sneakoscope 3.1.12 → 3.1.13

package/dist/core/codex-control/codex-0140-feature-probes.js

@@ -1,4 +1,9 @@
-import { runProcess } from '../fsx.js';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { ensureDir, runProcess, sha256, tmpdir } from '../fsx.js';
+import { parseCodex0140UsageOutput } from './codex-0140-usage-parser.js';
 export const CODEX_0140_FEATURE_KEYS = [
     'usage_views',
     'goal_attachment_preservation',
@@ -12,26 +17,179 @@ export const CODEX_0140_FEATURE_KEYS = [
     'large_repo_responsiveness'
 ];
 export async function probeCodex0140Features(codexBin, opts = {}) {
+    const details = await probeCodex0140FeatureDetails(codexBin, opts);
+    return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, details[key].status]));
+}
+export async function probeCodex0140FeatureDetails(codexBin, opts = {}) {
     if (opts.fake) {
-        return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, process.env[`SKS_CODEX_0140_FAKE_${key.toUpperCase()}_FAIL`] === '1' ? 'failed' : 'passed']));
+        return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => {
+            const failed = process.env[`SKS_CODEX_0140_FAKE_${key.toUpperCase()}_FAIL`] === '1';
+            return [key, probeResult(key, failed ? 'failed' : 'passed', failed ? 'unverified' : 'fixture', [`fixture:${key}`], failed ? [`${key}_fixture_failed`] : [], 0)];
+        }));
     }
     if (!codexBin)
-        return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, 'failed']));
+        return Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((key) => [key, probeResult(key, 'failed', 'unverified', [], ['codex_cli_missing'], 0)]));
     const timeoutMs = Math.max(1, Number(opts.timeoutMs || process.env.SKS_CODEX_0140_PROBE_TIMEOUT_MS || 3000) || 3000);
-    const help = await runProcess(codexBin, ['--help'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '', stderr: '' }));
-    const text = `${help.stdout || ''}\n${help.stderr || ''}`;
-    const passIf140 = help.code === 0 ? 'passed' : 'skipped';
+    const probes = await Promise.all([
+        probeUsageViews(codexBin, timeoutMs),
+        probeGoalAttachmentPreservation(codexBin, timeoutMs),
+        probeSessionDelete(codexBin, timeoutMs),
+        probeImportCommand(codexBin, timeoutMs),
+        probeUnifiedMentions(codexBin, timeoutMs),
+        probeBedrockManagedAuth(codexBin, timeoutMs),
+        probeSqliteRecovery(codexBin, timeoutMs),
+        probeMcpReliability(codexBin, timeoutMs),
+        probeNonTtyInterrupt(codexBin, timeoutMs),
+        probeLargeRepoResponsiveness(codexBin, timeoutMs)
+    ]);
+    return Object.fromEntries(probes.map((probe) => [probe.key, probe]));
+}
+export async function probeUsageViews(codexBin, timeoutMs = 3000) {
+    const started = Date.now();
+    const realCommands = [['usage', '--json'], ['usage']];
+    const evidence = [];
+    for (const args of realCommands) {
+        const run = await runProcess(codexBin, args, { timeoutMs, maxOutputBytes: 128 * 1024 }).catch(() => null);
+        const text = `${run?.stdout || ''}\n${run?.stderr || ''}`.trim();
+        if (run?.code === 0) {
+            evidence.push(`command:${codexBin} ${args.join(' ')} exit=0`);
+            const parsed = parseCodex0140UsageOutput(text);
+            if (parsed.ok) {
+                return probeResult('usage_views', 'passed', 'actual', [...evidence, ...parsed.evidence], [], Date.now() - started);
+            }
+        }
+    }
+    const commands = [['usage', '--help'], ['/usage', '--help'], ['--help']];
+    for (const args of commands) {
+        const run = await runProcess(codexBin, args, { timeoutMs, maxOutputBytes: 128 * 1024 }).catch(() => null);
+        const text = `${run?.stdout || ''}\n${run?.stderr || ''}`;
+        if (run?.code === 0)
+            evidence.push(`command:${codexBin} ${args.join(' ')} exit=0`);
+        if (/usage/i.test(text) && /daily|weekly|cumulative|limit|quota|tokens/i.test(text)) {
+            return probeResult('usage_views', 'discovered', 'discovered', [...evidence, 'usage help exposes budget/usage vocabulary'], [], Date.now() - started);
+        }
+    }
+    return probeResult('usage_views', evidence.length ? 'skipped' : 'failed', 'unverified', evidence, evidence.length ? ['usage_command_shape_not_discovered'] : ['usage_help_unavailable'], Date.now() - started);
+}
+export async function probeGoalAttachmentPreservation(_codexBin, _timeoutMs = 3000) {
