sneakoscope 3.1.6 → 3.1.8

package/dist/core/codex-native/native-capability-repair-matrix.js

@@ -0,0 +1,210 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { detectImagegenCapability } from '../imagegen/imagegen-capability.js';
+import { buildCodexNativeFeatureMatrix } from './codex-native-feature-broker.js';
+export const NATIVE_CAPABILITY_IDS = [
+    'image_generation',
+    'image_followup_edit',
+    'computer_use',
+    'chrome_web_review',
+    'codex_app_screenshot',
+    'app_handoff',
+    'image_path_exposure',
+    'saved_artifact_path_contract'
+];
+export async function buildNativeCapabilityRepairMatrix(input) {
+    const root = path.resolve(input.root);
+    const selected = new Set(input.capabilities || NATIVE_CAPABILITY_IDS);
+    const fixture = input.fixture || false;
+    const imageCapability = fixture
+        ? fixtureImageCapability(fixture)
+        : await detectImagegenCapability({ timeoutMs: 2500 }).catch((err) => ({ blockers: [messageOf(err)], auth_readiness: null, codex_app: { available: false } }));
+    const nativeFeatureMatrix = fixture
+        ? fixtureNativeFeatureMatrix(fixture)
+        : await buildCodexNativeFeatureMatrix({ root, mode: 'read-only' }).catch((err) => ({ ok: false, features: {}, blockers: [messageOf(err)], invocation_defaults: {} }));
+    const states = await Promise.all(NATIVE_CAPABILITY_IDS.filter((id) => selected.has(id)).map((id) => stateForCapability(root, id, imageCapability, nativeFeatureMatrix)));
+    const blockers = states.flatMap((state) => state.blockers);
+    const warnings = states.flatMap((state) => state.warnings);
+    const matrix = {
+        schema: 'sks.native-capability-repair-matrix.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        capabilities: states,
+        blockers,
+        warnings
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'native-capability-repair-matrix.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, matrix).catch(() => undefined);
+    return matrix;
+}
+async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix) {
+    const reports = path.join(root, '.sneakoscope', 'reports');
+    if (id === 'image_generation') {
+        const verified = imageCapability?.codex_app?.available === true || imageCapability?.auth_readiness?.headless_auto_available === true;
+        return {
+            id,
+            before: verified ? 'verified' : 'blocked',
+            repairability: verified ? 'auto' : 'manual-required',
+            repair_actions: verified ? ['postcheck-imagegen-path-contract'] : ['Sign in to Codex App and enable/use the built-in $imagegen surface, or provide explicit imagegen auth for a non-Codex fallback.'],
+            after: null,
+            artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
+            blockers: verified ? [] : ['imagegen_auth_or_codex_app_builtin_missing'],
+            warnings: verified ? [] : ['image_generation_not_verified_without_real_capability']
+        };
+    }
+    if (id === 'image_followup_edit') {
+        const contractReady = await fileExists(path.join(root, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json'));
+        return autoState(id, contractReady, path.join(reports, 'saved-artifact-path-contract.json'), ['create-saved-artifact-path-contract']);
+    }
+    if (id === 'codex_app_screenshot') {
+        const dir = path.join(root, '.sneakoscope', 'app-screenshots');
+        const ready = await dirWritable(dir);
+        return autoState(id, ready, path.join(root, '.sneakoscope', 'app-screenshots', 'screenshot-registry.json'), ['create-app-screenshot-directory', 'create-screenshot-registry']);
+    }
+    if (id === 'saved_artifact_path_contract') {
+        const ready = await fileExists(path.join(reports, 'saved-artifact-path-contract.json'));
+        return autoState(id, ready, path.join(reports, 'saved-artifact-path-contract.json'), ['create-saved-artifact-path-contract']);
+    }
+    if (id === 'app_handoff') {
+        const ok = featureOk(nativeFeatureMatrix, 'app_handoff');
+        return {
+            id,
+            before: ok ? 'verified' : 'unknown',
+            repairability: ok ? 'auto' : 'manual-required',
+            repair_actions: ok ? ['postcheck-app-handoff'] : ['Open Codex App and approve/enable app handoff; rerun `sks doctor --fix --repair-native-capabilities --yes`.'],
+            after: null,
+            artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
+            blockers: ok ? [] : ['codex_app_handoff_not_verified'],
+            warnings: ok ? [] : ['manual_app_handoff_approval_required']
+        };
+    }
+    if (id === 'image_path_exposure') {
+        const ok = featureOk(nativeFeatureMatrix, 'image_path_exposure');
+        const fallback = await fileExists(path.join(reports, 'saved-artifact-path-contract.json'));
+        return {
+            id,
+            before: ok ? 'verified' : fallback ? 'degraded' : 'missing',
+            repairability: ok ? 'auto' : 'doctor-fix',
