sneakoscope 3.1.7 → 3.1.9

package/dist/core/codex-native/core-skill-integrity.js

@@ -0,0 +1,89 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { buildSksCoreSkillManifest, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
+import { canonicalSkillName } from './skill-name-canonicalizer.js';
+export async function syncCoreSkillsIntegrity(input) {
+    const root = path.resolve(input.root);
+    const skillsRoot = input.skillsRoot || path.join(root, '.agents', 'skills');
+    const apply = input.apply === true;
+    const manifest = buildSksCoreSkillManifest();
+    const rows = [];
+    const installed = [];
+    const restored = [];
+    const skippedUserAuthored = [];
+    const blockers = [];
+    for (const skill of manifest.skills) {
+        const skillDir = path.join(skillsRoot, skill.canonical_name);
+        const file = path.join(skillDir, 'SKILL.md');
+        const desired = renderCoreSkillTemplate(skill.canonical_name);
+        const current = await readText(file, null);
+        const beforeSha = typeof current === 'string' ? sha256(current) : null;
+        let action = 'already-current';
+        let backupPath = null;
+        let blocker = null;
+        if (current === null) {
+            action = 'install-missing-managed-copy';
+            if (apply) {
+                await ensureDir(skillDir);
+                await writeTextAtomic(file, desired);
+                installed.push(file);
+            }
+        }
+        else if (beforeSha === skill.content_sha256) {
+            action = 'already-current';
+        }
+        else if (isSksManagedCoreSkillContent(current)) {
+            action = 'restore-corrupted-managed-copy';
+            if (apply) {
+                backupPath = path.join(root, '.sneakoscope', 'backups', 'core-skills', skill.canonical_name, `${Date.now()}-${process.pid}.SKILL.md.bak`);
+                await ensureDir(path.dirname(backupPath));
+                await fs.writeFile(backupPath, current, 'utf8');
+                await writeTextAtomic(file, desired);
+                restored.push(file);
+            }
+        }
+        else {
+            action = 'skip-user-authored';
+            blocker = `user_authored_core_skill_collision:${skill.canonical_name}`;
+            skippedUserAuthored.push(file);
+        }
+        const after = await readText(file, null);
+        const afterSha = typeof after === 'string' ? sha256(after) : null;
+        rows.push({
+            canonical_name: skill.canonical_name,
+            path: file,
+            action,
+            before_sha256: beforeSha,
+            after_sha256: afterSha,
+            backup_path: backupPath,
+            blocker
+        });
+        if (blocker)
+            blockers.push(blocker);
+    }
+    const report = {
+        schema: 'sks.core-skill-integrity.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        root,
+        apply,
+        skills_root: skillsRoot,
+        manifest_sha256: sha256(JSON.stringify(manifest.skills.map((skill) => [skill.canonical_name, skill.content_sha256]))),
+        rows,
+        installed,
+        restored,
+        skipped_user_authored: skippedUserAuthored,
+        blockers
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'core-skill-integrity.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, report).catch(() => undefined);
+    return report;
+}
+export function coreSkillPath(skillsRoot, name) {
+    return path.join(skillsRoot, canonicalSkillName(name), 'SKILL.md');
+}
+//# sourceMappingURL=core-skill-integrity.js.map

