sneakoscope 3.1.7 → 3.1.9

package/dist/core/config/managed-config-merge.js

@@ -0,0 +1,105 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { isProtectedSecretKey, PROTECTED_SECRET_KEYS } from './supabase-secret-preservation.js';
+export async function writeManagedJsonConfig(file, current, managed) {
+    const next = safeMergeObject(current, managed);
+    const before = `${JSON.stringify(current, null, 2)}\n`;
+    const after = `${JSON.stringify(next, null, 2)}\n`;
+    return writeMergedText(file, before, after, 'json', protectedKeysPresent(current));
+}
+export async function writeManagedTomlConfig(file, currentText, managedBlocks) {
+    let next = String(currentText || '').trimEnd();
+    for (const block of managedBlocks)
+        next = upsertTomlBlockPreservingSecrets(next, block);
+    return writeMergedText(file, currentText, `${next.trim()}\n`, 'toml', protectedKeysInText(currentText));
+}
+export async function writeManagedEnvConfig(file, currentText, managedLines) {
+    const existingKeys = new Set(String(currentText || '').split(/\r?\n/).map((line) => line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1]).filter((value) => Boolean(value)));
+    const additions = managedLines.filter((line) => {
+        const key = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1] || '';
+        return key && !existingKeys.has(key) && !isProtectedSecretKey(key);
+    });
+    const next = additions.length ? `${String(currentText || '').replace(/\s*$/, '\n')}${additions.join('\n')}\n` : String(currentText || '');
+    return writeMergedText(file, currentText, next, 'env', protectedKeysInText(currentText));
+}
+export function safeMergeObject(current, managed) {
+    const out = { ...current };
+    for (const [key, value] of Object.entries(managed)) {
+        if (isProtectedSecretKey(key) && current[key] != null)
+            continue;
+        if (isPlainObject(value) && isPlainObject(current[key]))
+            out[key] = safeMergeObject(current[key], value);
+        else
+            out[key] = value;
+    }
+    return out;
+}
+function upsertTomlBlockPreservingSecrets(text, block) {
+    const header = block.match(/^\s*\[([^\]]+)\]/)?.[1];
+    if (!header)
+        return text;
+    const lines = String(text || '').trimEnd().split('\n');
+    const start = lines.findIndex((line) => line.trim() === `[${header}]`);
+    const blockLines = block.trim().split('\n');
+    if (start === -1)
+        return [...lines.filter((line) => line.length), '', ...blockLines].join('\n');
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[.+\]\s*$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
+    }
+    const existingSecretLines = lines.slice(start + 1, end).filter((line) => {
+        const key = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        return isProtectedSecretKey(`${header}.${key}`) || isProtectedSecretKey(key);
+    });
+    lines.splice(start, end - start, ...blockLines, ...existingSecretLines.filter((line) => !blockLines.includes(line)));
+    return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+async function writeMergedText(file, before, after, format, preserved) {
+    await ensureDir(path.dirname(file));
+    let backupPath = null;
+    if (before !== after) {
+        if (before.trim()) {
+            backupPath = `${file}.sks-managed-merge-${Date.now()}.bak`;
+            await fs.writeFile(backupPath, before, 'utf8');
+        }
+        await writeTextAtomic(file, after);
+    }
+    return {
+        schema: 'sks.managed-config-merge.v1',
+        generated_at: nowIso(),
+        ok: true,
+        path: file,
+        format,
+        changed: before !== after,
+        backup_path: backupPath,
+        protected_keys_preserved: preserved,
+        blockers: []
+    };
+}
+function protectedKeysPresent(value) {
+    const found = [];
+    for (const key of PROTECTED_SECRET_KEYS)
+        if (lookupPath(value, key) != null)
+            found.push(String(key));
+    return found;
+}
+function protectedKeysInText(text) {
+    return PROTECTED_SECRET_KEYS.filter((key) => new RegExp(`(^|\\n)\\s*(?:export\\s+)?${String(key).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(text)).map(String);
+}
+function lookupPath(value, dotted) {
+    let current = value;
+    for (const part of dotted.split('.')) {
+        if (!current || typeof current !== 'object' || Array.isArray(current))
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=managed-config-merge.js.map

