sneakoscope 3.1.7 → 3.1.8

package/dist/core/codex-native/skill-registry-ledger.js

@@ -0,0 +1,85 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { nowIso, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { buildSksCoreSkillManifest, isSksManagedCoreSkillContent } from './core-skill-manifest.js';
+import { canonicalSkillName, skillDisplayNameFromMarkdown } from './skill-name-canonicalizer.js';
+export async function buildSkillRegistryLedger(input) {
+    const root = path.resolve(input.root);
+    const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
+    const scanRoots = [
+        { root: path.join(root, '.agents', 'skills'), scope: 'project', priority: 100 },
+        { root: path.join(root, '.codex', 'skills'), scope: 'project', priority: 80 },
+        { root: path.join(codexHome, 'skills'), scope: 'codex-home', priority: 60 },
+        ...(input.extraRoots || [])
+    ];
+    const manifestByName = new Map(buildSksCoreSkillManifest().skills.map((skill) => [skill.canonical_name, skill.content_sha256]));
+    const entries = [];
+    for (const scanRoot of scanRoots) {
+        const rows = await fs.readdir(scanRoot.root, { withFileTypes: true }).catch(() => []);
+        for (const row of rows) {
+            if (!row.isDirectory())
+                continue;
+            const skillPath = path.join(scanRoot.root, row.name, 'SKILL.md');
+            const text = await readText(skillPath, null);
+            if (typeof text !== 'string')
+                continue;
+            const displayName = skillDisplayNameFromMarkdown(text, row.name);
+            const canonical = canonicalSkillName(displayName || row.name);
+            const hash = sha256(text);
+            const managed = isSksManagedCoreSkillContent(text) || text.includes('BEGIN SKS MANAGED SKILL');
+            const expected = manifestByName.get(canonical);
+            const status = managed
+                ? expected && expected === hash ? 'managed-current' : 'managed-drift'
+                : 'user-owned';
+            entries.push({
+                schema: 'sks.skill-registry-entry.v1',
+                root: scanRoot.root,
+                scope: scanRoot.scope,
+                canonical_name: canonical,
+                display_name: displayName || row.name,
+                path: skillPath,
+                managed_by_sks: managed,
+                content_sha256: hash,
+                active_priority: scanRoot.priority,
+                status,
+                blockers: []
+            });
+        }
+    }
+    const grouped = groupByCanonical(entries);
+    const duplicates = [...grouped.entries()].filter(([, group]) => group.length > 1).map(([name]) => name).sort();
+    for (const group of grouped.values()) {
+        group.sort((a, b) => b.active_priority - a.active_priority || a.path.localeCompare(b.path));
+        group.forEach((entry, index) => {
+            if (group.length > 1 && index > 0)
+                entry.status = entry.status === 'user-owned' ? 'duplicate' : 'duplicate';
+        });
+    }
+    const blockers = duplicates.map((name) => `duplicate_skill_name:${name}`);
+    const ledger = {
+        schema: 'sks.skill-registry-ledger.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        root,
+        entries,
+        duplicate_canonical_names: duplicates,
+        blockers
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'skill-registry-ledger.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, ledger).catch(() => undefined);
+    return ledger;
+}
+export function groupByCanonical(entries) {
+    const grouped = new Map();
+    for (const entry of entries) {
+        const current = grouped.get(entry.canonical_name) || [];
+        current.push(entry);
+        grouped.set(entry.canonical_name, current);
+    }
+    return grouped;
+}
+//# sourceMappingURL=skill-registry-ledger.js.map

