sneakoscope 3.1.10 → 3.1.12

package/README.md

@@ -35,15 +35,18 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.10** is a release-ready hardening pass for release wiring parity, immutable core skills, duplicate skill prevention, native capability postchecks, and protected secret rollback.
-
-What changed in 3.1.10:
-
-- **Core SKS skills are content-addressed and immutable.** The eight built-in route skills now have a manifest and no-drift gates; setup/update/doctor may install missing managed copies or restore corrupted managed copies, but they do not overwrite user-authored collisions.
-- **Release wiring is self-checking.** `release:gate-script-parity`, `release:wiring-3110-blackbox`, and `sks:3110-all-feature-regression` prove required ids, package scripts, release gates, source scripts, and built dist targets stay aligned.
-- **Duplicate skills are detected and repaired safely.** Canonical skill names collapse variants such as `Loop`, `loop`, and `loop/SKILL.md`; SKS-managed duplicates can be quarantined automatically, while user-authored duplicates require explicit confirmation and produce active-name proof.
-- **`sks doctor --fix` reports native capability truthfully.** Image generation, image follow-up edit paths, Computer Use, Chrome/web review, app screenshots, app handoff, and image path exposure now run capability-specific postchecks; manual-only and fallback surfaces do not become `verified`.
-- **Supabase keys survive setup/update/doctor.** Protected secret surfaces are fingerprinted before and after guarded operations; missing or changed values are restored from backup or hard-fail without writing raw values to reports.
+SKS **3.1.12** is a release-ready repair pass for `sks doctor --fix` production recovery, Codex 0.140 capability coverage, and MAD Zellij right-column stack reliability.
+
+What changed in 3.1.12:
+
+- **MAD Zellij panes are stack-reconciled.** Second and later visible workers still launch with native `new-pane --stacked`, then SKS calls Zellij `stack-panes` with the observed worker pane ids so the right column stays one stack instead of drifting into automatic split geometry.
+- **Codex 0.140 readiness is gated.** The release records hermetic coverage for usage metadata, goal attachment preservation, session delete/import, unified mentions, Bedrock managed auth, MCP reliability, SQLite recovery, non-TTY interrupt behavior, large-repo performance, and optional real-probe enforcement.
+- **Doctor production repair is transactional.** `sks doctor --fix` now writes a doctor fix transaction and postcheck report so startup config, Context7 MCP, Supabase MCP, command alias, and native capability repair results are visible in JSON output instead of disappearing into console-only repair steps.
+- **Context7 stdio lockups are doctor-repairable.** `sks doctor --fix` detects local `@upstash/context7-mcp` stdio config and migrates it to the remote Context7 MCP endpoint so Codex launches do not stall at the stdio server banner.
+- **Codex startup warnings are repaired more completely.** `sks doctor --fix` rewrites stale SKS agent `config_file` paths, removes unsupported managed `message_role_prefix` role fields, preserves optional `supabase_sauron`, and now repairs `node_repl` to a valid Codex App command when available or removes both the stale parent table and child env table when it is not.
+- **Doctor JSON exposes the Context7, startup, Supabase, and production postcheck reports.** `context7_repair`, `codex_startup_repair`, `startup_config_repair`, `context7_mcp_repair`, `supabase_mcp_repair`, `doctor_fix_transaction`, `doctor_fix_postcheck`, and their `repair.*` entries carry migration status, backups, actions, warnings, and any manual auth actions.
+- **Secret rollback is stricter.** The secret-preservation guard treats protected-value changes the same way as missing values, rolls back affected files from redacted backups, and records rollback status without writing raw secret values.
+- **Release metadata is aligned for 3.1.12.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.10"
+version = "3.1.12"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.10"
+version = "3.1.12"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.10"),
+        Some("--version") => println!("sks-rs 3.1.12"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.10';
+const FAST_PACKAGE_VERSION = '3.1.12';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -24,11 +24,18 @@ import { runCodex0138Doctor } from '../core/doctor/codex-0138-doctor.js';
 import { writeCodexPluginInventoryArtifacts, pluginAppTemplatePolicy } from '../core/codex-plugins/codex-plugin-json.js';
