sneakoscope 3.1.13 → 4.0.0

package/dist/core/codex/codex-config-readability.js

@@ -17,50 +17,64 @@ export async function inspectCodexConfigReadability(rootInput = process.cwd(), o
             classifyBlocker(check).forEach((blocker) => blockers.add(blocker));
     };
     add(await accessCheck('codex_dir_exists', configDir, fs.constants.R_OK | fs.constants.X_OK));
-    add(await accessCheck('project_config_exists', configPath, fs.constants.R_OK));
+    const projectConfigExists = await accessCheck('project_config_exists', configPath, fs.constants.R_OK);
+    add(projectConfigExists);
     for (const dir of parentDirsFor(root, configPath)) {
         add(await accessCheck('parent_traverse', dir, fs.constants.X_OK));
     }
-    const lstatCheck = await statCheck('config_lstat', configPath, 'lstat');
-    add(lstatCheck);
-    const stat = await statCheck('config_stat', configPath, 'stat');
-    add(stat);
-    if (stat.ok) {
-        add({ name: 'config_owner', ok: true, detail: { uid: stat.detail.uid, gid: stat.detail.gid } });
-        add({ name: 'config_mode', ok: true, detail: { mode: stat.detail.mode_octal } });
-    }
-    if (lstatCheck.ok) {
-        const isSymlink = Boolean(lstatCheck.detail.is_symbolic_link);
-        const symlinkDetail = { is_symlink: isSymlink };
-        if (isSymlink) {
-            symlinkDetail.realpath = await fsp.realpath(configPath).catch((err) => ({ error: errorDetail(err) }));
-            symlinkDetail.allowed = typeof symlinkDetail.realpath === 'string' && symlinkTargetAllowed(symlinkDetail.realpath, root, opts);
-            if (!symlinkDetail.allowed)
-                blockers.add('symlink_escape');
+    // Fresh project: the managed config simply does not exist yet. Every downstream check
+    // (stat, symlink, macOS ACL/flags/xattr, node/child read, codex config load) would
+    // operate on a nonexistent path and fail with ENOENT, turning the single real cause —
+    // a missing config — into a misleading cascade (`macos_acl_ls_le_failed`,
+    // `macos_flags_ls_lO_failed`, `spawned_child_read_failed`, ...). Skip them and report
+    // only the honest `missing_config` / `missing_codex_dir` blocker so the caller can
+    // regenerate the managed config instead of chasing phantom ACL/permission problems.
+    const configMissing = projectConfigExists.error?.code === 'ENOENT';
+    if (!configMissing) {
+        const lstatCheck = await statCheck('config_lstat', configPath, 'lstat');
+        add(lstatCheck);
+        const stat = await statCheck('config_stat', configPath, 'stat');
+        add(stat);
+        if (stat.ok) {
+            add({ name: 'config_owner', ok: true, detail: { uid: stat.detail.uid, gid: stat.detail.gid } });
+            add({ name: 'config_mode', ok: true, detail: { mode: stat.detail.mode_octal } });
         }
-        add({ name: 'config_symlink', ok: !isSymlink || symlinkDetail.allowed === true, detail: symlinkDetail });
-    }
-    if (process.platform === 'darwin') {
-        add(await commandCheck('macos_acl_ls_le', 'ls', ['-le', configPath], root));
-        const acl = checks.find((check) => check.name === 'macos_acl_ls_le');
-        if (/\bdeny\b.*\b(read|readattr|readextattr|readsecurity|search)\b/i.test(String(acl?.detail?.stdout || '')))
-            blockers.add('acl_denied');
-        const flags = await commandCheck('macos_flags_ls_lO', 'ls', ['-lO', configPath], root);
-        add(flags);
-        if (/\b(uchg|schg|restricted)\b/.test(String(flags.detail?.stdout || '')))
-            blockers.add('flags_locked');
-        const xattrs = await commandCheck('macos_xattr', 'xattr', ['-l', configPath], root, { allowExitCodes: [0, 1] });
-        add(xattrs);
-        add({ name: 'macos_quarantine_xattr', ok: !/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')), detail: { present: /com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')) } });
-        if (/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')))
-            blockers.add('quarantine');
