sneakoscope 3.1.3 → 3.1.5

package/dist/core/codex-app/codex-agent-type-probe.js

@@ -0,0 +1,202 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
+import { isRecord } from './codex-app-types.js';
+export async function probeCodexAgentTypeSupport(root, input = {}) {
+    const env = input.env || process.env;
+    const fixture = await fixtureSchemaProbe(env);
+    if (fixture)
+        return persist(root, fixture, input.writeReport !== false);
+    const schema = await readSchemaFromEnv(env);
+    if (schema)
+        return persist(root, probeSchema(schema.value, schema.source, schema.schemaPath), input.writeReport !== false);
+    const doctor = await probeDoctorJson(input.codexBin, env);
+    if (doctor.source !== 'unknown')
+        return persist(root, doctor, input.writeReport !== false);
+    const help = await probeHelp(input.codexBin, env);
+    if (help.source !== 'unknown')
+        return persist(root, help, input.writeReport !== false);
+    const envProbe = envFallbackProbe(env);
+    if (envProbe)
+        return persist(root, envProbe, input.writeReport !== false);
+    return persist(root, {
+        schema: 'sks.codex-agent-type-probe.v1',
+        generated_at: nowIso(),
+        ok: true,
+        supported: false,
+        source: 'unknown',
+        spawn_tool_name: 'unknown',
+        schema_path: null,
+        evidence: [],
+        blockers: [],
+        warnings: ['agent_type_support_unknown_message_role_fallback']
+    }, input.writeReport !== false);
+}
+export function agentRolePayloadFor(role, probe) {
+    if (probe.supported)
+        return { strategy: 'agent_type', agent_type: role, probe_artifact_path: '.sneakoscope/reports/codex-agent-type-probe.json' };
+    return {
+        strategy: 'message-role',
+        message_role_prefix: `Role: ${role}. Use this as a message-level role because native agent_type is unavailable or unverified.`,
+        probe_artifact_path: '.sneakoscope/reports/codex-agent-type-probe.json'
+    };
+}
+async function fixtureSchemaProbe(env) {
+    const raw = env.SKS_CODEX_AGENT_TYPE_FIXTURE;
+    if (!raw)
+        return null;
+    const supported = raw === '1' || raw === 'supported' || raw === 'true';
+    return {
+        schema: 'sks.codex-agent-type-probe.v1',
+        generated_at: nowIso(),
+        ok: true,
+        supported,
+        source: 'fixture',
+        spawn_tool_name: supported ? 'spawn_agent' : 'unknown',
+        schema_path: supported ? 'fixture.spawn_agent.parameters.agent_type' : null,
+        evidence: [`fixture:${raw}`],
+        blockers: [],
+        warnings: []
+    };
+}
+async function readSchemaFromEnv(env) {
+    if (env.SKS_CODEX_TOOL_SCHEMA_FILE) {
+        const file = path.resolve(env.SKS_CODEX_TOOL_SCHEMA_FILE);
+        const text = await fs.readFile(file, 'utf8').catch(() => '');
+        if (text)
+            return { value: JSON.parse(text), source: 'codex-tool-schema', schemaPath: file };
+    }
+    if (env.SKS_CODEX_TOOL_SCHEMA_JSON) {
+        return { value: JSON.parse(env.SKS_CODEX_TOOL_SCHEMA_JSON), source: 'codex-tool-schema', schemaPath: 'env:SKS_CODEX_TOOL_SCHEMA_JSON' };
+    }
+    return null;
+}
+async function probeDoctorJson(codexBin, env) {
+    const bin = codexBin || env.CODEX_BIN || await findCodexBinary().catch(() => null);
+    if (!bin)
+        return unknownProbe(['codex_cli_missing']);
+    const run = await runProcess(bin, ['doctor', '--json'], { env, timeoutMs: 8000, maxOutputBytes: 256 * 1024 }).catch(() => null);
+    const text = `${run?.stdout || ''}${run?.stderr || ''}`.trim();
+    if (!run || run.code !== 0 || !text)
+        return unknownProbe(['codex_doctor_json_unavailable']);
+    try {
+        const parsed = JSON.parse(text);
+        const probed = probeSchema(parsed, 'codex-doctor-json', 'doctor-json');
+        return { ...probed, source: probed.supported ? 'codex-doctor-json' : 'unknown' };
+    }
+    catch {
+        return unknownProbe(['codex_doctor_json_parse_failed']);
