sneakoscope 9.2.3 → 9.2.5

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.2.3** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.2.5** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.2.3"
+version = "9.2.5"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.2.3"
+version = "9.2.5"
 edition = "2021"
 
 [dependencies]

package/dist/commands/bridge.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { readStdin } from '../core/fsx.js';
+import { BRIDGE_CLI_BOOLEAN_OPTIONS, BRIDGE_CLI_VALUE_OPTIONS, DESKTOP_BRIDGE_SUPERVISED_FLAG, isBridgeCliBooleanOption, isBridgeCliValueOption } from '../core/codex-lb/bridge-cli-contract.js';
 import { serveDesktopBridge } from '../core/codex-lb/desktop-service.js';
 import { BridgeCliError, errorOutput, mergeMetadata, ordinaryOutput, sanitizeBridgeValue, textSummary, verificationOutput } from './bridge-command-output.js';
 const CONTROLLER_FACADE_EXPORT = 'executeDesktopBridgeCommand';
@@ -117,7 +118,7 @@ async function parseInvocation(args, io) {
         return { ...base, request: { operation: 'status' }, label: 'Desktop Bridge status' };
     }
     if (area === 'serve' && action === undefined) {
-        allowOnly(parsed, ['--json', '--supervised'], ['--settings']);
+        allowOnly(parsed, ['--json', DESKTOP_BRIDGE_SUPERVISED_FLAG], ['--settings']);
         const settingsPath = parsed.values.get('--settings') || '';
         if (!path.isAbsolute(settingsPath)) {
             throw new BridgeCliError('desktop_bridge_settings_path_must_be_absolute');
@@ -280,10 +281,8 @@ function parseArgs(args) {
     const positionals = [];
     const flags = new Set();
     const values = new Map();
-    const booleanOptions = new Set([
-        '--json', '--strict', '--require-ready', '--api-key-stdin', '--confirm'
-    ]);
-    const valueOptions = new Set(['--level', '--host', '--settings', '--set']);
+    const booleanOptions = new Set(BRIDGE_CLI_BOOLEAN_OPTIONS);
+    const valueOptions = new Set(BRIDGE_CLI_VALUE_OPTIONS);
     for (let index = 0; index < args.length; index += 1) {
         const value = String(args[index] || '');
         if (!value.startsWith('--')) {
@@ -323,6 +322,10 @@ function rejectSecretArgv(args) {
     }
 }
 function allowOnly(parsed, allowedFlags, allowedValues) {
+    if (allowedFlags.some((entry) => !isBridgeCliBooleanOption(entry))
+        || allowedValues.some((entry) => !isBridgeCliValueOption(entry))) {
+        throw new BridgeCliError('bridge_command_option_table_desynchronized');
+    }
     const flags = new Set(allowedFlags);
     const values = new Set(allowedValues);
     if ([...parsed.flags].some((entry) => !flags.has(entry))) {

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.2.3",
+  "package_version": "9.2.5",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex/codex-feature-flags.js

@@ -2,9 +2,9 @@ export const MANAGED_CODEX_FEATURE_FLAGS = Object.freeze(['hooks', 'fast_mode',
 export const REMOVED_CODEX_FEATURE_FLAGS = Object.freeze([
     'fast_mode_ui',
     'codex_hooks',
+    'multi_agent_mode',
     'remote_control',
     'codex_git_commit',
     'plugin_hooks',
-    'js_repl',
-    'multi_agent_mode'
+    'js_repl'
 ]);

package/dist/core/codex-control/codex-current-collab-agent-real-probe.js

@@ -3,7 +3,10 @@ import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { ensureDir, runProcess } from '../fsx.js';
 import { codexCurrentCoreProbeTail, skippedCodexCurrentCoreProbe } from './codex-current-core-real-probes.js';
-const CURRENT_COLLAB_TOOLS = ['spawnAgent', 'sendInput', 'resumeAgent', 'wait', 'closeAgent'];
+const CURRENT_COLLAB_TOOLS = [
+    'spawnAgent', 'sendInput', 'resumeAgent', 'wait', 'closeAgent',
+    'sendMessage', 'followupTask', 'interruptAgent', 'listAgents'
+];
 export async function runCodexCurrentCollabAgentToolSchemaRealProbe(input) {
     const started = Date.now();
     const codexBin = input.codexBin || await findCodexBinary();
@@ -23,7 +26,7 @@ export async function runCodexCurrentCollabAgentToolSchemaRealProbe(input) {
         ? schema.definitions.CollabAgentTool.enum.map(String)
         : [];
     const currentNamesPresent = CURRENT_COLLAB_TOOLS.every((name) => tools.includes(name));
-    const legacyInterruptAbsent = !tools.includes('interruptAgent') && !tools.includes('interrupt_agent');
+    const legacyInterruptAbsent = !tools.includes('interrupt_agent');
     const collabItemPresent = JSON.stringify(schema?.definitions?.ThreadItem || {}).includes('collabAgentToolCall')
         || JSON.stringify(schema || {}).includes('collabAgentToolCall');
     const processExitedSuccessfully = result.code === 0;

