sneakoscope 3.1.6 → 3.1.8

package/dist/core/codex-native/codex-native-reference-source.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { ensureCodexNativeReferenceSnapshot } from './codex-native-reference-cache.js';
 const PATTERNS = [
     { id: 'no-global-optional-tooling', claim: 'optional tooling avoids mandatory global install', re: /\bnpx\b|no[- ]global|global install/i },
     { id: 'plugin-lifecycle-state-separation', claim: 'plugin install state is separated from approval/readiness', re: /\bplugin\b.+\b(install|enable|marketplace|lifecycle)\b/i },
@@ -18,7 +19,26 @@ const PATTERNS = [
 ];
 export async function analyzeCodexNativeReferenceSource(input) {
     const root = path.resolve(input.root);
-    const sourceDir = input.sourceDir ? path.resolve(input.sourceDir) : path.join(root, '.sneakoscope', 'cache', 'codex-native-reference');
+    const cacheInput = input.sourceRef ? { root, ref: input.sourceRef } : { root };
+    const cache = input.sourceDir
+        ? null
+        : await ensureCodexNativeReferenceSnapshot(cacheInput).catch((err) => ({
+            schema: 'sks.codex-native-reference-cache.v1',
+            generated_at: nowIso(),
+            ok: false,
+            cache_dir: '.sneakoscope/cache/codex-native-reference',
+            source_url_hash: null,
+            source_ref: input.sourceRef || 'HEAD',
+            source_sha: null,
+            refreshed: false,
+            offline: true,
+            blockers: [messageOf(err)],
+            warnings: ['reference_cache_exception']
+        }));
+    const sourceDir = input.sourceDir
+        ? path.resolve(input.sourceDir)
+        : path.join(root, cache?.cache_dir || '.sneakoscope/cache/codex-native-reference');
+    const confidence = input.sourceDir ? 'high' : cache?.ok ? cache.refreshed ? 'high' : 'medium' : 'low';
     const files = await listTextFiles(sourceDir);
     const evidence = [];
     const blockers = [];
@@ -26,7 +46,7 @@ export async function analyzeCodexNativeReferenceSource(input) {
         const rel = path.relative(sourceDir, file).split(path.sep).join('/');
         const text = await fs.readFile(file, 'utf8').catch(() => '');
         if (text)
-            evidence.push(...extractCodexNativeEvidence(rel, text));
+            evidence.push(...extractCodexNativeEvidence(rel, text).map((row) => ({ ...row, confidence })));
     }
     if (!files.length || !evidence.length)
         blockers.push('source_snapshot_missing');
@@ -34,11 +54,14 @@ export async function analyzeCodexNativeReferenceSource(input) {
         schema: 'sks.codex-native-reference-evidence.v1',
         generated_at: nowIso(),
         source_kind: 'external-reference-source',
-        source_ref: input.sourceRef || sourceDir,
-        source_sha: await gitSha(sourceDir),
+        source_ref: neutralSourceRef(input, cache, sourceDir),
+        source_sha: cache?.source_sha || await gitSha(sourceDir),
+        source_url_hash: cache?.source_url_hash || null,
+        cache_report_path: cache ? '.sneakoscope/reports/codex-native-reference-cache.json' : null,
+        cache,
         evidence,
-        blockers,
-        warnings: blockers.length ? ['reference_evidence_incomplete'] : []
+        blockers: [...new Set([...blockers, ...(cache?.blockers || [])])],
+        warnings: [...new Set([...(cache?.warnings || []), ...(blockers.length ? ['reference_evidence_incomplete'] : [])])]
     };
     if (input.writeReport !== false) {
         await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-native-reference-evidence.json'), report).catch(() => undefined);
@@ -74,6 +97,8 @@ export function renderCodexNativeReferenceMarkdown(report) {
         '',
         `Generated at: \`${report.generated_at}\``,
         `Source kind: \`${report.source_kind}\``,
+        `Source URL hash: \`${report.source_url_hash || 'none'}\``,
+        `Source SHA: \`${report.source_sha || 'none'}\``,
         '',
         '| Pattern | File | Lines | Snippet Hash | Confidence |',
         '|---|---|---:|---|---|',
@@ -81,21 +106,32 @@ export function renderCodexNativeReferenceMarkdown(report) {
         ''
     ].join('\n');
 }
+function neutralSourceRef(input, cache, sourceDir) {
+    if (cache)