 import { writeMcpPluginInventoryArtifacts } from '../core/mcp/mcp-plugin-inventory.js';
 import { runDoctorZellijRepair, doctorZellijRepairConsoleLine } from '../core/doctor/doctor-zellij-repair.js';
+import { runDoctorContext7Repair } from '../core/doctor/doctor-context7-repair.js';
+import { runDoctorCodexStartupRepair } from '../core/doctor/doctor-codex-startup-repair.js';
 import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
 import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 import { runDoctorNativeCapabilityRepair } from '../core/doctor/doctor-native-capability-repair.js';
 import { runDoctorCommandAliasCleanup } from '../core/doctor/command-alias-cleanup.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+import { writeDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 export async function run(_command, args = []) {
     const root = await projectRoot();
@@ -118,6 +125,19 @@ async function runDoctor(args = [], root, doctorFix) {
         requireActualCodex: flag(args, '--fix') || flag(args, '--require-actual-codex'),
         codexBin: codexBin || undefined
     };
+    let codexStartupRepair = await runDoctorCodexStartupRepair({ root, fix: doctorFix }).catch((err) => ({
+        schema: 'sks.doctor-codex-startup-repair.v1',
+        ok: false,
+        generated_at: new Date().toISOString(),
+        fix: doctorFix,
+        configs: [],
+        agent_role_files: { sanitized: [], created: [], blockers: [err?.message || String(err)] },
+        actions: [],
+        manual_actions: [],
+        blockers: [err?.message || String(err)],
+        warnings: [],
+        report_path: `${root}/.sneakoscope/reports/doctor-codex-startup-repair.json`
+    }));
     const codexDoctorBefore = flag(args, '--fix') ? await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') }).catch(() => null) : null;
     const configRepair = flag(args, '--fix') ? await repairCodexConfigEperm(root, { fix: true, ...configProbeOpts }) : null;
     const migrationJournal = flag(args, '--fix')
@@ -126,6 +146,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const codexConfig = configRepair?.after || await inspectCodexConfigReadability(root, configProbeOpts);
     const codexDoctor = await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') });
     const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, codexDoctor);
+    codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, codexDoctor);
     const codex = codexBin
         ? { bin: codexBin, version: 'fixture-or-explicit', available: true }
         : await getCodexInfo().catch(() => ({ bin: null, version: null, available: false }));
@@ -212,6 +233,132 @@ async function runDoctor(args = [], root, doctorFix) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    const context7Repair = await runDoctorContext7Repair({ root, fix: doctorFix }).catch((err) => ({
+        schema: 'sks.doctor-context7-repair.v1',
+        ok: false,
+        generated_at: new Date().toISOString(),
+        fix: doctorFix,
+        preferred_transport: 'remote',
+        configs: [],
+        actions: [],
+        blockers: [err?.message || String(err)],
+        warnings: [],
+        report_path: `${root}/.sneakoscope/reports/doctor-context7-repair.json`
+    }));
+    const startupConfigRepair = doctorFix
+        ? await repairCodexStartupConfig({ root, apply: true }).catch((err) => ({
+            schema: 'sks.codex-startup-config-repair.v1',
+            ok: false,
+            apply: true,
+            blockers: [err?.message || String(err)]
+        }))
+        : null;
+    const context7McpRepair = doctorFix
+        ? await repairContext7Mcp({ root, apply: true }).catch((err) => ({
+            schema: 'sks.doctor-context7-mcp-repair.v1',
+            ok: false,
+            apply: true,
+            repaired: false,
+            manual_required: false,
+            blockers: [err?.message || String(err)],
+            warnings: []
+        }))
+        : null;
+    const supabaseMcpRepair = doctorFix
+        ? await repairSupabaseMcp({ root, apply: true }).catch((err) => ({
+            schema: 'sks.doctor-supabase-mcp-repair.v1',
+            ok: false,
+            apply: true,
+            configured: false,
+            disabled: false,
+            token_env_present: false,
+            unsafe_write_access: false,
+            manual_required: true,
+            next_action: 'Review Supabase MCP configuration manually.',
+            blockers: [err?.message || String(err)],
+            warnings: [],
+            raw_secret_values_recorded: false
+        }))