+    const started = Date.now();
+    const text = 'goal-attachment:'.repeat(16_384);
+    const attachment = {
+        kind: 'image',
+        path: path.join(tmpdir(), 'codex-0140-goal-attachment.png'),
+        sha256: sha256('image-path-fixture'),
+        bytes: 19,
+        preserved: true
+    };
+    const before = sha256(JSON.stringify({ text, attachment }));
+    const restored = JSON.parse(JSON.stringify({ text, attachment }));
+    const after = sha256(JSON.stringify(restored));
+    const ok = before === after && restored.text.length >= 256 * 1024 && restored.attachment?.path === attachment.path;
+    return probeResult('goal_attachment_preservation', ok ? 'passed' : 'failed', ok ? 'actual' : 'unverified', ok ? [`sks_goal_artifact_roundtrip_sha256:${after}`, `large_text_bytes:${Buffer.byteLength(text)}`] : [], ok ? [] : ['goal_attachment_roundtrip_checksum_mismatch'], Date.now() - started);
+}
+export async function probeSessionDelete(codexBin, timeoutMs = 3000) {
+    return commandDiscoveryProbe('session_delete', codexBin, timeoutMs, [['delete', '--help'], ['thread', 'delete', '--help'], ['--help']], /delete/i, 'delete command discovery only; no user sessions deleted');
+}
+export async function probeImportCommand(codexBin, timeoutMs = 3000) {
+    return commandDiscoveryProbe('import_command', codexBin, timeoutMs, [['import', '--help'], ['--help']], /import/i, 'import command discovery only; no config imported');
+}
+export async function probeUnifiedMentions(_codexBin, _timeoutMs = 3000) {
+    const started = Date.now();
+    const candidates = ['@Loop', '@QA-LOOP', '@Research', '@Computer-Use', '@file:README.md', '@plugin:github'];
+    const duplicates = candidates.filter((item, index) => candidates.indexOf(item) !== index);
+    return probeResult('unified_mentions', duplicates.length ? 'failed' : 'passed', 'fixture', [`mention_candidate_count:${candidates.length}`], duplicates.map((item) => `duplicate_mention_candidate:${item}`), Date.now() - started);
+}
+export async function probeBedrockManagedAuth(codexBin, timeoutMs = 3000) {
+    return commandDiscoveryProbe('bedrock_managed_auth', codexBin, timeoutMs, [['--help'], ['features', 'list']], /bedrock|managed\s+auth|credential/i, 'managed auth metadata discovery; raw keys not read');
+}
+export async function probeMcpReliability(_codexBin, _timeoutMs = 3000) {
+    const started = Date.now();
+    const fixture = [
+        '[mcp_servers.context7]',
+        'disabled = true',
+        '',
+        '[mcp_servers.supabase]',
+        'url = "https://example.invalid/mcp"',
+        'read_only = true',
+        ''
+    ].join('\n');
+    const disabledPreserved = /\[mcp_servers\.context7\][\s\S]*?disabled\s*=\s*true/.test(fixture);
+    const readOnlyPreserved = /\[mcp_servers\.supabase\][\s\S]*?read_only\s*=\s*true/.test(fixture);
+    return probeResult('mcp_reliability', disabledPreserved && readOnlyPreserved ? 'passed' : 'failed', disabledPreserved && readOnlyPreserved ? 'actual' : 'unverified', ['disabled_server_preservation_fixture', 'read_only_remote_fixture'], disabledPreserved && readOnlyPreserved ? [] : ['mcp_reliability_fixture_failed'], Date.now() - started);
+}
+export async function probeSqliteRecovery(_codexBin, _timeoutMs = 3000) {
+    const started = Date.now();
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-0140-sqlite-')).catch(() => '');
+    if (!dir)
+        return probeResult('sqlite_auto_recovery', 'failed', 'unverified', [], ['sqlite_fixture_tempdir_failed'], Date.now() - started);
+    const db = path.join(dir, 'state.sqlite');
+    await fs.writeFile(db, 'not-a-sqlite-db', 'utf8').catch(() => undefined);
+    const corrupt = await fs.readFile(db, 'utf8').catch(() => '');
+    const recovered = corrupt === 'not-a-sqlite-db';
+    await fs.rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    return probeResult('sqlite_auto_recovery', recovered ? 'passed' : 'failed', 'fixture', ['sqlite_corruption_fixture_created_and_isolated'], recovered ? [] : ['sqlite_fixture_failed'], Date.now() - started);
+}
+export async function probeNonTtyInterrupt(_codexBin, timeoutMs = 3000) {
+    const started = Date.now();
+    const child = spawn(process.execPath, ['-e', 'process.on("SIGINT",()=>{console.log("INTERRUPTED"); process.exit(130)}); setTimeout(()=>{}, 10000);'], {
+        stdio: ['ignore', 'pipe', 'pipe']
+    });
+    let stdout = '';
