sneakoscope 3.1.14 → 4.0.1

package/README.md

@@ -35,7 +35,32 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.14** is a production-hardening release for Codex 0.140 evidence, transactional `sks doctor --fix` repair, MCP readiness, native capability proof, and protected-secret rollback.
+SKS **4.0.1** is the TriWiki Turbo completion release. It moves default completion toward affected-scope, release-equivalent proof with reusable TriWiki proof cards, real gate pack execution, SLA scheduling, build-once proof, probe memoization, and explicit legacy-runtime migration instead of silent fallback aliases.
+
+What changed in 4.0.1:
+
+- **TriWiki proof bank.** Proof cards now bind reusable gate proof to input hash, implementation hash, package lock hash, environment allowlist, fixture version, and tool version.
+- **Affected release-equivalent verification.** Changed files map to module cards, gate impact maps, and gate packs so small tasks can run fast without giving up scoped release confidence.
+- **Parallel SLA planning.** Release gate packs, resource budgets, and SLA certificates expose the planned critical path for five-minute foreground verification.
+- **New control surface.** `sks check`, `sks task`, `sks release`, `sks triwiki`, `sks proof bank status`, and `sks daemon` expose the fast proof pipeline.
+- **No silent legacy fallback.** Compatibility aliases are removed; removed runtimes now use explicit migration notices.
+
+SKS **3.1.16** was a launch-reliability patch on the 3.1.15 doctor-reliability release. It made `sks --mad` self-bootstrap a fresh project instead of dead-ending on a missing Codex config.
+
+What changed in 3.1.16:
+
+- **`sks --mad` bootstraps a fresh project.** When the only preflight blocker is a missing managed Codex config (`.codex/config.toml` absent), `sks --mad` now regenerates it — the `sks doctor --fix` equivalent — and re-runs the preflight, instead of blocking and making you run a separate command. An existing but unreadable/EPERM/parse-broken config still blocks and routes you to `sks doctor --fix`.
+- **Missing-config diagnostics are honest.** A missing config no longer cascades into misleading `macos_acl_ls_le_failed` / `macos_flags_ls_lO_failed` / `spawned_child_read_failed` blockers from running file checks on a nonexistent path; the preflight reports only `missing_config` / `missing_codex_dir`.
+
+SKS **3.1.15** was a doctor-reliability patch on the 3.1.14 production-hardening release. It ended the endless `sks doctor --fix` loop that kept reporting `codex_cli_config_toml_parse_error` / `cli_ready: no` on the very run that already repaired the config.
+
+What changed in 3.1.15:
+
+- **`sks doctor --fix` no longer loops on a config it already fixed.** The Codex config-load probe is re-run *after* the Context7/Supabase/startup MCP repairs land, so the readiness verdict reflects the repaired config instead of the stale pre-repair snapshot.
+- **Context7 is seeded on the remote transport.** Managed setup writes `[mcp_servers.context7]` with the streamable-HTTP `url` instead of a local stdio `command`, so the project config never merges with a remote `url` in the global Codex config into the `url is not supported for stdio` error Codex 0.140 rejects.
+- **The config-load operator action is accurate.** A `codex_cli_config_toml_parse_error` now points at both misplaced machine-local keys *and* the Context7/MCP stdio-vs-`url` transport conflict, instead of only suggesting a key hoist that does nothing for a transport conflict.
+
+The 3.1.14 production-hardening surface for Codex 0.140 evidence, transactional `sks doctor --fix` repair, MCP readiness, native capability proof, and protected-secret rollback remains intact.
 
 What changed in 3.1.14:
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.14"
+version = "4.0.1"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.14"
+version = "4.0.1"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.14"),
+        Some("--version") => println!("sks-rs 4.0.1"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.14';
+const FAST_PACKAGE_VERSION = '4.0.1';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/command-registry.js

