sneakoscope 9.0.6 → 9.1.1

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.0.6** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.1.1** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.0.6"
+version = "9.1.1"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.0.6"
+version = "9.1.1"
 edition = "2021"
 
 [dependencies]

package/dist/cli/router.js

@@ -302,6 +302,9 @@ export function safeReadOnlySubcommand(command, args) {
     if (command === 'mcp' && sub === 'config' && ['list', 'test', 'backups', 'show'].includes(nested)) {
         return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
     }
+    if (command === 'codex-app' && sub === 'context-1m' && (nested === 'status' || nested === '' || nested.startsWith('--'))) {
+        return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
+    }
     if (command === 'remote' && ['readiness', 'status', 'show'].includes(sub)) {
         return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
     }

package/dist/commands/codex-app.js

@@ -16,6 +16,35 @@ export async function run(_command, args = []) {
     const action = args[0] || 'check';
     if (action === 'restart')
         return printCodexAppResult(args, await restartCodexApp());
+    if (action === 'context-1m') {
+        const { codexContext1mCommand } = await import('../core/codex-app/codex-context-window.js');
+        const result = await codexContext1mCommand(args.slice(1));
+        if (flag(args, '--json')) {
+            printJson(result);
+            if (!result.ok)
+                process.exitCode = 1;
+            return;
+        }
+        console.log(`Codex 1M Context: ${result.enabled ? 'enabled' : 'disabled'}`);
+        console.log(`Config: ${result.config_path}`);
+        console.log(`Model: ${result.model || 'not set'} (documented for ${result.expected_model})`);
+        for (const [key, target] of Object.entries(result.target)) {
+            const state = result.keys[key];
+            const detail = state?.present ? `${state.value ?? 'unparsed'}${state.managed ? ' (SKS-managed)' : ''}` : 'not set';
+            console.log(`${key}: ${detail} · target ${target}`);
+        }
+        if (result.restart)
+            console.log(`Restart: ${result.restart.status}${result.restart.reason ? ` (${result.restart.reason})` : ''}`);
+        for (const note of result.notes)
+            console.log(`Note: ${note}`);
+        for (const warning of result.warnings)
+            console.log(`- warning: ${warning}`);
+        for (const blocker of result.blockers)
+            console.log(`- blocker: ${blocker}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (action === 'remote-control' || action === 'remote')
         return codexAppRemoteControlCommand(args.slice(1));
     if (action === 'harness-matrix') {
@@ -108,7 +137,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|restart|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Usage: sks codex-app check|status|restart|context-1m [status|on|off] [--no-restart]|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
     console.error('Provider routing moved to: sks bridge provider configure|validate|enable; sks bridge catalog sync; sks bridge route set-default.');
     process.exitCode = 1;
 }

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.0.6",
+  "package_version": "9.1.1",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-app/codex-context-window.js