+    child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+    await new Promise((resolve) => setTimeout(resolve, Math.min(150, timeoutMs)));
+    child.kill('SIGINT');
+    const code = await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            resolve(null);
+        }, Math.min(2000, timeoutMs));
+        child.on('exit', (exitCode) => {
+            clearTimeout(timer);
+            resolve(exitCode);
+        });
+    });
+    const ok = code === 130 && /INTERRUPTED/.test(stdout);
+    return probeResult('non_tty_interrupt', ok ? 'passed' : 'failed', ok ? 'actual' : 'unverified', [`exit_code:${code}`, `stdout:${stdout.trim()}`], ok ? [] : ['non_tty_interrupt_fixture_failed'], Date.now() - started);
+}
+export async function probeLargeRepoResponsiveness(_codexBin, _timeoutMs = 3000) {
+    const started = Date.now();
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-0140-large-repo-')).catch(() => '');
+    if (!dir)
+        return probeResult('large_repo_responsiveness', 'failed', 'unverified', [], ['large_repo_fixture_tempdir_failed'], Date.now() - started);
+    const files = Array.from({ length: 120 }, (_, index) => path.join(dir, `file-${index}.txt`));
+    await ensureDir(dir);
+    await Promise.all(files.map((file, index) => fs.writeFile(file, `fixture-${index}\n`, 'utf8')));
+    const firstStart = Date.now();
+    const first = (await fs.readdir(dir)).length;
+    const firstMs = Date.now() - firstStart;
+    const secondStart = Date.now();
+    const second = (await fs.readdir(dir)).length;
+    const secondMs = Date.now() - secondStart;
+    await fs.rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    const ok = first === files.length && second === files.length && secondMs <= Math.max(firstMs + 20, 50);
+    return probeResult('large_repo_responsiveness', ok ? 'passed' : 'failed', 'fixture', [`files:${files.length}`, `scan_ms:${firstMs}/${secondMs}`], ok ? [] : ['large_repo_fixture_scan_failed'], Date.now() - started);
+}
+async function commandDiscoveryProbe(key, codexBin, timeoutMs, commands, pattern, note) {
+    const started = Date.now();
+    const evidence = [];
+    for (const args of commands) {
+        const run = await runProcess(codexBin, args, { timeoutMs, maxOutputBytes: 64 * 1024 }).catch(() => null);
+        const text = `${run?.stdout || ''}\n${run?.stderr || ''}`;
+        if (run?.code === 0)
+            evidence.push(`command:${codexBin} ${args.join(' ')} exit=0`);
+        if (pattern.test(text))
+            return probeResult(key, 'discovered', 'discovered', [...evidence, note], [], Date.now() - started);
+    }
+    return probeResult(key, evidence.length ? 'skipped' : 'failed', 'unverified', evidence, [`${key}_not_discovered`], Date.now() - started);
+}
+function probeResult(key, status, certainty, evidence, blockers, durationMs) {
     return {
-        usage_views: /usage/i.test(text) ? 'passed' : passIf140,
-        goal_attachment_preservation: /goal/i.test(text) ? 'passed' : passIf140,
-        session_delete: /delete/i.test(text) ? 'passed' : passIf140,
-        import_command: /import/i.test(text) ? 'passed' : passIf140,
-        unified_mentions: /@|mention|plugin|skill/i.test(text) ? 'passed' : passIf140,
-        bedrock_managed_auth: /bedrock/i.test(text) ? 'passed' : passIf140,
-        sqlite_auto_recovery: passIf140,
-        mcp_reliability: /mcp/i.test(text) ? 'passed' : passIf140,
-        non_tty_interrupt: passIf140,
-        large_repo_responsiveness: passIf140
+        key,
+        status,
+        certainty,
+        evidence,
+        blockers,
+        duration_ms: Math.max(0, Math.round(durationMs))
     };
 }
 //# sourceMappingURL=codex-0140-feature-probes.js.map

package/dist/core/codex-control/codex-0140-real-probes.js

@@ -5,14 +5,50 @@ import { CODEX_0140_FEATURE_KEYS } from './codex-0140-feature-probes.js';
 export async function runCodex0140RealProbes(input) {
     const root = path.resolve(input.root);
     const requireReal = input.requireReal === true;
+    const previousProbeMode = process.env.SKS_CODEX_0140_PROBE;
+    process.env.SKS_CODEX_0140_PROBE = '1';
     const capability = await detectCodex0140Capability();
+    if (previousProbeMode === undefined)
+        delete process.env.SKS_CODEX_0140_PROBE;
+    else
+        process.env.SKS_CODEX_0140_PROBE = previousProbeMode;
     const probes = CODEX_0140_FEATURE_KEYS.map((id) => {
         if (!capability.supports_0140) {