+    }
+}
+async function probeHelp(codexBin, env) {
+    const bin = codexBin || env.CODEX_BIN || await findCodexBinary().catch(() => null);
+    if (!bin)
+        return unknownProbe(['codex_cli_missing']);
+    const run = await runProcess(bin, ['--help'], { env, timeoutMs: 5000, maxOutputBytes: 128 * 1024 }).catch(() => null);
+    const text = `${run?.stdout || ''}${run?.stderr || ''}`;
+    if (!run || run.code !== 0 || !text)
+        return unknownProbe(['codex_help_unavailable']);
+    const supported = /\bagent_type\b/.test(text) && /\bspawn_agent\b|\bmulti_agent_v2\b/.test(text);
+    return {
+        schema: 'sks.codex-agent-type-probe.v1',
+        generated_at: nowIso(),
+        ok: true,
+        supported,
+        source: supported ? 'codex-help' : 'unknown',
+        spawn_tool_name: text.includes('multi_agent_v2') ? 'multi_agent_v2' : supported ? 'spawn_agent' : 'unknown',
+        schema_path: supported ? 'codex --help' : null,
+        evidence: supported ? ['help_mentions_agent_type'] : [],
+        blockers: [],
+        warnings: supported ? [] : ['agent_type_not_found_in_help']
+    };
+}
+function envFallbackProbe(env) {
+    if (env.SKS_CODEX_AGENT_TYPE_SUPPORTED === undefined)
+        return null;
+    if (env.SKS_CODEX_AGENT_TYPE_ALLOW_ENV_FALLBACK !== '1' && env.NODE_ENV !== 'test') {
+        return {
+            schema: 'sks.codex-agent-type-probe.v1',
+            generated_at: nowIso(),
+            ok: true,
+            supported: false,
+            source: 'env',
+            spawn_tool_name: 'unknown',
+            schema_path: null,
+            evidence: [],
+            blockers: [],
+            warnings: ['env_agent_type_fallback_ignored_outside_test_mode']
+        };
+    }
+    const supported = env.SKS_CODEX_AGENT_TYPE_SUPPORTED === '1';
+    return {
+        schema: 'sks.codex-agent-type-probe.v1',
+        generated_at: nowIso(),
+        ok: true,
+        supported,
+        source: 'env',
+        spawn_tool_name: supported ? 'spawn_agent' : 'unknown',
+        schema_path: supported ? 'env:SKS_CODEX_AGENT_TYPE_SUPPORTED' : null,
+        evidence: [`env:SKS_CODEX_AGENT_TYPE_SUPPORTED=${env.SKS_CODEX_AGENT_TYPE_SUPPORTED}`],
+        blockers: [],
+        warnings: ['env_agent_type_fallback_test_only']
+    };
+}
+function probeSchema(value, source, schemaPath) {
+    const found = findAgentType(value);
+    return {
+        schema: 'sks.codex-agent-type-probe.v1',
+        generated_at: nowIso(),
+        ok: true,
+        supported: found.supported,
+        source,
+        spawn_tool_name: found.tool,
+        schema_path: found.path || schemaPath,
+        evidence: found.supported ? [`agent_type:${found.path || 'found'}`] : ['agent_type_absent'],
+        blockers: [],
+        warnings: found.supported ? [] : ['agent_type_not_supported_message_role_fallback']
+    };
+}
+function findAgentType(value, trail = []) {
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index += 1) {
+            const found = findAgentType(value[index], [...trail, String(index)]);
+            if (found.supported)
+                return found;
+        }
+        return { supported: false, tool: 'unknown', path: null };
+    }
+    if (!isRecord(value))
+        return { supported: false, tool: 'unknown', path: null };
+    const name = String(value.name || value.tool || value.id || '');
+    const tool = name.includes('multi_agent_v2') ? 'multi_agent_v2' : name.includes('spawn_agent') ? 'spawn_agent' : 'unknown';
+    if ('agent_type' in value || isRecord(value.properties) && 'agent_type' in value.properties) {
+        return { supported: true, tool: tool === 'unknown' ? 'spawn_agent' : tool, path: [...trail, 'agent_type'].join('.') };
+    }
+    for (const [key, entry] of Object.entries(value)) {
+        const found = findAgentType(entry, [...trail, key]);
+        if (found.supported)
+            return { ...found, tool: found.tool === 'unknown' && tool !== 'unknown' ? tool : found.tool };