+            repair_actions: ok ? ['postcheck-image-path-exposure'] : ['create-saved-artifact-path-contract'],
+            after: null,
+            artifact_path: path.join(reports, 'saved-artifact-path-contract.json'),
+            blockers: ok || fallback ? [] : ['image_path_exposure_missing_without_fallback_contract'],
+            warnings: ok ? [] : ['using_saved_artifact_path_contract_fallback']
+        };
+    }
+    if (id === 'computer_use') {
+        const envVerified = process.env.SKS_COMPUTER_USE_CAPABILITY === 'verified';
+        return {
+            id,
+            before: envVerified ? 'verified' : 'unknown',
+            repairability: envVerified ? 'auto' : 'manual-required',
+            repair_actions: envVerified ? ['postcheck-computer-use'] : ['Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions, then rerun doctor.'],
+            after: null,
+            artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
+            blockers: envVerified ? [] : ['computer_use_os_permission_or_capability_unknown'],
+            warnings: envVerified ? [] : ['manual_os_permission_required']
+        };
+    }
+    const chromeReady = process.env.SKS_CHROME_EXTENSION_READY === '1' || featureOk(nativeFeatureMatrix, 'plugin_json');
+    return {
+        id,
+        before: chromeReady ? 'verified' : 'unknown',
+        repairability: chromeReady ? 'auto' : 'manual-required',
+        repair_actions: chromeReady ? ['postcheck-chrome-extension-readiness'] : ['Install/enable the official Codex Chrome Extension, approve it in Codex App, then rerun QA/browser verification.'],
+        after: null,
+        artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
+        blockers: chromeReady ? [] : ['codex_chrome_extension_readiness_not_verified'],
+        warnings: chromeReady ? [] : ['manual_chrome_extension_setup_required']
+    };
+}
+export async function writeSavedArtifactPathContract(root) {
+    const artifactPath = path.join(root, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json');
+    await writeJsonAtomic(artifactPath, {
+        schema: 'sks.saved-artifact-path-contract.v1',
+        generated_at: nowIso(),
+        root,
+        image_artifacts: path.join(root, '.sneakoscope', 'image-artifacts'),
+        app_screenshots: path.join(root, '.sneakoscope', 'app-screenshots'),
+        model_visible_path_strategy: 'saved-artifact-path',
+        raw_secret_values_recorded: false
+    });
+    return artifactPath;
+}
+export async function ensureNativeCapabilityArtifactRoots(root) {
+    const imageDir = path.join(root, '.sneakoscope', 'image-artifacts');
+    const appDir = path.join(root, '.sneakoscope', 'app-screenshots');
+    await ensureDir(imageDir);
+    await ensureDir(appDir);
+    const imageRegistry = path.join(imageDir, 'image-artifact-registry.json');
+    const screenshotRegistry = path.join(appDir, 'screenshot-registry.json');
+    const created = [];
+    if (!(await fileExists(imageRegistry))) {
+        await writeJsonAtomic(imageRegistry, { schema: 'sks.image-artifact-registry.v1', generated_at: nowIso(), images: [] });
+        created.push(imageRegistry);
+    }
+    if (!(await fileExists(screenshotRegistry))) {
+        await writeJsonAtomic(screenshotRegistry, { schema: 'sks.app-screenshot-registry.v1', generated_at: nowIso(), screenshots: [] });
+        created.push(screenshotRegistry);
+    }
+    created.push(await writeSavedArtifactPathContract(root));
+    return created;
+}
+function autoState(id, ready, artifactPath, actions) {
+    return {
+        id,
+        before: ready ? 'verified' : 'missing',
+        repairability: ready ? 'auto' : 'doctor-fix',
+        repair_actions: ready ? [`postcheck-${id}`] : actions,
+        after: null,
+        artifact_path: artifactPath,
+        blockers: ready ? [] : [`${id}_repair_required`],
+        warnings: []
+    };
+}
+function featureOk(matrix, feature) {
+    return matrix?.features?.[feature]?.ok === true;
+}
+async function fileExists(file) {
+    try {
+        const stat = await fs.stat(file);
+        return stat.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function dirWritable(dir) {
+    try {
+        await ensureDir(dir);
+        await fs.access(dir);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function fixtureImageCapability(mode) {
+    return mode === 'all-repairable'
+        ? { codex_app: { available: true }, auth_readiness: { headless_auto_available: true }, blockers: [] }
+        : { codex_app: { available: false }, auth_readiness: { headless_auto_available: false }, blockers: ['fixture_manual_required'] };
+}
+function fixtureNativeFeatureMatrix(mode) {
+    const ok = mode === 'all-repairable';
+    return {
+        ok,
+        features: {
+            app_handoff: { ok },
+            image_path_exposure: { ok },
+            plugin_json: { ok }
+        },
+        blockers: ok ? [] : ['fixture_manual_required']
+    };
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=native-capability-repair-matrix.js.map

