sneakoscope 3.1.10 → 3.1.11

package/README.md

@@ -35,15 +35,15 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.10** is a release-ready hardening pass for release wiring parity, immutable core skills, duplicate skill prevention, native capability postchecks, and protected secret rollback.
+SKS **3.1.11** is a release-ready repair pass for MAD Zellij stacked panes, Context7 MCP doctor recovery, and stale Codex startup config.
 
-What changed in 3.1.10:
+What changed in 3.1.11:
 
-- **Core SKS skills are content-addressed and immutable.** The eight built-in route skills now have a manifest and no-drift gates; setup/update/doctor may install missing managed copies or restore corrupted managed copies, but they do not overwrite user-authored collisions.
-- **Release wiring is self-checking.** `release:gate-script-parity`, `release:wiring-3110-blackbox`, and `sks:3110-all-feature-regression` prove required ids, package scripts, release gates, source scripts, and built dist targets stay aligned.
-- **Duplicate skills are detected and repaired safely.** Canonical skill names collapse variants such as `Loop`, `loop`, and `loop/SKILL.md`; SKS-managed duplicates can be quarantined automatically, while user-authored duplicates require explicit confirmation and produce active-name proof.
-- **`sks doctor --fix` reports native capability truthfully.** Image generation, image follow-up edit paths, Computer Use, Chrome/web review, app screenshots, app handoff, and image path exposure now run capability-specific postchecks; manual-only and fallback surfaces do not become `verified`.
-- **Supabase keys survive setup/update/doctor.** Protected secret surfaces are fingerprinted before and after guarded operations; missing or changed values are restored from backup or hard-fail without writing raw values to reports.
+- **MAD Zellij panes require native stacked-pane support.** `sks doctor --fix` now treats Zellij 0.43.0 as the minimum interactive runtime so `sks --mad` can use native stacked worker panes instead of fragmenting into plain splits.
+- **Context7 stdio lockups are doctor-repairable.** `sks doctor --fix` detects local `@upstash/context7-mcp` stdio config and migrates it to the remote Context7 MCP endpoint so Codex launches do not stall at the stdio server banner.
+- **Codex startup warnings are doctor-repairable.** `sks doctor --fix` rewrites stale SKS agent `config_file` paths to existing absolute files, removes unsupported managed `message_role_prefix` role fields, preserves optional `supabase_sauron`, and drops missing-command `node_repl` MCP blocks that would otherwise spam startup.
+- **Doctor JSON exposes the Context7 and startup repair reports.** `context7_repair`, `codex_startup_repair`, and their `repair.*` entries carry migration status, backups, actions, warnings, and any manual auth actions.
+- **Release metadata is aligned for 3.1.11.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.10"
+version = "3.1.11"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.10"
+version = "3.1.11"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.10"),
+        Some("--version") => println!("sks-rs 3.1.11"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.1.10",
-  "source_digest": "57a7f5ee1f3ac797f46e3dfd59365b1e147e4637a8ddd18fde2cbee802fec0ac",
-  "source_file_count": 2609,
-  "built_at_source_time": 1781550268084
+  "package_version": "3.1.11",
+  "source_digest": "932de0e70bb2a5b787aef2782fa56cbc4956c6077d099d9e1067b9406fd8412a",
+  "source_file_count": 2613,
+  "built_at_source_time": 1781554790419
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.10';
+const FAST_PACKAGE_VERSION = '3.1.11';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -24,6 +24,8 @@ import { runCodex0138Doctor } from '../core/doctor/codex-0138-doctor.js';
 import { writeCodexPluginInventoryArtifacts, pluginAppTemplatePolicy } from '../core/codex-plugins/codex-plugin-json.js';
 import { writeMcpPluginInventoryArtifacts } from '../core/mcp/mcp-plugin-inventory.js';
 import { runDoctorZellijRepair, doctorZellijRepairConsoleLine } from '../core/doctor/doctor-zellij-repair.js';
+import { runDoctorContext7Repair } from '../core/doctor/doctor-context7-repair.js';
+import { runDoctorCodexStartupRepair } from '../core/doctor/doctor-codex-startup-repair.js';
 import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
 import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