@@ -77,6 +77,11 @@ export const COMMANDS = {
     help: entry('stable', 'Show SKS help', 'dist/commands/help.js', directCommand(() => import('../commands/help.js'), 'dist/commands/help.js')),
     version: entry('stable', 'Show SKS version', 'dist/commands/version.js', directCommand(() => import('../commands/version.js'), 'dist/commands/version.js')),
     commands: entry('stable', 'List SKS commands', 'dist/core/commands/basic-cli.js', basicArgs('commandsCommand')),
+    check: entry('stable', 'Run five-minute proof-bank affected checks', 'dist/core/commands/check-command.js', argsCommand(() => import('../core/commands/check-command.js'), 'checkCommand', 'dist/core/commands/check-command.js')),
+    task: entry('stable', 'Run an SLA-bounded SKS task check', 'dist/core/commands/task-command.js', argsCommand(() => import('../core/commands/task-command.js'), 'taskCommand', 'dist/core/commands/task-command.js')),
+    release: entry('stable', 'Run affected/full/background release gates', 'dist/core/commands/release-command.js', argsCommand(() => import('../core/commands/release-command.js'), 'releaseCommand', 'dist/core/commands/release-command.js')),
+    triwiki: entry('stable', 'Inspect TriWiki index, affected graph, and proof bank', 'dist/core/commands/triwiki-command.js', argsCommand(() => import('../core/commands/triwiki-command.js'), 'triwikiCommand', 'dist/core/commands/triwiki-command.js')),
+    daemon: entry('stable', 'Inspect or warm the local SKS daemon cache', 'dist/core/commands/daemon-command.js', argsCommand(() => import('../core/commands/daemon-command.js'), 'daemonCommand', 'dist/core/commands/daemon-command.js')),
     run: entry('beta', 'Classify and execute a task through the SKS trust kernel', 'dist/core/commands/run-command.js', argsCommand(() => import('../core/commands/run-command.js'), 'runCommand', 'dist/core/commands/run-command.js')),
     status: entry('stable', 'Show concise active mission and trust status', 'dist/core/commands/status-command.js', argsCommand(() => import('../core/commands/status-command.js'), 'statusCommand', 'dist/core/commands/status-command.js')),
     root: entry('stable', 'Show active SKS root', 'dist/commands/root.js', directCommand(() => import('../commands/root.js'), 'dist/commands/root.js')),
@@ -159,19 +164,7 @@ export const COMMANDS = {
     bench: entry('beta', 'Run core trust-kernel benchmark budgets', 'dist/core/commands/bench-command.js', argsCommand(() => import('../core/commands/bench-command.js'), 'benchCommand', 'dist/core/commands/bench-command.js'))
 };
 export const TYPED_COMMANDS = COMMANDS;
-export const LEGACY_COMMAND_ALIASES = {
-    auth: 'codex-lb',
-    mad: 'mad-sks',
-    autoreview: 'auto-review',
-    dollars: 'dollar-commands',
-    '$': 'dollar-commands',
-    'ux-review': 'image-ux-review',
-    'visual-review': 'image-ux-review',
-    'ui-ux-review': 'image-ux-review',
-    cu: 'computer-use',
-    grok: 'xai',
-    memory: 'gc'
-};
+export const LEGACY_COMMAND_ALIASES = {};
 export const COMMAND_ALIASES = {
     ...LEGACY_COMMAND_ALIASES,
     '--help': 'help',

package/dist/commands/doctor.js

@@ -35,6 +35,7 @@ import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-re
 import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
 import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
 import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { planDoctorDirtyRepair } from '../core/doctor/doctor-dirty-planner.js';
 import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 export async function run(_command, args = []) {
@@ -143,7 +144,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const migrationJournal = flag(args, '--fix')
         ? await writeFixMigrationJournal(root, migrationPreFix, configRepair, setupRepair).catch(() => null)
         : null;
-    const codexConfig = configRepair?.after || await inspectCodexConfigReadability(root, configProbeOpts);
+    let codexConfig = configRepair?.after || await inspectCodexConfigReadability(root, configProbeOpts);
     const codexDoctor = await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') });
     const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, codexDoctor);
     codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, codexDoctor);
@@ -284,9 +285,22 @@ async function runDoctor(args = [], root, doctorFix) {
             raw_secret_values_recorded: false
         }))
         : null;
+    const doctorDirtyPlan = doctorFix
+        ? planDoctorDirtyRepair(root, [
+            'setup',
+            'codex_startup_repair',
+            'startup_config_repair',
+            'context7_repair',
+            'context7_mcp_repair',
+            'supabase_mcp_repair',
+            'command_alias_cleanup',
+            'native_capability_repair'
+        ])
+        : null;
     const doctorFixTransaction = doctorFix
         ? await runDoctorFixTransaction({
             root,
+            dirtyPlan: doctorDirtyPlan,
             phases: [
                 {
                     id: 'setup',
@@ -459,6 +473,18 @@ async function runDoctor(args = [], root, doctorFix) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    // Re-probe the Codex config AFTER the MCP transport repairs (Context7 remote
+    // migration, Supabase read-only, startup config) have landed. `repairCodexConfigEperm`
+    // ran its config-load probe ~before~ those repairs, so a config that those repairs
+    // fix in THIS run would otherwise keep `codexConfig.ok === false`, making the doctor
+    // report `cli_ready: no` / `codex_cli_config_toml_parse_error` on the very run that
+    // fixed it — the endless "rerun sks doctor --fix" loop. Only re-probe when the initial
+    // probe failed and we are in --fix mode, so healthy configs pay no extra probe cost.
+    if (doctorFix && codexConfig?.ok === false) {
+        const reinspected = await inspectCodexConfigReadability(root, configProbeOpts).catch(() => null);
+        if (reinspected)
+            codexConfig = reinspected;
+    }
     const pkgBytes = await dirSize(root).catch(() => 0);
     const ready = await writeDoctorReadinessMatrix(root, {
         codex,
@@ -474,6 +500,7 @@ async function runDoctor(args = [], root, doctorFix) {
         context7_mcp_repair: context7McpRepair,
         supabase_mcp_repair: supabaseMcpRepair,
         doctor_fix_transaction: doctorFixTransaction,
+        doctor_dirty_plan: doctorDirtyPlan,
         doctor_fix_postcheck: doctorFixPostcheck,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
@@ -540,7 +567,7 @@ async function runDoctor(args = [], root, doctorFix) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, doctor_transaction: doctorFixTransaction, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
     };
     if (flag(args, '--json')) {
         printJson(result);

