sneakoscope 3.1.7 → 3.1.8

package/README.md

@@ -35,7 +35,14 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.7** closes Codex-native runtime-proof gaps with real routing blackboxes, neutral reference cache refresh, read-only broker checks, explicit managed-asset repair transactions, and final brand-neutral artifact scans.
+SKS **3.1.8** hardens update/setup/doctor safety around four operator-facing failure modes: immutable core skills, duplicate project skills, real native capability repair status, and Supabase/secret preservation.
+
+What changed in 3.1.8:
+
+- **Core SKS skills are content-addressed and immutable.** The eight built-in route skills now have a manifest and no-drift gates; setup/update/doctor may install missing managed copies or restore corrupted managed copies, but they do not overwrite user-authored collisions.
+- **Duplicate skills are detected and repaired safely.** Canonical skill names collapse variants such as `Loop`, `loop`, and `loop/SKILL.md`; SKS-managed duplicates can be quarantined automatically, while user-authored duplicates require explicit confirmation.
+- **`sks doctor --fix` reports native capability truthfully.** Image generation, image follow-up edit paths, Computer Use, Chrome/web review, app screenshots, app handoff, and image path exposure now run through a repair matrix and postcheck instead of capability assumptions.
+- **Supabase keys survive setup/update/doctor.** Protected secret surfaces are fingerprinted before and after guarded operations; reports store only redacted previews and hashes, never raw values.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 
@@ -622,7 +629,7 @@ TriWiki is intentionally sparse: `sks wiki sweep` records demote, soft-forget, a
 
 ```sh
 sks codex-native status --json
-sks codex-native invocation-plan --route '$Loop' --capability agent-role --json
+sks codex-native invocation-plan --route Loop --capability agent-role --json
 sks codex-native init-deep --apply --directory-local --json
 ```
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.7"
+version = "3.1.8"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.7"
+version = "3.1.8"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.7"),
+        Some("--version") => println!("sks-rs 3.1.8"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.1.7",
-  "source_digest": "8927dd50bf67d1f2ce1df5744a3b21645a870f8f9182fe7b86a92affedf416aa",
-  "source_file_count": 2558,
-  "built_at_source_time": 1781491235171
+  "package_version": "3.1.8",
+  "source_digest": "94742dc3eb63f280df98aa286ac2a94a14fd140f27c89db85880e4f92c630454",
+  "source_file_count": 2602,
+  "built_at_source_time": 1781513577024
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.7';
+const FAST_PACKAGE_VERSION = '3.1.8';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -27,6 +27,7 @@ import { runDoctorZellijRepair, doctorZellijRepairConsoleLine } from '../core/do
 import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
 import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
+import { runDoctorNativeCapabilityRepair } from '../core/doctor/doctor-native-capability-repair.js';
 export async function run(_command, args = []) {
     const doctorFix = flag(args, '--fix');
     let setupRepair = null;
@@ -69,6 +70,23 @@ export async function run(_command, args = []) {
         };
     }
     const root = await projectRoot();
+    const doctorNativeCapabilityRepair = await runDoctorNativeCapabilityRepair({
+        root,
+        fix: doctorFix || flag(args, '--repair-native-capabilities'),
+        yes: flag(args, '--yes') || flag(args, '-y'),
+        flags: args.map((arg) => String(arg))
+    }).catch((err) => ({
+        schema: 'sks.doctor-native-capability-repair.v1',
+        ok: false,
+        root,
+        fix: doctorFix,
+        yes: flag(args, '--yes') || flag(args, '-y'),
+        core_skills: null,
+        skill_dedupe: null,
+        native_capabilities: null,
+        secret_preservation_guard: '.sneakoscope/reports/secret-preservation-guard.json',
+        blockers: [err?.message || String(err)]
+    }));
     const codexBin = readOption(args, '--codex-bin', process.env.SKS_DOCTOR_CODEX_BIN || '');
     const configProbeOpts = {
         codexProbe: flag(args, '--fix') || flag(args, '--actual-codex') || Boolean(codexBin),
@@ -305,7 +323,7 @@ export async function run(_command, args = []) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair }
     };
     if (flag(args, '--json')) {
         printJson(result);
@@ -349,6 +367,24 @@ export async function run(_command, args = []) {
         for (const action of runtimeReadiness.repair_actions)
             console.log(`  - ${action}`);