package/dist/core/codex-native/core-skill-manifest.js

@@ -0,0 +1,156 @@
+import { PACKAGE_VERSION, nowIso, sha256 } from '../fsx.js';
+import { canonicalSkillName } from './skill-name-canonicalizer.js';
+export const CORE_SKILL_TEMPLATE_VERSION = '3.1.8-core-skill-template.v1';
+export const CORE_SKILL_MANAGED_BEGIN = '<!-- BEGIN SKS IMMUTABLE CORE SKILL -->';
+export const CORE_SKILL_MANAGED_END = '<!-- END SKS IMMUTABLE CORE SKILL -->';
+const CORE_SKILL_DEFINITIONS = [
+    {
+        id: 'sks-core-loop',
+        canonical_name: 'loop',
+        display_name: 'loop',
+        route: '$Loop',
+        purpose: 'compile persisted route work into bounded loop plans with continuation evidence.',
+        when: 'Use for resumable route stages, memory hints, and loop mission artifacts.',
+        evidence: '.sneakoscope/loops/** plus route-local proof artifacts.',
+        fallback: 'Record the unavailable surface as blocked; do not fabricate a loop proof.'
+    },
+    {
+        id: 'sks-core-naruto',
+        canonical_name: 'naruto',
+        display_name: 'naruto',
+        route: '$Naruto',
+        purpose: 'fan out bounded native worker lanes while parent integration remains owner.',
+        when: 'Use when the selected route explicitly requires high-scale parallel review or implementation.',
+        evidence: 'agent task graph, worker ledgers, leases, proof evidence, and cleanup artifacts.',
+        fallback: 'Degrade to parent-owned execution with blockers recorded if native lanes are unavailable.'
+    },
+    {
+        id: 'sks-core-qa-loop',
+        canonical_name: 'qa-loop',
+        display_name: 'qa-loop',
+        route: '$QA-LOOP',
+        purpose: 'dogfood UI/API behavior with safety gates and QA reports.',
+        when: 'Use when route completion needs human-proxy verification, rechecks, and QA ledgers.',
+        evidence: 'qa-ledger.json, dated QA report, qa-gate.json, and post-fix verification.',
+        fallback: 'Mark unverified browser/native surfaces explicitly; never substitute fake visual evidence.'
+    },
+    {
+        id: 'sks-core-research',
+        canonical_name: 'research',
+        display_name: 'research',
+        route: '$Research',
+        purpose: 'run evidence-bound discovery, source ledgers, and synthesis cycles.',
+        when: 'Use for discovery, evaluation, external-source claims, or frontier-style research.',
+        evidence: 'research plan, source ledger, cycle record, synthesis, and final review.',
+        fallback: 'State source/tool unavailability and avoid unsupported live-accuracy claims.'
+    },
+    {
+        id: 'sks-core-dfix',
+        canonical_name: 'dfix',
+        display_name: 'dfix',
+        route: '$DFix',
+        purpose: 'perform tiny direct fixes with cheap verification.',
+        when: 'Use only for narrow copy/config/docs/labels/spacing/translation/mechanical edits.',
+        evidence: 'focused diff and DFix Honest check.',
+        fallback: 'Escalate broad implementation to a full execution route.'
+    },
+    {
+        id: 'sks-core-image-ux-review',
+        canonical_name: 'image-ux-review',
+        display_name: 'image-ux-review',
+        route: '$Image-UX-Review',
+        purpose: 'produce generated annotated UI review images and extract issue ledgers.',
+        when: 'Use for screenshot/UI UX review requests that require generated raster evidence.',
+        evidence: 'source inventory, generated annotation image ledger, issue ledger, iteration report.',
+        fallback: 'Block full verification if generated annotated images cannot be produced.'
+    },
+    {
+        id: 'sks-core-computer-use',
+        canonical_name: 'computer-use',
+        display_name: 'computer-use',
+        route: '$Computer-Use',
+        purpose: 'operate native macOS desktop apps through Codex Computer Use.',
+        when: 'Use only for native Mac/non-web app or OS-setting surfaces.',
+        evidence: 'native desktop interaction evidence where live Computer Use is available.',
+        fallback: 'Do not use Computer Use as browser/web evidence; mark unavailable surfaces unverified.'
+    },
+    {
+        id: 'sks-core-init-deep',
+        canonical_name: 'init-deep',
+        display_name: 'init-deep',
+        route: '$Init-Deep',
+        purpose: 'refresh project-local memory, directory rules, and loop memory hints.',
+        when: 'Use when deeper local context or directory-specific recall is required.',
+        evidence: '.sneakoscope/context/AGENTS.generated.md and managed memory artifacts.',
+        fallback: 'Preserve user content and skip directories that cannot be safely updated.'
+    }
+];
+export function coreSkillDefinitions() {
+    return CORE_SKILL_DEFINITIONS;
+}
+export function isCoreSkillName(name) {
+    const canonical = canonicalSkillName(name);
+    return CORE_SKILL_DEFINITIONS.some((skill) => skill.canonical_name === canonical);
+}
+export function renderCoreSkillTemplate(name) {
+    const canonical = canonicalSkillName(name);
+    const skill = CORE_SKILL_DEFINITIONS.find((entry) => entry.canonical_name === canonical);
+    if (!skill)
+        throw new Error(`Unknown SKS core skill: ${name}`);
+    return [
+        '---',
+        `name: ${skill.display_name}`,
+        `description: Immutable SKS core Codex App route bridge for ${skill.route}.`,
+        '---',
+        '',
+        CORE_SKILL_MANAGED_BEGIN,
+        `id: ${skill.id}`,
+        `canonical_name: ${skill.canonical_name}`,
+        `route: ${skill.route}`,
+        `template_version: ${CORE_SKILL_TEMPLATE_VERSION}`,
+        'mutable_by_doctor: false',
+        'mutable_by_update: false',
+        'mutable_by_setup: false',
+        CORE_SKILL_MANAGED_END,
+        '',
+        `Route: ${skill.route}`,
+        `Command: ${skill.route}`,
+        `Purpose: ${skill.purpose}`,
+        `Use when: ${skill.when}`,
+        `Proof paths: ${skill.evidence}`,
+        'Safety rules: preserve user-authored skills, keep route state bounded, and stop on hard blockers instead of fabricating fallback behavior.',
+        `Failure recovery: ${skill.fallback}`,
+        ''
+    ].join('\n');
+}
+export function buildSksCoreSkillManifest(generatedAt = nowIso()) {
+    return {
+        schema: 'sks.core-skill-manifest.v1',
+        generated_at: generatedAt,
+        package_version: PACKAGE_VERSION,
+        skills: CORE_SKILL_DEFINITIONS.map((skill) => {
+            const content = renderCoreSkillTemplate(skill.canonical_name);
+            return {
+                id: skill.id,
+                canonical_name: skill.canonical_name,
+                display_name: skill.display_name,
+                route: skill.route,
+                relative_path: `.agents/skills/${skill.canonical_name}/SKILL.md`,
+                template_version: CORE_SKILL_TEMPLATE_VERSION,
+                content_sha256: sha256(content),
+                mutable_by_doctor: false,
+                mutable_by_update: false,
+                mutable_by_setup: false
+            };
+        })
+    };
+}
+export function coreSkillTemplateByCanonicalName(name) {
+    const canonical = canonicalSkillName(name);
+    return buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills.find((skill) => skill.canonical_name === canonical) || null;
+}
+export function isSksManagedCoreSkillContent(text) {
+    const value = String(text || '');
+    return value.includes(CORE_SKILL_MANAGED_BEGIN) && value.includes(CORE_SKILL_MANAGED_END);
+}
+//# sourceMappingURL=core-skill-manifest.js.map