+        return `cache:${createHash('sha256').update(`${cache.cache_dir}:${cache.source_ref}:${cache.source_sha || ''}`).digest('hex').slice(0, 16)}`;
+    if (input.sourceRef)
+        return `explicit:${createHash('sha256').update(input.sourceRef).digest('hex').slice(0, 16)}`;
+    return `explicit-source-dir:${createHash('sha256').update(sourceDir).digest('hex').slice(0, 16)}`;
+}
 async function listTextFiles(dir) {
     const out = [];
-    await walk(dir, out);
-    return out.filter((file) => /\.(md|txt|json|toml|ya?ml|js|ts|mjs|cjs)$/i.test(file)).slice(0, 500);
+    await walk(dir, out, 500);
+    return out;
 }
-async function walk(dir, out) {
+async function walk(dir, out, maxFiles) {
+    if (out.length >= maxFiles)
+        return;
     const rows = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const row of rows) {
+        if (out.length >= maxFiles)
+            return;
         const full = path.join(dir, row.name);
         if (row.isDirectory()) {
             if (['.git', 'node_modules', 'dist'].includes(row.name))
                 continue;
-            await walk(full, out);
+            await walk(full, out, maxFiles);
         }
-        else if (row.isFile()) {
+        else if (row.isFile() && /\.(md|txt|json|toml|ya?ml|js|ts|mjs|cjs)$/i.test(row.name)) {
             out.push(full);
         }
     }
@@ -107,4 +143,7 @@ async function gitSha(sourceDir) {
         return (await fs.readFile(path.join(sourceDir, '.git', ref), 'utf8').catch(() => '')).trim() || null;
     return /^[0-9a-f]{40}$/i.test(head.trim()) ? head.trim() : null;
 }
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
 //# sourceMappingURL=codex-native-reference-source.js.map

package/dist/core/codex-native/codex-native-repair-transaction.js

@@ -0,0 +1,150 @@
+import path from 'node:path';
+import { buildCodexHookLifecycle } from '../codex-app/codex-hook-lifecycle.js';
+import { runCodexInitDeep } from '../codex-app/codex-init-deep.js';
+import { syncCodexAgentRoles } from '../codex-app/codex-agent-role-sync.js';
+import { syncCodexSksSkills } from '../codex-app/codex-skill-sync.js';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+import { evaluateMutation, mutationLedgerPath, recordMutation } from '../safety/mutation-ledger.js';
+export async function repairCodexNativeManagedAssets(input) {
+    const root = path.resolve(input.root);
+    const requested = {
+        skills: input.repairSkills !== false,
+        agent_roles: input.repairAgentRoles !== false,
+        hooks: input.repairHooks !== false,
+        project_memory: input.repairProjectMemory !== false
+    };
+    const requestedAssets = Object.entries(requested)
+        .filter(([, enabled]) => enabled)
+        .map(([asset]) => asset);
+    if (input.yes !== true) {
+        const report = {
+            schema: 'sks.codex-native-repair-transaction.v1',
+            ok: false,
+            generated_at: nowIso(),
+            requested_by: input.requestedBy,
+            repaired: requestedAssets.map((asset) => ({
+                asset,
+                ok: false,
+                changed: false,
+                artifact_path: artifactPathFor(asset),
+                blockers: ['repair_transaction_requires_yes']
+            })),
+            confirmed: false,
+            mutation_ledger_path: null,
+            blockers: ['repair_transaction_requires_yes'],
+            warnings: []
+        };
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-native-repair-transaction.json'), report).catch(() => undefined);
+        return report;
+    }
+    const rows = [];
+    if (requested.skills) {
+        const report = await syncCodexSksSkills({ root, apply: true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+        rows.push({
+            asset: 'skills',
+            ok: recordOk(report) !== false,
+            changed: listLength(report, 'created') > 0,
+            artifact_path: '.sneakoscope/reports/codex-skill-sync.json',
+            blockers: blockersOf(report)
+        });
+    }
+    if (requested.agent_roles) {
+        const report = await syncCodexAgentRoles({ root, apply: true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+        rows.push({
+            asset: 'agent_roles',
+            ok: recordOk(report) !== false,
