sneakoscope 3.1.9 → 3.1.10

package/README.md

@@ -35,14 +35,15 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.9** hardens update/setup/doctor safety around four operator-facing failure modes: immutable core skills, duplicate project skills, real native capability repair status, and Supabase/secret preservation.
+SKS **3.1.10** is a release-ready hardening pass for release wiring parity, immutable core skills, duplicate skill prevention, native capability postchecks, and protected secret rollback.
 
-What changed in 3.1.8:
+What changed in 3.1.10:
 
 - **Core SKS skills are content-addressed and immutable.** The eight built-in route skills now have a manifest and no-drift gates; setup/update/doctor may install missing managed copies or restore corrupted managed copies, but they do not overwrite user-authored collisions.
-- **Duplicate skills are detected and repaired safely.** Canonical skill names collapse variants such as `Loop`, `loop`, and `loop/SKILL.md`; SKS-managed duplicates can be quarantined automatically, while user-authored duplicates require explicit confirmation.
-- **`sks doctor --fix` reports native capability truthfully.** Image generation, image follow-up edit paths, Computer Use, Chrome/web review, app screenshots, app handoff, and image path exposure now run through a repair matrix and postcheck instead of capability assumptions.
-- **Supabase keys survive setup/update/doctor.** Protected secret surfaces are fingerprinted before and after guarded operations; reports store only redacted previews and hashes, never raw values.
+- **Release wiring is self-checking.** `release:gate-script-parity`, `release:wiring-3110-blackbox`, and `sks:3110-all-feature-regression` prove required ids, package scripts, release gates, source scripts, and built dist targets stay aligned.
+- **Duplicate skills are detected and repaired safely.** Canonical skill names collapse variants such as `Loop`, `loop`, and `loop/SKILL.md`; SKS-managed duplicates can be quarantined automatically, while user-authored duplicates require explicit confirmation and produce active-name proof.
+- **`sks doctor --fix` reports native capability truthfully.** Image generation, image follow-up edit paths, Computer Use, Chrome/web review, app screenshots, app handoff, and image path exposure now run capability-specific postchecks; manual-only and fallback surfaces do not become `verified`.
+- **Supabase keys survive setup/update/doctor.** Protected secret surfaces are fingerprinted before and after guarded operations; missing or changed values are restored from backup or hard-fail without writing raw values to reports.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.9"
+version = "3.1.10"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.9"
+version = "3.1.10"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.9"),
+        Some("--version") => println!("sks-rs 3.1.10"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.1.9",
-  "source_digest": "dbfd5ddb700abfc4a008256b36e1743363164fd504bba959542ce79c25916dad",
-  "source_file_count": 2605,
-  "built_at_source_time": 1781537952236
+  "package_version": "3.1.10",
+  "source_digest": "57a7f5ee1f3ac797f46e3dfd59365b1e147e4637a8ddd18fde2cbee802fec0ac",
+  "source_file_count": 2609,
+  "built_at_source_time": 1781550268084
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.9';
+const FAST_PACKAGE_VERSION = '3.1.10';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -29,8 +29,15 @@ import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 import { runDoctorNativeCapabilityRepair } from '../core/doctor/doctor-native-capability-repair.js';
 import { runDoctorCommandAliasCleanup } from '../core/doctor/command-alias-cleanup.js';
+import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 export async function run(_command, args = []) {
+    const root = await projectRoot();
     const doctorFix = flag(args, '--fix');
+    if (doctorFix)
+        return withSecretPreservationGuard(root, 'doctor-fix', () => runDoctor(args, root, doctorFix));
+    return runDoctor(args, root, doctorFix);
+}
+async function runDoctor(args = [], root, doctorFix) {
     let setupRepair = null;
     const sksUpdate = doctorFix
         ? {
@@ -70,7 +77,6 @@ export async function run(_command, args = []) {
                 : await ensureGlobalCodexFastModeDuringInstall().catch((err) => ({ status: 'failed', error: err?.message || String(err) }))
         };
     }
-    const root = await projectRoot();
     const commandAliasCleanup = await runDoctorCommandAliasCleanup({
         root,
         fix: doctorFix
@@ -397,6 +403,12 @@ export async function run(_command, args = []) {
     console.log(`  app screenshot: ${nativeCapabilityStatus(nativeCapabilityRows, 'codex_app_screenshot', 'degraded')}`);
     console.log(`  app handoff: ${nativeCapabilityStatus(nativeCapabilityRows, 'app_handoff', 'unavailable')}`);
     console.log(`  image path exposure: ${nativeCapabilityStatus(nativeCapabilityRows, 'image_path_exposure', 'fallback')}`);
+    const nativeManualActions = uniqueNativeManualActions(nativeCapabilityRows);
+    if (nativeManualActions.length) {
+        console.log('  manual next actions:');
+        for (const action of nativeManualActions)
+            console.log(`    - ${action}`);
+    }
     console.log('SKS Skills:');
     console.log(`  core skills: ${doctorSkillStatus(doctorNativeCapabilityRepair?.core_skills)}`);
     console.log(`  duplicate project skills: ${doctorDedupeStatus(doctorNativeCapabilityRepair?.skill_dedupe)}`);
@@ -408,7 +420,7 @@ export async function run(_command, args = []) {
         console.log(`  report: ${commandAliasCleanup.report_path}`);
     console.log('Secret preservation:');
     console.log(`  Supabase keys: ${doctorNativeCapabilityRepair?.ok === false && String((doctorNativeCapabilityRepair?.blockers || []).join(' ')).includes('secret_preservation_failed') ? 'blocked' : 'preserved'}`);
-    console.log('  secret values: redacted');
+    console.log('  raw secret values: never recorded');
     console.log(`  migration journal: ${doctorNativeCapabilityRepair?.secret_preservation_guard || '.sneakoscope/reports/secret-preservation-guard.json'}`);
     console.log('Codex App Harness:');
     console.log(`  plugins: ${codexAppHarnessMatrix.app_features?.plugin_json ? 'ok' : 'degraded'}`);
@@ -540,6 +552,13 @@ function nativeCapabilityStatus(rows, id, fallback) {
         return fallback;
     if (row.after === 'verified' || row.before === 'verified')
         return 'verified';
+    if (id === 'image_path_exposure') {
+        if (row.before === 'degraded' || row.after === 'degraded' || row.repairability === 'doctor-fix')
+            return 'fallback';
+        return fallback;
+    }
+    if (id === 'app_handoff')
+        return 'unavailable';
     if (row.repairability === 'manual-required')
         return 'manual_required';
     if (row.before === 'degraded' || row.after === 'degraded')
@@ -550,6 +569,12 @@ function nativeCapabilityStatus(rows, id, fallback) {
         return 'unavailable';
     return fallback;
 }
+function uniqueNativeManualActions(rows) {
+    return [...new Set(rows
+            .filter((row) => row?.repairability === 'manual-required' && row?.after !== 'verified')
+            .flatMap((row) => Array.isArray(row.repair_actions) ? row.repair_actions : [])
+            .filter((action) => typeof action === 'string' && action.trim()))];
+}
 function doctorSkillStatus(coreSkills) {
     if (!coreSkills)
         return 'drift_detected';