     }
+    const nativeCapabilityRows = Array.isArray(doctorNativeCapabilityRepair?.native_capabilities?.capabilities)
+        ? doctorNativeCapabilityRepair.native_capabilities.capabilities
+        : [];
+    console.log('SKS Native Capabilities:');
+    console.log(`  image generation: ${nativeCapabilityStatus(nativeCapabilityRows, 'image_generation', 'repair_required')}`);
+    console.log(`  image follow-up edit: ${nativeCapabilityStatus(nativeCapabilityRows, 'image_followup_edit', 'degraded')}`);
+    console.log(`  computer use: ${nativeCapabilityStatus(nativeCapabilityRows, 'computer_use', 'manual_required')}`);
+    console.log(`  Chrome/web review: ${nativeCapabilityStatus(nativeCapabilityRows, 'chrome_web_review', 'manual_required')}`);
+    console.log(`  app screenshot: ${nativeCapabilityStatus(nativeCapabilityRows, 'codex_app_screenshot', 'degraded')}`);
+    console.log(`  app handoff: ${nativeCapabilityStatus(nativeCapabilityRows, 'app_handoff', 'unavailable')}`);
+    console.log(`  image path exposure: ${nativeCapabilityStatus(nativeCapabilityRows, 'image_path_exposure', 'fallback')}`);
+    console.log('SKS Skills:');
+    console.log(`  core skills: ${doctorSkillStatus(doctorNativeCapabilityRepair?.core_skills)}`);
+    console.log(`  duplicate project skills: ${doctorDedupeStatus(doctorNativeCapabilityRepair?.skill_dedupe)}`);
+    console.log('Secret preservation:');
+    console.log(`  Supabase keys: ${doctorNativeCapabilityRepair?.ok === false && String((doctorNativeCapabilityRepair?.blockers || []).join(' ')).includes('secret_preservation_failed') ? 'blocked' : 'preserved'}`);
+    console.log('  secret values: redacted');
+    console.log(`  migration journal: ${doctorNativeCapabilityRepair?.secret_preservation_guard || '.sneakoscope/reports/secret-preservation-guard.json'}`);
     console.log('Codex App Harness:');
     console.log(`  plugins: ${codexAppHarnessMatrix.app_features?.plugin_json ? 'ok' : 'degraded'}`);
     console.log(`  hook approval: ${codexAppHarnessMatrix.app_features?.hook_approval_state_detectable ? 'ok' : 'unknown'}`);
@@ -473,6 +509,40 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
         repair_actions: [...new Set(repairActions)]
     };
 }
+function nativeCapabilityStatus(rows, id, fallback) {
+    const row = rows.find((entry) => entry?.id === id);
+    if (!row)
+        return fallback;
+    if (row.after === 'verified' || row.before === 'verified')
+        return 'verified';
+    if (row.repairability === 'manual-required')
+        return 'manual_required';
+    if (row.before === 'degraded' || row.after === 'degraded')
+        return 'degraded';
+    if (row.repairability === 'doctor-fix')
+        return row.after === 'blocked' ? 'blocked' : 'repair_required';
+    if (row.repairability === 'unavailable')
+        return 'unavailable';
+    return fallback;
+}
+function doctorSkillStatus(coreSkills) {
+    if (!coreSkills)
+        return 'drift_detected';
+    if (Array.isArray(coreSkills.restored) && coreSkills.restored.length)
+        return 'repaired';
+    if (Array.isArray(coreSkills.blockers) && coreSkills.blockers.length)
+        return 'drift_detected';
+    return 'current';
+}
+function doctorDedupeStatus(skillDedupe) {
+    if (!skillDedupe)
+        return 'manual_required';
+    if (Array.isArray(skillDedupe.actions) && skillDedupe.actions.some((action) => action.action === 'quarantined'))
+        return 'repaired';
+    if (Array.isArray(skillDedupe.blockers) && skillDedupe.blockers.length)
+        return 'manual_required';
+    return 'none';
+}
 // Assemble the explicit Zellij readiness block for `doctor --json` from the
 // capability probe + readiness matrix. Proof statuses are availability-derived:
 // `verified` is reserved for a real environment run (SKS_REQUIRE_ZELLIJ=1 gates);

package/dist/core/codex-app/codex-skill-sync.js

@@ -1,169 +1,95 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import crypto from 'node:crypto';
-import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
-const SKS_SKILLS = [
-    '$Loop',
-    '$Naruto',
-    '$QA-LOOP',
-    '$Research',
-    '$DFix',
-    '$Image-UX-Review',
-    '$Computer-Use',
-    '$Init-Deep'
-];
+import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { buildSksCoreSkillManifest } from '../codex-native/core-skill-manifest.js';
+import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
+import { dedupeProjectSkills } from '../codex-native/project-skill-dedupe.js';
 const EXTERNAL_ROUTE_RESERVED = new Set(['ulw-loop', 'ulw-plan', 'start-work']);
 export async function syncCodexSksSkills(input) {
     const root = path.resolve(input.root);