+    }
+    return { supported: false, tool, path: null };
+}
+function unknownProbe(blockers) {
+    return {
+        schema: 'sks.codex-agent-type-probe.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        supported: false,
+        source: 'unknown',
+        spawn_tool_name: 'unknown',
+        schema_path: null,
+        evidence: [],
+        blockers,
+        warnings: ['agent_type_support_unknown_message_role_fallback']
+    };
+}
+async function persist(root, report, writeReport) {
+    if (writeReport)
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-agent-type-probe.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=codex-agent-type-probe.js.map

package/dist/core/codex-app/codex-app-execution-profile.js

@@ -0,0 +1,39 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { buildCodexAppHarnessMatrix } from './codex-app-harness-matrix.js';
+import { isCodexAppHarnessMatrix } from './codex-app-types.js';
+export async function resolveCodexAppExecutionProfile(input = { root: process.cwd() }) {
+    const root = path.resolve(input.root || process.cwd());
+    const maybeMatrix = input.matrix || await buildCodexAppHarnessMatrix({ root }).catch(() => null);
+    const matrix = isCodexAppHarnessMatrix(maybeMatrix) ? maybeMatrix : null;
+    const mode = !matrix?.codex_cli.available
+        ? 'degraded-no-app'
+        : matrix.app_features.app_handoff_ready && matrix.app_features.agent_type_supported
+            ? 'codex-app-native'
+            : matrix.codex_cli.available
+                ? 'codex-cli-headless'
+                : 'sks-loop-headless';
+    const profile = {
+        schema: 'sks.codex-app-execution-profile.v1',
+        generated_at: nowIso(),
+        ok: mode !== 'degraded-no-app',
+        mode,
+        agent_role_strategy: matrix?.app_features.agent_type_supported ? 'agent_type' : 'message-role',
+        hooks_assumed_running: false,
+        hooks_approval_required: matrix?.app_features.hook_approval_state !== 'approved',
+        hook_approval_state: matrix?.app_features.hook_approval_state || 'unknown',
+        app_handoff_ready: matrix?.app_features.app_handoff_ready === true,
+        image_path_exposure_ready: matrix?.app_features.image_path_exposure_ready === true,
+        plugin_mcp_inventory_ready: matrix?.app_features.mcp_inventory_ready === true,
+        loop_mesh_app_profile_available: true,
+        artifact_path: '.sneakoscope/reports/codex-app-execution-profile.json',
+        matrix_artifact_path: '.sneakoscope/reports/codex-app-harness-matrix.json',
+        agent_type_probe_artifact_path: '.sneakoscope/reports/codex-agent-type-probe.json',
+        hook_approval_probe_artifact_path: '.sneakoscope/reports/codex-hook-approval-probe.json',
+        blockers: mode === 'degraded-no-app' ? ['codex_cli_missing'] : [],
+        warnings: matrix?.warnings || []
+    };
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-app-execution-profile.json'), profile).catch(() => undefined);
+    return profile;
+}
+//# sourceMappingURL=codex-app-execution-profile.js.map

package/dist/core/codex-app/codex-app-fast-ui-repair.js

@@ -4,8 +4,9 @@ import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic }
 import { codexHome, scanProjectLocalForbiddenKeys, snapshotCodexAppUiState } from './codex-app-ui-state-snapshot.js';
 import { assertCodexAppUiMutationAllowed } from './codex-app-ui-clobber-guard.js';
 export const CODEX_APP_FAST_UI_REPAIR_SCHEMA = 'sks.codex-app-fast-ui-repair.v1';
-const HOST_OWNED_TOP_LEVEL_RE = /^\s*(openai_base_url|chatgpt_base_url|apps_mcp_product_sku|model_provider|notify|profile|experimental_realtime_ws_base_url|service_tier)\s*=/;
-const HOST_OWNED_TABLE_RE = /^\s*\[(model_providers(?:[.\]].*)?|profiles(?:[.\]].*)?|otel(?:[.\]].*)?|user\.fast_mode(?:[.\]].*)?)\]\s*$/;
+const FAST_UI_TOP_LEVEL_RE = /^\s*service_tier\s*=/;
+const FAST_UI_FEATURE_LINE_RE = /^\s*fast_mode\s*=/;
+const FAST_UI_USER_TABLE_LINE_RE = /^\s*(enabled|visible|locked|hidden|disabled)\s*=/;