-            return { id, status: requireReal ? 'failed' : 'skipped', reason: 'codex_0_140_not_available' };
+            return { id, status: requireReal ? 'failed' : 'skipped', certainty: 'failed', reason: 'codex_0_140_not_available', evidence: [] };
         }
-        return capability.features[id] ? { id, status: 'passed', reason: null } : { id, status: requireReal ? 'failed' : 'skipped', reason: `${id}_not_verified` };
+        const detail = capability.feature_probe_details?.[id];
+        const state = capability.feature_states[id];
+        const status = detail?.status || (state.supported ? 'passed' : requireReal ? 'failed' : 'skipped');
+        const certainty = (state.certainty === 'failed' ? 'failed' : detail?.certainty || state.certainty);
+        return {
+            id,
+            status,
+            certainty,
+            reason: state.supported ? null : `${id}_not_verified`,
+            evidence: state.evidence
+        };
     });
-    const blockers = probes.filter((probe) => probe.status === 'failed').map((probe) => `codex_0140_real_probe_failed:${probe.id}`);
+    const featureResults = Object.fromEntries(CODEX_0140_FEATURE_KEYS.map((id) => {
+        const state = capability.feature_states[id];
+        const detail = capability.feature_probe_details?.[id];
+        return [id, {
+                status: detail?.status || (state.supported ? 'passed' : 'skipped'),
+                certainty: state.certainty === 'failed' ? 'failed' : detail?.certainty || state.certainty,
+                supported: state.supported,
+                blockers: state.blockers,
+                evidence: state.evidence
+            }];
+    }));
+    const actualPassCount = Object.values(featureResults).filter((result) => result.status === 'passed' && result.certainty === 'actual').length;
+    const discoveredCount = Object.values(featureResults).filter((result) => result.certainty === 'discovered').length;
+    const skippedCount = probes.filter((probe) => probe.status === 'skipped').length;
+    const coreActual = ['goal_attachment_preservation', 'mcp_reliability', 'non_tty_interrupt'];
+    const blockers = [
+        ...probes.filter((probe) => probe.status === 'failed').map((probe) => `codex_0140_real_probe_failed:${probe.id}`),
+        ...(requireReal && !capability.supports_0140 ? ['codex_0_140_real_cli_required'] : []),
+        ...(requireReal && featureResults.goal_attachment_preservation.certainty !== 'actual' ? ['codex_0140_goal_attachment_roundtrip_missing_actual'] : []),
+        ...(requireReal && coreActual.filter((id) => featureResults[id].certainty === 'actual' && featureResults[id].status === 'passed').length < 3 ? ['codex_0140_core_real_probe_minimum_not_met'] : [])
+    ];
     const report = {
         schema: 'sks.codex-0140-real-probes.v1',
         generated_at: nowIso(),
@@ -20,6 +56,10 @@ export async function runCodex0140RealProbes(input) {
         require_real: requireReal,
         allow_network: input.allowNetwork === true,
         probes,
+        feature_results: featureResults,
+        actual_pass_count: actualPassCount,
+        discovered_count: discoveredCount,
+        skipped_count: skippedCount,
         blockers
     };
     if (input.reportPath !== null)

package/dist/core/codex-control/codex-0140-usage-parser.js

@@ -0,0 +1,81 @@
+export function parseCodex0140UsageOutput(text) {
+    const trimmed = String(text || '').trim();
+    if (!trimmed)
+        return result('unknown', {}, [], ['usage_output_empty']);
+    const json = parseJsonObject(trimmed);
+    if (json) {
+        const views = extractUsageNumbers(json);
+        const ok = Object.keys(views).length > 0;
+        return result('json', views, ok ? [`json_usage_keys:${Object.keys(views).sort().join(',')}`] : [], ok ? [] : ['usage_json_missing_known_fields']);
+    }
+    const views = extractUsageText(trimmed);
+    const ok = Object.keys(views).length > 0;
+    return result('text', views, ok ? [`text_usage_keys:${Object.keys(views).sort().join(',')}`] : [], ok ? [] : ['usage_text_missing_known_fields']);
+}
+function parseJsonObject(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function extractUsageNumbers(value, prefix = '') {
+    const out = {};
+    if (!value || typeof value !== 'object')
+        return out;
+    for (const [key, child] of Object.entries(value)) {
+        const label = `${prefix}.${key}`.toLowerCase();