@@ -0,0 +1,227 @@
+import { exists, readText } from '../fsx.js';
+import { escapeRegExp } from '../text/regex.js';
+import { safeWriteCodexConfigToml } from '../codex-runtime/codex-desktop-config-policy.js';
+import { codexUserConfigPath, readTopLevelTomlString } from './codex-model-catalog.js';
+import { isCodexAppRunningByBundleId } from './menubar/config.js';
+import { restartCodexApp } from './codex-app-restart.js';
+export const CODEX_CONTEXT_1M_SCHEMA = 'sks.codex-context-1m.v1';
+export const CODEX_CONTEXT_1M_MARKER = 'sks-codex-context-1m';
+export const CODEX_CONTEXT_1M_TARGETS = {
+    model_context_window: 1_000_000,
+    model_auto_compact_token_limit: 900_000
+};
+export const CODEX_CONTEXT_1M_MODEL = 'gpt-5.6-sol';
+const MANAGED_KEYS = Object.keys(CODEX_CONTEXT_1M_TARGETS);
+function topLevelRegionEnd(lines) {
+    const first = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
+    return first === -1 ? lines.length : first;
+}
+function managedLine(key, previous) {
+    return `${key} = ${CODEX_CONTEXT_1M_TARGETS[key]} # ${CODEX_CONTEXT_1M_MARKER} prev=${previous}`;
+}
+function inspectKeyLines(lines, key) {
+    const end = topLevelRegionEnd(lines);
+    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    const managedPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*(\\d+)\\s*#\\s*${escapeRegExp(CODEX_CONTEXT_1M_MARKER)}\\s+prev=(unset|\\d+)\\s*$`);
+    const valuePattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*(\\d+)\\s*(?:#.*)?$`);
+    let state = null;
+    let duplicate = false;
+    for (let index = 0; index < end; index += 1) {
+        const line = lines[index] || '';
+        if (!keyPattern.test(line))
+            continue;
+        if (state) {
+            duplicate = true;
+            continue;
+        }
+        const managed = line.match(managedPattern);
+        const value = line.match(valuePattern);
+        state = {
+            present: true,
+            managed: Boolean(managed),
+            value: managed ? Number(managed[1]) : value ? Number(value[1]) : null,
+            previous: managed ? (managed[2] === 'unset' ? 'unset' : Number(managed[2])) : null,
+            duplicate: false,
+            lineIndex: index
+        };
+    }
+    if (!state)
+        return { present: false, managed: false, value: null, previous: null, duplicate: false, lineIndex: -1 };
+    return { ...state, duplicate };
+}
+export function inspectCodexContext1m(text) {
+    const lines = String(text || '').split('\n');
+    const warnings = [];
+    const keys = {};
+    for (const key of MANAGED_KEYS) {
+        const { lineIndex: _lineIndex, ...state } = inspectKeyLines(lines, key);
+        keys[key] = state;
+        if (state.duplicate)
+            warnings.push(`codex_context_duplicate_key:${key}`);
+        if (state.managed && state.value !== CODEX_CONTEXT_1M_TARGETS[key])
+            warnings.push(`codex_context_managed_value_drift:${key}`);
+    }
+    const enabled = MANAGED_KEYS.every((key) => keys[key].managed && keys[key].value === CODEX_CONTEXT_1M_TARGETS[key]);
+    return { enabled, model: readTopLevelTomlString(String(text || ''), 'model'), keys, warnings };
+}
+export function enableCodexContext1m(text) {
+    const source = String(text || '');
+    const lines = source.split('\n');
+    const blockers = [];
+    const previous = {};
+    for (const key of MANAGED_KEYS) {
+        const state = inspectKeyLines(lines, key);
+        if (state.duplicate)
+            blockers.push(`codex_context_duplicate_key:${key}`);
+        if (state.present && !state.managed && state.value === null)
+            blockers.push(`codex_context_unparseable_value:${key}`);
+    }
+    if (blockers.length)
+        return { next: source, changed: false, previous: {}, restored: {}, blockers, warnings: [] };
+    for (const key of MANAGED_KEYS) {
+        const state = inspectKeyLines(lines, key);
+        if (state.present) {
+            const prior = state.managed ? (state.previous ?? 'unset') : state.value;
+            previous[key] = prior;
+            lines[state.lineIndex] = managedLine(key, prior);
+        }
+        else {
+            previous[key] = 'unset';
+            lines.splice(topLevelRegionEnd(lines), 0, managedLine(key, 'unset'));
+        }
+    }
+    const next = lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
+    return { next, changed: next !== source, previous, restored: {}, blockers: [], warnings: [] };
+}
+export function disableCodexContext1m(text) {
+    const source = String(text || '');
+    const lines = source.split('\n');
+    const warnings = [];
+    const restored = {};
+    for (const key of MANAGED_KEYS) {
+        const state = inspectKeyLines(lines, key);
+        if (state.duplicate) {
+            return { next: source, changed: false, previous: {}, restored: {}, blockers: [`codex_context_duplicate_key:${key}`], warnings: [] };
+        }
+        if (!state.present)
+            continue;
+        if (!state.managed) {
+            warnings.push(`codex_context_unmanaged_key_left:${key}`);
+            continue;
+        }
+        const prior = state.previous ?? 'unset';
+        restored[key] = prior;
+        if (prior === 'unset')
+            lines.splice(state.lineIndex, 1);
+        else
+            lines[state.lineIndex] = `${key} = ${prior}`;
+    }
+    const next = lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
+    return { next, changed: next !== source, previous: {}, restored, blockers: [], warnings };
+}
+export function normalizeCodexContext1mAction(value) {
+    const text = String(value || 'status').toLowerCase();
+    if (['on', 'enable', 'enabled', '1m'].includes(text))
+        return 'on';
+    if (['off', 'disable', 'disabled', 'default'].includes(text))
+        return 'off';
+    return 'status';
+}
+export async function codexContext1mCommand(args = [], opts = {}) {
+    const env = opts.env || process.env;
+    const action = normalizeCodexContext1mAction(args[0]);
+    const noRestart = args.includes('--no-restart');
+    const configPath = codexUserConfigPath({ env, ...(opts.home ? { home: opts.home } : {}) });
+    const before = String(await readText(configPath, ''));
+    const fileExists = await exists(configPath);
+    const blockers = [];
+    const warnings = [];
+    let write = null;
+    let changed = false;
+    let afterText = before;
+    let mutation = null;
+    if (action === 'on' || action === 'off') {
+        mutation = action === 'on' ? enableCodexContext1m(before) : disableCodexContext1m(before);
+        blockers.push(...mutation.blockers);
+        warnings.push(...mutation.warnings);
+        if (!blockers.length && mutation.changed) {
+            write = await safeWriteCodexConfigToml(configPath, before, mutation.next, 'codex-context-1m', {
+                verifyUnchangedBeforeWrite: true,
+                expectedBeforeExists: fileExists
+            });
+            if (!write.ok) {
+                blockers.push(`codex_config_write_${write.status}`);
+            }
+            else {
+                changed = write.changed;
+                afterText = write.expected_after?.text ?? mutation.next;
+            }
+        }
+    }
+    const inspection = inspectCodexContext1m(afterText);
+    warnings.push(...inspection.warnings);
+    if (action === 'on' || inspection.enabled) {
+        if (!inspection.model)
+            warnings.push('codex_context_model_line_missing');
+        else if (inspection.model !== CODEX_CONTEXT_1M_MODEL)
+            warnings.push(`codex_context_active_model_not_${CODEX_CONTEXT_1M_MODEL}:${inspection.model}`);
+    }
+    let restart = null;
+    if ((action === 'on' || action === 'off') && !blockers.length) {
+        restart = await maybeRestartCodexApp({
+            env,
+            changed,
+            noRestart,
+            ...(opts.root === undefined ? {} : { root: opts.root }),
+            ...(opts.isRunningImpl === undefined ? {} : { isRunningImpl: opts.isRunningImpl }),
+            ...(opts.restartImpl === undefined ? {} : { restartImpl: opts.restartImpl })
+        });
+        if (restart.attempted && !restart.ok)
+            warnings.push('codex_restart_failed_manual_restart_required');
+    }
+    return {
+        schema: CODEX_CONTEXT_1M_SCHEMA,
+        ok: blockers.length === 0,
+        action,
+        enabled: inspection.enabled,
+        config_path: configPath,
+        model: inspection.model,
+        expected_model: CODEX_CONTEXT_1M_MODEL,
+        target: { ...CODEX_CONTEXT_1M_TARGETS },
+        keys: inspection.keys,
+        previous: mutation && action === 'on' ? mutation.previous : null,
+        restored: mutation && action === 'off' ? mutation.restored : null,
+        changed,
+        write: write ? { status: write.status, backup_path: write.backup_path } : null,
+        restart,
+        blockers,
+        warnings,
+        notes: [
+            'Only new Codex sessions pick up context-window changes; existing conversations keep their previous limits.',
+            'Requests with more than 272K input tokens are billed at the long-context rate (2x input / 1.5x output) for the entire request.'
+        ],
+        cli_commands: {
+            status: 'sks codex-app context-1m status',
+            on: 'sks codex-app context-1m on',
+            off: 'sks codex-app context-1m off'
+        }
+    };
+}
+async function maybeRestartCodexApp(input) {
+    const skippedOutcome = (reason) => ({ attempted: false, running: null, status: 'skipped', reason, ok: true, blockers: [] });
+    if (input.noRestart)
+        return skippedOutcome('no_restart_flag');
+    if (!input.changed)
+        return skippedOutcome('config_unchanged');
+    if (input.env.SKS_SKIP_CODEX_APP_RESTART === '1')
+        return skippedOutcome('SKS_SKIP_CODEX_APP_RESTART');
+    if (process.platform !== 'darwin')
+        return skippedOutcome('not_macos');
+    const bundleId = String(input.env.SKS_CODEX_APP_BUNDLE_ID || 'com.openai.codex');
+    const running = await (input.isRunningImpl || isCodexAppRunningByBundleId)(bundleId, input.env);
+    if (!running) {
+        return { attempted: false, running: false, status: 'skipped', reason: 'codex_not_running', ok: true, blockers: [] };
+    }
+    const result = await (input.restartImpl || restartCodexApp)({ env: input.env, ...(input.root ? { root: input.root } : {}) });
+    return { attempted: true, running: true, status: result.status, reason: null, ok: result.ok, blockers: result.blockers };
+}