+            changed: listLength(report, 'created') > 0,
+            artifact_path: '.sneakoscope/reports/codex-agent-role-sync.json',
+            blockers: blockersOf(report)
+        });
+    }
+    if (requested.hooks) {
+        const report = await buildCodexHookLifecycle({ root, apply: true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+        rows.push({
+            asset: 'hooks',
+            ok: recordOk(report) !== false,
+            changed: recordOk(report) !== false,
+            artifact_path: '.sneakoscope/reports/codex-hook-lifecycle.json',
+            blockers: blockersOf(report)
+        });
+    }
+    if (requested.project_memory) {
+        const report = await runCodexInitDeep({ root, apply: true, directoryLocal: true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+        rows.push({
+            asset: 'project_memory',
+            ok: recordOk(report) !== false,
+            changed: listLength(report, 'directory_local_agents.created') + listLength(report, 'directory_local_agents.updated') > 0,
+            artifact_path: '.sneakoscope/reports/codex-init-deep.json',
+            blockers: blockersOf(report)
+        });
+    }
+    const blockers = rows.flatMap((row) => row.blockers);
+    const mutationWarnings = await recordRepairMutations(root, rows);
+    const report = {
+        schema: 'sks.codex-native-repair-transaction.v1',
+        ok: rows.every((row) => row.ok) && blockers.length === 0,
+        generated_at: nowIso(),
+        requested_by: input.requestedBy,
+        repaired: rows,
+        confirmed: true,
+        mutation_ledger_path: path.relative(root, mutationLedgerPath(root)).split(path.sep).join('/'),
+        blockers: [...new Set(blockers)],
+        warnings: mutationWarnings
+    };
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-native-repair-transaction.json'), report).catch(() => undefined);
+    return report;
+}
+async function recordRepairMutations(root, rows) {
+    const contract = createRequestedScopeContract({
+        route: 'codex-native-repair-transaction',
+        userRequest: 'Repair SKS-managed Codex Native assets after explicit --yes confirmation.',
+        projectRoot: root,
+        overrides: { global_codex_config: true }
+    });
+    const warnings = [];
+    for (const row of rows) {
+        const kind = row.asset === 'project_memory' ? 'file_write' : 'global_config_write';
+        const entry = evaluateMutation(contract, kind, {
+            target: row.asset,
+            confirmed: true,
+            applied: row.changed,
+            noOpReason: row.changed ? 'sks_managed_asset_transaction_recorded' : 'repair_noop'
+        });
+        await recordMutation(root, entry).catch((err) => warnings.push(`mutation_ledger_write_failed:${messageOf(err)}`));
+    }
+    return warnings;
+}
+function artifactPathFor(asset) {
+    return asset === 'skills'
+        ? '.sneakoscope/reports/codex-skill-sync.json'
+        : asset === 'agent_roles'
+            ? '.sneakoscope/reports/codex-agent-role-sync.json'
+            : asset === 'hooks'
+                ? '.sneakoscope/reports/codex-hook-lifecycle.json'
+                : '.sneakoscope/reports/codex-init-deep.json';
+}
+function recordOk(value) {
+    return Boolean(value) && typeof value === 'object' && typeof value.ok === 'boolean'
+        ? value.ok
+        : undefined;
+}
+function blockersOf(value) {
+    return Boolean(value) && typeof value === 'object' && Array.isArray(value.blockers)
+        ? value.blockers.map((item) => String(item)).filter(Boolean)
+        : [];
+}
+function listLength(value, key) {
+    const parts = key.split('.');
+    let current = value;
+    for (const part of parts) {
+        if (!current || typeof current !== 'object')
+            return 0;
+        current = current[part];
+    }
+    return Array.isArray(current) ? current.length : 0;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=codex-native-repair-transaction.js.map

package/dist/core/codex-native/core-skill-integrity.js

@@ -0,0 +1,89 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { buildSksCoreSkillManifest, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
+import { canonicalSkillName } from './skill-name-canonicalizer.js';