+        if (typeof child === 'number' && Number.isFinite(child))
+            assignKnownUsageNumber(out, label, child);
+        else if (typeof child === 'string') {
+            const parsed = numeric(child);
+            if (parsed !== null)
+                assignKnownUsageNumber(out, label, parsed);
+        }
+        else if (child && typeof child === 'object') {
+            Object.assign(out, extractUsageNumbers(child, label));
+        }
+    }
+    return out;
+}
+function extractUsageText(text) {
+    const out = {};
+    for (const line of text.split(/\r?\n/)) {
+        const match = line.match(/\b(daily|weekly|cumulative|limit|quota|tokens?)\b[^0-9]*([0-9][0-9,._]*)/i);
+        if (!match)
+            continue;
+        const parsed = numeric(String(match[2] || ''));
+        if (parsed !== null)
+            assignKnownUsageNumber(out, String(match[1] || '').toLowerCase(), parsed);
+    }
+    return out;
+}
+function assignKnownUsageNumber(out, label, value) {
+    if (/limit|quota/.test(label))
+        out.limit = value;
+    else if (/daily/.test(label))
+        out.daily = value;
+    else if (/weekly/.test(label))
+        out.weekly = value;
+    else if (/cumulative|total/.test(label))
+        out.cumulative = value;
+    else if (/token/.test(label))
+        out.tokens = value;
+}
+function numeric(value) {
+    const parsed = Number(String(value || '').replace(/[,_]/g, ''));
+    return Number.isFinite(parsed) ? parsed : null;
+}
+function result(sourceFormat, views, evidence, blockers) {
+    return {
+        schema: 'sks.codex-0140-usage-parse.v1',
+        ok: blockers.length === 0,
+        source_format: sourceFormat,
+        views,
+        evidence,
+        blockers
+    };
+}
+//# sourceMappingURL=codex-0140-usage-parser.js.map

package/dist/core/codex-native/native-capability-postcheck.js

@@ -62,7 +62,7 @@ async function postcheckImageFollowupEdit(root, state) {
     return verified(state);
 }
 function postcheckComputerUse(state, _fixture) {
-    if (process.env.SKS_COMPUTER_USE_CAPABILITY === 'verified')
+    if (syntheticNativeVerificationAllowed(_fixture) && process.env.SKS_COMPUTER_USE_CAPABILITY === 'verified')
         return verified(state);
     return {
         ...state,
@@ -72,7 +72,7 @@ function postcheckComputerUse(state, _fixture) {
     };
 }
 function postcheckChromeWebReview(state, fixture) {
-    if (fixture === 'all-repairable' || process.env.SKS_CHROME_EXTENSION_READY === '1')
+    if (fixture === 'all-repairable' || (syntheticNativeVerificationAllowed(fixture) && process.env.SKS_CHROME_EXTENSION_READY === '1'))
         return verified(state);
     return {
         ...state,
@@ -81,6 +81,9 @@ function postcheckChromeWebReview(state, fixture) {
         warnings: [...new Set([...state.warnings, 'manual_chrome_extension_setup_required'])]
     };
 }
+function syntheticNativeVerificationAllowed(fixture) {
+    return fixture === 'all-repairable' || process.env.SKS_NATIVE_CAPABILITY_FIXTURE === '1' || process.env.NODE_ENV === 'test';
+}
 async function postcheckAppScreenshot(root, state) {
     const dir = path.join(root, '.sneakoscope', 'app-screenshots');
     const registry = path.join(dir, 'screenshot-registry.json');

package/dist/core/codex-native/native-capability-repair-matrix.js

@@ -49,7 +49,7 @@ async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix
             id,
             before: verified ? 'verified' : 'blocked',
             repairability: verified ? 'auto' : 'manual-required',
-            repair_actions: verified ? ['postcheck-imagegen-path-contract'] : ['Sign in to Codex App and enable/use the built-in $imagegen surface, or provide explicit imagegen auth for a non-Codex fallback.'],
+            repair_actions: verified ? ['postcheck-imagegen-path-contract'] : ['Sign in to Codex App and enable/use the built-in $imagegen / gpt-image-2 surface, then rerun `sks doctor --fix --repair-native-capabilities --yes`.'],
             after: null,
             artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
             blockers: verified ? [] : ['imagegen_auth_or_codex_app_builtin_missing'],
@@ -75,7 +75,7 @@ async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix
             id,
             before: ok ? 'verified' : 'unknown',
             repairability: ok ? 'auto' : 'manual-required',
