sneakoscope 3.1.11 → 3.1.12

package/README.md

@@ -35,15 +35,18 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.11** is a release-ready repair pass for MAD Zellij stacked panes, Context7 MCP doctor recovery, and stale Codex startup config.
+SKS **3.1.12** is a release-ready repair pass for `sks doctor --fix` production recovery, Codex 0.140 capability coverage, and MAD Zellij right-column stack reliability.
 
-What changed in 3.1.11:
+What changed in 3.1.12:
 
-- **MAD Zellij panes require native stacked-pane support.** `sks doctor --fix` now treats Zellij 0.43.0 as the minimum interactive runtime so `sks --mad` can use native stacked worker panes instead of fragmenting into plain splits.
+- **MAD Zellij panes are stack-reconciled.** Second and later visible workers still launch with native `new-pane --stacked`, then SKS calls Zellij `stack-panes` with the observed worker pane ids so the right column stays one stack instead of drifting into automatic split geometry.
+- **Codex 0.140 readiness is gated.** The release records hermetic coverage for usage metadata, goal attachment preservation, session delete/import, unified mentions, Bedrock managed auth, MCP reliability, SQLite recovery, non-TTY interrupt behavior, large-repo performance, and optional real-probe enforcement.
+- **Doctor production repair is transactional.** `sks doctor --fix` now writes a doctor fix transaction and postcheck report so startup config, Context7 MCP, Supabase MCP, command alias, and native capability repair results are visible in JSON output instead of disappearing into console-only repair steps.
 - **Context7 stdio lockups are doctor-repairable.** `sks doctor --fix` detects local `@upstash/context7-mcp` stdio config and migrates it to the remote Context7 MCP endpoint so Codex launches do not stall at the stdio server banner.
-- **Codex startup warnings are doctor-repairable.** `sks doctor --fix` rewrites stale SKS agent `config_file` paths to existing absolute files, removes unsupported managed `message_role_prefix` role fields, preserves optional `supabase_sauron`, and drops missing-command `node_repl` MCP blocks that would otherwise spam startup.
-- **Doctor JSON exposes the Context7 and startup repair reports.** `context7_repair`, `codex_startup_repair`, and their `repair.*` entries carry migration status, backups, actions, warnings, and any manual auth actions.
-- **Release metadata is aligned for 3.1.11.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
+- **Codex startup warnings are repaired more completely.** `sks doctor --fix` rewrites stale SKS agent `config_file` paths, removes unsupported managed `message_role_prefix` role fields, preserves optional `supabase_sauron`, and now repairs `node_repl` to a valid Codex App command when available or removes both the stale parent table and child env table when it is not.
+- **Doctor JSON exposes the Context7, startup, Supabase, and production postcheck reports.** `context7_repair`, `codex_startup_repair`, `startup_config_repair`, `context7_mcp_repair`, `supabase_mcp_repair`, `doctor_fix_transaction`, `doctor_fix_postcheck`, and their `repair.*` entries carry migration status, backups, actions, warnings, and any manual auth actions.
+- **Secret rollback is stricter.** The secret-preservation guard treats protected-value changes the same way as missing values, rolls back affected files from redacted backups, and records rollback status without writing raw secret values.
+- **Release metadata is aligned for 3.1.12.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.11"
+version = "3.1.12"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.11"
+version = "3.1.12"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.11"),
+        Some("--version") => println!("sks-rs 3.1.12"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.11';
+const FAST_PACKAGE_VERSION = '3.1.12';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -31,6 +31,11 @@ import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 import { runDoctorNativeCapabilityRepair } from '../core/doctor/doctor-native-capability-repair.js';
 import { runDoctorCommandAliasCleanup } from '../core/doctor/command-alias-cleanup.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+import { writeDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 export async function run(_command, args = []) {
     const root = await projectRoot();
@@ -240,6 +245,120 @@ async function runDoctor(args = [], root, doctorFix) {
         warnings: [],
         report_path: `${root}/.sneakoscope/reports/doctor-context7-repair.json`
     }));
+    const startupConfigRepair = doctorFix
+        ? await repairCodexStartupConfig({ root, apply: true }).catch((err) => ({
+            schema: 'sks.codex-startup-config-repair.v1',
+            ok: false,
+            apply: true,
+            blockers: [err?.message || String(err)]
+        }))
+        : null;
+    const context7McpRepair = doctorFix
+        ? await repairContext7Mcp({ root, apply: true }).catch((err) => ({
+            schema: 'sks.doctor-context7-mcp-repair.v1',
+            ok: false,
+            apply: true,
+            repaired: false,
+            manual_required: false,
+            blockers: [err?.message || String(err)],
+            warnings: []
+        }))
+        : null;
+    const supabaseMcpRepair = doctorFix
+        ? await repairSupabaseMcp({ root, apply: true }).catch((err) => ({
+            schema: 'sks.doctor-supabase-mcp-repair.v1',
+            ok: false,
+            apply: true,
+            configured: false,
+            disabled: false,
+            token_env_present: false,
+            unsafe_write_access: false,
+            manual_required: true,
+            next_action: 'Review Supabase MCP configuration manually.',
+            blockers: [err?.message || String(err)],
+            warnings: [],
+            raw_secret_values_recorded: false
+        }))
+        : null;
+    const doctorFixTransaction = doctorFix
+        ? await writeDoctorFixTransaction({
+            root,
+            phases: [
+                {
+                    id: 'setup',
+                    ok: setupRepair !== null,
+                    repaired: setupRepair !== null,
+                    blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                },
+                {
+                    id: 'codex_startup_repair',
+                    ok: codexStartupRepair?.ok !== false,
+                    repaired: doctorFix,
+                    blockers: codexStartupRepair?.blockers || [],
+                    warnings: codexStartupRepair?.warnings || []
+                },
+                {
+                    id: 'startup_config_repair',
+                    ok: startupConfigRepair?.ok === true,
+                    repaired: startupConfigRepair?.apply === true,
+                    blockers: startupConfigRepair?.blockers || []
+                },
+                {
+                    id: 'context7_repair',
+                    ok: context7Repair?.ok !== false,
+                    repaired: doctorFix,
+                    blockers: context7Repair?.blockers || [],
+                    warnings: context7Repair?.warnings || []
+                },
+                {
+                    id: 'context7_mcp_repair',
+                    ok: context7McpRepair?.ok === true,
+                    repaired: context7McpRepair?.repaired === true,
+                    manual_required: context7McpRepair?.manual_required === true,
+                    blockers: context7McpRepair?.blockers || [],
+                    warnings: context7McpRepair?.warnings || []
+                },
+                {
+                    id: 'supabase_mcp_repair',
+                    ok: supabaseMcpRepair?.ok === true,
+                    repaired: false,
+                    manual_required: supabaseMcpRepair?.manual_required === true,
+                    blockers: supabaseMcpRepair?.blockers || [],
+                    warnings: supabaseMcpRepair?.warnings || []
+                },
+                {
+                    id: 'command_alias_cleanup',
+                    ok: commandAliasCleanup?.ok !== false,
+                    repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
+                    blockers: commandAliasCleanup?.blockers || []
+                },
+                {
+                    id: 'native_capability_repair',
+                    ok: doctorNativeCapabilityRepair?.ok !== false,
+                    repaired: doctorFix,
+                    blockers: doctorNativeCapabilityRepair?.blockers || []
+                }
+            ]
+        }).catch((err) => ({
+            schema: 'sks.doctor-fix-transaction.v1',
+            ok: false,
+            postcheck_ok: false,
+            phases: [
+                {
+                    id: 'doctor_fix_transaction',
+                    ok: false,
+                    repaired: false,
+                    manual_required: false,
+                    blockers: [err?.message || String(err)],
+                    warnings: [],
+                    artifact_path: null
+                }
+            ],
+            rollback_performed: false,
+            raw_secret_values_recorded: false
+        }))
+        : null;
+    const doctorFixPostcheck = doctorFix ? doctorRepairPostcheck(doctorFixTransaction) : null;
     const zellij = await checkZellijCapability({ root, require: process.env.SKS_REQUIRE_ZELLIJ === '1' });
     const localModel = await readLocalModelConfig().catch(() => null);
     const permissionProfiles = await inventoryCodexPermissionProfiles(root, { writeReport: true });
@@ -321,6 +440,11 @@ async function runDoctor(args = [], root, doctorFix) {
         zellij,
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
+        startup_config_repair: startupConfigRepair,
+        context7_mcp_repair: context7McpRepair,
+        supabase_mcp_repair: supabaseMcpRepair,
+        doctor_fix_transaction: doctorFixTransaction,
+        doctor_fix_postcheck: doctorFixPostcheck,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         repair: configRepair,
@@ -342,7 +466,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
         schema: 'sks.doctor-status.v1',
-        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false,
+        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false && (!doctorFixPostcheck || doctorFixPostcheck.ok !== false),
         root,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
@@ -358,6 +482,11 @@ async function runDoctor(args = [], root, doctorFix) {
         zellij_repair: zellijRepair,
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
+        startup_config_repair: startupConfigRepair,
+        context7_mcp_repair: context7McpRepair,
+        supabase_mcp_repair: supabaseMcpRepair,
+        doctor_fix_transaction: doctorFixTransaction,
+        doctor_fix_postcheck: doctorFixPostcheck,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         zellij_readiness: zellijReadiness,
@@ -381,7 +510,7 @@ async function runDoctor(args = [], root, doctorFix) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, doctor_transaction: doctorFixTransaction, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
     };
     if (flag(args, '--json')) {
         printJson(result);

