sneakoscope 3.1.12 → 3.1.13

package/README.md

@@ -35,18 +35,16 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.12** is a release-ready repair pass for `sks doctor --fix` production recovery, Codex 0.140 capability coverage, and MAD Zellij right-column stack reliability.
-
-What changed in 3.1.12:
-
-- **MAD Zellij panes are stack-reconciled.** Second and later visible workers still launch with native `new-pane --stacked`, then SKS calls Zellij `stack-panes` with the observed worker pane ids so the right column stays one stack instead of drifting into automatic split geometry.
-- **Codex 0.140 readiness is gated.** The release records hermetic coverage for usage metadata, goal attachment preservation, session delete/import, unified mentions, Bedrock managed auth, MCP reliability, SQLite recovery, non-TTY interrupt behavior, large-repo performance, and optional real-probe enforcement.
-- **Doctor production repair is transactional.** `sks doctor --fix` now writes a doctor fix transaction and postcheck report so startup config, Context7 MCP, Supabase MCP, command alias, and native capability repair results are visible in JSON output instead of disappearing into console-only repair steps.
-- **Context7 stdio lockups are doctor-repairable.** `sks doctor --fix` detects local `@upstash/context7-mcp` stdio config and migrates it to the remote Context7 MCP endpoint so Codex launches do not stall at the stdio server banner.
-- **Codex startup warnings are repaired more completely.** `sks doctor --fix` rewrites stale SKS agent `config_file` paths, removes unsupported managed `message_role_prefix` role fields, preserves optional `supabase_sauron`, and now repairs `node_repl` to a valid Codex App command when available or removes both the stale parent table and child env table when it is not.
-- **Doctor JSON exposes the Context7, startup, Supabase, and production postcheck reports.** `context7_repair`, `codex_startup_repair`, `startup_config_repair`, `context7_mcp_repair`, `supabase_mcp_repair`, `doctor_fix_transaction`, `doctor_fix_postcheck`, and their `repair.*` entries carry migration status, backups, actions, warnings, and any manual auth actions.
-- **Secret rollback is stricter.** The secret-preservation guard treats protected-value changes the same way as missing values, rolls back affected files from redacted backups, and records rollback status without writing raw secret values.
-- **Release metadata is aligned for 3.1.12.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
+SKS **3.1.13** is a production-hardening release for Codex 0.140 evidence, transactional `sks doctor --fix` repair, MCP readiness, native capability proof, and protected-secret rollback.
+
+What changed in 3.1.13:
+
+- **Codex 0.140 readiness carries evidence.** Capability reports now expose per-feature state and certainty, real usage parsing, goal attachment roundtrip proof, and usage-budget provenance for loop/Naruto runtime decisions.
+- **Doctor repair is phase-based.** `sks doctor --fix` records phase durations, postchecks, optional manual readiness, and rollback evidence instead of collapsing repair work into a summary writer.
+- **Startup and MCP repair are safer.** Managed agent TOML blocks are repaired without touching unrelated config, missing role files are regenerated from real managed templates, Context7 disabled servers stay disabled, and Supabase write scope is separated from read-only readiness.
+- **Secret rollback is line-level when possible.** Protected key changes are restored without discarding unrelated operator edits, nested guard operations are recorded, and backup artifacts remain ignored.
+- **Native capability proof is stricter.** Computer Use and Chrome/web review no longer become verified from environment variables outside explicit fixture/test modes.