package/dist/commands/proof.js

@@ -9,10 +9,18 @@ import { finalizeRouteWithProof } from '../core/proof/route-finalizer.js';
 import { renderProofMarkdown, writeCompletionProof } from '../core/proof/proof-writer.js';
 import { validateCompletionProof } from '../core/proof/validation.js';
 import { buildRuntimeProofSummary, renderRuntimeProofSummary } from '../core/agents/runtime-proof-summary.js';
+import { summarizeTriWikiProofBank } from '../core/triwiki/triwiki-proof-bank.js';
 export async function run(_command, args = []) {
     const root = await projectRoot();
     const action = args[0] || 'show';
     const rest = args.slice(1);
+    if (action === 'bank' && rest[0] === 'status') {
+        const status = summarizeTriWikiProofBank(root);
+        if (flag(args, '--json'))
+            return printJson(status);
+        console.log(JSON.stringify(status, null, 2));
+        return;
+    }
     if (action === 'latest' && !flag(args, '--completion')) {
         const runtime = await tryRuntimeProofSummary(root);
         if (runtime) {

package/dist/core/build/build-once-runner.js

@@ -0,0 +1,66 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { computeTriWikiCacheKey } from '../triwiki/triwiki-cache-key.js';
+export const BUILD_ONCE_PROOF_SCHEMA = 'sks.build-once-proof.v1';
+export function runBuildOnce(input) {
+    const mode = input.mode || 'incremental';
+    const key = computeTriWikiCacheKey({
+        root: input.root,
+        id: `build-once:${mode}`,
+        inputs: ['src/**/*.ts', 'package.json', 'package-lock.json', 'tsconfig.json'],
+        implementationFiles: ['tsconfig.json'],
+        envAllowlist: ['NODE_ENV', 'CI'],
+        fixtureVersion: 'sks-4.0.1'
+    });
+    const existing = readBuildOnceProof(input.root);
+    if (!input.force && existing?.ok === true && existing.cache_key === key.key) {
+        return { ...existing, reused: true };
+    }
+    const started = Date.now();
+    const run = spawnSync('npm', ['run', mode === 'clean' ? 'build:clean' : 'build:incremental', '--silent'], {
+        cwd: input.root,
+        encoding: 'utf8',
+        maxBuffer: 1024 * 1024 * 20,
+        env: { ...process.env, CI: process.env.CI || 'true' }
+    });
+    const proof = {
+        schema: BUILD_ONCE_PROOF_SCHEMA,
+        ok: run.status === 0,
+        mode,
+        cache_key: key.key,
+        source_hash: key.input_hash,
+        package_lock_hash: key.package_lock_hash,
+        tsconfig_hash: computeTriWikiCacheKey({ root: input.root, id: 'build-once:tsconfig', inputs: ['tsconfig.json'] }).input_hash,
+        dist_hash: computeTriWikiCacheKey({ root: input.root, id: 'build-once:dist', inputs: ['dist'] }).input_hash,
+        created_at: new Date().toISOString(),
+        status: run.status,
+        duration_ms: Math.max(0, Date.now() - started),
+        reused: false,
+        blockers: run.status === 0 ? [] : [`build_failed:${run.status ?? 'signal'}`]
+    };
+    writeBuildOnceProof(input.root, proof);
+    return proof;
+}
+export function readBuildOnceProof(root) {
+    const file = buildProofPath(root);
+    try {
+        if (!fs.existsSync(file))
+            return null;
+        const json = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return json.schema === BUILD_ONCE_PROOF_SCHEMA ? json : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeBuildOnceProof(root, proof) {
+    const file = buildProofPath(root);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(proof, null, 2)}\n`);
+    return file;
+}
+function buildProofPath(root) {
+    return path.join(root, 'dist', '.sks-build-proof.json');
+}
+//# sourceMappingURL=build-once-runner.js.map