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -148,6 +148,34 @@ function safeUpstreamErrorId(value) {
     const text = String(value ?? '').trim();
     return /^[A-Za-z0-9_.:-]{1,64}$/.test(text) ? text : null;
 }
+const TRANSIENT_UPSTREAM_STATUSES = new Set([500, 502, 503, 524]);
+const TRANSIENT_UPSTREAM_IDENTIFIERS = new Set(['upstream_error', 'upstream_request_timeout']);
+export const TRANSIENT_UPSTREAM_REPLAY_LIMIT = 3;
+const TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS = [200, 400, 800];
+function isTransientUpstreamIdentifier(value) {
+    return Boolean(value && TRANSIENT_UPSTREAM_IDENTIFIERS.has(value));
+}
+function delay(ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref();
+    });
+}
+function isTransientUpstreamFailure(statusCode, upstreamType, upstreamCode) {
+    if (statusCode === 429)
+        return false;
+    if (statusCode === 404) {
+        return isTransientUpstreamIdentifier(upstreamType) || isTransientUpstreamIdentifier(upstreamCode);
+    }
+    return TRANSIENT_UPSTREAM_STATUSES.has(statusCode);
+}
+function redactedUpstreamClientMessage(statusCode, transient) {
+    if (statusCode === 429)
+        return 'rate_limited';
+    if (transient)
+        return 'temporary_upstream_failure';
+    return 'bridge_upstream_request_failed';
+}
 async function readRedactedUpstreamError(response) {
     let total = 0;
     const chunks = [];
@@ -169,19 +197,18 @@ async function readRedactedUpstreamError(response) {
     }
     catch {
     }
-    return {
-        upstreamCode,
-        upstreamType,
-        body: Buffer.from(JSON.stringify({
-            error: {
-                type: 'upstream_error',
-                code: 'bridge_upstream_request_failed',
-                message: 'Upstream request failed',
-                ...(upstreamType ? { upstream_type: upstreamType } : {}),
-                ...(upstreamCode ? { upstream_code: upstreamCode } : {})
-            }
-        }))
-    };
+    return { upstreamCode, upstreamType };
+}
+function buildRedactedUpstreamErrorBody(statusCode, upstreamCode, upstreamType, transient) {
+    return Buffer.from(JSON.stringify({
+        error: {
+            type: 'upstream_error',
+            code: 'bridge_upstream_request_failed',
+            message: redactedUpstreamClientMessage(statusCode, transient),
+            ...(upstreamType ? { upstream_type: upstreamType } : {}),
+            ...(upstreamCode ? { upstream_code: upstreamCode } : {}),
+        },
+    }));
 }
 const upstreamAgents = new Map();
 function upstreamAgent(secure, key, idleTimeoutMs) {
@@ -240,7 +267,7 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
             delete headers['content-encoding'];
         const agent = upstreamAgent(provider.remote.secure, `${provider.remote.address}:${provider.remote.port}`, config.idleTimeoutMs);
         const replayable = Buffer.isBuffer(request.body);
-        const attempt = (useFreshConnection) => new Promise((resolve, reject) => {
+        const attempt = (useFreshConnection, canReplay) => new Promise((resolve, reject) => {
             let responseStarted = false;
             let settled = false;
             const abort = () => { if (!res.writableEnded)
@@ -273,15 +300,17 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
             upstream.once('response', (response) => {
                 const statusCode = response.statusCode || 502;
                 if (statusCode >= 400) {
-                    void readRedactedUpstreamError(response).then(({ body, upstreamCode, upstreamType }) => {
-                        const transientMislabel = statusCode === 404
-                            && (upstreamType === 'upstream_error' || upstreamCode === 'upstream_error');
-                        if (transientMislabel && replayable && !useFreshConnection) {
+                    void readRedactedUpstreamError(response).then(({ upstreamCode, upstreamType }) => {
+                        const transientMislabel = isTransientUpstreamFailure(statusCode, upstreamType, upstreamCode);
+                        if (transientMislabel && replayable && canReplay) {
                             responseStarted = true;
-                            finish(new StalePooledSocketFailure(new DesktopBridgeError('bridge_upstream_transient_mislabel')));
+                            finish(new StalePooledSocketFailure(new DesktopBridgeError(upstreamCode === 'upstream_request_timeout'
+                                ? 'bridge_upstream_request_timeout'
+                                : 'bridge_upstream_transient_mislabel')));
                             return;
                         }
                         const clientStatus = transientMislabel ? 503 : statusCode;
+                        const body = buildRedactedUpstreamErrorBody(statusCode, upstreamCode, upstreamType, transientMislabel);
                         logHttpRejection({
                             code: transientMislabel
                                 ? `bridge_upstream_status_${statusCode}_translated_503`
@@ -298,6 +327,8 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                         responseHeaders['content-length'] = String(body.length);
                         delete responseHeaders['transfer-encoding'];
                         if (transientMislabel)
+                            responseHeaders['retry-after'] = String(responseHeaders['retry-after'] || '10');
+                        if (statusCode === 429 && !responseHeaders['retry-after'])
                             responseHeaders['retry-after'] = '10';
                         res.writeHead(clientStatus, responseHeaders);
                         res.end(body, () => finish());
@@ -321,21 +352,34 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 void pipeline(req, upstream).catch((error) => { if (!responseStarted)
                     finish(error); });
         });
-        try {
-            await attempt(false);
-        }
-        catch (error) {
-            if (!(error instanceof StalePooledSocketFailure))
-                throw error;
-            agent.destroy();
-            upstreamAgents.delete(`${provider.remote.secure ? 'https' : 'http'}:${provider.remote.address}:${provider.remote.port}`);
-            logHttpRejection({
-                code: `bridge_upstream_socket_stale_replayed:${underlyingErrorCode(error.reason) || 'unknown'}`,
-                transport: 'http',
-                ...(req.method === undefined ? {} : { method: req.method }),
-                ...(req.url === undefined ? {} : { url: req.url }),
-            });
-            await attempt(true);
+        let remainingReplays = replayable ? TRANSIENT_UPSTREAM_REPLAY_LIMIT : 0;
+        let useFreshConnection = false;
+        for (;;) {
+            try {
+                await attempt(useFreshConnection, remainingReplays > 0);
+                return;
+            }
+            catch (error) {
+                if (!(error instanceof StalePooledSocketFailure) || remainingReplays <= 0)
+                    throw error;
+                remainingReplays -= 1;
+                if (!useFreshConnection) {
+                    agent.destroy();
+                    upstreamAgents.delete(`${provider.remote.secure ? 'https' : 'http'}:${provider.remote.address}:${provider.remote.port}`);
+                }
+                logHttpRejection({
+                    code: `bridge_upstream_socket_stale_replayed:${underlyingErrorCode(error.reason) || 'unknown'}`,
+                    transport: 'http',
+                    ...(req.method === undefined ? {} : { method: req.method }),
+                    ...(req.url === undefined ? {} : { url: req.url }),
+                });
+                useFreshConnection = true;
+                const backoffIndex = TRANSIENT_UPSTREAM_REPLAY_LIMIT - remainingReplays - 1;
+                const backoffMs = TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS[Math.max(0, backoffIndex)]
+                    ?? TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS[TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS.length - 1];
+                if (backoffMs)
+                    await delay(backoffMs);
+            }
         }
     }
     catch (error) {