+- **Release metadata is aligned for 3.1.13.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.12"
+version = "3.1.13"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.12"
+version = "3.1.13"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.12"),
+        Some("--version") => println!("sks-rs 3.1.13"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.12';
+const FAST_PACKAGE_VERSION = '3.1.13';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -34,7 +34,7 @@ import { runDoctorCommandAliasCleanup } from '../core/doctor/command-alias-clean
 import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
 import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
 import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
-import { writeDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
 import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 export async function run(_command, args = []) {
@@ -271,8 +271,12 @@ async function runDoctor(args = [], root, doctorFix) {
             apply: true,
             configured: false,
             disabled: false,
+            disabled_preserved: false,
             token_env_present: false,
             unsafe_write_access: false,
+            read_only_migrated: false,
+            write_scope_requires_confirmation: false,
+            ready_blocking: true,
             manual_required: true,
             next_action: 'Review Supabase MCP configuration manually.',
             blockers: [err?.message || String(err)],
@@ -281,62 +285,88 @@ async function runDoctor(args = [], root, doctorFix) {
         }))
         : null;
     const doctorFixTransaction = doctorFix
-        ? await writeDoctorFixTransaction({
+        ? await runDoctorFixTransaction({
             root,
             phases: [
                 {
                     id: 'setup',
-                    ok: setupRepair !== null,
-                    repaired: setupRepair !== null,
-                    blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                    run: async () => ({
+                        id: 'setup',
+                        ok: setupRepair !== null,
+                        repaired: setupRepair !== null,
+                        blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                    })
                 },
                 {
                     id: 'codex_startup_repair',
-                    ok: codexStartupRepair?.ok !== false,
-                    repaired: doctorFix,
-                    blockers: codexStartupRepair?.blockers || [],
-                    warnings: codexStartupRepair?.warnings || []
+                    run: async () => ({
+                        id: 'codex_startup_repair',
+                        ok: codexStartupRepair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: codexStartupRepair?.blockers || [],
+                        warnings: codexStartupRepair?.warnings || []
+                    })
                 },
                 {
                     id: 'startup_config_repair',
-                    ok: startupConfigRepair?.ok === true,
-                    repaired: startupConfigRepair?.apply === true,
-                    blockers: startupConfigRepair?.blockers || []
+                    run: async () => ({
+                        id: 'startup_config_repair',
+                        ok: startupConfigRepair?.ok === true,
+                        repaired: startupConfigRepair?.apply === true,
+                        blockers: startupConfigRepair?.blockers || []
+                    })
                 },
                 {
                     id: 'context7_repair',
-                    ok: context7Repair?.ok !== false,
-                    repaired: doctorFix,
-                    blockers: context7Repair?.blockers || [],
-                    warnings: context7Repair?.warnings || []
+                    run: async () => ({
+                        id: 'context7_repair',
+                        ok: context7Repair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: context7Repair?.blockers || [],
+                        warnings: context7Repair?.warnings || []
+                    })
                 },
                 {
                     id: 'context7_mcp_repair',
-                    ok: context7McpRepair?.ok === true,
-                    repaired: context7McpRepair?.repaired === true,
-                    manual_required: context7McpRepair?.manual_required === true,
-                    blockers: context7McpRepair?.blockers || [],
-                    warnings: context7McpRepair?.warnings || []
+                    run: async () => ({
+                        id: 'context7_mcp_repair',
+                        ok: context7McpRepair?.ok === true,
+                        repaired: context7McpRepair?.repaired === true,
+                        manual_required: context7McpRepair?.manual_required === true,
