sneakoscope 9.2.4 → 9.2.5

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.2.4** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.2.5** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.2.4"
+version = "9.2.5"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.2.4"
+version = "9.2.5"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.2.4",
+  "package_version": "9.2.5",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex/codex-feature-flags.js

@@ -2,9 +2,9 @@ export const MANAGED_CODEX_FEATURE_FLAGS = Object.freeze(['hooks', 'fast_mode',
 export const REMOVED_CODEX_FEATURE_FLAGS = Object.freeze([
     'fast_mode_ui',
     'codex_hooks',
+    'multi_agent_mode',
     'remote_control',
     'codex_git_commit',
     'plugin_hooks',
-    'js_repl',
-    'multi_agent_mode'
+    'js_repl'
 ]);

package/dist/core/codex-control/codex-current-collab-agent-real-probe.js

@@ -3,7 +3,10 @@ import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { ensureDir, runProcess } from '../fsx.js';
 import { codexCurrentCoreProbeTail, skippedCodexCurrentCoreProbe } from './codex-current-core-real-probes.js';
-const CURRENT_COLLAB_TOOLS = ['spawnAgent', 'sendInput', 'resumeAgent', 'wait', 'closeAgent'];
+const CURRENT_COLLAB_TOOLS = [
+    'spawnAgent', 'sendInput', 'resumeAgent', 'wait', 'closeAgent',
+    'sendMessage', 'followupTask', 'interruptAgent', 'listAgents'
+];
 export async function runCodexCurrentCollabAgentToolSchemaRealProbe(input) {
     const started = Date.now();
     const codexBin = input.codexBin || await findCodexBinary();
@@ -23,7 +26,7 @@ export async function runCodexCurrentCollabAgentToolSchemaRealProbe(input) {
         ? schema.definitions.CollabAgentTool.enum.map(String)
         : [];
     const currentNamesPresent = CURRENT_COLLAB_TOOLS.every((name) => tools.includes(name));
-    const legacyInterruptAbsent = !tools.includes('interruptAgent') && !tools.includes('interrupt_agent');
+    const legacyInterruptAbsent = !tools.includes('interrupt_agent');
     const collabItemPresent = JSON.stringify(schema?.definitions?.ThreadItem || {}).includes('collabAgentToolCall')
         || JSON.stringify(schema || {}).includes('collabAgentToolCall');
     const processExitedSuccessfully = result.code === 0;

package/dist/core/codex-lb/desktop-service.js

@@ -465,17 +465,15 @@ async function autoApplyOfficialModelsAtServe(runtime, home, options) {
         home,
         codexLbRegistered: desktopBridgeCodexLbRegistered(settings.provider_registry.providers),
     });
-    if (mode !== 'passthrough')
+    const converged = applyOfficialModelPassthrough(settings.route_policy, { mode });
+    if (converged.policy_generation === settings.route_policy.policy_generation)
         return;
-    const flipped = applyOfficialModelPassthrough(settings.route_policy, { mode: 'passthrough' });
-    if (flipped.policy_generation === settings.route_policy.policy_generation)
-        return;
-    const nextSettings = { ...settings, route_policy: flipped };
+    const nextSettings = { ...settings, route_policy: converged };
     await writeDesktopBridgeServiceSettings(options.settingsPath || desktopBridgeServicePaths(home).settings_path, nextSettings);
-    await writeBridgeRoutingPolicy(bridgeRoutePolicyPath(path.join(path.resolve(home), '.codex')), flipped).catch(() => undefined);
-    settings.route_policy = flipped;
-    runtime.config.routePolicy = flipped;
-    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.official_models_auto_applied', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, mode: 'passthrough', policy_generation: flipped.policy_generation, secret_fields_redacted: true })}\n`);
+    await writeBridgeRoutingPolicy(bridgeRoutePolicyPath(path.join(path.resolve(home), '.codex')), converged).catch(() => undefined);
+    settings.route_policy = converged;
+    runtime.config.routePolicy = converged;
+    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.official_models_auto_applied', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, mode, policy_generation: converged.policy_generation, secret_fields_redacted: true })}\n`);
 }
 export async function serveDesktopBridge(options = {}) {
     let handle = null;