package/dist/core/config/secret-preservation.js

@@ -0,0 +1,169 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { ensureDir, nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { PROTECTED_SECRET_KEYS, PROTECTED_SUPABASE_ENV_KEYS } from './supabase-secret-preservation.js';
+export async function captureSecretPreservationSnapshot(input) {
+    const root = path.resolve(input.root);
+    const sources = secretSources(root);
+    const fingerprints = [];
+    for (const source of sources) {
+        const text = await readText(source, null);
+        if (typeof text !== 'string')
+            continue;
+        if (source.endsWith('.json')) {
+            const json = await readJson(source, {}).catch(() => ({}));
+            fingerprints.push(...fingerprintsFromObject(json, source));
+        }
+        else {
+            fingerprints.push(...fingerprintsFromText(text, source));
+        }
+    }
+    const snapshot = {
+        schema: 'sks.secret-preservation-snapshot.v1',
+        generated_at: nowIso(),
+        root,
+        fingerprints: dedupeFingerprints(fingerprints)
+    };
+    if (input.artifactPath)
+        await writeJsonAtomic(input.artifactPath, snapshot).catch(() => undefined);
+    return snapshot;
+}
+export async function withSecretPreservationGuard(root, operationName, fn) {
+    const resolvedRoot = path.resolve(root);
+    const reportDir = path.join(resolvedRoot, '.sneakoscope', 'reports');
+    await ensureDir(reportDir);
+    const beforePath = path.join(reportDir, 'secret-preservation-before.json');
+    const afterPath = path.join(reportDir, 'secret-preservation-after.json');
+    const guardPath = path.join(reportDir, 'secret-preservation-guard.json');
+    const before = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: beforePath });
+    let result;
+    try {
+        result = await fn();
+    }
+    catch (err) {
+        await writeJsonAtomic(guardPath, {
+            schema: 'sks.secret-preservation-guard.v1',
+            generated_at: nowIso(),
+            ok: false,
+            operation: operationName,
+            before_path: beforePath,
+            after_path: null,
+            restored_keys_count: 0,
+            missing_after: [],
+            raw_values_recorded: false,
+            operation_error: err instanceof Error ? err.message : String(err)
+        }).catch(() => undefined);
+        throw err;
+    }
+    const after = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: afterPath });
+    const missing = missingProtectedSecrets(before, after);
+    const report = {
+        schema: 'sks.secret-preservation-guard.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0,
+        operation: operationName,
+        before_path: beforePath,
+        after_path: afterPath,
+        restored_keys_count: 0,
+        missing_after: missing,
+        raw_values_recorded: false
+    };
+    await writeJsonAtomic(guardPath, report).catch(() => undefined);
+    if (missing.length) {
+        throw new Error(`secret_preservation_failed:${missing.map((item) => `${item.source}:${item.key}`).join(',')}`);
+    }
+    return result;
+}
+export function missingProtectedSecrets(before, after) {
+    const afterMap = new Map(after.fingerprints.filter((fp) => fp.present).map((fp) => [`${fp.source}\0${fp.key}`, fp]));
+    return before.fingerprints
+        .filter((fp) => fp.present && fp.value_sha256)
+        .filter((fp) => !afterMap.has(`${fp.source}\0${fp.key}`))
+        .map((fp) => ({ key: fp.key, source: fp.source }));
+}
+function secretSources(root) {
+    const home = process.env.HOME || os.homedir();
+    return [
+        '.env',
+        '.env.local',
+        '.env.development',
+        '.env.production',
+        '.sneakoscope/config.json',
+        '.codex/config.toml'
+    ].map((rel) => path.join(root, rel)).concat(path.join(home, '.codex', 'config.toml'));
+}
+function fingerprintsFromText(text, source) {
+    const rows = [];
+    for (const key of PROTECTED_SECRET_KEYS) {
+        const value = readAssignment(text, key);
+        if (!value)
+            continue;
+        rows.push(fingerprint(String(key), source, value));
+    }
+    for (const envKey of PROTECTED_SUPABASE_ENV_KEYS) {
+        const value = readAssignment(text, envKey);
+        if (value)
+            rows.push(fingerprint(envKey, source, value));
+    }
+    return rows;
+}
+function fingerprintsFromObject(value, source) {
+    const flat = flattenObject(value);
+    const rows = [];
+    for (const [key, raw] of Object.entries(flat)) {
+        if (!PROTECTED_SECRET_KEYS.includes(key))
+            continue;
+        rows.push(fingerprint(key, source, String(raw)));
+    }
+    return rows;
+}
+function fingerprint(key, source, value) {
+    return {
+        key,
+        source,
+        present: Boolean(value),
+        redacted_preview: redactPreview(value),
+        value_sha256: value ? sha256(value) : null
+    };
+}
+function readAssignment(text, key) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`^\\s*(?:export\\s+)?${escaped.replace(/\\\./g, '\\s*\\.\\s*')}\\s*=\\s*(.+?)\\s*$`, 'm');
+    const raw = String(text || '').match(re)?.[1]?.trim() || '';
+    return unquote(raw);
+}
+function unquote(value) {
+    const trimmed = String(value || '').trim().replace(/\s+#.*$/, '');
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'")))
+        return trimmed.slice(1, -1);
+    return trimmed;
+}
+function redactPreview(value) {
+    const text = String(value || '');
+    if (!text)
+        return '';
+    const head = text.slice(0, Math.min(3, text.length));
+    const tail = text.length > 6 ? text.slice(-3) : '';
+    return `${head}...${tail || 'redacted'}(${text.length})`;
+}
+function flattenObject(value, prefix = '') {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+        const nextKey = prefix ? `${prefix}.${key}` : key;
+        if (child && typeof child === 'object' && !Array.isArray(child))
+            Object.assign(out, flattenObject(child, nextKey));
+        else if (child != null)
+            out[nextKey] = String(child);
+    }
+    return out;
+}
+function dedupeFingerprints(fingerprints) {
+    const byKey = new Map();
+    for (const fp of fingerprints)
+        byKey.set(`${fp.source}\0${fp.key}`, fp);
+    return [...byKey.values()].sort((a, b) => a.source.localeCompare(b.source) || a.key.localeCompare(b.key));
+}
+//# sourceMappingURL=secret-preservation.js.map