package/dist/core/codex-native/native-capability-postcheck.js

@@ -0,0 +1,35 @@
+import path from 'node:path';
+import { writeJsonAtomic } from '../fsx.js';
+import { buildNativeCapabilityRepairMatrix } from './native-capability-repair-matrix.js';
+export async function postcheckNativeCapabilities(input) {
+    const root = path.resolve(input.root);
+    const matrix = input.matrix || await buildNativeCapabilityRepairMatrix({ root, fixture: input.fixture || false, reportPath: null });
+    const capabilities = matrix.capabilities.map((state) => {
+        const verifiedAfterRepair = state.repairability === 'auto' || state.repairability === 'doctor-fix';
+        if (state.id === 'computer_use' && process.env.SKS_COMPUTER_USE_CAPABILITY !== 'verified') {
+            return { ...state, after: 'unknown', blockers: ['computer_use_os_permission_or_capability_unknown'] };
+        }
+        if (state.id === 'chrome_web_review' && process.env.SKS_CHROME_EXTENSION_READY !== '1' && input.fixture !== 'all-repairable') {
+            return { ...state, after: 'unknown', blockers: ['codex_chrome_extension_readiness_not_verified'] };
+        }
+        if (state.blockers.length === 0 || verifiedAfterRepair)
+            return { ...state, after: state.repairability === 'manual-required' ? 'unknown' : 'verified', blockers: state.repairability === 'manual-required' ? state.blockers : [] };
+        return { ...state, after: 'blocked' };
+    });
+    const blockers = capabilities.flatMap((state) => state.after === 'verified' ? [] : state.blockers);
+    const checked = {
+        ...matrix,
+        generated_at: new Date().toISOString(),
+        ok: blockers.length === 0,
+        capabilities,
+        blockers,
+        warnings: capabilities.flatMap((state) => state.warnings)
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'native-capability-postcheck.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, checked).catch(() => undefined);
+    return checked;
+}
+//# sourceMappingURL=native-capability-postcheck.js.map