 const SKS_CAUSED_RE = /(?:SKS|Sneakoscope|codex-lb|sks-mad|sks fast)/i;
 export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
     const resolvedRoot = path.resolve(root);
@@ -124,8 +125,10 @@ function stripProjectLocalForbiddenKeys(text) {
 }
 function stripSksCausedHostOwnedLines(text) {
     return stripMatchingLines(text, (line, table, previous, next) => {
-        const isHostOwned = HOST_OWNED_TOP_LEVEL_RE.test(line) || HOST_OWNED_TABLE_RE.test(line) || Boolean(table && /^(model_providers|profiles|otel|user\.fast_mode)/.test(table));
-        return isHostOwned && (SKS_CAUSED_RE.test(line) || SKS_CAUSED_RE.test(previous) || SKS_CAUSED_RE.test(next));
+        const isFastUiLine = FAST_UI_TOP_LEVEL_RE.test(line)
+            || (table === 'features' && FAST_UI_FEATURE_LINE_RE.test(line))
+            || (table === 'user.fast_mode' && FAST_UI_USER_TABLE_LINE_RE.test(line));
+        return isFastUiLine && (SKS_CAUSED_RE.test(line) || SKS_CAUSED_RE.test(previous) || SKS_CAUSED_RE.test(next));
     });
 }
 function stripMatchingLines(text, shouldRemove) {

package/dist/core/codex-app/codex-app-harness-matrix.js

@@ -0,0 +1,127 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { codexAppIntegrationStatus } from '../codex-app.js';
+import { detectCodex0138Capability } from '../codex-control/codex-0138-capability.js';
+import { detectCodex0139Capability } from '../codex-control/codex-0139-capability.js';
+import { buildCodexPluginInventory } from '../codex-plugins/codex-plugin-json.js';
+import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
+import { repairAgentRoleConfigs } from '../agents/agent-role-config.js';
+import { buildLazyCodexInteropPolicy } from './lazycodex-interop-policy.js';
+import { probeCodexAgentTypeSupport } from './codex-agent-type-probe.js';
+import { probeCodexHookApprovalState } from './codex-hook-approval-probe.js';
+import { isRecord } from './codex-app-types.js';
+export async function buildCodexAppHarnessMatrix(input = { root: process.cwd() }) {
+    const root = path.resolve(input.root || process.cwd());
+    const codexBin = await findCodexBinary().catch(() => null);
+    const version = codexBin ? await codexVersion(codexBin) : null;
+    const cap0138 = await detectCodex0138Capability({ codexBin }).catch((err) => ({ blockers: [messageOf(err)] }));
+    const cap0139 = await detectCodex0139Capability({ codexBin }).catch((err) => ({ blockers: [messageOf(err)] }));
+    const app = await codexAppIntegrationStatus({ codex: { bin: codexBin, version, available: Boolean(codexBin) } }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+    const plugins = await buildCodexPluginInventory().catch((err) => ({ plugins: [], marketplace_available: false, blockers: [messageOf(err)] }));
+    const hookApproval = await probeCodexHookApprovalState(root, { codexBin }).catch((err) => ({
+        schema: 'sks.codex-hook-approval-probe.v1',
+        generated_at: nowIso(),
+        ok: false,
+        detectable: false,
+        approval_state: 'unknown',
+        sources_checked: [],
+        blockers: [messageOf(err)],
+        warnings: ['hook_approval_probe_failed']
+    }));
+    const agentType = await probeCodexAgentTypeSupport(root, { codexBin }).catch((err) => ({
+        schema: 'sks.codex-agent-type-probe.v1',
+        generated_at: nowIso(),
+        ok: false,
+        supported: false,
+        source: 'unknown',
+        spawn_tool_name: 'unknown',
+        schema_path: null,
+        evidence: [],
+        blockers: [messageOf(err)],
+        warnings: ['agent_type_probe_failed_message_role_fallback']
+    }));
+    const agents = await repairAgentRoleConfigs({ root, apply: input.applyRepairs === true, reportPath: path.join(root, '.sneakoscope', 'reports', 'codex-agent-role-sync.json') }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+    const interop = await buildLazyCodexInteropPolicy({ root, inventory: plugins }).catch(() => null);
+    const appRecord = isRecord(app) ? app : {};
