sneakoscope 3.1.6 → 3.1.7

package/dist/core/codex-native/codex-native-reference-cache.js

@@ -0,0 +1,98 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { exists, nowIso, runProcess, sha256, writeJsonAtomic } from '../fsx.js';
+export async function ensureCodexNativeReferenceSnapshot(input) {
+    const root = path.resolve(input.root);
+    const cacheDir = path.join(root, '.sneakoscope', 'cache', 'codex-native-reference');
+    const reportPath = path.join(root, '.sneakoscope', 'reports', 'codex-native-reference-cache.json');
+    const sourceUrl = input.sourceUrl ?? process.env.SKS_CODEX_NATIVE_REFERENCE_SOURCE_URL ?? null;
+    const sourceRef = input.ref || process.env.SKS_CODEX_NATIVE_REFERENCE_REF || 'HEAD';
+    const offline = input.offline === true || process.env.SKS_CODEX_NATIVE_REFERENCE_OFFLINE === '1' || !sourceUrl;
+    const blockers = [];
+    const warnings = [];
+    let refreshed = false;
+    if (!offline && sourceUrl) {
+        const parent = path.dirname(cacheDir);
+        await fs.mkdir(parent, { recursive: true });
+        const gitDir = path.join(cacheDir, '.git');
+        const timeoutMs = input.timeoutMs || 60_000;
+        if (!(await exists(gitDir))) {
+            if (await exists(cacheDir))
+                await fs.rm(cacheDir, { recursive: true, force: true });
+            const cloneArgs = [
+                'clone',
+                '--depth',
+                '1',
+                '--filter=blob:none',
+                ...(sourceRef === 'HEAD' ? [] : ['--branch', sourceRef]),
+                sourceUrl,
+                cacheDir
+            ];
+            const cloned = await runProcess('git', cloneArgs, {
+                timeoutMs,
+                maxOutputBytes: 128 * 1024
+            }).catch((err) => ({ code: 1, stderr: messageOf(err), stdout: '' }));
+            if (cloned.code === 0)
+                refreshed = true;
+            else
+                blockers.push('source_snapshot_fetch_failed');
+        }
+        else if (input.refresh === true) {
+            const fetched = await runProcess('git', ['fetch', '--depth', '1', 'origin', sourceRef], {
+                cwd: cacheDir,
+                timeoutMs,
+                maxOutputBytes: 128 * 1024
+            }).catch((err) => ({ code: 1, stderr: messageOf(err), stdout: '' }));
+            if (fetched.code === 0) {
+                await runProcess('git', ['checkout', 'FETCH_HEAD'], { cwd: cacheDir, timeoutMs, maxOutputBytes: 64 * 1024 }).catch(() => null);
+                refreshed = true;
+            }
+            else {
+                blockers.push('source_snapshot_refresh_failed');
+            }
+        }
+    }
+    else {
+        warnings.push(sourceUrl ? 'reference_cache_offline_mode' : 'reference_source_url_missing_offline_cache_only');
+    }
+    const cacheExists = await hasTextFiles(cacheDir);
+    if (!cacheExists)
+        blockers.push('source_snapshot_missing');
+    const report = {
+        schema: 'sks.codex-native-reference-cache.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        cache_dir: path.relative(root, cacheDir),
+        source_url_hash: sourceUrl ? sha256(sourceUrl) : null,
+        source_ref: sourceRef,
+        source_sha: await gitSha(cacheDir),
+        refreshed,
+        offline,
+        blockers: [...new Set(blockers)],
+        warnings: [...new Set(warnings)]
+    };
+    await writeJsonAtomic(reportPath, report).catch(() => undefined);
+    return report;
+}
+async function hasTextFiles(dir) {
+    const rows = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const row of rows) {
+        if (row.name === '.git' || row.name === 'node_modules' || row.name === 'dist')
+            continue;
+        const full = path.join(dir, row.name);
+        if (row.isFile() && /\.(md|txt|json|toml|ya?ml|js|ts|mjs|cjs)$/i.test(row.name))
+            return true;
+        if (row.isDirectory() && await hasTextFiles(full))
+            return true;
+    }
+    return false;
+}
+async function gitSha(sourceDir) {
+    const run = await runProcess('git', ['rev-parse', 'HEAD'], { cwd: sourceDir, timeoutMs: 5000, maxOutputBytes: 4096 }).catch(() => null);
+    const sha = run?.code === 0 ? `${run.stdout || ''}`.trim() : '';
+    return /^[0-9a-f]{40}$/i.test(sha) ? sha : null;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=codex-native-reference-cache.js.map