+                        blockers: context7McpRepair?.blockers || [],
+                        warnings: context7McpRepair?.warnings || []
+                    })
                 },
                 {
                     id: 'supabase_mcp_repair',
-                    ok: supabaseMcpRepair?.ok === true,
-                    repaired: false,
-                    manual_required: supabaseMcpRepair?.manual_required === true,
-                    blockers: supabaseMcpRepair?.blockers || [],
-                    warnings: supabaseMcpRepair?.warnings || []
+                    required_for_ready: false,
+                    run: async () => ({
+                        id: 'supabase_mcp_repair',
+                        ok: supabaseMcpRepair?.ok === true,
+                        repaired: false,
+                        manual_required: supabaseMcpRepair?.manual_required === true,
+                        required_for_ready: false,
+                        blockers: supabaseMcpRepair?.blockers || [],
+                        warnings: supabaseMcpRepair?.warnings || []
+                    })
                 },
                 {
                     id: 'command_alias_cleanup',
-                    ok: commandAliasCleanup?.ok !== false,
-                    repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
-                    blockers: commandAliasCleanup?.blockers || []
+                    run: async () => ({
+                        id: 'command_alias_cleanup',
+                        ok: commandAliasCleanup?.ok !== false,
+                        repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
+                        blockers: commandAliasCleanup?.blockers || []
+                    })
                 },
                 {
                     id: 'native_capability_repair',
-                    ok: doctorNativeCapabilityRepair?.ok !== false,
-                    repaired: doctorFix,
-                    blockers: doctorNativeCapabilityRepair?.blockers || []
+                    run: async () => ({
+                        id: 'native_capability_repair',
+                        ok: doctorNativeCapabilityRepair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: doctorNativeCapabilityRepair?.blockers || []
+                    })
                 }
             ]
         }).catch((err) => ({

package/dist/core/agents/agent-role-config.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const AGENT_ROLE_CONFIG_REPAIR_SCHEMA = 'sks.agent-role-config-repair.v1';
-const SKS_OWNED_AGENT_CONFIGS = new Map([
+export const SKS_OWNED_AGENT_CONFIGS = new Map([
     ['analysis-scout.toml', roleConfig('analysis_scout', 'Read-only SKS analysis scout retained for stale Codex agent-role config repair.', 'read-only')],
     ['native-agent-intake.toml', roleConfig('native_agent', 'Read-only Team native agent for repository/docs/tests/API/risk slices.', 'read-only')],
     ['team-consensus.toml', roleConfig('team_consensus', 'Planning and debate specialist for SKS Team mode.', 'read-only')],
@@ -11,6 +11,17 @@ const SKS_OWNED_AGENT_CONFIGS = new Map([
     ['db-safety-reviewer.toml', roleConfig('db_safety_reviewer', 'Read-only database safety reviewer for SQL, migrations, Supabase, and rollback safety.', 'read-only')],
     ['qa-reviewer.toml', roleConfig('qa_reviewer', 'Strict read-only verification reviewer for correctness, regressions, and final evidence.', 'read-only')]
 ]);
+export function managedAgentRoleConfigForFile(file) {
+    return SKS_OWNED_AGENT_CONFIGS.get(path.basename(file))?.content || null;
+}
+export function managedAgentRoleConfigForRole(role) {
+    const normalized = String(role || '').trim().replace(/-/g, '_');
+    for (const [file, config] of SKS_OWNED_AGENT_CONFIGS) {
+        if (config.name === normalized || path.basename(file, '.toml').replace(/-/g, '_') === normalized)
+            return { file, content: config.content };
+    }
+    return null;
+}
 export async function repairAgentRoleConfigs(input) {
     const root = path.resolve(input.root);
     const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || '', '.codex');

package/dist/core/codex/agent-config-file-repair.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { managedAgentRoleConfigForFile, managedAgentRoleConfigForRole } from '../agents/agent-role-config.js';
 export async function repairAgentConfigFileReferences(input) {
     const root = path.resolve(input.root);
     const configPath = path.join(root, '.codex', 'config.toml');
@@ -8,27 +9,42 @@ export async function repairAgentConfigFileReferences(input) {
     const createdFiles = [];
     const repairedPaths = [];
     const removedUnsupportedFields = [];
-    let text = original.replace(/^\s*message_role_prefix\s*=.*$/gm, (line) => {
-        removedUnsupportedFields.push(line.trim());
-        return '';
-    });