+    const requiredSkills = isRecord(appRecord.required_skills) ? appRecord.required_skills : {};
+    const skills = isRecord(appRecord.skills) ? appRecord.skills : {};
+    const skillShadows = isRecord(appRecord.skill_shadows) ? appRecord.skill_shadows : {};
+    const hasSkills = requiredSkills.ok === true || skills.ok === true || skillShadows.ok !== false;
+    const hookApprovalKnown = hookApproval.detectable === true;
+    const hookBlockers = hookApproval.approval_state === 'modified_requires_reapproval'
+        ? ['hook_modified_requires_reapproval']
+        : [];
+    const matrix = {
+        schema: 'sks.codex-app-harness-matrix.v1',
+        generated_at: nowIso(),
+        ok: Boolean(codexBin) && feature(cap0138, 'supports_plugin_json') !== false && recordOk(agents) !== false,
+        codex_cli: { available: Boolean(codexBin), version },
+        app_features: {
+            plugin_json: feature(cap0138, 'supports_plugin_json') === true,
+            marketplace_add: feature(cap0139, 'supports_marketplace_source_field') === true || feature(plugins, 'marketplace_available') === true,
+            marketplace_upgrade: feature(cap0139, 'supports_marketplace_source_field') === true,
+            startup_review_detectable: hookApprovalKnown,
+            hook_approval_state_detectable: hookApprovalKnown,
+            hook_approval_state: hookApproval.approval_state,
+            skill_picker_ready: Boolean(hasSkills),
+            agent_type_supported: agentType.supported,
+            mcp_inventory_ready: Array.isArray(isRecord(plugins) ? plugins.plugins : null),
+            app_handoff_ready: feature(cap0138, 'supports_app_handoff') === true,
+            image_path_exposure_ready: feature(cap0138, 'supports_image_path_exposure') === true
+        },
+        sks_integrations: {
+            dollar_skills_synced: Boolean(hasSkills),
+            agent_roles_synced: recordOk(agents) !== false,
+            hooks_synced: hookApproval.approval_state === 'approved',
+            init_deep_available: true,
+            loop_mesh_app_profile_available: true
+        },
+        probes: {
+            hook_approval: hookApproval,
+            agent_type: agentType
+        },
+        blockers: [
+            ...(!codexBin ? ['codex_cli_missing'] : []),
+            ...blockersOf(cap0138),
+            ...blockersOf(plugins),
+            ...blockersOf(agents),
+            ...hookBlockers
+        ],
+        warnings: [
+            ...blockersOf(cap0139).map((b) => `codex_0139:${b}`),
+            ...hookApproval.blockers.map((b) => `hooks:${b}`),
+            ...hookApproval.warnings,
+            ...agentType.warnings,
+            ...(hookApproval.approval_state === 'pending_review' ? ['hook_approval_pending_review'] : []),
+            ...(hookApproval.approval_state === 'not_installed' ? ['hooks_not_installed'] : []),
+            ...(interop?.lazycodex_detected ? ['lazycodex_detected_coexist_mode'] : [])
+        ]
+    };
+    matrix.ok = matrix.blockers.length === 0;
+    await writeCodexAppHarnessMatrix(root, matrix, input.missionDir);
+    return matrix;
+}
+export async function writeCodexAppHarnessMatrix(root, matrix, missionDir) {
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-app-harness-matrix.json'), matrix);
+    if (missionDir)
+        await writeJsonAtomic(path.join(missionDir, 'codex-app-harness-matrix.json'), matrix).catch(() => undefined);
+}
+async function codexVersion(bin) {
+    const run = await runProcess(bin, ['--version'], { timeoutMs: 5000, maxOutputBytes: 16 * 1024 }).catch(() => null);
+    return run?.code === 0 ? `${run.stdout || run.stderr || ''}`.trim() || null : null;
+}
+function blockersOf(value) {
+    if (!isRecord(value) || !Array.isArray(value.blockers))
+        return [];
+    return value.blockers.map((item) => String(item)).filter(Boolean);
+}
+function feature(value, key) {
+    return isRecord(value) && typeof value[key] === 'boolean' ? value[key] : undefined;
