sneakoscope 3.1.11 → 3.1.13

package/README.md

@@ -35,15 +35,16 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.11** is a release-ready repair pass for MAD Zellij stacked panes, Context7 MCP doctor recovery, and stale Codex startup config.
+SKS **3.1.13** is a production-hardening release for Codex 0.140 evidence, transactional `sks doctor --fix` repair, MCP readiness, native capability proof, and protected-secret rollback.
 
-What changed in 3.1.11:
+What changed in 3.1.13:
 
-- **MAD Zellij panes require native stacked-pane support.** `sks doctor --fix` now treats Zellij 0.43.0 as the minimum interactive runtime so `sks --mad` can use native stacked worker panes instead of fragmenting into plain splits.
-- **Context7 stdio lockups are doctor-repairable.** `sks doctor --fix` detects local `@upstash/context7-mcp` stdio config and migrates it to the remote Context7 MCP endpoint so Codex launches do not stall at the stdio server banner.
-- **Codex startup warnings are doctor-repairable.** `sks doctor --fix` rewrites stale SKS agent `config_file` paths to existing absolute files, removes unsupported managed `message_role_prefix` role fields, preserves optional `supabase_sauron`, and drops missing-command `node_repl` MCP blocks that would otherwise spam startup.
-- **Doctor JSON exposes the Context7 and startup repair reports.** `context7_repair`, `codex_startup_repair`, and their `repair.*` entries carry migration status, backups, actions, warnings, and any manual auth actions.
-- **Release metadata is aligned for 3.1.11.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
+- **Codex 0.140 readiness carries evidence.** Capability reports now expose per-feature state and certainty, real usage parsing, goal attachment roundtrip proof, and usage-budget provenance for loop/Naruto runtime decisions.
+- **Doctor repair is phase-based.** `sks doctor --fix` records phase durations, postchecks, optional manual readiness, and rollback evidence instead of collapsing repair work into a summary writer.
+- **Startup and MCP repair are safer.** Managed agent TOML blocks are repaired without touching unrelated config, missing role files are regenerated from real managed templates, Context7 disabled servers stay disabled, and Supabase write scope is separated from read-only readiness.
+- **Secret rollback is line-level when possible.** Protected key changes are restored without discarding unrelated operator edits, nested guard operations are recorded, and backup artifacts remain ignored.
+- **Native capability proof is stricter.** Computer Use and Chrome/web review no longer become verified from environment variables outside explicit fixture/test modes.
+- **Release metadata is aligned for 3.1.13.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.11"
+version = "3.1.13"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.11"
+version = "3.1.13"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.11"),
+        Some("--version") => println!("sks-rs 3.1.13"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.11';
+const FAST_PACKAGE_VERSION = '3.1.13';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -31,6 +31,11 @@ import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 import { runDoctorNativeCapabilityRepair } from '../core/doctor/doctor-native-capability-repair.js';
 import { runDoctorCommandAliasCleanup } from '../core/doctor/command-alias-cleanup.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 export async function run(_command, args = []) {
     const root = await projectRoot();
@@ -240,6 +245,150 @@ async function runDoctor(args = [], root, doctorFix) {
         warnings: [],
         report_path: `${root}/.sneakoscope/reports/doctor-context7-repair.json`
     }));
+    const startupConfigRepair = doctorFix
+        ? await repairCodexStartupConfig({ root, apply: true }).catch((err) => ({
+            schema: 'sks.codex-startup-config-repair.v1',
+            ok: false,
+            apply: true,
+            blockers: [err?.message || String(err)]
+        }))
+        : null;
+    const context7McpRepair = doctorFix
+        ? await repairContext7Mcp({ root, apply: true }).catch((err) => ({
+            schema: 'sks.doctor-context7-mcp-repair.v1',
+            ok: false,
+            apply: true,
+            repaired: false,
+            manual_required: false,
+            blockers: [err?.message || String(err)],
+            warnings: []
+        }))
+        : null;
+    const supabaseMcpRepair = doctorFix
+        ? await repairSupabaseMcp({ root, apply: true }).catch((err) => ({
+            schema: 'sks.doctor-supabase-mcp-repair.v1',
+            ok: false,
+            apply: true,
+            configured: false,
+            disabled: false,
+            disabled_preserved: false,
+            token_env_present: false,
+            unsafe_write_access: false,
+            read_only_migrated: false,
+            write_scope_requires_confirmation: false,
+            ready_blocking: true,
+            manual_required: true,
+            next_action: 'Review Supabase MCP configuration manually.',
+            blockers: [err?.message || String(err)],
+            warnings: [],
+            raw_secret_values_recorded: false
+        }))
+        : null;
+    const doctorFixTransaction = doctorFix
+        ? await runDoctorFixTransaction({
+            root,
+            phases: [
+                {
+                    id: 'setup',
+                    run: async () => ({
+                        id: 'setup',
+                        ok: setupRepair !== null,
+                        repaired: setupRepair !== null,
+                        blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                    })
+                },
+                {
+                    id: 'codex_startup_repair',