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -8,7 +8,7 @@ import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridg
 import { DesktopBridgeError } from './types.js';
 import { PACKAGE_VERSION } from '../../version.js';
 import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL } from './types.js';
-import { forwardWebSocket } from './websocket-forward.js';
+import { forwardWebSocket, safeEndUpgradeSocket } from './websocket-forward.js';
 function authenticateDesktopBridgeClient(req, input) {
     const raw = String(req.url || '/');
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) || raw.startsWith('//') || /[\r\n\0]/.test(raw)) {
@@ -135,22 +135,14 @@ function writeUpgradeRejection(socket, error, req) {
         url: req?.url,
         status: rejectionStatus(safeBridgeErrorCode(error)),
     });
-    socket.on('error', () => undefined);
-    if (socket.destroyed || socket.writableEnded)
-        return;
     const code = safeBridgeErrorCode(error);
     const status = rejectionStatus(code);
-    try {
-        socket.end(`HTTP/1.1 ${status} ${rejectionStatusText(status)}\r\n`
-            + 'Content-Type: application/json\r\n'
-            + 'Cache-Control: no-store\r\n'
-            + 'Connection: close\r\n'
-            + '\r\n'
-            + JSON.stringify({ error: { type: 'sks_bridge_rejection', code, message: code } }));
-    }
-    catch {
-        socket.destroy();
-    }
+    safeEndUpgradeSocket(socket, `HTTP/1.1 ${status} ${rejectionStatusText(status)}\r\n`
+        + 'Content-Type: application/json\r\n'
+        + 'Cache-Control: no-store\r\n'
+        + 'Connection: close\r\n'
+        + '\r\n'
+        + JSON.stringify({ error: { type: 'sks_bridge_rejection', code, message: code } }));
 }
 function writeDiagnosticHealth(req, res, input) {
     if (req.method !== 'GET')