-    text = text.replace(/config_file\s*=\s*"([^"]+)"/g, (_match, value) => {
-        const absolute = path.isAbsolute(value) ? value : path.join(root, value);
-        repairedPaths.push(absolute);
-        return `config_file = "${absolute}"`;
-    });
-    if (input.apply && text !== original) {
-        for (const file of repairedPaths) {
-            const exists = await fs.stat(file).then((stat) => stat.isFile()).catch(() => false);
+    const skippedUnmanagedPaths = [];
+    const edits = [];
+    let text = original;
+    for (const block of tomlBlocks(original)) {
+        const managed = managedBlockTarget(root, block);
+        const currentConfigFile = stringValue(block.text, 'config_file');
+        if (!managed) {
+            if (currentConfigFile && !path.isAbsolute(currentConfigFile))
+                skippedUnmanagedPaths.push(currentConfigFile);
+            continue;
+        }
+        const target = path.join(root, '.codex', 'agents', managed.file);
+        let replacement = removeKey(block.text, 'message_role_prefix', removedUnsupportedFields);
+        replacement = replaceOrInsertKey(replacement, 'config_file', `"${escapeToml(target)}"`);
+        if (replacement !== block.text) {
+            edits.push({ start: block.start, end: block.end, replacement });
+            repairedPaths.push(target);
+        }
+        if (input.apply) {
+            const exists = await fs.stat(target).then((stat) => stat.isFile()).catch(() => false);
             if (!exists) {
-                await ensureDir(path.dirname(file));
-                await writeTextAtomic(file, '# SKS managed agent config placeholder\n');
-                createdFiles.push(file);
+                await ensureDir(path.dirname(target));
+                await writeTextAtomic(target, managed.content);
+                createdFiles.push(target);
             }
         }
-        await writeTextAtomic(configPath, text);
     }
-    const missing = await missingAgentConfigFiles(text);
+    if (edits.length)
+        text = applyEdits(original, edits);
+    if (input.apply && text !== original) {
+        await writeTextAtomic(configPath, text.replace(/\n{3,}/g, '\n\n').replace(/\s*$/, '\n'));
+    }
+    const effectiveText = input.apply ? await fs.readFile(configPath, 'utf8').catch(() => text) : text;
+    const missing = await missingAgentConfigFiles(effectiveText);
+    const unsupportedManagedFields = managedAgentBlocks(effectiveText)
+        .flatMap((block) => block.text.split(/\r?\n/).filter((line) => /^\s*message_role_prefix\s*=/.test(line)));
     const report = {
         schema: 'sks.agent-config-file-repair.v1',
         generated_at: nowIso(),
@@ -38,14 +54,22 @@ export async function repairAgentConfigFileReferences(input) {
         repaired_paths: repairedPaths,
         created_files: createdFiles,
         removed_unsupported_fields: removedUnsupportedFields,
-        blockers: missing.map((file) => `missing_agent_config_file:${file}`)
+        skipped_unmanaged_paths: skippedUnmanagedPaths,
+        manual_required: skippedUnmanagedPaths.length > 0,
+        blockers: [
+            ...missing.map((file) => `missing_agent_config_file:${file}`),
+            ...unsupportedManagedFields.map(() => 'unsupported_message_role_prefix_field')
+        ]
     };
+    report.ok = report.blockers.length === 0;
     if (input.reportPath !== null)
         await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'agent-config-file-repair.json'), report).catch(() => undefined);
     return report;
 }
 export async function missingAgentConfigFiles(text) {
-    const rows = [...String(text || '').matchAll(/config_file\s*=\s*"([^"]+)"/g)].map((match) => match[1]).filter((file) => Boolean(file));
+    const rows = managedAgentBlocks(text)
+        .map((block) => stringValue(block.text, 'config_file'))
+        .filter((file) => Boolean(file));
     const missing = [];
     for (const file of rows) {
         if (!path.isAbsolute(file)) {
@@ -58,4 +82,76 @@ export async function missingAgentConfigFiles(text) {
     }
     return missing;
 }
+function tomlBlocks(text) {
+    const source = String(text || '');
+    const matches = [...source.matchAll(/(^|\n)\s*\[([^\]]+)\]\s*(?:#.*)?(?:\n|$)/g)];
+    return matches.map((match, index) => {
+        const start = Number(match.index || 0) + (match[1] ? 1 : 0);
+        const next = matches[index + 1];
+        const end = next ? Number(next.index || 0) + (next[1] ? 1 : 0) : source.length;
+        return {
+            header: String(match[2] || '').trim(),
+            start,
+            end,
+            text: source.slice(start, end)
+        };
+    });
+}
+function managedAgentBlocks(text) {
+    return tomlBlocks(text).filter((block) => Boolean(managedBlockTarget(process.cwd(), block)));
+}
+function managedBlockTarget(root, block) {
+    if (!block.header.startsWith('agents.'))