@@ -118,6 +120,19 @@ async function runDoctor(args = [], root, doctorFix) {
         requireActualCodex: flag(args, '--fix') || flag(args, '--require-actual-codex'),
         codexBin: codexBin || undefined
     };
+    let codexStartupRepair = await runDoctorCodexStartupRepair({ root, fix: doctorFix }).catch((err) => ({
+        schema: 'sks.doctor-codex-startup-repair.v1',
+        ok: false,
+        generated_at: new Date().toISOString(),
+        fix: doctorFix,
+        configs: [],
+        agent_role_files: { sanitized: [], created: [], blockers: [err?.message || String(err)] },
+        actions: [],
+        manual_actions: [],
+        blockers: [err?.message || String(err)],
+        warnings: [],
+        report_path: `${root}/.sneakoscope/reports/doctor-codex-startup-repair.json`
+    }));
     const codexDoctorBefore = flag(args, '--fix') ? await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') }).catch(() => null) : null;
     const configRepair = flag(args, '--fix') ? await repairCodexConfigEperm(root, { fix: true, ...configProbeOpts }) : null;
     const migrationJournal = flag(args, '--fix')
@@ -126,6 +141,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const codexConfig = configRepair?.after || await inspectCodexConfigReadability(root, configProbeOpts);
     const codexDoctor = await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') });
     const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, codexDoctor);
+    codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, codexDoctor);
     const codex = codexBin
         ? { bin: codexBin, version: 'fixture-or-explicit', available: true }
         : await getCodexInfo().catch(() => ({ bin: null, version: null, available: false }));
@@ -212,6 +228,18 @@ async function runDoctor(args = [], root, doctorFix) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    const context7Repair = await runDoctorContext7Repair({ root, fix: doctorFix }).catch((err) => ({
+        schema: 'sks.doctor-context7-repair.v1',
+        ok: false,
+        generated_at: new Date().toISOString(),
+        fix: doctorFix,
+        preferred_transport: 'remote',
+        configs: [],
+        actions: [],
+        blockers: [err?.message || String(err)],
+        warnings: [],
+        report_path: `${root}/.sneakoscope/reports/doctor-context7-repair.json`
+    }));
     const zellij = await checkZellijCapability({ root, require: process.env.SKS_REQUIRE_ZELLIJ === '1' });
     const localModel = await readLocalModelConfig().catch(() => null);
     const permissionProfiles = await inventoryCodexPermissionProfiles(root, { writeReport: true });
@@ -291,6 +319,8 @@ async function runDoctor(args = [], root, doctorFix) {
         codex_doctor: codexDoctor,
         require_codex_doctor: flag(args, '--fix') || flag(args, '--require-actual-codex'),
         zellij,
+        context7_repair: context7Repair,
+        codex_startup_repair: codexStartupRepair,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         repair: configRepair,
@@ -304,6 +334,7 @@ async function runDoctor(args = [], root, doctorFix) {
             ...(codexConfig.operator_actions || []),
             ...(configRepair?.operator_actions || []),
             ...(zellijRepair && !zellijRepair.ok && zellijRepair.command ? [`Run: ${zellijRepair.command}`] : []),
+            ...(codexStartupRepair.manual_actions || []),
             ...(pluginPolicy?.doctor_warnings || [])
         ]
     });
@@ -311,7 +342,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
         schema: 'sks.doctor-status.v1',
-        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false,
+        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false,
         root,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
@@ -325,6 +356,8 @@ async function runDoctor(args = [], root, doctorFix) {
         codex_doctor_diff: codexDoctorDiff,
         zellij,
         zellij_repair: zellijRepair,
+        context7_repair: context7Repair,
+        codex_startup_repair: codexStartupRepair,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         zellij_readiness: zellijReadiness,
@@ -348,7 +381,7 @@ async function runDoctor(args = [], root, doctorFix) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
     };
     if (flag(args, '--json')) {
         printJson(result);
@@ -375,6 +408,21 @@ async function runDoctor(args = [], root, doctorFix) {