package/dist/core/codex-app/codex-skill-sync.js

@@ -1,11 +1,12 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { ensureDir, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { buildSksCoreSkillManifest } from '../codex-native/core-skill-manifest.js';
 import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
 import { dedupeProjectSkills } from '../codex-native/project-skill-dedupe.js';
 const EXTERNAL_ROUTE_RESERVED = new Set(['ulw-loop', 'ulw-plan', 'start-work']);
+const SKILL_SYNC_LOCK_STALE_AFTER_MS = 30000;
 export async function syncCodexSksSkills(input) {
     const root = path.resolve(input.root);
     const skillsRoot = input.skillsRoot || path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'skills');
@@ -71,6 +72,8 @@ export async function withSkillSyncLock(root, fn) {
             const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
             if (code !== 'EEXIST')
                 throw err;
+            if (await recoverStaleSkillSyncLock(lockPath))
+                continue;
             if (Date.now() - started > 30000)
                 throw new Error(`Timed out waiting for skill sync lock: ${lockPath}`);
             await new Promise((resolve) => setTimeout(resolve, 25));
@@ -80,7 +83,8 @@ export async function withSkillSyncLock(root, fn) {
         await writeJsonAtomic(path.join(lockPath, 'owner.json'), {
             schema: 'sks.skill-sync-lock.v1',
             pid: process.pid,
-            acquired_at: nowIso()
+            acquired_at: nowIso(),
+            stale_after_ms: SKILL_SYNC_LOCK_STALE_AFTER_MS
         }).catch(() => undefined);
         return await fn();
     }
@@ -88,6 +92,37 @@ export async function withSkillSyncLock(root, fn) {
         await fs.rm(lockPath, { recursive: true, force: true }).catch(() => undefined);
     }
 }
+async function recoverStaleSkillSyncLock(lockPath) {
+    const ownerPath = path.join(lockPath, 'owner.json');
+    const stat = await fs.stat(lockPath).catch(() => null);
+    const owner = await readJson(ownerPath, null).catch(() => null);
+    const staleAfterMs = Number(owner?.stale_after_ms || SKILL_SYNC_LOCK_STALE_AFTER_MS);
+    const acquiredAt = owner?.acquired_at ? Date.parse(owner.acquired_at) : NaN;
+    const ageMs = Number.isFinite(acquiredAt) ? Date.now() - acquiredAt : stat ? Date.now() - stat.mtimeMs : 0;
+    if (owner?.schema === 'sks.skill-sync-lock.v1' && Number.isFinite(owner.pid)) {
+        if (ageMs <= staleAfterMs || pidAlive(Number(owner.pid)))
+            return false;
+        await fs.rm(lockPath, { recursive: true, force: true }).catch(() => undefined);
+        return true;
+    }
+    if (stat && Date.now() - stat.mtimeMs > staleAfterMs) {
+        await fs.rm(lockPath, { recursive: true, force: true }).catch(() => undefined);
+        return true;
+    }
+    return false;
+}
+function pidAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+        return code === 'EPERM';
+    }
+}
 async function listSkillNames(root) {
     const rows = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
     return rows.filter((row) => row.isDirectory()).map((row) => row.name).sort();

package/dist/core/codex-native/core-skill-integrity.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
-import { buildSksCoreSkillManifest, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
+import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
 import { canonicalSkillName } from './skill-name-canonicalizer.js';
 export async function syncCoreSkillsIntegrity(input) {
     const root = path.resolve(input.root);
@@ -69,7 +69,12 @@ export async function syncCoreSkillsIntegrity(input) {
         root,
         apply,
         skills_root: skillsRoot,
+        template_version: CORE_SKILL_TEMPLATE_VERSION,
         manifest_sha256: sha256(JSON.stringify(manifest.skills.map((skill) => [skill.canonical_name, skill.content_sha256]))),
+        drift_detected_count: rows.filter((row) => row.action === 'restore-corrupted-managed-copy' || row.action === 'skip-user-authored').length,
+        restored_count: restored.length,
+        installed_count: installed.length,
+        user_collision_count: skippedUserAuthored.length,
         rows,
         installed,
         restored,

package/dist/core/codex-native/core-skill-manifest.js

@@ -1,6 +1,6 @@
 import { PACKAGE_VERSION, nowIso, sha256 } from '../fsx.js';
 import { canonicalSkillName } from './skill-name-canonicalizer.js';
-export const CORE_SKILL_TEMPLATE_VERSION = '3.1.8-core-skill-template.v1';
+export const CORE_SKILL_TEMPLATE_VERSION = 'sks-core-skill-template.v1';
 export const CORE_SKILL_MANAGED_BEGIN = '<!-- BEGIN SKS IMMUTABLE CORE SKILL -->';
 export const CORE_SKILL_MANAGED_END = '<!-- END SKS IMMUTABLE CORE SKILL -->';
 const CORE_SKILL_DEFINITIONS = [