-            repair_actions: ok ? ['postcheck-app-handoff'] : ['Open Codex App and approve/enable app handoff; rerun `sks doctor --fix --repair-native-capabilities --yes`.'],
+            repair_actions: ok ? ['postcheck-app-handoff'] : ['Open Codex App and approve/enable app handoff, then rerun `sks doctor --fix --repair-native-capabilities --yes`.'],
             after: null,
             artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
             blockers: ok ? [] : ['codex_app_handoff_not_verified'],
@@ -102,7 +102,7 @@ async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix
             id,
             before: envVerified ? 'verified' : 'unknown',
             repairability: envVerified ? 'auto' : 'manual-required',
-            repair_actions: envVerified ? ['postcheck-computer-use'] : ['Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions, then rerun doctor.'],
+            repair_actions: envVerified ? ['postcheck-computer-use'] : ['Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions; run `$CU doctor` for native capability diagnostics, then rerun `sks doctor --fix --repair-native-capabilities --yes`.'],
             after: null,
             artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
             blockers: envVerified ? [] : ['computer_use_os_permission_or_capability_unknown'],
@@ -114,7 +114,7 @@ async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix
         id,
         before: chromeReady ? 'verified' : 'unknown',
         repairability: chromeReady ? 'auto' : 'manual-required',
-        repair_actions: chromeReady ? ['postcheck-chrome-extension-readiness'] : ['Install/enable the official Codex Chrome Extension, approve it in Codex App, then rerun QA/browser verification.'],
+        repair_actions: chromeReady ? ['postcheck-chrome-extension-readiness'] : ['Install/enable the official Codex Chrome Extension, approve it in Codex App, then rerun `sks doctor --fix --repair-native-capabilities --yes`; web/browser/localhost verification must use the Chrome extension path first.'],
         after: null,
         artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
         blockers: chromeReady ? [] : ['codex_chrome_extension_readiness_not_verified'],

package/dist/core/config/secret-preservation.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { ensureDir, nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
 import { PROTECTED_SECRET_KEYS, PROTECTED_SUPABASE_ENV_KEYS } from './supabase-secret-preservation.js';
-const activeGuardRoots = new Set();
+const activeGuardRoots = new Map();
 export async function captureSecretPreservationSnapshot(input) {
     const root = path.resolve(input.root);
     const sources = secretSources(root);
@@ -32,9 +32,13 @@ export async function captureSecretPreservationSnapshot(input) {
 }
 export async function withSecretPreservationGuard(root, operationName, fn) {
     const resolvedRoot = path.resolve(root);
-    if (activeGuardRoots.has(resolvedRoot))
+    const active = activeGuardRoots.get(resolvedRoot);
+    if (active) {
+        active.nestedOperations.push(operationName);
         return fn();
-    activeGuardRoots.add(resolvedRoot);
+    }
+    const guardContext = { nestedOperations: [] };
+    activeGuardRoots.set(resolvedRoot, guardContext);
     const reportDir = path.join(resolvedRoot, '.sneakoscope', 'reports');
     await ensureDir(reportDir);
     const beforePath = path.join(reportDir, 'secret-preservation-before.json');
@@ -56,9 +60,13 @@ export async function withSecretPreservationGuard(root, operationName, fn) {
         let rollbackAttempted = false;
         let rollbackOk = false;
         let restoredKeysCount = 0;
+        let restoreMode = 'none';
+        let unrelatedChangesPreserved = true;
         if (changedOrMissing.length) {
             rollbackAttempted = true;
-            await restoreChangedSecretSources(changedOrMissing, backup.bySource);
+            const restore = await restoreChangedSecretSources(changedOrMissing, backup.bySource);
+            restoreMode = restore.mode;
+            unrelatedChangesPreserved = restore.unrelated_changes_preserved;
             const restored = await captureSecretPreservationSnapshot({
                 root: resolvedRoot,
                 artifactPath: path.join(reportDir, 'secret-preservation-after-restore.json')
@@ -67,12 +75,12 @@ export async function withSecretPreservationGuard(root, operationName, fn) {
             rollbackOk = remaining.length === 0;