package/dist/core/codex-lb/bridge-cli-contract.js

@@ -0,0 +1,35 @@
+import { DesktopBridgeError } from './desktop-bridge/types.js';
+export const DESKTOP_BRIDGE_SUPERVISED_FLAG = '--supervised';
+export const BRIDGE_CLI_BOOLEAN_OPTIONS = [
+    '--json',
+    '--strict',
+    '--require-ready',
+    '--api-key-stdin',
+    '--confirm',
+    DESKTOP_BRIDGE_SUPERVISED_FLAG
+];
+export const BRIDGE_CLI_VALUE_OPTIONS = ['--level', '--host', '--settings', '--set'];
+export function isBridgeCliBooleanOption(value) {
+    return BRIDGE_CLI_BOOLEAN_OPTIONS.includes(value);
+}
+export function isBridgeCliValueOption(value) {
+    return BRIDGE_CLI_VALUE_OPTIONS.includes(value);
+}
+export function isBridgeCliOption(value) {
+    return isBridgeCliBooleanOption(value) || isBridgeCliValueOption(value);
+}
+export function desktopBridgeServeArguments(settingsPath) {
+    const argv = [
+        'bridge',
+        'serve',
+        '--settings',
+        settingsPath,
+        '--json',
+        DESKTOP_BRIDGE_SUPERVISED_FLAG
+    ];
+    const unregistered = argv.filter((token) => token.startsWith('--') && !isBridgeCliOption(token));
+    if (unregistered.length) {
+        throw new DesktopBridgeError(`bridge_serve_option_unregistered:${unregistered.join(',')}`);
+    }
+    return argv;
+}