package/dist/core/codex-native/native-capability-repair.js

@@ -0,0 +1,47 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { syncCoreSkillsIntegrity } from './core-skill-integrity.js';
+import { buildNativeCapabilityRepairMatrix, ensureNativeCapabilityArtifactRoots } from './native-capability-repair-matrix.js';
+import { postcheckNativeCapabilities } from './native-capability-postcheck.js';
+export async function repairNativeCapabilities(input) {
+    const root = path.resolve(input.root);
+    const capabilitySelection = input.capabilities ? { capabilities: input.capabilities } : {};
+    const before = await buildNativeCapabilityRepairMatrix({
+        root,
+        ...capabilitySelection,
+        fixture: input.fixture || false,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'native-capability-repair-matrix-before.json')
+    });
+    const repaired = [];
+    if (input.fix) {
+        repaired.push(...await ensureNativeCapabilityArtifactRoots(root));
+        await syncCoreSkillsIntegrity({ root, apply: true }).catch(() => undefined);
+    }
+    const afterMatrix = await buildNativeCapabilityRepairMatrix({
+        root,
+        ...capabilitySelection,
+        fixture: input.fixture || false,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'native-capability-repair-matrix.json')
+    });
+    const postcheck = await postcheckNativeCapabilities({
+        root,
+        matrix: afterMatrix,
+        fixture: input.fixture || false,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'native-capability-postcheck.json')
+    });
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'native-capability-repair.json'), {
+        schema: 'sks.native-capability-repair.v1',
+        generated_at: nowIso(),
+        ok: postcheck.ok,
+        fix: input.fix,
+        yes: input.yes,
+        before,
+        after: postcheck,
+        repaired_artifacts: repaired,
+        manual_required: postcheck.capabilities
+            .filter((state) => state.repairability === 'manual-required' && state.after !== 'verified')
+            .map((state) => ({ id: state.id, actions: state.repair_actions }))
+    }).catch(() => undefined);
+    return postcheck;
+}
+//# sourceMappingURL=native-capability-repair.js.map

package/dist/core/codex-native/native-media-computer-repair.js

@@ -0,0 +1,5 @@
+import { repairNativeCapabilities } from './native-capability-repair.js';
+export async function repairNativeMediaComputerCapabilities(input) {
+    return repairNativeCapabilities(input);
+}
+//# sourceMappingURL=native-media-computer-repair.js.map