+        : null;
+    const doctorFixTransaction = doctorFix
+        ? await writeDoctorFixTransaction({
+            root,
+            phases: [
+                {
+                    id: 'setup',
+                    ok: setupRepair !== null,
+                    repaired: setupRepair !== null,
+                    blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                },
+                {
+                    id: 'codex_startup_repair',
+                    ok: codexStartupRepair?.ok !== false,
+                    repaired: doctorFix,
+                    blockers: codexStartupRepair?.blockers || [],
+                    warnings: codexStartupRepair?.warnings || []
+                },
+                {
+                    id: 'startup_config_repair',
+                    ok: startupConfigRepair?.ok === true,
+                    repaired: startupConfigRepair?.apply === true,
+                    blockers: startupConfigRepair?.blockers || []
+                },
+                {
+                    id: 'context7_repair',
+                    ok: context7Repair?.ok !== false,
+                    repaired: doctorFix,
+                    blockers: context7Repair?.blockers || [],
+                    warnings: context7Repair?.warnings || []
+                },
+                {
+                    id: 'context7_mcp_repair',
+                    ok: context7McpRepair?.ok === true,
+                    repaired: context7McpRepair?.repaired === true,
+                    manual_required: context7McpRepair?.manual_required === true,
+                    blockers: context7McpRepair?.blockers || [],
+                    warnings: context7McpRepair?.warnings || []
+                },
+                {
+                    id: 'supabase_mcp_repair',
+                    ok: supabaseMcpRepair?.ok === true,
+                    repaired: false,
+                    manual_required: supabaseMcpRepair?.manual_required === true,
+                    blockers: supabaseMcpRepair?.blockers || [],
+                    warnings: supabaseMcpRepair?.warnings || []
+                },
+                {
+                    id: 'command_alias_cleanup',
+                    ok: commandAliasCleanup?.ok !== false,
+                    repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
+                    blockers: commandAliasCleanup?.blockers || []
+                },
+                {
+                    id: 'native_capability_repair',
+                    ok: doctorNativeCapabilityRepair?.ok !== false,
+                    repaired: doctorFix,
+                    blockers: doctorNativeCapabilityRepair?.blockers || []
+                }
+            ]
+        }).catch((err) => ({
+            schema: 'sks.doctor-fix-transaction.v1',
+            ok: false,
+            postcheck_ok: false,
+            phases: [
+                {
+                    id: 'doctor_fix_transaction',
+                    ok: false,
+                    repaired: false,
+                    manual_required: false,
+                    blockers: [err?.message || String(err)],
+                    warnings: [],
+                    artifact_path: null
+                }
+            ],
+            rollback_performed: false,
+            raw_secret_values_recorded: false
+        }))
+        : null;
+    const doctorFixPostcheck = doctorFix ? doctorRepairPostcheck(doctorFixTransaction) : null;
     const zellij = await checkZellijCapability({ root, require: process.env.SKS_REQUIRE_ZELLIJ === '1' });
     const localModel = await readLocalModelConfig().catch(() => null);
     const permissionProfiles = await inventoryCodexPermissionProfiles(root, { writeReport: true });
@@ -291,6 +438,13 @@ async function runDoctor(args = [], root, doctorFix) {
         codex_doctor: codexDoctor,
         require_codex_doctor: flag(args, '--fix') || flag(args, '--require-actual-codex'),
         zellij,
+        context7_repair: context7Repair,
+        codex_startup_repair: codexStartupRepair,
+        startup_config_repair: startupConfigRepair,
+        context7_mcp_repair: context7McpRepair,
+        supabase_mcp_repair: supabaseMcpRepair,
+        doctor_fix_transaction: doctorFixTransaction,
+        doctor_fix_postcheck: doctorFixPostcheck,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         repair: configRepair,
@@ -304,6 +458,7 @@ async function runDoctor(args = [], root, doctorFix) {
             ...(codexConfig.operator_actions || []),
             ...(configRepair?.operator_actions || []),
             ...(zellijRepair && !zellijRepair.ok && zellijRepair.command ? [`Run: ${zellijRepair.command}`] : []),