package/dist/core/codex-native/native-capability-postcheck.js

@@ -1,22 +1,13 @@
+import fs from 'node:fs/promises';
 import path from 'node:path';
-import { writeJsonAtomic } from '../fsx.js';
+import { ensureDir, readJson, writeJsonAtomic } from '../fsx.js';
 import { buildNativeCapabilityRepairMatrix } from './native-capability-repair-matrix.js';
 export async function postcheckNativeCapabilities(input) {
     const root = path.resolve(input.root);
-    const matrix = input.matrix || await buildNativeCapabilityRepairMatrix({ root, fixture: input.fixture || false, reportPath: null });
-    const capabilities = matrix.capabilities.map((state) => {
-        const verifiedAfterRepair = state.repairability === 'auto' || state.repairability === 'doctor-fix';
-        if (state.id === 'computer_use' && process.env.SKS_COMPUTER_USE_CAPABILITY !== 'verified') {
-            return { ...state, after: 'unknown', blockers: ['computer_use_os_permission_or_capability_unknown'] };
-        }
-        if (state.id === 'chrome_web_review' && process.env.SKS_CHROME_EXTENSION_READY !== '1' && input.fixture !== 'all-repairable') {
-            return { ...state, after: 'unknown', blockers: ['codex_chrome_extension_readiness_not_verified'] };
-        }
-        if (state.blockers.length === 0 || verifiedAfterRepair)
-            return { ...state, after: state.repairability === 'manual-required' ? 'unknown' : 'verified', blockers: state.repairability === 'manual-required' ? state.blockers : [] };
-        return { ...state, after: 'blocked' };
-    });
-    const blockers = capabilities.flatMap((state) => state.after === 'verified' ? [] : state.blockers);
+    const fixture = input.fixture || false;
+    const matrix = input.matrix || await buildNativeCapabilityRepairMatrix({ root, fixture, reportPath: null });
+    const capabilities = await Promise.all(matrix.capabilities.map((state) => postcheckCapability(root, state, fixture)));
+    const blockers = capabilities.flatMap((state) => state.after === 'verified' || state.after === 'degraded' ? [] : state.blockers);
     const checked = {
         ...matrix,
         generated_at: new Date().toISOString(),
@@ -32,4 +23,141 @@ export async function postcheckNativeCapabilities(input) {
         await writeJsonAtomic(reportPath, checked).catch(() => undefined);
     return checked;
 }
+async function postcheckCapability(root, state, fixture) {
+    if (state.id === 'image_generation')
+        return postcheckImageGeneration(state, fixture);
+    if (state.id === 'image_followup_edit')
+        return postcheckImageFollowupEdit(root, state);
+    if (state.id === 'computer_use')
+        return postcheckComputerUse(state, fixture);
+    if (state.id === 'chrome_web_review')
+        return postcheckChromeWebReview(state, fixture);
+    if (state.id === 'codex_app_screenshot')
+        return postcheckAppScreenshot(root, state);
+    if (state.id === 'app_handoff')
+        return postcheckAppHandoff(state, fixture);
+    if (state.id === 'image_path_exposure')
+        return postcheckImagePathExposure(root, state, fixture);
+    if (state.id === 'saved_artifact_path_contract')
+        return postcheckSavedArtifactPathContract(root, state);
+    return { ...state, after: 'blocked', blockers: [...state.blockers, `unknown_capability:${state.id}`] };
+}
+function postcheckImageGeneration(state, fixture) {
+    if (fixture === 'all-repairable' || state.before === 'verified')
+        return verified(state);
+    return {
+        ...state,
+        after: 'unknown',
+        blockers: ['imagegen_auth_or_codex_app_builtin_missing'],
+        warnings: [...new Set([...state.warnings, 'image_generation_not_verified_without_real_capability'])]
+    };
+}
+async function postcheckImageFollowupEdit(root, state) {
+    const contract = await validateSavedArtifactPathContract(root);
+    if (!contract.ok)
+        return { ...state, after: 'blocked', blockers: contract.blockers };
+    const sample = path.join(contract.imageArtifacts, 'postcheck-followup-sample.txt');
+    if (!(await writeReadSample(sample)))
+        return { ...state, after: 'blocked', blockers: ['image_followup_sample_artifact_unwritable'] };
+    return verified(state);
+}
+function postcheckComputerUse(state, _fixture) {
+    if (process.env.SKS_COMPUTER_USE_CAPABILITY === 'verified')
+        return verified(state);
+    return {
+        ...state,
+        after: 'unknown',
+        blockers: ['computer_use_os_permission_or_capability_unknown'],
+        warnings: [...new Set([...state.warnings, 'manual_os_permission_required'])]
+    };
+}
+function postcheckChromeWebReview(state, fixture) {
+    if (fixture === 'all-repairable' || process.env.SKS_CHROME_EXTENSION_READY === '1')
+        return verified(state);
+    return {
+        ...state,
+        after: 'unknown',
+        blockers: ['codex_chrome_extension_readiness_not_verified'],
+        warnings: [...new Set([...state.warnings, 'manual_chrome_extension_setup_required'])]
+    };
+}
+async function postcheckAppScreenshot(root, state) {
+    const dir = path.join(root, '.sneakoscope', 'app-screenshots');
+    const registry = path.join(dir, 'screenshot-registry.json');
+    if (!(await writeReadSample(path.join(dir, 'postcheck-screenshot-sample.txt')))) {
+        return { ...state, after: 'blocked', blockers: ['app_screenshot_directory_unwritable'] };
+    }
+    await writeJsonAtomic(registry, { schema: 'sks.app-screenshot-registry.v1', generated_at: new Date().toISOString(), screenshots: [] }).catch(() => undefined);
+    const json = await readJson(registry, {}).catch(() => ({}));
+    if (json.schema !== 'sks.app-screenshot-registry.v1')
+        return { ...state, after: 'blocked', blockers: ['app_screenshot_registry_invalid'] };
+    return verified(state);
+}
+function postcheckAppHandoff(state, fixture) {
+    if (fixture === 'all-repairable' || state.before === 'verified')
+        return verified(state);
+    return {
+        ...state,
+        after: 'unknown',
+        blockers: ['codex_app_handoff_not_verified'],
+        warnings: [...new Set([...state.warnings, 'manual_app_handoff_approval_required'])]
+    };
+}
+async function postcheckImagePathExposure(root, state, fixture) {
+    if (fixture === 'all-repairable' || state.before === 'verified')
+        return verified(state);
+    const contract = await validateSavedArtifactPathContract(root);
+    if (contract.ok) {
+        return {
+            ...state,
+            after: 'degraded',
+            blockers: [],
+            warnings: [...new Set([...state.warnings, 'using_saved_artifact_path_contract_fallback'])]
+        };
+    }
+    return { ...state, after: 'blocked', blockers: ['image_path_exposure_missing_without_fallback_contract', ...contract.blockers] };
+}
+async function postcheckSavedArtifactPathContract(root, state) {
+    const contract = await validateSavedArtifactPathContract(root);
+    if (!contract.ok)
+        return { ...state, after: 'blocked', blockers: contract.blockers };
+    if (!(await writeReadSample(path.join(contract.imageArtifacts, 'postcheck-contract-image.txt'))))
+        return { ...state, after: 'blocked', blockers: ['image_artifacts_directory_unwritable'] };
+    if (!(await writeReadSample(path.join(contract.appScreenshots, 'postcheck-contract-screenshot.txt'))))
+        return { ...state, after: 'blocked', blockers: ['app_screenshots_directory_unwritable'] };
+    return verified(state);
+}
+function verified(state) {
+    return { ...state, after: 'verified', blockers: [] };
+}
+async function validateSavedArtifactPathContract(root) {
+    const contractPath = path.join(root, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json');
+    const contract = await readJson(contractPath, null).catch(() => null);
+    const imageArtifacts = String(contract?.image_artifacts || path.join(root, '.sneakoscope', 'image-artifacts'));
+    const appScreenshots = String(contract?.app_screenshots || path.join(root, '.sneakoscope', 'app-screenshots'));
+    const blockers = [];
+    if (contract?.schema !== 'sks.saved-artifact-path-contract.v1')
+        blockers.push('saved_artifact_path_contract_schema_invalid');
+    for (const dir of [imageArtifacts, appScreenshots]) {
+        try {
+            await ensureDir(dir);
+            await fs.access(dir);
+        }
+        catch {
+            blockers.push(`directory_unwritable:${path.basename(dir)}`);
+        }
+    }
+    return { ok: blockers.length === 0, imageArtifacts, appScreenshots, blockers };
+}
+async function writeReadSample(file) {
+    try {
+        await ensureDir(path.dirname(file));
+        await fs.writeFile(file, 'sks-native-capability-postcheck\n', 'utf8');
+        const text = await fs.readFile(file, 'utf8');
+        return text === 'sks-native-capability-postcheck\n';
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=native-capability-postcheck.js.map