package/dist/core/codex/codex-config-readability.js

@@ -17,50 +17,64 @@ export async function inspectCodexConfigReadability(rootInput = process.cwd(), o
             classifyBlocker(check).forEach((blocker) => blockers.add(blocker));
     };
     add(await accessCheck('codex_dir_exists', configDir, fs.constants.R_OK | fs.constants.X_OK));
-    add(await accessCheck('project_config_exists', configPath, fs.constants.R_OK));
+    const projectConfigExists = await accessCheck('project_config_exists', configPath, fs.constants.R_OK);
+    add(projectConfigExists);
     for (const dir of parentDirsFor(root, configPath)) {
         add(await accessCheck('parent_traverse', dir, fs.constants.X_OK));
     }
-    const lstatCheck = await statCheck('config_lstat', configPath, 'lstat');
-    add(lstatCheck);
-    const stat = await statCheck('config_stat', configPath, 'stat');
-    add(stat);
-    if (stat.ok) {
-        add({ name: 'config_owner', ok: true, detail: { uid: stat.detail.uid, gid: stat.detail.gid } });
-        add({ name: 'config_mode', ok: true, detail: { mode: stat.detail.mode_octal } });
-    }
-    if (lstatCheck.ok) {
-        const isSymlink = Boolean(lstatCheck.detail.is_symbolic_link);
-        const symlinkDetail = { is_symlink: isSymlink };
-        if (isSymlink) {
-            symlinkDetail.realpath = await fsp.realpath(configPath).catch((err) => ({ error: errorDetail(err) }));
-            symlinkDetail.allowed = typeof symlinkDetail.realpath === 'string' && symlinkTargetAllowed(symlinkDetail.realpath, root, opts);
-            if (!symlinkDetail.allowed)
-                blockers.add('symlink_escape');
+    // Fresh project: the managed config simply does not exist yet. Every downstream check
+    // (stat, symlink, macOS ACL/flags/xattr, node/child read, codex config load) would
+    // operate on a nonexistent path and fail with ENOENT, turning the single real cause —
+    // a missing config — into a misleading cascade (`macos_acl_ls_le_failed`,
+    // `macos_flags_ls_lO_failed`, `spawned_child_read_failed`, ...). Skip them and report
+    // only the honest `missing_config` / `missing_codex_dir` blocker so the caller can
+    // regenerate the managed config instead of chasing phantom ACL/permission problems.
+    const configMissing = projectConfigExists.error?.code === 'ENOENT';
+    if (!configMissing) {
+        const lstatCheck = await statCheck('config_lstat', configPath, 'lstat');
+        add(lstatCheck);
+        const stat = await statCheck('config_stat', configPath, 'stat');
+        add(stat);
+        if (stat.ok) {
+            add({ name: 'config_owner', ok: true, detail: { uid: stat.detail.uid, gid: stat.detail.gid } });
+            add({ name: 'config_mode', ok: true, detail: { mode: stat.detail.mode_octal } });
         }
-        add({ name: 'config_symlink', ok: !isSymlink || symlinkDetail.allowed === true, detail: symlinkDetail });
-    }
-    if (process.platform === 'darwin') {
-        add(await commandCheck('macos_acl_ls_le', 'ls', ['-le', configPath], root));
-        const acl = checks.find((check) => check.name === 'macos_acl_ls_le');
-        if (/\bdeny\b.*\b(read|readattr|readextattr|readsecurity|search)\b/i.test(String(acl?.detail?.stdout || '')))
-            blockers.add('acl_denied');
-        const flags = await commandCheck('macos_flags_ls_lO', 'ls', ['-lO', configPath], root);
-        add(flags);
-        if (/\b(uchg|schg|restricted)\b/.test(String(flags.detail?.stdout || '')))
-            blockers.add('flags_locked');
-        const xattrs = await commandCheck('macos_xattr', 'xattr', ['-l', configPath], root, { allowExitCodes: [0, 1] });
-        add(xattrs);
-        add({ name: 'macos_quarantine_xattr', ok: !/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')), detail: { present: /com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')) } });
-        if (/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')))
-            blockers.add('quarantine');