package/dist/core/codex-lb/provider-route-policy.js

@@ -118,14 +118,18 @@ function isRouteTargetId(value) {
 }
 export const OFFICIAL_MODEL_ID_PATTERN = /^(?:gpt-[0-9]|o[0-9]|codex-mini)/;
 export function applyOfficialModelPassthrough(policy, input = { mode: 'passthrough' }) {
-    if (input.mode === 'gateway')
-        return policy;
     const routes = {};
+    let changed = false;
     for (const [model, target] of Object.entries(policy.model_routes)) {
-        routes[model] = OFFICIAL_MODEL_ID_PATTERN.test(model) && !model.includes(':')
-            ? { provider_id: BRIDGE_OFFICIAL_ROUTE_ID, upstream_model: model }
-            : target;
+        const next = input.mode === 'passthrough'
+            ? passthroughRouteTarget(model, target)
+            : gatewayRouteTarget(model, target, policy);
+        routes[model] = next;
+        if (next !== target)
+            changed = true;
     }
+    if (!changed)
+        return policy;
     const semantic = {
         default_provider_id: policy.default_provider_id,
         fallback: 'none',
@@ -139,6 +143,23 @@ export function applyOfficialModelPassthrough(policy, input = { mode: 'passthrou
         changed_at: input.changedAt || new Date().toISOString()
     };
 }
+function passthroughRouteTarget(model, target) {
+    if (!OFFICIAL_MODEL_ID_PATTERN.test(model) || model.includes(':'))
+        return target;
+    if (target.provider_id === BRIDGE_OFFICIAL_ROUTE_ID && target.upstream_model === model)
+        return target;
+    return { provider_id: BRIDGE_OFFICIAL_ROUTE_ID, upstream_model: model };
+}
+function gatewayRouteTarget(model, target, policy) {
+    if (target.provider_id !== BRIDGE_OFFICIAL_ROUTE_ID)
+        return target;
+    if (!OFFICIAL_MODEL_ID_PATTERN.test(model) || model.includes(':'))
+        return target;
+    const twin = policy.model_routes[`codex-lb:${model}`];
+    if (!twin || twin.provider_id !== 'codex-lb')
+        return target;
+    return { provider_id: twin.provider_id, upstream_model: twin.upstream_model };
+}
 function sameTarget(left, right) {
     return left.provider_id === right.provider_id && left.upstream_model === right.upstream_model;
 }