     const zellijRepairLine = doctorZellijRepairConsoleLine(zellijRepair);
     if (zellijRepairLine)
         console.log(zellijRepairLine);
+    console.log('Context7 MCP:');
+    console.log(`  transport: ${context7Repair.preferred_transport || 'remote'}`);
+    console.log(`  repair: ${context7Repair.ok ? 'ok' : 'blocked'}`);
+    for (const action of context7Repair.actions || [])
+        console.log(`  - ${action}`);
+    for (const warning of context7Repair.warnings || [])
+        console.log(`  warning: ${warning}`);
+    console.log('Codex startup config:');
+    console.log(`  repair: ${codexStartupRepair.ok ? 'ok' : 'blocked'}`);
+    for (const action of codexStartupRepair.actions || [])
+        console.log(`  - ${action}`);
+    for (const action of codexStartupRepair.manual_actions || [])
+        console.log(`  manual: ${action}`);
+    for (const warning of codexStartupRepair.warnings || [])
+        console.log(`  warning: ${warning}`);
     console.log(`  codex doctor:    ${codexDoctor.available ? (codexDoctor.exit_code === 0 ? 'ok' : 'warning') : 'unavailable'}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
@@ -721,4 +769,30 @@ function readOption(args = [], name, fallback = null) {
     const index = args.indexOf(name);
     return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
 }
+function mergeObservedCodexStartupWarnings(startupRepair, codexDoctor) {
+    const text = `${codexDoctor?.stdout_tail || ''}\n${codexDoctor?.stderr_tail || ''}`;
+    const manual = new Set(Array.isArray(startupRepair?.manual_actions) ? startupRepair.manual_actions : []);
+    const warnings = new Set(Array.isArray(startupRepair?.warnings) ? startupRepair.warnings : []);
+    const blockers = new Set(Array.isArray(startupRepair?.blockers) ? startupRepair.blockers : []);
+    if (/codex_apps[\s\S]{0,500}token_expired|token_expired[\s\S]{0,500}codex_apps/i.test(text)) {
+        manual.add('Codex Apps MCP token is expired; sign in to Codex App/CLI again so the connector can mint a fresh token.');
+        warnings.add('codex_apps_token_expired_observed');
+        blockers.add('codex_apps_token_expired_manual_reauth_required');
+    }
+    if (/SUPABASE_ACCESS_TOKEN[\s\S]{0,500}mcp server ['"`]?supabase['"`]?|mcp server ['"`]?supabase['"`]?[\s\S]{0,500}SUPABASE_ACCESS_TOKEN/i.test(text)) {
+        manual.add('Supabase MCP uses SUPABASE_ACCESS_TOKEN but the variable is unset; export the token or migrate that server to a read-only remote URL.');
+        warnings.add('supabase_access_token_missing_observed');
+        blockers.add('supabase_access_token_missing_manual_auth_required');
+    }
+    if (/node_repl[\s\S]{0,500}No such file or directory|No such file or directory[\s\S]{0,500}node_repl/i.test(text)) {
+        warnings.add('node_repl_missing_command_observed');
+    }
+    return {
+        ...startupRepair,
+        ok: blockers.size === 0 && startupRepair?.ok !== false,
+        manual_actions: [...manual],
+        warnings: [...warnings],
+        blockers: [...blockers]
+    };
+}
 //# sourceMappingURL=doctor.js.map

package/dist/core/codex-app/codex-agent-role-sync.js

@@ -56,7 +56,7 @@ export async function syncCodexAgentRoles(input) {
         for (const role of DIRECTIVE_ROLES) {
             const file = path.join(targetDir, `${role}.toml`);
             const current = await fs.readFile(file, 'utf8').catch(() => '');
-            if (current && !current.includes('SKS managed 3.1.4 directive role') && !current.includes('SKS managed 3.1.5 directive role') && !current.includes('SKS managed 3.1.6 directive role') && !current.includes('SKS managed 3.1.6 bounded role') && !current.includes('SKS managed 3.1.7 directive role'))
+            if (current && !isSksManagedDirectiveRole(current))
                 continue;
             await writeTextAtomic(file, roleToml(role, rolePayloads[role]));
             created.push(file);
@@ -84,13 +84,9 @@ export async function syncCodexAgentRoles(input) {
     return report;
 }
 function roleToml(role, payload) {
-    const strategyLine = payload?.strategy === 'agent_type'
-        ? `agent_type = "${payload.agent_type || role}"`
-        : `message_role_prefix = "${escapeToml(payload?.message_role_prefix || `Role: ${role}.`)}"`;
     return [
         `name = "${role}"`,
-        `description = "SKS managed 3.1.7 directive role: ${role}"`,