package/dist/core/codex-lb/desktop-service.js

@@ -8,6 +8,7 @@ import { withFileLock } from '../locks/file-lock.js';
 import { loadCodexLbEnv } from './codex-lb-env.js';
 import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
 import { cleanupRetiredDesktopBridgeRuntime, prepareRetiredDesktopBridgeRuntime, } from './desktop-bridge-migration/retired-runtime-cleanup.js';
+import { DESKTOP_BRIDGE_SUPERVISED_FLAG, desktopBridgeServeArguments } from './bridge-cli-contract.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, sha256Stable } from './route-index.js';
 import { captureCodexAuthSnapshot } from './desktop-auth-invariant.js';
 import { applyOfficialModelPassthrough, bridgeRoutePolicyPath, writeBridgeRoutingPolicy } from './provider-route-policy.js';
@@ -352,12 +353,13 @@ export async function installAndStartDesktopBridgeService(options = {}) {
     catch (error) {
         return failedStatus(paths, settings, launchService(options.uid), 'credentials_unavailable', safeServiceError(error));
     }
-    const command = await resolveLaunchCommand(options);
+    const launch = await resolveLaunchCommand(options, home);
+    const command = launch.command;
     if (!command)
-        return failedStatus(paths, settings, launchService(options.uid), 'settings_missing', 'desktop_bridge_sks_executable_missing');
+        return failedStatus(paths, settings, launchService(options.uid), 'settings_missing', launch.blocker);
     await prepareDesktopBridgeServicePaths(paths);
     await writeDesktopBridgeServiceSettings(paths.settings_path, { ...settings, provider_registry: runtime.config.providerRegistry, route_policy: runtime.config.routePolicy });
-    await writeDesktopBridgeLaunchdPlist(paths.launch_agent_path, { executablePath: command.executable, arguments: [...command.arguments, 'bridge', 'serve', '--settings', paths.settings_path, '--json', '--supervised'], stdoutPath: paths.stdout_log_path, stderrPath: paths.stderr_log_path });
+    await writeDesktopBridgeLaunchdPlist(paths.launch_agent_path, { executablePath: command.executable, arguments: [...command.arguments, ...desktopBridgeServeArguments(paths.settings_path)], stdoutPath: paths.stdout_log_path, stderrPath: paths.stderr_log_path });
     const run = options.run || runProcess;
     const ctl = options.launchctl || '/bin/launchctl';
     const service = launchService(options.uid);
@@ -426,8 +428,8 @@ export async function stopDesktopBridgeService(options = {}) {
     const status = await desktopBridgeServiceStatus({ ...options, home });
     return { ...status, ok: !status.running, blockers: status.running ? ['desktop_bridge_process_still_running'] : [] };
 }
-function desktopBridgeIsSupervised(env = process.env, argv = process.argv) {
-    return env.XPC_SERVICE_NAME === DESKTOP_BRIDGE_LAUNCHD_LABEL || argv.includes('--supervised');
+export function desktopBridgeIsSupervised(env = process.env, argv = process.argv) {
+    return env.XPC_SERVICE_NAME === DESKTOP_BRIDGE_LAUNCHD_LABEL || argv.includes(DESKTOP_BRIDGE_SUPERVISED_FLAG);
 }
 async function installedPackageVersion() {
     try {
@@ -463,17 +465,15 @@ async function autoApplyOfficialModelsAtServe(runtime, home, options) {
         home,
         codexLbRegistered: desktopBridgeCodexLbRegistered(settings.provider_registry.providers),
     });
-    if (mode !== 'passthrough')
+    const converged = applyOfficialModelPassthrough(settings.route_policy, { mode });
+    if (converged.policy_generation === settings.route_policy.policy_generation)
         return;
-    const flipped = applyOfficialModelPassthrough(settings.route_policy, { mode: 'passthrough' });
-    if (flipped.policy_generation === settings.route_policy.policy_generation)
-        return;
-    const nextSettings = { ...settings, route_policy: flipped };
+    const nextSettings = { ...settings, route_policy: converged };
     await writeDesktopBridgeServiceSettings(options.settingsPath || desktopBridgeServicePaths(home).settings_path, nextSettings);
-    await writeBridgeRoutingPolicy(bridgeRoutePolicyPath(path.join(path.resolve(home), '.codex')), flipped).catch(() => undefined);
-    settings.route_policy = flipped;
-    runtime.config.routePolicy = flipped;
-    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.official_models_auto_applied', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, mode: 'passthrough', policy_generation: flipped.policy_generation, secret_fields_redacted: true })}\n`);
+    await writeBridgeRoutingPolicy(bridgeRoutePolicyPath(path.join(path.resolve(home), '.codex')), converged).catch(() => undefined);
+    settings.route_policy = converged;
+    runtime.config.routePolicy = converged;
+    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.official_models_auto_applied', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, mode, policy_generation: converged.policy_generation, secret_fields_redacted: true })}\n`);
 }
 export async function serveDesktopBridge(options = {}) {
     let handle = null;
@@ -697,9 +697,30 @@ function normalizeProviderRegistrySnapshot(value) {
 function overridePaths(base, options) { return { settings_path: options.settingsPath || base.settings_path, state_path: options.statePath || base.state_path, client_capability_path: options.clientCapabilityPath || base.client_capability_path, launch_agent_path: options.launchAgentPath || base.launch_agent_path, stdout_log_path: options.stdoutLogPath || base.stdout_log_path, stderr_log_path: options.stderrLogPath || base.stderr_log_path }; }
 function launchDomain(uid = typeof process.getuid === 'function' ? process.getuid() : 0) { return `gui/${uid}`; }
 function launchService(uid) { return `${launchDomain(uid)}/${DESKTOP_BRIDGE_LAUNCHD_LABEL}`; }
-async function resolveLaunchCommand(options) { if (options.executablePath)
-    return await exists(path.resolve(options.executablePath)) ? { executable: path.resolve(options.executablePath), arguments: [...(options.executableArguments || [])] } : null; const entry = String(process.argv[1] || ''); if (entry && ['sks', 'sneakoscope'].includes(path.basename(entry).replace(/\.js$/i, '')) && await exists(entry))
-    return { executable: path.resolve(process.execPath), arguments: [path.resolve(entry)] }; const sks = await which('sks').catch(() => null); return sks ? { executable: path.resolve(sks), arguments: [] } : null; }
+async function resolveLaunchCommand(options, home) {
+    if (options.executablePath) {
+        return await exists(path.resolve(options.executablePath))
+            ? { command: { executable: path.resolve(options.executablePath), arguments: [...(options.executableArguments || [])] }, blocker: 'desktop_bridge_sks_executable_missing' }
+            : { command: null, blocker: 'desktop_bridge_sks_executable_missing' };
+    }
+    const candidates = [];
+    const entry = String(process.argv[1] || '');
+    if (entry && ['sks', 'sneakoscope'].includes(path.basename(entry).replace(/\.js$/i, '')) && await exists(entry)) {
+        candidates.push({ executable: path.resolve(process.execPath), arguments: [path.resolve(entry)] });
+    }
+    const sks = await which('sks').catch(() => null);
+    if (sks)
+        candidates.push({ executable: path.resolve(sks), arguments: [] });
+    let rejectedProtected = false;
+    for (const candidate of candidates) {
+        if (await launchTargetsProtectedFolder([candidate.executable, ...candidate.arguments], home)) {
+            rejectedProtected = true;
+            continue;
+        }
+        return { command: candidate, blocker: 'desktop_bridge_sks_executable_missing' };
+    }
+    return { command: null, blocker: rejectedProtected ? 'desktop_bridge_entry_macos_protected_folder' : 'desktop_bridge_sks_executable_missing' };
+}
 function macosProtectedUserPath(target, home) {
     if (!target)
         return false;