package/dist/core/doctor/legacy-runtime-data-gc.js

@@ -0,0 +1,185 @@
+import path from 'node:path';
+import fsp from 'node:fs/promises';
+import { readJson } from '../fsx.js';
+import { inspectConfinedPath, publicPathError, removeManagedPathVerified } from '../managed-path-safety.js';
+export const LEGACY_RUNTIME_DATA_GC_SCHEMA = 'sks.legacy-runtime-data-gc.v1';
+const CONFIG_BACKUP_NAME = /^config\.toml\.(?:backup-[A-Za-z0-9_.:-]+|bak(?:[-.][A-Za-z0-9_.-]+)?|[A-Za-z0-9_.-]+\.bak)$/;
+const BRIDGE_GENERATION_DIR = /^[0-9a-f]{64}\.[0-9a-f]{64}\.[0-9a-f]{64}$/;
+const RETIRED_VERSION_CACHE = /^codex-0\d{2,3}-(?:capability|doctor)\.json$/;
+const RETIRED_CHROME_HOSTS_V1 = 'chrome-native-hosts.json';
+const CHROME_HOSTS_V2 = 'chrome-native-hosts-v2.json';
+export const LEGACY_CONFIG_BACKUP_KEEP_COUNT = 3;
+export const LEGACY_BRIDGE_GENERATION_KEEP_COUNT = 1;
+export async function reconcileLegacyRuntimeData(input) {
+    const codexHome = path.resolve(input.codexHome);
+    const configBackups = await reconcileConfigBackups(codexHome, input.fix);
+    const bridgeGenerations = await reconcileBridgeGenerations(codexHome, input.fix);
+    const retiredVersionCaches = await reconcileRetiredVersionCaches(input.stateRoots, input.fix);
+    const retiredSingletons = await reconcileRetiredSingletons(codexHome, input.fix);
+    const categories = [configBackups, bridgeGenerations, retiredVersionCaches, retiredSingletons];
+    const remainingCount = categories.reduce((total, category) => total + category.remaining, 0);
+    const errorCount = categories.reduce((total, category) => total + category.errors.length, 0);
+    return {
+        schema: LEGACY_RUNTIME_DATA_GC_SCHEMA,
+        ok: remainingCount === 0 && errorCount === 0,
+        fix: input.fix,
+        config_backups: configBackups,
+        bridge_generations: bridgeGenerations,
+        retired_version_caches: retiredVersionCaches,
+        retired_singletons: retiredSingletons,
+        remaining_count: remainingCount,
+        error_count: errorCount
+    };
+}
+function emptyCategory() {
+    return { detected: 0, removed: 0, kept: 0, remaining: 0, errors: [] };
+}
+async function reconcileConfigBackups(codexHome, fix) {
+    const report = emptyCategory();
+    const names = await readdirOrNull(codexHome);
+    if (!names)
+        return report;
+    const candidates = [];
+    for (const name of names) {
+        if (!CONFIG_BACKUP_NAME.test(name))
+            continue;
+        const inspected = await inspectOwnedRegularFile(codexHome, path.join(codexHome, name), report);
+        if (!inspected)
+            continue;
+        report.detected += 1;
+        candidates.push({ file: inspected.path, mtimeMs: inspected.stat?.mtimeMs || 0 });
+    }
+    candidates.sort((left, right) => right.mtimeMs - left.mtimeMs);
+    report.kept = Math.min(candidates.length, LEGACY_CONFIG_BACKUP_KEEP_COUNT);
+    for (const candidate of candidates.slice(LEGACY_CONFIG_BACKUP_KEEP_COUNT)) {
+        await removeOrCount(codexHome, candidate.file, fix, report);
+    }
+    return report;
+}
+async function reconcileBridgeGenerations(codexHome, fix) {
+    const report = emptyCategory();
+    const runtimeRoot = path.join(codexHome, 'sks');
+    const generationsRoot = path.join(runtimeRoot, '.sks-bridge-generations');
+    const names = await readdirOrNull(generationsRoot);
+    if (!names)
+        return report;
+    const pointer = await readJson(path.join(runtimeRoot, 'sks-bridge-active-generation.json'), null);
+    const activeName = typeof pointer?.bundle_directory === 'string'
+        ? path.basename(pointer.bundle_directory)
+        : null;
+    const candidates = [];
+    for (const name of names) {
+        if (!BRIDGE_GENERATION_DIR.test(name))
+            continue;