-        strategyLine,
+        `description = "SKS managed 3.1.11 directive role: ${role}"`,
         'model_reasoning_effort = "medium"',
         role.includes('implementer') ? 'sandbox_mode = "workspace-write"' : 'sandbox_mode = "read-only"',
         'approval_policy = "never"',
@@ -110,6 +106,10 @@ function roleToml(role, payload) {
         ''
     ].join('\n');
 }
+function isSksManagedDirectiveRole(text) {
+    return /SKS managed 3\.1\.(?:4|5|6|7|11) (?:directive|bounded) role/.test(text)
+        || /\bmessage_role_prefix\s*=/.test(text) && /SKS managed 3\.1\./.test(text);
+}
 function blockersOf(value) {
     return Boolean(value) && typeof value === 'object' && Array.isArray(value.blockers)
         ? (value.blockers).map((item) => String(item)).filter(Boolean)

package/dist/core/doctor/doctor-codex-startup-repair.js

@@ -0,0 +1,269 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
+import { ensureDir, exists, nowIso, readText, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+export const DOCTOR_CODEX_STARTUP_REPAIR_SCHEMA = 'sks.doctor-codex-startup-repair.v1';
+const AGENT_ROLE_FILES = new Map([
+    ['analysis_scout', { file: 'analysis-scout.toml', description: 'Read-only SKS scout.', sandbox: 'read-only', nicknames: ['Scout', 'Mapper'] }],
+    ['native_agent', { file: 'native-agent-intake.toml', description: 'Read-only SKS analysis agent.', sandbox: 'read-only', nicknames: ['Analysis', 'Mapper'] }],
+    ['team_consensus', { file: 'team-consensus.toml', description: 'SKS planning/debate agent.', sandbox: 'read-only', nicknames: ['Consensus', 'Atlas'] }],
+    ['implementation_worker', { file: 'implementation-worker.toml', description: 'SKS bounded implementation worker.', sandbox: 'workspace-write', nicknames: ['Builder', 'Mason'] }],
+    ['db_safety_reviewer', { file: 'db-safety-reviewer.toml', description: 'Read-only DB safety reviewer.', sandbox: 'read-only', nicknames: ['Sentinel', 'Ledger'] }],
+    ['qa_reviewer', { file: 'qa-reviewer.toml', description: 'Read-only QA reviewer.', sandbox: 'read-only', nicknames: ['Verifier', 'Reviewer'] }]
+]);
+const DIRECTIVE_ROLE_FILES = [
+    'sks-explorer.toml',
+    'sks-planner.toml',
+    'sks-implementer.toml',
+    'sks-checker.toml',
+    'sks-release-verifier.toml',
+    'sks-zellij-ui-verifier.toml',
+    'sks-codex-probe-verifier.toml'
+];
+export async function runDoctorCodexStartupRepair(input) {
+    const root = path.resolve(input.root || process.cwd());
+    const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
+    const roleFiles = input.fix
+        ? await repairAgentRoleFiles(root, codexHome)
+        : await inspectAgentRoleFiles(root, codexHome);
+    const configs = [];
+    for (const candidate of [
+        { scope: 'project', path: path.join(root, '.codex', 'config.toml'), agentDir: path.join(root, '.codex', 'agents') },
+        { scope: 'global', path: path.join(codexHome, 'config.toml'), agentDir: path.join(codexHome, 'agents') }
+    ]) {
+        configs.push(await inspectOrRepairConfig(candidate, input.fix));
+    }
+    const blockers = [...roleFiles.blockers, ...configs.flatMap((entry) => entry.blockers.map((item) => `${entry.scope}:${item}`))];
+    const warnings = configs.flatMap((entry) => entry.warnings.map((item) => `${entry.scope}:${item}`));
+    const actions = [
+        ...roleFiles.sanitized.map((file) => `removed unsupported message_role_prefix from ${file}`),
+        ...roleFiles.created.map((file) => `created missing SKS agent role config ${file}`),
+        ...configs.flatMap((entry) => [
+            ...entry.agent_config_files_repaired.map((file) => `${entry.scope} agent config_file now points at ${file}`),
+            ...entry.stale_mcp_blocks_removed.map((server) => `${entry.scope} stale MCP block removed: ${server}`)
+        ])
+    ];
+    const manualActions = [
+        ...configs.flatMap((entry) => entry.blockers
+            .filter((item) => item.includes('codex_apps_token_expired'))
+            .map(() => 'Codex Apps MCP token is expired; sign in to Codex App/CLI again so the connector can mint a fresh token.')),
+        ...configs.flatMap((entry) => entry.blockers
+            .filter((item) => item.includes('supabase_access_token_missing'))
+            .map(() => 'Supabase MCP uses SUPABASE_ACCESS_TOKEN but the variable is unset; export the token or migrate that server to a read-only remote URL.'))