package/dist/core/commands/basic-cli.js

@@ -11,6 +11,7 @@ import { hooksExplainReport } from '../../cli/feature-commands.js';
 import { writeSelftestRouteProof } from '../proof/selftest-proof-fixtures.js';
 import { createMission } from '../mission.js';
 import { formatSksUpdateCheckText, runSksUpdateCheck, runSksUpdateNow } from '../update-check.js';
+import { withSecretPreservationGuard } from '../config/config-migration-journal.js';
 export async function helpCommand(args = []) {
     const topic = args[0];
     if (topic)
@@ -118,12 +119,13 @@ export async function updateCommand(sub = 'check', args = []) {
         process.exitCode = 1;
         return;
     }
-    const result = await runSksUpdateNow({
+    const root = await projectRoot();
+    const result = await withSecretPreservationGuard(root, 'update-now', async () => runSksUpdateNow({
         version: valueAfter(args, '--version') || valueAfter(args, '-v'),
         dryRun: flag(args, '--dry-run'),
         timeoutMs: 10 * 60 * 1000,
         maxOutputBytes: 128 * 1024
-    });
+    }));
     if (flag(args, '--json'))
         return printJson(result);
     console.log(`${sksTextLogo()}\n`);
@@ -140,14 +142,18 @@ export async function updateCommand(sub = 'check', args = []) {
 export async function setupCommand(args = []) {
     const root = await projectRoot();
     const installScope = installScopeFromArgs(args);
-    const res = await initProject(root, {
-        force: flag(args, '--force'),
-        installScope,
-        localOnly: flag(args, '--local-only'),
-        globalCommand: 'sks'
+    let res = null;
+    let cliTools = null;
+    await withSecretPreservationGuard(root, 'setup-command', async () => {
+        res = await initProject(root, {
+            force: flag(args, '--force'),
+            installScope,
+            localOnly: flag(args, '--local-only'),
+            globalCommand: 'sks'
+        });
+        const { ensureRelatedCliTools } = await import('../../cli/install-helpers.js');
+        cliTools = await ensureRelatedCliTools(args);
     });
-    const { ensureRelatedCliTools } = await import('../../cli/install-helpers.js');
-    const cliTools = await ensureRelatedCliTools(args);
     const result = {
         schema: 'sks.setup.v1',
         ok: true,

package/dist/core/config/config-migration-journal.js

@@ -0,0 +1,27 @@
+import path from 'node:path';
+import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+import { captureSecretPreservationSnapshot, withSecretPreservationGuard } from './secret-preservation.js';
+export { withSecretPreservationGuard };
+export async function writeSecretMigrationJournal(root, operationName, filesTouched = []) {
+    const resolvedRoot = path.resolve(root);
+    const snapshot = await captureSecretPreservationSnapshot({ root: resolvedRoot });
+    const journalPath = path.join(resolvedRoot, '.sneakoscope', 'reports', 'secret-migration-journal.json');
+    const current = await readJson(journalPath, { entries: [] }).catch(() => ({ entries: [] }));
+    const entries = Array.isArray(current.entries) ? current.entries : [];
+    const entry = {
+        schema: 'sks.secret-migration-journal-entry.v1',
+        generated_at: nowIso(),
+        operation: operationName,
+        files_touched: filesTouched,
+        protected_keys_present: snapshot.fingerprints.filter((fp) => fp.present).map((fp) => ({ key: fp.key, source: fp.source })),
+        raw_values_recorded: false
+    };
+    const journal = {
+        schema: 'sks.secret-migration-journal.v1',
+        generated_at: nowIso(),
+        entries: [...entries, entry]
+    };
+    await writeJsonAtomic(journalPath, journal);
+    return { journal_path: journalPath, entry };
+}
+//# sourceMappingURL=config-migration-journal.js.map