package/dist/core/codex-lb/provider-route-policy.js

@@ -118,14 +118,18 @@ function isRouteTargetId(value) {
 }
 export const OFFICIAL_MODEL_ID_PATTERN = /^(?:gpt-[0-9]|o[0-9]|codex-mini)/;
 export function applyOfficialModelPassthrough(policy, input = { mode: 'passthrough' }) {
-    if (input.mode === 'gateway')
-        return policy;
     const routes = {};
+    let changed = false;
     for (const [model, target] of Object.entries(policy.model_routes)) {
-        routes[model] = OFFICIAL_MODEL_ID_PATTERN.test(model) && !model.includes(':')
-            ? { provider_id: BRIDGE_OFFICIAL_ROUTE_ID, upstream_model: model }
-            : target;
+        const next = input.mode === 'passthrough'
+            ? passthroughRouteTarget(model, target)
+            : gatewayRouteTarget(model, target, policy);
+        routes[model] = next;
+        if (next !== target)
+            changed = true;
     }
+    if (!changed)
+        return policy;
     const semantic = {
         default_provider_id: policy.default_provider_id,
         fallback: 'none',
@@ -139,6 +143,23 @@ export function applyOfficialModelPassthrough(policy, input = { mode: 'passthrou
         changed_at: input.changedAt || new Date().toISOString()
     };
 }
+function passthroughRouteTarget(model, target) {
+    if (!OFFICIAL_MODEL_ID_PATTERN.test(model) || model.includes(':'))
+        return target;
+    if (target.provider_id === BRIDGE_OFFICIAL_ROUTE_ID && target.upstream_model === model)
+        return target;
+    return { provider_id: BRIDGE_OFFICIAL_ROUTE_ID, upstream_model: model };
+}
+function gatewayRouteTarget(model, target, policy) {
+    if (target.provider_id !== BRIDGE_OFFICIAL_ROUTE_ID)
+        return target;
+    if (!OFFICIAL_MODEL_ID_PATTERN.test(model) || model.includes(':'))
+        return target;
+    const twin = policy.model_routes[`codex-lb:${model}`];
+    if (!twin || twin.provider_id !== 'codex-lb')
+        return target;
+    return { provider_id: twin.provider_id, upstream_model: twin.upstream_model };
+}
 function sameTarget(left, right) {
     return left.provider_id === right.provider_id && left.upstream_model === right.upstream_model;
 }