+        const target = path.join(generationsRoot, name);
+        let inspected;
+        try {
+            inspected = await inspectConfinedPath(generationsRoot, target);
+        }
+        catch (error) {
+            report.errors.push(publicPathError(error, target));
+            continue;
+        }
+        if (!inspected.exists || inspected.leafSymlink || !inspected.stat?.isDirectory() || !ownedByCurrentUid(inspected))
+            continue;
+        report.detected += 1;
+        if (name === activeName) {
+            report.kept += 1;
+            continue;
+        }
+        candidates.push({ file: target, name, mtimeMs: inspected.stat.mtimeMs });
+    }
+    if (!activeName || !BRIDGE_GENERATION_DIR.test(activeName)) {
+        report.kept += candidates.length;
+        return report;
+    }
+    candidates.sort((left, right) => right.mtimeMs - left.mtimeMs);
+    report.kept += Math.min(candidates.length, LEGACY_BRIDGE_GENERATION_KEEP_COUNT);
+    for (const candidate of candidates.slice(LEGACY_BRIDGE_GENERATION_KEEP_COUNT)) {
+        await removeOrCount(generationsRoot, candidate.file, fix, report);
+    }
+    return report;
+}
+async function reconcileRetiredVersionCaches(stateRoots, fix) {
+    const report = emptyCategory();
+    for (const root of [...new Set(stateRoots.map((value) => path.resolve(value)))]) {
+        const names = await readdirOrNull(root);
+        if (!names)
+            continue;
+        for (const name of names) {
+            if (!RETIRED_VERSION_CACHE.test(name))
+                continue;
+            const inspected = await inspectOwnedRegularFile(root, path.join(root, name), report);
+            if (!inspected)
+                continue;
+            report.detected += 1;
+            await removeOrCount(root, inspected.path, fix, report);
+        }
+    }
+    return report;
+}
+async function reconcileRetiredSingletons(codexHome, fix) {
+    const report = emptyCategory();
+    const v1 = path.join(codexHome, RETIRED_CHROME_HOSTS_V1);
+    const v2 = path.join(codexHome, CHROME_HOSTS_V2);
+    const v1Inspected = await inspectOwnedRegularFile(codexHome, v1, report, { quiet: true });
+    if (!v1Inspected)
+        return report;
+    const v2Inspected = await inspectOwnedRegularFile(codexHome, v2, report, { quiet: true });
+    report.detected += 1;
+    if (!v2Inspected) {
+        report.kept += 1;
+        return report;
+    }
+    await removeOrCount(codexHome, v1, fix, report);
+    return report;
+}
+async function removeOrCount(boundary, file, fix, report) {
+    if (!fix) {
+        report.remaining += 1;
+        return;
+    }
+    try {
+        await removeManagedPathVerified(boundary, file);
+        report.removed += 1;
+    }
+    catch (error) {
+        report.errors.push(publicPathError(error, file));
+        report.remaining += 1;
+    }
+}
+async function inspectOwnedRegularFile(boundary, file, report, options = {}) {
+    let inspected;
+    try {
+        inspected = await inspectConfinedPath(boundary, file);
+    }
+    catch (error) {
+        if (!options.quiet)
+            report.errors.push(publicPathError(error, file));
+        return null;
+    }
+    if (!inspected.exists || inspected.leafSymlink || !inspected.stat?.isFile() || !ownedByCurrentUid(inspected))
+        return null;
+    return inspected;
+}
+function ownedByCurrentUid(inspected) {
+    if (typeof process.getuid !== 'function')
+        return true;
+    return inspected.stat?.uid === process.getuid();
+}
+async function readdirOrNull(directory) {
+    try {
+        const stat = await fsp.lstat(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    try {
+        return (await fsp.readdir(directory)).sort();
+    }
+    catch {
+        return null;
+    }
+}