     const skillsRoot = input.skillsRoot || path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'skills');
-    const existing = await listSkillNames(skillsRoot);
-    const collisions = existing.filter((name) => EXTERNAL_ROUTE_RESERVED.has(name));
-    const desired = SKS_SKILLS.map((skill) => skillName(skill));
-    const created = [];
-    const skipped = [];
-    if (input.apply === true) {
-        await ensureDir(skillsRoot);
-        for (const name of desired) {
-            if (EXTERNAL_ROUTE_RESERVED.has(name)) {
-                skipped.push(name);
-                continue;
-            }
-            const dir = path.join(skillsRoot, name);
-            const file = path.join(dir, 'SKILL.md');
-            const content = skillContent(name);
-            const current = await fs.readFile(file, 'utf8').catch(() => '');
-            if (current && !current.includes('BEGIN SKS MANAGED SKILL')) {
-                skipped.push(name);
-                continue;
-            }
-            await ensureDir(dir);
-            await writeTextAtomic(file, content);
-            created.push(file);
+    return withSkillSyncLock(root, async () => {
+        const beforeExisting = await listSkillNames(skillsRoot);
+        const reserved = beforeExisting.filter((name) => EXTERNAL_ROUTE_RESERVED.has(name));
+        const manifest = buildSksCoreSkillManifest();
+        const desired = manifest.skills.map((skill) => skill.canonical_name);
+        const integrity = await syncCoreSkillsIntegrity({
+            root,
+            apply: input.apply === true,
+            skillsRoot,
+            reportPath: path.join(root, '.sneakoscope', 'reports', 'core-skill-integrity.json')
+        });
+        const dedupe = await dedupeProjectSkills({
+            root,
+            fix: input.apply === true,
+            yes: true,
+            quarantineUserDuplicates: false,
+            reportPath: path.join(root, '.sneakoscope', 'reports', 'project-skill-dedupe.json')
+        }).catch((err) => ({
+            ok: false,
+            blockers: [err instanceof Error ? err.message : String(err)],
+            unresolved_user_duplicates: [],
+            actions: []
+        }));
+        const report = {
+            schema: 'sks.codex-skill-sync.v1',
+            generated_at: nowIso(),
+            ok: integrity.ok && dedupe.ok !== false,
+            apply: input.apply === true,
+            skills_root: skillsRoot,
+            desired_skills: desired,
+            existing_skills: beforeExisting,
+            created: integrity.installed,
+            skipped: integrity.skipped_user_authored,
+            external_route_names_preserved: reserved,
+            integrity_report: '.sneakoscope/reports/core-skill-integrity.json',
+            dedupe_report: '.sneakoscope/reports/project-skill-dedupe.json',
+            interop: {
+                mode: 'coexist',
+                clobbered_external_routes: false,
+                clobbered_user_skills: false,
+                skipped_user_skills: integrity.skipped_user_authored,
+                managed_skills: desired
+            },
+            blockers: [...integrity.blockers, ...(dedupe.blockers || [])]
+        };
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-skill-sync.json'), report).catch(() => undefined);
+        return report;
+    });
+}
+export async function withSkillSyncLock(root, fn) {
+    const lockPath = path.join(path.resolve(root), '.sneakoscope', 'locks', 'skill-sync.lock');
+    await ensureDir(path.dirname(lockPath));
+    const started = Date.now();
+    while (true) {
+        try {
+            await fs.mkdir(lockPath);
+            break;
+        }
+        catch (err) {
+            const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+            if (code !== 'EEXIST')
+                throw err;
+            if (Date.now() - started > 30000)
+                throw new Error(`Timed out waiting for skill sync lock: ${lockPath}`);
+            await new Promise((resolve) => setTimeout(resolve, 25));
         }
     }
-    const report = {
-        schema: 'sks.codex-skill-sync.v1',
-        generated_at: nowIso(),
-        ok: true,
-        apply: input.apply === true,
-        skills_root: skillsRoot,
-        desired_skills: desired,
-        existing_skills: existing,
-        created,
-        skipped,
-        external_route_names_preserved: collisions,
-        interop: {
-            mode: 'coexist',
-            clobbered_external_routes: false,
-            clobbered_user_skills: false,
-            skipped_user_skills: skipped,
-            managed_skills: desired
-        },