package/dist/core/codex-native/project-skill-dedupe.js

@@ -0,0 +1,109 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { buildSkillRegistryLedger, groupByCanonical } from './skill-registry-ledger.js';
+export async function dedupeProjectSkills(input) {
+    const root = path.resolve(input.root);
+    const fix = input.fix === true;
+    const yes = input.yes === true;
+    const ledger = await buildSkillRegistryLedger({ root });
+    const grouped = groupByCanonical(ledger.entries);
+    const actions = [];
+    const unresolvedUserDuplicates = [];
+    for (const [canonical, group] of grouped.entries()) {
+        if (group.length <= 1)
+            continue;
+        group.sort(compareSkillPriority);
+        const userEntries = group.filter((entry) => !entry.managed_by_sks);
+        const managedEntries = group.filter((entry) => entry.managed_by_sks);
+        if (userEntries.length > 0 && managedEntries.length > 0) {
+            for (const user of userEntries)
+                actions.push(actionRow(canonical, 'kept', user, null, 'user-authored skill preserved'));
+            for (const managed of managedEntries) {
+                const quarantine = await maybeQuarantine(root, canonical, managed, fix, 'managed collision with user-authored skill');
+                actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', managed, quarantine, 'managed collision with user-authored skill'));
+            }
+            continue;
+        }
+        if (managedEntries.length > 1) {
+            const current = managedEntries.find((entry) => entry.status === 'managed-current') || managedEntries[0];
+            if (current)
+                actions.push(actionRow(canonical, 'kept', current, null, 'highest-priority SKS-managed skill kept'));
+            for (const duplicate of managedEntries.filter((entry) => entry !== current)) {
+                const quarantine = await maybeQuarantine(root, canonical, duplicate, fix, 'duplicate SKS-managed skill');
+                actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', duplicate, quarantine, 'duplicate SKS-managed skill'));
+            }
+            continue;
+        }
+        if (userEntries.length > 1) {
+            const keep = userEntries[0];
+            if (keep)
+                actions.push(actionRow(canonical, 'kept', keep, null, 'highest-priority user-authored skill kept'));
+            const shouldMove = fix && yes && input.quarantineUserDuplicates === true;
+            for (const duplicate of userEntries.slice(1)) {
+                const quarantine = shouldMove ? await quarantineSkill(root, canonical, duplicate, 'user-authored duplicate skill') : null;
+                actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', duplicate, quarantine, 'user-authored duplicate skill requires --quarantine-user-duplicates --yes'));
+            }
+            if (!shouldMove)
+                unresolvedUserDuplicates.push(canonical);
+        }
+    }
+    const duplicateNames = [...new Set(actions.filter((action) => action.action !== 'kept').map((action) => action.canonical_name))].sort();
+    const blockers = unresolvedUserDuplicates.map((name) => `user_duplicate_requires_confirmation:${name}`);
+    const report = {
+        schema: 'sks.project-skill-dedupe.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        root,
+        fix,
+        yes,
+        actions,
+        duplicate_canonical_names: duplicateNames,
+        unresolved_user_duplicates: unresolvedUserDuplicates,
+        blockers
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'project-skill-dedupe.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, report).catch(() => undefined);
+    return report;
+}
+function compareSkillPriority(a, b) {
+    const currentA = a.status === 'managed-current' ? 1 : 0;
+    const currentB = b.status === 'managed-current' ? 1 : 0;
+    return currentB - currentA || b.active_priority - a.active_priority || a.path.localeCompare(b.path);
+}
+function actionRow(canonicalName, action, entry, quarantinePath, reason) {
+    return {
+        canonical_name: canonicalName,
+        action,
+        path: entry.path,
+        quarantine_path: quarantinePath,
+        reason
+    };
+}
+async function maybeQuarantine(root, canonical, entry, fix, reason) {
+    if (!fix)
+        return null;
+    return quarantineSkill(root, canonical, entry, reason);
+}
+async function quarantineSkill(root, canonical, entry, reason) {
+    const sourceDir = path.dirname(entry.path);
+    const stamp = `${Date.now()}-${process.pid}`;
+    const target = path.join(root, '.sneakoscope', 'quarantine', 'skills', canonical, stamp, path.basename(sourceDir));
+    await ensureDir(path.dirname(target));
+    await fs.cp(sourceDir, target, { recursive: true, force: false });
+    await fs.rm(sourceDir, { recursive: true, force: true });
+    await writeJsonAtomic(path.join(target, 'quarantine-record.json'), {
+        schema: 'sks.skill-quarantine-record.v1',
+        generated_at: nowIso(),
+        source_path: sourceDir,
+        quarantine_path: target,
+        canonical_name: canonical,
+        reason,
+        content_sha256: entry.content_sha256
+    });
+    return target;
+}
+//# sourceMappingURL=project-skill-dedupe.js.map