package/dist/core/codex-native/native-capability-repair-matrix.js

@@ -109,7 +109,7 @@ async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix
             warnings: envVerified ? [] : ['manual_os_permission_required']
         };
     }
-    const chromeReady = process.env.SKS_CHROME_EXTENSION_READY === '1' || featureOk(nativeFeatureMatrix, 'plugin_json');
+    const chromeReady = process.env.SKS_CHROME_EXTENSION_READY === '1';
     return {
         id,
         before: chromeReady ? 'verified' : 'unknown',

package/dist/core/codex-native/project-skill-dedupe.js

@@ -17,8 +17,16 @@ export async function dedupeProjectSkills(input) {
         const userEntries = group.filter((entry) => !entry.managed_by_sks);
         const managedEntries = group.filter((entry) => entry.managed_by_sks);
         if (userEntries.length > 0 && managedEntries.length > 0) {
-            for (const user of userEntries)
-                actions.push(actionRow(canonical, 'kept', user, null, 'user-authored skill preserved'));
+            const keepUser = userEntries[0];
+            if (keepUser)
+                actions.push(actionRow(canonical, 'kept', keepUser, null, 'user-authored skill preserved'));
+            const shouldMoveUserDuplicates = fix && yes && input.quarantineUserDuplicates === true;
+            for (const duplicateUser of userEntries.slice(1)) {
+                const quarantine = shouldMoveUserDuplicates ? await quarantineSkill(root, canonical, duplicateUser, 'user-authored duplicate skill') : null;
+                actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', duplicateUser, quarantine, 'user-authored duplicate skill requires --quarantine-user-duplicates --yes'));
+            }
+            if (userEntries.length > 1 && !shouldMoveUserDuplicates)
+                unresolvedUserDuplicates.push(canonical);
             for (const managed of managedEntries) {
                 const quarantine = await maybeQuarantine(root, canonical, managed, fix, 'managed collision with user-authored skill');
                 actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', managed, quarantine, 'managed collision with user-authored skill'));
@@ -49,7 +57,11 @@ export async function dedupeProjectSkills(input) {
         }
     }
     const duplicateNames = [...new Set(actions.filter((action) => action.action !== 'kept').map((action) => action.canonical_name))].sort();
-    const blockers = unresolvedUserDuplicates.map((name) => `user_duplicate_requires_confirmation:${name}`);
+    const afterLedger = await buildSkillRegistryLedger({ root, reportPath: null });
+    const blockers = [
+        ...unresolvedUserDuplicates.map((name) => `user_duplicate_requires_confirmation:${name}`),
+        ...afterLedger.duplicate_active_canonical_names.map((name) => `duplicate_active_skill_name:${name}`)
+    ];
     const report = {
         schema: 'sks.project-skill-dedupe.v1',
         generated_at: nowIso(),
@@ -58,6 +70,9 @@ export async function dedupeProjectSkills(input) {
         fix,
         yes,
         actions,
+        active_unique_by_canonical_name: afterLedger.active_unique_by_canonical_name,
+        active_entries: afterLedger.active_entries,
+        duplicate_active_canonical_names: afterLedger.duplicate_active_canonical_names,
         duplicate_canonical_names: duplicateNames,
         unresolved_user_duplicates: unresolvedUserDuplicates,
         blockers

package/dist/core/codex-native/skill-registry-ledger.js

@@ -56,13 +56,20 @@ export async function buildSkillRegistryLedger(input) {
                 entry.status = entry.status === 'user-owned' ? 'duplicate' : 'duplicate';
         });
     }
-    const blockers = duplicates.map((name) => `duplicate_skill_name:${name}`);
+    const activeEntries = entries.filter((entry) => entry.status !== 'quarantined');
+    const activeGrouped = groupByCanonical(activeEntries);
+    const duplicateActiveNames = [...activeGrouped.entries()].filter(([, group]) => group.length > 1).map(([name]) => name).sort();
+    const activeUnique = duplicateActiveNames.length === 0;
+    const blockers = duplicateActiveNames.map((name) => `duplicate_active_skill_name:${name}`);
     const ledger = {
         schema: 'sks.skill-registry-ledger.v1',
         generated_at: nowIso(),
-        ok: blockers.length === 0,
+        ok: activeUnique,
         root,
         entries,
+        active_unique_by_canonical_name: activeUnique,
+        active_entries: activeEntries,
+        duplicate_active_canonical_names: duplicateActiveNames,
         duplicate_canonical_names: duplicates,
         blockers
     };