+export async function syncCoreSkillsIntegrity(input) {
+    const root = path.resolve(input.root);
+    const skillsRoot = input.skillsRoot || path.join(root, '.agents', 'skills');
+    const apply = input.apply === true;
+    const manifest = buildSksCoreSkillManifest();
+    const rows = [];
+    const installed = [];
+    const restored = [];
+    const skippedUserAuthored = [];
+    const blockers = [];
+    for (const skill of manifest.skills) {
+        const skillDir = path.join(skillsRoot, skill.canonical_name);
+        const file = path.join(skillDir, 'SKILL.md');
+        const desired = renderCoreSkillTemplate(skill.canonical_name);
+        const current = await readText(file, null);
+        const beforeSha = typeof current === 'string' ? sha256(current) : null;
+        let action = 'already-current';
+        let backupPath = null;
+        let blocker = null;
+        if (current === null) {
+            action = 'install-missing-managed-copy';
+            if (apply) {
+                await ensureDir(skillDir);
+                await writeTextAtomic(file, desired);
+                installed.push(file);
+            }
+        }
+        else if (beforeSha === skill.content_sha256) {
+            action = 'already-current';
+        }
+        else if (isSksManagedCoreSkillContent(current)) {
+            action = 'restore-corrupted-managed-copy';
+            if (apply) {
+                backupPath = path.join(root, '.sneakoscope', 'backups', 'core-skills', skill.canonical_name, `${Date.now()}-${process.pid}.SKILL.md.bak`);
+                await ensureDir(path.dirname(backupPath));
+                await fs.writeFile(backupPath, current, 'utf8');
+                await writeTextAtomic(file, desired);
+                restored.push(file);
+            }
+        }
+        else {
+            action = 'skip-user-authored';
+            blocker = `user_authored_core_skill_collision:${skill.canonical_name}`;
+            skippedUserAuthored.push(file);
+        }
+        const after = await readText(file, null);
+        const afterSha = typeof after === 'string' ? sha256(after) : null;
+        rows.push({
+            canonical_name: skill.canonical_name,
+            path: file,
+            action,
+            before_sha256: beforeSha,
+            after_sha256: afterSha,
+            backup_path: backupPath,
+            blocker
+        });
+        if (blocker)
+            blockers.push(blocker);
+    }
+    const report = {
+        schema: 'sks.core-skill-integrity.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        root,
+        apply,
+        skills_root: skillsRoot,
+        manifest_sha256: sha256(JSON.stringify(manifest.skills.map((skill) => [skill.canonical_name, skill.content_sha256]))),
+        rows,
+        installed,
+        restored,
+        skipped_user_authored: skippedUserAuthored,
+        blockers
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'core-skill-integrity.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, report).catch(() => undefined);
+    return report;
+}
+export function coreSkillPath(skillsRoot, name) {
+    return path.join(skillsRoot, canonicalSkillName(name), 'SKILL.md');
+}
+//# sourceMappingURL=core-skill-integrity.js.map

package/dist/core/codex-native/core-skill-manifest.js

@@ -0,0 +1,156 @@
+import { PACKAGE_VERSION, nowIso, sha256 } from '../fsx.js';
+import { canonicalSkillName } from './skill-name-canonicalizer.js';
+export const CORE_SKILL_TEMPLATE_VERSION = '3.1.8-core-skill-template.v1';
+export const CORE_SKILL_MANAGED_BEGIN = '<!-- BEGIN SKS IMMUTABLE CORE SKILL -->';
+export const CORE_SKILL_MANAGED_END = '<!-- END SKS IMMUTABLE CORE SKILL -->';
+const CORE_SKILL_DEFINITIONS = [
+    {
+        id: 'sks-core-loop',
+        canonical_name: 'loop',
+        display_name: 'loop',
+        route: '$Loop',
+        purpose: 'compile persisted route work into bounded loop plans with continuation evidence.',
+        when: 'Use for resumable route stages, memory hints, and loop mission artifacts.',
+        evidence: '.sneakoscope/loops/** plus route-local proof artifacts.',
+        fallback: 'Record the unavailable surface as blocked; do not fabricate a loop proof.'