+                    run: async () => ({
+                        id: 'codex_startup_repair',
+                        ok: codexStartupRepair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: codexStartupRepair?.blockers || [],
+                        warnings: codexStartupRepair?.warnings || []
+                    })
+                },
+                {
+                    id: 'startup_config_repair',
+                    run: async () => ({
+                        id: 'startup_config_repair',
+                        ok: startupConfigRepair?.ok === true,
+                        repaired: startupConfigRepair?.apply === true,
+                        blockers: startupConfigRepair?.blockers || []
+                    })
+                },
+                {
+                    id: 'context7_repair',
+                    run: async () => ({
+                        id: 'context7_repair',
+                        ok: context7Repair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: context7Repair?.blockers || [],
+                        warnings: context7Repair?.warnings || []
+                    })
+                },
+                {
+                    id: 'context7_mcp_repair',
+                    run: async () => ({
+                        id: 'context7_mcp_repair',
+                        ok: context7McpRepair?.ok === true,
+                        repaired: context7McpRepair?.repaired === true,
+                        manual_required: context7McpRepair?.manual_required === true,
+                        blockers: context7McpRepair?.blockers || [],
+                        warnings: context7McpRepair?.warnings || []
+                    })
+                },
+                {
+                    id: 'supabase_mcp_repair',
+                    required_for_ready: false,
+                    run: async () => ({
+                        id: 'supabase_mcp_repair',
+                        ok: supabaseMcpRepair?.ok === true,
+                        repaired: false,
+                        manual_required: supabaseMcpRepair?.manual_required === true,
+                        required_for_ready: false,
+                        blockers: supabaseMcpRepair?.blockers || [],
+                        warnings: supabaseMcpRepair?.warnings || []
+                    })
+                },
+                {
+                    id: 'command_alias_cleanup',
+                    run: async () => ({
+                        id: 'command_alias_cleanup',
+                        ok: commandAliasCleanup?.ok !== false,
+                        repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
+                        blockers: commandAliasCleanup?.blockers || []
+                    })
+                },
+                {
+                    id: 'native_capability_repair',
+                    run: async () => ({
+                        id: 'native_capability_repair',
+                        ok: doctorNativeCapabilityRepair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: doctorNativeCapabilityRepair?.blockers || []
+                    })
+                }
+            ]
+        }).catch((err) => ({
+            schema: 'sks.doctor-fix-transaction.v1',
+            ok: false,
+            postcheck_ok: false,
+            phases: [
+                {
+                    id: 'doctor_fix_transaction',
+                    ok: false,
+                    repaired: false,
+                    manual_required: false,
+                    blockers: [err?.message || String(err)],
+                    warnings: [],
+                    artifact_path: null
+                }
+            ],
+            rollback_performed: false,
+            raw_secret_values_recorded: false
+        }))
+        : null;
+    const doctorFixPostcheck = doctorFix ? doctorRepairPostcheck(doctorFixTransaction) : null;
     const zellij = await checkZellijCapability({ root, require: process.env.SKS_REQUIRE_ZELLIJ === '1' });
     const localModel = await readLocalModelConfig().catch(() => null);
     const permissionProfiles = await inventoryCodexPermissionProfiles(root, { writeReport: true });
@@ -321,6 +470,11 @@ async function runDoctor(args = [], root, doctorFix) {
         zellij,
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
+        startup_config_repair: startupConfigRepair,
+        context7_mcp_repair: context7McpRepair,
+        supabase_mcp_repair: supabaseMcpRepair,
+        doctor_fix_transaction: doctorFixTransaction,
+        doctor_fix_postcheck: doctorFixPostcheck,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         repair: configRepair,
@@ -342,7 +496,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
         schema: 'sks.doctor-status.v1',
-        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false,
+        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false && (!doctorFixPostcheck || doctorFixPostcheck.ok !== false),
         root,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
@@ -358,6 +512,11 @@ async function runDoctor(args = [], root, doctorFix) {
         zellij_repair: zellijRepair,
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
+        startup_config_repair: startupConfigRepair,
+        context7_mcp_repair: context7McpRepair,
+        supabase_mcp_repair: supabaseMcpRepair,
+        doctor_fix_transaction: doctorFixTransaction,
+        doctor_fix_postcheck: doctorFixPostcheck,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         zellij_readiness: zellijReadiness,
@@ -381,7 +540,7 @@ async function runDoctor(args = [], root, doctorFix) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, doctor_transaction: doctorFixTransaction, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
     };
     if (flag(args, '--json')) {
         printJson(result);