package/dist/core/codex-native/codex-native-reference-source.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { ensureCodexNativeReferenceSnapshot } from './codex-native-reference-cache.js';
 const PATTERNS = [
     { id: 'no-global-optional-tooling', claim: 'optional tooling avoids mandatory global install', re: /\bnpx\b|no[- ]global|global install/i },
     { id: 'plugin-lifecycle-state-separation', claim: 'plugin install state is separated from approval/readiness', re: /\bplugin\b.+\b(install|enable|marketplace|lifecycle)\b/i },
@@ -18,7 +19,26 @@ const PATTERNS = [
 ];
 export async function analyzeCodexNativeReferenceSource(input) {
     const root = path.resolve(input.root);
-    const sourceDir = input.sourceDir ? path.resolve(input.sourceDir) : path.join(root, '.sneakoscope', 'cache', 'codex-native-reference');
+    const cacheInput = input.sourceRef ? { root, ref: input.sourceRef } : { root };
+    const cache = input.sourceDir
+        ? null
+        : await ensureCodexNativeReferenceSnapshot(cacheInput).catch((err) => ({
+            schema: 'sks.codex-native-reference-cache.v1',
+            generated_at: nowIso(),
+            ok: false,
+            cache_dir: '.sneakoscope/cache/codex-native-reference',
+            source_url_hash: null,
+            source_ref: input.sourceRef || 'HEAD',
+            source_sha: null,
+            refreshed: false,
+            offline: true,
+            blockers: [messageOf(err)],
+            warnings: ['reference_cache_exception']
+        }));
+    const sourceDir = input.sourceDir
+        ? path.resolve(input.sourceDir)
+        : path.join(root, cache?.cache_dir || '.sneakoscope/cache/codex-native-reference');
+    const confidence = input.sourceDir ? 'high' : cache?.ok ? cache.refreshed ? 'high' : 'medium' : 'low';
     const files = await listTextFiles(sourceDir);
     const evidence = [];
     const blockers = [];
@@ -26,7 +46,7 @@ export async function analyzeCodexNativeReferenceSource(input) {
         const rel = path.relative(sourceDir, file).split(path.sep).join('/');
         const text = await fs.readFile(file, 'utf8').catch(() => '');
         if (text)
-            evidence.push(...extractCodexNativeEvidence(rel, text));
+            evidence.push(...extractCodexNativeEvidence(rel, text).map((row) => ({ ...row, confidence })));
     }
     if (!files.length || !evidence.length)
         blockers.push('source_snapshot_missing');
@@ -34,11 +54,14 @@ export async function analyzeCodexNativeReferenceSource(input) {
         schema: 'sks.codex-native-reference-evidence.v1',
         generated_at: nowIso(),
         source_kind: 'external-reference-source',
-        source_ref: input.sourceRef || sourceDir,
-        source_sha: await gitSha(sourceDir),
+        source_ref: neutralSourceRef(input, cache, sourceDir),
+        source_sha: cache?.source_sha || await gitSha(sourceDir),
+        source_url_hash: cache?.source_url_hash || null,
+        cache_report_path: cache ? '.sneakoscope/reports/codex-native-reference-cache.json' : null,
+        cache,
         evidence,
-        blockers,
-        warnings: blockers.length ? ['reference_evidence_incomplete'] : []
+        blockers: [...new Set([...blockers, ...(cache?.blockers || [])])],
+        warnings: [...new Set([...(cache?.warnings || []), ...(blockers.length ? ['reference_evidence_incomplete'] : [])])]
     };
     if (input.writeReport !== false) {
         await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-native-reference-evidence.json'), report).catch(() => undefined);
@@ -74,6 +97,8 @@ export function renderCodexNativeReferenceMarkdown(report) {
         '',
         `Generated at: \`${report.generated_at}\``,
         `Source kind: \`${report.source_kind}\``,
+        `Source URL hash: \`${report.source_url_hash || 'none'}\``,
+        `Source SHA: \`${report.source_sha || 'none'}\``,
         '',
         '| Pattern | File | Lines | Snippet Hash | Confidence |',
         '|---|---|---:|---|---|',
@@ -81,21 +106,32 @@ export function renderCodexNativeReferenceMarkdown(report) {
         ''
     ].join('\n');
 }
+function neutralSourceRef(input, cache, sourceDir) {
+    if (cache)
+        return `cache:${createHash('sha256').update(`${cache.cache_dir}:${cache.source_ref}:${cache.source_sha || ''}`).digest('hex').slice(0, 16)}`;
+    if (input.sourceRef)
+        return `explicit:${createHash('sha256').update(input.sourceRef).digest('hex').slice(0, 16)}`;
+    return `explicit-source-dir:${createHash('sha256').update(sourceDir).digest('hex').slice(0, 16)}`;
+}
 async function listTextFiles(dir) {
     const out = [];
-    await walk(dir, out);
-    return out.filter((file) => /\.(md|txt|json|toml|ya?ml|js|ts|mjs|cjs)$/i.test(file)).slice(0, 500);
+    await walk(dir, out, 500);
+    return out;
 }
-async function walk(dir, out) {
+async function walk(dir, out, maxFiles) {
+    if (out.length >= maxFiles)
+        return;
     const rows = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const row of rows) {
+        if (out.length >= maxFiles)
+            return;
         const full = path.join(dir, row.name);
         if (row.isDirectory()) {
             if (['.git', 'node_modules', 'dist'].includes(row.name))
                 continue;
-            await walk(full, out);
+            await walk(full, out, maxFiles);
         }
-        else if (row.isFile()) {
+        else if (row.isFile() && /\.(md|txt|json|toml|ya?ml|js|ts|mjs|cjs)$/i.test(row.name)) {
             out.push(full);
         }
     }
@@ -107,4 +143,7 @@ async function gitSha(sourceDir) {
         return (await fs.readFile(path.join(sourceDir, '.git', ref), 'utf8').catch(() => '')).trim() || null;
     return /^[0-9a-f]{40}$/i.test(head.trim()) ? head.trim() : null;
 }
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
 //# sourceMappingURL=codex-native-reference-source.js.map