+    },
+    {
+        id: 'sks-core-naruto',
+        canonical_name: 'naruto',
+        display_name: 'naruto',
+        route: '$Naruto',
+        purpose: 'fan out bounded native worker lanes while parent integration remains owner.',
+        when: 'Use when the selected route explicitly requires high-scale parallel review or implementation.',
+        evidence: 'agent task graph, worker ledgers, leases, proof evidence, and cleanup artifacts.',
+        fallback: 'Degrade to parent-owned execution with blockers recorded if native lanes are unavailable.'
+    },
+    {
+        id: 'sks-core-qa-loop',
+        canonical_name: 'qa-loop',
+        display_name: 'qa-loop',
+        route: '$QA-LOOP',
+        purpose: 'dogfood UI/API behavior with safety gates and QA reports.',
+        when: 'Use when route completion needs human-proxy verification, rechecks, and QA ledgers.',
+        evidence: 'qa-ledger.json, dated QA report, qa-gate.json, and post-fix verification.',
+        fallback: 'Mark unverified browser/native surfaces explicitly; never substitute fake visual evidence.'
+    },
+    {
+        id: 'sks-core-research',
+        canonical_name: 'research',
+        display_name: 'research',
+        route: '$Research',
+        purpose: 'run evidence-bound discovery, source ledgers, and synthesis cycles.',
+        when: 'Use for discovery, evaluation, external-source claims, or frontier-style research.',
+        evidence: 'research plan, source ledger, cycle record, synthesis, and final review.',
+        fallback: 'State source/tool unavailability and avoid unsupported live-accuracy claims.'
+    },
+    {
+        id: 'sks-core-dfix',
+        canonical_name: 'dfix',
+        display_name: 'dfix',
+        route: '$DFix',
+        purpose: 'perform tiny direct fixes with cheap verification.',
+        when: 'Use only for narrow copy/config/docs/labels/spacing/translation/mechanical edits.',
+        evidence: 'focused diff and DFix Honest check.',
+        fallback: 'Escalate broad implementation to a full execution route.'
+    },
+    {
+        id: 'sks-core-image-ux-review',
+        canonical_name: 'image-ux-review',
+        display_name: 'image-ux-review',
+        route: '$Image-UX-Review',
+        purpose: 'produce generated annotated UI review images and extract issue ledgers.',
+        when: 'Use for screenshot/UI UX review requests that require generated raster evidence.',
+        evidence: 'source inventory, generated annotation image ledger, issue ledger, iteration report.',
+        fallback: 'Block full verification if generated annotated images cannot be produced.'
+    },
+    {
+        id: 'sks-core-computer-use',
+        canonical_name: 'computer-use',
+        display_name: 'computer-use',
+        route: '$Computer-Use',
+        purpose: 'operate native macOS desktop apps through Codex Computer Use.',
+        when: 'Use only for native Mac/non-web app or OS-setting surfaces.',
+        evidence: 'native desktop interaction evidence where live Computer Use is available.',
+        fallback: 'Do not use Computer Use as browser/web evidence; mark unavailable surfaces unverified.'
+    },
+    {
+        id: 'sks-core-init-deep',
+        canonical_name: 'init-deep',
+        display_name: 'init-deep',
+        route: '$Init-Deep',
+        purpose: 'refresh project-local memory, directory rules, and loop memory hints.',
+        when: 'Use when deeper local context or directory-specific recall is required.',
+        evidence: '.sneakoscope/context/AGENTS.generated.md and managed memory artifacts.',
+        fallback: 'Preserve user content and skip directories that cannot be safely updated.'