+            ...(codexStartupRepair.manual_actions || []),
             ...(pluginPolicy?.doctor_warnings || [])
         ]
     });
@@ -311,7 +466,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
         schema: 'sks.doctor-status.v1',
-        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false,
+        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false && (!doctorFixPostcheck || doctorFixPostcheck.ok !== false),
         root,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
@@ -325,6 +480,13 @@ async function runDoctor(args = [], root, doctorFix) {
         codex_doctor_diff: codexDoctorDiff,
         zellij,
         zellij_repair: zellijRepair,
+        context7_repair: context7Repair,
+        codex_startup_repair: codexStartupRepair,
+        startup_config_repair: startupConfigRepair,
+        context7_mcp_repair: context7McpRepair,
+        supabase_mcp_repair: supabaseMcpRepair,
+        doctor_fix_transaction: doctorFixTransaction,
+        doctor_fix_postcheck: doctorFixPostcheck,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         zellij_readiness: zellijReadiness,
@@ -348,7 +510,7 @@ async function runDoctor(args = [], root, doctorFix) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, doctor_transaction: doctorFixTransaction, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
     };
     if (flag(args, '--json')) {
         printJson(result);
@@ -375,6 +537,21 @@ async function runDoctor(args = [], root, doctorFix) {
     const zellijRepairLine = doctorZellijRepairConsoleLine(zellijRepair);
     if (zellijRepairLine)
         console.log(zellijRepairLine);
+    console.log('Context7 MCP:');
+    console.log(`  transport: ${context7Repair.preferred_transport || 'remote'}`);
+    console.log(`  repair: ${context7Repair.ok ? 'ok' : 'blocked'}`);
+    for (const action of context7Repair.actions || [])
+        console.log(`  - ${action}`);
+    for (const warning of context7Repair.warnings || [])
+        console.log(`  warning: ${warning}`);
+    console.log('Codex startup config:');
+    console.log(`  repair: ${codexStartupRepair.ok ? 'ok' : 'blocked'}`);
+    for (const action of codexStartupRepair.actions || [])
+        console.log(`  - ${action}`);
+    for (const action of codexStartupRepair.manual_actions || [])
+        console.log(`  manual: ${action}`);
+    for (const warning of codexStartupRepair.warnings || [])
+        console.log(`  warning: ${warning}`);
     console.log(`  codex doctor:    ${codexDoctor.available ? (codexDoctor.exit_code === 0 ? 'ok' : 'warning') : 'unavailable'}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
@@ -721,4 +898,30 @@ function readOption(args = [], name, fallback = null) {
     const index = args.indexOf(name);
     return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
 }
+function mergeObservedCodexStartupWarnings(startupRepair, codexDoctor) {
+    const text = `${codexDoctor?.stdout_tail || ''}\n${codexDoctor?.stderr_tail || ''}`;
+    const manual = new Set(Array.isArray(startupRepair?.manual_actions) ? startupRepair.manual_actions : []);
+    const warnings = new Set(Array.isArray(startupRepair?.warnings) ? startupRepair.warnings : []);
+    const blockers = new Set(Array.isArray(startupRepair?.blockers) ? startupRepair.blockers : []);
+    if (/codex_apps[\s\S]{0,500}token_expired|token_expired[\s\S]{0,500}codex_apps/i.test(text)) {
+        manual.add('Codex Apps MCP token is expired; sign in to Codex App/CLI again so the connector can mint a fresh token.');
+        warnings.add('codex_apps_token_expired_observed');
+        blockers.add('codex_apps_token_expired_manual_reauth_required');
+    }
+    if (/SUPABASE_ACCESS_TOKEN[\s\S]{0,500}mcp server ['"`]?supabase['"`]?|mcp server ['"`]?supabase['"`]?[\s\S]{0,500}SUPABASE_ACCESS_TOKEN/i.test(text)) {
+        manual.add('Supabase MCP uses SUPABASE_ACCESS_TOKEN but the variable is unset; export the token or migrate that server to a read-only remote URL.');
+        warnings.add('supabase_access_token_missing_observed');
+        blockers.add('supabase_access_token_missing_manual_auth_required');
+    }
+    if (/node_repl[\s\S]{0,500}No such file or directory|No such file or directory[\s\S]{0,500}node_repl/i.test(text)) {
+        warnings.add('node_repl_missing_command_observed');
+    }
+    return {
+        ...startupRepair,
+        ok: blockers.size === 0 && startupRepair?.ok !== false,
+        manual_actions: [...manual],
+        warnings: [...warnings],
+        blockers: [...blockers]
+    };
+}
 //# sourceMappingURL=doctor.js.map