package/dist/core/config/managed-config-merge.js

@@ -0,0 +1,105 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { isProtectedSecretKey, PROTECTED_SECRET_KEYS } from './supabase-secret-preservation.js';
+export async function writeManagedJsonConfig(file, current, managed) {
+    const next = safeMergeObject(current, managed);
+    const before = `${JSON.stringify(current, null, 2)}\n`;
+    const after = `${JSON.stringify(next, null, 2)}\n`;
+    return writeMergedText(file, before, after, 'json', protectedKeysPresent(current));
+}
+export async function writeManagedTomlConfig(file, currentText, managedBlocks) {
+    let next = String(currentText || '').trimEnd();
+    for (const block of managedBlocks)
+        next = upsertTomlBlockPreservingSecrets(next, block);
+    return writeMergedText(file, currentText, `${next.trim()}\n`, 'toml', protectedKeysInText(currentText));
+}
+export async function writeManagedEnvConfig(file, currentText, managedLines) {
+    const existingKeys = new Set(String(currentText || '').split(/\r?\n/).map((line) => line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1]).filter((value) => Boolean(value)));
+    const additions = managedLines.filter((line) => {
+        const key = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1] || '';
+        return key && !existingKeys.has(key) && !isProtectedSecretKey(key);
+    });
+    const next = additions.length ? `${String(currentText || '').replace(/\s*$/, '\n')}${additions.join('\n')}\n` : String(currentText || '');
+    return writeMergedText(file, currentText, next, 'env', protectedKeysInText(currentText));
+}
+export function safeMergeObject(current, managed) {
+    const out = { ...current };
+    for (const [key, value] of Object.entries(managed)) {
+        if (isProtectedSecretKey(key) && current[key] != null)
+            continue;
+        if (isPlainObject(value) && isPlainObject(current[key]))
+            out[key] = safeMergeObject(current[key], value);
+        else
+            out[key] = value;
+    }
+    return out;
+}
+function upsertTomlBlockPreservingSecrets(text, block) {
+    const header = block.match(/^\s*\[([^\]]+)\]/)?.[1];
+    if (!header)
+        return text;
+    const lines = String(text || '').trimEnd().split('\n');
+    const start = lines.findIndex((line) => line.trim() === `[${header}]`);
+    const blockLines = block.trim().split('\n');
+    if (start === -1)
+        return [...lines.filter((line) => line.length), '', ...blockLines].join('\n');
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[.+\]\s*$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
+    }
+    const existingSecretLines = lines.slice(start + 1, end).filter((line) => {
+        const key = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        return isProtectedSecretKey(`${header}.${key}`) || isProtectedSecretKey(key);
+    });
+    lines.splice(start, end - start, ...blockLines, ...existingSecretLines.filter((line) => !blockLines.includes(line)));
+    return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+async function writeMergedText(file, before, after, format, preserved) {
+    await ensureDir(path.dirname(file));
+    let backupPath = null;
+    if (before !== after) {
+        if (before.trim()) {
+            backupPath = `${file}.sks-managed-merge-${Date.now()}.bak`;
+            await fs.writeFile(backupPath, before, 'utf8');
+        }
+        await writeTextAtomic(file, after);
+    }
+    return {
+        schema: 'sks.managed-config-merge.v1',
+        generated_at: nowIso(),
+        ok: true,
+        path: file,
+        format,
+        changed: before !== after,
+        backup_path: backupPath,
+        protected_keys_preserved: preserved,
+        blockers: []
+    };
+}
+function protectedKeysPresent(value) {
+    const found = [];
+    for (const key of PROTECTED_SECRET_KEYS)
+        if (lookupPath(value, key) != null)
+            found.push(String(key));
+    return found;
+}
+function protectedKeysInText(text) {
+    return PROTECTED_SECRET_KEYS.filter((key) => new RegExp(`(^|\\n)\\s*(?:export\\s+)?${String(key).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(text)).map(String);
+}
+function lookupPath(value, dotted) {
+    let current = value;
+    for (const part of dotted.split('.')) {
+        if (!current || typeof current !== 'object' || Array.isArray(current))
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=managed-config-merge.js.map

