tickmarkr 2.6.4 → 2.6.6

package/dist/adapters/types.d.ts

@@ -51,7 +51,17 @@ export interface AuthHealth {
     modelAuth?: Record<string, ModelAuth>;
     modelIdentities?: Record<string, string>;
     modelRetirements?: Record<string, ModelRetirement | null>;
+    codexCommit?: CodexCommitStatus;
+    launchServices?: LaunchServicesRecord;
 }
+export interface LaunchServicesRecord {
+    pid: number;
+    start: string;
+    advisory?: string;
+}
+/** allowed: linked branch commit landed, shared hooks/common root denied · protected: commit denied, controls
+ *  readable · escape: a unique hostile member was written · unknown: unreadable or contradictory receipts. */
+export type CodexCommitStatus = "allowed" | "protected" | "escape" | "unknown";
 export declare function modelAuthed(health: AuthHealth | undefined, model: string, allowUnverifiedModels?: boolean): boolean;
 export interface Invocation {
     command: string;

package/dist/cli/commands/approve.js

@@ -210,11 +210,17 @@ export async function approve(argv, cwd = process.cwd()) {
         if (namedGate !== undefined && namedGate !== park?.failedGate) {
             throw new Error(`refusing mismatched gate for ${taskId}: --gate ${namedGate} but park ${bindingToken(parkBinding)} failed ${park?.failedGate ?? "no gate"} — nothing appended`);
         }
-        if ((park?.kind === "scope-request" && !decisions) || files !== undefined) {
+        // A scope-request park is released one of two ways: --files widens files[], or a nonempty --reason
+        // refuses the expansion and funds a plain worker within the current files[] — the reason rides into
+        // the next brief as a standing ruling (journaledFailureBrief). No reason, no release: the refusal is
+        // a ruling only when it says why. The cockpit menu still offers neither (it has no reason entry).
+        const scopeRefusal = park?.kind === "scope-request" && !decisions && files === undefined && Boolean(reason?.trim());
+        if ((park?.kind === "scope-request" && !decisions && !scopeRefusal) || files !== undefined) {
             if (park?.kind !== "scope-request")
                 throw new Error("--files requires a scope-request park");
-            if (!files?.length)
-                throw new Error(`scope-request for ${taskId} requires --files <glob,…>`);
+            if (!files?.length) {
+                throw new Error(`scope-request for ${taskId} requires --files <glob,…> to widen files[], or \`tickmarkr approve ${runId} ${taskId} --reason <text>\` to refuse the expansion and continue within the current files[]`);
+            }
             if (decisions)
                 throw new Error("--files cannot be combined with --waive, --uphold or --recheck");
             const graph = applyScopeAmendments(loadGraph(cwd), journal, false, engagementReleased(events));
@@ -358,7 +364,7 @@ export async function approve(argv, cwd = process.cwd()) {
             park: parkBinding,
         });
         const token = capPark ? "fresh-budget" : "dispatch";
-        return disposition(cwd, runId, token, `approved ${taskId} in ${runId} — by ${by}`, serialization.contended);
+        return disposition(cwd, runId, token, `approved ${taskId} in ${runId} — by ${by}${scopeRefusal ? "; scope expansion refused, files[] unchanged" : ""}`, serialization.contended);
     }
     finally {
         serialization.release();

package/dist/cli/commands/doctor.d.ts

@@ -1,6 +1,7 @@
 import { type ClaudeAlias } from "../../adapters/claude-code.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
 import { type KimiDoctorTurnResult } from "../../adapters/kimi.js";
+import { type CodexSandbox } from "../../adapters/codex-commit-check.js";
 import { type CatalogFetcher, type CatalogReadResult } from "../../adapters/catalog-remote.js";
 import { type ShResult } from "../../run/git.js";
 import { type VitestListResult } from "../../gates/acceptance.js";
@@ -17,6 +18,7 @@ export declare function recentReviewDemotions(cwd: string, lastRuns?: number): R
 export type DoctorOpts = {
     banner?: boolean;
     kimiTurnProbe?: (cwd: string) => Promise<KimiDoctorTurnResult>;
+    codexSandbox?: CodexSandbox;
     resolveClaudeAliasIdentity?: (cwd: string, alias: ClaudeAlias) => string | undefined;
     catalog?: CatalogReadResult;
     catalogNow?: () => Date;