+        return null;
+    const role = block.header.slice('agents.'.length);
+    const byRole = managedAgentRoleConfigForRole(role);
+    if (byRole)
+        return byRole;
+    const configFile = stringValue(block.text, 'config_file');
+    if (configFile) {
+        const content = managedAgentRoleConfigForFile(configFile);
+        if (content)
+            return { file: path.basename(configFile), content };
+    }
+    if (/SKS managed|sks_/i.test(block.text)) {
+        const fallback = managedAgentRoleConfigForRole(role);
+        if (fallback)
+            return fallback;
+    }
+    void root;
+    return null;
+}
+function stringValue(text, key) {
+    const match = text.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"`, 'm'));
+    return match && typeof match[1] === 'string' ? match[1] : null;
+}
+function removeKey(text, key, removed) {
+    return text.split(/\r?\n/).filter((line) => {
+        const match = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(line);
+        if (match)
+            removed.push(line.trim());
+        return !match;
+    }).join('\n');
+}
+function replaceOrInsertKey(text, key, encodedValue) {
+    const lines = text.replace(/\s*$/, '').split('\n');
+    const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    const index = lines.findIndex((line) => re.test(line));
+    if (index >= 0)
+        lines[index] = `${key} = ${encodedValue}`;
+    else
+        lines.push(`${key} = ${encodedValue}`);
+    return `${lines.join('\n')}\n`;
+}
+function applyEdits(text, edits) {
+    return [...edits]
+        .sort((a, b) => b.start - a.start)
+        .reduce((current, edit) => `${current.slice(0, edit.start)}${edit.replacement}${current.slice(edit.end)}`, text);
+}
+function escapeToml(value) {
+    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 //# sourceMappingURL=agent-config-file-repair.js.map

package/dist/core/codex/codex-startup-config-postcheck.js

@@ -2,29 +2,82 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { missingAgentConfigFiles } from './agent-config-file-repair.js';
+import { managedAgentRoleConfigForFile, managedAgentRoleConfigForRole } from '../agents/agent-role-config.js';
 export async function postcheckCodexStartupConfig(input) {
     const root = path.resolve(input.root);
     const configPath = path.join(root, '.codex', 'config.toml');
     const text = await fs.readFile(configPath, 'utf8').catch(() => '');
     const missing = await missingAgentConfigFiles(text);
-    const unsupportedRoleFields = /^\s*message_role_prefix\s*=/m.test(text);
-    const relativePaths = [...text.matchAll(/config_file\s*=\s*"([^"]+)"/g)].map((match) => match[1]).filter((file) => file && !path.isAbsolute(file));
+    const managedBlocks = managedAgentBlocks(text);
+    const unsupportedRoleFields = managedBlocks.some((block) => /^\s*message_role_prefix\s*=/m.test(block.text));
+    const relativePaths = managedBlocks
+        .map((block) => block.text.match(/^\s*config_file\s*=\s*"([^"]+)"/m)?.[1])
+        .filter((file) => Boolean(file && !path.isAbsolute(file)));
+    const tomlSmoke = tomlSyntaxSmoke(text);
+    const orphanChildTables = orphanMcpChildTables(text);
     const report = {
         schema: 'sks.codex-startup-config-postcheck.v1',
         generated_at: nowIso(),
-        ok: missing.length === 0 && relativePaths.length === 0 && !unsupportedRoleFields,
+        ok: missing.length === 0 && relativePaths.length === 0 && !unsupportedRoleFields && tomlSmoke.ok && orphanChildTables.length === 0,
         config_path: configPath,
         missing_config_files: missing,
         relative_config_files: relativePaths,
         unsupported_managed_role_fields: unsupportedRoleFields,
+        toml_syntax_smoke_ok: tomlSmoke.ok,
+        orphan_mcp_child_tables: orphanChildTables,
         blockers: [
             ...missing.map((file) => `missing_agent_config_file:${file}`),
             ...relativePaths.map((file) => `relative_agent_config_file:${file}`),
-            ...(unsupportedRoleFields ? ['unsupported_message_role_prefix_field'] : [])
+            ...(unsupportedRoleFields ? ['unsupported_message_role_prefix_field'] : []),
+            ...tomlSmoke.blockers,
+            ...orphanChildTables.map((table) => `orphan_mcp_child_table:${table}`)
         ]
     };
     if (input.reportPath !== null)
         await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json'), report).catch(() => undefined);
     return report;
 }
+function managedAgentBlocks(text) {
+    const blocks = tomlBlocks(text);
+    return blocks.filter((block) => {
+        if (!block.header.startsWith('agents.'))