-        blockers: []
-    };
-    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-skill-sync.json'), report).catch(() => undefined);
-    return report;
+    try {
+        await writeJsonAtomic(path.join(lockPath, 'owner.json'), {
+            schema: 'sks.skill-sync-lock.v1',
+            pid: process.pid,
+            acquired_at: nowIso()
+        }).catch(() => undefined);
+        return await fn();
+    }
+    finally {
+        await fs.rm(lockPath, { recursive: true, force: true }).catch(() => undefined);
+    }
 }
 async function listSkillNames(root) {
     const rows = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
     return rows.filter((row) => row.isDirectory()).map((row) => row.name).sort();
 }
-function skillName(value) {
-    return value.replace(/^\$/, '').toLowerCase();
-}
-function skillContent(name) {
-    const profile = skillProfile(name);
-    const body = [
-        '---',
-        `name: ${name}`,
-        `description: SKS managed Codex App route bridge for ${profile.command}.`,
-        '---',
-        '',
-        '<!-- BEGIN SKS MANAGED SKILL -->',
-        `Command: ${profile.command}`,
-        `Purpose: ${profile.purpose}`,
-        `Use when: ${profile.when}`,
-        `Route: ${profile.command}`,
-        `Evidence: ${profile.evidence}`,
-        'Safety rules: keep route state bounded, preserve user and external route assets, and stop on hard blockers instead of fabricating fallback behavior.',
-        'Proof paths: write the route-local mission artifact named in Evidence before claiming completion.',
-        'Failure recovery: if a proof path cannot be produced, record the blocker and continue only when the selected SKS route has another allowed evidence path.',
-        `Fallback: ${profile.fallback}`,
-        `checksum: ${hash(`${name}:${profile.command}:${profile.evidence}:${profile.fallback}`)}`,
-        '<!-- END SKS MANAGED SKILL -->',
-        ''
-    ].join('\n');
-    return body;
-}
-function skillProfile(name) {
-    const table = {
-        loop: {
-            command: '$Loop',
-            purpose: 'compile persisted route work into bounded loop plans with continuation evidence.',
-            when: 'a mission needs stage-by-stage execution, memory hints, or resume-safe artifacts.',
-            evidence: '.sneakoscope/loops/** plus codex-app-execution-profile.json',
-            fallback: 'use message-role routing when native agent_type is not verified.'
-        },
-        naruto: {
-            command: '$Naruto',
-            purpose: 'fan out bounded native worker lanes for high-scale review or implementation.',
-            when: 'parallel lanes are explicitly selected by the route and parent integration remains owner.',
-            evidence: 'naruto work graph, worker ledgers, and execution profile payloads.',
-            fallback: 'degrade to message-role workers without dropping proof artifacts.'
-        },
-        'qa-loop': {
-            command: '$QA-LOOP',
-            purpose: 'dogfood UI/API behavior with gate artifacts and current execution profile.',
-            when: 'route completion needs human-proxy verification or app handoff checks.',
-            evidence: 'qa-loop gate/result ledgers and codex-app-execution-profile.json.',
-            fallback: 'record the unavailable surface as blocked rather than inventing visual proof.'
-        },
-        research: {
-            command: '$Research',
-            purpose: 'run evidence-bound research cycles with source routing and synthesis ledgers.',
-            when: 'the request depends on discovery, evaluation, or external-source claims.',
-            evidence: 'research plan, source ledger, cycle record, and execution profile routing.',
-            fallback: 'mark unavailable source tools explicitly and avoid unsupported live-accuracy claims.'
-        },
-        dfix: {
-            command: '$DFix',
-            purpose: 'perform tiny direct fixes without the full Team route.',
-            when: 'copy/config/docs/labels/spacing/translation/mechanical edits are truly narrow.',
-            evidence: 'focused diff plus DFix Honest check.',
-            fallback: 'route broad implementation through Team/Loop instead.'
-        },
-        'image-ux-review': {
-            command: '$Image-UX-Review',
-            purpose: 'produce generated annotated UI review images and extract issue ledgers.',
-            when: 'visual UX critique is requested from screenshots or app captures.',
-            evidence: 'source inventory, generated annotation images, extracted issue ledger.',
-            fallback: 'block if raster annotation cannot be produced.'