package/dist/core/init/legacy-generation-convergence.js

@@ -6,6 +6,7 @@ import { hasExplicitSksManagedCodexConfigMarker, writeCodexConfigGuarded } from
 import { validateCodexConfigRoundTrip } from '../codex/codex-config-toml.js';
 import { collectNestedProjectRoots } from '../doctor/current-project-guidance-nested.js';
 import { reconcileRetiredManagedResidue } from '../doctor/retired-managed-residue.js';
+import { reconcileLegacyRuntimeData } from '../doctor/legacy-runtime-data-gc.js';
 import { readJson, readText } from '../fsx.js';
 import { removeMcpServerBlock, mcpServerBlockWithChildren } from '../mcp/mcp-config-preservation.js';
 import { reconcileRetiredSksConfigText } from '../auto-review.js';
@@ -54,6 +55,11 @@ export async function reconcileLegacyManagedGeneration(input) {
     for (const runtimeRoot of runtimeRoots) {
         retiredRuntimeScopes.push(await reconcileRuntimeScope(runtimeRoot, input.fix));
     }
+    const runtimeDataGc = await reconcileLegacyRuntimeData({
+        codexHome,
+        stateRoots: runtimeRoots.map((runtimeRoot) => path.join(runtimeRoot, '.sneakoscope')),
+        fix: input.fix
+    });
     const managedConfigs = await reconcileManagedConfigs({
         projectRoots,
         home,
@@ -68,6 +74,7 @@ export async function reconcileLegacyManagedGeneration(input) {
         ok: skillsOk
             && retiredAgentRoles.ok
             && runtimeOk
+            && runtimeDataGc.ok
             && managedConfigs.ok
             && blockers.length === 0
             && nested.errorCount === 0,
@@ -79,6 +86,7 @@ export async function reconcileLegacyManagedGeneration(input) {
         project_skills: projectSkills,
         retired_agent_roles: retiredAgentRoles,
         retired_runtime_scopes: retiredRuntimeScopes,
+        runtime_data_gc: runtimeDataGc,
         managed_configs: managedConfigs,
         blockers,
         warnings
@@ -133,6 +141,7 @@ async function reconcileManagedConfigs(input) {
         rewritten_count: 0,
         retired_mcp_block_count: 0,
         retired_config_entry_count: 0,
+        compacted_marker_line_count: 0,
         preserved_user_config_count: 0,
         remaining_count: 0,
         error_count: 0,
@@ -179,7 +188,8 @@ async function reconcileManagedConfigTarget(target, fix, report) {
     const before = await readText(target.configPath, '');
     const ownership = await managedConfigOwnershipProof(target.ownerRoot, target.configPath, before);
     const retiredConfig = reconcileRetiredSksConfigText(before);
-    let next = retiredConfig.user_authored_conflict && !ownership ? before : retiredConfig.text;
+    const retiredApplied = !(retiredConfig.user_authored_conflict && !ownership);
+    let next = retiredApplied ? retiredConfig.text : before;
     let retiredMcpCount = 0;
     if (ownership) {
         for (const server of RETIRED_SKS_MCP_SERVERS) {
@@ -189,8 +199,11 @@ async function reconcileManagedConfigTarget(target, fix, report) {
             retiredMcpCount += 1;
         }
     }
-    const retiredConfigCount = next === before ? 0 : retiredConfig.detected_count;
-    const detectedCount = retiredConfigCount + retiredMcpCount;
+    const compacted = compactSksMovedConfigMarkers(next);
+    const markerCount = compacted.removed_count;
+    next = compacted.text;
+    const retiredConfigCount = retiredApplied && retiredConfig.detected_count > 0 ? retiredConfig.detected_count : 0;
+    const detectedCount = retiredConfigCount + retiredMcpCount + markerCount;
     if (retiredConfig.user_authored_conflict && !ownership) {
         report.preserved_user_config_count += 1;
         report.preserved_user_configs.push(target.configPath);
@@ -200,6 +213,7 @@ async function reconcileManagedConfigTarget(target, fix, report) {
     report.detected_count += detectedCount;
     report.retired_config_entry_count += retiredConfigCount;
     report.retired_mcp_block_count += retiredMcpCount;
+    report.compacted_marker_line_count += markerCount;
     if (!fix) {
         report.remaining_count += detectedCount;
         return;
@@ -211,8 +225,9 @@ async function reconcileManagedConfigTarget(target, fix, report) {
     }
     try {
         const normalized = normalizeConfigText(next);
-        const exactRetiredConfigAuthorized = retiredConfig.detected_count > 0
-            && retiredConfig.user_authored_conflict !== true;
+        const exactRetiredConfigAuthorized = (retiredConfig.detected_count > 0
+            && retiredConfig.user_authored_conflict !== true)
+            || markerCount > 0;
         const guarded = await writeCodexConfigGuarded({
             root: target.ownerRoot,
             configPath: target.configPath,
@@ -254,6 +269,16 @@ function normalizeConfigText(text) {
     const value = String(text || '').trimEnd().replace(/\n{3,}/g, '\n\n');
     return value ? `${value}\n` : '';
 }
+const SKS_MOVED_MARKER_LINE = /^\s*#\s*SKS moved machine-local Codex config\b/i;
+function compactSksMovedConfigMarkers(text) {
+    const lines = String(text || '').split('\n');
+    const markerIndexes = lines.flatMap((line, index) => (SKS_MOVED_MARKER_LINE.test(line) ? [index] : []));
+    if (markerIndexes.length < 2)
+        return { text, removed_count: 0 };
+    const keep = markerIndexes[markerIndexes.length - 1];
+    const kept = lines.filter((line, index) => !SKS_MOVED_MARKER_LINE.test(line) || index === keep);
+    return { text: kept.join('\n'), removed_count: markerIndexes.length - 1 };
+}
 function recordConfigError(report, file, error) {
     report.error_count += 1;
     report.errors.push(`${file}:${error instanceof Error ? error.message : String(error)}`);

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '9.2.4';
+export const PACKAGE_VERSION = '9.2.5';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "9.2.4",
+  "version": "9.2.5",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -200,7 +200,7 @@
   "dependencies": {
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
-    "@openai/codex-sdk": "0.147.0",
+    "@openai/codex-sdk": "0.150.1",
     "smol-toml": "^1.7.0",
     "typescript": "^5.9.3"
   },