+        if (lstatCheck.ok) {
+            const isSymlink = Boolean(lstatCheck.detail.is_symbolic_link);
+            const symlinkDetail = { is_symlink: isSymlink };
+            if (isSymlink) {
+                symlinkDetail.realpath = await fsp.realpath(configPath).catch((err) => ({ error: errorDetail(err) }));
+                symlinkDetail.allowed = typeof symlinkDetail.realpath === 'string' && symlinkTargetAllowed(symlinkDetail.realpath, root, opts);
+                if (!symlinkDetail.allowed)
+                    blockers.add('symlink_escape');
+            }
+            add({ name: 'config_symlink', ok: !isSymlink || symlinkDetail.allowed === true, detail: symlinkDetail });
+        }
+        if (process.platform === 'darwin') {
+            add(await commandCheck('macos_acl_ls_le', 'ls', ['-le', configPath], root));
+            const acl = checks.find((check) => check.name === 'macos_acl_ls_le');
+            if (/\bdeny\b.*\b(read|readattr|readextattr|readsecurity|search)\b/i.test(String(acl?.detail?.stdout || '')))
+                blockers.add('acl_denied');
+            const flags = await commandCheck('macos_flags_ls_lO', 'ls', ['-lO', configPath], root);
+            add(flags);
+            if (/\b(uchg|schg|restricted)\b/.test(String(flags.detail?.stdout || '')))
+                blockers.add('flags_locked');
+            const xattrs = await commandCheck('macos_xattr', 'xattr', ['-l', configPath], root, { allowExitCodes: [0, 1] });
+            add(xattrs);
+            add({ name: 'macos_quarantine_xattr', ok: !/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')), detail: { present: /com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')) } });
+            if (/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')))
+                blockers.add('quarantine');
+        }
+        else {
+            add({ name: 'macos_metadata', ok: true, status: 'skipped_non_macos' });
+        }
+        add(await nodeReadCheck(configPath));
+        add(await childReadCheck(configPath, root));
+        add(await codexCliConfigLoadCheck(root, configPath, opts));
     }
     else {
-        add({ name: 'macos_metadata', ok: true, status: 'skipped_non_macos' });
+        add({ name: 'config_file_checks', ok: true, status: 'skipped_config_missing', detail: { config_path: configPath } });
     }
-    add(await nodeReadCheck(configPath));
-    add(await childReadCheck(configPath, root));
-    add(await codexCliConfigLoadCheck(root, configPath, opts));
     const report = {
         schema: CODEX_CONFIG_READABILITY_SCHEMA,
         generated_at: nowIso(),
@@ -176,7 +190,7 @@ function operatorActions(blockers) {
     if (blockers.some((item) => /^missing_/.test(item)))
         actions.add('Run `sks doctor --fix` to regenerate the managed Codex project config, then rerun the preflight.');
     if (blockers.includes('codex_cli_config_toml_parse_error'))
-        actions.add('Run `sks doctor --fix` (or `sks mad repair-config --apply`) to hoist misplaced machine-local keys back to the top of the Codex config and restore a loadable config.toml.');
+        actions.add('Run `sks doctor --fix` (or `sks mad repair-config --apply`) to restore a loadable config.toml. This hoists misplaced machine-local keys back to the top of the file AND migrates a local-stdio Context7/MCP server that conflicts with a remote `url` (the "url is not supported for stdio" error, caused by the global and project configs merging) to the supported transport. If `sks doctor --fix` already reports the Context7/MCP transport repaired, the config is fixed — rerun once to confirm `cli_ready`.');
     if (blockers.includes('codex_cli_config_eperm'))
         actions.add('Run `sks mad repair-config --apply`; if it still fails on macOS, grant Full Disk Access/Files and Folders access to the launching terminal, Warp, iTerm, Terminal, Codex app, or Codex CLI context.');
     if (blockers.includes('EPERM') || blockers.includes('tcc_possible'))

