sneakoscope 3.1.11 → 3.1.13

package/dist/core/config/secret-preservation.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { ensureDir, nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
 import { PROTECTED_SECRET_KEYS, PROTECTED_SUPABASE_ENV_KEYS } from './supabase-secret-preservation.js';
-const activeGuardRoots = new Set();
+const activeGuardRoots = new Map();
 export async function captureSecretPreservationSnapshot(input) {
     const root = path.resolve(input.root);
     const sources = secretSources(root);
@@ -32,9 +32,13 @@ export async function captureSecretPreservationSnapshot(input) {
 }
 export async function withSecretPreservationGuard(root, operationName, fn) {
     const resolvedRoot = path.resolve(root);
-    if (activeGuardRoots.has(resolvedRoot))
+    const active = activeGuardRoots.get(resolvedRoot);
+    if (active) {
+        active.nestedOperations.push(operationName);
         return fn();
-    activeGuardRoots.add(resolvedRoot);
+    }
+    const guardContext = { nestedOperations: [] };
+    activeGuardRoots.set(resolvedRoot, guardContext);
     const reportDir = path.join(resolvedRoot, '.sneakoscope', 'reports');
     await ensureDir(reportDir);
     const beforePath = path.join(reportDir, 'secret-preservation-before.json');
@@ -56,9 +60,13 @@ export async function withSecretPreservationGuard(root, operationName, fn) {
         let rollbackAttempted = false;
         let rollbackOk = false;
         let restoredKeysCount = 0;
+        let restoreMode = 'none';
+        let unrelatedChangesPreserved = true;
         if (changedOrMissing.length) {
             rollbackAttempted = true;
-            await restoreChangedSecretSources(changedOrMissing, backup.bySource);
+            const restore = await restoreChangedSecretSources(changedOrMissing, backup.bySource);
+            restoreMode = restore.mode;
+            unrelatedChangesPreserved = restore.unrelated_changes_preserved;
             const restored = await captureSecretPreservationSnapshot({
                 root: resolvedRoot,
                 artifactPath: path.join(reportDir, 'secret-preservation-after-restore.json')
@@ -67,12 +75,12 @@ export async function withSecretPreservationGuard(root, operationName, fn) {
             rollbackOk = remaining.length === 0;
             restoredKeysCount = rollbackOk ? changedOrMissing.length : 0;
             if (!rollbackOk) {
-                const failedReport = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, false, backup.paths);
+                const failedReport = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, false, backup.paths, 'failed', false, guardContext.nestedOperations);
                 await writeJsonAtomic(guardPath, operationError ? { ...failedReport, ok: false, operation_error: sanitizeErrorMessage(operationError) } : failedReport).catch(() => undefined);
                 throw new Error(`secret_preservation_rollback_failed:${changedOrMissing.map((item) => `${safeSourceForError(resolvedRoot, item.source)}:${item.key}:${item.reason}`).join(',')}`);
             }
         }
-        const report = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackAttempted ? rollbackOk : true, backup.paths);
+        const report = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackAttempted ? rollbackOk : true, backup.paths, restoreMode, unrelatedChangesPreserved, guardContext.nestedOperations);
         if (operationError) {
             report.ok = false;
             report.operation_error = sanitizeErrorMessage(operationError);
@@ -80,7 +88,7 @@ export async function withSecretPreservationGuard(root, operationName, fn) {
         await writeJsonAtomic(guardPath, report).catch(() => undefined);
         if (operationError)
             throw operationError;
-        if (operationName === 'doctor-fix' && rollbackAttempted) {
+        if (rollbackAttempted) {
             throw new Error(`secret_preservation_restored:${changedOrMissing.map((item) => `${safeSourceForError(resolvedRoot, item.source)}:${item.key}:${item.reason}`).join(',')}`);
         }
         return result;
@@ -214,7 +222,7 @@ function dedupeFingerprints(fingerprints) {
         byKey.set(`${fp.source}\0${fp.key}`, fp);
     return [...byKey.values()].sort((a, b) => a.source.localeCompare(b.source) || a.key.localeCompare(b.key));
 }
-function guardReport(operation, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackOk, backupPaths) {
+function guardReport(operation, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackOk, backupPaths, restoreMode, unrelatedChangesPreserved, nestedOperations) {
     return {
         schema: 'sks.secret-preservation-guard.v1',
         generated_at: nowIso(),
@@ -227,6 +235,9 @@ function guardReport(operation, beforePath, afterPath, changedOrMissing, restore