package/dist/core/codex-native/codex-native-repair-transaction.js

@@ -0,0 +1,150 @@
+import path from 'node:path';
+import { buildCodexHookLifecycle } from '../codex-app/codex-hook-lifecycle.js';
+import { runCodexInitDeep } from '../codex-app/codex-init-deep.js';
+import { syncCodexAgentRoles } from '../codex-app/codex-agent-role-sync.js';
+import { syncCodexSksSkills } from '../codex-app/codex-skill-sync.js';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+import { evaluateMutation, mutationLedgerPath, recordMutation } from '../safety/mutation-ledger.js';
+export async function repairCodexNativeManagedAssets(input) {
+    const root = path.resolve(input.root);
+    const requested = {
+        skills: input.repairSkills !== false,
+        agent_roles: input.repairAgentRoles !== false,
+        hooks: input.repairHooks !== false,
+        project_memory: input.repairProjectMemory !== false
+    };
+    const requestedAssets = Object.entries(requested)
+        .filter(([, enabled]) => enabled)
+        .map(([asset]) => asset);
+    if (input.yes !== true) {
+        const report = {
+            schema: 'sks.codex-native-repair-transaction.v1',
+            ok: false,
+            generated_at: nowIso(),
+            requested_by: input.requestedBy,
+            repaired: requestedAssets.map((asset) => ({
+                asset,
+                ok: false,
+                changed: false,
+                artifact_path: artifactPathFor(asset),
+                blockers: ['repair_transaction_requires_yes']
+            })),
+            confirmed: false,
+            mutation_ledger_path: null,
+            blockers: ['repair_transaction_requires_yes'],
+            warnings: []
+        };
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-native-repair-transaction.json'), report).catch(() => undefined);
+        return report;
+    }
+    const rows = [];
+    if (requested.skills) {
+        const report = await syncCodexSksSkills({ root, apply: true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+        rows.push({
+            asset: 'skills',
+            ok: recordOk(report) !== false,
+            changed: listLength(report, 'created') > 0,
+            artifact_path: '.sneakoscope/reports/codex-skill-sync.json',
+            blockers: blockersOf(report)
+        });
+    }
+    if (requested.agent_roles) {
+        const report = await syncCodexAgentRoles({ root, apply: true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+        rows.push({
+            asset: 'agent_roles',
+            ok: recordOk(report) !== false,
+            changed: listLength(report, 'created') > 0,
+            artifact_path: '.sneakoscope/reports/codex-agent-role-sync.json',
+            blockers: blockersOf(report)
+        });
+    }
+    if (requested.hooks) {
+        const report = await buildCodexHookLifecycle({ root, apply: true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+        rows.push({
+            asset: 'hooks',
+            ok: recordOk(report) !== false,
+            changed: recordOk(report) !== false,
+            artifact_path: '.sneakoscope/reports/codex-hook-lifecycle.json',
+            blockers: blockersOf(report)
+        });
+    }
+    if (requested.project_memory) {
+        const report = await runCodexInitDeep({ root, apply: true, directoryLocal: true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+        rows.push({
+            asset: 'project_memory',
+            ok: recordOk(report) !== false,
+            changed: listLength(report, 'directory_local_agents.created') + listLength(report, 'directory_local_agents.updated') > 0,
+            artifact_path: '.sneakoscope/reports/codex-init-deep.json',
+            blockers: blockersOf(report)
+        });
+    }
+    const blockers = rows.flatMap((row) => row.blockers);