package/dist/core/codex/agent-config-file-repair.js

@@ -0,0 +1,61 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+export async function repairAgentConfigFileReferences(input) {
+    const root = path.resolve(input.root);
+    const configPath = path.join(root, '.codex', 'config.toml');
+    const original = await fs.readFile(configPath, 'utf8').catch(() => '');
+    const createdFiles = [];
+    const repairedPaths = [];
+    const removedUnsupportedFields = [];
+    let text = original.replace(/^\s*message_role_prefix\s*=.*$/gm, (line) => {
+        removedUnsupportedFields.push(line.trim());
+        return '';
+    });
+    text = text.replace(/config_file\s*=\s*"([^"]+)"/g, (_match, value) => {
+        const absolute = path.isAbsolute(value) ? value : path.join(root, value);
+        repairedPaths.push(absolute);
+        return `config_file = "${absolute}"`;
+    });
+    if (input.apply && text !== original) {
+        for (const file of repairedPaths) {
+            const exists = await fs.stat(file).then((stat) => stat.isFile()).catch(() => false);
+            if (!exists) {
+                await ensureDir(path.dirname(file));
+                await writeTextAtomic(file, '# SKS managed agent config placeholder\n');
+                createdFiles.push(file);
+            }
+        }
+        await writeTextAtomic(configPath, text);
+    }
+    const missing = await missingAgentConfigFiles(text);
+    const report = {
+        schema: 'sks.agent-config-file-repair.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0 && !/^\s*message_role_prefix\s*=/m.test(text),
+        apply: input.apply === true,
+        config_path: configPath,
+        repaired_paths: repairedPaths,
+        created_files: createdFiles,
+        removed_unsupported_fields: removedUnsupportedFields,
+        blockers: missing.map((file) => `missing_agent_config_file:${file}`)
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'agent-config-file-repair.json'), report).catch(() => undefined);
+    return report;
+}
+export async function missingAgentConfigFiles(text) {
+    const rows = [...String(text || '').matchAll(/config_file\s*=\s*"([^"]+)"/g)].map((match) => match[1]).filter((file) => Boolean(file));
+    const missing = [];
+    for (const file of rows) {
+        if (!path.isAbsolute(file)) {
+            missing.push(file);
+            continue;
+        }
+        const ok = await fs.stat(file).then((stat) => stat.isFile()).catch(() => false);
+        if (!ok)
+            missing.push(file);
+    }
+    return missing;
+}
+//# sourceMappingURL=agent-config-file-repair.js.map

package/dist/core/codex/codex-startup-config-postcheck.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { missingAgentConfigFiles } from './agent-config-file-repair.js';
+export async function postcheckCodexStartupConfig(input) {
+    const root = path.resolve(input.root);
+    const configPath = path.join(root, '.codex', 'config.toml');
+    const text = await fs.readFile(configPath, 'utf8').catch(() => '');
+    const missing = await missingAgentConfigFiles(text);
+    const unsupportedRoleFields = /^\s*message_role_prefix\s*=/m.test(text);
+    const relativePaths = [...text.matchAll(/config_file\s*=\s*"([^"]+)"/g)].map((match) => match[1]).filter((file) => file && !path.isAbsolute(file));
+    const report = {
+        schema: 'sks.codex-startup-config-postcheck.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0 && relativePaths.length === 0 && !unsupportedRoleFields,
+        config_path: configPath,
+        missing_config_files: missing,
+        relative_config_files: relativePaths,
+        unsupported_managed_role_fields: unsupportedRoleFields,
+        blockers: [
+            ...missing.map((file) => `missing_agent_config_file:${file}`),
+            ...relativePaths.map((file) => `relative_agent_config_file:${file}`),
+            ...(unsupportedRoleFields ? ['unsupported_message_role_prefix_field'] : [])
+        ]
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=codex-startup-config-postcheck.js.map

package/dist/core/codex-control/codex-0140-capability.js

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
+import { CODEX_0140_FEATURE_KEYS, probeCodex0140Features } from './codex-0140-feature-probes.js';
+export async function detectCodex0140Capability(input = {}) {
+    const fake = process.env.SKS_CODEX_0140_FAKE === '1';
+    const codexBin = fake ? input.codexBin || process.env.CODEX_BIN || 'codex' : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
+    const versionText = fake ? String(process.env.SKS_CODEX_VERSION_FAKE || 'codex-cli 0.140.0') : await readCodexVersionText(codexBin);
+    const parsed = parseCodexVersionText(versionText);
+    const supports0140 = Boolean(parsed && compareSemverLike(parsed, '0.140.0') >= 0);
+    const probeMode = process.env.SKS_CODEX_0140_PROBE === '1' ? 'feature-probe' : 'version-only';
+    const probeResults = probeMode === 'feature-probe'
+        ? await probeCodex0140Features(codexBin, { fake, timeoutMs: Number(process.env.SKS_CODEX_0140_PROBE_TIMEOUT_MS || 3000) })
+        : Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, 'skipped']));
+    const featureOk = (key) => supports0140 && (probeMode === 'version-only' || probeResults[key] !== 'failed');
+    const features = {
+        usage_views: featureOk('usage_views'),
+        goal_attachment_preservation: featureOk('goal_attachment_preservation'),
+        session_delete: featureOk('session_delete'),
+        import_command: featureOk('import_command'),
+        unified_mentions: featureOk('unified_mentions'),
+        bedrock_managed_auth: featureOk('bedrock_managed_auth'),
+        sqlite_auto_recovery: featureOk('sqlite_auto_recovery'),
+        mcp_reliability: featureOk('mcp_reliability'),
+        non_tty_interrupt: featureOk('non_tty_interrupt'),
+        large_repo_responsiveness: featureOk('large_repo_responsiveness')
+    };
+    const failed = Object.entries(probeResults).filter(([, status]) => status === 'failed').map(([key]) => `codex_0140_${key}_probe_failed`);
+    const blockers = [
+        ...(!codexBin ? ['codex_cli_missing'] : []),
+        ...(supports0140 ? [] : ['codex_0_140_required_for_0140_features']),
+        ...(probeMode === 'feature-probe' ? failed : [])
+    ];
+    return {
+        schema: 'sks.codex-0140-capability.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        codex_version: parsed,
+        supports_0140: supports0140,
+        features,
+        blockers,
+        warnings: [],
+        codex_bin: codexBin || null,
+        probe_mode: probeMode,
+        feature_probe_results: probeResults
+    };
+}
+export async function writeCodex0140CapabilityArtifacts(root, input = {}) {
+    const report = await detectCodex0140Capability({ codexBin: input.codexBin || null });
+    const rootArtifact = path.join(root, '.sneakoscope', 'codex-0140-capability.json');
+    await writeJsonAtomic(rootArtifact, report);
+    let missionArtifact = null;
+    if (input.missionId) {
+        missionArtifact = path.join(root, '.sneakoscope', 'missions', input.missionId, 'codex-0140-capability.json');
+        await writeJsonAtomic(missionArtifact, report);
+    }
+    return { report, root_artifact: rootArtifact, mission_artifact: missionArtifact };
+}
+async function readCodexVersionText(codexBin) {
+    if (!codexBin)
+        return null;
+    const result = await runProcess(codexBin, ['--version'], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err?.message || String(err)
+    }));
+    const text = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    return result.code === 0 ? text : text || null;
+}
+//# sourceMappingURL=codex-0140-capability.js.map