package/dist/core/config/supabase-secret-preservation.js

@@ -0,0 +1,29 @@
+export const PROTECTED_SUPABASE_ENV_KEYS = [
+    'SUPABASE_URL',
+    'SUPABASE_ANON_KEY',
+    'SUPABASE_SERVICE_ROLE_KEY',
+    'NEXT_PUBLIC_SUPABASE_URL',
+    'NEXT_PUBLIC_SUPABASE_ANON_KEY',
+    'VITE_SUPABASE_URL',
+    'VITE_SUPABASE_ANON_KEY',
+    'PUBLIC_SUPABASE_URL',
+    'PUBLIC_SUPABASE_ANON_KEY'
+];
+export const PROTECTED_SUPABASE_CONFIG_PATHS = [
+    'supabase.url',
+    'supabase.anon_key',
+    'supabase.service_role_key',
+    'mcp.supabase.url',
+    'mcp.supabase.token',
+    'mcp.supabase.access_token',
+    'mcp.supabase.service_role_key'
+];
+export const PROTECTED_SECRET_KEYS = [
+    ...PROTECTED_SUPABASE_ENV_KEYS,
+    ...PROTECTED_SUPABASE_CONFIG_PATHS
+];
+export function isProtectedSecretKey(key) {
+    const normalized = String(key || '').trim();
+    return PROTECTED_SECRET_KEYS.some((candidate) => candidate === normalized);
+}
+//# sourceMappingURL=supabase-secret-preservation.js.map