package/dist/core/commands/basic-cli.js

@@ -185,7 +185,9 @@ export async function initCommand(args = []) {
 export async function fixPathCommand(args = []) {
     const root = await projectRoot();
     const installScope = installScopeFromArgs(args);
-    await initProject(root, { installScope, localOnly: flag(args, '--local-only'), globalCommand: 'sks', force: true });
+    await withSecretPreservationGuard(root, 'fix-path-command', async () => {
+        await initProject(root, { installScope, localOnly: flag(args, '--local-only'), globalCommand: 'sks', force: true });
+    });
     const result = {
         schema: 'sks.fix-path.v1',
         ok: true,

package/dist/core/commands/research-command.js

@@ -180,7 +180,7 @@ async function researchRun(args) {
     await runResearchCycle(dir, researchWorkGraph, { cycle: 0, status: mock ? 'mock_native_orchestrator_planned' : 'native_orchestrator_planned' });
     await setCurrent(root, { mission_id: id, mode: 'RESEARCH', phase: 'RESEARCH_RUNNING_NO_QUESTIONS', questions_allowed: false, implementation_allowed: false, research_real_run_required: !mock, research_cycle_timeout_minutes: cycleTimeoutMinutes });
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.run.started', maxCycles, mock, cycleTimeoutMinutes, real_run_required: !mock });
-    const nativeAgentRun = await runNativeAgentOrchestrator({ root, missionId: id, route: flag(args, '--autoresearch') ? '$AutoResearch' : '$Research', prompt: mission.prompt || plan.prompt || 'Research run', backend: mock ? 'fake' : 'codex-sdk', mock, agents: requestedAgents, targetActiveSlots, desiredWorkItemCount: effectiveDesiredWorkItemCount, minimumWorkItems: effectiveMinimumWorkItems, maxQueueExpansion, concurrency: Math.min(requestedAgents, 5), readonly: true, profile, writeMode: writeMode, applyPatches: false, dryRunPatches, maxWriteAgents, roster: plan.native_agent_plan, routeCommand: 'sks research run', routeBlackboxKind: 'actual_research_command', narutoWorkGraph: nativeResearchWorkGraph });
+    const nativeAgentRun = await runNativeAgentOrchestrator({ root, missionId: id, route: flag(args, '--autoresearch') ? '$AutoResearch' : '$Research', prompt: mission.prompt || plan.prompt || 'Research run', backend: mock ? 'fake' : 'codex-sdk', mock, agents: requestedAgents, targetActiveSlots, desiredWorkItemCount: effectiveDesiredWorkItemCount, minimumWorkItems: effectiveMinimumWorkItems, maxQueueExpansion, concurrency: Math.min(requestedAgents, 5), readonly: true, profile, writeMode: writeMode, applyPatches: false, dryRunPatches, maxWriteAgents, roster: plan.native_agent_plan, routeCommand: 'sks research run', routeBlackboxKind: 'actual_research_command', narutoWorkGraph: researchWorkGraph });
     await writeJsonAtomic(path.join(dir, 'research-native-agent-run.json'), nativeAgentRun);
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.native_agents.completed', backend: nativeAgentRun.backend, ok: nativeAgentRun.ok, proof: nativeAgentRun.proof?.status });
     if (!nativeAgentRun.ok) {

package/dist/core/config/managed-config-merge.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { ensureDir, nowIso, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { isProtectedSecretKey, PROTECTED_SECRET_KEYS } from './supabase-secret-preservation.js';
 export async function writeManagedJsonConfig(file, current, managed) {
     const next = safeMergeObject(current, managed);
@@ -23,13 +23,14 @@ export async function writeManagedEnvConfig(file, currentText, managedLines) {
     const next = additions.length ? `${String(currentText || '').replace(/\s*$/, '\n')}${additions.join('\n')}\n` : String(currentText || '');
     return writeMergedText(file, currentText, next, 'env', protectedKeysInText(currentText));
 }
-export function safeMergeObject(current, managed) {
+export function safeMergeObject(current, managed, prefix = '') {
     const out = { ...current };
     for (const [key, value] of Object.entries(managed)) {
-        if (isProtectedSecretKey(key) && current[key] != null)
+        const dotted = prefix ? `${prefix}.${key}` : key;
+        if (isProtectedSecretKey(dotted) && current[key] != null)
             continue;
         if (isPlainObject(value) && isPlainObject(current[key]))
-            out[key] = safeMergeObject(current[key], value);
+            out[key] = safeMergeObject(current[key], value, dotted);
         else
             out[key] = value;
     }
@@ -51,11 +52,23 @@ function upsertTomlBlockPreservingSecrets(text, block) {
             break;
         }
     }
-    const existingSecretLines = lines.slice(start + 1, end).filter((line) => {
-        const key = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
-        return isProtectedSecretKey(`${header}.${key}`) || isProtectedSecretKey(key);
-    });
-    lines.splice(start, end - start, ...blockLines, ...existingSecretLines.filter((line) => !blockLines.includes(line)));
+    const existingBody = lines.slice(start + 1, end);
+    const nextBody = [...existingBody];
+    for (const managedLine of blockLines.slice(1)) {
+        const managedKey = managedLine.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        if (!managedKey) {
+            if (!nextBody.includes(managedLine))
+                nextBody.push(managedLine);
+            continue;
+        }
+        const existingIndex = nextBody.findIndex((line) => (line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '') === managedKey);
+        const protectedLine = isProtectedSecretKey(`${header}.${managedKey}`) || isProtectedSecretKey(managedKey);
+        if (existingIndex === -1)
+            nextBody.push(managedLine);
+        else if (!protectedLine)
+            nextBody[existingIndex] = managedLine;
+    }
+    lines.splice(start, end - start, blockLines[0] || `[${header}]`, ...nextBody);
     return lines.join('\n').replace(/\n{3,}/g, '\n\n');
 }
 async function writeMergedText(file, before, after, format, preserved) {
@@ -68,6 +81,7 @@ async function writeMergedText(file, before, after, format, preserved) {
         }
         await writeTextAtomic(file, after);
     }
+    const preservedSecretLineHashes = protectedSecretLineHashes(before);
     return {
         schema: 'sks.managed-config-merge.v1',
         generated_at: nowIso(),
@@ -77,6 +91,8 @@ async function writeMergedText(file, before, after, format, preserved) {
         changed: before !== after,
         backup_path: backupPath,
         protected_keys_preserved: preserved,
+        preserved_secret_lines_sha256: preservedSecretLineHashes,
+        idempotent: before === after || protectedSecretLineHashes(after).every((hash) => preservedSecretLineHashes.includes(hash)),
         blockers: []
     };
 }
@@ -88,7 +104,40 @@ function protectedKeysPresent(value) {
     return found;
 }
 function protectedKeysInText(text) {
-    return PROTECTED_SECRET_KEYS.filter((key) => new RegExp(`(^|\\n)\\s*(?:export\\s+)?${String(key).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(text)).map(String);
+    const found = new Set();
+    for (const key of PROTECTED_SECRET_KEYS) {
+        if (new RegExp(`(^|\\n)\\s*(?:export\\s+)?${String(key).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(text))
+            found.add(String(key));
+    }
+    let section = '';
+    for (const line of String(text || '').split(/\r?\n/)) {
+        const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+        if (sectionMatch) {
+            section = String(sectionMatch[1] || '');
+            continue;
+        }
+        const key = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        if (key && section && isProtectedSecretKey(`${section}.${key}`))
+            found.add(`${section}.${key}`);
+    }
+    return [...found].sort();
+}
+function protectedSecretLineHashes(text) {
+    const hashes = [];
+    let section = '';
+    for (const line of String(text || '').split(/\r?\n/)) {
+        const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+        if (sectionMatch) {
+            section = String(sectionMatch[1] || '');
+            continue;
+        }
+        const key = line.match(/^\s*(?:export\s+)?([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        if (!key)
+            continue;
+        if (isProtectedSecretKey(key) || (section && isProtectedSecretKey(`${section}.${key}`)))
+            hashes.push(sha256(line));
+    }
+    return hashes.sort();
 }
 function lookupPath(value, dotted) {
     let current = value;