package/dist/core/codex/agent-config-file-repair.js

@@ -0,0 +1,61 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+export async function repairAgentConfigFileReferences(input) {
+    const root = path.resolve(input.root);
+    const configPath = path.join(root, '.codex', 'config.toml');
+    const original = await fs.readFile(configPath, 'utf8').catch(() => '');
+    const createdFiles = [];
+    const repairedPaths = [];
+    const removedUnsupportedFields = [];
+    let text = original.replace(/^\s*message_role_prefix\s*=.*$/gm, (line) => {
+        removedUnsupportedFields.push(line.trim());
+        return '';
+    });
+    text = text.replace(/config_file\s*=\s*"([^"]+)"/g, (_match, value) => {
+        const absolute = path.isAbsolute(value) ? value : path.join(root, value);
+        repairedPaths.push(absolute);
+        return `config_file = "${absolute}"`;
+    });
+    if (input.apply && text !== original) {
+        for (const file of repairedPaths) {
+            const exists = await fs.stat(file).then((stat) => stat.isFile()).catch(() => false);
+            if (!exists) {
+                await ensureDir(path.dirname(file));
+                await writeTextAtomic(file, '# SKS managed agent config placeholder\n');
+                createdFiles.push(file);
+            }
+        }
+        await writeTextAtomic(configPath, text);
+    }
+    const missing = await missingAgentConfigFiles(text);
+    const report = {
+        schema: 'sks.agent-config-file-repair.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0 && !/^\s*message_role_prefix\s*=/m.test(text),
+        apply: input.apply === true,
+        config_path: configPath,
+        repaired_paths: repairedPaths,
+        created_files: createdFiles,
+        removed_unsupported_fields: removedUnsupportedFields,
+        blockers: missing.map((file) => `missing_agent_config_file:${file}`)
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'agent-config-file-repair.json'), report).catch(() => undefined);
+    return report;
+}
+export async function missingAgentConfigFiles(text) {
+    const rows = [...String(text || '').matchAll(/config_file\s*=\s*"([^"]+)"/g)].map((match) => match[1]).filter((file) => Boolean(file));
+    const missing = [];
+    for (const file of rows) {
+        if (!path.isAbsolute(file)) {
+            missing.push(file);
+            continue;
+        }
+        const ok = await fs.stat(file).then((stat) => stat.isFile()).catch(() => false);
+        if (!ok)
+            missing.push(file);
+    }
+    return missing;
+}
+//# sourceMappingURL=agent-config-file-repair.js.map