package/dist/core/decision-contract.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { readJson, writeJsonAtomic, nowIso, sha256 } from './fsx.js';
 import { validateQaLoopAnswers } from './qa-loop.js';
-import { inferAnswersForPrompt } from './questions.js';
+import { buildRequestIntake, inferAnswersForPrompt, REQUEST_INTAKE_ARTIFACT } from './questions.js';
 import { bindMistakeRecallToAnswers, buildMistakeRecallLedger, mistakeRecallContractSummary, writeMistakeRecallArtifacts } from './mistake-recall.js';
 function isEmptyAnswer(v, slot = {}) {
     if (v === undefined || v === null)
@@ -41,7 +41,7 @@ export function validateAnswers(schema, answers) {
     errors.push(...validateQaLoopAnswers(schema, answers));
     return { ok: errors.length === 0, errors, resolved, totalRequired: schema.slots.filter((s) => s.required).length };
 }
-export function buildDecisionContract({ mission, schema, answers, mistakeRecall = null }) {
+export function buildDecisionContract({ mission, schema, answers, mistakeRecall = null, requestIntake = null }) {
     const madSks = answers.MAD_SKS_MODE === 'explicit_invocation_only';
     const defaults = {
         if_multiple_valid_implementations: 'choose_smallest_reversible_change',
@@ -115,6 +115,14 @@ export function buildDecisionContract({ mission, schema, answers, mistakeRecall
         acceptance_criteria: Array.isArray(answers.ACCEPTANCE_CRITERIA) ? answers.ACCEPTANCE_CRITERIA : String(answers.ACCEPTANCE_CRITERIA || '').split('\n').map((x) => x.trim()).filter(Boolean),
         non_goals: Array.isArray(answers.NON_GOALS) ? answers.NON_GOALS : String(answers.NON_GOALS || '').split('\n').map((x) => x.trim()).filter(Boolean),
         test_scope: answers.TEST_SCOPE,
+        request_intake: requestIntake ? {
+            artifact: REQUEST_INTAKE_ARTIFACT,
+            prompt_hash: requestIntake.prompt_hash || null,
+            interpreted_intent: requestIntake.interpreted_intent || null,
+            requirements: requestIntake.requirements || [],
+            transformed_prompt: requestIntake.transformed_prompt || null,
+            wiki_context_used: requestIntake.wiki_context_used || null
+        } : null,
         triwiki_mistake_recall: mistakeRecallContractSummary(mistakeRecall),
         approved_defaults: defaults,
         decision_ladder: [
@@ -135,6 +143,7 @@ export function buildDecisionContract({ mission, schema, answers, mistakeRecall
     return contract;
 }
 export async function sealContract(missionDir, mission) {
+    const root = rootFromMissionDir(missionDir);
     const schema = await readJson(path.join(missionDir, 'required-answers.schema.json'), {});
     const explicitAnswers = await readJson(path.join(missionDir, 'answers.json'), {});
     const inferred = inferAnswersForPrompt(mission?.prompt || schema?.prompt || '', explicitAnswers);
@@ -143,7 +152,7 @@ export async function sealContract(missionDir, mission) {
         ...inferred.answers,
         ...explicitAnswers
     };
-    const root = rootFromMissionDir(missionDir);
+    const requestIntake = await readOrBuildRequestIntake(missionDir, root, mission?.prompt || schema?.prompt || '', baseAnswers);
     const mistakeRecall = await buildMistakeRecallLedger(root, {
         prompt: mission?.prompt || schema?.prompt || '',
         answers: baseAnswers
@@ -152,7 +161,7 @@ export async function sealContract(missionDir, mission) {
     const validation = validateAnswers(schema, answers);
     if (!validation.ok)
         return { ok: false, validation };
-    const contract = buildDecisionContract({ mission, schema, answers, mistakeRecall });
+    const contract = buildDecisionContract({ mission, schema, answers, mistakeRecall, requestIntake });
     const mistakeRecallConsumption = await writeMistakeRecallArtifacts(missionDir, mistakeRecall, contract);
     await writeJsonAtomic(path.join(missionDir, 'resolved-answers.json'), {
         explicit_answers: explicitAnswers,
@@ -163,12 +172,27 @@ export async function sealContract(missionDir, mission) {
             artifact: 'mistake-recall-ledger.json',
             consumed: mistakeRecallConsumption.ok,
             required: mistakeRecall.required
+        },
+        request_intake: {
+            artifact: REQUEST_INTAKE_ARTIFACT,
+            prompt_hash: requestIntake?.prompt_hash || null,
+            transformed_prompt_available: Boolean(requestIntake?.transformed_prompt)
         }
     });
     await writeJsonAtomic(path.join(missionDir, 'decision-contract.json'), contract);
     await writeJsonAtomic(path.join(missionDir, 'answer-validation.json'), validation);
     return { ok: true, validation, contract };
 }
+async function readOrBuildRequestIntake(missionDir, root, prompt, answers = {}) {
+    const file = path.join(missionDir, REQUEST_INTAKE_ARTIFACT);
+    const existing = await readJson(file, null);
+    if (existing)
+        return existing;
+    const wikiContext = await readJson(path.join(root, '.sneakoscope', 'wiki', 'context-pack.json'), null);
+    const intake = buildRequestIntake(prompt, answers, { wikiContext });
+    await writeJsonAtomic(file, intake);
+    return intake;
+}
 function rootFromMissionDir(missionDir) {
     const resolved = path.resolve(missionDir);
     const parts = resolved.split(path.sep);