+    const mutationWarnings = await recordRepairMutations(root, rows);
+    const report = {
+        schema: 'sks.codex-native-repair-transaction.v1',
+        ok: rows.every((row) => row.ok) && blockers.length === 0,
+        generated_at: nowIso(),
+        requested_by: input.requestedBy,
+        repaired: rows,
+        confirmed: true,
+        mutation_ledger_path: path.relative(root, mutationLedgerPath(root)).split(path.sep).join('/'),
+        blockers: [...new Set(blockers)],
+        warnings: mutationWarnings
+    };
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-native-repair-transaction.json'), report).catch(() => undefined);
+    return report;
+}
+async function recordRepairMutations(root, rows) {
+    const contract = createRequestedScopeContract({
+        route: 'codex-native-repair-transaction',
+        userRequest: 'Repair SKS-managed Codex Native assets after explicit --yes confirmation.',
+        projectRoot: root,
+        overrides: { global_codex_config: true }
+    });
+    const warnings = [];
+    for (const row of rows) {
+        const kind = row.asset === 'project_memory' ? 'file_write' : 'global_config_write';
+        const entry = evaluateMutation(contract, kind, {
+            target: row.asset,
+            confirmed: true,
+            applied: row.changed,
+            noOpReason: row.changed ? 'sks_managed_asset_transaction_recorded' : 'repair_noop'
+        });
+        await recordMutation(root, entry).catch((err) => warnings.push(`mutation_ledger_write_failed:${messageOf(err)}`));
+    }
+    return warnings;
+}
+function artifactPathFor(asset) {
+    return asset === 'skills'
+        ? '.sneakoscope/reports/codex-skill-sync.json'
+        : asset === 'agent_roles'
+            ? '.sneakoscope/reports/codex-agent-role-sync.json'
+            : asset === 'hooks'
+                ? '.sneakoscope/reports/codex-hook-lifecycle.json'
+                : '.sneakoscope/reports/codex-init-deep.json';
+}
+function recordOk(value) {
+    return Boolean(value) && typeof value === 'object' && typeof value.ok === 'boolean'
+        ? value.ok
+        : undefined;
+}
+function blockersOf(value) {
+    return Boolean(value) && typeof value === 'object' && Array.isArray(value.blockers)
+        ? value.blockers.map((item) => String(item)).filter(Boolean)
+        : [];
+}
+function listLength(value, key) {
+    const parts = key.split('.');
+    let current = value;
+    for (const part of parts) {
+        if (!current || typeof current !== 'object')
+            return 0;
+        current = current[part];
+    }
+    return Array.isArray(current) ? current.length : 0;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=codex-native-repair-transaction.js.map

package/dist/core/codex-plugins/codex-plugin-json.js

@@ -33,7 +33,8 @@ export async function buildCodexPluginInventory() {
     });
     const blockers = [
         ...(capability.supports_plugin_json ? [] : ['codex_0_138_plugin_json_unavailable']),
-        ...normalizeList(listJson?.blockers)
+        ...normalizeList(listJson?.blockers),
+        ...(process.env.SKS_CODEX_PLUGIN_JSON_FAKE_NO_MCP === '1' ? ['fixture_mcp_candidates_disabled'] : [])
     ];
     return {
         schema: 'sks.codex-plugin-inventory.v1',
@@ -169,7 +170,9 @@ function fakePluginDetail(pluginId) {
         installed: true,
         enabled: true,
         default_prompts: ['Use the fixture plugin safely.'],
-        remote_mcp_servers: [{ name: 'fixture-db-docs', url: 'https://mcp.example.test', auth_type: 'oauth' }],
+        remote_mcp_servers: process.env.SKS_CODEX_PLUGIN_JSON_FAKE_NO_MCP === '1'
+            ? []
+            : [{ name: 'fixture-db-docs', url: 'https://mcp.example.test', auth_type: 'oauth' }],
         unavailable_app_templates: ['fixture-desktop-template']
     };
 }