package/dist/core/config/secret-preservation.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { ensureDir, nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
 import { PROTECTED_SECRET_KEYS, PROTECTED_SUPABASE_ENV_KEYS } from './supabase-secret-preservation.js';
+const activeGuardRoots = new Set();
 export async function captureSecretPreservationSnapshot(input) {
     const root = path.resolve(input.root);
     const sources = secretSources(root);
@@ -31,56 +32,83 @@ export async function captureSecretPreservationSnapshot(input) {
 }
 export async function withSecretPreservationGuard(root, operationName, fn) {
     const resolvedRoot = path.resolve(root);
+    if (activeGuardRoots.has(resolvedRoot))
+        return fn();
+    activeGuardRoots.add(resolvedRoot);
     const reportDir = path.join(resolvedRoot, '.sneakoscope', 'reports');
     await ensureDir(reportDir);
     const beforePath = path.join(reportDir, 'secret-preservation-before.json');
     const afterPath = path.join(reportDir, 'secret-preservation-after.json');
     const guardPath = path.join(reportDir, 'secret-preservation-guard.json');
     const before = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: beforePath });
+    const backup = await backupSecretBearingSources(resolvedRoot, operationName, before);
     let result;
+    let operationError = null;
     try {
         result = await fn();
     }
     catch (err) {
-        await writeJsonAtomic(guardPath, {
-            schema: 'sks.secret-preservation-guard.v1',
-            generated_at: nowIso(),
-            ok: false,
-            operation: operationName,
-            before_path: beforePath,
-            after_path: null,
-            restored_keys_count: 0,
-            missing_after: [],
-            raw_values_recorded: false,
-            operation_error: err instanceof Error ? err.message : String(err)
-        }).catch(() => undefined);
-        throw err;
+        operationError = err;
     }
-    const after = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: afterPath });
-    const missing = missingProtectedSecrets(before, after);
-    const report = {
-        schema: 'sks.secret-preservation-guard.v1',
-        generated_at: nowIso(),
-        ok: missing.length === 0,
-        operation: operationName,
-        before_path: beforePath,
-        after_path: afterPath,
-        restored_keys_count: 0,
-        missing_after: missing,
-        raw_values_recorded: false
-    };
-    await writeJsonAtomic(guardPath, report).catch(() => undefined);
-    if (missing.length) {
-        throw new Error(`secret_preservation_failed:${missing.map((item) => `${item.source}:${item.key}`).join(',')}`);
+    try {
+        const after = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: afterPath });
+        const changedOrMissing = changedOrMissingProtectedSecrets(before, after);
+        let rollbackAttempted = false;
+        let rollbackOk = false;
+        let restoredKeysCount = 0;
+        if (changedOrMissing.length) {
+            rollbackAttempted = true;
+            await restoreChangedSecretSources(changedOrMissing, backup.bySource);
+            const restored = await captureSecretPreservationSnapshot({
+                root: resolvedRoot,
+                artifactPath: path.join(reportDir, 'secret-preservation-after-restore.json')
+            });
+            const remaining = changedOrMissingProtectedSecrets(before, restored);
+            rollbackOk = remaining.length === 0;
+            restoredKeysCount = rollbackOk ? changedOrMissing.length : 0;
+            if (!rollbackOk) {
+                const failedReport = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, false, backup.paths);
+                await writeJsonAtomic(guardPath, operationError ? { ...failedReport, ok: false, operation_error: sanitizeErrorMessage(operationError) } : failedReport).catch(() => undefined);
+                throw new Error(`secret_preservation_rollback_failed:${changedOrMissing.map((item) => `${safeSourceForError(resolvedRoot, item.source)}:${item.key}:${item.reason}`).join(',')}`);
+            }
+        }
+        const report = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackAttempted ? rollbackOk : true, backup.paths);
+        if (operationError) {
+            report.ok = false;
+            report.operation_error = sanitizeErrorMessage(operationError);
+        }
+        await writeJsonAtomic(guardPath, report).catch(() => undefined);
+        if (operationError)
+            throw operationError;
+        if (operationName === 'doctor-fix' && rollbackAttempted) {
+            throw new Error(`secret_preservation_restored:${changedOrMissing.map((item) => `${safeSourceForError(resolvedRoot, item.source)}:${item.key}:${item.reason}`).join(',')}`);
+        }
+        return result;
+    }
+    finally {
+        activeGuardRoots.delete(resolvedRoot);
     }
-    return result;
 }
 export function missingProtectedSecrets(before, after) {
+    return changedOrMissingProtectedSecrets(before, after)
+        .filter((item) => item.reason === 'missing')
+        .map((item) => ({ key: item.key, source: item.source }));
+}
+export function changedOrMissingProtectedSecrets(before, after) {
     const afterMap = new Map(after.fingerprints.filter((fp) => fp.present).map((fp) => [`${fp.source}\0${fp.key}`, fp]));
     return before.fingerprints
         .filter((fp) => fp.present && fp.value_sha256)
-        .filter((fp) => !afterMap.has(`${fp.source}\0${fp.key}`))
-        .map((fp) => ({ key: fp.key, source: fp.source }));
+        .map((fp) => {
+        const afterFp = afterMap.get(`${fp.source}\0${fp.key}`);
+        if (!afterFp) {
+            return { key: fp.key, source: fp.source, before_sha256: fp.value_sha256, after_sha256: null, reason: 'missing' };