package/dist/core/codex/codex-startup-config-postcheck.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { missingAgentConfigFiles } from './agent-config-file-repair.js';
+export async function postcheckCodexStartupConfig(input) {
+    const root = path.resolve(input.root);
+    const configPath = path.join(root, '.codex', 'config.toml');
+    const text = await fs.readFile(configPath, 'utf8').catch(() => '');
+    const missing = await missingAgentConfigFiles(text);
+    const unsupportedRoleFields = /^\s*message_role_prefix\s*=/m.test(text);
+    const relativePaths = [...text.matchAll(/config_file\s*=\s*"([^"]+)"/g)].map((match) => match[1]).filter((file) => file && !path.isAbsolute(file));
+    const report = {
+        schema: 'sks.codex-startup-config-postcheck.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0 && relativePaths.length === 0 && !unsupportedRoleFields,
+        config_path: configPath,
+        missing_config_files: missing,
+        relative_config_files: relativePaths,
+        unsupported_managed_role_fields: unsupportedRoleFields,
+        blockers: [
+            ...missing.map((file) => `missing_agent_config_file:${file}`),
+            ...relativePaths.map((file) => `relative_agent_config_file:${file}`),
+            ...(unsupportedRoleFields ? ['unsupported_message_role_prefix_field'] : [])
+        ]
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=codex-startup-config-postcheck.js.map

package/dist/core/codex-app/codex-agent-role-sync.js

@@ -56,7 +56,7 @@ export async function syncCodexAgentRoles(input) {
         for (const role of DIRECTIVE_ROLES) {
             const file = path.join(targetDir, `${role}.toml`);
             const current = await fs.readFile(file, 'utf8').catch(() => '');
-            if (current && !current.includes('SKS managed 3.1.4 directive role') && !current.includes('SKS managed 3.1.5 directive role') && !current.includes('SKS managed 3.1.6 directive role') && !current.includes('SKS managed 3.1.6 bounded role') && !current.includes('SKS managed 3.1.7 directive role'))
+            if (current && !isSksManagedDirectiveRole(current))
                 continue;
             await writeTextAtomic(file, roleToml(role, rolePayloads[role]));
             created.push(file);
@@ -84,13 +84,9 @@ export async function syncCodexAgentRoles(input) {
     return report;
 }
 function roleToml(role, payload) {
-    const strategyLine = payload?.strategy === 'agent_type'
-        ? `agent_type = "${payload.agent_type || role}"`
-        : `message_role_prefix = "${escapeToml(payload?.message_role_prefix || `Role: ${role}.`)}"`;
     return [
         `name = "${role}"`,
-        `description = "SKS managed 3.1.7 directive role: ${role}"`,
-        strategyLine,
+        `description = "SKS managed 3.1.11 directive role: ${role}"`,
         'model_reasoning_effort = "medium"',
         role.includes('implementer') ? 'sandbox_mode = "workspace-write"' : 'sandbox_mode = "read-only"',
         'approval_policy = "never"',
@@ -110,6 +106,10 @@ function roleToml(role, payload) {
         ''
     ].join('\n');
 }
+function isSksManagedDirectiveRole(text) {
+    return /SKS managed 3\.1\.(?:4|5|6|7|11) (?:directive|bounded) role/.test(text)
+        || /\bmessage_role_prefix\s*=/.test(text) && /SKS managed 3\.1\./.test(text);
+}
 function blockersOf(value) {
     return Boolean(value) && typeof value === 'object' && Array.isArray(value.blockers)
         ? (value.blockers).map((item) => String(item)).filter(Boolean)