+        if (lstatCheck.ok) {
+            const isSymlink = Boolean(lstatCheck.detail.is_symbolic_link);
+            const symlinkDetail = { is_symlink: isSymlink };
+            if (isSymlink) {
+                symlinkDetail.realpath = await fsp.realpath(configPath).catch((err) => ({ error: errorDetail(err) }));
+                symlinkDetail.allowed = typeof symlinkDetail.realpath === 'string' && symlinkTargetAllowed(symlinkDetail.realpath, root, opts);
+                if (!symlinkDetail.allowed)
+                    blockers.add('symlink_escape');
+            }
+            add({ name: 'config_symlink', ok: !isSymlink || symlinkDetail.allowed === true, detail: symlinkDetail });
+        }
+        if (process.platform === 'darwin') {
+            add(await commandCheck('macos_acl_ls_le', 'ls', ['-le', configPath], root));
+            const acl = checks.find((check) => check.name === 'macos_acl_ls_le');
+            if (/\bdeny\b.*\b(read|readattr|readextattr|readsecurity|search)\b/i.test(String(acl?.detail?.stdout || '')))
+                blockers.add('acl_denied');
+            const flags = await commandCheck('macos_flags_ls_lO', 'ls', ['-lO', configPath], root);
+            add(flags);
+            if (/\b(uchg|schg|restricted)\b/.test(String(flags.detail?.stdout || '')))
+                blockers.add('flags_locked');
+            const xattrs = await commandCheck('macos_xattr', 'xattr', ['-l', configPath], root, { allowExitCodes: [0, 1] });
+            add(xattrs);
+            add({ name: 'macos_quarantine_xattr', ok: !/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')), detail: { present: /com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')) } });
+            if (/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')))
+                blockers.add('quarantine');
+        }
+        else {
+            add({ name: 'macos_metadata', ok: true, status: 'skipped_non_macos' });
+        }
+        add(await nodeReadCheck(configPath));
+        add(await childReadCheck(configPath, root));
+        add(await codexCliConfigLoadCheck(root, configPath, opts));
     }
     else {
-        add({ name: 'macos_metadata', ok: true, status: 'skipped_non_macos' });
+        add({ name: 'config_file_checks', ok: true, status: 'skipped_config_missing', detail: { config_path: configPath } });
     }
-    add(await nodeReadCheck(configPath));
-    add(await childReadCheck(configPath, root));
-    add(await codexCliConfigLoadCheck(root, configPath, opts));
     const report = {
         schema: CODEX_CONFIG_READABILITY_SCHEMA,
         generated_at: nowIso(),
@@ -176,7 +190,7 @@ function operatorActions(blockers) {
     if (blockers.some((item) => /^missing_/.test(item)))
         actions.add('Run `sks doctor --fix` to regenerate the managed Codex project config, then rerun the preflight.');
     if (blockers.includes('codex_cli_config_toml_parse_error'))
-        actions.add('Run `sks doctor --fix` (or `sks mad repair-config --apply`) to hoist misplaced machine-local keys back to the top of the Codex config and restore a loadable config.toml.');
+        actions.add('Run `sks doctor --fix` (or `sks mad repair-config --apply`) to restore a loadable config.toml. This hoists misplaced machine-local keys back to the top of the file AND migrates a local-stdio Context7/MCP server that conflicts with a remote `url` (the "url is not supported for stdio" error, caused by the global and project configs merging) to the supported transport. If `sks doctor --fix` already reports the Context7/MCP transport repaired, the config is fixed — rerun once to confirm `cli_ready`.');
     if (blockers.includes('codex_cli_config_eperm'))
         actions.add('Run `sks mad repair-config --apply`; if it still fails on macOS, grant Full Disk Access/Files and Folders access to the launching terminal, Warp, iTerm, Terminal, Codex app, or Codex CLI context.');
     if (blockers.includes('EPERM') || blockers.includes('tcc_possible'))