package/dist/core/commands/check-command.js

@@ -0,0 +1,132 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { flag } from '../../cli/args.js';
+import { printJson } from '../../cli/output.js';
+import { projectRoot } from '../fsx.js';
+const CHECK_SCHEMA = 'sks.check.v1';
+export async function checkCommand(args = []) {
+    const root = await projectRoot();
+    const tier = readArg(args, '--tier', positionalTier(args) || 'confidence');
+    const sla = readArg(args, '--sla', '5m');
+    const changedSince = readArg(args, '--changed-since', 'auto');
+    const json = flag(args, '--json');
+    const planOnly = flag(args, '--plan');
+    const triwiki = !flag(args, '--no-triwiki');
+    const plan = buildCheckPlan({ tier, sla, changedSince, triwiki });
+    if (planOnly) {
+        const result = { schema: CHECK_SCHEMA, ok: true, mode: 'plan', ...plan };
+        if (json)
+            return printJson(result);
+        printPlan(result);
+        return result;
+    }
+    const steps = [];
+    let proofBankSummary = null;
+    for (const step of plan.steps) {
+        const result = spawnSync(step.command, step.args, {
+            cwd: root,
+            encoding: 'utf8',
+            maxBuffer: 1024 * 1024 * 20,
+            shell: false,
+            env: { ...process.env, CI: process.env.CI || 'true' }
+        });
+        const ok = result.status === 0;
+        if (step.name === 'proof-bank-summary')
+            proofBankSummary = parseJsonObject(String(result.stdout || ''));
+        steps.push({ name: step.name, ok, status: result.status, stderr_tail: tail(String(result.stderr || '')) });
+        if (!json) {
+            if (result.stdout)
+                process.stdout.write(result.stdout);
+            if (result.stderr)
+                process.stderr.write(result.stderr);
+        }
+        if (!ok) {
+            const failed = { schema: CHECK_SCHEMA, ok: false, mode: 'run', ...plan, steps, completion_certificate: latestCertificate(root) || proofBankSummary?.completion_certificate || null, release_speed_summary: proofBankSummary };
+            if (json)
+                return printJson(failed);
+            process.exitCode = result.status || 1;
+            return failed;
+        }
+    }
+    const result = { schema: CHECK_SCHEMA, ok: true, mode: 'run', ...plan, steps, completion_certificate: latestCertificate(root) || proofBankSummary?.completion_certificate || null, release_speed_summary: proofBankSummary };
+    if (json)
+        return printJson(result);
+    if (result.completion_certificate) {
+        console.log(`SKS check certificate: ${result.completion_certificate.confidence} sla_met=${result.completion_certificate.sla_met}`);
+    }
+    return result;
+}
+function buildCheckPlan(input) {
+    const tier = normalizeTier(input.tier);
+    const buildScript = tier === 'release' ? 'build:clean' : 'build:incremental';
+    const steps = [];
+    if (tier === 'instant') {
+        steps.push({ name: 'proof-bank-summary', command: process.execPath, args: ['dist/scripts/release-speed-summary.js'] });
+    }
+    else if (tier === 'real-check') {
+        steps.push({ name: 'real-check', command: process.execPath, args: ['dist/scripts/release-real-check.js'] });
+    }
+    else {
+        steps.push({ name: buildScript, command: 'npm', args: ['run', buildScript, '--silent'] });
+        steps.push({ name: `release:${tier}`, command: process.execPath, args: dagArgs(tier, input.changedSince, input.sla) });
+    }
+    return {
+        tier,
+        sla: input.sla,
+        triwiki: input.triwiki,
+        changed_since: input.changedSince,
+        build_once: tier === 'release' ? 'clean' : tier === 'real-check' || tier === 'instant' ? 'not_applicable' : 'incremental',
+        steps
+    };
+}
+function dagArgs(tier, changedSince, sla) {
+    if (tier === 'release')
+        return ['dist/scripts/release-gate-dag-runner.js', '--preset', 'release', '--full'];
+    const preset = tier === 'instant' ? 'fast' : tier === 'affected' || tier === 'confidence' ? 'affected' : tier;
+    return ['dist/scripts/release-gate-dag-runner.js', '--preset', preset, '--changed-since', changedSince, '--sla', sla];
+}
+function latestCertificate(root) {
+    const direct = path.join(root, '.sneakoscope', 'reports', 'completion-certificate.json');
+    if (fs.existsSync(direct))
+        return JSON.parse(fs.readFileSync(direct, 'utf8'));
+    const base = path.join(root, '.sneakoscope', 'reports', 'release-gates');
+    if (!fs.existsSync(base))
+        return null;
+    const latest = fs.readdirSync(base)
+        .map((name) => path.join(base, name, 'completion-certificate.json'))
+        .filter((file) => fs.existsSync(file))
+        .sort((a, b) => fs.statSync(b).mtimeMs - fs.statSync(a).mtimeMs)[0];
+    return latest ? JSON.parse(fs.readFileSync(latest, 'utf8')) : null;
+}
+function normalizeTier(value) {
+    const tier = String(value || '').trim().toLowerCase();
+    if (['instant', 'affected', 'confidence', 'release', 'real-check'].includes(tier))
+        return tier;
+    return 'confidence';
+}
+function positionalTier(args) {
+    const first = args.find((arg) => !arg.startsWith('-'));
+    return first || null;
+}
+function readArg(args, name, fallback) {
+    const index = args.indexOf(name);
+    return index >= 0 && args[index + 1] ? String(args[index + 1]) : fallback;
+}
+function tail(value, limit = 1200) {
+    return value.length > limit ? value.slice(-limit) : value;
+}
+function parseJsonObject(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function printPlan(result) {
+    console.log(`SKS check plan: tier=${result.tier} sla=${result.sla} build=${result.build_once}`);
+    for (const step of result.steps)
+        console.log(`- ${step.name}: ${[step.command, ...step.args].join(' ')}`);
+}
+//# sourceMappingURL=check-command.js.map