package/dist/core/codex-native/native-capability-repair-matrix.js

@@ -0,0 +1,210 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { detectImagegenCapability } from '../imagegen/imagegen-capability.js';
+import { buildCodexNativeFeatureMatrix } from './codex-native-feature-broker.js';
+export const NATIVE_CAPABILITY_IDS = [
+    'image_generation',
+    'image_followup_edit',
+    'computer_use',
+    'chrome_web_review',
+    'codex_app_screenshot',
+    'app_handoff',
+    'image_path_exposure',
+    'saved_artifact_path_contract'
+];
+export async function buildNativeCapabilityRepairMatrix(input) {
+    const root = path.resolve(input.root);
+    const selected = new Set(input.capabilities || NATIVE_CAPABILITY_IDS);
+    const fixture = input.fixture || false;
+    const imageCapability = fixture
+        ? fixtureImageCapability(fixture)
+        : await detectImagegenCapability({ timeoutMs: 2500 }).catch((err) => ({ blockers: [messageOf(err)], auth_readiness: null, codex_app: { available: false } }));
+    const nativeFeatureMatrix = fixture
+        ? fixtureNativeFeatureMatrix(fixture)
+        : await buildCodexNativeFeatureMatrix({ root, mode: 'read-only' }).catch((err) => ({ ok: false, features: {}, blockers: [messageOf(err)], invocation_defaults: {} }));
+    const states = await Promise.all(NATIVE_CAPABILITY_IDS.filter((id) => selected.has(id)).map((id) => stateForCapability(root, id, imageCapability, nativeFeatureMatrix)));
+    const blockers = states.flatMap((state) => state.blockers);
+    const warnings = states.flatMap((state) => state.warnings);
+    const matrix = {
+        schema: 'sks.native-capability-repair-matrix.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        capabilities: states,
+        blockers,
+        warnings
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'native-capability-repair-matrix.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, matrix).catch(() => undefined);
+    return matrix;
+}
+async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix) {
+    const reports = path.join(root, '.sneakoscope', 'reports');
+    if (id === 'image_generation') {
+        const verified = imageCapability?.codex_app?.available === true || imageCapability?.auth_readiness?.headless_auto_available === true;
+        return {
+            id,
+            before: verified ? 'verified' : 'blocked',
+            repairability: verified ? 'auto' : 'manual-required',
+            repair_actions: verified ? ['postcheck-imagegen-path-contract'] : ['Sign in to Codex App and enable/use the built-in $imagegen surface, or provide explicit imagegen auth for a non-Codex fallback.'],
+            after: null,
+            artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
+            blockers: verified ? [] : ['imagegen_auth_or_codex_app_builtin_missing'],
+            warnings: verified ? [] : ['image_generation_not_verified_without_real_capability']
+        };
+    }
+    if (id === 'image_followup_edit') {
+        const contractReady = await fileExists(path.join(root, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json'));
+        return autoState(id, contractReady, path.join(reports, 'saved-artifact-path-contract.json'), ['create-saved-artifact-path-contract']);
+    }
+    if (id === 'codex_app_screenshot') {
+        const dir = path.join(root, '.sneakoscope', 'app-screenshots');
+        const ready = await dirWritable(dir);
+        return autoState(id, ready, path.join(root, '.sneakoscope', 'app-screenshots', 'screenshot-registry.json'), ['create-app-screenshot-directory', 'create-screenshot-registry']);
+    }
+    if (id === 'saved_artifact_path_contract') {
+        const ready = await fileExists(path.join(reports, 'saved-artifact-path-contract.json'));
+        return autoState(id, ready, path.join(reports, 'saved-artifact-path-contract.json'), ['create-saved-artifact-path-contract']);
+    }
+    if (id === 'app_handoff') {
+        const ok = featureOk(nativeFeatureMatrix, 'app_handoff');
+        return {
+            id,
+            before: ok ? 'verified' : 'unknown',
+            repairability: ok ? 'auto' : 'manual-required',
+            repair_actions: ok ? ['postcheck-app-handoff'] : ['Open Codex App and approve/enable app handoff; rerun `sks doctor --fix --repair-native-capabilities --yes`.'],
+            after: null,
+            artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
+            blockers: ok ? [] : ['codex_app_handoff_not_verified'],
+            warnings: ok ? [] : ['manual_app_handoff_approval_required']
+        };
+    }
+    if (id === 'image_path_exposure') {
+        const ok = featureOk(nativeFeatureMatrix, 'image_path_exposure');
+        const fallback = await fileExists(path.join(reports, 'saved-artifact-path-contract.json'));
+        return {
+            id,
+            before: ok ? 'verified' : fallback ? 'degraded' : 'missing',
+            repairability: ok ? 'auto' : 'doctor-fix',