package/dist/core/commands/check-command.js

@@ -0,0 +1,130 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { flag } from '../../cli/args.js';
+import { printJson } from '../../cli/output.js';
+import { projectRoot } from '../fsx.js';
+const CHECK_SCHEMA = 'sks.check.v1';
+export async function checkCommand(args = []) {
+    const root = await projectRoot();
+    const tier = readArg(args, '--tier', positionalTier(args) || 'confidence');
+    const sla = readArg(args, '--sla', '5m');
+    const changedSince = readArg(args, '--changed-since', 'auto');
+    const json = flag(args, '--json');
+    const planOnly = flag(args, '--plan');
+    const plan = buildCheckPlan({ tier, sla, changedSince });
+    if (planOnly) {
+        const result = { schema: CHECK_SCHEMA, ok: true, mode: 'plan', ...plan };
+        if (json)
+            return printJson(result);
+        printPlan(result);
+        return result;
+    }
+    const steps = [];
+    let proofBankSummary = null;
+    for (const step of plan.steps) {
+        const result = spawnSync(step.command, step.args, {
+            cwd: root,
+            encoding: 'utf8',
+            maxBuffer: 1024 * 1024 * 20,
+            shell: false,
+            env: { ...process.env, CI: process.env.CI || 'true' }
+        });
+        const ok = result.status === 0;
+        if (step.name === 'proof-bank-summary')
+            proofBankSummary = parseJsonObject(String(result.stdout || ''));
+        steps.push({ name: step.name, ok, status: result.status, stderr_tail: tail(String(result.stderr || '')) });
+        if (!json) {
+            if (result.stdout)
+                process.stdout.write(result.stdout);
+            if (result.stderr)
+                process.stderr.write(result.stderr);
+        }
+        if (!ok) {
+            const failed = { schema: CHECK_SCHEMA, ok: false, mode: 'run', ...plan, steps, completion_certificate: latestCertificate(root) || proofBankSummary?.completion_certificate || null, release_speed_summary: proofBankSummary };
+            if (json)
+                return printJson(failed);
+            process.exitCode = result.status || 1;
+            return failed;
+        }
+    }
+    const result = { schema: CHECK_SCHEMA, ok: true, mode: 'run', ...plan, steps, completion_certificate: latestCertificate(root) || proofBankSummary?.completion_certificate || null, release_speed_summary: proofBankSummary };
+    if (json)
+        return printJson(result);
+    if (result.completion_certificate) {
+        console.log(`SKS check certificate: ${result.completion_certificate.confidence} sla_met=${result.completion_certificate.sla_met}`);
+    }
+    return result;
+}
+function buildCheckPlan(input) {
+    const tier = normalizeTier(input.tier);
+    const buildScript = tier === 'release' ? 'build:clean' : 'build:incremental';
+    const steps = [];
+    if (tier === 'instant') {
+        steps.push({ name: 'proof-bank-summary', command: process.execPath, args: ['dist/scripts/release-speed-summary.js'] });
+    }
+    else if (tier === 'real-check') {
+        steps.push({ name: 'real-check', command: process.execPath, args: ['dist/scripts/release-real-check.js'] });
+    }
+    else {
+        steps.push({ name: buildScript, command: 'npm', args: ['run', buildScript, '--silent'] });
+        steps.push({ name: `release:${tier}`, command: process.execPath, args: dagArgs(tier, input.changedSince, input.sla) });
+    }
+    return {
+        tier,
+        sla: input.sla,
+        changed_since: input.changedSince,
+        build_once: tier === 'release' ? 'clean' : tier === 'real-check' || tier === 'instant' ? 'not_applicable' : 'incremental',
+        steps
+    };
+}
+function dagArgs(tier, changedSince, sla) {
+    if (tier === 'release')
+        return ['dist/scripts/release-gate-dag-runner.js', '--preset', 'release', '--full'];
+    const preset = tier === 'instant' ? 'fast' : tier === 'affected' || tier === 'confidence' ? 'affected' : tier;
+    return ['dist/scripts/release-gate-dag-runner.js', '--preset', preset, '--changed-since', changedSince, '--sla', sla];
+}
+function latestCertificate(root) {
+    const direct = path.join(root, '.sneakoscope', 'reports', 'completion-certificate.json');
+    if (fs.existsSync(direct))
+        return JSON.parse(fs.readFileSync(direct, 'utf8'));
+    const base = path.join(root, '.sneakoscope', 'reports', 'release-gates');
+    if (!fs.existsSync(base))
+        return null;
+    const latest = fs.readdirSync(base)
+        .map((name) => path.join(base, name, 'completion-certificate.json'))
+        .filter((file) => fs.existsSync(file))
+        .sort((a, b) => fs.statSync(b).mtimeMs - fs.statSync(a).mtimeMs)[0];
+    return latest ? JSON.parse(fs.readFileSync(latest, 'utf8')) : null;
+}
+function normalizeTier(value) {
+    const tier = String(value || '').trim().toLowerCase();
+    if (['instant', 'affected', 'confidence', 'release', 'real-check'].includes(tier))
+        return tier;
+    return 'confidence';
+}
+function positionalTier(args) {
+    const first = args.find((arg) => !arg.startsWith('-'));
+    return first || null;
+}
+function readArg(args, name, fallback) {
+    const index = args.indexOf(name);
+    return index >= 0 && args[index + 1] ? String(args[index + 1]) : fallback;
+}
+function tail(value, limit = 1200) {
+    return value.length > limit ? value.slice(-limit) : value;
+}
+function parseJsonObject(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function printPlan(result) {
+    console.log(`SKS check plan: tier=${result.tier} sla=${result.sla} build=${result.build_once}`);
+    for (const step of result.steps)
+        console.log(`- ${step.name}: ${[step.command, ...step.args].join(' ')}`);
+}
+//# sourceMappingURL=check-command.js.map