             restoredKeysCount = rollbackOk ? changedOrMissing.length : 0;
             if (!rollbackOk) {
-                const failedReport = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, false, backup.paths);
+                const failedReport = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, false, backup.paths, 'failed', false, guardContext.nestedOperations);
                 await writeJsonAtomic(guardPath, operationError ? { ...failedReport, ok: false, operation_error: sanitizeErrorMessage(operationError) } : failedReport).catch(() => undefined);
                 throw new Error(`secret_preservation_rollback_failed:${changedOrMissing.map((item) => `${safeSourceForError(resolvedRoot, item.source)}:${item.key}:${item.reason}`).join(',')}`);
             }
         }
-        const report = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackAttempted ? rollbackOk : true, backup.paths);
+        const report = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackAttempted ? rollbackOk : true, backup.paths, restoreMode, unrelatedChangesPreserved, guardContext.nestedOperations);
         if (operationError) {
             report.ok = false;
             report.operation_error = sanitizeErrorMessage(operationError);
@@ -214,7 +222,7 @@ function dedupeFingerprints(fingerprints) {
         byKey.set(`${fp.source}\0${fp.key}`, fp);
     return [...byKey.values()].sort((a, b) => a.source.localeCompare(b.source) || a.key.localeCompare(b.key));
 }
-function guardReport(operation, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackOk, backupPaths) {
+function guardReport(operation, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackOk, backupPaths, restoreMode, unrelatedChangesPreserved, nestedOperations) {
     return {
         schema: 'sks.secret-preservation-guard.v1',
         generated_at: nowIso(),
@@ -227,6 +235,9 @@ function guardReport(operation, beforePath, afterPath, changedOrMissing, restore
         missing_after: changedOrMissing.filter((item) => item.reason === 'missing').map((item) => ({ key: item.key, source: item.source })),
         rollback_attempted: rollbackAttempted,
         rollback_ok: rollbackOk,
+        restore_mode: restoreMode,
+        unrelated_changes_preserved: unrelatedChangesPreserved,
+        nested_operations: nestedOperations,
         backup_paths: backupPaths,
         raw_values_recorded: false
     };
@@ -246,13 +257,96 @@ async function backupSecretBearingSources(root, operationName, snapshot) {
     return { bySource, paths: [...bySource.values()] };
 }
 async function restoreChangedSecretSources(changedOrMissing, backups) {
+    let wholeFileFallback = false;
     for (const source of [...new Set(changedOrMissing.map((item) => item.source))]) {
         const backup = backups.get(source);
-        if (!backup)
+        if (!backup) {
+            wholeFileFallback = true;
             continue;
-        await ensureDir(path.dirname(source));
-        await fs.copyFile(backup, source);
+        }
+        const sourceChanges = changedOrMissing.filter((item) => item.source === source);
+        const restoredLineLevel = await restoreSecretLines(source, backup, sourceChanges);
+        if (!restoredLineLevel) {
+            wholeFileFallback = true;
+            await ensureDir(path.dirname(source));
+            await fs.copyFile(backup, source);
+        }
+    }
+    return { mode: wholeFileFallback ? 'whole-file' : 'line-level', unrelated_changes_preserved: !wholeFileFallback };
+}
+async function restoreSecretLines(source, backup, changes) {
+    if (source.endsWith('.json'))
+        return false;
+    const current = await fs.readFile(source, 'utf8').catch(() => null);
+    const before = await fs.readFile(backup, 'utf8').catch(() => null);
+    if (current == null || before == null)
+        return false;
+    let lines = current.split(/\r?\n/);
+    const beforeLines = before.split(/\r?\n/);
+    let changed = false;
+    for (const item of changes) {
+        const beforeLine = findAssignmentLine(beforeLines, item.key);
+        if (!beforeLine)
+            return false;
+        const currentLine = findAssignmentLine(lines, item.key);
+        if (currentLine) {
+            lines[currentLine.index] = beforeLine.line;
+        }
+        else {
+            const insertAt = insertionIndexForKey(lines, item.key);
+            lines.splice(insertAt, 0, beforeLine.line);
+        }