package/dist/core/config/secret-preservation.js

@@ -0,0 +1,169 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { ensureDir, nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { PROTECTED_SECRET_KEYS, PROTECTED_SUPABASE_ENV_KEYS } from './supabase-secret-preservation.js';
+export async function captureSecretPreservationSnapshot(input) {
+    const root = path.resolve(input.root);
+    const sources = secretSources(root);
+    const fingerprints = [];
+    for (const source of sources) {
+        const text = await readText(source, null);
+        if (typeof text !== 'string')
+            continue;
+        if (source.endsWith('.json')) {
+            const json = await readJson(source, {}).catch(() => ({}));
+            fingerprints.push(...fingerprintsFromObject(json, source));
+        }
+        else {
+            fingerprints.push(...fingerprintsFromText(text, source));
+        }
+    }
+    const snapshot = {
+        schema: 'sks.secret-preservation-snapshot.v1',
+        generated_at: nowIso(),
+        root,
+        fingerprints: dedupeFingerprints(fingerprints)
+    };
+    if (input.artifactPath)
+        await writeJsonAtomic(input.artifactPath, snapshot).catch(() => undefined);
+    return snapshot;
+}
+export async function withSecretPreservationGuard(root, operationName, fn) {
+    const resolvedRoot = path.resolve(root);
+    const reportDir = path.join(resolvedRoot, '.sneakoscope', 'reports');
+    await ensureDir(reportDir);
+    const beforePath = path.join(reportDir, 'secret-preservation-before.json');
+    const afterPath = path.join(reportDir, 'secret-preservation-after.json');
+    const guardPath = path.join(reportDir, 'secret-preservation-guard.json');
+    const before = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: beforePath });
+    let result;
+    try {
+        result = await fn();
+    }
+    catch (err) {
+        await writeJsonAtomic(guardPath, {
+            schema: 'sks.secret-preservation-guard.v1',
+            generated_at: nowIso(),
+            ok: false,
+            operation: operationName,
+            before_path: beforePath,
+            after_path: null,
+            restored_keys_count: 0,
+            missing_after: [],
+            raw_values_recorded: false,
+            operation_error: err instanceof Error ? err.message : String(err)
+        }).catch(() => undefined);
+        throw err;
+    }
+    const after = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: afterPath });
+    const missing = missingProtectedSecrets(before, after);
+    const report = {
+        schema: 'sks.secret-preservation-guard.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0,
+        operation: operationName,
+        before_path: beforePath,
+        after_path: afterPath,
+        restored_keys_count: 0,
+        missing_after: missing,
+        raw_values_recorded: false
+    };
+    await writeJsonAtomic(guardPath, report).catch(() => undefined);
+    if (missing.length) {
+        throw new Error(`secret_preservation_failed:${missing.map((item) => `${item.source}:${item.key}`).join(',')}`);
+    }
+    return result;
+}
+export function missingProtectedSecrets(before, after) {
+    const afterMap = new Map(after.fingerprints.filter((fp) => fp.present).map((fp) => [`${fp.source}\0${fp.key}`, fp]));
+    return before.fingerprints
+        .filter((fp) => fp.present && fp.value_sha256)
+        .filter((fp) => !afterMap.has(`${fp.source}\0${fp.key}`))
+        .map((fp) => ({ key: fp.key, source: fp.source }));
+}
+function secretSources(root) {
+    const home = process.env.HOME || os.homedir();
+    return [
+        '.env',
+        '.env.local',
+        '.env.development',
+        '.env.production',
+        '.sneakoscope/config.json',
+        '.codex/config.toml'
+    ].map((rel) => path.join(root, rel)).concat(path.join(home, '.codex', 'config.toml'));
+}
+function fingerprintsFromText(text, source) {
+    const rows = [];
+    for (const key of PROTECTED_SECRET_KEYS) {
+        const value = readAssignment(text, key);
+        if (!value)
+            continue;
+        rows.push(fingerprint(String(key), source, value));
+    }
+    for (const envKey of PROTECTED_SUPABASE_ENV_KEYS) {
+        const value = readAssignment(text, envKey);
+        if (value)
+            rows.push(fingerprint(envKey, source, value));
+    }
+    return rows;
+}
+function fingerprintsFromObject(value, source) {
+    const flat = flattenObject(value);
+    const rows = [];
+    for (const [key, raw] of Object.entries(flat)) {
+        if (!PROTECTED_SECRET_KEYS.includes(key))
+            continue;
+        rows.push(fingerprint(key, source, String(raw)));
+    }
+    return rows;
+}
+function fingerprint(key, source, value) {
+    return {
+        key,
+        source,
+        present: Boolean(value),
+        redacted_preview: redactPreview(value),
+        value_sha256: value ? sha256(value) : null
+    };
+}
+function readAssignment(text, key) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`^\\s*(?:export\\s+)?${escaped.replace(/\\\./g, '\\s*\\.\\s*')}\\s*=\\s*(.+?)\\s*$`, 'm');
+    const raw = String(text || '').match(re)?.[1]?.trim() || '';
+    return unquote(raw);
+}
+function unquote(value) {
+    const trimmed = String(value || '').trim().replace(/\s+#.*$/, '');
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'")))
+        return trimmed.slice(1, -1);
+    return trimmed;
+}
+function redactPreview(value) {
+    const text = String(value || '');
+    if (!text)
+        return '';
+    const head = text.slice(0, Math.min(3, text.length));
+    const tail = text.length > 6 ? text.slice(-3) : '';
+    return `${head}...${tail || 'redacted'}(${text.length})`;
+}
+function flattenObject(value, prefix = '') {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+        const nextKey = prefix ? `${prefix}.${key}` : key;
+        if (child && typeof child === 'object' && !Array.isArray(child))
+            Object.assign(out, flattenObject(child, nextKey));
+        else if (child != null)
+            out[nextKey] = String(child);
+    }
+    return out;
+}
+function dedupeFingerprints(fingerprints) {
+    const byKey = new Map();
+    for (const fp of fingerprints)
+        byKey.set(`${fp.source}\0${fp.key}`, fp);
+    return [...byKey.values()].sort((a, b) => a.source.localeCompare(b.source) || a.key.localeCompare(b.key));
+}
+//# sourceMappingURL=secret-preservation.js.map