+    }
+];
+export function coreSkillDefinitions() {
+    return CORE_SKILL_DEFINITIONS;
+}
+export function isCoreSkillName(name) {
+    const canonical = canonicalSkillName(name);
+    return CORE_SKILL_DEFINITIONS.some((skill) => skill.canonical_name === canonical);
+}
+export function renderCoreSkillTemplate(name) {
+    const canonical = canonicalSkillName(name);
+    const skill = CORE_SKILL_DEFINITIONS.find((entry) => entry.canonical_name === canonical);
+    if (!skill)
+        throw new Error(`Unknown SKS core skill: ${name}`);
+    return [
+        '---',
+        `name: ${skill.display_name}`,
+        `description: Immutable SKS core Codex App route bridge for ${skill.route}.`,
+        '---',
+        '',
+        CORE_SKILL_MANAGED_BEGIN,
+        `id: ${skill.id}`,
+        `canonical_name: ${skill.canonical_name}`,
+        `route: ${skill.route}`,
+        `template_version: ${CORE_SKILL_TEMPLATE_VERSION}`,
+        'mutable_by_doctor: false',
+        'mutable_by_update: false',
+        'mutable_by_setup: false',
+        CORE_SKILL_MANAGED_END,
+        '',
+        `Route: ${skill.route}`,
+        `Command: ${skill.route}`,
+        `Purpose: ${skill.purpose}`,
+        `Use when: ${skill.when}`,
+        `Proof paths: ${skill.evidence}`,
+        'Safety rules: preserve user-authored skills, keep route state bounded, and stop on hard blockers instead of fabricating fallback behavior.',
+        `Failure recovery: ${skill.fallback}`,
+        ''
+    ].join('\n');
+}
+export function buildSksCoreSkillManifest(generatedAt = nowIso()) {
+    return {
+        schema: 'sks.core-skill-manifest.v1',
+        generated_at: generatedAt,
+        package_version: PACKAGE_VERSION,
+        skills: CORE_SKILL_DEFINITIONS.map((skill) => {
+            const content = renderCoreSkillTemplate(skill.canonical_name);
+            return {
+                id: skill.id,
+                canonical_name: skill.canonical_name,
+                display_name: skill.display_name,
+                route: skill.route,
+                relative_path: `.agents/skills/${skill.canonical_name}/SKILL.md`,
+                template_version: CORE_SKILL_TEMPLATE_VERSION,
+                content_sha256: sha256(content),
+                mutable_by_doctor: false,
+                mutable_by_update: false,
+                mutable_by_setup: false
+            };
+        })
+    };
+}
+export function coreSkillTemplateByCanonicalName(name) {
+    const canonical = canonicalSkillName(name);
+    return buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills.find((skill) => skill.canonical_name === canonical) || null;
+}
+export function isSksManagedCoreSkillContent(text) {
+    const value = String(text || '');
+    return value.includes(CORE_SKILL_MANAGED_BEGIN) && value.includes(CORE_SKILL_MANAGED_END);
+}
+//# sourceMappingURL=core-skill-manifest.js.map

package/dist/core/codex-native/native-capability-postcheck.js

@@ -0,0 +1,35 @@
+import path from 'node:path';
+import { writeJsonAtomic } from '../fsx.js';
+import { buildNativeCapabilityRepairMatrix } from './native-capability-repair-matrix.js';
+export async function postcheckNativeCapabilities(input) {
+    const root = path.resolve(input.root);
+    const matrix = input.matrix || await buildNativeCapabilityRepairMatrix({ root, fixture: input.fixture || false, reportPath: null });
+    const capabilities = matrix.capabilities.map((state) => {
+        const verifiedAfterRepair = state.repairability === 'auto' || state.repairability === 'doctor-fix';
+        if (state.id === 'computer_use' && process.env.SKS_COMPUTER_USE_CAPABILITY !== 'verified') {
+            return { ...state, after: 'unknown', blockers: ['computer_use_os_permission_or_capability_unknown'] };
+        }
+        if (state.id === 'chrome_web_review' && process.env.SKS_CHROME_EXTENSION_READY !== '1' && input.fixture !== 'all-repairable') {
+            return { ...state, after: 'unknown', blockers: ['codex_chrome_extension_readiness_not_verified'] };
+        }
+        if (state.blockers.length === 0 || verifiedAfterRepair)
+            return { ...state, after: state.repairability === 'manual-required' ? 'unknown' : 'verified', blockers: state.repairability === 'manual-required' ? state.blockers : [] };
+        return { ...state, after: 'blocked' };
+    });
+    const blockers = capabilities.flatMap((state) => state.after === 'verified' ? [] : state.blockers);
+    const checked = {
+        ...matrix,
+        generated_at: new Date().toISOString(),
+        ok: blockers.length === 0,
+        capabilities,
+        blockers,
+        warnings: capabilities.flatMap((state) => state.warnings)
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'native-capability-postcheck.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, checked).catch(() => undefined);
+    return checked;
+}
+//# sourceMappingURL=native-capability-postcheck.js.map