+    ];
+    const reportPath = path.join(root, '.sneakoscope', 'reports', 'doctor-codex-startup-repair.json');
+    const report = {
+        schema: DOCTOR_CODEX_STARTUP_REPAIR_SCHEMA,
+        ok: blockers.length === 0,
+        generated_at: nowIso(),
+        fix: input.fix === true,
+        configs,
+        agent_role_files: roleFiles,
+        actions,
+        manual_actions: [...new Set(manualActions)],
+        blockers,
+        warnings,
+        report_path: reportPath
+    };
+    await writeJsonAtomic(reportPath, report);
+    return report;
+}
+async function inspectOrRepairConfig(candidate, fix) {
+    const text = await readText(candidate.path, null);
+    if (text == null) {
+        return {
+            scope: candidate.scope,
+            path: candidate.path,
+            present: false,
+            changed: false,
+            backup_path: null,
+            agent_config_files_repaired: [],
+            stale_mcp_blocks_removed: [],
+            optional_mcp_blocks_ignored: [],
+            blockers: [],
+            warnings: candidate.scope === 'global' ? ['codex_home_config_missing_optional'] : []
+        };
+    }
+    let next = text;
+    const agentConfigFilesRepaired = [];
+    const staleMcpBlocksRemoved = [];
+    const optionalMcpBlocksIgnored = [];
+    const blockers = [];
+    const warnings = [];
+    for (const [tableName, role] of AGENT_ROLE_FILES) {
+        const target = path.join(candidate.agentDir, role.file);
+        const table = tomlBlock(next, `agents.${tableName}`);
+        if (!table)
+            continue;
+        const current = stringValue(table.text, 'config_file');
+        const targetExists = await exists(target);
+        const currentValid = Boolean(current && path.isAbsolute(current) && await exists(current));
+        if (currentValid && current === target)
+            continue;
+        warnings.push(`agent_config_file_stale:${tableName}`);
+        if (!fix)
+            continue;
+        if (!targetExists) {
+            await ensureDir(path.dirname(target));
+            await writeTextAtomic(target, roleConfigToml(tableName, role.description, role.sandbox));
+        }
+        next = replaceOrInsertKey(next, table, 'config_file', `"${escapeToml(target)}"`);
+        agentConfigFilesRepaired.push(target);
+    }
+    for (const server of ['node_repl']) {
+        const table = tomlBlock(next, `mcp_servers.${server}`);
+        if (!table)
+            continue;
+        const command = stringValue(table.text, 'command');
+        if (!command || await commandExists(command))
+            continue;
+        warnings.push(`stale_mcp_command_missing:${server}`);
+        if (fix) {
+            next = removeTomlBlock(next, table);
+            staleMcpBlocksRemoved.push(server);
+        }
+    }
+    for (const server of ['supabase_sauron']) {
+        if (tomlBlock(next, `mcp_servers.${server}`))
+            optionalMcpBlocksIgnored.push(server);
+    }
+    const supabase = tomlBlock(next, 'mcp_servers.supabase');
+    if (supabase && /\bSUPABASE_ACCESS_TOKEN\b/.test(supabase.text) && !process.env.SUPABASE_ACCESS_TOKEN) {
+        blockers.push('supabase_access_token_missing');
+    }
+    const codexApps = tomlBlock(next, 'mcp_servers.codex_apps');
+    if (codexApps && /token_expired|expired/i.test(codexApps.text))
+        blockers.push('codex_apps_token_expired');
+    const changed = next !== text;
+    const backupPath = changed && fix ? await backupConfig(candidate.path, text, 'startup') : null;
+    if (changed && fix)
+        await writeTextAtomic(candidate.path, next.replace(/\n{3,}/g, '\n\n').replace(/\s*$/, '\n'));
+    return {
+        scope: candidate.scope,
+        path: candidate.path,
+        present: true,
+        changed,
+        backup_path: backupPath,
+        agent_config_files_repaired: agentConfigFilesRepaired,
