sneakoscope 2.0.9 → 2.0.11

package/dist/core/agents/agent-orchestrator.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import { createMission, missionDir, setCurrent } from '../mission.js';
-import { nowIso, readJson, readText, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { exists, nowIso, readJson, readText, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { buildAgentRoster, normalizeAgentConcurrency } from './agent-roster.js';
 import { buildAgentWorkPartition } from './agent-work-partition.js';
 import { initializeAgentCentralLedger, appendAgentLedgerEvent, compactAgentLedger } from './agent-central-ledger.js';
@@ -55,7 +55,10 @@ import { selectFinalGptPatchSource } from '../pipeline/final-gpt-patch-stage.js'
 import { allocateWorkerWorktree } from '../git/git-worktree-manager.js';
 import { exportGitWorktreeDiff } from '../git/git-worktree-diff.js';
 import { buildGitWorktreePatchEnvelope } from '../git/git-worktree-patch-envelope.js';
+import { checkpointWorkerWorktree } from '../git/git-worktree-checkpoint.js';
 import { cleanupGitWorktree } from '../git/git-worktree-cleanup.js';
+import { createGitIntegrationWorktree } from '../git/git-integration-worktree.js';
+import { applyGitWorktreeMergeQueue } from '../git/git-worktree-merge-queue.js';
 export async function runNativeAgentOrchestrator(opts = {}) {
     const root = path.resolve(opts.root || process.cwd());
     const prompt = String(opts.prompt || 'Native agent run');
@@ -268,6 +271,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         worktree_root: gitWorktreePolicy?.worktree_root || null,
         allocations: [],
         diffs: [],
+        checkpoints: [],
         cleanup: [],
         blockers: []
     };
@@ -422,7 +426,10 @@ export async function runNativeAgentOrchestrator(opts = {}) {
     await writeJsonAtomic(path.join(ledgerRoot, 'local-collaboration-policy.json'), localCollaborationPolicy);
     const localParticipated = localCollaborationParticipated(results);
     const candidatePatchEnvelopes = results.flatMap((result) => Array.isArray(result.patch_envelopes) ? result.patch_envelopes : []);
-    const gptFinalArbiter = localParticipated
+    const worktreeParticipated = candidatePatchEnvelopes.some((envelope) => envelope?.source === 'git-worktree-diff' || envelope?.git_worktree?.worktree_path)
+        || results.some((result) => result?.git_worktree_diff || result?.git_worktree_checkpoint);
+    const gptFinalRequired = localParticipated || worktreeParticipated;
+    const gptFinalArbiter = gptFinalRequired
         ? await runFinalGptReviewStage({
             schema: 'sks.gpt-final-arbiter-input.v1',
             route,
@@ -446,10 +453,10 @@ export async function runNativeAgentOrchestrator(opts = {}) {
             rollback_plan: { verification_rollback_dag: strategyCompiled.verification_rollback_dag || null }
         }, { cwd: root, mutationLedgerRoot: path.join(ledgerRoot, 'gpt-final-arbiter') })
         : null;
-    const finalGptPatchStage = localParticipated
+    const finalGptPatchStage = gptFinalRequired
         ? selectFinalGptPatchSource(gptFinalArbiter, candidatePatchEnvelopes)
         : null;
-    const resultsForPatchSwarm = localParticipated && finalGptPatchStage?.ok === true && gptFinalArbiter?.result?.status === 'modified'
+    const resultsForPatchSwarm = gptFinalRequired && finalGptPatchStage?.ok === true && gptFinalArbiter?.result?.status === 'modified'
         ? withFinalGptPatchEnvelopes(results, finalGptPatchStage.patch_envelopes)
         : results;
     const patchSwarm = await runAgentPatchSwarmRuntime(root, ledgerRoot, {
@@ -460,7 +467,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         results: resultsForPatchSwarm,
         parallelWritePolicy,
         verificationRollbackDag: strategyCompiled.verification_rollback_dag,
-        dryRun: opts.dryRunPatches === true || opts.applyPatches !== true || (localParticipated && gptFinalArbiter?.ok !== true),
+        dryRun: opts.dryRunPatches === true || opts.applyPatches !== true || (gptFinalRequired && gptFinalArbiter?.ok !== true),
         gptFinalArbiter,
         finalGptPatchStage
     });