package/dist/core/commands/mad-sks-command.js

@@ -22,6 +22,7 @@ import { checkSksUpdateNotice } from '../update/update-notice.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../mad-db/mad-db-capability.js';
 import { writeCodex0138CapabilityArtifacts } from '../codex-control/codex-0138-capability.js';
 import { writeCodex0139CapabilityArtifacts } from '../codex-control/codex-0139-capability.js';
+import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-invocation-router.js';
 import { repairZellijForSks } from '../zellij/zellij-self-heal.js';
 export async function madHighCommand(args = [], deps = {}) {
     const subcommand = firstSubcommand(args);
@@ -478,6 +479,14 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
     const { id, dir } = await createMission(root, { mode: 'mad-sks', prompt: 'sks --mad Zellij scoped high-power maintenance session' });
     await writeCodex0138CapabilityArtifacts(root, { missionId: id }).catch(() => null);
     await writeCodex0139CapabilityArtifacts(root, { missionId: id }).catch(() => null);
+    const codexNativeInvocation = await resolveCodexNativeInvocationPlan({
+        root,
+        missionId: id,
+        route: '$MAD',
+        desiredCapability: 'hook-evidence'
+    }).catch(() => null);
+    if (codexNativeInvocation)
+        await writeJsonAtomic(path.join(dir, 'mad-codex-native-invocation.json'), codexNativeInvocation).catch(() => undefined);
     const protectedCore = resolveProtectedCore({ packageRoot: packageRoot(), targetRoot: cwd });
     // The interactive launch 'before' snapshot is only persisted (env + policy json)
     // and is never compared against an 'after' snapshot during the session, so the
@@ -521,6 +530,13 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
         protected_core_policy: protectedCorePolicyPath,
         protected_core_before: protectedCoreBeforePath,
         protected_core_digest: protectedCoreBefore.digest,
+        codex_native_invocation_plan: codexNativeInvocation ? {
+            selected_strategy: codexNativeInvocation.selected_strategy,
+            hook_evidence_policy: codexNativeInvocation.env.SKS_CODEX_NATIVE_HOOK_EVIDENCE_POLICY,
+            blockers: codexNativeInvocation.blockers,
+            warnings: codexNativeInvocation.warnings,
+            artifact_path: 'mad-codex-native-invocation.json'
+        } : null,
         activated_by: 'sks --mad',
         cwd: path.resolve(cwd || process.cwd())
     };

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.6';
+export const PACKAGE_VERSION = '3.1.7';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/loops/loop-planner.js

@@ -59,7 +59,7 @@ export async function planLoopsFromRequest(input) {
         return {
             ...node,
             ...(hints.length ? { memory_hints: hints } : {}),
-            memory_hints_used: hints.length,
+            memory_hints_used: hints,
             memory_did_not_expand_scope: true
         };
     });

package/dist/core/loops/loop-worker-prompts.js

@@ -10,6 +10,7 @@ export function buildLoopMakerPrompt(input) {
         `Owner directories: ${node.owner_scope.directories.join(', ') || '-'}`,
         `Allowed mutation scope: ${ownerScopeText(node)}`,
         'Do not mutate outside the owner scope.',
+        'Memory hints are guidance only; memory never grants write permission or expands owner scope.',
         `Selected local gates: ${allGateIds(node.gates).join(', ') || '-'}`,
         `Budget: ${JSON.stringify(node.budget)}`,
         `Worktree path: ${input.worktreePath || '-'}`,
@@ -30,6 +31,7 @@ export function buildLoopCheckerPrompt(input) {
         `Selected gates: ${allGateIds(node.gates).join(', ') || '-'}`,
         `Risk: ${node.risk.level} (${node.risk.reasons.join(', ') || '-'})`,
         'Reject unrequested side effects and owner-scope violations.',
+        'Memory hints are guidance only; memory never grants write permission or expands owner scope.',
         'Write checker-findings.json with fresh_session, reviewed_maker_artifacts, side_effects_detected, and approved.',
         'No synthetic pass is allowed for production proof.'
     ].join('\n');