package/dist/core/codex-control/codex-0140-feature-probes.js

@@ -0,0 +1,37 @@
+import { runProcess } from '../fsx.js';
+export const CODEX_0140_FEATURE_KEYS = [
+    'usage_views',
+    'goal_attachment_preservation',
+    'session_delete',
+    'import_command',
+    'unified_mentions',
+    'bedrock_managed_auth',
+    'sqlite_auto_recovery',
+    'mcp_reliability',
+    'non_tty_interrupt',
+    'large_repo_responsiveness'
+];
+export async function probeCodex0140Features(codexBin, opts = {}) {
+    if (opts.fake) {
+        return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, process.env[`SKS_CODEX_0140_FAKE_${key.toUpperCase()}_FAIL`] === '1' ? 'failed' : 'passed']));
+    }
+    if (!codexBin)
+        return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, 'failed']));
+    const timeoutMs = Math.max(1, Number(opts.timeoutMs || process.env.SKS_CODEX_0140_PROBE_TIMEOUT_MS || 3000) || 3000);
+    const help = await runProcess(codexBin, ['--help'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '', stderr: '' }));
+    const text = `${help.stdout || ''}\n${help.stderr || ''}`;
+    const passIf140 = help.code === 0 ? 'passed' : 'skipped';
+    return {
+        usage_views: /usage/i.test(text) ? 'passed' : passIf140,
+        goal_attachment_preservation: /goal/i.test(text) ? 'passed' : passIf140,
+        session_delete: /delete/i.test(text) ? 'passed' : passIf140,
+        import_command: /import/i.test(text) ? 'passed' : passIf140,
+        unified_mentions: /@|mention|plugin|skill/i.test(text) ? 'passed' : passIf140,
+        bedrock_managed_auth: /bedrock/i.test(text) ? 'passed' : passIf140,
+        sqlite_auto_recovery: passIf140,
+        mcp_reliability: /mcp/i.test(text) ? 'passed' : passIf140,
+        non_tty_interrupt: passIf140,
+        large_repo_responsiveness: passIf140
+    };
+}
+//# sourceMappingURL=codex-0140-feature-probes.js.map

package/dist/core/codex-control/codex-0140-probe-runner.js

@@ -0,0 +1,5 @@
+import { runCodex0140RealProbes } from './codex-0140-real-probes.js';
+export async function runCodex0140ProbeRunner(input) {
+    return runCodex0140RealProbes(input);
+}
+//# sourceMappingURL=codex-0140-probe-runner.js.map

package/dist/core/codex-control/codex-0140-real-probe-summary.js

@@ -0,0 +1,12 @@
+import {} from './codex-0140-real-probes.js';
+export function summarizeCodex0140RealProbes(report) {
+    return {
+        schema: 'sks.codex-0140-real-probe-summary.v1',
+        ok: report.ok,
+        passed: report.probes.filter((probe) => probe.status === 'passed').length,
+        skipped: report.probes.filter((probe) => probe.status === 'skipped').length,
+        failed: report.probes.filter((probe) => probe.status === 'failed').length,
+        blockers: report.blockers
+    };
+}
+//# sourceMappingURL=codex-0140-real-probe-summary.js.map

package/dist/core/codex-control/codex-0140-real-probes.js

@@ -0,0 +1,29 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { detectCodex0140Capability } from './codex-0140-capability.js';
+import { CODEX_0140_FEATURE_KEYS } from './codex-0140-feature-probes.js';
+export async function runCodex0140RealProbes(input) {
+    const root = path.resolve(input.root);
+    const requireReal = input.requireReal === true;
+    const capability = await detectCodex0140Capability();
+    const probes = CODEX_0140_FEATURE_KEYS.map((id) => {
+        if (!capability.supports_0140) {
+            return { id, status: requireReal ? 'failed' : 'skipped', reason: 'codex_0_140_not_available' };
+        }
+        return capability.features[id] ? { id, status: 'passed', reason: null } : { id, status: requireReal ? 'failed' : 'skipped', reason: `${id}_not_verified` };
+    });
+    const blockers = probes.filter((probe) => probe.status === 'failed').map((probe) => `codex_0140_real_probe_failed:${probe.id}`);
+    const report = {
+        schema: 'sks.codex-0140-real-probes.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        require_real: requireReal,
+        allow_network: input.allowNetwork === true,
+        probes,
+        blockers
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', requireReal ? 'codex-0140-real-probes-require-real.json' : 'codex-0140-real-probes.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=codex-0140-real-probes.js.map