package/dist/core/commands/daemon-command.js

@@ -0,0 +1,14 @@
+import { flag } from '../../cli/args.js';
+import { printJson } from '../../cli/output.js';
+import { projectRoot } from '../fsx.js';
+import { runSksdClient } from '../daemon/sksd-client.js';
+export async function daemonCommand(args = []) {
+    const root = await projectRoot();
+    const action = args[0] === 'warm' || args[0] === 'stop' || args[0] === 'status' ? args[0] : 'status';
+    const state = runSksdClient(root, action);
+    if (flag(args, '--json'))
+        return printJson(state);
+    console.log(JSON.stringify(state, null, 2));
+    return state;
+}
+//# sourceMappingURL=daemon-command.js.map

package/dist/core/commands/local-model-command.js

@@ -72,7 +72,7 @@ async function enable(args) {
         : await runLocalLlmGenerationSmoke(config, {
             prompt: 'Return strict JSON: {"status":"ok","summary":"local smoke passed"}',
             schema: localLlmSmokeSchema,
-            timeoutMs: 20_000
+            timeoutMs: Math.max(60_000, Number(config.timeout_ms || 0) || 0)
         });
     const next = await writeLocalModelConfig(applyLocalLlmSmokeResult(config, smoke));
     if (!skipSmoke && smoke.ok !== true)

package/dist/core/commands/mad-sks-command.js

@@ -135,7 +135,24 @@ export async function madHighCommand(args = [], deps = {}) {
     // readability + repair checks still run. SKS_LAUNCH_FULL_CODEX_PROBE=1 restores the
     // old behavior.
     const allowMadRepair = rawArgs.includes('--repair-config') || rawArgs.includes('--fix') || rawArgs.includes('--yes-repair');
-    const launchPreflight = await runCodexLaunchPreflight(launchRoot, { fix: allowMadRepair, launchFast: process.env.SKS_LAUNCH_FULL_CODEX_PROBE !== '1', profile: profile.profile_name, sandbox: 'danger-full-access', serviceTier: 'fast' });
+    const launchPreflightOpts = { fix: allowMadRepair, launchFast: process.env.SKS_LAUNCH_FULL_CODEX_PROBE !== '1', profile: profile.profile_name, sandbox: 'danger-full-access', serviceTier: 'fast' };
+    let launchPreflight = await runCodexLaunchPreflight(launchRoot, launchPreflightOpts);
+    // Fresh-project bootstrap: when the ONLY blocker is that the managed Codex config does
+    // not exist yet (`.codex/config.toml` absent), regenerate it — exactly what the blocker
+    // action tells the user to run via `sks doctor --fix` — and re-run the preflight once,
+    // instead of blocking the launch on a trivially-fixable missing config. An EXISTING but
+    // unreadable/broken config is NOT auto-fixed here: it still blocks and routes the user
+    // to `sks doctor --fix`, so genuine permission/EPERM/parse problems are never masked.
+    if (!launchPreflight.ok && !fs.existsSync(path.join(launchRoot, '.codex', 'config.toml'))) {
+        try {
+            await initProject(launchRoot, { installScope: rawArgs.includes('--local-only') ? 'project' : 'global', localOnly: rawArgs.includes('--local-only'), globalCommand: 'sks' });
+            console.error('SKS MAD bootstrapped the missing managed Codex config (`sks doctor --fix` equivalent) and re-ran preflight.');
+            launchPreflight = await runCodexLaunchPreflight(launchRoot, launchPreflightOpts);
+        }
+        catch (bootstrapErr) {
+            console.error(`SKS MAD could not bootstrap the managed Codex config: ${bootstrapErr?.message || bootstrapErr}. Run \`sks doctor --fix\`.`);
+        }
+    }
     const afterPreflightUi = beforeUi ? await writeCodexAppUiSnapshot(launchRoot, `mad-after-preflight-${uiSnapshotId}`).catch(() => null) : null;
     const preflightUiDiff = beforeUi && afterPreflightUi ? diffCodexAppUiSnapshots(beforeUi, afterPreflightUi) : null;
     if (preflightUiDiff && !preflightUiDiff.ok) {