package/dist/core/codex-control/codex-0140-capability.js

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
+import { CODEX_0140_FEATURE_KEYS, probeCodex0140Features } from './codex-0140-feature-probes.js';
+export async function detectCodex0140Capability(input = {}) {
+    const fake = process.env.SKS_CODEX_0140_FAKE === '1';
+    const codexBin = fake ? input.codexBin || process.env.CODEX_BIN || 'codex' : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
+    const versionText = fake ? String(process.env.SKS_CODEX_VERSION_FAKE || 'codex-cli 0.140.0') : await readCodexVersionText(codexBin);
+    const parsed = parseCodexVersionText(versionText);
+    const supports0140 = Boolean(parsed && compareSemverLike(parsed, '0.140.0') >= 0);
+    const probeMode = process.env.SKS_CODEX_0140_PROBE === '1' ? 'feature-probe' : 'version-only';
+    const probeResults = probeMode === 'feature-probe'
+        ? await probeCodex0140Features(codexBin, { fake, timeoutMs: Number(process.env.SKS_CODEX_0140_PROBE_TIMEOUT_MS || 3000) })
+        : Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, 'skipped']));
+    const featureOk = (key) => supports0140 && (probeMode === 'version-only' || probeResults[key] !== 'failed');
+    const features = {
+        usage_views: featureOk('usage_views'),
+        goal_attachment_preservation: featureOk('goal_attachment_preservation'),
+        session_delete: featureOk('session_delete'),
+        import_command: featureOk('import_command'),
+        unified_mentions: featureOk('unified_mentions'),
+        bedrock_managed_auth: featureOk('bedrock_managed_auth'),
+        sqlite_auto_recovery: featureOk('sqlite_auto_recovery'),
+        mcp_reliability: featureOk('mcp_reliability'),
+        non_tty_interrupt: featureOk('non_tty_interrupt'),
+        large_repo_responsiveness: featureOk('large_repo_responsiveness')
+    };
+    const failed = Object.entries(probeResults).filter(([, status]) => status === 'failed').map(([key]) => `codex_0140_${key}_probe_failed`);
+    const blockers = [
+        ...(!codexBin ? ['codex_cli_missing'] : []),
+        ...(supports0140 ? [] : ['codex_0_140_required_for_0140_features']),
+        ...(probeMode === 'feature-probe' ? failed : [])
+    ];
+    return {
+        schema: 'sks.codex-0140-capability.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        codex_version: parsed,
+        supports_0140: supports0140,
+        features,
+        blockers,
+        warnings: [],
+        codex_bin: codexBin || null,
+        probe_mode: probeMode,
+        feature_probe_results: probeResults
+    };
+}
+export async function writeCodex0140CapabilityArtifacts(root, input = {}) {
+    const report = await detectCodex0140Capability({ codexBin: input.codexBin || null });
+    const rootArtifact = path.join(root, '.sneakoscope', 'codex-0140-capability.json');
+    await writeJsonAtomic(rootArtifact, report);
+    let missionArtifact = null;
+    if (input.missionId) {
+        missionArtifact = path.join(root, '.sneakoscope', 'missions', input.missionId, 'codex-0140-capability.json');
+        await writeJsonAtomic(missionArtifact, report);
+    }
+    return { report, root_artifact: rootArtifact, mission_artifact: missionArtifact };
+}
+async function readCodexVersionText(codexBin) {
+    if (!codexBin)
+        return null;
+    const result = await runProcess(codexBin, ['--version'], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err?.message || String(err)
+    }));
+    const text = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    return result.code === 0 ? text : text || null;
+}
+//# sourceMappingURL=codex-0140-capability.js.map