package/dist/core/agents/agent-role-config.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const AGENT_ROLE_CONFIG_REPAIR_SCHEMA = 'sks.agent-role-config-repair.v1';
-const SKS_OWNED_AGENT_CONFIGS = new Map([
+export const SKS_OWNED_AGENT_CONFIGS = new Map([
     ['analysis-scout.toml', roleConfig('analysis_scout', 'Read-only SKS analysis scout retained for stale Codex agent-role config repair.', 'read-only')],
     ['native-agent-intake.toml', roleConfig('native_agent', 'Read-only Team native agent for repository/docs/tests/API/risk slices.', 'read-only')],
     ['team-consensus.toml', roleConfig('team_consensus', 'Planning and debate specialist for SKS Team mode.', 'read-only')],
@@ -11,6 +11,17 @@ const SKS_OWNED_AGENT_CONFIGS = new Map([
     ['db-safety-reviewer.toml', roleConfig('db_safety_reviewer', 'Read-only database safety reviewer for SQL, migrations, Supabase, and rollback safety.', 'read-only')],
     ['qa-reviewer.toml', roleConfig('qa_reviewer', 'Strict read-only verification reviewer for correctness, regressions, and final evidence.', 'read-only')]
 ]);
+export function managedAgentRoleConfigForFile(file) {
+    return SKS_OWNED_AGENT_CONFIGS.get(path.basename(file))?.content || null;
+}
+export function managedAgentRoleConfigForRole(role) {
+    const normalized = String(role || '').trim().replace(/-/g, '_');
+    for (const [file, config] of SKS_OWNED_AGENT_CONFIGS) {
+        if (config.name === normalized || path.basename(file, '.toml').replace(/-/g, '_') === normalized)
+            return { file, content: config.content };
+    }
+    return null;
+}
 export async function repairAgentRoleConfigs(input) {
     const root = path.resolve(input.root);
     const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || '', '.codex');