+}
+function recordOk(value) {
+    return isRecord(value) && typeof value.ok === 'boolean' ? value.ok : undefined;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=codex-app-harness-matrix.js.map

package/dist/core/codex-app/codex-app-types.js

@@ -0,0 +1,21 @@
+export function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+export function stringList(value) {
+    return Array.isArray(value) ? value.map((item) => String(item)).filter(Boolean) : [];
+}
+export function isCodexAppHarnessMatrix(value) {
+    if (!isRecord(value))
+        return false;
+    if (value.schema !== 'sks.codex-app-harness-matrix.v1')
+        return false;
+    const app = value.app_features;
+    const sks = value.sks_integrations;
+    return isRecord(app)
+        && isRecord(sks)
+        && typeof value.ok === 'boolean'
+        && isRecord(value.codex_cli)
+        && Array.isArray(value.blockers)
+        && Array.isArray(value.warnings);
+}
+//# sourceMappingURL=codex-app-types.js.map

package/dist/core/codex-app/codex-hook-approval-probe.js

@@ -0,0 +1,188 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { readCodexHookActualState } from '../codex-hooks/codex-hook-actual-discovery.js';
+import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
+import { isRecord } from './codex-app-types.js';
+export async function probeCodexHookApprovalState(root, input = {}) {
+    const env = input.env || process.env;
+    const sources = [];
+    const fixture = normalizeApprovalState(env.SKS_CODEX_HOOK_APPROVAL_FIXTURE);
+    if (fixture) {
+        const report = buildProbe(fixture !== 'unknown', fixture, [{
+                source: 'config',
+                ok: fixture !== 'unknown',
+                evidence: [`fixture:${fixture}`],
+                blockers: fixture === 'unknown' ? ['fixture_unknown'] : []
+            }]);
+        return persist(root, report, input.writeReport !== false);
+    }
+    const actual = await readCodexHookActualState(root).catch((err) => ({
+        schema: 'sks.codex-hook-actual-state.v1',
+        ok: false,
+        root,
+        sources: [],
+        managed_dirs: [],
+        entries: [],
+        unsupported_handlers: [],
+        invalid_matchers: [],
+        dual_representation: [],
+        warnings: [],
+        blockers: [messageOf(err)]
+    }));
+    const actualState = approvalFromActualState(actual);
+    sources.push({
+        source: 'hook-actual-state',
+        ok: actual.ok !== false,
+        evidence: [
+            `entries:${actual.entries.length}`,
+            `trusted:${actual.entries.filter((entry) => entry.trust_status === 'Trusted' || entry.trust_status === 'Managed').length}`,
+            `modified:${actual.entries.filter((entry) => entry.trust_status === 'Modified').length}`,
+            `untrusted:${actual.entries.filter((entry) => entry.trust_status === 'Untrusted').length}`
+        ],
+        blockers: actual.blockers
+    });
+    const doctor = await probeCodexDoctorApproval(input.codexBin, env);
+    sources.push(doctor.source);
+    const doctorState = doctor.approval_state;
+    const state = strongestApprovalState([actualState, doctorState]);
+    const detectable = state !== 'unknown';
+    const blockers = [
+        ...sources.flatMap((source) => source.blockers),
+        ...(state === 'modified_requires_reapproval' ? ['hook_modified_requires_reapproval'] : [])
+    ];
+    const warnings = [
+        ...(state === 'unknown' ? ['hook_approval_state_unknown'] : []),
+        ...(actual.entries.length > 0 && state === 'unknown' ? ['hooks_installed_but_approval_unknown'] : [])
+    ];
+    const report = {
+        schema: 'sks.codex-hook-approval-probe.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0 && state !== 'pending_review' && state !== 'modified_requires_reapproval',
+        detectable,
+        approval_state: state,
+        sources_checked: sources,
+        blockers,
+        warnings
+    };
+    return persist(root, report, input.writeReport !== false);