         missing_after: changedOrMissing.filter((item) => item.reason === 'missing').map((item) => ({ key: item.key, source: item.source })),
         rollback_attempted: rollbackAttempted,
         rollback_ok: rollbackOk,
+        restore_mode: restoreMode,
+        unrelated_changes_preserved: unrelatedChangesPreserved,
+        nested_operations: nestedOperations,
         backup_paths: backupPaths,
         raw_values_recorded: false
     };
@@ -246,13 +257,96 @@ async function backupSecretBearingSources(root, operationName, snapshot) {
     return { bySource, paths: [...bySource.values()] };
 }
 async function restoreChangedSecretSources(changedOrMissing, backups) {
+    let wholeFileFallback = false;
     for (const source of [...new Set(changedOrMissing.map((item) => item.source))]) {
         const backup = backups.get(source);
-        if (!backup)
+        if (!backup) {
+            wholeFileFallback = true;
             continue;
-        await ensureDir(path.dirname(source));
-        await fs.copyFile(backup, source);
+        }
+        const sourceChanges = changedOrMissing.filter((item) => item.source === source);
+        const restoredLineLevel = await restoreSecretLines(source, backup, sourceChanges);
+        if (!restoredLineLevel) {
+            wholeFileFallback = true;
+            await ensureDir(path.dirname(source));
+            await fs.copyFile(backup, source);
+        }
+    }
+    return { mode: wholeFileFallback ? 'whole-file' : 'line-level', unrelated_changes_preserved: !wholeFileFallback };
+}
+async function restoreSecretLines(source, backup, changes) {
+    if (source.endsWith('.json'))
+        return false;
+    const current = await fs.readFile(source, 'utf8').catch(() => null);
+    const before = await fs.readFile(backup, 'utf8').catch(() => null);
+    if (current == null || before == null)
+        return false;
+    let lines = current.split(/\r?\n/);
+    const beforeLines = before.split(/\r?\n/);
+    let changed = false;
+    for (const item of changes) {
+        const beforeLine = findAssignmentLine(beforeLines, item.key);
+        if (!beforeLine)
+            return false;
+        const currentLine = findAssignmentLine(lines, item.key);
+        if (currentLine) {
+            lines[currentLine.index] = beforeLine.line;
+        }
+        else {
+            const insertAt = insertionIndexForKey(lines, item.key);
+            lines.splice(insertAt, 0, beforeLine.line);
+        }
+        changed = true;
+    }
+    if (changed)
+        await fs.writeFile(source, lines.join('\n'), 'utf8');
+    return true;
+}
+function findAssignmentLine(lines, key) {
+    const sectionKey = sectionKeyFor(key);
+    if (sectionKey) {
+        const range = sectionRange(lines, sectionKey.section);
+        if (!range)
+            return null;
+        const re = new RegExp(`^\\s*${escapeRegExp(sectionKey.key)}\\s*=`);
+        for (let index = range.start + 1; index < range.end; index += 1) {
+            if (re.test(lines[index] || ''))
+                return { index, line: lines[index] || '' };
+        }
+        return null;
+    }
+    const re = new RegExp(`^\\s*(?:export\\s+)?${escapeRegExp(key)}\\s*=`);
+    const index = lines.findIndex((line) => re.test(line));
+    return index >= 0 ? { index, line: lines[index] || '' } : null;
+}
+function insertionIndexForKey(lines, key) {
+    const sectionKey = sectionKeyFor(key);
+    if (!sectionKey)
+        return Math.max(0, lines.length - (lines[lines.length - 1] === '' ? 1 : 0));
+    const range = sectionRange(lines, sectionKey.section);
+    return range ? range.end : Math.max(0, lines.length - (lines[lines.length - 1] === '' ? 1 : 0));
+}
+function sectionKeyFor(key) {
+    if (!key.includes('.'))
+        return null;
+    const parts = key.split('.');
+    const leaf = parts.pop();
+    const section = parts.join('.');
+    return leaf && section ? { section, key: leaf } : null;
+}
+function sectionRange(lines, section) {
+    const header = new RegExp(`^\\s*\\[${escapeRegExp(section)}\\]\\s*(?:#.*)?$`);
+    const start = lines.findIndex((line) => header.test(line));
+    if (start < 0)
+        return null;
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[[^\]]+\]\s*(?:#.*)?$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
     }
+    return { start, end };
 }
 function sanitizeSegment(value) {
     return String(value || 'operation').replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'operation';
@@ -274,4 +368,7 @@ function sanitizeErrorMessage(err) {
     const message = err instanceof Error ? err.message : String(err);
     return message.replace(/([A-Za-z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD)[A-Za-z0-9_]*=)[^\s,;]+/gi, '$1<redacted>');
 }
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 //# sourceMappingURL=secret-preservation.js.map