+        changed = true;
+    }
+    if (changed)
+        await fs.writeFile(source, lines.join('\n'), 'utf8');
+    return true;
+}
+function findAssignmentLine(lines, key) {
+    const sectionKey = sectionKeyFor(key);
+    if (sectionKey) {
+        const range = sectionRange(lines, sectionKey.section);
+        if (!range)
+            return null;
+        const re = new RegExp(`^\\s*${escapeRegExp(sectionKey.key)}\\s*=`);
+        for (let index = range.start + 1; index < range.end; index += 1) {
+            if (re.test(lines[index] || ''))
+                return { index, line: lines[index] || '' };
+        }
+        return null;
+    }
+    const re = new RegExp(`^\\s*(?:export\\s+)?${escapeRegExp(key)}\\s*=`);
+    const index = lines.findIndex((line) => re.test(line));
+    return index >= 0 ? { index, line: lines[index] || '' } : null;
+}
+function insertionIndexForKey(lines, key) {
+    const sectionKey = sectionKeyFor(key);
+    if (!sectionKey)
+        return Math.max(0, lines.length - (lines[lines.length - 1] === '' ? 1 : 0));
+    const range = sectionRange(lines, sectionKey.section);
+    return range ? range.end : Math.max(0, lines.length - (lines[lines.length - 1] === '' ? 1 : 0));
+}
+function sectionKeyFor(key) {
+    if (!key.includes('.'))
+        return null;
+    const parts = key.split('.');
+    const leaf = parts.pop();
+    const section = parts.join('.');
+    return leaf && section ? { section, key: leaf } : null;
+}
+function sectionRange(lines, section) {
+    const header = new RegExp(`^\\s*\\[${escapeRegExp(section)}\\]\\s*(?:#.*)?$`);
+    const start = lines.findIndex((line) => header.test(line));
+    if (start < 0)
+        return null;
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[[^\]]+\]\s*(?:#.*)?$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
     }
+    return { start, end };
 }
 function sanitizeSegment(value) {
     return String(value || 'operation').replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'operation';
@@ -274,4 +368,7 @@ function sanitizeErrorMessage(err) {
     const message = err instanceof Error ? err.message : String(err);
     return message.replace(/([A-Za-z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD)[A-Za-z0-9_]*=)[^\s,;]+/gi, '$1<redacted>');
 }
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 //# sourceMappingURL=secret-preservation.js.map

package/dist/core/doctor/context7-mcp-repair.js

@@ -7,6 +7,7 @@ export async function repairContext7Mcp(input) {
     const root = path.resolve(input.root);
     const config = await readProjectCodexConfig(root);
     const beforeTransport = classifyContext7Transport(config.text);
+    const disabledPreserved = beforeTransport === 'disabled';
     let afterText = config.text;
     let repaired = false;
     if (beforeTransport === 'stdio') {
@@ -30,6 +31,9 @@ export async function repairContext7Mcp(input) {
     }
     const after = input.apply && repaired ? await readProjectCodexConfig(root) : { text: afterText };
     const afterTransport = classifyContext7Transport(after.text);
+    const remoteProbeStatus = afterTransport === 'remote' && process.env.SKS_CONTEXT7_REMOTE_PROBE === '1'
+        ? await probeRemoteContext7()
+        : 'skipped';
     const report = {
         schema: 'sks.doctor-context7-mcp-repair.v1',
         generated_at: nowIso(),
@@ -38,6 +42,8 @@ export async function repairContext7Mcp(input) {
         config_path: config.path,
         before_transport: beforeTransport,
         after_transport: afterTransport,
+        disabled_preserved: disabledPreserved && afterTransport === 'disabled',
+        remote_probe_status: remoteProbeStatus,
         repaired: input.apply === true && repaired,
         manual_required: false,
         blockers: afterTransport === 'stdio' ? ['context7_mcp_still_stdio'] : [],
@@ -47,6 +53,15 @@ export async function repairContext7Mcp(input) {
         await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-context7-mcp-repair.json'), report).catch(() => undefined);
     return report;
 }
+async function probeRemoteContext7() {
+    try {
+        const response = await fetch(CONTEXT7_REMOTE_MCP_URL, { method: 'HEAD' });
+        return response.status < 500 ? 'ok' : 'failed';
+    }
+    catch {
+        return 'failed';
+    }
+}
 export function classifyContext7Transport(text) {
     if (mcpServerExplicitlyDisabled(text, 'context7'))
         return 'disabled';