package/dist/core/doctor/legacy-runtime-data-gc.js

@@ -0,0 +1,185 @@
+import path from 'node:path';
+import fsp from 'node:fs/promises';
+import { readJson } from '../fsx.js';
+import { inspectConfinedPath, publicPathError, removeManagedPathVerified } from '../managed-path-safety.js';
+export const LEGACY_RUNTIME_DATA_GC_SCHEMA = 'sks.legacy-runtime-data-gc.v1';
+const CONFIG_BACKUP_NAME = /^config\.toml\.(?:backup-[A-Za-z0-9_.:-]+|bak(?:[-.][A-Za-z0-9_.-]+)?|[A-Za-z0-9_.-]+\.bak)$/;
+const BRIDGE_GENERATION_DIR = /^[0-9a-f]{64}\.[0-9a-f]{64}\.[0-9a-f]{64}$/;
+const RETIRED_VERSION_CACHE = /^codex-0\d{2,3}-(?:capability|doctor)\.json$/;
+const RETIRED_CHROME_HOSTS_V1 = 'chrome-native-hosts.json';
+const CHROME_HOSTS_V2 = 'chrome-native-hosts-v2.json';
+export const LEGACY_CONFIG_BACKUP_KEEP_COUNT = 3;
+export const LEGACY_BRIDGE_GENERATION_KEEP_COUNT = 1;
+export async function reconcileLegacyRuntimeData(input) {
+    const codexHome = path.resolve(input.codexHome);
+    const configBackups = await reconcileConfigBackups(codexHome, input.fix);
+    const bridgeGenerations = await reconcileBridgeGenerations(codexHome, input.fix);
+    const retiredVersionCaches = await reconcileRetiredVersionCaches(input.stateRoots, input.fix);
+    const retiredSingletons = await reconcileRetiredSingletons(codexHome, input.fix);
+    const categories = [configBackups, bridgeGenerations, retiredVersionCaches, retiredSingletons];
+    const remainingCount = categories.reduce((total, category) => total + category.remaining, 0);
+    const errorCount = categories.reduce((total, category) => total + category.errors.length, 0);
+    return {
+        schema: LEGACY_RUNTIME_DATA_GC_SCHEMA,
+        ok: remainingCount === 0 && errorCount === 0,
+        fix: input.fix,
+        config_backups: configBackups,
+        bridge_generations: bridgeGenerations,
+        retired_version_caches: retiredVersionCaches,
+        retired_singletons: retiredSingletons,
+        remaining_count: remainingCount,
+        error_count: errorCount
+    };
+}
+function emptyCategory() {
+    return { detected: 0, removed: 0, kept: 0, remaining: 0, errors: [] };
+}
+async function reconcileConfigBackups(codexHome, fix) {
+    const report = emptyCategory();
+    const names = await readdirOrNull(codexHome);
+    if (!names)
+        return report;
+    const candidates = [];
+    for (const name of names) {
+        if (!CONFIG_BACKUP_NAME.test(name))
+            continue;
+        const inspected = await inspectOwnedRegularFile(codexHome, path.join(codexHome, name), report);
+        if (!inspected)
+            continue;
+        report.detected += 1;
+        candidates.push({ file: inspected.path, mtimeMs: inspected.stat?.mtimeMs || 0 });
+    }
+    candidates.sort((left, right) => right.mtimeMs - left.mtimeMs);
+    report.kept = Math.min(candidates.length, LEGACY_CONFIG_BACKUP_KEEP_COUNT);
+    for (const candidate of candidates.slice(LEGACY_CONFIG_BACKUP_KEEP_COUNT)) {
+        await removeOrCount(codexHome, candidate.file, fix, report);
+    }
+    return report;
+}
+async function reconcileBridgeGenerations(codexHome, fix) {
+    const report = emptyCategory();
+    const runtimeRoot = path.join(codexHome, 'sks');
+    const generationsRoot = path.join(runtimeRoot, '.sks-bridge-generations');
+    const names = await readdirOrNull(generationsRoot);
+    if (!names)
+        return report;
+    const pointer = await readJson(path.join(runtimeRoot, 'sks-bridge-active-generation.json'), null);
+    const activeName = typeof pointer?.bundle_directory === 'string'
+        ? path.basename(pointer.bundle_directory)
+        : null;
+    const candidates = [];
+    for (const name of names) {
+        if (!BRIDGE_GENERATION_DIR.test(name))
+            continue;