package/dist/core/codex/agent-config-file-repair.js

@@ -0,0 +1,157 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { managedAgentRoleConfigForFile, managedAgentRoleConfigForRole } from '../agents/agent-role-config.js';
+export async function repairAgentConfigFileReferences(input) {
+    const root = path.resolve(input.root);
+    const configPath = path.join(root, '.codex', 'config.toml');
+    const original = await fs.readFile(configPath, 'utf8').catch(() => '');
+    const createdFiles = [];
+    const repairedPaths = [];
+    const removedUnsupportedFields = [];
+    const skippedUnmanagedPaths = [];
+    const edits = [];
+    let text = original;
+    for (const block of tomlBlocks(original)) {
+        const managed = managedBlockTarget(root, block);
+        const currentConfigFile = stringValue(block.text, 'config_file');
+        if (!managed) {
+            if (currentConfigFile && !path.isAbsolute(currentConfigFile))
+                skippedUnmanagedPaths.push(currentConfigFile);
+            continue;
+        }
+        const target = path.join(root, '.codex', 'agents', managed.file);
+        let replacement = removeKey(block.text, 'message_role_prefix', removedUnsupportedFields);
+        replacement = replaceOrInsertKey(replacement, 'config_file', `"${escapeToml(target)}"`);
+        if (replacement !== block.text) {
+            edits.push({ start: block.start, end: block.end, replacement });
+            repairedPaths.push(target);
+        }
+        if (input.apply) {
+            const exists = await fs.stat(target).then((stat) => stat.isFile()).catch(() => false);
+            if (!exists) {
+                await ensureDir(path.dirname(target));
+                await writeTextAtomic(target, managed.content);
+                createdFiles.push(target);
+            }
+        }
+    }
+    if (edits.length)
+        text = applyEdits(original, edits);
+    if (input.apply && text !== original) {
+        await writeTextAtomic(configPath, text.replace(/\n{3,}/g, '\n\n').replace(/\s*$/, '\n'));
+    }
+    const effectiveText = input.apply ? await fs.readFile(configPath, 'utf8').catch(() => text) : text;
+    const missing = await missingAgentConfigFiles(effectiveText);
+    const unsupportedManagedFields = managedAgentBlocks(effectiveText)
+        .flatMap((block) => block.text.split(/\r?\n/).filter((line) => /^\s*message_role_prefix\s*=/.test(line)));
+    const report = {
+        schema: 'sks.agent-config-file-repair.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0 && !/^\s*message_role_prefix\s*=/m.test(text),
+        apply: input.apply === true,
+        config_path: configPath,
+        repaired_paths: repairedPaths,
+        created_files: createdFiles,
+        removed_unsupported_fields: removedUnsupportedFields,
+        skipped_unmanaged_paths: skippedUnmanagedPaths,
+        manual_required: skippedUnmanagedPaths.length > 0,
+        blockers: [
+            ...missing.map((file) => `missing_agent_config_file:${file}`),
+            ...unsupportedManagedFields.map(() => 'unsupported_message_role_prefix_field')
+        ]
+    };
+    report.ok = report.blockers.length === 0;
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'agent-config-file-repair.json'), report).catch(() => undefined);
+    return report;
+}
+export async function missingAgentConfigFiles(text) {
+    const rows = managedAgentBlocks(text)
+        .map((block) => stringValue(block.text, 'config_file'))
+        .filter((file) => Boolean(file));
+    const missing = [];
+    for (const file of rows) {
+        if (!path.isAbsolute(file)) {
+            missing.push(file);
+            continue;
+        }
+        const ok = await fs.stat(file).then((stat) => stat.isFile()).catch(() => false);
+        if (!ok)
+            missing.push(file);
+    }
+    return missing;
+}
+function tomlBlocks(text) {
+    const source = String(text || '');
+    const matches = [...source.matchAll(/(^|\n)\s*\[([^\]]+)\]\s*(?:#.*)?(?:\n|$)/g)];
+    return matches.map((match, index) => {
+        const start = Number(match.index || 0) + (match[1] ? 1 : 0);
+        const next = matches[index + 1];
+        const end = next ? Number(next.index || 0) + (next[1] ? 1 : 0) : source.length;
+        return {
+            header: String(match[2] || '').trim(),
+            start,
+            end,
+            text: source.slice(start, end)
+        };
+    });
+}
+function managedAgentBlocks(text) {
+    return tomlBlocks(text).filter((block) => Boolean(managedBlockTarget(process.cwd(), block)));
+}
+function managedBlockTarget(root, block) {
+    if (!block.header.startsWith('agents.'))
+        return null;
+    const role = block.header.slice('agents.'.length);
+    const byRole = managedAgentRoleConfigForRole(role);
+    if (byRole)
+        return byRole;
+    const configFile = stringValue(block.text, 'config_file');
+    if (configFile) {
+        const content = managedAgentRoleConfigForFile(configFile);
+        if (content)
+            return { file: path.basename(configFile), content };
+    }
+    if (/SKS managed|sks_/i.test(block.text)) {
+        const fallback = managedAgentRoleConfigForRole(role);
+        if (fallback)
+            return fallback;
+    }
+    void root;
+    return null;
+}
+function stringValue(text, key) {
+    const match = text.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"`, 'm'));
+    return match && typeof match[1] === 'string' ? match[1] : null;
+}
+function removeKey(text, key, removed) {
+    return text.split(/\r?\n/).filter((line) => {
+        const match = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(line);
+        if (match)
+            removed.push(line.trim());
+        return !match;
+    }).join('\n');
+}
+function replaceOrInsertKey(text, key, encodedValue) {
+    const lines = text.replace(/\s*$/, '').split('\n');
+    const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    const index = lines.findIndex((line) => re.test(line));
+    if (index >= 0)
+        lines[index] = `${key} = ${encodedValue}`;
+    else
+        lines.push(`${key} = ${encodedValue}`);
+    return `${lines.join('\n')}\n`;
+}
+function applyEdits(text, edits) {
+    return [...edits]
+        .sort((a, b) => b.start - a.start)
+        .reduce((current, edit) => `${current.slice(0, edit.start)}${edit.replacement}${current.slice(edit.end)}`, text);
+}
+function escapeToml(value) {
+    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=agent-config-file-repair.js.map