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -107,6 +107,17 @@ const PERMANENT_UPGRADE_REFUSALS = new Set([
     'catalog_model_route_missing',
     'bridge_provider_route_unavailable',
 ]);
+export function safeEndUpgradeSocket(socket, payload) {
+    socket.on('error', () => undefined);
+    if (socket.destroyed || socket.writableEnded)
+        return;
+    try {
+        socket.end(payload);
+    }
+    catch {
+        socket.destroy();
+    }
+}
 function writeUpgradeFailure(client, error, req) {
     const code = safeBridgeErrorCode(error) || 'bridge_websocket_upstream_unavailable';
     const permanent = PERMANENT_UPGRADE_REFUSALS.has(code);
@@ -119,9 +130,7 @@ function writeUpgradeFailure(client, error, req) {
         ...(req?.url === undefined ? {} : { url: req.url }),
         status,
     });
-    if (client.destroyed)
-        return;
-    client.end(`HTTP/1.1 ${status} ${reason}\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n`
+    safeEndUpgradeSocket(client, `HTTP/1.1 ${status} ${reason}\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n`
         + JSON.stringify({ error: { type: 'sks_bridge_error', code, retryable: !permanent } }));
 }
 export async function forwardWebSocket(req, client, head, config, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {

package/dist/core/hooks-runtime/official-subagent-lifecycle.js

@@ -18,6 +18,28 @@ import { MAX_LIFECYCLE_THREADS } from './subagent-skill-availability-contract.js
 import { officialSubagentEvidenceReady, terminalBlockedNarutoGate } from '../subagents/terminal-subagent-state.js';
 const SUBAGENT_LIFECYCLE_CAPTURE_FAILURE_SCHEMA = 'sks.subagent-lifecycle-capture-failure.v1';
 const MAX_SUBAGENT_LIFECYCLE_CAPTURE_FAILURES = 528;
+export const ACTIVE_OFFICIAL_WORKFLOW_IDLE_MS = 2 * 60 * 60 * 1000;
+function parseIsoMs(value) {
+    const parsed = Date.parse(String(value || ''));
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+export function officialWorkflowLastActivityMs(input) {
+    const times = [
+        parseIsoMs(input.plan?.created_at),
+        parseIsoMs(input.plan?.updated_at),
+        parseIsoMs(input.plan?.wave_lifecycle?.updated_at),
+        parseIsoMs(input.plan?.wave_lifecycle?.created_at),
+        parseIsoMs(input.gate?.updated_at),
+        parseIsoMs(input.gate?.created_at),
+        ...(input.events || []).map((event) => parseIsoMs(event.occurred_at ?? event.ts))
+    ];
+    return times.reduce((max, value) => (value > max ? value : max), 0);
+}
+export function officialWorkflowIsIdle(activityMs, nowMs = Date.now()) {
+    if (activityMs <= 0)
+        return true;
+    return nowMs - activityMs > ACTIVE_OFFICIAL_WORKFLOW_IDLE_MS;
+}
 export async function inspectActiveOfficialSubagentWorkflow(root, state, sessionKey = null) {
     const missionId = String(state?.mission_id || '').trim();
     const workflowRunId = String(state?.official_subagent_run_id || '').trim();
@@ -71,8 +93,14 @@ export async function inspectActiveOfficialSubagentWorkflow(root, state, session
             if (events.length > 0 && openThreads !== liveThreads.size) {
                 return { status: 'invalid', missionId, workflowRunId, reason: 'active_lifecycle_event_mismatch' };
             }
+            if (officialWorkflowIsIdle(officialWorkflowLastActivityMs({ plan, gate, events }))) {
+                return { status: 'inactive' };
+            }
             return { status: 'active', missionId, workflowRunId, openThreads };
         }
+        if (officialWorkflowIsIdle(officialWorkflowLastActivityMs({ plan, gate, events }))) {
+            return { status: 'inactive' };
+        }
         return { status: 'active', missionId, workflowRunId, openThreads: liveThreads.size };
     }
     catch {

package/dist/core/hooks-runtime.js

@@ -2,7 +2,7 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { projectRoot, readJson, writeJsonAtomic, writeTextAtomic, appendJsonl, nowIso, sha256, packageRoot } from './fsx.js';
 import { looksInteractiveCommand, interactiveCommandReason } from './no-question-guard.js';
-import { loadStateForSession, missionDir, sessionStateKey, setCurrent, stateFileForSession } from './mission.js';
+import { loadOwnedRouteState, missionDir, sessionStateKey, setCurrent, stateFileForSession } from './mission.js';
 import { checkDbOperation, dbBlockReason, handleMadSksUserConfirmation } from './db-safety.js';
 import { maybeRecordMadSksSqlPlaneToolResultFromToolUse } from './mad-sks/sql-plane/result-lifecycle.js';
 import { checkHarnessModification, harnessGuardBlockReason, isHarnessSourceProject } from './harness-guard.js';
@@ -53,7 +53,7 @@ export { selftestCodexCommitHooks } from './hooks-runtime/codex-commit-hooks-sel
 async function loadState(root, payload = {}) {
     const sessionKey = conversationId(payload);
     if (!explicitConversationId(payload))
-        return loadStateForSession(root, sessionKey);
+        return loadOwnedRouteState(root);
     const hashed = sessionStateKey(sessionKey);
     const sessionState = await readJson(stateFileForSession(root, sessionKey), null).catch(() => null);
     return sessionState ? { ...sessionState, _session_key: sessionState._session_key || hashed } : {};