package/dist/core/codex-native/skill-name-canonicalizer.js

@@ -0,0 +1,21 @@
+export function canonicalSkillName(name) {
+    const normalizedPath = String(name || '').replace(/\\/g, '/').trim();
+    const parts = normalizedPath.split('/').filter(Boolean);
+    let leaf = parts.length ? String(parts[parts.length - 1]) : normalizedPath;
+    if (/^SKILL\.md$/i.test(leaf) && parts.length > 1)
+        leaf = String(parts[parts.length - 2]);
+    leaf = leaf.replace(/\.md$/i, '');
+    return leaf
+        .trim()
+        .toLowerCase()
+        .replace(/^[$@#]+/, '')
+        .replace(/[_\s]+/g, '-')
+        .replace(/[^a-z0-9-]/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '');
+}
+export function skillDisplayNameFromMarkdown(text, fallback) {
+    const match = String(text || '').match(/^name:\s*([^\n\r]+)/m);
+    return String(match?.[1] || fallback || '').trim().replace(/^["']|["']$/g, '');
+}
+//# sourceMappingURL=skill-name-canonicalizer.js.map

package/dist/core/codex-native/skill-registry-ledger.js

@@ -0,0 +1,85 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { nowIso, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { buildSksCoreSkillManifest, isSksManagedCoreSkillContent } from './core-skill-manifest.js';
+import { canonicalSkillName, skillDisplayNameFromMarkdown } from './skill-name-canonicalizer.js';
+export async function buildSkillRegistryLedger(input) {
+    const root = path.resolve(input.root);
+    const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
+    const scanRoots = [
+        { root: path.join(root, '.agents', 'skills'), scope: 'project', priority: 100 },
+        { root: path.join(root, '.codex', 'skills'), scope: 'project', priority: 80 },
+        { root: path.join(codexHome, 'skills'), scope: 'codex-home', priority: 60 },
+        ...(input.extraRoots || [])
+    ];
+    const manifestByName = new Map(buildSksCoreSkillManifest().skills.map((skill) => [skill.canonical_name, skill.content_sha256]));
+    const entries = [];
+    for (const scanRoot of scanRoots) {
+        const rows = await fs.readdir(scanRoot.root, { withFileTypes: true }).catch(() => []);
+        for (const row of rows) {
+            if (!row.isDirectory())
+                continue;
+            const skillPath = path.join(scanRoot.root, row.name, 'SKILL.md');
+            const text = await readText(skillPath, null);
+            if (typeof text !== 'string')
+                continue;
+            const displayName = skillDisplayNameFromMarkdown(text, row.name);
+            const canonical = canonicalSkillName(displayName || row.name);
+            const hash = sha256(text);
+            const managed = isSksManagedCoreSkillContent(text) || text.includes('BEGIN SKS MANAGED SKILL');
+            const expected = manifestByName.get(canonical);
+            const status = managed
+                ? expected && expected === hash ? 'managed-current' : 'managed-drift'
+                : 'user-owned';
+            entries.push({
+                schema: 'sks.skill-registry-entry.v1',
+                root: scanRoot.root,
+                scope: scanRoot.scope,
+                canonical_name: canonical,
+                display_name: displayName || row.name,
+                path: skillPath,
+                managed_by_sks: managed,
+                content_sha256: hash,
+                active_priority: scanRoot.priority,
+                status,
+                blockers: []
+            });
+        }
+    }
+    const grouped = groupByCanonical(entries);
+    const duplicates = [...grouped.entries()].filter(([, group]) => group.length > 1).map(([name]) => name).sort();
+    for (const group of grouped.values()) {
+        group.sort((a, b) => b.active_priority - a.active_priority || a.path.localeCompare(b.path));
+        group.forEach((entry, index) => {
+            if (group.length > 1 && index > 0)
+                entry.status = entry.status === 'user-owned' ? 'duplicate' : 'duplicate';
+        });
+    }
+    const blockers = duplicates.map((name) => `duplicate_skill_name:${name}`);
+    const ledger = {
+        schema: 'sks.skill-registry-ledger.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        root,
+        entries,
+        duplicate_canonical_names: duplicates,
+        blockers
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'skill-registry-ledger.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, ledger).catch(() => undefined);
+    return ledger;
+}
+export function groupByCanonical(entries) {
+    const grouped = new Map();
+    for (const entry of entries) {
+        const current = grouped.get(entry.canonical_name) || [];
+        current.push(entry);
+        grouped.set(entry.canonical_name, current);
+    }
+    return grouped;
+}
+//# sourceMappingURL=skill-registry-ledger.js.map