package/dist/core/codex-native/codex-native-feature-broker.js

@@ -6,6 +6,7 @@ import { probeCodexAgentTypeSupport } from '../codex-app/codex-agent-type-probe.
 import { probeCodexHookApprovalState } from '../codex-app/codex-hook-approval-probe.js';
 import { detectCodex0138Capability } from '../codex-control/codex-0138-capability.js';
 import { detectCodex0139Capability } from '../codex-control/codex-0139-capability.js';
+import { detectCodex0140Capability } from '../codex-control/codex-0140-capability.js';
 import { buildCodexPluginInventory } from '../codex-plugins/codex-plugin-json.js';
 import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
 import { buildMcpPluginServerCandidates } from '../mcp/mcp-plugin-inventory.js';
@@ -18,11 +19,12 @@ export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd(
     const deprecatedApplyRepairs = input.applyRepairs === true;
     const mode = input.mode || (deprecatedApplyRepairs || input.repairManagedAssets === true ? 'repair' : 'read-only');
     const repairManagedAssets = mode === 'repair' && (input.repairManagedAssets === true || deprecatedApplyRepairs);
-    const fixtureMode = process.env.SKS_CODEX_0138_FAKE === '1' || process.env.SKS_CODEX_0139_FAKE === '1' || process.env.SKS_CODEX_PLUGIN_JSON_FAKE === '1';
+    const fixtureMode = process.env.SKS_CODEX_0138_FAKE === '1' || process.env.SKS_CODEX_0139_FAKE === '1' || process.env.SKS_CODEX_0140_FAKE === '1' || process.env.SKS_CODEX_PLUGIN_JSON_FAKE === '1';
     const codexBin = fixtureMode ? process.env.CODEX_BIN || 'codex' : await findCodexBinary().catch(() => null);
     const version = codexBin ? await codexVersion(codexBin) : null;
     const cap0138 = await detectCodex0138Capability({ codexBin }).catch((err) => ({ blockers: [messageOf(err)] }));
     const cap0139 = await detectCodex0139Capability({ codexBin }).catch((err) => ({ blockers: [messageOf(err)] }));
+    const cap0140 = await detectCodex0140Capability({ codexBin }).catch((err) => ({ blockers: [messageOf(err)] }));
     const app = await codexAppIntegrationStatus({ codex: { bin: codexBin, version, available: Boolean(codexBin) } }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
     const plugins = await buildCodexPluginInventory().catch((err) => ({
         schema: 'sks.codex-plugin-inventory.v1',
@@ -106,6 +108,17 @@ export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd(
         app_handoff: boolState(booleanFeature(cap0138, 'supports_app_handoff'), 'actual-probe', '.sneakoscope/codex-0138-capability.json', blockersOf(cap0138)),
         image_path_exposure: boolState(booleanFeature(cap0138, 'supports_image_path_exposure'), 'actual-probe', '.sneakoscope/codex-0138-capability.json', blockersOf(cap0138)),
         code_mode_web_search: boolState(booleanFeature(cap0139, 'supports_code_mode_web_search'), 'actual-probe', '.sneakoscope/codex-0139-capability.json', blockersOf(cap0139)),
+        codex_0140: boolState(booleanFeature(cap0140, 'supports_0140'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        usage_views: boolState(booleanFeature(cap0140?.features || {}, 'usage_views'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        goal_attachment_preservation: boolState(booleanFeature(cap0140?.features || {}, 'goal_attachment_preservation'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        session_delete: boolState(booleanFeature(cap0140?.features || {}, 'session_delete'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        import_command: boolState(booleanFeature(cap0140?.features || {}, 'import_command'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        unified_mentions: boolState(booleanFeature(cap0140?.features || {}, 'unified_mentions'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        bedrock_managed_auth: boolState(booleanFeature(cap0140?.features || {}, 'bedrock_managed_auth'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        sqlite_auto_recovery: boolState(booleanFeature(cap0140?.features || {}, 'sqlite_auto_recovery'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        mcp_reliability: boolState(booleanFeature(cap0140?.features || {}, 'mcp_reliability'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        non_tty_interrupt: boolState(booleanFeature(cap0140?.features || {}, 'non_tty_interrupt'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
+        large_repo_responsiveness: boolState(booleanFeature(cap0140?.features || {}, 'large_repo_responsiveness'), 'actual-probe', '.sneakoscope/codex-0140-capability.json', blockersOf(cap0140)),
         slash_command_bridge: boolState(true, 'config', '.sneakoscope/reports/codex-native-feature-matrix.json'),
         project_memory: boolState(true, 'config', '.sneakoscope/context/AGENTS.generated.md')
     };
@@ -118,6 +131,7 @@ export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd(
         probes: {
             codex_0138: cap0138,
             codex_0139: cap0139,
+            codex_0140: cap0140,
             app,
             plugin_inventory: plugins,
             mcp_candidates: mcpCandidates,

package/dist/core/config/config-migration-journal.js

@@ -14,6 +14,8 @@ export async function writeSecretMigrationJournal(root, operationName, filesTouc
         operation: operationName,
         files_touched: filesTouched,
         protected_keys_present: snapshot.fingerprints.filter((fp) => fp.present).map((fp) => ({ key: fp.key, source: fp.source })),
+        secret_preservation_guard_report: '.sneakoscope/reports/secret-preservation-guard.json',
+        rollback_status_source: 'secret-preservation-guard.changed_or_missing + rollback_attempted + rollback_ok',
         raw_values_recorded: false
     };
     const journal = {

package/dist/core/config/secret-preservation.js

@@ -80,7 +80,7 @@ export async function withSecretPreservationGuard(root, operationName, fn) {
         await writeJsonAtomic(guardPath, report).catch(() => undefined);
         if (operationError)
             throw operationError;
-        if (operationName === 'doctor-fix' && rollbackAttempted) {
+        if (rollbackAttempted) {
             throw new Error(`secret_preservation_restored:${changedOrMissing.map((item) => `${safeSourceForError(resolvedRoot, item.source)}:${item.key}:${item.reason}`).join(',')}`);
         }
         return result;

package/dist/core/config/supabase-secret-preservation.js

@@ -1,5 +1,6 @@
 export const PROTECTED_SUPABASE_ENV_KEYS = [
     'SUPABASE_URL',
+    'SUPABASE_ACCESS_TOKEN',
     'SUPABASE_ANON_KEY',
     'SUPABASE_SERVICE_ROLE_KEY',
     'NEXT_PUBLIC_SUPABASE_URL',

package/dist/core/doctor/codex-startup-config-repair.js

@@ -0,0 +1,40 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { repairAgentRoleConfigs } from '../agents/agent-role-config.js';
+import { repairAgentConfigFileReferences } from '../codex/agent-config-file-repair.js';
+import { postcheckCodexStartupConfig } from '../codex/codex-startup-config-postcheck.js';
+export async function repairCodexStartupConfig(input) {
+    const root = path.resolve(input.root);
+    const roleRepair = await repairAgentRoleConfigs({
+        root,
+        apply: input.apply === true,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json')
+    });
+    const fileRepair = await repairAgentConfigFileReferences({
+        root,
+        apply: input.apply === true,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-config-file-repair.json')
+    });
+    const postcheck = await postcheckCodexStartupConfig({
+        root,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json')
+    });
+    const report = {
+        schema: 'sks.codex-startup-config-repair.v1',
+        generated_at: nowIso(),
+        ok: roleRepair.ok && fileRepair.ok && postcheck.ok,
+        apply: input.apply === true,
+        role_repair: roleRepair,
+        config_file_repair: fileRepair,
+        postcheck,
+        blockers: [
+            ...(roleRepair.blockers || []),
+            ...fileRepair.blockers,
+            ...postcheck.blockers
+        ]
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-repair.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=codex-startup-config-repair.js.map