+        stale_mcp_blocks_removed: staleMcpBlocksRemoved,
+        optional_mcp_blocks_ignored: optionalMcpBlocksIgnored,
+        blockers,
+        warnings
+    };
+}
+async function inspectAgentRoleFiles(root, codexHome) {
+    const dirs = [path.join(root, '.codex', 'agents'), path.join(codexHome, 'agents')];
+    const sanitized = [];
+    for (const dir of dirs) {
+        for (const file of DIRECTIVE_ROLE_FILES) {
+            const full = path.join(dir, file);
+            const text = await readText(full, null);
+            if (typeof text === 'string' && /\bmessage_role_prefix\s*=/.test(text) && /SKS managed 3\.1\./.test(text))
+                sanitized.push(full);
+        }
+    }
+    return { sanitized, created: [], blockers: [] };
+}
+async function repairAgentRoleFiles(root, codexHome) {
+    const dirs = [path.join(root, '.codex', 'agents'), path.join(codexHome, 'agents')];
+    const sanitized = [];
+    const created = [];
+    const blockers = [];
+    for (const dir of dirs) {
+        for (const [name, role] of AGENT_ROLE_FILES) {
+            const file = path.join(dir, role.file);
+            const text = await readText(file, null);
+            if (text == null) {
+                await ensureDir(dir);
+                await writeTextAtomic(file, roleConfigToml(name, role.description, role.sandbox));
+                created.push(file);
+            }
+        }
+        for (const file of DIRECTIVE_ROLE_FILES) {
+            const full = path.join(dir, file);
+            const text = await readText(full, null);
+            if (typeof text !== 'string')
+                continue;
+            if (!/\bmessage_role_prefix\s*=/.test(text) || !/SKS managed 3\.1\./.test(text))
+                continue;
+            const next = text.split('\n').filter((line) => !/^\s*message_role_prefix\s*=/.test(line)).join('\n');
+            await backupConfig(full, text, 'role');
+            await writeTextAtomic(full, next.replace(/\s*$/, '\n'));
+            sanitized.push(full);
+        }
+    }
+    return { sanitized, created, blockers };
+}
+function tomlBlock(text, table) {
+    const header = new RegExp(`(^|\\n)\\s*\\[${escapeRegExp(table)}\\]\\s*(?:#.*)?(?:\\n|$)`, 'g');
+    const match = header.exec(text);
+    if (!match)
+        return null;
+    const start = match.index + (match[1] ? 1 : 0);
+    const rest = text.slice(header.lastIndex);
+    const nextHeader = rest.search(/\n\s*\[[^\]]+\]\s*(?:#.*)?(?:\n|$)/);
+    const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
+    return { start, end, text: text.slice(start, end) };
+}
+function removeTomlBlock(text, block) {
+    return `${text.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${text.slice(block.end).replace(/^\n+/, '')}`;
+}
+function replaceOrInsertKey(text, block, key, encodedValue) {
+    const lines = block.text.replace(/\s*$/, '').split('\n');
+    const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    const index = lines.findIndex((line) => re.test(line));
+    if (index >= 0)
+        lines[index] = `${key} = ${encodedValue}`;
+    else
+        lines.push(`${key} = ${encodedValue}`);
+    const replacement = `${lines.join('\n')}\n`;
+    return `${text.slice(0, block.start)}${replacement}${text.slice(block.end)}`;
+}
+function stringValue(text, key) {
+    const match = text.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"`, 'm'));
+    return match && typeof match[1] === 'string' ? match[1] : null;
+}
+async function commandExists(command) {
+    if (command.includes(path.sep))
+        return exists(command);
+    const paths = String(process.env.PATH || '').split(path.delimiter).filter(Boolean);
+    for (const dir of paths)
+        if (await exists(path.join(dir, command)))
+            return true;
+    return false;
+}
+async function backupConfig(configPath, text, label) {
+    try {
+        const backupPath = `${configPath}.sks-${label}-${Date.now().toString(36)}.bak`;