package/dist/core/config/supabase-secret-preservation.js

@@ -1,5 +1,6 @@
 export const PROTECTED_SUPABASE_ENV_KEYS = [
     'SUPABASE_URL',
+    'SUPABASE_ACCESS_TOKEN',
     'SUPABASE_ANON_KEY',
     'SUPABASE_SERVICE_ROLE_KEY',
     'NEXT_PUBLIC_SUPABASE_URL',

package/dist/core/doctor/codex-startup-config-repair.js

@@ -0,0 +1,40 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { repairAgentRoleConfigs } from '../agents/agent-role-config.js';
+import { repairAgentConfigFileReferences } from '../codex/agent-config-file-repair.js';
+import { postcheckCodexStartupConfig } from '../codex/codex-startup-config-postcheck.js';
+export async function repairCodexStartupConfig(input) {
+    const root = path.resolve(input.root);
+    const roleRepair = await repairAgentRoleConfigs({
+        root,
+        apply: input.apply === true,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json')
+    });
+    const fileRepair = await repairAgentConfigFileReferences({
+        root,
+        apply: input.apply === true,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-config-file-repair.json')
+    });
+    const postcheck = await postcheckCodexStartupConfig({
+        root,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json')
+    });
+    const report = {
+        schema: 'sks.codex-startup-config-repair.v1',
+        generated_at: nowIso(),
+        ok: roleRepair.ok && fileRepair.ok && postcheck.ok,
+        apply: input.apply === true,
+        role_repair: roleRepair,
+        config_file_repair: fileRepair,
+        postcheck,
+        blockers: [
+            ...(roleRepair.blockers || []),
+            ...fileRepair.blockers,
+            ...postcheck.blockers
+        ]
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-repair.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=codex-startup-config-repair.js.map

package/dist/core/doctor/context7-mcp-repair.js

@@ -0,0 +1,77 @@
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { CONTEXT7_REMOTE_MCP_URL, mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig, replaceOrAppendMcpServerBlock } from '../mcp/mcp-config-preservation.js';
+import { guardedWriteFile, guardContextForRoute } from '../safety/mutation-guard.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+export async function repairContext7Mcp(input) {
+    const root = path.resolve(input.root);
+    const config = await readProjectCodexConfig(root);
+    const beforeTransport = classifyContext7Transport(config.text);
+    const disabledPreserved = beforeTransport === 'disabled';
+    let afterText = config.text;
+    let repaired = false;
+    if (beforeTransport === 'stdio') {
+        afterText = replaceOrAppendMcpServerBlock(config.text, 'context7', [
+            '[mcp_servers.context7]',
+            `url = "${CONTEXT7_REMOTE_MCP_URL}"`,
+            ''
+        ].join('\n'));
+        repaired = afterText !== config.text;
+    }
+    if (input.apply && repaired) {
+        await ensureDir(path.dirname(config.path));
+        const backupPath = `${config.path}.context7-mcp-repair-${Date.now().toString(36)}.bak`;
+        const contract = createRequestedScopeContract({
+            route: '$Team',
+            userRequest: 'Write a scoped project backup before doctor Context7 MCP repair.',
+            projectRoot: root
+        });
+        await guardedWriteFile(guardContextForRoute(root, contract, 'doctor Context7 MCP repair backup'), backupPath, config.text).catch(() => undefined);
+        await writeTextAtomic(config.path, afterText);
+    }
+    const after = input.apply && repaired ? await readProjectCodexConfig(root) : { text: afterText };
+    const afterTransport = classifyContext7Transport(after.text);
+    const remoteProbeStatus = afterTransport === 'remote' && process.env.SKS_CONTEXT7_REMOTE_PROBE === '1'
+        ? await probeRemoteContext7()
+        : 'skipped';
+    const report = {
+        schema: 'sks.doctor-context7-mcp-repair.v1',
+        generated_at: nowIso(),
+        ok: afterTransport === 'remote' || afterTransport === 'disabled' || beforeTransport === 'missing',
+        apply: input.apply === true,
+        config_path: config.path,
+        before_transport: beforeTransport,
+        after_transport: afterTransport,
+        disabled_preserved: disabledPreserved && afterTransport === 'disabled',
+        remote_probe_status: remoteProbeStatus,
+        repaired: input.apply === true && repaired,
+        manual_required: false,
+        blockers: afterTransport === 'stdio' ? ['context7_mcp_still_stdio'] : [],
+        warnings: beforeTransport === 'missing' ? ['context7_mcp_not_configured'] : []
+    };
+    if (input.reportPath !== null)
+        await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-context7-mcp-repair.json'), report).catch(() => undefined);
+    return report;
+}
+async function probeRemoteContext7() {
+    try {
+        const response = await fetch(CONTEXT7_REMOTE_MCP_URL, { method: 'HEAD' });
+        return response.status < 500 ? 'ok' : 'failed';
+    }
+    catch {
+        return 'failed';
+    }
+}
+export function classifyContext7Transport(text) {
+    if (mcpServerExplicitlyDisabled(text, 'context7'))
+        return 'disabled';
+    const block = mcpServerBlock(text, 'context7');
+    if (!block)
+        return 'missing';
+    if (/^\s*url\s*=/m.test(block))
+        return 'remote';
+    if (/^\s*command\s*=|stdio|npx|context7/i.test(block))
+        return 'stdio';
+    return 'unknown';
+}
+//# sourceMappingURL=context7-mcp-repair.js.map