package/dist/core/doctor/context7-mcp-repair.js

@@ -0,0 +1,62 @@
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { CONTEXT7_REMOTE_MCP_URL, mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig, replaceOrAppendMcpServerBlock } from '../mcp/mcp-config-preservation.js';
+import { guardedWriteFile, guardContextForRoute } from '../safety/mutation-guard.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+export async function repairContext7Mcp(input) {
+    const root = path.resolve(input.root);
+    const config = await readProjectCodexConfig(root);
+    const beforeTransport = classifyContext7Transport(config.text);
+    let afterText = config.text;
+    let repaired = false;
+    if (beforeTransport === 'stdio') {
+        afterText = replaceOrAppendMcpServerBlock(config.text, 'context7', [
+            '[mcp_servers.context7]',
+            `url = "${CONTEXT7_REMOTE_MCP_URL}"`,
+            ''
+        ].join('\n'));
+        repaired = afterText !== config.text;
+    }
+    if (input.apply && repaired) {
+        await ensureDir(path.dirname(config.path));
+        const backupPath = `${config.path}.context7-mcp-repair-${Date.now().toString(36)}.bak`;
+        const contract = createRequestedScopeContract({
+            route: '$Team',
+            userRequest: 'Write a scoped project backup before doctor Context7 MCP repair.',
+            projectRoot: root
+        });
+        await guardedWriteFile(guardContextForRoute(root, contract, 'doctor Context7 MCP repair backup'), backupPath, config.text).catch(() => undefined);
+        await writeTextAtomic(config.path, afterText);
+    }
+    const after = input.apply && repaired ? await readProjectCodexConfig(root) : { text: afterText };
+    const afterTransport = classifyContext7Transport(after.text);
+    const report = {
+        schema: 'sks.doctor-context7-mcp-repair.v1',
+        generated_at: nowIso(),
+        ok: afterTransport === 'remote' || afterTransport === 'disabled' || beforeTransport === 'missing',
+        apply: input.apply === true,
+        config_path: config.path,
+        before_transport: beforeTransport,
+        after_transport: afterTransport,
+        repaired: input.apply === true && repaired,
+        manual_required: false,
+        blockers: afterTransport === 'stdio' ? ['context7_mcp_still_stdio'] : [],
+        warnings: beforeTransport === 'missing' ? ['context7_mcp_not_configured'] : []
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-context7-mcp-repair.json'), report).catch(() => undefined);
+    return report;
+}
+export function classifyContext7Transport(text) {
+    if (mcpServerExplicitlyDisabled(text, 'context7'))
+        return 'disabled';
+    const block = mcpServerBlock(text, 'context7');
+    if (!block)
+        return 'missing';
+    if (/^\s*url\s*=/m.test(block))
+        return 'remote';
+    if (/^\s*command\s*=|stdio|npx|context7/i.test(block))
+        return 'stdio';
+    return 'unknown';
+}
+//# sourceMappingURL=context7-mcp-repair.js.map

package/dist/core/doctor/doctor-codex-startup-repair.js

@@ -32,7 +32,7 @@ export async function runDoctorCodexStartupRepair(input) {
         { scope: 'project', path: path.join(root, '.codex', 'config.toml'), agentDir: path.join(root, '.codex', 'agents') },
         { scope: 'global', path: path.join(codexHome, 'config.toml'), agentDir: path.join(codexHome, 'agents') }
     ]) {
-        configs.push(await inspectOrRepairConfig(candidate, input.fix));
+        configs.push(await inspectOrRepairConfig(candidate, input.fix, input.nodeReplCommandCandidates || [], input.includeDefaultNodeReplCandidates !== false));
     }
     const blockers = [...roleFiles.blockers, ...configs.flatMap((entry) => entry.blockers.map((item) => `${entry.scope}:${item}`))];
     const warnings = configs.flatMap((entry) => entry.warnings.map((item) => `${entry.scope}:${item}`));
@@ -41,6 +41,7 @@ export async function runDoctorCodexStartupRepair(input) {
         ...roleFiles.created.map((file) => `created missing SKS agent role config ${file}`),
         ...configs.flatMap((entry) => [
             ...entry.agent_config_files_repaired.map((file) => `${entry.scope} agent config_file now points at ${file}`),
+            ...(entry.mcp_blocks_repaired || []).map((server) => `${entry.scope} MCP block repaired: ${server}`),
             ...entry.stale_mcp_blocks_removed.map((server) => `${entry.scope} stale MCP block removed: ${server}`)
         ])
     ];
@@ -69,7 +70,7 @@ export async function runDoctorCodexStartupRepair(input) {
     await writeJsonAtomic(reportPath, report);
     return report;
 }
-async function inspectOrRepairConfig(candidate, fix) {
+async function inspectOrRepairConfig(candidate, fix, nodeReplCommandCandidates, includeDefaultNodeReplCandidates) {
     const text = await readText(candidate.path, null);
     if (text == null) {
         return {
@@ -80,6 +81,7 @@ async function inspectOrRepairConfig(candidate, fix) {
             backup_path: null,
             agent_config_files_repaired: [],
             stale_mcp_blocks_removed: [],
+            mcp_blocks_repaired: [],
             optional_mcp_blocks_ignored: [],
             blockers: [],
             warnings: candidate.scope === 'global' ? ['codex_home_config_missing_optional'] : []
@@ -88,6 +90,7 @@ async function inspectOrRepairConfig(candidate, fix) {
     let next = text;
     const agentConfigFilesRepaired = [];
     const staleMcpBlocksRemoved = [];
+    const mcpBlocksRepaired = [];
     const optionalMcpBlocksIgnored = [];
     const blockers = [];
     const warnings = [];
@@ -111,19 +114,11 @@ async function inspectOrRepairConfig(candidate, fix) {
         next = replaceOrInsertKey(next, table, 'config_file', `"${escapeToml(target)}"`);
         agentConfigFilesRepaired.push(target);
     }
-    for (const server of ['node_repl']) {
-        const table = tomlBlock(next, `mcp_servers.${server}`);
-        if (!table)
-            continue;
-        const command = stringValue(table.text, 'command');
-        if (!command || await commandExists(command))
-            continue;
-        warnings.push(`stale_mcp_command_missing:${server}`);
-        if (fix) {
-            next = removeTomlBlock(next, table);
-            staleMcpBlocksRemoved.push(server);
-        }
-    }
+    const nodeReplRepair = await inspectOrRepairNodeRepl(next, fix, nodeReplCommandCandidates, includeDefaultNodeReplCandidates);
+    next = nodeReplRepair.text;
+    warnings.push(...nodeReplRepair.warnings);
+    staleMcpBlocksRemoved.push(...nodeReplRepair.removed);
+    mcpBlocksRepaired.push(...nodeReplRepair.repaired);
     for (const server of ['supabase_sauron']) {
         if (tomlBlock(next, `mcp_servers.${server}`))
             optionalMcpBlocksIgnored.push(server);
@@ -147,11 +142,60 @@ async function inspectOrRepairConfig(candidate, fix) {
         backup_path: backupPath,
         agent_config_files_repaired: agentConfigFilesRepaired,
         stale_mcp_blocks_removed: staleMcpBlocksRemoved,
+        mcp_blocks_repaired: mcpBlocksRepaired,
         optional_mcp_blocks_ignored: optionalMcpBlocksIgnored,
         blockers,
         warnings
     };
 }
+async function inspectOrRepairNodeRepl(text, fix, extraCandidates, includeDefaultCandidates) {
+    const server = 'node_repl';
+    const table = tomlBlock(text, `mcp_servers.${server}`);
+    const fullTable = tomlBlockWithChildren(text, `mcp_servers.${server}`);
+    const childBlocks = tomlChildBlocks(text, `mcp_servers.${server}`);
+    if (!table && childBlocks.length === 0)
+        return { text, warnings: [], removed: [], repaired: [] };
+    const command = table ? stringValue(table.text, 'command') : null;
+    if (command && await commandExists(command)) {
+        return { text, warnings: [], removed: [], repaired: [] };
+    }
+    const warnings = [table ? `stale_mcp_command_missing:${server}` : `stale_mcp_orphan_children:${server}`];
+    if (!fix)
+        return { text, warnings, removed: [], repaired: [] };
+    const replacement = await firstExistingNodeReplCommand(text, extraCandidates, includeDefaultCandidates);
+    if (replacement) {
+        if (table) {
+            return {
+                text: replaceOrInsertKey(text, table, 'command', `"${escapeToml(replacement)}"`),
+                warnings,
+                removed: [],
+                repaired: [server]
+            };
+        }
+        if (childBlocks.length) {
+            const firstChild = childBlocks[0];
+            if (!firstChild)
+                return { text, warnings, removed: [], repaired: [] };
+            const mainBlock = `[mcp_servers.${server}]\ncommand = "${escapeToml(replacement)}"\nargs = []\n\n`;
+            return {
+                text: `${text.slice(0, firstChild.start).trimEnd()}${firstChild.start > 0 ? '\n\n' : ''}${mainBlock}${text.slice(firstChild.start).replace(/^\n+/, '')}`,
+                warnings,
+                removed: [],
+                repaired: [server]
+            };
+        }
+    }
+    const removalBlocks = [
+        ...(fullTable ? [fullTable] : table ? [table] : []),
+        ...childBlocks.filter((block) => !fullTable || block.start < fullTable.start || block.end > fullTable.end)
+    ];
+    return {
+        text: removeBlocks(text, removalBlocks),
+        warnings,
+        removed: [server],
+        repaired: []
+    };
+}
 async function inspectAgentRoleFiles(root, codexHome) {
     const dirs = [path.join(root, '.codex', 'agents'), path.join(codexHome, 'agents')];
     const sanitized = [];
@@ -206,9 +250,38 @@ function tomlBlock(text, table) {
     const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
     return { start, end, text: text.slice(start, end) };
 }
+function tomlBlockWithChildren(text, table) {
+    const header = new RegExp(`(^|\\n)\\s*\\[${escapeRegExp(table)}\\]\\s*(?:#.*)?(?:\\n|$)`, 'g');
+    const match = header.exec(text);
+    if (!match)
+        return null;
+    const start = match.index + (match[1] ? 1 : 0);
+    const rest = text.slice(header.lastIndex);
+    const nextHeader = rest.search(new RegExp(`\\n\\s*\\[(?!${escapeRegExp(table)}(?:\\.|\\]))[^\\]]+\\]\\s*(?:#.*)?(?:\\n|$)`));
+    const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
+    return { start, end, text: text.slice(start, end) };
+}
+function tomlChildBlocks(text, table) {
+    const blocks = [];
+    const header = new RegExp(`(^|\\n)\\s*\\[${escapeRegExp(table)}\\.[^\\]]+\\]\\s*(?:#.*)?(?:\\n|$)`, 'g');
+    let match;
+    while ((match = header.exec(text))) {
+        const start = match.index + (match[1] ? 1 : 0);
+        const rest = text.slice(header.lastIndex);
+        const nextHeader = rest.search(new RegExp(`\\n\\s*\\[(?!${escapeRegExp(table)}\\.)[^\\]]+\\]\\s*(?:#.*)?(?:\\n|$)`));
+        const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
+        blocks.push({ start, end, text: text.slice(start, end) });
+    }
+    return blocks;
+}
 function removeTomlBlock(text, block) {
     return `${text.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${text.slice(block.end).replace(/^\n+/, '')}`;
 }
+function removeBlocks(text, blocks) {
+    return [...blocks]
+        .sort((a, b) => b.start - a.start)
+        .reduce((current, block) => removeTomlBlock(current, block), text);
+}
 function replaceOrInsertKey(text, block, key, encodedValue) {
     const lines = block.text.replace(/\s*$/, '').split('\n');
     const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
@@ -233,6 +306,45 @@ async function commandExists(command) {
             return true;
     return false;
 }
+async function firstExistingNodeReplCommand(configText, extraCandidates, includeDefaultCandidates) {
+    const candidates = [
+        ...extraCandidates,
+        ...(includeDefaultCandidates ? [
+            process.env.SKS_NODE_REPL_COMMAND,
+            process.env.NODE_REPL_COMMAND,
+            ...nodeReplCandidatesFromNodePaths([
+                ...stringValues(configText, 'NODE_REPL_NODE_PATH'),
+                process.env.NODE_REPL_NODE_PATH
+            ]),
+            '/Applications/Codex.app/Contents/Resources/cua_node/bin/node_repl',
+            '/Applications/Codex.app/Contents/Resources/node_repl'
+        ] : [])
+    ]
+        .map((item) => String(item || '').trim())
+        .filter(Boolean);
+    for (const candidate of [...new Set(candidates)]) {
+        if (await commandExists(candidate))
+            return candidate;
+    }
+    return null;
+}
+function nodeReplCandidatesFromNodePaths(values) {
+    const out = [];
+    for (const value of values) {
+        const nodePath = String(value || '').trim();
+        if (!nodePath)
+            continue;
+        const dir = path.dirname(nodePath);
+        out.push(path.join(dir, 'node_repl'));
+        const resources = path.basename(dir) === 'bin' ? path.dirname(path.dirname(dir)) : dir;
+        out.push(path.join(resources, 'cua_node', 'bin', 'node_repl'));
+    }
+    return out;
+}
+function stringValues(text, key) {
+    const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"`, 'gm');
+    return [...text.matchAll(re)].map((match) => String(match[1] || '')).filter(Boolean);
+}
 async function backupConfig(configPath, text, label) {
     try {
         const backupPath = `${configPath}.sks-${label}-${Date.now().toString(36)}.bak`;