+        }
+        if (afterFp.value_sha256 !== fp.value_sha256) {
+            return { key: fp.key, source: fp.source, before_sha256: fp.value_sha256, after_sha256: afterFp.value_sha256, reason: 'changed' };
+        }
+        return null;
+    })
+        .filter((item) => Boolean(item));
 }
 function secretSources(root) {
     const home = process.env.HOME || os.homedir();
@@ -90,8 +118,10 @@ function secretSources(root) {
         '.env.development',
         '.env.production',
         '.sneakoscope/config.json',
-        '.codex/config.toml'
-    ].map((rel) => path.join(root, rel)).concat(path.join(home, '.codex', 'config.toml'));
+        '.codex/config.toml',
+        '.cursor/mcp.json',
+        'mcp.json'
+    ].map((rel) => path.join(root, rel)).concat(path.join(home, '.codex', 'config.toml'), path.join(home, '.config', 'sks', 'config.json'));
 }
 function fingerprintsFromText(text, source) {
     const rows = [];
@@ -101,6 +131,7 @@ function fingerprintsFromText(text, source) {
             continue;
         rows.push(fingerprint(String(key), source, value));
     }
+    rows.push(...fingerprintsFromTomlSections(text, source));
     for (const envKey of PROTECTED_SUPABASE_ENV_KEYS) {
         const value = readAssignment(text, envKey);
         if (value)
@@ -118,6 +149,25 @@ function fingerprintsFromObject(value, source) {
     }
     return rows;
 }
+function fingerprintsFromTomlSections(text, source) {
+    const rows = [];
+    let section = '';
+    for (const line of String(text || '').split(/\r?\n/)) {
+        const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+        if (sectionMatch) {
+            section = String(sectionMatch[1] || '').trim();
+            continue;
+        }
+        const kv = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(.+?)\s*$/);
+        if (!kv || !section)
+            continue;
+        const key = `${section}.${kv[1]}`;
+        if (!PROTECTED_SECRET_KEYS.includes(key))
+            continue;
+        rows.push(fingerprint(key, source, unquote(String(kv[2] || ''))));
+    }
+    return rows;
+}
 function fingerprint(key, source, value) {
     return {
         key,
@@ -143,9 +193,7 @@ function redactPreview(value) {
     const text = String(value || '');
     if (!text)
         return '';
-    const head = text.slice(0, Math.min(3, text.length));
-    const tail = text.length > 6 ? text.slice(-3) : '';
-    return `${head}...${tail || 'redacted'}(${text.length})`;
+    return `sha256:${sha256(text).slice(0, 12)}(${text.length})`;
 }
 function flattenObject(value, prefix = '') {
     if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -166,4 +214,64 @@ function dedupeFingerprints(fingerprints) {
         byKey.set(`${fp.source}\0${fp.key}`, fp);
     return [...byKey.values()].sort((a, b) => a.source.localeCompare(b.source) || a.key.localeCompare(b.key));
 }
+function guardReport(operation, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackOk, backupPaths) {
+    return {
+        schema: 'sks.secret-preservation-guard.v1',
+        generated_at: nowIso(),
+        ok: changedOrMissing.length === 0 || rollbackOk,
+        operation,
+        before_path: beforePath,
+        after_path: afterPath,
+        restored_keys_count: restoredKeysCount,
+        changed_or_missing: changedOrMissing,
+        missing_after: changedOrMissing.filter((item) => item.reason === 'missing').map((item) => ({ key: item.key, source: item.source })),
+        rollback_attempted: rollbackAttempted,
+        rollback_ok: rollbackOk,
+        backup_paths: backupPaths,
+        raw_values_recorded: false
+    };
+}
+async function backupSecretBearingSources(root, operationName, snapshot) {
+    const bySource = new Map();
+    const sources = [...new Set(snapshot.fingerprints.filter((fp) => fp.present).map((fp) => fp.source))];
+    if (!sources.length)
+        return { bySource, paths: [] };
+    const backupRoot = path.join(root, '.sneakoscope', 'backups', 'secrets', sanitizeSegment(operationName), new Date().toISOString().replace(/[:.]/g, '-'));
+    for (const source of sources) {
+        const backupPath = path.join(backupRoot, sanitizeSourcePath(root, source));
+        await ensureDir(path.dirname(backupPath));
+        await fs.copyFile(source, backupPath);
+        bySource.set(source, backupPath);
+    }
+    return { bySource, paths: [...bySource.values()] };
+}
+async function restoreChangedSecretSources(changedOrMissing, backups) {
+    for (const source of [...new Set(changedOrMissing.map((item) => item.source))]) {
+        const backup = backups.get(source);
+        if (!backup)
+            continue;
+        await ensureDir(path.dirname(source));
+        await fs.copyFile(backup, source);
+    }
+}
+function sanitizeSegment(value) {
+    return String(value || 'operation').replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'operation';
+}
+function sanitizeSourcePath(root, source) {
+    return safeSourceForError(root, source).replace(/[^A-Za-z0-9._/-]+/g, '_').replace(/^\/+/, '');
+}
+function safeSourceForError(root, source) {
+    const rel = path.relative(root, source);
+    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel))
+        return rel;
+    const home = process.env.HOME || os.homedir();
+    const homeRel = path.relative(home, source);
+    if (homeRel && !homeRel.startsWith('..') && !path.isAbsolute(homeRel))
+        return `~/${homeRel}`;
+    return path.basename(source);
+}
+function sanitizeErrorMessage(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return message.replace(/([A-Za-z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD)[A-Za-z0-9_]*=)[^\s,;]+/gi, '$1<redacted>');
+}
 //# sourceMappingURL=secret-preservation.js.map