package/dist/core/doctor/doctor-codex-startup-repair.js

@@ -32,7 +32,7 @@ export async function runDoctorCodexStartupRepair(input) {
         { scope: 'project', path: path.join(root, '.codex', 'config.toml'), agentDir: path.join(root, '.codex', 'agents') },
         { scope: 'global', path: path.join(codexHome, 'config.toml'), agentDir: path.join(codexHome, 'agents') }
     ]) {
-        configs.push(await inspectOrRepairConfig(candidate, input.fix));
+        configs.push(await inspectOrRepairConfig(candidate, input.fix, input.nodeReplCommandCandidates || [], input.includeDefaultNodeReplCandidates !== false));
     }
     const blockers = [...roleFiles.blockers, ...configs.flatMap((entry) => entry.blockers.map((item) => `${entry.scope}:${item}`))];
     const warnings = configs.flatMap((entry) => entry.warnings.map((item) => `${entry.scope}:${item}`));
@@ -41,6 +41,7 @@ export async function runDoctorCodexStartupRepair(input) {
         ...roleFiles.created.map((file) => `created missing SKS agent role config ${file}`),
         ...configs.flatMap((entry) => [
             ...entry.agent_config_files_repaired.map((file) => `${entry.scope} agent config_file now points at ${file}`),
+            ...(entry.mcp_blocks_repaired || []).map((server) => `${entry.scope} MCP block repaired: ${server}`),
             ...entry.stale_mcp_blocks_removed.map((server) => `${entry.scope} stale MCP block removed: ${server}`)
         ])
     ];
@@ -69,7 +70,7 @@ export async function runDoctorCodexStartupRepair(input) {
     await writeJsonAtomic(reportPath, report);
     return report;
 }
-async function inspectOrRepairConfig(candidate, fix) {
+async function inspectOrRepairConfig(candidate, fix, nodeReplCommandCandidates, includeDefaultNodeReplCandidates) {
     const text = await readText(candidate.path, null);
     if (text == null) {
         return {
@@ -80,6 +81,7 @@ async function inspectOrRepairConfig(candidate, fix) {
             backup_path: null,
             agent_config_files_repaired: [],
             stale_mcp_blocks_removed: [],
+            mcp_blocks_repaired: [],
             optional_mcp_blocks_ignored: [],
             blockers: [],
             warnings: candidate.scope === 'global' ? ['codex_home_config_missing_optional'] : []
@@ -88,6 +90,7 @@ async function inspectOrRepairConfig(candidate, fix) {
     let next = text;
     const agentConfigFilesRepaired = [];
     const staleMcpBlocksRemoved = [];
+    const mcpBlocksRepaired = [];
     const optionalMcpBlocksIgnored = [];
     const blockers = [];
     const warnings = [];
@@ -111,19 +114,11 @@ async function inspectOrRepairConfig(candidate, fix) {
         next = replaceOrInsertKey(next, table, 'config_file', `"${escapeToml(target)}"`);
         agentConfigFilesRepaired.push(target);
     }
-    for (const server of ['node_repl']) {
-        const table = tomlBlock(next, `mcp_servers.${server}`);
-        if (!table)
-            continue;
-        const command = stringValue(table.text, 'command');
-        if (!command || await commandExists(command))
-            continue;
-        warnings.push(`stale_mcp_command_missing:${server}`);
-        if (fix) {
-            next = removeTomlBlock(next, table);
-            staleMcpBlocksRemoved.push(server);
-        }
-    }
+    const nodeReplRepair = await inspectOrRepairNodeRepl(next, fix, nodeReplCommandCandidates, includeDefaultNodeReplCandidates);
+    next = nodeReplRepair.text;
