sneakoscope 3.1.9 → 3.1.11

package/README.md

@@ -35,14 +35,15 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.9** hardens update/setup/doctor safety around four operator-facing failure modes: immutable core skills, duplicate project skills, real native capability repair status, and Supabase/secret preservation.
+SKS **3.1.11** is a release-ready repair pass for MAD Zellij stacked panes, Context7 MCP doctor recovery, and stale Codex startup config.
 
-What changed in 3.1.8:
+What changed in 3.1.11:
 
-- **Core SKS skills are content-addressed and immutable.** The eight built-in route skills now have a manifest and no-drift gates; setup/update/doctor may install missing managed copies or restore corrupted managed copies, but they do not overwrite user-authored collisions.
-- **Duplicate skills are detected and repaired safely.** Canonical skill names collapse variants such as `Loop`, `loop`, and `loop/SKILL.md`; SKS-managed duplicates can be quarantined automatically, while user-authored duplicates require explicit confirmation.
-- **`sks doctor --fix` reports native capability truthfully.** Image generation, image follow-up edit paths, Computer Use, Chrome/web review, app screenshots, app handoff, and image path exposure now run through a repair matrix and postcheck instead of capability assumptions.
-- **Supabase keys survive setup/update/doctor.** Protected secret surfaces are fingerprinted before and after guarded operations; reports store only redacted previews and hashes, never raw values.
+- **MAD Zellij panes require native stacked-pane support.** `sks doctor --fix` now treats Zellij 0.43.0 as the minimum interactive runtime so `sks --mad` can use native stacked worker panes instead of fragmenting into plain splits.
+- **Context7 stdio lockups are doctor-repairable.** `sks doctor --fix` detects local `@upstash/context7-mcp` stdio config and migrates it to the remote Context7 MCP endpoint so Codex launches do not stall at the stdio server banner.
+- **Codex startup warnings are doctor-repairable.** `sks doctor --fix` rewrites stale SKS agent `config_file` paths to existing absolute files, removes unsupported managed `message_role_prefix` role fields, preserves optional `supabase_sauron`, and drops missing-command `node_repl` MCP blocks that would otherwise spam startup.
+- **Doctor JSON exposes the Context7 and startup repair reports.** `context7_repair`, `codex_startup_repair`, and their `repair.*` entries carry migration status, backups, actions, warnings, and any manual auth actions.
+- **Release metadata is aligned for 3.1.11.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.9"
+version = "3.1.11"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.9"
+version = "3.1.11"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.9"),
+        Some("--version") => println!("sks-rs 3.1.11"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.1.9",
-  "source_digest": "dbfd5ddb700abfc4a008256b36e1743363164fd504bba959542ce79c25916dad",
-  "source_file_count": 2605,
-  "built_at_source_time": 1781537952236
+  "package_version": "3.1.11",
+  "source_digest": "932de0e70bb2a5b787aef2782fa56cbc4956c6077d099d9e1067b9406fd8412a",
+  "source_file_count": 2613,
+  "built_at_source_time": 1781554790419
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.9';
+const FAST_PACKAGE_VERSION = '3.1.11';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -24,13 +24,22 @@ import { runCodex0138Doctor } from '../core/doctor/codex-0138-doctor.js';
 import { writeCodexPluginInventoryArtifacts, pluginAppTemplatePolicy } from '../core/codex-plugins/codex-plugin-json.js';
 import { writeMcpPluginInventoryArtifacts } from '../core/mcp/mcp-plugin-inventory.js';
 import { runDoctorZellijRepair, doctorZellijRepairConsoleLine } from '../core/doctor/doctor-zellij-repair.js';
+import { runDoctorContext7Repair } from '../core/doctor/doctor-context7-repair.js';
+import { runDoctorCodexStartupRepair } from '../core/doctor/doctor-codex-startup-repair.js';
 import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
 import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 import { runDoctorNativeCapabilityRepair } from '../core/doctor/doctor-native-capability-repair.js';
 import { runDoctorCommandAliasCleanup } from '../core/doctor/command-alias-cleanup.js';
+import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 export async function run(_command, args = []) {
+    const root = await projectRoot();
     const doctorFix = flag(args, '--fix');
+    if (doctorFix)
+        return withSecretPreservationGuard(root, 'doctor-fix', () => runDoctor(args, root, doctorFix));
+    return runDoctor(args, root, doctorFix);
+}
+async function runDoctor(args = [], root, doctorFix) {
     let setupRepair = null;
     const sksUpdate = doctorFix
         ? {
@@ -70,7 +79,6 @@ export async function run(_command, args = []) {
                 : await ensureGlobalCodexFastModeDuringInstall().catch((err) => ({ status: 'failed', error: err?.message || String(err) }))
         };
     }
-    const root = await projectRoot();
     const commandAliasCleanup = await runDoctorCommandAliasCleanup({
         root,
         fix: doctorFix
@@ -112,6 +120,19 @@ export async function run(_command, args = []) {