package/dist/core/commands/daemon-command.js

@@ -0,0 +1,14 @@
+import { flag } from '../../cli/args.js';
+import { printJson } from '../../cli/output.js';
+import { projectRoot } from '../fsx.js';
+import { runSksdClient } from '../daemon/sksd-client.js';
+export async function daemonCommand(args = []) {
+    const root = await projectRoot();
+    const action = args[0] === 'warm' || args[0] === 'stop' || args[0] === 'status' ? args[0] : 'status';
+    const state = runSksdClient(root, action);
+    if (flag(args, '--json'))
+        return printJson(state);
+    console.log(JSON.stringify(state, null, 2));
+    return state;
+}
+//# sourceMappingURL=daemon-command.js.map

package/dist/core/commands/mad-sks-command.js

@@ -135,7 +135,24 @@ export async function madHighCommand(args = [], deps = {}) {
     // readability + repair checks still run. SKS_LAUNCH_FULL_CODEX_PROBE=1 restores the
     // old behavior.
     const allowMadRepair = rawArgs.includes('--repair-config') || rawArgs.includes('--fix') || rawArgs.includes('--yes-repair');
-    const launchPreflight = await runCodexLaunchPreflight(launchRoot, { fix: allowMadRepair, launchFast: process.env.SKS_LAUNCH_FULL_CODEX_PROBE !== '1', profile: profile.profile_name, sandbox: 'danger-full-access', serviceTier: 'fast' });
+    const launchPreflightOpts = { fix: allowMadRepair, launchFast: process.env.SKS_LAUNCH_FULL_CODEX_PROBE !== '1', profile: profile.profile_name, sandbox: 'danger-full-access', serviceTier: 'fast' };
+    let launchPreflight = await runCodexLaunchPreflight(launchRoot, launchPreflightOpts);
+    // Fresh-project bootstrap: when the ONLY blocker is that the managed Codex config does
+    // not exist yet (`.codex/config.toml` absent), regenerate it — exactly what the blocker
+    // action tells the user to run via `sks doctor --fix` — and re-run the preflight once,
+    // instead of blocking the launch on a trivially-fixable missing config. An EXISTING but
+    // unreadable/broken config is NOT auto-fixed here: it still blocks and routes the user
+    // to `sks doctor --fix`, so genuine permission/EPERM/parse problems are never masked.
+    if (!launchPreflight.ok && !fs.existsSync(path.join(launchRoot, '.codex', 'config.toml'))) {
+        try {
+            await initProject(launchRoot, { installScope: rawArgs.includes('--local-only') ? 'project' : 'global', localOnly: rawArgs.includes('--local-only'), globalCommand: 'sks' });
+            console.error('SKS MAD bootstrapped the missing managed Codex config (`sks doctor --fix` equivalent) and re-ran preflight.');
+            launchPreflight = await runCodexLaunchPreflight(launchRoot, launchPreflightOpts);
+        }
+        catch (bootstrapErr) {
+            console.error(`SKS MAD could not bootstrap the managed Codex config: ${bootstrapErr?.message || bootstrapErr}. Run \`sks doctor --fix\`.`);
+        }
+    }
     const afterPreflightUi = beforeUi ? await writeCodexAppUiSnapshot(launchRoot, `mad-after-preflight-${uiSnapshotId}`).catch(() => null) : null;
     const preflightUiDiff = beforeUi && afterPreflightUi ? diffCodexAppUiSnapshots(beforeUi, afterPreflightUi) : null;
     if (preflightUiDiff && !preflightUiDiff.ok) {
@@ -217,10 +234,15 @@ export async function madHighCommand(args = [], deps = {}) {
         SKS_MAD_SKS_PROTECTED_CORE_DIGEST: madLaunch.gate.protected_core_digest
     };
     const launchOpts = codexLbImmediateLaunchOpts(cleanArgs, launchLb, { codexArgs: profile.launch_args, conciseBlockers: true, madSksEnv, launchEnv: madSksEnv });