package/dist/core/commands/naruto-command.js

@@ -108,7 +108,7 @@ async function narutoRun(parsed) {
     // system-safe number so naruto never spawns the whole count at once unless an
     // explicit operator override asks for a higher target.
     const localWorker = await resolveNarutoLocalWorkerMode(parsed);
-    const schedulerBackend = localWorker.auto_select_eligible ? 'ollama' : parsed.backend;
+    const schedulerBackend = localWorker.auto_select_eligible ? 'local-llm' : parsed.backend;
     const safe = systemSafeNarutoConcurrency({ backend: schedulerBackend });
     const baseWorkGraph = buildNarutoWorkGraph({
         prompt: parsed.prompt,
@@ -658,7 +658,7 @@ function summarizeNarutoLocalWorkerResult(localWorker, result) {
     }
     return {
         ...localWorker,
-        selected_worker_count: backendCounts.ollama || 0,
+        selected_worker_count: (backendCounts['local-llm'] || 0) + (backendCounts.ollama || 0),
         backend_counts: backendCounts
     };
 }
@@ -770,7 +770,7 @@ async function narutoHelp(parsed) {
         mode: 'NARUTO',
         description: 'Shadow Clone Swarm: fan out up to ' + MAX_NARUTO_AGENT_COUNT + ' parallel clone sessions.',
         usage: [
-            'sks naruto run "<task>" [--clones N] [--backend codex-sdk|fake|ollama] [--local-model|--no-ollama] [--work-items N] [--write-mode parallel|serial|off] [--apply-patches] [--dry-run-patches] [--real] [--readonly] [--json]',
+            'sks naruto run "<task>" [--clones N] [--backend codex-sdk|fake|ollama|local-llm] [--local-model|--ollama|--no-ollama] [--work-items N] [--write-mode parallel|serial|off] [--apply-patches] [--dry-run-patches] [--real] [--readonly] [--json]',
             'sks naruto status [--mission <id>] [--json]',
             'sks naruto proof latest [--messages 20] [--json]'
         ],
@@ -796,10 +796,19 @@ function parseNarutoArgs(args = []) {
     const workItemsExplicit = hasOption(args, '--work-items');
     const workItems = clampWorkItems(Number(readOption(args, '--work-items', clones * 2)), clones);
     const concurrency = normalizeConcurrency(readOption(args, '--concurrency', readOption(args, '--target-active-slots', null)), clones);
-    const useOllama = hasFlag(args, '--ollama') || hasFlag(args, '--local-model');
+    const useOllamaProtocol = hasFlag(args, '--ollama');
+    const useLocalModel = hasFlag(args, '--local-model');
+    const useOllama = useOllamaProtocol || useLocalModel;
     const noOllama = hasFlag(args, '--no-ollama') || hasFlag(args, '--no-local-model');
     const backendExplicit = hasOption(args, '--backend') || useOllama || noOllama;
-    const backend = String(readOption(args, '--backend', hasFlag(args, '--mock') ? 'fake' : useOllama && !noOllama ? 'ollama' : 'codex-sdk'));
+    const defaultBackend = hasFlag(args, '--mock')
+        ? 'fake'
+        : useLocalModel && !noOllama
+            ? 'local-llm'
+            : useOllamaProtocol && !noOllama
+                ? 'ollama'
+                : 'codex-sdk';
+    const backend = String(readOption(args, '--backend', defaultBackend));
     const mock = hasFlag(args, '--mock') || backend === 'fake';
     const real = hasFlag(args, '--real');
     const readonly = hasFlag(args, '--readonly') || hasFlag(args, '--read-only');