@@ -489,8 +496,8 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         ...(noSubagentScalingPolicy.ok ? [] : noSubagentScalingPolicy.blockers),
         ...(fastModePropagation.ok ? [] : fastModePropagation.blockers),
         ...(gitWorktreeRuntime.required === true && gitWorktreeRuntime.ok === false ? gitWorktreeRuntime.blockers || ['git_worktree_runtime_not_ok'] : []),
-        ...(localParticipated && gptFinalArbiter?.ok !== true ? gptFinalArbiter?.blockers || ['gpt_final_arbiter_not_ok'] : []),
-        ...(localParticipated && finalGptPatchStage?.ok === false ? finalGptPatchStage.blockers || ['final_gpt_patch_stage_not_ok'] : []),
+        ...(gptFinalRequired && gptFinalArbiter?.ok !== true ? gptFinalArbiter?.blockers || ['gpt_final_arbiter_not_ok'] : []),
+        ...(gptFinalRequired && finalGptPatchStage?.ok === false ? finalGptPatchStage.blockers || ['final_gpt_patch_stage_not_ok'] : []),
         ...(patchSwarm.ok ? [] : patchSwarm.blockers),
         ...(janitor.ok ? [] : janitor.blockers)
     ];
@@ -645,6 +652,14 @@ async function finalizeWorkerGitWorktree(input) {
         workerId: String(input.agent.id || input.slice.id || 'worker')
     });
     await writeJsonAtomic(path.join(input.workerWorktree.artifactDir, 'git-worktree-diff.json'), diff);
+    const checkpoint = await checkpointWorkerWorktree({
+        worktreePath: allocation.worktree_path,
+        repoRoot: allocation.main_repo_root || input.root,
+        workerId: String(input.agent.id || input.slice.id || 'worker'),
+        taskId: String(input.slice.id || input.agent.id || 'task'),
+        mode: 'auto'
+    });
+    await writeJsonAtomic(path.join(input.workerWorktree.artifactDir, 'git-worktree-checkpoint.json'), checkpoint);
     input.runtime.diffs.push({
         agent_id: input.agent.id,
         slice_id: input.slice.id,
@@ -654,18 +669,29 @@ async function finalizeWorkerGitWorktree(input) {
         diff_bytes: diff.diff_bytes,
         blockers: diff.blockers
     });
+    input.runtime.checkpoints.push({
+        agent_id: input.agent.id,
+        slice_id: input.slice.id,
+        ok: checkpoint.ok,
+        mode_applied: checkpoint.mode_applied,
+        commit_hash: checkpoint.commit_hash,
+        changed_files: checkpoint.changed_files,
+        blockers: checkpoint.blockers
+    });
     if (!diff.clean && diff.ok) {
         const envelope = buildGitWorktreePatchEnvelope({
             diff,
             agentId: String(input.agent.id || 'agent'),
             sessionId: String(input.agent.session_id || ''),
             slotId: String(input.agent.slot_id || ''),
-            generationIndex: Math.max(1, Math.floor(Number(input.agent.generation_index || 1)))
+            generationIndex: Math.max(1, Math.floor(Number(input.agent.generation_index || 1))),
+            checkpoint
         });
         input.result.patch_envelopes = [...(Array.isArray(input.result.patch_envelopes) ? input.result.patch_envelopes : []), envelope];
         input.result.changed_files = [...new Set([...(input.result.changed_files || []), ...diff.changed_files])];
-        input.result.artifacts = [...new Set([...(input.result.artifacts || []), path.relative(input.ledgerRoot, path.join(input.workerWorktree.artifactDir, 'git-worktree-diff.json'))])];
+        input.result.artifacts = [...new Set([...(input.result.artifacts || []), path.relative(input.ledgerRoot, path.join(input.workerWorktree.artifactDir, 'git-worktree-diff.json')), path.relative(input.ledgerRoot, path.join(input.workerWorktree.artifactDir, 'git-worktree-checkpoint.json'))])];
         input.result.git_worktree_diff = diff;
+        input.result.git_worktree_checkpoint = checkpoint;
     }
     const cleanup = await cleanupGitWorktree({
         repoRoot: allocation.main_repo_root || input.root,
@@ -682,7 +708,7 @@ async function finalizeWorkerGitWorktree(input) {
         retention_lock_path: cleanup.retention_lock_path,
         blockers: cleanup.blockers
     });
-    input.runtime.blockers.push(...diff.blockers, ...cleanup.blockers);
+    input.runtime.blockers.push(...diff.blockers, ...checkpoint.blockers, ...cleanup.blockers);
     input.runtime.ok = input.runtime.blockers.length === 0;