+            return false;
+        const role = block.header.slice('agents.'.length);
+        if (managedAgentRoleConfigForRole(role))
+            return true;
+        const configFile = block.text.match(/^\s*config_file\s*=\s*"([^"]+)"/m)?.[1] || '';
+        return Boolean(configFile && managedAgentRoleConfigForFile(configFile));
+    });
+}
+function tomlBlocks(text) {
+    const source = String(text || '');
+    const matches = [...source.matchAll(/(^|\n)\s*\[([^\]]+)\]\s*(?:#.*)?(?:\n|$)/g)];
+    return matches.map((match, index) => {
+        const start = Number(match.index || 0) + (match[1] ? 1 : 0);
+        const next = matches[index + 1];
+        const end = next ? Number(next.index || 0) + (next[1] ? 1 : 0) : source.length;
+        return { header: String(match[2] || '').trim(), text: source.slice(start, end) };
+    });
+}
+function tomlSyntaxSmoke(text) {
+    const blockers = [];
+    for (const [index, line] of String(text || '').split(/\r?\n/).entries()) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('['))
+            continue;
+        if (!/^\[[^\]]+\]\s*(?:#.*)?$/.test(trimmed))
+            blockers.push(`toml_table_header_invalid:${index + 1}`);
+    }
+    const tripleQuotes = (String(text || '').match(/"""/g) || []).length;
+    if (tripleQuotes % 2 !== 0)
+        blockers.push('toml_multiline_string_unbalanced');
+    return { ok: blockers.length === 0, blockers };
+}
+function orphanMcpChildTables(text) {
+    const headers = new Set(tomlBlocks(text).map((block) => block.header));
+    return [...headers].filter((header) => {
+        const match = header.match(/^mcp_servers\.([^.]+)\./);
+        return Boolean(match && !headers.has(`mcp_servers.${match[1]}`));
+    });
+}
 //# sourceMappingURL=codex-startup-config-postcheck.js.map

package/dist/core/codex-control/codex-0140-capability.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
 import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
-import { CODEX_0140_FEATURE_KEYS, probeCodex0140Features } from './codex-0140-feature-probes.js';
+import { CODEX_0140_FEATURE_KEYS, probeCodex0140FeatureDetails, probeCodex0140Features } from './codex-0140-feature-probes.js';
 export async function detectCodex0140Capability(input = {}) {
     const fake = process.env.SKS_CODEX_0140_FAKE === '1';
     const codexBin = fake ? input.codexBin || process.env.CODEX_BIN || 'codex' : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
@@ -10,10 +10,16 @@ export async function detectCodex0140Capability(input = {}) {
     const parsed = parseCodexVersionText(versionText);
     const supports0140 = Boolean(parsed && compareSemverLike(parsed, '0.140.0') >= 0);
     const probeMode = process.env.SKS_CODEX_0140_PROBE === '1' ? 'feature-probe' : 'version-only';
-    const probeResults = probeMode === 'feature-probe'
-        ? await probeCodex0140Features(codexBin, { fake, timeoutMs: Number(process.env.SKS_CODEX_0140_PROBE_TIMEOUT_MS || 3000) })
+    const probeTimeoutMs = Number(process.env.SKS_CODEX_0140_PROBE_TIMEOUT_MS || 3000);
+    const probeDetails = probeMode === 'feature-probe'
+        ? await probeCodex0140FeatureDetails(codexBin, { fake, timeoutMs: probeTimeoutMs })
+        : null;
+    const probeResults = probeDetails
+        ? Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, probeDetails[key].status]))
         : Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, 'skipped']));
-    const featureOk = (key) => supports0140 && (probeMode === 'version-only' || probeResults[key] !== 'failed');
+    const featureStates = Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, featureStateFor(key, supports0140, probeMode, probeDetails)]));
+    const featureCertainty = Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, featureStates[key].certainty]));