package/dist/core/loops/loop-worker-runtime.js

@@ -159,6 +159,12 @@ async function runLoopWorkerFixture(input) {
     });
     const dir = path.join(loopNodeRoot(input.root, input.plan.mission_id, input.node.loop_id), input.phase);
     await ensureDir(dir);
+    const invocationPlan = await resolveCodexNativeInvocationPlan({
+        root: input.root,
+        missionId: input.plan.mission_id,
+        route: '$Loop',
+        desiredCapability: 'agent-role'
+    }).catch(() => null);
     const resultPath = path.join(dir, 'worker-runtime-result.json');
     const childInputPath = path.join(dir, 'worker-fixture-intake.json');
     await writeJsonAtomic(childInputPath, {
@@ -170,7 +176,8 @@ async function runLoopWorkerFixture(input) {
         worker_count: input.phase === 'maker' ? input.node.maker.worker_count : input.node.checker.worker_count,
         result_path: resultPath,
         owner_scope: input.node.owner_scope,
-        maker_artifacts: input.makerArtifacts || []
+        maker_artifacts: input.makerArtifacts || [],
+        codex_native_invocation_plan: invocationPlan ? compactInvocationPlan(invocationPlan) : null
     });
     const child = await runProcess(process.execPath, [fixtureChildEntrypoint(), childInputPath], {
         cwd: input.root,

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '3.1.6';
+export const PACKAGE_VERSION = '3.1.7';
 //# sourceMappingURL=version.js.map

package/dist/scripts/codex-native-runtime-e2e-fixture.js

@@ -0,0 +1,75 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+export async function createCodexNativeRuntimeFixture(input) {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-native-e2e-'));
+    const missionId = `M-check-${Date.now().toString(36)}`;
+    const home = path.join(root, 'home');
+    const codexHome = path.join(root, 'codex-home');
+    await fs.mkdir(home, { recursive: true });
+    await fs.mkdir(codexHome, { recursive: true });
+    await fs.mkdir(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+    await fs.mkdir(path.join(root, '.sneakoscope', 'missions', missionId), { recursive: true });
+    await fs.mkdir(path.join(root, 'src', 'core', 'loops'), { recursive: true });
+    await fs.mkdir(path.join(root, 'src', 'core', 'qa'), { recursive: true });
+    await fs.mkdir(path.join(root, 'src', 'core', 'research'), { recursive: true });
+    await fs.mkdir(path.join(root, 'docs'), { recursive: true });
+    await fs.writeFile(path.join(root, 'package.json'), '{"name":"fixture","version":"3.1.7","scripts":{}}\n', 'utf8');
+    await fs.writeFile(path.join(root, 'src', 'core', 'loops', 'fixture.ts'), 'export const loopFixture = true\n', 'utf8');
+    await fs.writeFile(path.join(root, 'src', 'core', 'qa', 'fixture.ts'), 'export const qaFixture = true\n', 'utf8');
+    await fs.writeFile(path.join(root, 'src', 'core', 'research', 'fixture.ts'), 'export const researchFixture = true\n', 'utf8');
+    await fs.writeFile(path.join(root, 'docs', 'fixture.md'), '# Fixture\n', 'utf8');
+    return {
+        root,
+        missionId,
+        matrixPath: path.join(root, '.sneakoscope', 'reports', 'codex-native-feature-matrix.json'),
+        env: {
+            ...process.env,
+            HOME: home,
+            USERPROFILE: home,
+            CODEX_HOME: codexHome,
+            CODEX_BIN: 'codex',
+            SKS_CODEX_0138_FAKE: '1',
+            SKS_CODEX_0138_PROBE: '1',
+            SKS_CODEX_0139_FAKE: '1',
+            SKS_CODEX_0139_PROBE: '1',
+            SKS_CODEX_PLUGIN_JSON_FAKE: '1',
+            SKS_CODEX_HOOK_APPROVAL_FIXTURE: input.hook,
+            SKS_CODEX_AGENT_TYPE_FIXTURE: input.agentType,
+            SKS_CODEX_0138_FAKE_APP_HANDOFF_FAIL: input.appHandoff ? '0' : '1',
+            SKS_CODEX_0138_FAKE_IMAGE_PATH_FAIL: input.imagePathExposure ? '0' : '1',
+            SKS_CODEX_0138_FAKE_PLUGIN_JSON_FAIL: '0',
+            SKS_CODEX_PLUGIN_JSON_FAKE_NO_MCP: input.mcpCandidates ? '0' : '1',
+            SKS_CODEX_0139_FAKE_WEB_SEARCH_FAIL: input.codeModeWebSearch ? '0' : '1',
+            SKS_CODEX_0139_FAKE_MARKETPLACE_FAIL: '0',
+            SKS_CODEX_0139_FAKE_PROFILE_ALIAS_FAIL: '0',
+            SKS_CODEX_0139_FAKE_INTERRUPT_FAIL: '0',
+            SKS_CODEX_0139_FAKE_RICH_SCHEMA_FAIL: '0',
+            SKS_CODEX_0139_FAKE_DOCTOR_ENV_FAIL: '0',
+            SKS_LOOP_RUNTIME_FIXTURE: '1',
+            SKS_TEST_RUNTIME_FIXTURE_ALLOWED: '1'
+        }
+    };
+}
+export async function withFixtureEnv(fixture, fn) {
+    const previous = new Map();
+    for (const [key, value] of Object.entries(fixture.env)) {
+        previous.set(key, process.env[key]);
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        for (const [key, value] of previous) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+    }
+}
+//# sourceMappingURL=codex-native-runtime-e2e-fixture.js.map