     await writeJsonAtomic(path.join(input.ledgerRoot, 'agent-git-worktree-runtime.json'), input.runtime);
 }
@@ -753,9 +779,18 @@ async function runAgentPatchSwarmRuntime(root, ledgerRoot, input) {
         }
     }
     const pendingEntries = queueStore.queue.queued();
-    const merge = coordinateAgentPatchMerge(pendingEntries);
+    const worktreeEntries = pendingEntries.filter((entry) => entry.envelope?.source === 'git-worktree-diff');
+    const normalEntries = pendingEntries.filter((entry) => entry.envelope?.source !== 'git-worktree-diff');
+    let worktreeMergeReport = null;
+    const worktreeApplyResults = [];
+    if (worktreeEntries.length) {
+        worktreeMergeReport = await runGitWorktreeIntegrationPrimary(root, ledgerRoot, input.missionId, worktreeEntries, queueStore);
+        for (const row of worktreeMergeReport.apply_results || [])
+            worktreeApplyResults.push(row);
+    }
+    const merge = coordinateAgentPatchMerge(normalEntries);
     await writeAgentMergeCoordinatorArtifacts(ledgerRoot, merge);
-    const conflictRebase = await executeAgentPatchConflictRebase(root, pendingEntries, merge, { dryRun: input.dryRun, artifactsDir: ledgerRoot });
+    const conflictRebase = await executeAgentPatchConflictRebase(root, normalEntries, merge, { dryRun: input.dryRun, artifactsDir: ledgerRoot });
     merge.conflict_rebase_results = 'agent-patch-conflict-rebase-results.json';
     merge.rebase_success_count = conflictRebase.succeeded_entry_ids.length;
     merge.rebase_blocker_count = conflictRebase.blockers.length;
@@ -765,11 +800,11 @@ async function runAgentPatchSwarmRuntime(root, ledgerRoot, input) {
     merge.unresolved_conflict_entry_ids = [...conflictedEntryIds];
     merge.ok = conflictedEntryIds.size === 0 && (conflictRebase.failed_entry_ids || []).length === 0 && (conflictRebase.blocked_entry_ids || []).length === 0;
     merge.blockers = merge.ok ? [] : merge.blockers || [];
-    for (const entry of pendingEntries) {
+    for (const entry of normalEntries) {
         if (conflictedEntryIds.has(entry.id))
             await queueStore.markConflicted(entry.id, merge.blockers || ['patch_conflict']);
     }
-    const disjointEntries = pendingEntries.filter((entry) => !conflictedEntryIds.has(entry.id));
+    const disjointEntries = normalEntries.filter((entry) => !conflictedEntryIds.has(entry.id));
     const startedAt = nowIso();
     for (const entryId of rebaseSucceededEntryIds) {
         await queueStore.markApplying(entryId);
@@ -797,6 +832,7 @@ async function runAgentPatchSwarmRuntime(root, ledgerRoot, input) {
         return { entry_id: entry.id, started_at, finished_at, ...applyResult };
     }));
     const applyResults = [
+        ...worktreeApplyResults,
         ...parallelApplyResults,
         ...(conflictRebase.apply_results || []).map((row) => ({ entry_id: row.entry_id, started_at: row.apply_started_at || nowIso(), finished_at: row.apply_ended_at || nowIso(), ...row }))
     ];
@@ -912,7 +948,8 @@ async function runAgentPatchSwarmRuntime(root, ledgerRoot, input) {
         conflictRebase,
         verificationRollbackDag: input.verificationRollbackDag,
         gptFinalArbiter: input.gptFinalArbiter,
-        finalGptPatchStage: input.finalGptPatchStage
+        finalGptPatchStage: input.finalGptPatchStage,
+        worktreeMergeReport
     };
     const initialProof = buildAgentPatchProof(proofInput);
     await writeJsonAtomic(path.join(ledgerRoot, 'agent-patch-proof.json'), initialProof);
@@ -942,6 +979,8 @@ async function runAgentPatchSwarmRuntime(root, ledgerRoot, input) {
         apply_finished_at: finishedAt,
         apply_latency_ms: Math.max(0, Date.parse(finishedAt) - Date.parse(startedAt)),
         parallel_apply_count: parallelEntries.length,
+        worktree_integration_primary_count: worktreeEntries.length,
+        worktree_merge_queue: worktreeMergeReport,
         parallel_apply_groups: merge.parallel_apply_groups || [],
         serial_merge_groups: merge.serial_merge_groups || [],
         conflict_rebase: {
@@ -971,7 +1010,8 @@ async function runAgentPatchSwarmRuntime(root, ledgerRoot, input) {