package/dist/core/config/supabase-secret-preservation.js

@@ -0,0 +1,29 @@
+export const PROTECTED_SUPABASE_ENV_KEYS = [
+    'SUPABASE_URL',
+    'SUPABASE_ANON_KEY',
+    'SUPABASE_SERVICE_ROLE_KEY',
+    'NEXT_PUBLIC_SUPABASE_URL',
+    'NEXT_PUBLIC_SUPABASE_ANON_KEY',
+    'VITE_SUPABASE_URL',
+    'VITE_SUPABASE_ANON_KEY',
+    'PUBLIC_SUPABASE_URL',
+    'PUBLIC_SUPABASE_ANON_KEY'
+];
+export const PROTECTED_SUPABASE_CONFIG_PATHS = [
+    'supabase.url',
+    'supabase.anon_key',
+    'supabase.service_role_key',
+    'mcp.supabase.url',
+    'mcp.supabase.token',
+    'mcp.supabase.access_token',
+    'mcp.supabase.service_role_key'
+];
+export const PROTECTED_SECRET_KEYS = [
+    ...PROTECTED_SUPABASE_ENV_KEYS,
+    ...PROTECTED_SUPABASE_CONFIG_PATHS
+];
+export function isProtectedSecretKey(key) {
+    const normalized = String(key || '').trim();
+    return PROTECTED_SECRET_KEYS.some((candidate) => candidate === normalized);
+}
+//# sourceMappingURL=supabase-secret-preservation.js.map

package/dist/core/doctor/doctor-native-capability-repair.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
+import { dedupeProjectSkills } from '../codex-native/project-skill-dedupe.js';
+import { repairNativeCapabilities } from '../codex-native/native-capability-repair.js';
+import { withSecretPreservationGuard } from '../config/config-migration-journal.js';
+export async function runDoctorNativeCapabilityRepair(input) {
+    const root = path.resolve(input.root);
+    const operation = async () => {
+        const coreSkills = await syncCoreSkillsIntegrity({ root, apply: input.fix });
+        const skillDedupe = await dedupeProjectSkills({
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            quarantineUserDuplicates: (input.flags || []).includes('--quarantine-user-duplicate-skills')
+        });
+        const nativeCapabilities = await repairNativeCapabilities({
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            allowManualInstructions: true
+        });
+        const blockers = [
+            ...(coreSkills.blockers || []),
+            ...(skillDedupe.blockers || []),
+            ...(nativeCapabilities.blockers || [])
+        ];
+        const report = {
+            schema: 'sks.doctor-native-capability-repair.v1',
+            generated_at: nowIso(),
+            ok: blockers.length === 0,
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            core_skills: coreSkills,
+            skill_dedupe: skillDedupe,
+            native_capabilities: nativeCapabilities,
+            secret_preservation_guard: '.sneakoscope/reports/secret-preservation-guard.json',
+            blockers
+        };
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'doctor-native-capability-repair.json'), report).catch(() => undefined);
+        return report;
+    };
+    if (!input.fix)
+        return operation();
+    return withSecretPreservationGuard(root, 'doctor-native-capability-repair', operation);
+}
+//# sourceMappingURL=doctor-native-capability-repair.js.map