+}
+function approvalFromActualState(actual) {
+    if (actual.entries.length === 0)
+        return 'not_installed';
+    if (actual.entries.some((entry) => entry.trust_status === 'Modified'))
+        return 'modified_requires_reapproval';
+    if (actual.entries.some((entry) => entry.trust_status === 'Untrusted'))
+        return 'pending_review';
+    if (actual.entries.every((entry) => entry.trust_status === 'Trusted' || entry.trust_status === 'Managed'))
+        return 'approved';
+    return 'unknown';
+}
+async function probeCodexDoctorApproval(codexBin, env) {
+    const bin = codexBin || env.CODEX_BIN || await findCodexBinary().catch(() => null);
+    if (!bin) {
+        return { approval_state: 'unknown', source: { source: 'codex-doctor-json', ok: false, evidence: [], blockers: ['codex_cli_missing'] } };
+    }
+    const run = await runProcess(bin, ['doctor', '--json'], { env, timeoutMs: 8000, maxOutputBytes: 256 * 1024 }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: messageOf(err)
+    }));
+    const text = `${run.stdout || ''}${run.stderr || ''}`.trim();
+    if (run.code !== 0 || !text) {
+        return {
+            approval_state: 'unknown',
+            source: { source: 'codex-doctor-json', ok: false, evidence: text ? [text.slice(0, 240)] : [], blockers: ['codex_doctor_json_unavailable'] }
+        };
+    }
+    try {
+        const parsed = JSON.parse(text);
+        const state = findApprovalState(parsed);
+        return {
+            approval_state: state || 'unknown',
+            source: {
+                source: 'codex-doctor-json',
+                ok: Boolean(state),
+                evidence: state ? [`approval_state:${state}`] : ['doctor_json_no_hook_approval_field'],
+                blockers: state ? [] : ['hook_approval_not_exposed_by_codex_doctor']
+            }
+        };
+    }
+    catch {
+        return {
+            approval_state: 'unknown',
+            source: { source: 'codex-doctor-json', ok: false, evidence: [text.slice(0, 240)], blockers: ['codex_doctor_json_parse_failed'] }
+        };
+    }
+}
+function findApprovalState(value) {
+    if (!isRecord(value))
+        return null;
+    for (const key of ['hook_approval_state', 'approval_state', 'hookApprovalState']) {
+        const state = normalizeApprovalState(value[key]);
+        if (state)
+            return state;
+    }
+    for (const nested of Object.values(value)) {
+        if (Array.isArray(nested)) {
+            for (const item of nested) {
+                const found = findApprovalState(item);
+                if (found)
+                    return found;
+            }
+        }
+        else if (isRecord(nested)) {
+            const found = findApprovalState(nested);
+            if (found)
+                return found;
+        }
+    }
+    return null;
+}
+function normalizeApprovalState(value) {
+    const raw = String(value || '').trim().toLowerCase().replace(/[-\s]+/g, '_');
+    if (raw === 'approved' || raw === 'trusted' || raw === 'managed')
+        return 'approved';
+    if (raw === 'pending' || raw === 'pending_review' || raw === 'untrusted')
+        return 'pending_review';
+    if (raw === 'modified' || raw === 'modified_requires_reapproval')
+        return 'modified_requires_reapproval';
+    if (raw === 'not_installed' || raw === 'missing')
+        return 'not_installed';
+    if (raw === 'unknown')
+        return 'unknown';
+    return null;
+}
+function strongestApprovalState(states) {
+    if (states.includes('modified_requires_reapproval'))
+        return 'modified_requires_reapproval';
+    if (states.includes('pending_review'))
+        return 'pending_review';
+    if (states.includes('approved'))
+        return 'approved';
+    if (states.every((state) => state === 'not_installed'))
+        return 'not_installed';
+    if (states.includes('not_installed') && states.length === 1)
+        return 'not_installed';
+    return 'unknown';
+}