             proof: 'agent-patch-proof.json',
             transaction_journal: 'agent-patch-transaction-journal.jsonl',
             transaction_journal_summary: 'agent-patch-transaction-journal-summary.json',
-            conflict_rebase: 'agent-patch-conflict-rebase-results.json'
+            conflict_rebase: 'agent-patch-conflict-rebase-results.json',
+            git_worktree_merge_queue: worktreeMergeReport ? 'git-worktree-merge-queue-report.json' : null
         },
         blockers
     };
@@ -985,6 +1025,205 @@ async function runAgentPatchSwarmRuntime(root, ledgerRoot, input) {
     await writeJsonAtomic(path.join(ledgerRoot, 'agent-patch-swarm-runtime.json'), report);
     return report;
 }
+async function runGitWorktreeIntegrationPrimary(root, ledgerRoot, missionId, entries, queueStore) {
+    const diffs = entries.map((entry) => gitWorktreeDiffFromQueueEntry(entry)).filter(Boolean);
+    const checkpoints = entries.map((entry) => gitWorktreeCheckpointFromQueueEntry(entry)).filter(Boolean);
+    const repoRoot = diffs[0]?.main_repo_root || root;
+    const baseRef = diffs.find((diff) => diff.base_head)?.base_head || undefined;
+    const integration = await createGitIntegrationWorktree({ repoRoot, missionId, ...(baseRef ? { baseRef } : {}) });
+    const applyResults = [];
+    if (!integration.ok) {
+        for (const entry of entries) {
+            await queueStore.markConflicted(entry.id, integration.blockers || ['git_worktree_integration_allocation_failed']);
+            applyResults.push({
+                entry_id: entry.id,
+                started_at: nowIso(),
+                finished_at: nowIso(),
+                ok: false,
+                changed_files: entry.write_paths || entry.envelope?.git_worktree?.changed_files || [],
+                verification: { checks: ['git-worktree-integration-primary'] },
+                violations: integration.blockers || ['git_worktree_integration_allocation_failed']
+            });
+        }
+        const blockedReport = {
+            schema: 'sks.git-worktree-integration-primary-runtime.v1',
+            ok: false,
+            generated_at: nowIso(),
+            integration,
+            integration_worktree_path: integration.worktree_path || null,
+            applied_entry_ids: [],
+            conflicted_entry_ids: entries.map((entry) => entry.id),
+            apply_results: applyResults,
+            blockers: integration.blockers || ['git_worktree_integration_allocation_failed']
+        };
+        await writeJsonAtomic(path.join(ledgerRoot, 'git-worktree-merge-queue-report.json'), blockedReport);
+        return blockedReport;
+    }
+    const startedAt = nowIso();
+    for (const entry of entries)
+        await queueStore.markApplying(entry.id);
+    const queueReport = await applyGitWorktreeMergeQueue({
+        integrationWorktreePath: integration.worktree_path,
+        diffs,
+        checkpoints
+    });
+    const rollbackPlan = queueReport.ok ? await captureGitWorktreeRollbackPlan(repoRoot, queueReport.changed_files || []) : { ok: false, rollback: [], blockers: ['git_worktree_integration_prevalidation_failed'] };
+    const mainApplyReport = queueReport.ok && rollbackPlan.ok
+        ? await applyGitWorktreeMergeQueue({
+            integrationWorktreePath: repoRoot,
+            diffs,
+            checkpoints
+        })
+        : null;
+    const rollbackEvidence = mainApplyReport?.ok
+        ? await completeGitWorktreeRollbackPlan(repoRoot, rollbackPlan.rollback)
+        : rollbackPlan;
+    const finishedAt = nowIso();
+    const conflictsByWorker = new Set([
+        ...(queueReport.conflicts || []).map((row) => String(row.worker_id || row.workerId || '')),
+        ...(mainApplyReport?.conflicts || []).map((row) => String(row.worker_id || row.workerId || ''))
+    ]);
+    const appliedEntryIds = [];
+    const conflictedEntryIds = [];
+    for (const entry of entries) {
+        const workerId = String(entry.envelope?.git_worktree?.worker_id || entry.envelope?.agent_id || entry.agent_id || '');
+        const changedFiles = entry.write_paths || entry.envelope?.git_worktree?.changed_files || [];