package/dist/core/commands/release-command.js

@@ -0,0 +1,52 @@
+import { spawnSync } from 'node:child_process';
+import { flag } from '../../cli/args.js';
+import { printJson } from '../../cli/output.js';
+import { projectRoot } from '../fsx.js';
+export async function releaseCommand(args = []) {
+    const root = await projectRoot();
+    const sub = args[0] && !args[0].startsWith('-') ? args[0] : 'affected';
+    const json = flag(args, '--json');
+    const command = commandForSubcommand(sub);
+    if (!command) {
+        console.error('Usage: sks release affected|full|background [--json]');
+        process.exitCode = 1;
+        return null;
+    }
+    const result = spawnSync('npm', ['run', command, '--silent'], {
+        cwd: root,
+        encoding: 'utf8',
+        maxBuffer: 1024 * 1024 * 20,
+        env: { ...process.env, CI: process.env.CI || 'true' }
+    });
+    const report = {
+        schema: 'sks.release-command.v1',
+        ok: result.status === 0,
+        subcommand: sub,
+        script: command,
+        status: result.status,
+        stdout_tail: tail(String(result.stdout || '')),
+        stderr_tail: tail(String(result.stderr || ''))
+    };
+    if (json)
+        return printJson(report);
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    if (!report.ok)
+        process.exitCode = result.status || 1;
+    return report;
+}
+function commandForSubcommand(sub) {
+    if (sub === 'affected')
+        return 'release:check:affected';
+    if (sub === 'full')
+        return 'release:check:full';
+    if (sub === 'background')
+        return 'release:check:full';
+    return null;
+}
+function tail(value, limit = 4000) {
+    return value.length > limit ? value.slice(-limit) : value;
+}
+//# sourceMappingURL=release-command.js.map

package/dist/core/commands/task-command.js

@@ -0,0 +1,15 @@
+import { checkCommand } from './check-command.js';
+export async function taskCommand(args = []) {
+    const sub = args[0] && !args[0].startsWith('-') ? args[0] : 'run';
+    const rest = sub === args[0] ? args.slice(1) : args;
+    if (sub === 'run')
+        return checkCommand(['--tier', 'confidence', ...rest]);
+    if (sub === 'affected')
+        return checkCommand(['--tier', 'affected', ...rest]);
+    if (sub === 'instant')
+        return checkCommand(['--tier', 'instant', ...rest]);
+    console.error('Usage: sks task run|affected|instant [--sla 5m] [--json]');
+    process.exitCode = 1;
+    return null;
+}
+//# sourceMappingURL=task-command.js.map

package/dist/core/commands/triwiki-command.js

@@ -0,0 +1,38 @@
+import { flag } from '../../cli/args.js';
+import { printJson } from '../../cli/output.js';
+import { projectRoot } from '../fsx.js';
+import { computeTriWikiAffectedGraph } from '../triwiki/triwiki-affected-graph.js';
+import { buildTriWikiGateImpactMap } from '../triwiki/triwiki-gate-impact-map.js';
+import { DEFAULT_TRIWIKI_MODULE_CARDS } from '../triwiki/triwiki-module-card.js';
+import { summarizeTriWikiProofBank } from '../triwiki/triwiki-proof-bank.js';
+export async function triwikiCommand(args = []) {
+    const root = await projectRoot();
+    const sub = args[0] && !args[0].startsWith('-') ? args[0] : 'index';
+    const json = flag(args, '--json');
+    let result;
+    if (sub === 'index') {
+        result = {
+            schema: 'sks.triwiki-index.v1',
+            ok: true,
+            modules: DEFAULT_TRIWIKI_MODULE_CARDS,
+            impact_map: buildTriWikiGateImpactMap(root),
+            proof_bank: summarizeTriWikiProofBank(root)
+        };
+    }
+    else if (sub === 'affected') {
+        result = computeTriWikiAffectedGraph({ root, tier: 'affected' });
+    }
+    else if (sub === 'proof-bank') {
+        result = summarizeTriWikiProofBank(root);
+    }
+    else {
+        console.error('Usage: sks triwiki index|affected|proof-bank [--json]');
+        process.exitCode = 1;
+        return null;
+    }
+    if (json)
+        return printJson(result);
+    console.log(JSON.stringify(result, null, 2));
+    return result;
+}
+//# sourceMappingURL=triwiki-command.js.map