package/dist/core/codex-plugins/codex-plugin-json.js

@@ -33,7 +33,8 @@ export async function buildCodexPluginInventory() {
     });
     const blockers = [
         ...(capability.supports_plugin_json ? [] : ['codex_0_138_plugin_json_unavailable']),
-        ...normalizeList(listJson?.blockers)
+        ...normalizeList(listJson?.blockers),
+        ...(process.env.SKS_CODEX_PLUGIN_JSON_FAKE_NO_MCP === '1' ? ['fixture_mcp_candidates_disabled'] : [])
     ];
     return {
         schema: 'sks.codex-plugin-inventory.v1',
@@ -169,7 +170,9 @@ function fakePluginDetail(pluginId) {
         installed: true,
         enabled: true,
         default_prompts: ['Use the fixture plugin safely.'],
-        remote_mcp_servers: [{ name: 'fixture-db-docs', url: 'https://mcp.example.test', auth_type: 'oauth' }],
+        remote_mcp_servers: process.env.SKS_CODEX_PLUGIN_JSON_FAKE_NO_MCP === '1'
+            ? []
+            : [{ name: 'fixture-db-docs', url: 'https://mcp.example.test', auth_type: 'oauth' }],
         unavailable_app_templates: ['fixture-desktop-template']
     };
 }

package/dist/core/commands/basic-cli.js

@@ -11,6 +11,7 @@ import { hooksExplainReport } from '../../cli/feature-commands.js';
 import { writeSelftestRouteProof } from '../proof/selftest-proof-fixtures.js';
 import { createMission } from '../mission.js';
 import { formatSksUpdateCheckText, runSksUpdateCheck, runSksUpdateNow } from '../update-check.js';
+import { withSecretPreservationGuard } from '../config/config-migration-journal.js';
 export async function helpCommand(args = []) {
     const topic = args[0];
     if (topic)
@@ -118,12 +119,13 @@ export async function updateCommand(sub = 'check', args = []) {
         process.exitCode = 1;
         return;
     }
-    const result = await runSksUpdateNow({
+    const root = await projectRoot();
+    const result = await withSecretPreservationGuard(root, 'update-now', async () => runSksUpdateNow({
         version: valueAfter(args, '--version') || valueAfter(args, '-v'),
         dryRun: flag(args, '--dry-run'),
         timeoutMs: 10 * 60 * 1000,
         maxOutputBytes: 128 * 1024
-    });
+    }));
     if (flag(args, '--json'))
         return printJson(result);
     console.log(`${sksTextLogo()}\n`);
@@ -140,14 +142,18 @@ export async function updateCommand(sub = 'check', args = []) {
 export async function setupCommand(args = []) {
     const root = await projectRoot();
     const installScope = installScopeFromArgs(args);
-    const res = await initProject(root, {
-        force: flag(args, '--force'),
-        installScope,
-        localOnly: flag(args, '--local-only'),
-        globalCommand: 'sks'
+    let res = null;
+    let cliTools = null;
+    await withSecretPreservationGuard(root, 'setup-command', async () => {
+        res = await initProject(root, {
+            force: flag(args, '--force'),
+            installScope,
+            localOnly: flag(args, '--local-only'),
+            globalCommand: 'sks'
+        });
+        const { ensureRelatedCliTools } = await import('../../cli/install-helpers.js');
+        cliTools = await ensureRelatedCliTools(args);
     });
-    const { ensureRelatedCliTools } = await import('../../cli/install-helpers.js');
-    const cliTools = await ensureRelatedCliTools(args);
     const result = {
         schema: 'sks.setup.v1',
         ok: true,