package/dist/core/doctor/command-alias-cleanup.js

@@ -0,0 +1,64 @@
+import path from 'node:path';
+import { COMMAND_CATALOG } from '../routes.js';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { COMMANDS, LEGACY_COMMAND_ALIASES, commandNames } from '../../cli/command-registry.js';
+export const COMMAND_ALIAS_CLEANUP_SCHEMA = 'sks.command-alias-cleanup.v1';
+export async function runDoctorCommandAliasCleanup(opts) {
+    const report = commandAliasCleanupReport(opts);
+    if (opts.fix)
+        await writeJsonAtomic(report.report_path, report);
+    return report;
+}
+export function commandAliasCleanupReport(opts) {
+    const root = opts.root;
+    const legacyAliases = Object.entries(LEGACY_COMMAND_ALIASES).map(([alias, canonical]) => ({
+        alias,
+        canonical
+    }));
+    const registeredAliasCommands = legacyAliases
+        .filter((entry) => Object.prototype.hasOwnProperty.call(COMMANDS, entry.alias))
+        .map((entry) => entry.alias);
+    const catalogAliasRows = legacyAliases
+        .filter((entry) => COMMAND_CATALOG.some((row) => row.name === entry.alias))
+        .map((entry) => entry.alias);
+    const canonical = commandNames();
+    const missingCanonicalTargets = legacyAliases
+        .filter((entry) => !canonical.includes(entry.canonical))
+        .map((entry) => `${entry.alias}->${entry.canonical}`);
+    const blockers = [
+        ...registeredAliasCommands.map((alias) => `legacy_alias_registered_as_command:${alias}`),
+        ...catalogAliasRows.map((alias) => `legacy_alias_visible_in_command_catalog:${alias}`),
+        ...missingCanonicalTargets.map((entry) => `legacy_alias_missing_target:${entry}`)
+    ];
+    const ok = blockers.length === 0;
+    return {
+        schema: COMMAND_ALIAS_CLEANUP_SCHEMA,
+        ok,
+        status: ok ? 'clean' : 'blocked',
+        generated_at: nowIso(),
+        root,
+        fix: Boolean(opts.fix),
+        report_path: path.join(root, '.sneakoscope', 'reports', 'command-alias-cleanup.json'),
+        canonical_command_count: canonical.length,
+        legacy_alias_count: legacyAliases.length,
+        aliases: legacyAliases,
+        detected: {
+            registered_alias_commands: registeredAliasCommands,
+            catalog_alias_rows: catalogAliasRows,
+            missing_canonical_targets: missingCanonicalTargets
+        },
+        actions: ok
+            ? [{
+                    action: opts.fix ? 'doctor_fix_verified_aliases_consolidated' : 'verify_aliases_consolidated',
+                    ok: true,
+                    detail: 'Legacy command names dispatch through COMMAND_ALIASES and are not registered as duplicate command rows.'
+                }]
+            : [{
+                    action: 'source_registry_cleanup_required',
+                    ok: false,
+                    detail: 'Remove duplicate alias rows from COMMANDS and COMMAND_CATALOG, then map them through LEGACY_COMMAND_ALIASES.'
+                }],
+        blockers
+    };
+}
+//# sourceMappingURL=command-alias-cleanup.js.map