package/dist/core/daemon/sksd-client.js

@@ -0,0 +1,9 @@
+import { sksdStatus, sksdStop, sksdWarm } from './sksd.js';
+export function runSksdClient(root, action) {
+    if (action === 'warm')
+        return sksdWarm(root);
+    if (action === 'stop')
+        return sksdStop(root);
+    return sksdStatus(root);
+}
+//# sourceMappingURL=sksd-client.js.map

package/dist/core/daemon/sksd.js

@@ -0,0 +1,55 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const SKSD_STATE_SCHEMA = 'sks.sksd-state.v1';
+export function sksdStatus(root) {
+    const state = readState(root);
+    return state || emptyState();
+}
+export function sksdWarm(root) {
+    const state = {
+        schema: SKSD_STATE_SCHEMA,
+        status: 'warm',
+        pid: process.pid,
+        warmed_at: new Date().toISOString(),
+        proof_bank_ready: true,
+        build_proof_ready: fs.existsSync(path.join(root, 'dist', '.sks-build-proof.json'))
+    };
+    writeState(root, state);
+    return state;
+}
+export function sksdStop(root) {
+    const state = { ...emptyState(), status: 'stopped' };
+    writeState(root, state);
+    return state;
+}
+function readState(root) {
+    const file = statePath(root);
+    try {
+        if (!fs.existsSync(file))
+            return null;
+        const json = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return json.schema === SKSD_STATE_SCHEMA ? json : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeState(root, state) {
+    const file = statePath(root);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`);
+}
+function statePath(root) {
+    return path.join(root, '.sneakoscope', 'cache', 'sksd-state.json');
+}
+function emptyState() {
+    return {
+        schema: SKSD_STATE_SCHEMA,
+        status: 'stopped',
+        pid: null,
+        warmed_at: null,
+        proof_bank_ready: false,
+        build_proof_ready: false
+    };
+}
+//# sourceMappingURL=sksd.js.map

package/dist/core/doctor/doctor-codex-startup-repair.js

@@ -104,9 +104,10 @@ async function inspectOrRepairConfig(candidate, fix, nodeReplCommandCandidates,
         const currentValid = Boolean(current && path.isAbsolute(current) && await exists(current));
         if (currentValid && current === target)
             continue;
-        warnings.push(`agent_config_file_stale:${tableName}`);
-        if (!fix)
+        if (!fix) {
+            warnings.push(`agent_config_file_stale:${tableName}`);
             continue;
+        }
         if (!targetExists) {
             await ensureDir(path.dirname(target));
             await writeTextAtomic(target, roleConfigToml(tableName, role.description, role.sandbox));

package/dist/core/doctor/doctor-dirty-planner.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const DOCTOR_DIRTY_PLAN_SCHEMA = 'sks.doctor-dirty-plan.v1';
+export function planDoctorDirtyRepair(root, phaseIds) {
+    const phases = phaseIds.map((id) => {
+        const marker = markerPath(root, id);
+        if (!fs.existsSync(marker))
+            return { id, status: 'dirty', reason: 'no_clean_marker' };
+        return { id, status: 'clean', reason: 'clean_marker_present' };
+    });
+    return {
+        schema: DOCTOR_DIRTY_PLAN_SCHEMA,
+        root,
+        phases,
+        dirty_count: phases.filter((phase) => phase.status === 'dirty').length,
+        clean_count: phases.filter((phase) => phase.status === 'clean').length
+    };
+}
+export function markDoctorPhaseClean(root, id) {
+    const file = markerPath(root, id);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${new Date().toISOString()}\n`);
+}
+export function isDoctorPhaseClean(plan, id) {
+    return plan?.phases.find((phase) => phase.id === id)?.status === 'clean';
+}
+function markerPath(root, id) {
+    return path.join(root, '.sneakoscope', 'cache', 'doctor-dirty', `${id.replace(/[^a-zA-Z0-9._-]+/g, '_')}.clean`);
+}
+//# sourceMappingURL=doctor-dirty-planner.js.map