+    const featureOk = (key) => featureStates[key].supported;
     const features = {
         usage_views: featureOk('usage_views'),
         goal_attachment_preservation: featureOk('goal_attachment_preservation'),
@@ -26,25 +32,84 @@ export async function detectCodex0140Capability(input = {}) {
         non_tty_interrupt: featureOk('non_tty_interrupt'),
         large_repo_responsiveness: featureOk('large_repo_responsiveness')
     };
-    const failed = Object.entries(probeResults).filter(([, status]) => status === 'failed').map(([key]) => `codex_0140_${key}_probe_failed`);
+    const failed = Object.entries(featureStates).flatMap(([key, state]) => state.certainty === 'failed' ? [`codex_0140_${key}_probe_failed`] : []);
+    const assumedWarnings = Object.entries(featureStates)
+        .filter(([, state]) => state.certainty === 'assumed_by_version')
+        .map(([key]) => `codex_0140_${key}_assumed_by_version`);
+    const unverifiedWarnings = Object.entries(featureStates)
+        .filter(([, state]) => state.certainty === 'unverified')
+        .map(([key]) => `codex_0140_${key}_unverified`);
     const blockers = [
         ...(!codexBin ? ['codex_cli_missing'] : []),
         ...(supports0140 ? [] : ['codex_0_140_required_for_0140_features']),
         ...(probeMode === 'feature-probe' ? failed : [])
     ];
-    return {
+    const report = {
         schema: 'sks.codex-0140-capability.v1',
         generated_at: nowIso(),
         ok: blockers.length === 0,
         codex_version: parsed,
         supports_0140: supports0140,
         features,
+        feature_states: featureStates,
+        feature_certainty: featureCertainty,
         blockers,
-        warnings: [],
+        warnings: [...assumedWarnings, ...unverifiedWarnings],
         codex_bin: codexBin || null,
         probe_mode: probeMode,
         feature_probe_results: probeResults
     };
+    if (probeDetails)
+        report.feature_probe_details = probeDetails;
+    return report;
+}
+function featureStateFor(key, supports0140, probeMode, probeDetails) {
+    if (!supports0140) {
+        return {
+            supported: false,
+            certainty: 'failed',
+            evidence: [],
+            blockers: ['codex_0_140_required_for_0140_features']
+        };
+    }
+    if (probeMode === 'version-only') {
+        return {
+            supported: true,
+            certainty: 'assumed_by_version',
+            evidence: ['codex_version>=0.140.0'],
+            blockers: []
+        };
+    }
+    const detail = probeDetails?.[key];
+    if (!detail) {
+        return {
+            supported: false,
+            certainty: 'unverified',
+            evidence: [],
+            blockers: [`codex_0140_${key}_probe_missing`]
+        };
+    }
+    if (detail.status === 'failed') {
+        return {
+            supported: false,
+            certainty: 'failed',
+            evidence: detail.evidence,
+            blockers: detail.blockers.length ? detail.blockers : [`codex_0140_${key}_probe_failed`]
+        };
+    }
+    const certainty = normalizeCertainty(detail.certainty);
+    const supported = detail.status === 'passed' || detail.status === 'discovered';
+    return {
+        supported,
+        certainty: supported ? certainty : 'unverified',
+        evidence: detail.evidence,
+        blockers: supported ? [] : detail.blockers
+    };
+}
+function normalizeCertainty(certainty) {
+    if (certainty === 'actual' || certainty === 'discovered' || certainty === 'fixture' || certainty === 'assumed_by_version')
+        return certainty;
+    return 'unverified';
 }
 export async function writeCodex0140CapabilityArtifacts(root, input = {}) {
     const report = await detectCodex0140Capability({ codexBin: input.codexBin || null });