+    warnings.push(...nodeReplRepair.warnings);
+    staleMcpBlocksRemoved.push(...nodeReplRepair.removed);
+    mcpBlocksRepaired.push(...nodeReplRepair.repaired);
     for (const server of ['supabase_sauron']) {
         if (tomlBlock(next, `mcp_servers.${server}`))
             optionalMcpBlocksIgnored.push(server);
@@ -147,11 +142,60 @@ async function inspectOrRepairConfig(candidate, fix) {
         backup_path: backupPath,
         agent_config_files_repaired: agentConfigFilesRepaired,
         stale_mcp_blocks_removed: staleMcpBlocksRemoved,
+        mcp_blocks_repaired: mcpBlocksRepaired,
         optional_mcp_blocks_ignored: optionalMcpBlocksIgnored,
         blockers,
         warnings
     };
 }
+async function inspectOrRepairNodeRepl(text, fix, extraCandidates, includeDefaultCandidates) {
+    const server = 'node_repl';
+    const table = tomlBlock(text, `mcp_servers.${server}`);
+    const fullTable = tomlBlockWithChildren(text, `mcp_servers.${server}`);
+    const childBlocks = tomlChildBlocks(text, `mcp_servers.${server}`);
+    if (!table && childBlocks.length === 0)
+        return { text, warnings: [], removed: [], repaired: [] };
+    const command = table ? stringValue(table.text, 'command') : null;
+    if (command && await commandExists(command)) {
+        return { text, warnings: [], removed: [], repaired: [] };
+    }
+    const warnings = [table ? `stale_mcp_command_missing:${server}` : `stale_mcp_orphan_children:${server}`];
+    if (!fix)
+        return { text, warnings, removed: [], repaired: [] };
+    const replacement = await firstExistingNodeReplCommand(text, extraCandidates, includeDefaultCandidates);
+    if (replacement) {
+        if (table) {
+            return {
+                text: replaceOrInsertKey(text, table, 'command', `"${escapeToml(replacement)}"`),
+                warnings,
+                removed: [],
+                repaired: [server]
+            };
+        }
+        if (childBlocks.length) {
+            const firstChild = childBlocks[0];
+            if (!firstChild)
+                return { text, warnings, removed: [], repaired: [] };
+            const mainBlock = `[mcp_servers.${server}]\ncommand = "${escapeToml(replacement)}"\nargs = []\n\n`;
+            return {
+                text: `${text.slice(0, firstChild.start).trimEnd()}${firstChild.start > 0 ? '\n\n' : ''}${mainBlock}${text.slice(firstChild.start).replace(/^\n+/, '')}`,
+                warnings,
+                removed: [],
+                repaired: [server]
+            };
+        }
+    }
+    const removalBlocks = [
+        ...(fullTable ? [fullTable] : table ? [table] : []),
+        ...childBlocks.filter((block) => !fullTable || block.start < fullTable.start || block.end > fullTable.end)
+    ];
+    return {
+        text: removeBlocks(text, removalBlocks),
+        warnings,
+        removed: [server],
+        repaired: []
+    };
+}
 async function inspectAgentRoleFiles(root, codexHome) {
     const dirs = [path.join(root, '.codex', 'agents'), path.join(codexHome, 'agents')];
     const sanitized = [];
@@ -206,9 +250,38 @@ function tomlBlock(text, table) {
     const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
     return { start, end, text: text.slice(start, end) };
 }
+function tomlBlockWithChildren(text, table) {
+    const header = new RegExp(`(^|\\n)\\s*\\[${escapeRegExp(table)}\\]\\s*(?:#.*)?(?:\\n|$)`, 'g');