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.7';
+export const PACKAGE_VERSION = '3.1.8';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/init.js

@@ -11,6 +11,7 @@ import { AWESOME_DESIGN_MD_REFERENCE, CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_
 import { SKILL_DREAM_POLICY, skillDreamPolicyText } from './skill-forge.js';
 import { CODEX_HOOK_EVENT_STATE_KEYS } from './codex-compat/codex-hook-events.js';
 import { codexCommandHookCurrentHash } from './codex-hooks/codex-hook-hash.js';
+import { buildSksCoreSkillManifest, isCoreSkillName, renderCoreSkillTemplate } from './codex-native/core-skill-manifest.js';
 const REFLECTION_MEMORY_PATH = '.sneakoscope/memory/q2_facts/post-route-reflection.md';
 const SKS_GENERATED_GIT_PATTERNS = [
     '.sneakoscope/missions/',
@@ -1083,9 +1084,12 @@ export async function installSkills(root) {
         'design-ui-editor': `---\nname: design-ui-editor\ndescription: Legacy fallback UI/UX editor for existing design.md systems when Product Design plugin is unavailable.\n---\n\nUse Product Design plugin first. When falling back, read \`design.md\`, inspect relevant UI/assets/tests, consult getdesign-reference when improving the design system, apply the smallest design-system-conformant change, use imagegen for image/logo/raster assets, and verify render quality. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY} If design.md is missing and Product Design is unavailable, use design-system-builder as fallback.\n`,
         'design-artifact-expert': `---\nname: design-artifact-expert\ndescription: Legacy fallback for high-fidelity HTML/UI/prototype artifacts when Product Design plugin cannot be used.\n---\n\nUse Product Design plugin first for design/UI/prototype work. When falling back, read design.md when present, consult getdesign-reference for design-system grounding, build the usable artifact first, preserve state, verify overlap/readability/responsiveness, and use imagegen for required assets. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY}\n`
     };
+    for (const skill of buildSksCoreSkillManifest().skills) {
+        skills[skill.canonical_name] = renderCoreSkillTemplate(skill.canonical_name);
+    }
     for (const [name, content] of Object.entries(skills)) {
         const dir = path.join(root, '.agents', 'skills', name);
-        const skillContent = enrichSkillContent(name, content);
+        const skillContent = isCoreSkillName(name) ? content : enrichSkillContent(name, content);
         await ensureDir(dir);
         await writeTextAtomic(path.join(dir, 'SKILL.md'), `${skillContent.trim()}\n`);
         await writeSkillMetadata(dir, name);

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '3.1.7';
+export const PACKAGE_VERSION = '3.1.8';
 //# sourceMappingURL=version.js.map

package/dist/scripts/sizecheck.js

@@ -7,11 +7,15 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const limits = {
-    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || 1024 * 1024),
-    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || 5 * 1024 * 1024),
+    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || 1536 * 1024),
+    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || 6 * 1024 * 1024),
     packFiles: Number(process.env.SKS_MAX_PACK_FILES || 1200),
     trackedFileBytes: Number(process.env.SKS_MAX_TRACKED_FILE_BYTES || 384 * 1024)
 };
+const trackedFileSizeAllowlist = new Set([
+    // Historical source documentation export; not included in the npm package payload.
+    'docs/sks-local-llm-mode/exports/sks-local-llm-mode-deck.pdf'
+]);
 const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 function fail(message, detail = '') {
     console.error(`Size check failed: ${message}`);
@@ -40,6 +44,8 @@ function checkTrackedFiles() {
     const files = result.stdout.toString('utf8').split('\0').filter(Boolean);
     const oversized = [];
     for (const file of files) {
+        if (trackedFileSizeAllowlist.has(file))
+            continue;
         let stat;
         try {
             stat = fs.statSync(path.join(root, file));