-        },
-        'computer-use': {
-            command: '$Computer-Use',
-            purpose: 'operate native macOS desktop apps through the fast Computer Use lane.',
-            when: 'the task depends on non-web desktop UI or OS settings.',
-            evidence: 'desktop interaction notes/screenshots where available.',
-            fallback: 'use Browser/Chrome only for web targets.'
-        },
-        'init-deep': {
-            command: '$Init-Deep',
-            purpose: 'refresh project-local memory, directory AGENTS sections, and loop memory hints.',
-            when: 'a route needs deeper local context or directory-specific instruction recall.',
-            evidence: '.sneakoscope/context/AGENTS.generated.md and managed directory AGENTS blocks.',
-            fallback: 'preserve user content and skip directories that cannot be safely updated.'
-        }
-    };
-    return table[name] || {
-        command: `$${name}`,
-        purpose: 'bridge an SKS managed Codex App route.',
-        when: 'the matching SKS route is explicitly requested.',
-        evidence: '.sneakoscope route artifacts.',
-        fallback: 'record blockers with evidence.'
-    };
-}
-function hash(value) {
-    return crypto.createHash('sha256').update(`sks-skill:${value}`).digest('hex').slice(0, 12);
-}
 //# sourceMappingURL=codex-skill-sync.js.map

package/dist/core/codex-native/core-skill-integrity.js

@@ -0,0 +1,89 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { buildSksCoreSkillManifest, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
+import { canonicalSkillName } from './skill-name-canonicalizer.js';
+export async function syncCoreSkillsIntegrity(input) {
+    const root = path.resolve(input.root);
+    const skillsRoot = input.skillsRoot || path.join(root, '.agents', 'skills');
+    const apply = input.apply === true;
+    const manifest = buildSksCoreSkillManifest();
+    const rows = [];
+    const installed = [];
+    const restored = [];
+    const skippedUserAuthored = [];
+    const blockers = [];
+    for (const skill of manifest.skills) {
+        const skillDir = path.join(skillsRoot, skill.canonical_name);
+        const file = path.join(skillDir, 'SKILL.md');
+        const desired = renderCoreSkillTemplate(skill.canonical_name);
+        const current = await readText(file, null);
+        const beforeSha = typeof current === 'string' ? sha256(current) : null;
+        let action = 'already-current';
+        let backupPath = null;
+        let blocker = null;
+        if (current === null) {
+            action = 'install-missing-managed-copy';
+            if (apply) {
+                await ensureDir(skillDir);
+                await writeTextAtomic(file, desired);
+                installed.push(file);
+            }
+        }
+        else if (beforeSha === skill.content_sha256) {
+            action = 'already-current';
+        }
+        else if (isSksManagedCoreSkillContent(current)) {
+            action = 'restore-corrupted-managed-copy';
+            if (apply) {
+                backupPath = path.join(root, '.sneakoscope', 'backups', 'core-skills', skill.canonical_name, `${Date.now()}-${process.pid}.SKILL.md.bak`);
+                await ensureDir(path.dirname(backupPath));
+                await fs.writeFile(backupPath, current, 'utf8');
+                await writeTextAtomic(file, desired);
+                restored.push(file);
+            }
+        }
+        else {
+            action = 'skip-user-authored';
+            blocker = `user_authored_core_skill_collision:${skill.canonical_name}`;
+            skippedUserAuthored.push(file);
+        }
+        const after = await readText(file, null);
+        const afterSha = typeof after === 'string' ? sha256(after) : null;
+        rows.push({
+            canonical_name: skill.canonical_name,
+            path: file,
+            action,
+            before_sha256: beforeSha,
+            after_sha256: afterSha,
+            backup_path: backupPath,
+            blocker
+        });
+        if (blocker)
+            blockers.push(blocker);
+    }
+    const report = {
+        schema: 'sks.core-skill-integrity.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        root,
+        apply,
+        skills_root: skillsRoot,
+        manifest_sha256: sha256(JSON.stringify(manifest.skills.map((skill) => [skill.canonical_name, skill.content_sha256]))),
+        rows,
+        installed,
+        restored,
+        skipped_user_authored: skippedUserAuthored,
+        blockers
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'core-skill-integrity.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, report).catch(() => undefined);
+    return report;
+}
+export function coreSkillPath(skillsRoot, name) {
+    return path.join(skillsRoot, canonicalSkillName(name), 'SKILL.md');
+}
+//# sourceMappingURL=core-skill-integrity.js.map