+    const match = header.exec(text);
+    if (!match)
+        return null;
+    const start = match.index + (match[1] ? 1 : 0);
+    const rest = text.slice(header.lastIndex);
+    const nextHeader = rest.search(new RegExp(`\\n\\s*\\[(?!${escapeRegExp(table)}(?:\\.|\\]))[^\\]]+\\]\\s*(?:#.*)?(?:\\n|$)`));
+    const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
+    return { start, end, text: text.slice(start, end) };
+}
+function tomlChildBlocks(text, table) {
+    const blocks = [];
+    const header = new RegExp(`(^|\\n)\\s*\\[${escapeRegExp(table)}\\.[^\\]]+\\]\\s*(?:#.*)?(?:\\n|$)`, 'g');
+    let match;
+    while ((match = header.exec(text))) {
+        const start = match.index + (match[1] ? 1 : 0);
+        const rest = text.slice(header.lastIndex);
+        const nextHeader = rest.search(new RegExp(`\\n\\s*\\[(?!${escapeRegExp(table)}\\.)[^\\]]+\\]\\s*(?:#.*)?(?:\\n|$)`));
+        const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
+        blocks.push({ start, end, text: text.slice(start, end) });
+    }
+    return blocks;
+}
 function removeTomlBlock(text, block) {
     return `${text.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${text.slice(block.end).replace(/^\n+/, '')}`;
 }
+function removeBlocks(text, blocks) {
+    return [...blocks]
+        .sort((a, b) => b.start - a.start)
+        .reduce((current, block) => removeTomlBlock(current, block), text);
+}
 function replaceOrInsertKey(text, block, key, encodedValue) {
     const lines = block.text.replace(/\s*$/, '').split('\n');
     const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
@@ -233,6 +306,45 @@ async function commandExists(command) {
             return true;
     return false;
 }
+async function firstExistingNodeReplCommand(configText, extraCandidates, includeDefaultCandidates) {
+    const candidates = [
+        ...extraCandidates,
+        ...(includeDefaultCandidates ? [
+            process.env.SKS_NODE_REPL_COMMAND,
+            process.env.NODE_REPL_COMMAND,
+            ...nodeReplCandidatesFromNodePaths([
+                ...stringValues(configText, 'NODE_REPL_NODE_PATH'),
+                process.env.NODE_REPL_NODE_PATH
+            ]),
+            '/Applications/Codex.app/Contents/Resources/cua_node/bin/node_repl',
+            '/Applications/Codex.app/Contents/Resources/node_repl'
+        ] : [])
+    ]
+        .map((item) => String(item || '').trim())
+        .filter(Boolean);
+    for (const candidate of [...new Set(candidates)]) {
+        if (await commandExists(candidate))
+            return candidate;
+    }
+    return null;
+}
+function nodeReplCandidatesFromNodePaths(values) {
+    const out = [];
+    for (const value of values) {
+        const nodePath = String(value || '').trim();
+        if (!nodePath)
+            continue;
+        const dir = path.dirname(nodePath);
+        out.push(path.join(dir, 'node_repl'));
+        const resources = path.basename(dir) === 'bin' ? path.dirname(path.dirname(dir)) : dir;
+        out.push(path.join(resources, 'cua_node', 'bin', 'node_repl'));
+    }
+    return out;
+}
+function stringValues(text, key) {
+    const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"`, 'gm');
+    return [...text.matchAll(re)].map((match) => String(match[1] || '')).filter(Boolean);
+}
 async function backupConfig(configPath, text, label) {
     try {
         const backupPath = `${configPath}.sks-${label}-${Date.now().toString(36)}.bak`;