package/dist/cli/commands/doctor.js

@@ -14,11 +14,15 @@ import { loadConfig, overlayPreferShapes } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
 import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
+import { recordCodexCommit } from "../../adapters/codex-commit-check.js";
+import { codex } from "../../adapters/codex.js";
 import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, observedSeat, preferRanks } from "../../route/preference.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
 import { readReviewNoVerdictHistory, reviewNoVerdictRows } from "../../run/journal.js";
+import { checkModelDiscovery } from "../../adapters/model-discovery-check.js";
+import { recordLaunchServices } from "../../run/launchservices-check.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
  *  concatenation and publishes no index, so the release listing is the only enumerable surface. */
 export const LIVEBENCH_RELEASES_URL = "https://api.github.com/repos/LiveBench/livebench.github.io/contents/public";
@@ -578,6 +582,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             };
         }
     }
+    await recordCodexCommit(adapters, health, cwd, opts.codexSandbox);
     // MODEL-02: detect models where the adapter exposes a list surface, BEFORE writing doctor.json (write once, below).
     // Fail OPEN — the inverse of gates' fail-closed: detection is advisory, so a broken list surface NEVER fails doctor.
     for (const a of adapters) {
@@ -659,12 +664,17 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             }
         }
     }
-    writeDoctor(cwd, health);
+    const discovery = await checkModelDiscovery({ cwd, cfg, adapters, health, catalog, resolved: resolvedIdentitySnapshot, mayRefresh: !opts.catalog && !catalogRefreshLine && catalogRefreshAllowed, fetcher: opts.catalogFetcher, now: opts.catalogNow });
+    catalog = discovery.catalog;
+    aliasDriftFindings.push(...discovery.findings);
+    const launchServices = await recordLaunchServices(readDoctor(cwd), health);
+    writeDoctor(cwd, launchServices.health);
     const rows = adapters.map((a) => {
         const h = health[a.id];
         // OBS-503: a crash-on-version verdict carries its reason in note — print it instead of the lie.
         const state = !h.installed ? (h.note ?? "not installed") : `${h.version ?? "installed"}${h.note ? ` (${h.note})` : ""}`;
-        const healthy = h.installed && (a.id !== kimi.id || h.authed);
+        // v2.6.6 T9 (K): a Codex sandbox escape is a BLOCKING security warning — never a passing row
+        const healthy = h.installed && (a.id !== kimi.id || h.authed) && !(a.id === codex.id && h.codexCommit === "escape");
         return alignedStatusRow(healthy ? "pass" : "fail", a.id, state);
     });
     const reviewDemotions = recentReviewDemotions(cwd);
@@ -807,6 +817,8 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     lintRows.push(...flagDriftWarnings(adapters, health).map(attentionRow));
     // OBS-145: resolved-identity drift is advisory display warning.
     lintRows.push(...aliasDriftFindings.map(attentionRow));
+    if (launchServices.line)
+        lintRows.push(attentionRow(launchServices.line));
     const resolvedCatalogModel = (adapter, model) => {
         if (adapter !== "claude-code" || !(model in CLAUDE_ALIAS_IDENTITY_STAMPS))
             return undefined;
@@ -895,9 +907,11 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
                 rows.push(`    ${dim(`catalog · ${advisory.display}`)}`);
             if (!listAllModels && bulk.length) {
                 const uncovered = bulk.filter((adv) => adv.coverage === "uncovered").length;
-                const evidenceOnly = bulk.length - uncovered;
+                const unknown = bulk.filter((adv) => adv.coverage === "unknown").length;
+                const evidenceOnly = bulk.length - uncovered - unknown;
                 const parts = [
                     ...(uncovered ? [`${uncovered} uncovered by ${catalog.source === "cache" ? "cached catalogs" : "vendored catalog"}`] : []),
+                    ...(unknown ? [`${unknown} coverage unknown after a failed refresh`] : []),
                     ...(evidenceOnly ? [`${evidenceOnly} covered without a tier suggestion`] : []),
                 ];
                 rows.push(`    ${dim(`catalog · ${parts.join(" · ")} — tickmarkr doctor --models lists each`)}`);

package/dist/cli/commands/fleet.d.ts

@@ -1,6 +1,7 @@
 import { type CatalogFetcher, type CatalogReadResult } from "../../adapters/catalog-remote.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
-import type { FleetEditorResult } from "../../tui/ink/fleet-app.js";
+import { type MapEntry, type ModeResolution, type RoutingMode, type TickmarkrConfig } from "../../config/config.js";
+import type { FleetEditorResult, FleetStagedDeny, FleetStagedMetadata } from "../../tui/ink/fleet-app.js";
 type FleetEditorProps = Parameters<typeof import("../../tui/ink/fleet-app.js").runFleetInkEditor>[0];
 export type FleetInput = NodeJS.ReadableStream & {
     isTTY?: boolean;
@@ -44,6 +45,14 @@ export declare function assembleFleetEditor(cwd: string, adapters: WorkerAdapter
     props: FleetEditorProps;
     commit: (result: FleetEditorResult) => string;
     renderWhy: () => string;
+    previewConfig: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny, stage?: FleetStagedMetadata) => {
+        ok: true;
+        cfg: TickmarkrConfig;
+        mode: ModeResolution;
+    } | {
+        ok: false;
+        error: string;
+    };
 } | {
     unavailable: string;
 }>;