package/dist/core/commands/mad-sks-command.js

@@ -22,6 +22,7 @@ import { checkSksUpdateNotice } from '../update/update-notice.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../mad-db/mad-db-capability.js';
 import { writeCodex0138CapabilityArtifacts } from '../codex-control/codex-0138-capability.js';
 import { writeCodex0139CapabilityArtifacts } from '../codex-control/codex-0139-capability.js';
+import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-invocation-router.js';
 import { repairZellijForSks } from '../zellij/zellij-self-heal.js';
 export async function madHighCommand(args = [], deps = {}) {
     const subcommand = firstSubcommand(args);
@@ -478,6 +479,14 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
     const { id, dir } = await createMission(root, { mode: 'mad-sks', prompt: 'sks --mad Zellij scoped high-power maintenance session' });
     await writeCodex0138CapabilityArtifacts(root, { missionId: id }).catch(() => null);
     await writeCodex0139CapabilityArtifacts(root, { missionId: id }).catch(() => null);
+    const codexNativeInvocation = await resolveCodexNativeInvocationPlan({
+        root,
+        missionId: id,
+        route: '$MAD',
+        desiredCapability: 'hook-evidence'
+    }).catch(() => null);
+    if (codexNativeInvocation)
+        await writeJsonAtomic(path.join(dir, 'mad-codex-native-invocation.json'), codexNativeInvocation).catch(() => undefined);
     const protectedCore = resolveProtectedCore({ packageRoot: packageRoot(), targetRoot: cwd });
     // The interactive launch 'before' snapshot is only persisted (env + policy json)
     // and is never compared against an 'after' snapshot during the session, so the
@@ -521,6 +530,13 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
         protected_core_policy: protectedCorePolicyPath,
         protected_core_before: protectedCoreBeforePath,
         protected_core_digest: protectedCoreBefore.digest,
+        codex_native_invocation_plan: codexNativeInvocation ? {
+            selected_strategy: codexNativeInvocation.selected_strategy,
+            hook_evidence_policy: codexNativeInvocation.env.SKS_CODEX_NATIVE_HOOK_EVIDENCE_POLICY,
+            blockers: codexNativeInvocation.blockers,
+            warnings: codexNativeInvocation.warnings,
+            artifact_path: 'mad-codex-native-invocation.json'
+        } : null,
         activated_by: 'sks --mad',
         cwd: path.resolve(cwd || process.cwd())
     };

package/dist/core/config/config-migration-journal.js

@@ -0,0 +1,27 @@
+import path from 'node:path';
+import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+import { captureSecretPreservationSnapshot, withSecretPreservationGuard } from './secret-preservation.js';
+export { withSecretPreservationGuard };
+export async function writeSecretMigrationJournal(root, operationName, filesTouched = []) {
+    const resolvedRoot = path.resolve(root);
+    const snapshot = await captureSecretPreservationSnapshot({ root: resolvedRoot });
+    const journalPath = path.join(resolvedRoot, '.sneakoscope', 'reports', 'secret-migration-journal.json');
+    const current = await readJson(journalPath, { entries: [] }).catch(() => ({ entries: [] }));
+    const entries = Array.isArray(current.entries) ? current.entries : [];
+    const entry = {
+        schema: 'sks.secret-migration-journal-entry.v1',
+        generated_at: nowIso(),
+        operation: operationName,
+        files_touched: filesTouched,
+        protected_keys_present: snapshot.fingerprints.filter((fp) => fp.present).map((fp) => ({ key: fp.key, source: fp.source })),
+        raw_values_recorded: false
+    };
+    const journal = {
+        schema: 'sks.secret-migration-journal.v1',
+        generated_at: nowIso(),
+        entries: [...entries, entry]
+    };
+    await writeJsonAtomic(journalPath, journal);
+    return { journal_path: journalPath, entry };
+}
+//# sourceMappingURL=config-migration-journal.js.map