package/dist/core/init/skills.js

@@ -228,6 +228,12 @@ export async function installProjectSkills(root) {
 export async function installSkills(root) {
     return installGlobalSkills(root);
 }
+function hostExtraRemovedSkillTargets(home) {
+    return [
+        { scope: 'global-host-extra', ownerRoot: home, targetDir: path.join(home, '.cursor', 'skills'), managedOnly: true },
+        { scope: 'global-host-extra', ownerRoot: home, targetDir: path.join(home, '.claude', 'skills'), managedOnly: true },
+    ];
+}
 export async function cleanupRemovedSksSkillResidue(opts) {
     const projectRoot = path.resolve(opts.root);
     const home = path.resolve(opts.home || os.homedir());
@@ -238,7 +244,8 @@ export async function cleanupRemovedSksSkillResidue(opts) {
         { scope: 'project', ownerRoot: projectRoot, targetDir: path.join(projectRoot, '.agents', 'skills') },
         { scope: 'project-codex', ownerRoot: projectRoot, targetDir: path.join(projectRoot, '.codex', 'skills') },
         { scope: 'global-runtime', ownerRoot: globalRuntimeRoot, targetDir: path.join(globalRuntimeRoot, '.agents', 'skills') },
-        { scope: 'global-runtime-codex', ownerRoot: globalRuntimeRoot, targetDir: path.join(globalRuntimeRoot, '.codex', 'skills') }
+        { scope: 'global-runtime-codex', ownerRoot: globalRuntimeRoot, targetDir: path.join(globalRuntimeRoot, '.codex', 'skills') },
+        ...hostExtraRemovedSkillTargets(home),
     ];
     if (projectRoot !== home && projectRoot !== globalRuntimeRoot) {
         const scan = await collectNestedProjectRoots(projectRoot, new Set([home, globalRuntimeRoot]));
@@ -365,6 +372,8 @@ async function reconcileRemovedSkillTargets(targets, fix) {
                 remaining.push(displayPath);
                 continue;
             }
+            if (!managed && target.managedOnly)
+                continue;
             detected.push({
                 scope: target.scope,
                 name,
@@ -394,7 +403,7 @@ async function reconcileRemovedSkillTargets(targets, fix) {
             quarantinedManifestCollisions,
             remaining,
             errors
-        });
+        }, { managedOnly: target.managedOnly === true });
         if (fix)
             await removeEmptySkillParents(target, errors);
     }
@@ -448,7 +457,7 @@ async function removeEmptySkillParents(target, errors) {
         }
     }
 }
-async function reconcileRemovedSkillManifests(target, rowByName, fix, report) {
+async function reconcileRemovedSkillManifests(target, rowByName, fix, report, opts = {}) {
     for (const fileName of [SKS_SKILL_MANIFEST_FILE, 'skills-manifest.json']) {
         if (!rowByName.has(fileName))
             continue;
@@ -466,6 +475,8 @@ async function reconcileRemovedSkillManifests(target, rowByName, fix, report) {
         if (!inspection.exists)
             continue;
         if (inspection.leafSymlink || !inspection.stat?.isFile()) {
+            if (opts.managedOnly)
+                continue;
             if (fix) {
                 try {
                     await quarantineSkillDir(target.ownerRoot, manifestPath, fileName, 'removed-skill-manifest-collision');
@@ -496,6 +507,8 @@ async function reconcileRemovedSkillManifests(target, rowByName, fix, report) {
         catch {
             if (!manifestTextContainsRetiredJsonValue(text))
                 continue;
+            if (opts.managedOnly)
+                continue;
             if (fix) {
                 try {
                     await quarantineSkillDir(target.ownerRoot, manifestPath, fileName, 'unparseable-removed-skill-manifest-collision');
@@ -514,6 +527,8 @@ async function reconcileRemovedSkillManifests(target, rowByName, fix, report) {
         if (!scrubbed.valid) {
             if (!scrubbed.hasRetiredResidue)
                 continue;
+            if (opts.managedOnly)
+                continue;
             if (fix) {
                 try {
                     await quarantineSkillDir(target.ownerRoot, manifestPath, fileName, 'unmanaged-removed-skill-manifest-collision');
@@ -726,7 +741,7 @@ async function reconcileSkillsUnlocked(opts) {
             scope: 'global-runtime-codex',
             ownerRoot: globalRuntimeRoot,
             targetDir: path.join(globalRuntimeRoot, '.codex', 'skills')
-        });
+        }, ...hostExtraRemovedSkillTargets(root));
     }
     const removedResidue = await reconcileRemovedSkillTargets(removedResidueTargets, opts.fix);
     report.retired_residue = {

package/dist/core/routes.js

@@ -644,7 +644,7 @@ export const COMMAND_CATALOG = [
     { name: 'uninstall', usage: 'sks uninstall [--dry-run] [--yes] [--keep-config] [--keep-data] [--purge-projects] [--json]', description: 'Remove SKS global skills, hooks, menu bar, state, temp files, and optional project residue while preserving user-owned content by default.' },
     { name: 'deps', usage: 'sks deps check [--json] [--yes]', description: 'Check Node/npm and Codex CLI readiness; pass --yes to repair missing Codex CLI tooling when supported.' },
     { name: 'codex', usage: 'sks codex compatibility|version|update-status [--refresh]|update|doctor|schema|current [--json]', description: 'Check Codex CLI compatibility/version/update status, run the official `codex update`, and inspect current manifest, capability, and hook-schema evidence.' },
-    { name: 'codex-app', usage: 'sks codex-app [check|status|restart|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App integration, Desktop Bridge readiness, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, and Codex CLI remote-control availability. Provider routing is managed only by sks bridge.' },
+    { name: 'codex-app', usage: 'sks codex-app [check|status|restart|context-1m [status|on|off]|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App integration, Desktop Bridge readiness, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, Codex CLI remote-control availability, and the opt-in GPT-5.6 Sol 1M context window toggle with automatic Codex restart. Provider routing is managed only by sks bridge.' },
     { name: 'codex-native', usage: 'sks codex-native status|feature-broker|invocation-plan|init-deep [--json]', description: 'Inspect Codex Native feature broker readiness, invocation routing, pattern evidence, and managed memory setup.' },
     { name: 'hooks', usage: 'sks hooks explain|status|trust-report|replay|codex-validate|warning-check ... [--json]', description: 'Explain Codex hook events, validate current vendored event output schemas, replay fixtures, and enforce warning-zero SKS hook policies.' },
     { name: 'remote', usage: 'sks remote readiness|machines|worker ... [--json]', description: 'Inspect official Codex Remote readiness and the allowlisted proof-aware SSH stdio worker surface.' },