+function buildProbe(detectable, approvalState, sources) {
+    return {
+        schema: 'sks.codex-hook-approval-probe.v1',
+        generated_at: nowIso(),
+        ok: approvalState === 'approved' || approvalState === 'not_installed',
+        detectable,
+        approval_state: approvalState,
+        sources_checked: sources,
+        blockers: sources.flatMap((source) => source.blockers),
+        warnings: approvalState === 'unknown' ? ['hook_approval_state_unknown'] : []
+    };
+}
+async function persist(root, report, writeReport) {
+    if (writeReport)
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-hook-approval-probe.json'), report).catch(() => undefined);
+    return report;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=codex-hook-approval-probe.js.map

package/dist/core/codex-app/codex-hook-lifecycle.js

@@ -0,0 +1,61 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { readCodexHookActualState } from '../codex-hooks/codex-hook-actual-discovery.js';
+import { installManagedCodexHooks } from '../codex-hooks/codex-hook-managed-install.js';
+import { probeCodexHookApprovalState } from './codex-hook-approval-probe.js';
+export async function buildCodexHookLifecycle(input = {}) {
+    const root = path.resolve(input.root || process.cwd());
+    const install = input.apply === true
+        ? await installManagedCodexHooks(root).catch((err) => ({ ok: false, blockers: [messageOf(err)] }))
+        : null;
+    const actual = await readCodexHookActualState(root).catch((err) => ({ ok: false, entries: [], blockers: [messageOf(err)] }));
+    const probe = await probeCodexHookApprovalState(root).catch((err) => ({
+        schema: 'sks.codex-hook-approval-probe.v1',
+        generated_at: nowIso(),
+        ok: false,
+        detectable: false,
+        approval_state: 'unknown',
+        sources_checked: [],
+        blockers: [messageOf(err)],
+        warnings: ['hook_approval_probe_failed']
+    }));
+    const events = {
+        UserPromptSubmit: ['route_classifier', 'goal_to_loop_compiler', 'permission_profile_badge'],
+        PreToolUse: ['requested_scope_guard', 'mad_db_priority_resolver', 'side_effect_zero_gate'],
+        PostToolUse: ['evidence_ledger', 'mutation_ledger', 'side_effect_scanner', 'context7_native_session_updates'],
+        Stop: ['continuation_enforcer', 'final_proof_check', 'loop_resume_hint'],
+        Notification: ['operator_status', 'zellij_anchor', 'codex_app_status']
+    };
+    const installedEvents = new Set(Array.isArray(actual.entries) ? actual.entries.map((entry) => String(entry.event || '')) : []);
+    const report = {
+        schema: 'sks.codex-hook-lifecycle.v1',
+        generated_at: nowIso(),
+        ok: actual.ok !== false && probe.approval_state !== 'modified_requires_reapproval',
+        apply: input.apply === true,
+        approval_state: probe.approval_state,
+        approval_state_detectable: probe.detectable,
+        lifecycle: Object.fromEntries(Object.entries(events).map(([event, actions]) => [event, {
+                actions,
+                installed: installedEvents.has(event),
+                approval_state: installedEvents.has(event) ? probe.approval_state : 'not_installed'
+            }])),
+        actual_state: actual,
+        install,
+        probe,
+        blockers: [
+            ...(Array.isArray(actual.blockers) ? actual.blockers.map(String) : []),
+            ...(probe.approval_state === 'modified_requires_reapproval' ? ['hook_modified_requires_reapproval'] : [])
+        ],
+        warnings: [
+            ...probe.warnings,
+            ...(probe.approval_state === 'pending_review' ? ['hook_approval_pending_review'] : []),
+            ...(probe.approval_state === 'unknown' ? ['hook_approval_state_unknown'] : [])
+        ]
+    };
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-hook-lifecycle.json'), report).catch(() => undefined);
+    return report;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=codex-hook-lifecycle.js.map