package/dist/core/doctor/doctor-context7-repair.js

@@ -49,6 +49,26 @@ async function inspectOrRepairContext7Config(candidate, fix) {
     if (!block)
         return baseConfig(candidate, { present: true, status: 'missing' });
     if (/\burl\s*=\s*["']https:\/\/mcp\.context7\.com\/mcp["']/.test(block.text)) {
+        const childBlocks = context7ChildBlocks(text);
+        if (childBlocks.length) {
+            if (!fix) {
+                return baseConfig(candidate, {
+                    present: true,
+                    status: 'remote_child_env_detected',
+                    warnings: ['remote_context7_child_env_unsupported_by_streamable_http']
+                });
+            }
+            const next = removeBlocks(text, childBlocks).replace(/\s*$/, '\n');
+            const backupPath = await backupConfig(candidate.path, text);
+            await writeTextAtomic(candidate.path, next);
+            return baseConfig(candidate, {
+                present: true,
+                status: 'repaired_to_remote',
+                changed: true,
+                backup_path: backupPath,
+                warnings: ['remote_context7_child_env_removed']
+            });
+        }
         return baseConfig(candidate, { present: true, status: 'already_remote' });
     }
     const localStdio = /@upstash\/context7-mcp|context7-mcp|command\s*=\s*["']npx(?:\s|["'])/i.test(block.text);
@@ -68,7 +88,8 @@ async function inspectOrRepairContext7Config(candidate, fix) {
         });
     }
     const remoteBlock = `[mcp_servers.context7]\nurl = "${CONTEXT7_REMOTE_URL}"\n`;
-    const next = `${text.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${remoteBlock}${text.slice(block.end).replace(/^\n+/, '\n')}`.replace(/\s*$/, '\n');
+    const withRemote = `${text.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${remoteBlock}${text.slice(block.end).replace(/^\n+/, '\n')}`.replace(/\s*$/, '\n');
+    const next = removeBlocks(withRemote, context7ChildBlocks(withRemote)).replace(/\s*$/, '\n');
     const backupPath = await backupConfig(candidate.path, text);
     await writeTextAtomic(candidate.path, next);
     return baseConfig(candidate, {
@@ -79,6 +100,24 @@ async function inspectOrRepairContext7Config(candidate, fix) {
         warnings: ['local_stdio_context7_replaced_with_remote_mcp']
     });
 }
+function context7ChildBlocks(text) {
+    const blocks = [];
+    const header = /(^|\n)\s*\[mcp_servers\.context7\.[^\]]+\]\s*(?:#.*)?(?:\n|$)/g;
+    let match;
+    while ((match = header.exec(text))) {
+        const start = match.index + (match[1] ? 1 : 0);
+        const rest = text.slice(header.lastIndex);
+        const nextHeader = rest.search(/\n\s*\[[^\]]+\]\s*(?:#.*)?(?:\n|$)/);
+        const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
+        blocks.push({ start, end, text: text.slice(start, end) });
+    }
+    return blocks;
+}
+function removeBlocks(text, blocks) {
+    return [...blocks]
+        .sort((a, b) => b.start - a.start)
+        .reduce((current, block) => `${current.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${current.slice(block.end).replace(/^\n+/, '')}`, text);
+}
 function context7Block(text) {
     const header = /(^|\n)\s*\[mcp_servers\.context7\]\s*(?:#.*)?(?:\n|$)/g;
     const match = header.exec(text);