+            repair_actions: ok ? ['postcheck-image-path-exposure'] : ['create-saved-artifact-path-contract'],
+            after: null,
+            artifact_path: path.join(reports, 'saved-artifact-path-contract.json'),
+            blockers: ok || fallback ? [] : ['image_path_exposure_missing_without_fallback_contract'],
+            warnings: ok ? [] : ['using_saved_artifact_path_contract_fallback']
+        };
+    }
+    if (id === 'computer_use') {
+        const envVerified = process.env.SKS_COMPUTER_USE_CAPABILITY === 'verified';
+        return {
+            id,
+            before: envVerified ? 'verified' : 'unknown',
+            repairability: envVerified ? 'auto' : 'manual-required',
+            repair_actions: envVerified ? ['postcheck-computer-use'] : ['Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions, then rerun doctor.'],
+            after: null,
+            artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
+            blockers: envVerified ? [] : ['computer_use_os_permission_or_capability_unknown'],
+            warnings: envVerified ? [] : ['manual_os_permission_required']
+        };
+    }
+    const chromeReady = process.env.SKS_CHROME_EXTENSION_READY === '1' || featureOk(nativeFeatureMatrix, 'plugin_json');
+    return {
+        id,
+        before: chromeReady ? 'verified' : 'unknown',
+        repairability: chromeReady ? 'auto' : 'manual-required',
+        repair_actions: chromeReady ? ['postcheck-chrome-extension-readiness'] : ['Install/enable the official Codex Chrome Extension, approve it in Codex App, then rerun QA/browser verification.'],
+        after: null,
+        artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
+        blockers: chromeReady ? [] : ['codex_chrome_extension_readiness_not_verified'],
+        warnings: chromeReady ? [] : ['manual_chrome_extension_setup_required']
+    };
+}
+export async function writeSavedArtifactPathContract(root) {
+    const artifactPath = path.join(root, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json');
+    await writeJsonAtomic(artifactPath, {
+        schema: 'sks.saved-artifact-path-contract.v1',
+        generated_at: nowIso(),
+        root,
+        image_artifacts: path.join(root, '.sneakoscope', 'image-artifacts'),
+        app_screenshots: path.join(root, '.sneakoscope', 'app-screenshots'),
+        model_visible_path_strategy: 'saved-artifact-path',
+        raw_secret_values_recorded: false
+    });
+    return artifactPath;
+}
+export async function ensureNativeCapabilityArtifactRoots(root) {
+    const imageDir = path.join(root, '.sneakoscope', 'image-artifacts');
+    const appDir = path.join(root, '.sneakoscope', 'app-screenshots');
+    await ensureDir(imageDir);
+    await ensureDir(appDir);
+    const imageRegistry = path.join(imageDir, 'image-artifact-registry.json');
+    const screenshotRegistry = path.join(appDir, 'screenshot-registry.json');
+    const created = [];
+    if (!(await fileExists(imageRegistry))) {
+        await writeJsonAtomic(imageRegistry, { schema: 'sks.image-artifact-registry.v1', generated_at: nowIso(), images: [] });
+        created.push(imageRegistry);
+    }
+    if (!(await fileExists(screenshotRegistry))) {
+        await writeJsonAtomic(screenshotRegistry, { schema: 'sks.app-screenshot-registry.v1', generated_at: nowIso(), screenshots: [] });
+        created.push(screenshotRegistry);
+    }
+    created.push(await writeSavedArtifactPathContract(root));
+    return created;
+}
+function autoState(id, ready, artifactPath, actions) {
+    return {
+        id,
+        before: ready ? 'verified' : 'missing',
+        repairability: ready ? 'auto' : 'doctor-fix',
+        repair_actions: ready ? [`postcheck-${id}`] : actions,
+        after: null,
+        artifact_path: artifactPath,
+        blockers: ready ? [] : [`${id}_repair_required`],
+        warnings: []
+    };
+}
+function featureOk(matrix, feature) {
+    return matrix?.features?.[feature]?.ok === true;
+}
+async function fileExists(file) {
+    try {
+        const stat = await fs.stat(file);
+        return stat.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function dirWritable(dir) {
+    try {
+        await ensureDir(dir);
+        await fs.access(dir);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function fixtureImageCapability(mode) {
+    return mode === 'all-repairable'
+        ? { codex_app: { available: true }, auth_readiness: { headless_auto_available: true }, blockers: [] }
+        : { codex_app: { available: false }, auth_readiness: { headless_auto_available: false }, blockers: ['fixture_manual_required'] };
+}
+function fixtureNativeFeatureMatrix(mode) {
+    const ok = mode === 'all-repairable';
+    return {
+        ok,
+        features: {
+            app_handoff: { ok },
+            image_path_exposure: { ok },
+            plugin_json: { ok }
+        },
+        blockers: ok ? [] : ['fixture_manual_required']
+    };
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=native-capability-repair-matrix.js.map