-    const workspace = readOption(cleanArgs, '--workspace', readOption(cleanArgs, '--session', launchOpts.session || `sks-mad-${sanitizeZellijSessionName(process.cwd())}`));
+    const explicitWorkspace = readOption(cleanArgs, '--workspace', readOption(cleanArgs, '--session', null));
+    // Only the auto-derived stable `sks-mad-<cwd>` name accumulates panes across
+    // runs; when the user names a session explicitly (or codex-lb already minted a
+    // fresh unique session) respect it and skip the reset.
+    const autoDerivedMadSession = !explicitWorkspace && !launchOpts.session;
+    const workspace = explicitWorkspace || launchOpts.session || `sks-mad-${sanitizeZellijSessionName(process.cwd())}`;
     const launch = headlessZellij
         ? await writeMadHeadlessZellijFallback(madLaunch, workspace)
-        : await launchMadZellijUi([...cleanArgs, '--workspace', workspace], { ...launchOpts, missionId: madLaunch.mission_id, root: madLaunch.root, cwd: process.cwd(), ledgerRoot: path.join(madLaunch.dir, 'agents'), slotCount: 0, requireZellij: process.env.SKS_REQUIRE_ZELLIJ === '1' });
+        : await launchMadZellijUi([...cleanArgs, '--workspace', workspace], { ...launchOpts, missionId: madLaunch.mission_id, root: madLaunch.root, cwd: process.cwd(), ledgerRoot: path.join(madLaunch.dir, 'agents'), slotCount: 0, freshSession: autoDerivedMadSession, requireZellij: process.env.SKS_REQUIRE_ZELLIJ === '1' });
     const afterLaunchUi = beforeUi ? await writeCodexAppUiSnapshot(launchRoot, `mad-after-launch-${uiSnapshotId}`).catch(() => null) : null;
     const launchUiDiff = beforeUi && afterLaunchUi ? diffCodexAppUiSnapshots(beforeUi, afterLaunchUi) : null;
     if (launchUiDiff) {

package/dist/core/commands/release-command.js

@@ -0,0 +1,52 @@
+import { spawnSync } from 'node:child_process';
+import { flag } from '../../cli/args.js';
+import { printJson } from '../../cli/output.js';
+import { projectRoot } from '../fsx.js';
+export async function releaseCommand(args = []) {
+    const root = await projectRoot();
+    const sub = args[0] && !args[0].startsWith('-') ? args[0] : 'affected';
+    const json = flag(args, '--json');
+    const command = commandForSubcommand(sub);
+    if (!command) {
+        console.error('Usage: sks release affected|full|background [--json]');
+        process.exitCode = 1;
+        return null;
+    }
+    const result = spawnSync('npm', ['run', command, '--silent'], {
+        cwd: root,
+        encoding: 'utf8',
+        maxBuffer: 1024 * 1024 * 20,
+        env: { ...process.env, CI: process.env.CI || 'true' }
+    });
+    const report = {
+        schema: 'sks.release-command.v1',
+        ok: result.status === 0,
+        subcommand: sub,
+        script: command,
+        status: result.status,
+        stdout_tail: tail(String(result.stdout || '')),
+        stderr_tail: tail(String(result.stderr || ''))
+    };
+    if (json)
+        return printJson(report);
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    if (!report.ok)
+        process.exitCode = result.status || 1;
+    return report;
+}
+function commandForSubcommand(sub) {
+    if (sub === 'affected')
+        return 'release:check:affected';
+    if (sub === 'full')
+        return 'release:check:full';
+    if (sub === 'background')
+        return 'release:check:full';
+    return null;
+}
+function tail(value, limit = 4000) {
+    return value.length > limit ? value.slice(-limit) : value;
+}
+//# sourceMappingURL=release-command.js.map