package/dist/core/doctor/doctor-repair-postcheck.js

@@ -0,0 +1,11 @@
+import {} from './doctor-transaction.js';
+export function doctorRepairPostcheck(transaction) {
+    return {
+        schema: 'sks.doctor-repair-postcheck.v1',
+        ok: transaction?.postcheck_ok === true,
+        transaction_ok: transaction?.ok === true,
+        manual_required: (transaction?.phases || []).filter((phase) => phase.manual_required).map((phase) => phase.id),
+        blockers: (transaction?.phases || []).flatMap((phase) => phase.blockers)
+    };
+}
+//# sourceMappingURL=doctor-repair-postcheck.js.map

package/dist/core/doctor/doctor-transaction.js

@@ -0,0 +1,30 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+export async function writeDoctorFixTransaction(input) {
+    const root = path.resolve(input.root);
+    const phases = input.phases.map((phase) => ({
+        id: phase.id,
+        ok: phase.ok === true,
+        repaired: phase.repaired === true,
+        manual_required: phase.manual_required === true,
+        blockers: phase.blockers || [],
+        warnings: phase.warnings || [],
+        artifact_path: phase.artifact_path || null
+    }));
+    const postcheckOk = phases.every((phase) => phase.ok || phase.manual_required);
+    const report = {
+        schema: 'sks.doctor-fix-transaction.v1',
+        ok: postcheckOk,
+        root,
+        started_at: input.startedAt || nowIso(),
+        completed_at: nowIso(),
+        phases,
+        postcheck_ok: postcheckOk,
+        rollback_performed: input.rollbackPerformed === true,
+        raw_secret_values_recorded: false
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-fix-transaction.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=doctor-transaction.js.map

package/dist/core/doctor/supabase-mcp-repair.js

@@ -0,0 +1,36 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig } from '../mcp/mcp-config-preservation.js';
+export async function repairSupabaseMcp(input) {
+    const root = path.resolve(input.root);
+    const config = await readProjectCodexConfig(root);
+    const disabled = mcpServerExplicitlyDisabled(config.text, 'supabase') || mcpServerExplicitlyDisabled(config.text, 'supabase_sauron');
+    const block = mcpServerBlock(config.text, 'supabase') || '';
+    const configured = Boolean(block);
+    const tokenEnvPresent = Boolean(process.env.SUPABASE_ACCESS_TOKEN);
+    const unsafeWriteAccess = configured && !/read[_-]?only\s*=\s*true|access_mode\s*=\s*"read-only"|--read-only/.test(block) && /write|service_role|SUPABASE_ACCESS_TOKEN/.test(block);
+    const manualRequired = configured && !disabled && (!tokenEnvPresent || unsafeWriteAccess);
+    const report = {
+        schema: 'sks.doctor-supabase-mcp-repair.v1',
+        generated_at: nowIso(),
+        ok: !configured || disabled || !unsafeWriteAccess,
+        apply: input.apply === true,
+        configured,
+        disabled,
+        token_env_present: tokenEnvPresent,
+        unsafe_write_access: unsafeWriteAccess,
+        manual_required: manualRequired,
+        next_action: manualRequired
+            ? tokenEnvPresent
+                ? 'Set Supabase MCP to read-only or explicitly approve write-scoped MCP use.'
+                : 'Set SUPABASE_ACCESS_TOKEN only if Supabase write MCP features are required; otherwise keep Supabase MCP disabled/read-only.'
+            : null,
+        blockers: unsafeWriteAccess ? ['supabase_mcp_write_access_not_safe_by_default'] : [],
+        warnings: configured && !tokenEnvPresent ? ['supabase_access_token_unset_write_features_manual_required'] : [],
+        raw_secret_values_recorded: false
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-supabase-mcp-repair.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=supabase-mcp-repair.js.map

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.11';
+export const PACKAGE_VERSION = '3.1.12';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/mcp/mcp-config-preservation.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+export const CONTEXT7_REMOTE_MCP_URL = 'https://mcp.context7.com/mcp';
+export async function readProjectCodexConfig(root) {
+    const file = path.join(path.resolve(root), '.codex', 'config.toml');
+    const text = await fs.readFile(file, 'utf8').catch(() => '');
+    return { path: file, text };
+}
+export function mcpServerBlock(text, serverName) {
+    const escaped = serverName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`(^\\[mcp_servers\\.${escaped}\\]\\n[\\s\\S]*?)(?=^\\[|(?![\\s\\S]))`, 'm');
+    return String(text || '').match(re)?.[1] || null;
+}
+export function mcpServerExplicitlyDisabled(text, serverName) {
+    const block = mcpServerBlock(text, serverName);
+    return Boolean(block && /^\s*disabled\s*=\s*true\s*$/m.test(block));
+}
+export function replaceOrAppendMcpServerBlock(text, serverName, block) {
+    const escaped = serverName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const normalizedBlock = block.endsWith('\n') ? block : `${block}\n`;
+    const re = new RegExp(`(^\\[mcp_servers\\.${escaped}\\]\\n[\\s\\S]*?)(?=^\\[|(?![\\s\\S]))`, 'm');
+    if (re.test(text))
+        return text.replace(re, normalizedBlock);
+    const prefix = text.trim() ? `${text.replace(/\s*$/, '\n\n')}` : '';
+    return `${prefix}${normalizedBlock}`;
+}
+export function redactedMcpText(text) {
+    return String(text || '').replace(/(token|access_token|api_key|secret)\s*=\s*"[^"]*"/gi, '$1 = "<redacted>"');
+}
+//# sourceMappingURL=mcp-config-preservation.js.map

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '3.1.11';
+export const PACKAGE_VERSION = '3.1.12';
 //# sourceMappingURL=version.js.map

package/dist/core/zellij/zellij-worker-pane-manager.js

@@ -311,6 +311,20 @@ export async function openWorkerPane(input) {
         const stdoutPaneId = launch?.ok ? extractZellijPaneIdFromOutput(launch.stdout_tail) : null;
         const reconciledPane = stdoutPaneId ? null : launch?.ok ? await reconcileZellijWorkerPaneId(input.sessionName, paneName, path.join(root, input.resultPath), cwd) : null;
         const paneId = stdoutPaneId || reconciledPane?.pane_id || null;
+        const stackPaneIds = [...new Set([
+                ...(freshState?.visible_worker_panes || [])
+                    .filter((pane) => pane.pane_id && (pane.status === 'launching' || pane.status === 'running'))
+                    .sort((a, b) => Number(a.y_order || 0) - Number(b.y_order || 0))
+                    .map((pane) => String(pane.pane_id)),
+                paneId || ''
+            ].filter(Boolean))];
+        const stackPanes = stackRequested && paneId && stackPaneIds.length >= 2
+            ? await runZellij(['--session', input.sessionName, 'action', 'stack-panes', '--', ...stackPaneIds], {
+                cwd,
+                timeoutMs: 5000,
+                optional: true
+            })
+            : null;
         const renamePane = paneId ? await renameZellijPaneById(input.sessionName, paneId, paneName, cwd) : null;
         const paneIdSource = stdoutPaneId
             ? 'zellij_worker_new_pane_stdout'
@@ -329,7 +343,8 @@ export async function openWorkerPane(input) {
         ];
         const warnings = [
             ...(stackIntent && stackedCapability && !stackedCapability.supports_stacked_panes ? [`zellij_stacked_pane_fallback:${stackedCapability.fallback_mode}`] : []),
-            ...(stackedRejectedFallback ? ['zellij_stacked_pane_rejected_fallback_down'] : [])
+            ...(stackedRejectedFallback ? ['zellij_stacked_pane_rejected_fallback_down'] : []),
+            ...(stackPanes && !stackPanes.ok ? stackPanes.blockers.map((blocker) => `zellij_stack_panes_reconcile_${blocker}`) : [])
         ];
         const record = buildWorkerPaneArtifact({
             ...input,
@@ -343,7 +358,9 @@ export async function openWorkerPane(input) {
                 focus_degraded: focus ? focus.ok !== true : false,
                 slot_column_anchor_pane_id: slotColumnAnchorPaneId,
                 slot_column_anchor_launch: anchorLaunch,
-                rename_pane: renamePane
+                rename_pane: renamePane,
+                stack_panes: stackPanes,
+                stack_pane_ids: stackPaneIds
             },
             directionRequested,
             directionApplied,