package/dist/scripts/loop-worker-fixture-child.js

@@ -48,6 +48,7 @@ await fs.writeFile(intake.result_path, `${JSON.stringify({
     blockers: [],
     runtime_proof_path: intake.result_path,
     worker_ids: workerIds,
-    session_ids: sessionIds
+    session_ids: sessionIds,
+    codex_native_invocation_plan: intake.codex_native_invocation_plan || null
 }, null, 2)}\n`);
 //# sourceMappingURL=loop-worker-fixture-child.js.map

package/dist/scripts/sks-3-1-5-directive-check-lib.js

@@ -259,7 +259,7 @@ async function richContentGate(id) {
         const codexHome = path.join(rootDir, 'codex-home');
         const report = await mod.syncCodexAgentRoles({ root: rootDir, codexHome, apply: true });
         const role = fs.readFileSync(path.join(codexHome, 'agents', 'sks-checker.toml'), 'utf8');
-        assertGate(role.includes('SKS managed 3.1.6 directive role') && role.includes('Execution role strategy'), 'managed agent role must include rich directive content', { role, report });
+        assertGate(/SKS managed 3\.1\.[67] directive role/.test(role) && role.includes('Execution role strategy'), 'managed agent role must include rich directive content', { role, report });
         emitGate(id, { roles: report.created.length });
     }
     finally {

package/dist/scripts/sks-3-1-6-directive-check-lib.js

@@ -321,7 +321,7 @@ async function initDeepMemoryScopeSafety(id) {
     emitGate(id);
 }
 async function releaseScriptsTypeSafe(id) {
-    for (const rel of ['src/scripts/release-dag-full-coverage-check.ts', 'src/scripts/sks-3-1-5-directive-check-lib.ts', 'src/scripts/sks-3-1-6-directive-check-lib.ts']) {
+    for (const rel of ['src/scripts/release-dag-full-coverage-check.ts', 'src/scripts/sks-3-1-5-directive-check-lib.ts', 'src/scripts/sks-3-1-6-directive-check-lib.ts', 'src/scripts/sks-3-1-7-directive-check-lib.ts']) {
         const text = readText(rel);
         assertGate(!/^\s*\/\/\s*@ts-nocheck\b/m.test(text), `release helper still has ts-nocheck:${rel}`);
     }
@@ -334,7 +334,7 @@ async function noTsNoCheckReleaseScripts(id) {
     const checked = listFiles(path.join(root, 'src/scripts')).filter((file) => {
         const rel = path.relative(root, file).split(path.sep).join('/');
         return /^src\/scripts\/release-dag-full-coverage-check\.ts$/.test(rel)
-            || /^src\/scripts\/sks-3-1-[56]-directive-check-lib\.ts$/.test(rel)
+            || /^src\/scripts\/sks-3-1-[567]-directive-check-lib\.ts$/.test(rel)
             || /^src\/scripts\/no-ts-nocheck-release-scripts-check\.ts$/.test(rel)
             || /^src\/scripts\/release-script-type-safety-check\.ts$/.test(rel);
     });