package/dist/core/codex-native/native-capability-repair.js

@@ -0,0 +1,47 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { syncCoreSkillsIntegrity } from './core-skill-integrity.js';
+import { buildNativeCapabilityRepairMatrix, ensureNativeCapabilityArtifactRoots } from './native-capability-repair-matrix.js';
+import { postcheckNativeCapabilities } from './native-capability-postcheck.js';
+export async function repairNativeCapabilities(input) {
+    const root = path.resolve(input.root);
+    const capabilitySelection = input.capabilities ? { capabilities: input.capabilities } : {};
+    const before = await buildNativeCapabilityRepairMatrix({
+        root,
+        ...capabilitySelection,
+        fixture: input.fixture || false,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'native-capability-repair-matrix-before.json')
+    });
+    const repaired = [];
+    if (input.fix) {
+        repaired.push(...await ensureNativeCapabilityArtifactRoots(root));
+        await syncCoreSkillsIntegrity({ root, apply: true }).catch(() => undefined);
+    }
+    const afterMatrix = await buildNativeCapabilityRepairMatrix({
+        root,
+        ...capabilitySelection,
+        fixture: input.fixture || false,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'native-capability-repair-matrix.json')
+    });
+    const postcheck = await postcheckNativeCapabilities({
+        root,
+        matrix: afterMatrix,
+        fixture: input.fixture || false,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'native-capability-postcheck.json')
+    });
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'native-capability-repair.json'), {
+        schema: 'sks.native-capability-repair.v1',
+        generated_at: nowIso(),
+        ok: postcheck.ok,
+        fix: input.fix,
+        yes: input.yes,
+        before,
+        after: postcheck,
+        repaired_artifacts: repaired,
+        manual_required: postcheck.capabilities
+            .filter((state) => state.repairability === 'manual-required' && state.after !== 'verified')
+            .map((state) => ({ id: state.id, actions: state.repair_actions }))
+    }).catch(() => undefined);
+    return postcheck;
+}
+//# sourceMappingURL=native-capability-repair.js.map

package/dist/core/codex-native/native-media-computer-repair.js

@@ -0,0 +1,5 @@
+import { repairNativeCapabilities } from './native-capability-repair.js';
+export async function repairNativeMediaComputerCapabilities(input) {
+    return repairNativeCapabilities(input);
+}
+//# sourceMappingURL=native-media-computer-repair.js.map