package/dist/core/doctor/doctor-native-capability-repair.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
+import { dedupeProjectSkills } from '../codex-native/project-skill-dedupe.js';
+import { repairNativeCapabilities } from '../codex-native/native-capability-repair.js';
+import { withSecretPreservationGuard } from '../config/config-migration-journal.js';
+export async function runDoctorNativeCapabilityRepair(input) {
+    const root = path.resolve(input.root);
+    const operation = async () => {
+        const coreSkills = await syncCoreSkillsIntegrity({ root, apply: input.fix });
+        const skillDedupe = await dedupeProjectSkills({
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            quarantineUserDuplicates: (input.flags || []).includes('--quarantine-user-duplicate-skills')
+        });
+        const nativeCapabilities = await repairNativeCapabilities({
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            allowManualInstructions: true
+        });
+        const blockers = [
+            ...(coreSkills.blockers || []),
+            ...(skillDedupe.blockers || []),
+            ...(nativeCapabilities.blockers || [])
+        ];
+        const report = {
+            schema: 'sks.doctor-native-capability-repair.v1',
+            generated_at: nowIso(),
+            ok: blockers.length === 0,
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            core_skills: coreSkills,
+            skill_dedupe: skillDedupe,
+            native_capabilities: nativeCapabilities,
+            secret_preservation_guard: '.sneakoscope/reports/secret-preservation-guard.json',
+            blockers
+        };
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'doctor-native-capability-repair.json'), report).catch(() => undefined);
+        return report;
+    };
+    if (!input.fix)
+        return operation();
+    return withSecretPreservationGuard(root, 'doctor-native-capability-repair', operation);
+}
+//# sourceMappingURL=doctor-native-capability-repair.js.map

package/dist/core/feature-fixtures.js

@@ -39,6 +39,7 @@ const FIXTURES = Object.freeze({
     'cli-qa-loop': fixture('mock', 'sks qa-loop status latest --json', ['qa-loop-proof.json', 'completion-proof.json'], 'pass'),
     'cli-ppt': fixture('mock', 'sks ppt fixture --mock --json', ['ppt-imagegen-review-gate.json', 'completion-proof.json'], 'pass'),
     'cli-image-ux-review': fixture('mock', 'sks image-ux-review status latest --json', ['image-ux-generated-review-ledger.json', 'image-voxel-ledger.json'], 'pass'),
+    'cli-computer-use': fixture('real_optional', 'sks computer-use status --json', [], 'pass'),
     'cli-pipeline': fixture('mock', 'sks pipeline status latest --json', ['pipeline-plan.json'], 'pass'),
     'cli-validate-artifacts': fixture('mock', 'sks validate-artifacts latest --json', ['validation-report.json'], 'pass'),
     'cli-hproof': fixture('mock', 'sks hproof check latest', ['completion-proof.json'], 'pass'),
@@ -68,6 +69,7 @@ const FIXTURES = Object.freeze({
     'cli-zellij': fixture('mock', 'npm run zellij:capability --silent', [], 'pass'),
     'cli-tmux': fixture('mock', 'removed runtime migration notice: sks tmux --json', [], 'pass'),
     'cli-mad': fixture('mock', 'sks mad --help', [], 'pass'),
+    'cli-mad-sks': fixture('static', 'sks mad-sks status --json', [], 'pass'),
     'cli-auto-review': fixture('mock', 'sks auto-review status --json', [], 'pass'),
     'cli-commit': fixture('mock', 'sks commit --dry-run', [], 'pass'),
     'cli-commit-and-push': fixture('mock', 'sks commit-and-push --dry-run', [], 'pass'),

package/dist/core/feature-registry.js

@@ -813,7 +813,7 @@ function commandCategory(name) {
         return 'proof-route';
     if (['qa-loop', 'research', 'recallpulse', 'skill-dream', 'eval', 'perf'].includes(name))
         return 'loop';
-    if (['codex', 'codex-app', 'codex-native', 'codex-lb', 'auth', 'hooks', 'context7'].includes(name))
+    if (['codex', 'codex-app', 'codex-native', 'codex-lb', 'hooks', 'context7', 'computer-use'].includes(name))
         return 'integration';
     if (['db', 'guard', 'conflicts', 'harness', 'versioning'].includes(name))
         return 'safety';
@@ -826,7 +826,7 @@ function commandCategory(name) {
 function commandMaturity(name) {
     if (['help', 'version', 'commands', 'usage', 'root', 'quickstart', 'setup', 'doctor', 'selftest', 'update-check', 'fast-mode'].includes(name))
         return 'stable';
-    if (['codex', 'codex-app', 'codex-lb', 'hooks', 'features', 'all-features', 'wiki', 'wrongness', 'team', 'pipeline', 'goal', 'db', 'guard'].includes(name))
+    if (['codex', 'codex-app', 'codex-native', 'codex-lb', 'hooks', 'features', 'all-features', 'wiki', 'wrongness', 'team', 'pipeline', 'goal', 'db', 'guard', 'computer-use', 'mad-sks'].includes(name))
         return 'beta';
     return 'labs';
 }