+        await ensureDir(path.dirname(backupPath));
+        await writeTextAtomic(backupPath, text);
+        return backupPath;
+    }
+    catch {
+        return null;
+    }
+}
+function roleConfigToml(name, description, sandbox) {
+    return [
+        `name = "${name}"`,
+        `description = "${description}"`,
+        `model = "${REQUIRED_CODEX_MODEL}"`,
+        'model_reasoning_effort = "medium"',
+        `sandbox_mode = "${sandbox}"`,
+        'approval_policy = "never"',
+        'developer_instructions = """',
+        `You are the SKS ${name} role.`,
+        sandbox === 'read-only' ? 'Do not edit files.' : 'Only edit the bounded files assigned by the parent orchestrator.',
+        'Return concise source-backed findings and LIVE_EVENT lines when applicable.',
+        '"""',
+        ''
+    ].join('\n');
+}
+function escapeToml(value) {
+    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=doctor-codex-startup-repair.js.map

package/dist/core/doctor/doctor-context7-repair.js

@@ -0,0 +1,116 @@
+import path from 'node:path';
+import os from 'node:os';
+import { ensureDir, nowIso, readText, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+export const DOCTOR_CONTEXT7_REPAIR_SCHEMA = 'sks.doctor-context7-repair.v1';
+const CONTEXT7_REMOTE_URL = 'https://mcp.context7.com/mcp';
+export async function runDoctorContext7Repair(input) {
+    const root = path.resolve(input.root || process.cwd());
+    const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
+    const candidates = [
+        { scope: 'project', path: path.join(root, '.codex', 'config.toml') },
+        { scope: 'global', path: path.join(codexHome, 'config.toml') }
+    ];
+    const configs = [];
+    for (const candidate of candidates)
+        configs.push(await inspectOrRepairContext7Config(candidate, input.fix));
+    const blockers = configs.flatMap((entry) => entry.blockers.map((blocker) => `${entry.scope}:${blocker}`));
+    const warnings = configs.flatMap((entry) => entry.warnings.map((warning) => `${entry.scope}:${warning}`));
+    const actions = configs
+        .filter((entry) => entry.changed || entry.status === 'local_stdio_detected')
+        .map((entry) => entry.changed
+        ? `${entry.scope} Context7 MCP migrated to remote transport`
+        : `${entry.scope} Context7 MCP local stdio detected; rerun sks doctor --fix to migrate`);
+    const reportPath = path.join(root, '.sneakoscope', 'reports', 'doctor-context7-repair.json');
+    const result = {
+        schema: DOCTOR_CONTEXT7_REPAIR_SCHEMA,
+        ok: blockers.length === 0,
+        generated_at: nowIso(),
+        fix: input.fix === true,
+        preferred_transport: 'remote',
+        configs,
+        actions,
+        blockers,
+        warnings,
+        report_path: reportPath
+    };
+    await writeJsonAtomic(reportPath, result);
+    return result;
+}
+async function inspectOrRepairContext7Config(candidate, fix) {
+    const text = await readText(candidate.path, null);
+    if (text == null) {
+        return baseConfig(candidate, {
+            present: false,
+            status: 'missing',
+            warnings: candidate.scope === 'global' ? ['context7_global_config_missing_optional'] : []
+        });
+    }
+    const block = context7Block(text);
+    if (!block)
+        return baseConfig(candidate, { present: true, status: 'missing' });
+    if (/\burl\s*=\s*["']https:\/\/mcp\.context7\.com\/mcp["']/.test(block.text)) {
+        return baseConfig(candidate, { present: true, status: 'already_remote' });
+    }
+    const localStdio = /@upstash\/context7-mcp|context7-mcp|command\s*=\s*["']npx(?:\s|["'])/i.test(block.text);
+    if (!localStdio) {
+        return baseConfig(candidate, {
+            present: true,
+            status: 'blocked',
+            blockers: ['context7_custom_config_preserved'],