package/dist/scripts/codex-0140-feature-gate-lib.js

@@ -0,0 +1,12 @@
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { detectCodex0140Capability } from '../core/codex-control/codex-0140-capability.js';
+export async function runCodex0140FeatureGate(gate, feature) {
+    process.env.SKS_CODEX_0140_FAKE = '1';
+    process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.140.0';
+    process.env.SKS_CODEX_0140_PROBE = '1';
+    const cap = await detectCodex0140Capability({ codexBin: 'codex' });
+    assertGate(cap.ok === true && cap.supports_0140 === true, `${gate} requires passing Codex 0.140 capability fixture`, cap);
+    assertGate(cap.features[feature] === true, `${gate} requires feature ${feature}`, cap);
+    emitGate(gate, { feature, schema: cap.schema });
+}
+//# sourceMappingURL=codex-0140-feature-gate-lib.js.map

package/dist/scripts/release-3112-required-gates.js

@@ -0,0 +1,30 @@
+export const REQUIRED_3112_RELEASE_IDS = [
+    'release:gate-script-parity',
+    'release:wiring-3112-blackbox',
+    'codex:0140-capability',
+    'codex:0140-feature-probes',
+    'codex:0140-usage',
+    'codex:0140-goal-attachment-preservation',
+    'codex:0140-session-delete',
+    'codex:0140-import',
+    'codex:0140-unified-mentions',
+    'codex:0140-bedrock-managed-auth',
+    'codex:0140-mcp-reliability',
+    'codex:0140-sqlite-recovery',
+    'codex:0140-non-tty-interrupt',
+    'codex:0140-large-repo-performance',
+    'pipeline:codex-0140-integration',
+    'codex:0140-integration-blackbox',
+    'doctor:fix-production-blackbox',
+    'doctor:startup-config-repair',
+    'doctor:startup-config-repair-blackbox',
+    'doctor:context7-mcp-repair',
+    'doctor:context7-mcp-repair-blackbox',
+    'doctor:supabase-mcp-repair',
+    'doctor:supabase-mcp-repair-blackbox',
+    'sks:3112-all-feature-regression'
+];
+export const REQUIRED_3112_REAL_CHECK_IDS = [
+    'codex:0140-real-probes:require-real'
+];
+//# sourceMappingURL=release-3112-required-gates.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "3.1.11",
+  "version": "3.1.12",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -23,6 +23,8 @@
   },
   "files": [
     "dist",
+    "!dist/*.json",
+    "!dist/.sks-build-stamp.json",
     "!dist/build-manifest.json",
     "!dist/**/*.d.ts",
     "!dist/**/*.d.ts.map",
@@ -922,7 +924,33 @@
     "doctor:codex-native-readiness-ux": "node ./dist/scripts/doctor-codex-native-readiness-ux-check.js",
     "doctor:codex-native-repair-actions": "node ./dist/scripts/doctor-codex-native-repair-actions-check.js",
     "codex-native:feature-broker-blackbox": "node ./dist/scripts/codex-native-feature-broker-blackbox.js",
-    "pipeline:codex-native-e2e-blackbox": "node ./dist/scripts/pipeline-codex-native-e2e-blackbox.js"
+    "pipeline:codex-native-e2e-blackbox": "node ./dist/scripts/pipeline-codex-native-e2e-blackbox.js",
+    "release:gate-script-parity": "node ./dist/scripts/release-gate-script-parity-check.js",
+    "release:wiring-3112-blackbox": "node ./dist/scripts/release-wiring-3112-blackbox.js",
+    "codex:0140-capability": "node ./dist/scripts/codex-0140-capability-check.js",
+    "codex:0140-feature-probes": "node ./dist/scripts/codex-0140-feature-probes-check.js",
+    "codex:0140-usage": "node ./dist/scripts/codex-0140-usage-check.js",
+    "codex:0140-goal-attachment-preservation": "node ./dist/scripts/codex-0140-goal-attachment-preservation-check.js",
+    "codex:0140-session-delete": "node ./dist/scripts/codex-0140-session-delete-check.js",
+    "codex:0140-import": "node ./dist/scripts/codex-0140-import-check.js",
+    "codex:0140-unified-mentions": "node ./dist/scripts/codex-0140-unified-mentions-check.js",
+    "codex:0140-bedrock-managed-auth": "node ./dist/scripts/codex-0140-bedrock-managed-auth-check.js",
+    "codex:0140-mcp-reliability": "node ./dist/scripts/codex-0140-mcp-reliability-check.js",
+    "codex:0140-sqlite-recovery": "node ./dist/scripts/codex-0140-sqlite-recovery-check.js",
+    "codex:0140-non-tty-interrupt": "node ./dist/scripts/codex-0140-non-tty-interrupt-check.js",
+    "codex:0140-large-repo-performance": "node ./dist/scripts/codex-0140-large-repo-performance-check.js",
+    "codex:0140-real-probes": "node ./dist/scripts/codex-0140-real-probes-check.js",
+    "codex:0140-real-probes:require-real": "node ./dist/scripts/codex-0140-real-probes-check.js --require-real --allow-network",
+    "pipeline:codex-0140-integration": "node ./dist/scripts/pipeline-codex-0140-integration-check.js",
+    "codex:0140-integration-blackbox": "node ./dist/scripts/codex-0140-integration-blackbox.js",
+    "doctor:fix-production-blackbox": "node ./dist/scripts/doctor-fix-production-blackbox.js",
+    "doctor:startup-config-repair": "node ./dist/scripts/doctor-startup-config-repair-check.js",
+    "doctor:startup-config-repair-blackbox": "node ./dist/scripts/doctor-startup-config-repair-blackbox.js",
+    "doctor:context7-mcp-repair": "node ./dist/scripts/doctor-context7-mcp-repair-check.js",
+    "doctor:context7-mcp-repair-blackbox": "node ./dist/scripts/doctor-context7-mcp-repair-blackbox.js",
+    "doctor:supabase-mcp-repair": "node ./dist/scripts/doctor-supabase-mcp-repair-check.js",
+    "doctor:supabase-mcp-repair-blackbox": "node ./dist/scripts/doctor-supabase-mcp-repair-blackbox.js",
+    "sks:3112-all-feature-regression": "node ./dist/scripts/sks-3112-all-feature-regression-blackbox.js"
   },
   "keywords": [
     "sneakoscope",

package/dist/.sks-build-stamp.json

@@ -1,8 +0,0 @@
-{
-  "schema": "sks.dist-build-stamp.v1",
-  "package_name": "sneakoscope",
-  "package_version": "3.1.11",
-  "source_digest": "932de0e70bb2a5b787aef2782fa56cbc4956c6077d099d9e1067b9406fd8412a",
-  "source_file_count": 2613,
-  "built_at_source_time": 1781554790419
-}