package/dist/core/doctor/doctor-context7-repair.js

@@ -49,6 +49,26 @@ async function inspectOrRepairContext7Config(candidate, fix) {
     if (!block)
         return baseConfig(candidate, { present: true, status: 'missing' });
     if (/\burl\s*=\s*["']https:\/\/mcp\.context7\.com\/mcp["']/.test(block.text)) {
+        const childBlocks = context7ChildBlocks(text);
+        if (childBlocks.length) {
+            if (!fix) {
+                return baseConfig(candidate, {
+                    present: true,
+                    status: 'remote_child_env_detected',
+                    warnings: ['remote_context7_child_env_unsupported_by_streamable_http']
+                });
+            }
+            const next = removeBlocks(text, childBlocks).replace(/\s*$/, '\n');
+            const backupPath = await backupConfig(candidate.path, text);
+            await writeTextAtomic(candidate.path, next);
+            return baseConfig(candidate, {
+                present: true,
+                status: 'repaired_to_remote',
+                changed: true,
+                backup_path: backupPath,
+                warnings: ['remote_context7_child_env_removed']
+            });
+        }
         return baseConfig(candidate, { present: true, status: 'already_remote' });
     }
     const localStdio = /@upstash\/context7-mcp|context7-mcp|command\s*=\s*["']npx(?:\s|["'])/i.test(block.text);
@@ -68,7 +88,8 @@ async function inspectOrRepairContext7Config(candidate, fix) {
         });
     }
     const remoteBlock = `[mcp_servers.context7]\nurl = "${CONTEXT7_REMOTE_URL}"\n`;
-    const next = `${text.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${remoteBlock}${text.slice(block.end).replace(/^\n+/, '\n')}`.replace(/\s*$/, '\n');
+    const withRemote = `${text.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${remoteBlock}${text.slice(block.end).replace(/^\n+/, '\n')}`.replace(/\s*$/, '\n');
+    const next = removeBlocks(withRemote, context7ChildBlocks(withRemote)).replace(/\s*$/, '\n');
     const backupPath = await backupConfig(candidate.path, text);
     await writeTextAtomic(candidate.path, next);
     return baseConfig(candidate, {
@@ -79,6 +100,24 @@ async function inspectOrRepairContext7Config(candidate, fix) {
         warnings: ['local_stdio_context7_replaced_with_remote_mcp']
     });
 }
+function context7ChildBlocks(text) {
+    const blocks = [];
+    const header = /(^|\n)\s*\[mcp_servers\.context7\.[^\]]+\]\s*(?:#.*)?(?:\n|$)/g;
+    let match;
+    while ((match = header.exec(text))) {
+        const start = match.index + (match[1] ? 1 : 0);
+        const rest = text.slice(header.lastIndex);
+        const nextHeader = rest.search(/\n\s*\[[^\]]+\]\s*(?:#.*)?(?:\n|$)/);
+        const end = nextHeader >= 0 ? header.lastIndex + nextHeader : text.length;
+        blocks.push({ start, end, text: text.slice(start, end) });
+    }
+    return blocks;
+}
+function removeBlocks(text, blocks) {
+    return [...blocks]
+        .sort((a, b) => b.start - a.start)
+        .reduce((current, block) => `${current.slice(0, block.start).trimEnd()}${block.start > 0 ? '\n\n' : ''}${current.slice(block.end).replace(/^\n+/, '')}`, text);
+}
 function context7Block(text) {
     const header = /(^|\n)\s*\[mcp_servers\.context7\]\s*(?:#.*)?(?:\n|$)/g;
     const match = header.exec(text);

package/dist/core/doctor/doctor-repair-postcheck.js

@@ -0,0 +1,17 @@
+import {} from './doctor-transaction.js';
+export function doctorRepairPostcheck(transaction) {
+    const phases = transaction?.phases || [];
+    const requiredBlockers = phases
+        .filter((phase) => phase.required_for_ready !== false && phase.ok !== true)
+        .flatMap((phase) => phase.blockers.length ? phase.blockers : [`required_phase_not_ready:${phase.id}`]);
+    return {
+        schema: 'sks.doctor-repair-postcheck.v1',
+        ok: transaction?.postcheck_ok === true && requiredBlockers.length === 0,
+        transaction_ok: transaction?.ok === true,
+        required_ready: requiredBlockers.length === 0,
+        manual_required: phases.filter((phase) => phase.manual_required).map((phase) => phase.id),
+        optional_manual_required: phases.filter((phase) => phase.manual_required && phase.required_for_ready === false).map((phase) => phase.id),
+        blockers: [...new Set([...requiredBlockers, ...phases.flatMap((phase) => phase.blockers)])]
+    };
+}
+//# sourceMappingURL=doctor-repair-postcheck.js.map