package/dist/core/codex-native/project-skill-dedupe.js

@@ -0,0 +1,109 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { buildSkillRegistryLedger, groupByCanonical } from './skill-registry-ledger.js';
+export async function dedupeProjectSkills(input) {
+    const root = path.resolve(input.root);
+    const fix = input.fix === true;
+    const yes = input.yes === true;
+    const ledger = await buildSkillRegistryLedger({ root });
+    const grouped = groupByCanonical(ledger.entries);
+    const actions = [];
+    const unresolvedUserDuplicates = [];
+    for (const [canonical, group] of grouped.entries()) {
+        if (group.length <= 1)
+            continue;
+        group.sort(compareSkillPriority);
+        const userEntries = group.filter((entry) => !entry.managed_by_sks);
+        const managedEntries = group.filter((entry) => entry.managed_by_sks);
+        if (userEntries.length > 0 && managedEntries.length > 0) {
+            for (const user of userEntries)
+                actions.push(actionRow(canonical, 'kept', user, null, 'user-authored skill preserved'));
+            for (const managed of managedEntries) {
+                const quarantine = await maybeQuarantine(root, canonical, managed, fix, 'managed collision with user-authored skill');
+                actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', managed, quarantine, 'managed collision with user-authored skill'));
+            }
+            continue;
+        }
+        if (managedEntries.length > 1) {
+            const current = managedEntries.find((entry) => entry.status === 'managed-current') || managedEntries[0];
+            if (current)
+                actions.push(actionRow(canonical, 'kept', current, null, 'highest-priority SKS-managed skill kept'));
+            for (const duplicate of managedEntries.filter((entry) => entry !== current)) {
+                const quarantine = await maybeQuarantine(root, canonical, duplicate, fix, 'duplicate SKS-managed skill');
+                actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', duplicate, quarantine, 'duplicate SKS-managed skill'));
+            }
+            continue;
+        }
+        if (userEntries.length > 1) {
+            const keep = userEntries[0];
+            if (keep)
+                actions.push(actionRow(canonical, 'kept', keep, null, 'highest-priority user-authored skill kept'));
+            const shouldMove = fix && yes && input.quarantineUserDuplicates === true;
+            for (const duplicate of userEntries.slice(1)) {
+                const quarantine = shouldMove ? await quarantineSkill(root, canonical, duplicate, 'user-authored duplicate skill') : null;
+                actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', duplicate, quarantine, 'user-authored duplicate skill requires --quarantine-user-duplicates --yes'));
+            }
+            if (!shouldMove)
+                unresolvedUserDuplicates.push(canonical);
+        }
+    }
+    const duplicateNames = [...new Set(actions.filter((action) => action.action !== 'kept').map((action) => action.canonical_name))].sort();
+    const blockers = unresolvedUserDuplicates.map((name) => `user_duplicate_requires_confirmation:${name}`);
+    const report = {
+        schema: 'sks.project-skill-dedupe.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        root,
+        fix,
+        yes,
+        actions,
+        duplicate_canonical_names: duplicateNames,
+        unresolved_user_duplicates: unresolvedUserDuplicates,
+        blockers
+    };
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'project-skill-dedupe.json');
+    if (reportPath)
+        await writeJsonAtomic(reportPath, report).catch(() => undefined);
+    return report;
+}
+function compareSkillPriority(a, b) {
+    const currentA = a.status === 'managed-current' ? 1 : 0;
+    const currentB = b.status === 'managed-current' ? 1 : 0;
+    return currentB - currentA || b.active_priority - a.active_priority || a.path.localeCompare(b.path);
+}
+function actionRow(canonicalName, action, entry, quarantinePath, reason) {
+    return {
+        canonical_name: canonicalName,
+        action,
+        path: entry.path,
+        quarantine_path: quarantinePath,
+        reason
+    };
+}
+async function maybeQuarantine(root, canonical, entry, fix, reason) {
+    if (!fix)
+        return null;
+    return quarantineSkill(root, canonical, entry, reason);
+}
+async function quarantineSkill(root, canonical, entry, reason) {
+    const sourceDir = path.dirname(entry.path);
+    const stamp = `${Date.now()}-${process.pid}`;
+    const target = path.join(root, '.sneakoscope', 'quarantine', 'skills', canonical, stamp, path.basename(sourceDir));
+    await ensureDir(path.dirname(target));
+    await fs.cp(sourceDir, target, { recursive: true, force: false });
+    await fs.rm(sourceDir, { recursive: true, force: true });
+    await writeJsonAtomic(path.join(target, 'quarantine-record.json'), {
+        schema: 'sks.skill-quarantine-record.v1',
+        generated_at: nowIso(),
+        source_path: sourceDir,
+        quarantine_path: target,
+        canonical_name: canonical,
+        reason,
+        content_sha256: entry.content_sha256
+    });
+    return target;
+}
+//# sourceMappingURL=project-skill-dedupe.js.map