+        const ok = queueReport.ok && mainApplyReport?.ok === true && rollbackEvidence.ok === true && !conflictsByWorker.has(workerId);
+        if (ok) {
+            await queueStore.markApplied(entry.id);
+            appliedEntryIds.push(entry.id);
+        }
+        else {
+            await queueStore.markConflicted(entry.id, queueReport.blockers || ['git_worktree_merge_failed']);
+            conflictedEntryIds.push(entry.id);
+        }
+        applyResults.push({
+            entry_id: entry.id,
+            started_at: startedAt,
+            finished_at: finishedAt,
+            ok,
+            changed_files: changedFiles,
+            rollback: ok ? rollbackEvidence.rollback.filter((row) => changedFiles.includes(row.path)) : [],
+            rollback_digest: ok ? `git-worktree-integration:${entry.id}:${sha256(JSON.stringify(rollbackEvidence.rollback.filter((row) => changedFiles.includes(row.path))))}` : null,
+            verification: { checks: ['git-worktree-integration-primary', 'git-apply-3way', 'main-repo-apply', 'rollback-hashes'] },
+            violations: ok ? [] : [...(queueReport.blockers || []), ...(mainApplyReport?.blockers || []), ...(rollbackEvidence.blockers || []), 'git_worktree_main_repo_apply_failed'].filter(Boolean)
+        });
+    }
+    const reportBlockers = [...(queueReport.blockers || []), ...(mainApplyReport?.blockers || []), ...(rollbackEvidence.blockers || [])];
+    const report = {
+        schema: 'sks.git-worktree-integration-primary-runtime.v1',
+        ok: reportBlockers.length === 0 && appliedEntryIds.length === entries.length,
+        generated_at: nowIso(),
+        integration,
+        integration_worktree_path: integration.worktree_path,
+        applied_entry_ids: appliedEntryIds,
+        conflicted_entry_ids: conflictedEntryIds,
+        merge_queue: queueReport,
+        main_repo_apply: mainApplyReport,
+        rollback_evidence: rollbackEvidence,
+        apply_results: applyResults,
+        blockers: reportBlockers
+    };
+    await writeJsonAtomic(path.join(ledgerRoot, 'git-worktree-merge-queue-report.json'), report);
+    return report;
+}
+async function captureGitWorktreeRollbackPlan(root, changedFiles) {
+    const rootResolved = path.resolve(root);
+    const rollback = [];
+    const blockers = [];
+    for (const file of [...new Set(changedFiles.map((row) => String(row || '').trim()).filter(Boolean))]) {
+        const rel = normalizeWorktreeRelPath(file);
+        const absolute = path.resolve(rootResolved, rel);
+        if (!absolute.startsWith(rootResolved + path.sep)) {
+            blockers.push(`git_worktree_rollback_path_outside_root:${rel}`);
+            continue;
+        }
+        const beforeExists = await exists(absolute);
+        const before = beforeExists ? await readText(absolute, '') : '';
+        rollback.push({
+            path: rel,
+            existed: beforeExists,
+            sha256_before: beforeExists ? sha256(String(before)) : null,
+            content_before: beforeExists ? String(before) : null
+        });
+    }
+    return { ok: blockers.length === 0, rollback, blockers };
+}
+async function completeGitWorktreeRollbackPlan(root, rollback) {
+    const rootResolved = path.resolve(root);
+    const blockers = [];
+    const completed = [];
+    for (const row of rollback) {
+        const rel = normalizeWorktreeRelPath(row.path);
+        const absolute = path.resolve(rootResolved, rel);
+        if (!absolute.startsWith(rootResolved + path.sep)) {
+            blockers.push(`git_worktree_rollback_path_outside_root:${rel}`);
+            continue;
+        }
+        const afterExists = await exists(absolute);
+        if (!afterExists) {
+            blockers.push(`git_worktree_rollback_after_missing:${rel}`);
+            completed.push({ ...row, path: rel, sha256_after: null });
+            continue;
+        }
+        const after = await readText(absolute, '');
+        completed.push({
+            ...row,
+            path: rel,
+            sha256_after: sha256(String(after))
+        });
+    }
+    return { ok: blockers.length === 0, rollback: completed, blockers };
+}
+function normalizeWorktreeRelPath(file) {