+            warnings: ['custom_context7_config_not_rewritten']
+        });
+    }
+    if (!fix) {
+        return baseConfig(candidate, {
+            present: true,
+            status: 'local_stdio_detected',
+            warnings: ['local_stdio_context7_can_block_interactive_codex_launch']
+        });
+    }
+    const remoteBlock = `[mcp_servers.context7]\nurl = "${CONTEXT7_REMOTE_URL}"\n`;
+    const next = `${text.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${remoteBlock}${text.slice(block.end).replace(/^\n+/, '\n')}`.replace(/\s*$/, '\n');
+    const backupPath = await backupConfig(candidate.path, text);
+    await writeTextAtomic(candidate.path, next);
+    return baseConfig(candidate, {
+        present: true,
+        status: 'repaired_to_remote',
+        changed: true,
+        backup_path: backupPath,
+        warnings: ['local_stdio_context7_replaced_with_remote_mcp']
+    });
+}
+function context7Block(text) {
+    const header = /(^|\n)\s*\[mcp_servers\.context7\]\s*(?:#.*)?(?:\n|$)/g;
+    const match = header.exec(text);
+    if (!match)
+        return null;
+    const start = match.index + (match[1] ? 1 : 0);
+    const rest = text.slice(header.lastIndex);
+    const nextHeader = rest.search(/\n\s*\[(?!mcp_servers\.context7(?:\.|\]))[^\]]+\]\s*(?:#.*)?(?:\n|$)/);
+    const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
+    return { start, end, text: text.slice(start, end) };
+}
+async function backupConfig(configPath, text) {
+    try {
+        const backupPath = `${configPath}.sks-context7-${Date.now().toString(36)}.bak`;
+        await ensureDir(path.dirname(backupPath));
+        await writeTextAtomic(backupPath, text);
+        return backupPath;
+    }
+    catch {
+        return null;
+    }
+}
+function baseConfig(candidate, patch) {
+    return {
+        scope: candidate.scope,
+        path: candidate.path,
+        present: patch.present === true,
+        status: patch.status || 'missing',
+        changed: patch.changed === true,
+        backup_path: patch.backup_path || null,
+        warnings: patch.warnings || [],
+        blockers: patch.blockers || []
+    };
+}
+//# sourceMappingURL=doctor-context7-repair.js.map

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.10';
+export const PACKAGE_VERSION = '3.1.11';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '3.1.10';
+export const PACKAGE_VERSION = '3.1.11';
 //# sourceMappingURL=version.js.map

package/dist/core/zellij/zellij-capability.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { compareVersionLike, parseZellijVersionText, runZellij } from './zellij-command.js';
 export const ZELLIJ_CAPABILITY_SCHEMA = 'sks.zellij-capability.v1';
-export const ZELLIJ_MIN_VERSION = '0.41.0';
+export const ZELLIJ_MIN_VERSION = '0.43.0';
 export const ZELLIJ_STACKED_PANE_CAPABILITY_SCHEMA = 'sks.zellij-stacked-pane-capability.v1';
 export const ZELLIJ_STACKED_PANE_MIN_VERSION = '0.43.0';
 export function zellijSupportsStackedPanes(version) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "3.1.10",
+  "version": "3.1.11",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -72,6 +72,8 @@
     "codex:config-eperm-fixture": "node ./dist/scripts/codex-config-eperm-fixture.js",
     "doctor:fix-proves-codex-read": "node ./dist/scripts/doctor-fix-proves-codex-read-check.js",
     "doctor:fix-recovers-corrupted-config": "node ./dist/scripts/doctor-fix-recovers-corrupted-config-check.js",
+    "doctor:context7-repair": "node ./dist/scripts/doctor-context7-repair-check.js",
+    "doctor:codex-startup-repair": "node ./dist/scripts/doctor-codex-startup-repair-check.js",
     "install:update-preserves-config": "node ./dist/scripts/install-update-preserves-config-check.js",
     "codex-lb:config-toml-safety": "node ./dist/scripts/codex-lb-config-toml-safety-check.js",
     "codex-app:ui-preservation": "node ./dist/scripts/codex-app-ui-preservation-check.js",