+        const target = path.join(generationsRoot, name);
+        let inspected;
+        try {
+            inspected = await inspectConfinedPath(generationsRoot, target);
+        }
+        catch (error) {
+            report.errors.push(publicPathError(error, target));
+            continue;
+        }
+        if (!inspected.exists || inspected.leafSymlink || !inspected.stat?.isDirectory() || !ownedByCurrentUid(inspected))
+            continue;
+        report.detected += 1;
+        if (name === activeName) {
+            report.kept += 1;
+            continue;
+        }
+        candidates.push({ file: target, name, mtimeMs: inspected.stat.mtimeMs });
+    }
+    if (!activeName || !BRIDGE_GENERATION_DIR.test(activeName)) {
+        report.kept += candidates.length;
+        return report;
+    }
+    candidates.sort((left, right) => right.mtimeMs - left.mtimeMs);
+    report.kept += Math.min(candidates.length, LEGACY_BRIDGE_GENERATION_KEEP_COUNT);
+    for (const candidate of candidates.slice(LEGACY_BRIDGE_GENERATION_KEEP_COUNT)) {
+        await removeOrCount(generationsRoot, candidate.file, fix, report);
+    }
+    return report;
+}
+async function reconcileRetiredVersionCaches(stateRoots, fix) {
+    const report = emptyCategory();
+    for (const root of [...new Set(stateRoots.map((value) => path.resolve(value)))]) {
+        const names = await readdirOrNull(root);
+        if (!names)
+            continue;
+        for (const name of names) {
+            if (!RETIRED_VERSION_CACHE.test(name))
+                continue;
+            const inspected = await inspectOwnedRegularFile(root, path.join(root, name), report);
+            if (!inspected)
+                continue;
+            report.detected += 1;
+            await removeOrCount(root, inspected.path, fix, report);
+        }
+    }
+    return report;
+}
+async function reconcileRetiredSingletons(codexHome, fix) {
+    const report = emptyCategory();
+    const v1 = path.join(codexHome, RETIRED_CHROME_HOSTS_V1);
+    const v2 = path.join(codexHome, CHROME_HOSTS_V2);
+    const v1Inspected = await inspectOwnedRegularFile(codexHome, v1, report, { quiet: true });
+    if (!v1Inspected)
+        return report;
+    const v2Inspected = await inspectOwnedRegularFile(codexHome, v2, report, { quiet: true });
+    report.detected += 1;
+    if (!v2Inspected) {
+        report.kept += 1;
+        return report;
+    }
+    await removeOrCount(codexHome, v1, fix, report);
+    return report;
+}
+async function removeOrCount(boundary, file, fix, report) {
+    if (!fix) {
+        report.remaining += 1;
+        return;
+    }
+    try {
+        await removeManagedPathVerified(boundary, file);
+        report.removed += 1;
+    }
+    catch (error) {
+        report.errors.push(publicPathError(error, file));
+        report.remaining += 1;
+    }
+}
+async function inspectOwnedRegularFile(boundary, file, report, options = {}) {
+    let inspected;
+    try {
+        inspected = await inspectConfinedPath(boundary, file);
+    }
+    catch (error) {
+        if (!options.quiet)
+            report.errors.push(publicPathError(error, file));
+        return null;
+    }
+    if (!inspected.exists || inspected.leafSymlink || !inspected.stat?.isFile() || !ownedByCurrentUid(inspected))
+        return null;
+    return inspected;
+}
+function ownedByCurrentUid(inspected) {
+    if (typeof process.getuid !== 'function')
+        return true;
+    return inspected.stat?.uid === process.getuid();
+}
+async function readdirOrNull(directory) {
+    try {
+        const stat = await fsp.lstat(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    try {
+        return (await fsp.readdir(directory)).sort();
+    }
+    catch {
+        return null;
+    }
+}