package/dist/core/doctor/doctor-transaction.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { isDoctorPhaseClean, markDoctorPhaseClean } from './doctor-dirty-planner.js';
 export async function runDoctorFixTransaction(input) {
     const startedAt = nowIso();
     const phases = [];
@@ -18,6 +19,16 @@ export async function runDoctorFixTransaction(input) {
             artifact_path: null,
             started_at: phaseStarted
         };
+        if (isDoctorPhaseClean(input.dirtyPlan, definition.id)) {
+            phases.push({
+                ...phase,
+                ok: true,
+                warnings: ['dirty_plan_skipped_clean_phase'],
+                completed_at: nowIso(),
+                duration_ms: Math.max(0, Date.now() - startedMs)
+            });
+            continue;
+        }
         try {
             const result = await definition.run();
             phase = normalizePhase(definition, result, phase, startedMs);
@@ -48,6 +59,8 @@ export async function runDoctorFixTransaction(input) {
         }
         phase.completed_at = phase.completed_at || nowIso();
         phase.duration_ms = phase.duration_ms ?? Math.max(0, Date.now() - startedMs);
+        if (phase.ok)
+            markDoctorPhaseClean(input.root, definition.id);
         phases.push(phase);
     }
     const writeInput = {

package/dist/core/feature-fixtures.js

@@ -21,6 +21,7 @@ const FIXTURES = Object.freeze({
     'cli-hooks': fixture('mock', 'sks hooks trust-report --json', [], 'pass'),
     'cli-features': fixture('execute', 'sks features check --json', [], 'pass'),
     'cli-commands': fixture('execute', 'sks commands --json', [], 'pass'),
+    'cli-check': fixture('execute', 'sks check --tier confidence --sla 5m --plan --json', [], 'pass'),
     'cli-run': fixture('execute_and_validate_artifacts', 'sks run "fixture" --mock --json', ['run-classification.json', 'completion-proof.json', 'evidence-index.json', 'route-completion-contract.json', 'trust-report.json'], 'pass'),
     'cli-status': fixture('execute', 'sks status --json', [], 'pass'),
     'cli-usage': fixture('execute', 'sks usage overview', [], 'pass'),

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.13';
+export const PACKAGE_VERSION = '4.0.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/init.js

@@ -806,7 +806,13 @@ export async function initProject(root, opts = {}) {
             // Context7 credentials may live directly in this table as args/env/headers/url
             // depending on the user's MCP client setup. Seed the default only when absent;
             // never replace an existing Context7 block during setup/update.
-            { table: 'mcp_servers.context7', text: context7ConfigToml().trim(), preserveExisting: true },
+            // Seed the REMOTE (streamable HTTP `url`) transport, not local stdio: Codex
+            // merges the global ~/.codex/config.toml and the project config per-key, so a
+            // local-stdio `command` here merging with a remote `url` in the global config
+            // yields a stdio server that also carries a `url` — which Codex 0.140 rejects
+            // with `url is not supported for stdio`. Remote is also the transport the doctor
+            // migrates everyone to (local stdio can block interactive Codex launch).
+            { table: 'mcp_servers.context7', text: context7ConfigToml('remote').trim(), preserveExisting: true },
             { table: 'agents.native_agent', text: agentConfigBlock('native_agent', 'Read-only SKS analysis agent.', './agents/native-agent-intake.toml', ['Analysis', 'Mapper']) },
             { table: 'agents.team_consensus', text: agentConfigBlock('team_consensus', 'SKS planning/debate agent.', './agents/team-consensus.toml', ['Consensus', 'Atlas']) },
             { table: 'agents.implementation_worker', text: agentConfigBlock('implementation_worker', 'SKS bounded implementation worker.', './agents/implementation-worker.toml', ['Builder', 'Mason']) },