+    return String(file || '').replace(/\\/g, '/').replace(/^\/+/, '');
+}
+function gitWorktreeDiffFromQueueEntry(entry) {
+    const envelope = entry?.envelope || {};
+    const meta = envelope.git_worktree || {};
+    const operation = Array.isArray(envelope.operations) ? envelope.operations.find((row) => row?.op === 'git_apply_patch') : null;
+    const diff = String(operation?.diff || '');
+    return {
+        schema: 'sks.git-worktree-diff.v1',
+        ok: true,
+        generated_at: nowIso(),
+        mission_id: String(envelope.mission_id || ''),
+        worker_id: String(envelope.agent_id || entry.agent_id || entry.id),
+        main_repo_root: String(meta.main_repo_root || ''),
+        worktree_path: String(meta.worktree_path || ''),
+        branch: meta.branch == null ? null : String(meta.branch),
+        base_head: meta.base_head == null ? null : String(meta.base_head),
+        worktree_head: meta.worktree_head == null ? null : String(meta.worktree_head),
+        status_porcelain: '',
+        changed_files: Array.isArray(meta.changed_files) ? meta.changed_files.map(String) : entry.write_paths || [],
+        untracked_files: [],
+        diff,
+        diff_bytes: Buffer.byteLength(diff),
+        clean: diff.trim().length === 0,
+        blockers: []
+    };
+}
+function gitWorktreeCheckpointFromQueueEntry(entry) {
+    const envelope = entry?.envelope || {};
+    const meta = envelope.git_worktree || {};
+    const checkpoint = meta.checkpoint || null;
+    if (!checkpoint || checkpoint.mode_applied !== 'checkpoint-commit' || !checkpoint.commit_hash)
+        return null;
+    return {
+        schema: 'sks.git-worktree-checkpoint.v1',
+        ok: Array.isArray(checkpoint.blockers) ? checkpoint.blockers.length === 0 : true,
+        generated_at: nowIso(),
+        worktree_path: String(meta.worktree_path || ''),
+        repo_root: String(meta.main_repo_root || ''),
+        worker_id: String(envelope.agent_id || entry.agent_id || entry.id),
+        task_id: String(envelope.task_slice_id || entry.id || ''),
+        mode_requested: 'auto',
+        mode_applied: 'checkpoint-commit',
+        commit_hash: String(checkpoint.commit_hash),
+        changed_files: Array.isArray(checkpoint.changed_files) ? checkpoint.changed_files.map(String) : Array.isArray(meta.changed_files) ? meta.changed_files.map(String) : [],
+        blockers: Array.isArray(checkpoint.blockers) ? checkpoint.blockers.map(String) : []
+    };
+}
 function normalizeDesiredWorkItemCount(value, minimumValue, targetActiveSlots) {
     const parsed = Number(value);
     const minimum = Number(minimumValue);

package/dist/core/agents/agent-patch-schema.js

@@ -117,7 +117,14 @@ function normalizeGitWorktreeMetadata(input) {
         base_head: input?.base_head == null ? null : String(input.base_head),
         worktree_head: input?.worktree_head == null ? null : String(input.worktree_head),
         changed_files: Array.isArray(input?.changed_files) ? input.changed_files.map(String) : [],
-        diff_bytes: Number(input?.diff_bytes || 0)
+        diff_bytes: Number(input?.diff_bytes || 0),
+        checkpoint: input?.checkpoint ? {
+            ...(input.checkpoint.schema === undefined ? {} : { schema: String(input.checkpoint.schema) }),
+            ...(input.checkpoint.mode_applied === undefined ? {} : { mode_applied: String(input.checkpoint.mode_applied) }),
+            commit_hash: input.checkpoint.commit_hash == null ? null : String(input.checkpoint.commit_hash),
+            changed_files: Array.isArray(input.checkpoint.changed_files) ? input.checkpoint.changed_files.map(String) : [],
+            blockers: Array.isArray(input.checkpoint.blockers) ? input.checkpoint.blockers.map(String) : []
+        } : null
     };
 }
 function normalizeHint(input) {

package/dist/core/agents/agent-role-config.js

@@ -0,0 +1,92 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
+export const AGENT_ROLE_CONFIG_REPAIR_SCHEMA = 'sks.agent-role-config-repair.v1';
+const SKS_OWNED_AGENT_CONFIGS = new Map([
+    ['analysis-scout.toml', roleConfig('analysis_scout', 'Read-only SKS analysis scout retained for stale Codex agent-role config repair.', 'read-only')],