package/dist/core/init/legacy-generation-convergence.js

@@ -6,6 +6,7 @@ import { hasExplicitSksManagedCodexConfigMarker, writeCodexConfigGuarded } from
 import { validateCodexConfigRoundTrip } from '../codex/codex-config-toml.js';
 import { collectNestedProjectRoots } from '../doctor/current-project-guidance-nested.js';
 import { reconcileRetiredManagedResidue } from '../doctor/retired-managed-residue.js';
+import { reconcileLegacyRuntimeData } from '../doctor/legacy-runtime-data-gc.js';
 import { readJson, readText } from '../fsx.js';
 import { removeMcpServerBlock, mcpServerBlockWithChildren } from '../mcp/mcp-config-preservation.js';
 import { reconcileRetiredSksConfigText } from '../auto-review.js';
@@ -54,6 +55,11 @@ export async function reconcileLegacyManagedGeneration(input) {
     for (const runtimeRoot of runtimeRoots) {
         retiredRuntimeScopes.push(await reconcileRuntimeScope(runtimeRoot, input.fix));
     }
+    const runtimeDataGc = await reconcileLegacyRuntimeData({
+        codexHome,
+        stateRoots: runtimeRoots.map((runtimeRoot) => path.join(runtimeRoot, '.sneakoscope')),
+        fix: input.fix
+    });
     const managedConfigs = await reconcileManagedConfigs({
         projectRoots,
         home,
@@ -68,6 +74,7 @@ export async function reconcileLegacyManagedGeneration(input) {
         ok: skillsOk
             && retiredAgentRoles.ok
             && runtimeOk
+            && runtimeDataGc.ok
             && managedConfigs.ok
             && blockers.length === 0
             && nested.errorCount === 0,
@@ -79,6 +86,7 @@ export async function reconcileLegacyManagedGeneration(input) {
         project_skills: projectSkills,
         retired_agent_roles: retiredAgentRoles,
         retired_runtime_scopes: retiredRuntimeScopes,
+        runtime_data_gc: runtimeDataGc,
         managed_configs: managedConfigs,
         blockers,
         warnings
@@ -133,6 +141,7 @@ async function reconcileManagedConfigs(input) {
         rewritten_count: 0,
         retired_mcp_block_count: 0,
         retired_config_entry_count: 0,
+        compacted_marker_line_count: 0,
         preserved_user_config_count: 0,
         remaining_count: 0,
         error_count: 0,
@@ -179,7 +188,8 @@ async function reconcileManagedConfigTarget(target, fix, report) {
     const before = await readText(target.configPath, '');
     const ownership = await managedConfigOwnershipProof(target.ownerRoot, target.configPath, before);
     const retiredConfig = reconcileRetiredSksConfigText(before);
-    let next = retiredConfig.user_authored_conflict && !ownership ? before : retiredConfig.text;
+    const retiredApplied = !(retiredConfig.user_authored_conflict && !ownership);
+    let next = retiredApplied ? retiredConfig.text : before;
     let retiredMcpCount = 0;
     if (ownership) {
         for (const server of RETIRED_SKS_MCP_SERVERS) {
@@ -189,8 +199,11 @@ async function reconcileManagedConfigTarget(target, fix, report) {
             retiredMcpCount += 1;
         }
     }
-    const retiredConfigCount = next === before ? 0 : retiredConfig.detected_count;
-    const detectedCount = retiredConfigCount + retiredMcpCount;
+    const compacted = compactSksMovedConfigMarkers(next);
+    const markerCount = compacted.removed_count;
+    next = compacted.text;
+    const retiredConfigCount = retiredApplied && retiredConfig.detected_count > 0 ? retiredConfig.detected_count : 0;
+    const detectedCount = retiredConfigCount + retiredMcpCount + markerCount;
     if (retiredConfig.user_authored_conflict && !ownership) {
         report.preserved_user_config_count += 1;
         report.preserved_user_configs.push(target.configPath);
@@ -200,6 +213,7 @@ async function reconcileManagedConfigTarget(target, fix, report) {
     report.detected_count += detectedCount;
     report.retired_config_entry_count += retiredConfigCount;
     report.retired_mcp_block_count += retiredMcpCount;
+    report.compacted_marker_line_count += markerCount;
     if (!fix) {
         report.remaining_count += detectedCount;
         return;
@@ -211,8 +225,9 @@ async function reconcileManagedConfigTarget(target, fix, report) {
     }
     try {
         const normalized = normalizeConfigText(next);
-        const exactRetiredConfigAuthorized = retiredConfig.detected_count > 0
-            && retiredConfig.user_authored_conflict !== true;
+        const exactRetiredConfigAuthorized = (retiredConfig.detected_count > 0
+            && retiredConfig.user_authored_conflict !== true)
+            || markerCount > 0;
         const guarded = await writeCodexConfigGuarded({
             root: target.ownerRoot,
             configPath: target.configPath,
@@ -254,6 +269,16 @@ function normalizeConfigText(text) {
     const value = String(text || '').trimEnd().replace(/\n{3,}/g, '\n\n');
     return value ? `${value}\n` : '';
 }
+const SKS_MOVED_MARKER_LINE = /^\s*#\s*SKS moved machine-local Codex config\b/i;
+function compactSksMovedConfigMarkers(text) {
+    const lines = String(text || '').split('\n');
+    const markerIndexes = lines.flatMap((line, index) => (SKS_MOVED_MARKER_LINE.test(line) ? [index] : []));
+    if (markerIndexes.length < 2)
+        return { text, removed_count: 0 };
+    const keep = markerIndexes[markerIndexes.length - 1];
+    const kept = lines.filter((line, index) => !SKS_MOVED_MARKER_LINE.test(line) || index === keep);
+    return { text: kept.join('\n'), removed_count: markerIndexes.length - 1 };
+}
 function recordConfigError(report, file, error) {
     report.error_count += 1;
     report.errors.push(`${file}:${error instanceof Error ? error.message : String(error)}`);