package/dist/core/codex/codex-startup-config-postcheck.js

@@ -0,0 +1,83 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { missingAgentConfigFiles } from './agent-config-file-repair.js';
+import { managedAgentRoleConfigForFile, managedAgentRoleConfigForRole } from '../agents/agent-role-config.js';
+export async function postcheckCodexStartupConfig(input) {
+    const root = path.resolve(input.root);
+    const configPath = path.join(root, '.codex', 'config.toml');
+    const text = await fs.readFile(configPath, 'utf8').catch(() => '');
+    const missing = await missingAgentConfigFiles(text);
+    const managedBlocks = managedAgentBlocks(text);
+    const unsupportedRoleFields = managedBlocks.some((block) => /^\s*message_role_prefix\s*=/m.test(block.text));
+    const relativePaths = managedBlocks
+        .map((block) => block.text.match(/^\s*config_file\s*=\s*"([^"]+)"/m)?.[1])
+        .filter((file) => Boolean(file && !path.isAbsolute(file)));
+    const tomlSmoke = tomlSyntaxSmoke(text);
+    const orphanChildTables = orphanMcpChildTables(text);
+    const report = {
+        schema: 'sks.codex-startup-config-postcheck.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0 && relativePaths.length === 0 && !unsupportedRoleFields && tomlSmoke.ok && orphanChildTables.length === 0,
+        config_path: configPath,
+        missing_config_files: missing,
+        relative_config_files: relativePaths,
+        unsupported_managed_role_fields: unsupportedRoleFields,
+        toml_syntax_smoke_ok: tomlSmoke.ok,
+        orphan_mcp_child_tables: orphanChildTables,
+        blockers: [
+            ...missing.map((file) => `missing_agent_config_file:${file}`),
+            ...relativePaths.map((file) => `relative_agent_config_file:${file}`),
+            ...(unsupportedRoleFields ? ['unsupported_message_role_prefix_field'] : []),
+            ...tomlSmoke.blockers,
+            ...orphanChildTables.map((table) => `orphan_mcp_child_table:${table}`)
+        ]
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json'), report).catch(() => undefined);
+    return report;
+}
+function managedAgentBlocks(text) {
+    const blocks = tomlBlocks(text);
+    return blocks.filter((block) => {
+        if (!block.header.startsWith('agents.'))
+            return false;
+        const role = block.header.slice('agents.'.length);
+        if (managedAgentRoleConfigForRole(role))
+            return true;
+        const configFile = block.text.match(/^\s*config_file\s*=\s*"([^"]+)"/m)?.[1] || '';
+        return Boolean(configFile && managedAgentRoleConfigForFile(configFile));
+    });
+}
+function tomlBlocks(text) {
+    const source = String(text || '');
+    const matches = [...source.matchAll(/(^|\n)\s*\[([^\]]+)\]\s*(?:#.*)?(?:\n|$)/g)];
+    return matches.map((match, index) => {
+        const start = Number(match.index || 0) + (match[1] ? 1 : 0);
+        const next = matches[index + 1];
+        const end = next ? Number(next.index || 0) + (next[1] ? 1 : 0) : source.length;
+        return { header: String(match[2] || '').trim(), text: source.slice(start, end) };
+    });
+}
+function tomlSyntaxSmoke(text) {
+    const blockers = [];
+    for (const [index, line] of String(text || '').split(/\r?\n/).entries()) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('['))
+            continue;
+        if (!/^\[[^\]]+\]\s*(?:#.*)?$/.test(trimmed))
+            blockers.push(`toml_table_header_invalid:${index + 1}`);
+    }
+    const tripleQuotes = (String(text || '').match(/"""/g) || []).length;
+    if (tripleQuotes % 2 !== 0)
+        blockers.push('toml_multiline_string_unbalanced');
+    return { ok: blockers.length === 0, blockers };
+}
+function orphanMcpChildTables(text) {
+    const headers = new Set(tomlBlocks(text).map((block) => block.header));
+    return [...headers].filter((header) => {
+        const match = header.match(/^mcp_servers\.([^.]+)\./);
+        return Boolean(match && !headers.has(`mcp_servers.${match[1]}`));
+    });
+}
+//# sourceMappingURL=codex-startup-config-postcheck.js.map