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.9';
+export const PACKAGE_VERSION = '3.1.10';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/init.js

@@ -11,7 +11,8 @@ import { AWESOME_DESIGN_MD_REFERENCE, CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_
 import { SKILL_DREAM_POLICY, skillDreamPolicyText } from './skill-forge.js';
 import { CODEX_HOOK_EVENT_STATE_KEYS } from './codex-compat/codex-hook-events.js';
 import { codexCommandHookCurrentHash } from './codex-hooks/codex-hook-hash.js';
-import { buildSksCoreSkillManifest, isCoreSkillName, renderCoreSkillTemplate } from './codex-native/core-skill-manifest.js';
+import { buildSksCoreSkillManifest, isCoreSkillName } from './codex-native/core-skill-manifest.js';
+import { syncCoreSkillsIntegrity } from './codex-native/core-skill-integrity.js';
 const REFLECTION_MEMORY_PATH = '.sneakoscope/memory/q2_facts/post-route-reflection.md';
 const SKS_GENERATED_GIT_PATTERNS = [
     '.sneakoscope/missions/',
@@ -1084,23 +1085,45 @@ export async function installSkills(root) {
         'design-ui-editor': `---\nname: design-ui-editor\ndescription: Legacy fallback UI/UX editor for existing design.md systems when Product Design plugin is unavailable.\n---\n\nUse Product Design plugin first. When falling back, read \`design.md\`, inspect relevant UI/assets/tests, consult getdesign-reference when improving the design system, apply the smallest design-system-conformant change, use imagegen for image/logo/raster assets, and verify render quality. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY} If design.md is missing and Product Design is unavailable, use design-system-builder as fallback.\n`,
         'design-artifact-expert': `---\nname: design-artifact-expert\ndescription: Legacy fallback for high-fidelity HTML/UI/prototype artifacts when Product Design plugin cannot be used.\n---\n\nUse Product Design plugin first for design/UI/prototype work. When falling back, read design.md when present, consult getdesign-reference for design-system grounding, build the usable artifact first, preserve state, verify overlap/readability/responsiveness, and use imagegen for required assets. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY}\n`
     };
-    for (const skill of buildSksCoreSkillManifest().skills) {
-        skills[skill.canonical_name] = renderCoreSkillTemplate(skill.canonical_name);
-    }
+    const nonCoreSkillNames = Object.keys(skills).filter((name) => !isCoreSkillName(name));
     for (const [name, content] of Object.entries(skills)) {
+        if (isCoreSkillName(name))
+            continue;
         const dir = path.join(root, '.agents', 'skills', name);
-        const skillContent = isCoreSkillName(name) ? content : enrichSkillContent(name, content);
+        const skillContent = enrichSkillContent(name, content);
         await ensureDir(dir);
         await writeTextAtomic(path.join(dir, 'SKILL.md'), `${skillContent.trim()}\n`);
         await writeSkillMetadata(dir, name);
     }
-    const skillNames = Object.keys(skills);
+    const coreManifest = buildSksCoreSkillManifest();
+    const coreByName = new Map(coreManifest.skills.map((skill) => [skill.canonical_name, skill.content_sha256]));
+    const coreIntegrity = await syncCoreSkillsIntegrity({
+        root,
+        apply: true,
+        skillsRoot: path.join(root, '.agents', 'skills'),
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'core-skill-integrity.json')
+    });
+    const managedCoreSkillNames = coreIntegrity.rows
+        .filter((row) => row.after_sha256 === coreByName.get(row.canonical_name) && row.action !== 'skip-user-authored')
+        .map((row) => row.canonical_name);
+    for (const name of managedCoreSkillNames) {
+        await writeSkillMetadata(path.join(root, '.agents', 'skills', name), name);
+    }
+    const skillNames = [...nonCoreSkillNames, ...managedCoreSkillNames];
     const removedStaleGeneratedSkills = await removeStaleGeneratedSkillsFromManifest(root, skillNames);
     const removedPluginSkillCollisions = await removeGeneratedPluginSkillCollisions(root);
     await writeGeneratedSkillManifest(root, skillNames);
     return {
         installed_skills: skillNames,
         generated_files: generatedSkillFiles(skillNames),
+        core_skill_integrity: {
+            ok: coreIntegrity.ok,
+            template_version: coreIntegrity.template_version,
+            installed_count: coreIntegrity.installed_count,
+            restored_count: coreIntegrity.restored_count,
+            user_collision_count: coreIntegrity.user_collision_count,
+            report: '.sneakoscope/reports/core-skill-integrity.json'
+        },
         removed_stale_generated_skills: [...removedStaleGeneratedSkills, ...removedPluginSkillCollisions].sort(),
         removed_agent_skill_aliases: await removeGeneratedAgentSkillAliases(root, skillNames),
         removed_codex_skill_mirrors: await removeGeneratedCodexSkillMirrors(root, skillNames)
@@ -1137,6 +1160,8 @@ async function removeStaleGeneratedSkillsFromManifest(root, skillNames) {
         const skillName = String(name || '').trim();
         if (!skillName || current.has(skillName) || !/^[a-z0-9-]+$/.test(skillName))
             continue;
+        if (isCoreSkillName(skillName))
+            continue;
         const dir = path.join(root, '.agents', 'skills', skillName);
         if (!(await exists(dir)))
             continue;

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '3.1.9';
+export const PACKAGE_VERSION = '3.1.10';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "3.1.9",
+  "version": "3.1.10",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -643,6 +643,10 @@
     "update:preserves-supabase-keys": "node ./dist/scripts/update-preserves-supabase-keys-blackbox.js",
     "update:secret-preservation-guard": "node ./dist/scripts/update-secret-preservation-guard-check.js",
     "update:secret-migration-journal": "node ./dist/scripts/update-secret-migration-journal-check.js",
+    "config:managed-merge-callsite-coverage": "node ./dist/scripts/config-managed-merge-callsite-coverage-check.js",
+    "release:gate-script-parity": "node ./dist/scripts/release-gate-script-parity-check.js",
+    "release:wiring-3110-blackbox": "node ./dist/scripts/release-wiring-3110-blackbox.js",
+    "sks:3110-all-feature-regression": "node ./dist/scripts/sks-3110-all-feature-regression-blackbox.js",
     "release:dag-full-coverage": "node ./dist/scripts/release-dag-full-coverage-check.js",
     "release:cache-glob-hashing": "node ./dist/scripts/release-cache-glob-hashing-check.js",
     "release:check:affected": "npm run build --silent && node ./dist/scripts/release-gate-dag-runner.js --preset affected --changed-since auto",