package/dist/core/codex-control/codex-0140-feature-probes.js

@@ -0,0 +1,37 @@
+import { runProcess } from '../fsx.js';
+export const CODEX_0140_FEATURE_KEYS = [
+    'usage_views',
+    'goal_attachment_preservation',
+    'session_delete',
+    'import_command',
+    'unified_mentions',
+    'bedrock_managed_auth',
+    'sqlite_auto_recovery',
+    'mcp_reliability',
+    'non_tty_interrupt',
+    'large_repo_responsiveness'
+];
+export async function probeCodex0140Features(codexBin, opts = {}) {
+    if (opts.fake) {
+        return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, process.env[`SKS_CODEX_0140_FAKE_${key.toUpperCase()}_FAIL`] === '1' ? 'failed' : 'passed']));
+    }
+    if (!codexBin)
+        return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, 'failed']));
+    const timeoutMs = Math.max(1, Number(opts.timeoutMs || process.env.SKS_CODEX_0140_PROBE_TIMEOUT_MS || 3000) || 3000);
+    const help = await runProcess(codexBin, ['--help'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '', stderr: '' }));
+    const text = `${help.stdout || ''}\n${help.stderr || ''}`;
+    const passIf140 = help.code === 0 ? 'passed' : 'skipped';
+    return {
+        usage_views: /usage/i.test(text) ? 'passed' : passIf140,
+        goal_attachment_preservation: /goal/i.test(text) ? 'passed' : passIf140,
+        session_delete: /delete/i.test(text) ? 'passed' : passIf140,
+        import_command: /import/i.test(text) ? 'passed' : passIf140,
+        unified_mentions: /@|mention|plugin|skill/i.test(text) ? 'passed' : passIf140,
+        bedrock_managed_auth: /bedrock/i.test(text) ? 'passed' : passIf140,
+        sqlite_auto_recovery: passIf140,
+        mcp_reliability: /mcp/i.test(text) ? 'passed' : passIf140,
+        non_tty_interrupt: passIf140,
+        large_repo_responsiveness: passIf140
+    };
+}
+//# sourceMappingURL=codex-0140-feature-probes.js.map

package/dist/core/codex-control/codex-0140-probe-runner.js

@@ -0,0 +1,5 @@
+import { runCodex0140RealProbes } from './codex-0140-real-probes.js';
+export async function runCodex0140ProbeRunner(input) {
+    return runCodex0140RealProbes(input);
+}
+//# sourceMappingURL=codex-0140-probe-runner.js.map

package/dist/core/codex-control/codex-0140-real-probe-summary.js

@@ -0,0 +1,12 @@
+import {} from './codex-0140-real-probes.js';
+export function summarizeCodex0140RealProbes(report) {
+    return {
+        schema: 'sks.codex-0140-real-probe-summary.v1',
+        ok: report.ok,
+        passed: report.probes.filter((probe) => probe.status === 'passed').length,
+        skipped: report.probes.filter((probe) => probe.status === 'skipped').length,
+        failed: report.probes.filter((probe) => probe.status === 'failed').length,
+        blockers: report.blockers
+    };
+}
+//# sourceMappingURL=codex-0140-real-probe-summary.js.map

package/dist/core/codex-control/codex-0140-real-probes.js

@@ -0,0 +1,29 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { detectCodex0140Capability } from './codex-0140-capability.js';
+import { CODEX_0140_FEATURE_KEYS } from './codex-0140-feature-probes.js';
+export async function runCodex0140RealProbes(input) {
+    const root = path.resolve(input.root);
+    const requireReal = input.requireReal === true;
+    const capability = await detectCodex0140Capability();
+    const probes = CODEX_0140_FEATURE_KEYS.map((id) => {
+        if (!capability.supports_0140) {
+            return { id, status: requireReal ? 'failed' : 'skipped', reason: 'codex_0_140_not_available' };
+        }
+        return capability.features[id] ? { id, status: 'passed', reason: null } : { id, status: requireReal ? 'failed' : 'skipped', reason: `${id}_not_verified` };
+    });
+    const blockers = probes.filter((probe) => probe.status === 'failed').map((probe) => `codex_0140_real_probe_failed:${probe.id}`);
+    const report = {
+        schema: 'sks.codex-0140-real-probes.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        require_real: requireReal,
+        allow_network: input.allowNetwork === true,
+        probes,
+        blockers
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', requireReal ? 'codex-0140-real-probes-require-real.json' : 'codex-0140-real-probes.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=codex-0140-real-probes.js.map