package/dist/scripts/sks-3-1-8-check-lib.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+export { assertGate, emitGate };
+export async function makeTempRoot(prefix) {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), prefix));
+    await fs.mkdir(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+    await fs.mkdir(path.join(root, '.sneakoscope', 'locks'), { recursive: true });
+    return root;
+}
+export async function writeText(file, text) {
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, text, 'utf8');
+}
+export async function readJson(file) {
+    return JSON.parse(await fs.readFile(file, 'utf8'));
+}
+export async function writeManagedCoreSkill(root, relRoot, name) {
+    const file = path.join(root, relRoot, name, 'SKILL.md');
+    await writeText(file, renderCoreSkillTemplate(name));
+    return file;
+}
+export async function writeUserSkill(root, relRoot, name, display = name) {
+    const file = path.join(root, relRoot, name, 'SKILL.md');
+    await writeText(file, `---\nname: ${display}\ndescription: user-authored fixture\n---\n\nUser skill fixture.\n`);
+    return file;
+}
+//# sourceMappingURL=sks-3-1-8-check-lib.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "3.1.7",
+  "version": "3.1.8",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -617,6 +617,32 @@
     "naruto:zellij-dynamic-right-column": "node ./dist/scripts/naruto-zellij-dynamic-right-column-check.js",
     "git:worktree-integration-primary-runtime": "node ./dist/scripts/git-worktree-integration-primary-runtime-check.js",
     "agent:role-config-repair": "node ./dist/scripts/agent-role-config-repair-check.js",
+    "core-skill:manifest": "node ./dist/scripts/core-skill-manifest-check.js",
+    "core-skill:immutable-sync": "node ./dist/scripts/core-skill-immutable-sync-check.js",
+    "core-skill:no-drift": "node ./dist/scripts/core-skill-no-drift-check.js",
+    "core-skill:integrity-blackbox": "node ./dist/scripts/core-skill-integrity-blackbox.js",
+    "skill:name-canonicalizer": "node ./dist/scripts/skill-name-canonicalizer-check.js",
+    "skill:registry-ledger": "node ./dist/scripts/skill-registry-ledger-check.js",
+    "skill:dedupe": "node ./dist/scripts/project-skill-dedupe-check.js",
+    "skill:sync-atomic": "node ./dist/scripts/skill-sync-atomic-check.js",
+    "skill:dedupe-blackbox": "node ./dist/scripts/project-skill-dedupe-blackbox.js",
+    "native-capability:repair-matrix": "node ./dist/scripts/native-capability-repair-matrix-check.js",
+    "native-capability:repair": "node ./dist/scripts/native-capability-repair-check.js",
+    "native-capability:postcheck": "node ./dist/scripts/native-capability-postcheck-check.js",
+    "native:image-generation-repair": "node ./dist/scripts/native-image-generation-repair-check.js",
+    "native:computer-use-repair": "node ./dist/scripts/native-computer-use-repair-check.js",
+    "native:chrome-web-review-repair": "node ./dist/scripts/native-chrome-web-review-repair-check.js",
+    "native:app-screenshot-repair": "node ./dist/scripts/native-app-screenshot-repair-check.js",
+    "doctor:native-capability-repair": "node ./dist/scripts/doctor-native-capability-repair-check.js",
+    "doctor:native-repair-output": "node ./dist/scripts/doctor-native-repair-output-check.js",
+    "doctor:native-capability-repair-blackbox": "node ./dist/scripts/doctor-native-capability-repair-blackbox.js",
+    "secret:preservation": "node ./dist/scripts/secret-preservation-check.js",
+    "config:managed-merge": "node ./dist/scripts/managed-config-merge-check.js",
+    "secret:preservation-guard": "node ./dist/scripts/secret-preservation-guard-check.js",
+    "secret:supabase-preservation-blackbox": "node ./dist/scripts/supabase-secret-preservation-blackbox.js",
+    "update:preserves-supabase-keys": "node ./dist/scripts/update-preserves-supabase-keys-blackbox.js",
+    "update:secret-preservation-guard": "node ./dist/scripts/update-secret-preservation-guard-check.js",
+    "update:secret-migration-journal": "node ./dist/scripts/update-secret-migration-journal-check.js",
     "release:dag-full-coverage": "node ./dist/scripts/release-dag-full-coverage-check.js",
     "release:cache-glob-hashing": "node ./dist/scripts/release-cache-glob-hashing-check.js",
     "release:check:affected": "npm run build --silent && node ./dist/scripts/release-gate-dag-runner.js --preset affected --changed-since auto",