package/dist/core/update/update-migration-state/simple-stages.js

@@ -1,32 +1,38 @@
 import { codexHookTrustDoctor } from '../../codex-hooks/codex-hook-trust-doctor.js';
 export async function runOtherHarnessCleanupStage(root) {
-    const { scanHarnessConflicts } = await import('../../harness-conflicts.js');
+    const { cleanupOtherHarnessConflicts, scanHarnessConflicts } = await import('../../harness-conflicts.js');
     const scan = await scanHarnessConflicts(root);
-    if (scan.hard_block) {
+    if (!scan.hard_block) {
         return {
-            ok: false,
-            status: 'failed',
-            actions: ['other_harness_conflict_detected'],
-            blockers: scan.hard.map((row) => `other_harness_conflict:${row.path}`),
+            ok: true,
+            status: 'ok',
+            actions: ['other_harness_conflict_check_clean'],
+            blockers: [],
             warnings: [],
             detail: {
                 cleaned_count: 0,
-                remaining_count: scan.hard.length,
-                error_count: 0,
-                cleanup_prompt_command: 'sks conflicts cleanup --yes'
+                remaining_count: 0,
+                error_count: 0
             }
         };
     }
+    const cleanup = await cleanupOtherHarnessConflicts(root);
+    const remaining = Array.isArray(cleanup.remaining) ? cleanup.remaining : [];
+    const errors = Array.isArray(cleanup.errors) ? cleanup.errors : [];
+    const blockers = [
+        ...remaining.map((row) => `other_harness_conflict:${row.path || 'unknown'}`),
+        ...errors.map((row) => `other_harness_cleanup_failed:${row.path || 'unknown'}:${row.error || 'error'}`),
+    ];
     return {
-        ok: true,
-        status: 'ok',
-        actions: ['other_harness_conflict_check_clean'],
-        blockers: [],
+        ok: blockers.length === 0,
+        status: blockers.length ? 'failed' : 'ok',
+        actions: ['other_harness_conflicts_quarantined'],
+        blockers,
         warnings: [],
         detail: {
-            cleaned_count: 0,
-            remaining_count: 0,
-            error_count: 0
+            cleaned_count: Array.isArray(cleanup.cleaned) ? cleanup.cleaned.length : 0,
+            remaining_count: remaining.length,
+            error_count: errors.length
         }
     };
 }

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '9.0.6';
+export const PACKAGE_VERSION = '9.1.1';

package/dist/native/sks-menubar/Sources/ControlCenterWindowController.swift

@@ -30,7 +30,7 @@ final class ControlCenterWindowController: NSWindowController, NSTableViewDataSo
             .providers: ProvidersViewController(processClient: processClient, operations: operations),
             .remoteCoding: RemoteCodingViewController(),
             .diagnostics: DiagnosticsViewController(processClient: processClient, operations: operations),
-            .settings: SettingsViewController(notifications: notifications)
+            .settings: SettingsViewController(processClient: processClient, operations: operations, notifications: notifications)
         ]
         let window = NSWindow(
             contentRect: NSRect(x: 0, y: 0, width: 860, height: 560),

package/dist/native/sks-menubar/Sources/SettingsViewController.swift

@@ -8,22 +8,41 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
         case malformed
     }
 
+    private let processClient: ProcessClient
+    private let operations: OperationCoordinator
     private let notifications: NotificationCoordinator
     private let followCodexLifecycle = NSButton(checkboxWithTitle: "Show SKS Menu only while Codex is running", target: nil, action: nil)
     private let status = NativeView.detail("Settings use the native app configuration file.")
+    private let contextStatus = NativeView.detail("Codex 1M context: checking current state…")
     private var notificationButton: NSButton!
-    init(notifications: NotificationCoordinator) { self.notifications = notifications; super.init(nibName: nil, bundle: nil) }
+    private var contextToggleButton: NSButton!
+    private var contextEnabled: Bool?
+    private var contextBusy = false
+    private var contextGeneration = 0
+    init(processClient: ProcessClient, operations: OperationCoordinator, notifications: NotificationCoordinator) {
+        self.processClient = processClient
+        self.operations = operations
+        self.notifications = notifications
+        super.init(nibName: nil, bundle: nil)
+    }
     required init?(coder: NSCoder) { nil }
 
     override func loadView() {
         followCodexLifecycle.target = self; followCodexLifecycle.action = #selector(save)
         followCodexLifecycle.setAccessibilityLabel("Show SKS Menu only while Codex is running")
         notificationButton = NativeView.button("Enable Notifications", target: self, action: #selector(enableNotifications))
+        contextToggleButton = NativeView.button("Enable 1M Context", target: self, action: #selector(toggleContext1m))
+        contextToggleButton.isEnabled = false
         let lifecycleCard = NativeView.card(
             title: "Codex lifecycle",
             subtitle: "On keeps a lightweight observer running, hides the icon when Codex is closed, and shows it automatically when Codex opens.",
             views: [followCodexLifecycle]
         )
+        let contextCard = NativeView.card(
+            title: "Codex 1M Context",
+            subtitle: "Opt Codex into the documented 1,000,000-token context window for GPT-5.6 Sol (model_context_window = 1000000, model_auto_compact_token_limit = 900000 in ~/.codex/config.toml). Requests beyond 272K input tokens bill the entire request at the long-context rate, only new sessions pick up the change, and Codex restarts automatically when it is running. Off restores the previous value.",
+            views: [NativeView.row([contextToggleButton]), contextStatus]
+        )
         let notificationsCard = NativeView.card(
             title: "Notifications",
             subtitle: "Operation results always stay available in Control Center, even when notifications are denied.",
@@ -31,11 +50,12 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
         )
         view = NativeView.page([
             ControlKit.header("Settings", "These options stay on this Mac. Notification permission and Codex lifecycle behavior never leave the machine."),
-            lifecycleCard, notificationsCard
+            lifecycleCard, contextCard, notificationsCard
         ])
     }
 
     func refreshOnAppear() {
+        refreshContext1m()
         let configResult = readConfig()
         switch configResult {
         case .loaded(let config):
@@ -67,6 +87,101 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
         }
     }
 