package/dist/core/update/update-migration-state/desktop-bridge-restage.js

@@ -1,46 +1,73 @@
 import os from 'node:os';
 import path from 'node:path';
 import { exists, PACKAGE_VERSION, readJson, runProcess } from '../../fsx.js';
-export async function runDesktopBridgeRestageStage() {
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths } from '../../codex-lb/desktop-service.js';
+export async function desktopBridgeRestage(options = {}) {
     const skip = (reason) => ({ ok: true, status: 'ok', actions: [reason], blockers: [], warnings: [] });
-    if (process.platform !== 'darwin')
+    const warn = (warnings) => ({ ok: true, status: 'ok', actions: [], blockers: [], warnings });
+    const env = options.env || process.env;
+    const version = options.packageVersion || PACKAGE_VERSION;
+    const reachesRealLaunchd = !(options.run && options.bootstrapService);
+    if ((options.platform || process.platform) !== 'darwin')
         return skip('desktop_bridge_restage_not_macos');
-    if (process.env.NODE_TEST_CONTEXT !== undefined)
+    if (reachesRealLaunchd && (env.NODE_TEST_CONTEXT !== undefined || env.SKS_TEST_ISOLATION === '1')) {
         return skip('desktop_bridge_restage_skipped_under_tests');
-    if (process.env.SKS_SKIP_BRIDGE_RESTAGE === '1')
+    }
+    if (env.SKS_SKIP_BRIDGE_RESTAGE === '1')
         return skip('desktop_bridge_restage_disabled');
-    const home = os.homedir();
-    const plist = path.join(home, 'Library', 'LaunchAgents', 'com.sneakoscope.desktop-bridge.plist');
-    if (!(await exists(plist)))
+    const home = options.home || path.resolve(env.HOME || os.homedir());
+    const paths = desktopBridgeServicePaths(home);
+    if (!(await exists(paths.launch_agent_path)))
         return skip('desktop_bridge_restage_no_launch_agent');
-    const state = await readJson(path.join(home, '.codex', 'sks', 'desktop-bridge-state.json'), null);
+    const state = await readJson(paths.state_path, null);
     const runningVersion = typeof state?.sks_version === 'string' ? state.sks_version : null;
     const pid = typeof state?.pid === 'number' && Number.isInteger(state.pid) && state.pid > 1 ? state.pid : null;
-    if (!pid)
-        return skip('desktop_bridge_restage_no_running_bridge');
-    try {
-        process.kill(pid, 0);
+    if (pid === null || !(options.processAlive || processAlive)(pid)) {
+        if (!(await exists(paths.settings_path)))
+            return skip('desktop_bridge_restage_no_managed_bridge');
+        const bootstrap = await (options.bootstrapService || bootstrapExistingDesktopBridgeService)({ home })
+            .catch(() => null);
+        if (bootstrap?.running) {
+            return {
+                ok: true,
+                status: 'ok',
+                actions: [`desktop_bridge_bootstrapped:${version}`],
+                blockers: [],
+                warnings: bootstrap.blockers.map((blocker) => `desktop_bridge_restage_bootstrap_incomplete:${blocker}`)
+            };
+        }
+        return warn([
+            ...(bootstrap?.blockers || ['desktop_bridge_restage_bootstrap_failed'])
+                .map((blocker) => `desktop_bridge_restage_bootstrap_incomplete:${blocker}`),
+            'Desktop Bridge is installed but not running: run `sks bridge repair` from your home directory'
+        ]);
     }
-    catch {
-        return skip('desktop_bridge_restage_no_running_bridge');
-    }
-    if (runningVersion === PACKAGE_VERSION)
+    if (runningVersion === version)
         return skip('desktop_bridge_restage_already_current');
-    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    const uid = options.uid === undefined
+        ? (typeof process.getuid === 'function' ? process.getuid() : null)
+        : options.uid;
     if (uid === null)
         return skip('desktop_bridge_restage_no_uid');
-    const kick = await runProcess('/bin/launchctl', ['kickstart', '-k', `gui/${uid}/com.sneakoscope.desktop-bridge`], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch(() => null);
+    const kick = await (options.run || runProcess)('/bin/launchctl', ['kickstart', '-k', `gui/${uid}/com.sneakoscope.desktop-bridge`], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch(() => null);
     if (!kick || kick.code !== 0) {
-        return {
-            ok: true, status: 'ok',
-            actions: [],
-            blockers: [],
-            warnings: [`desktop_bridge_restage_kickstart_failed:${runningVersion || 'pre-8.6.2'}`]
-        };
+        return warn([`desktop_bridge_restage_kickstart_failed:${runningVersion || 'pre-8.6.2'}`]);
     }
     return {
         ok: true, status: 'ok',
-        actions: [`desktop_bridge_restarted:${runningVersion || 'pre-8.6.2'}:${PACKAGE_VERSION}`],
+        actions: [`desktop_bridge_restarted:${runningVersion || 'pre-8.6.2'}:${version}`],
         blockers: [], warnings: []
     };
 }
+export function runDesktopBridgeRestageStage() {
+    return desktopBridgeRestage();
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/core/version-manager.js

@@ -362,8 +362,7 @@ async function syncSourcePackageVersion(root, version) {
                 .replace(/not represented as current \d+\.\d+\.\d+ completion proof\./g, `not represented as current ${version} completion proof.`)
                 .replace(/^For \d+\.\d+\.\d+, a selected codex-lb/m, `For ${version}, a selected codex-lb`)
                 .replace(/^The \d+\.\d+\.\d+ SKS menu bar/m, `The ${version} SKS menu bar`)
-                .replace(/the \d+\.\d+\.\d+ to \d+\.\d+\.\d+ upgrade smoke/g, `the ${RELEASE_UPGRADE_BASELINE_VERSION} to ${version} upgrade smoke`)
-                .replace(/to \d+\.\d+\.\d+ upgrade smoke/g, `to ${version} upgrade smoke`)
+                .replace(/\bthe (isolated )?\d+\.\d+\.\d+ to \d+\.\d+\.\d+ upgrade smoke/, (_match, isolated) => `the ${isolated || ''}${RELEASE_UPGRADE_BASELINE_VERSION} to ${version} upgrade smoke`)
                 .replace(/under the \d+\.\d+\.\d+ release evidence root/g, `under the ${version} release evidence root`)
                 .replace(/^Do not cut \d+\.\d+\.\d+ while/m, `Do not cut ${version} while`)
                 .replace(/must agree on \d+\.\d+\.\d+\./g, `must agree on ${version}.`)

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '9.2.3';
+export const PACKAGE_VERSION = '9.2.5';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "9.2.3",
+  "version": "9.2.5",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -200,7 +200,7 @@
   "dependencies": {
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
-    "@openai/codex-sdk": "0.147.0",
+    "@openai/codex-sdk": "0.150.1",
     "smol-toml": "^1.7.0",
     "typescript": "^5.9.3"
   },