+    ['native-agent-intake.toml', roleConfig('native_agent', 'Read-only Team native agent for repository/docs/tests/API/risk slices.', 'read-only')],
+    ['team-consensus.toml', roleConfig('team_consensus', 'Planning and debate specialist for SKS Team mode.', 'read-only')],
+    ['implementation-worker.toml', roleConfig('implementation_worker', 'Implementation specialist for bounded SKS Team write sets.', 'workspace-write')],
+    ['db-safety-reviewer.toml', roleConfig('db_safety_reviewer', 'Read-only database safety reviewer for SQL, migrations, Supabase, and rollback safety.', 'read-only')],
+    ['qa-reviewer.toml', roleConfig('qa_reviewer', 'Strict read-only verification reviewer for correctness, regressions, and final evidence.', 'read-only')]
+]);
+export async function repairAgentRoleConfigs(input) {
+    const root = path.resolve(input.root);
+    const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || '', '.codex');
+    const candidates = [path.join(root, '.codex', 'agents'), path.join(codexHome, 'agents')];
+    const missing = [];
+    const stale = [];
+    const created = [];
+    const repaired = [];
+    const existing = [];
+    for (const [file, config] of SKS_OWNED_AGENT_CONFIGS) {
+        const found = candidates.find((dir) => fs.existsSync(path.join(dir, file)));
+        if (found) {
+            const foundPath = path.join(found, file);
+            const text = fs.readFileSync(foundPath, 'utf8');
+            if (isValidRoleConfig(text, config)) {
+                existing.push(path.relative(root, foundPath) || foundPath);
+                continue;
+            }
+            stale.push(file);
+            if (input.apply) {
+                const target = foundPath.startsWith(path.join(root, '.codex', 'agents')) ? foundPath : path.join(root, '.codex', 'agents', file);
+                await ensureDir(path.dirname(target));
+                await writeTextAtomic(target, config.content);
+                repaired.push(path.relative(root, target));
+            }
+            continue;
+        }
+        missing.push(file);
+        if (input.apply) {
+            const target = path.join(root, '.codex', 'agents', file);
+            await ensureDir(path.dirname(target));
+            await writeTextAtomic(target, config.content);
+            created.push(path.relative(root, target));
+        }
+    }
+    const requiredFixes = missing.length + stale.length;
+    const appliedFixes = created.length + repaired.length;
+    const report = {
+        schema: AGENT_ROLE_CONFIG_REPAIR_SCHEMA,
+        generated_at: nowIso(),
+        ok: input.apply ? requiredFixes === appliedFixes : true,
+        apply: input.apply === true,
+        missing,
+        stale,
+        existing,
+        created,
+        repaired,
+        warnings_suppressed: true,
+        blockers: input.apply && requiredFixes !== appliedFixes ? ['agent_role_config_repair_incomplete'] : []
+    };
+    if (input.reportPath)
+        await writeJsonAtomic(input.reportPath, report);
+    return report;
+}
+function roleConfig(name, description, sandbox) {
+    const content = [
+        `name = "${name}"`,
+        `description = "${description}"`,
+        `model = "${REQUIRED_CODEX_MODEL}"`,
+        'model_reasoning_effort = "medium"',
+        `sandbox_mode = "${sandbox}"`,
+        'approval_policy = "never"',
+        'developer_instructions = """',
+        `You are the SKS ${name} role.`,
+        sandbox === 'read-only' ? 'Do not edit files.' : 'Only edit the bounded files assigned by the parent orchestrator.',
+        'Return concise source-backed findings and LIVE_EVENT lines when applicable.',
+        '"""',
+        ''
+    ].join('\n');
+    return { name, sandbox, content };
+}
+function isValidRoleConfig(text, config) {
+    return text.includes(`name = "${config.name}"`)
+        && text.includes('description = "')
+        && text.includes(`model = "${REQUIRED_CODEX_MODEL}"`)
+        && text.includes(`sandbox_mode = "${config.sandbox}"`)
+        && text.includes('developer_instructions = """');
+}
+//# sourceMappingURL=agent-role-config.js.map