+    private func refreshContext1m(preserveStatusText: Bool = false) {
+        contextGeneration += 1
+        let requestGeneration = contextGeneration
+        processClient.run(["codex-app", "context-1m", "status", "--json"], timeout: NativeView.statusTimeout) { [weak self] result in
+            guard let self = self, self.contextGeneration == requestGeneration, !self.contextBusy else { return }
+            guard let json = self.json(result.output),
+                  json["schema"] as? String == "sks.codex-context-1m.v1",
+                  json["ok"] as? Bool == true,
+                  let enabled = json["enabled"] as? Bool else {
+                self.contextEnabled = nil
+                self.contextToggleButton.isEnabled = false
+                if !preserveStatusText {
+                    self.contextStatus.stringValue = "Codex 1M context state unavailable · update SKS, then reopen Settings."
+                    self.contextStatus.textColor = .systemOrange
+                }
+                return
+            }
+            self.contextEnabled = enabled
+            self.contextToggleButton.isEnabled = true
+            self.contextToggleButton.title = enabled ? "Disable 1M Context" : "Enable 1M Context"
+            guard !preserveStatusText else { return }
+            let model = json["model"] as? String
+            var text = enabled
+                ? "Enabled · window 1,000,000 · auto-compact 900,000 · applies to new sessions only."
+                : "Disabled · Codex uses its tuned default context window."
+            var tone: NSColor = enabled ? .systemGreen : .secondaryLabelColor
+            if enabled, let model = model, model != "gpt-5.6-sol" {
+                text += " Active model is \(model); the 1M window is documented for gpt-5.6-sol."
+                tone = .systemOrange
+            }
+            self.contextStatus.stringValue = text
+            self.contextStatus.textColor = tone
+        }
+    }
+
+    @objc private func toggleContext1m() {
+        guard !contextBusy, let enabled = contextEnabled else { return }
+        let verb = enabled ? "off" : "on"
+        guard let snapshot = operations.begin(
+            kind: "codex-context-1m",
+            mutationGroup: "codex-config",
+            summary: enabled ? "Disable Codex 1M context" : "Enable Codex 1M context"
+        ) else {
+            contextStatus.stringValue = "Another guarded mutation is running. Try again after it completes."
+            contextStatus.textColor = .systemOrange
+            return
+        }
+        contextBusy = true
+        contextToggleButton.isEnabled = false
+        contextStatus.stringValue = enabled ? "Disabling 1M context…" : "Enabling 1M context and restarting Codex if it is running…"
+        contextStatus.textColor = .secondaryLabelColor
+        _ = operations.update(snapshot, state: .running, stage: "applying", progress: nil, summary: contextStatus.stringValue)
+        processClient.run(["codex-app", "context-1m", verb, "--json"], timeout: NativeView.mutationTimeout) { [weak self] result in
+            guard let self = self else { return }
+            self.contextBusy = false
+            self.contextToggleButton.isEnabled = true
+            let json = self.json(result.output)
+            let ok = result.code == 0
+                && json?["schema"] as? String == "sks.codex-context-1m.v1"
+                && json?["ok"] as? Bool == true
+            let summary: String
+            if ok {
+                let restart = json?["restart"] as? [String: Any]
+                let applied = verb == "on" ? "1M context enabled" : "1M context disabled"
+                if restart?["status"] as? String == "restarted" {
+                    summary = "\(applied) · Codex restarted — start a new session to apply it."
+                } else if restart?["reason"] as? String == "codex_not_running" {
+                    summary = "\(applied) · Codex is not running — the change applies on its next launch."
+                } else if restart?["reason"] as? String == "config_unchanged" {
+                    summary = "\(applied) · configuration already matched; nothing restarted."
+                } else {
+                    summary = "\(applied) · restart Codex manually, then start a new session."
+                }
+            } else {
+                let blocker = (json?["blockers"] as? [String])?.first
+                summary = blocker.map { "1M context change failed · \($0)" } ?? "1M context change failed · unexpected CLI response."
+            }
+            _ = self.operations.update(snapshot, state: ok ? .succeeded : .failed, stage: "complete", progress: 1, summary: summary)
+            self.contextStatus.stringValue = summary
+            self.contextStatus.textColor = ok ? .systemGreen : .systemRed
+            self.refreshContext1m(preserveStatusText: true)
+        }
+    }
+
+    private func json(_ text: String) -> [String: Any]? {
+        guard let data = text.data(using: .utf8) else { return nil }
+        if let object = try? JSONSerialization.jsonObject(with: data) as? [String: Any] { return object }
+        // Child processes may print banner lines before JSON; prefer the last
+        // top-level object payload, matching the Overview parser.
+        guard let start = text.range(of: "{", options: [.backwards])?.lowerBound else { return nil }
+        let slice = String(text[start...])
+        guard let sliced = slice.data(using: .utf8) else { return nil }
+        return try? JSONSerialization.jsonObject(with: sliced) as? [String: Any]
+    }
+
     @objc private func enableNotifications() {
         if notifications.authorizationDenied {
             guard openSystemSettings() else {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "9.0.6",
+  "version": "9.1.1",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",