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.7';
+export const PACKAGE_VERSION = '3.1.9';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/init.js

@@ -11,6 +11,7 @@ import { AWESOME_DESIGN_MD_REFERENCE, CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_
 import { SKILL_DREAM_POLICY, skillDreamPolicyText } from './skill-forge.js';
 import { CODEX_HOOK_EVENT_STATE_KEYS } from './codex-compat/codex-hook-events.js';
 import { codexCommandHookCurrentHash } from './codex-hooks/codex-hook-hash.js';
+import { buildSksCoreSkillManifest, isCoreSkillName, renderCoreSkillTemplate } from './codex-native/core-skill-manifest.js';
 const REFLECTION_MEMORY_PATH = '.sneakoscope/memory/q2_facts/post-route-reflection.md';
 const SKS_GENERATED_GIT_PATTERNS = [
     '.sneakoscope/missions/',
@@ -1083,9 +1084,12 @@ export async function installSkills(root) {
         'design-ui-editor': `---\nname: design-ui-editor\ndescription: Legacy fallback UI/UX editor for existing design.md systems when Product Design plugin is unavailable.\n---\n\nUse Product Design plugin first. When falling back, read \`design.md\`, inspect relevant UI/assets/tests, consult getdesign-reference when improving the design system, apply the smallest design-system-conformant change, use imagegen for image/logo/raster assets, and verify render quality. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY} If design.md is missing and Product Design is unavailable, use design-system-builder as fallback.\n`,
         'design-artifact-expert': `---\nname: design-artifact-expert\ndescription: Legacy fallback for high-fidelity HTML/UI/prototype artifacts when Product Design plugin cannot be used.\n---\n\nUse Product Design plugin first for design/UI/prototype work. When falling back, read design.md when present, consult getdesign-reference for design-system grounding, build the usable artifact first, preserve state, verify overlap/readability/responsiveness, and use imagegen for required assets. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY}\n`
     };
+    for (const skill of buildSksCoreSkillManifest().skills) {
+        skills[skill.canonical_name] = renderCoreSkillTemplate(skill.canonical_name);
+    }
     for (const [name, content] of Object.entries(skills)) {
         const dir = path.join(root, '.agents', 'skills', name);
-        const skillContent = enrichSkillContent(name, content);
+        const skillContent = isCoreSkillName(name) ? content : enrichSkillContent(name, content);
         await ensureDir(dir);
         await writeTextAtomic(path.join(dir, 'SKILL.md'), `${skillContent.trim()}\n`);
         await writeSkillMetadata(dir, name);

package/dist/core/naruto/naruto-work-graph.js

@@ -29,7 +29,10 @@ export function buildNarutoWorkGraph(input = {}) {
     const readonly = input.readonly === true;
     const writeCapable = input.writeCapable !== false && !readonly;
     const minimumFanout = writeCapable ? requestedClones * 2 : requestedClones;
-    const totalWorkItems = Math.max(minimumFanout, normalizePositiveInt(input.totalWorkItems, minimumFanout));
+    const requestedWorkItems = normalizePositiveInt(input.totalWorkItems, minimumFanout);
+    const totalWorkItems = input.honorExplicitTotalWorkItems === true
+        ? Math.max(requestedClones, requestedWorkItems)
+        : Math.max(minimumFanout, requestedWorkItems);
     const kindCycle = writeCapable ? WRITE_CAPABLE_KIND_CYCLE : READONLY_KIND_CYCLE;
     const basePath = normalizeNarutoPath(input.leaseBasePath || '.sneakoscope/naruto/patch-envelopes');
     const targetPaths = normalizePaths(input.targetPaths || []);