         requireActualCodex: flag(args, '--fix') || flag(args, '--require-actual-codex'),
         codexBin: codexBin || undefined
     };
+    let codexStartupRepair = await runDoctorCodexStartupRepair({ root, fix: doctorFix }).catch((err) => ({
+        schema: 'sks.doctor-codex-startup-repair.v1',
+        ok: false,
+        generated_at: new Date().toISOString(),
+        fix: doctorFix,
+        configs: [],
+        agent_role_files: { sanitized: [], created: [], blockers: [err?.message || String(err)] },
+        actions: [],
+        manual_actions: [],
+        blockers: [err?.message || String(err)],
+        warnings: [],
+        report_path: `${root}/.sneakoscope/reports/doctor-codex-startup-repair.json`
+    }));
     const codexDoctorBefore = flag(args, '--fix') ? await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') }).catch(() => null) : null;
     const configRepair = flag(args, '--fix') ? await repairCodexConfigEperm(root, { fix: true, ...configProbeOpts }) : null;
     const migrationJournal = flag(args, '--fix')
@@ -120,6 +141,7 @@ export async function run(_command, args = []) {
     const codexConfig = configRepair?.after || await inspectCodexConfigReadability(root, configProbeOpts);
     const codexDoctor = await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') });
     const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, codexDoctor);
+    codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, codexDoctor);
     const codex = codexBin
         ? { bin: codexBin, version: 'fixture-or-explicit', available: true }
         : await getCodexInfo().catch(() => ({ bin: null, version: null, available: false }));
@@ -206,6 +228,18 @@ export async function run(_command, args = []) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    const context7Repair = await runDoctorContext7Repair({ root, fix: doctorFix }).catch((err) => ({
+        schema: 'sks.doctor-context7-repair.v1',
+        ok: false,
+        generated_at: new Date().toISOString(),
+        fix: doctorFix,
+        preferred_transport: 'remote',
+        configs: [],
+        actions: [],
+        blockers: [err?.message || String(err)],
+        warnings: [],
+        report_path: `${root}/.sneakoscope/reports/doctor-context7-repair.json`
+    }));
     const zellij = await checkZellijCapability({ root, require: process.env.SKS_REQUIRE_ZELLIJ === '1' });
     const localModel = await readLocalModelConfig().catch(() => null);
     const permissionProfiles = await inventoryCodexPermissionProfiles(root, { writeReport: true });
@@ -285,6 +319,8 @@ export async function run(_command, args = []) {
         codex_doctor: codexDoctor,
         require_codex_doctor: flag(args, '--fix') || flag(args, '--require-actual-codex'),
         zellij,
+        context7_repair: context7Repair,
+        codex_startup_repair: codexStartupRepair,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         repair: configRepair,
@@ -298,6 +334,7 @@ export async function run(_command, args = []) {
             ...(codexConfig.operator_actions || []),
             ...(configRepair?.operator_actions || []),
             ...(zellijRepair && !zellijRepair.ok && zellijRepair.command ? [`Run: ${zellijRepair.command}`] : []),
+            ...(codexStartupRepair.manual_actions || []),
             ...(pluginPolicy?.doctor_warnings || [])
         ]
     });
@@ -305,7 +342,7 @@ export async function run(_command, args = []) {
     const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
         schema: 'sks.doctor-status.v1',
-        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false,
+        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false,
         root,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
@@ -319,6 +356,8 @@ export async function run(_command, args = []) {
         codex_doctor_diff: codexDoctorDiff,
         zellij,
         zellij_repair: zellijRepair,
+        context7_repair: context7Repair,
+        codex_startup_repair: codexStartupRepair,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         zellij_readiness: zellijReadiness,
@@ -342,7 +381,7 @@ export async function run(_command, args = []) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
     };
     if (flag(args, '--json')) {
         printJson(result);
@@ -369,6 +408,21 @@ export async function run(_command, args = []) {
     const zellijRepairLine = doctorZellijRepairConsoleLine(zellijRepair);
     if (zellijRepairLine)
         console.log(zellijRepairLine);
+    console.log('Context7 MCP:');
+    console.log(`  transport: ${context7Repair.preferred_transport || 'remote'}`);
+    console.log(`  repair: ${context7Repair.ok ? 'ok' : 'blocked'}`);
+    for (const action of context7Repair.actions || [])
+        console.log(`  - ${action}`);
+    for (const warning of context7Repair.warnings || [])
+        console.log(`  warning: ${warning}`);
+    console.log('Codex startup config:');
+    console.log(`  repair: ${codexStartupRepair.ok ? 'ok' : 'blocked'}`);
+    for (const action of codexStartupRepair.actions || [])
+        console.log(`  - ${action}`);
+    for (const action of codexStartupRepair.manual_actions || [])
+        console.log(`  manual: ${action}`);
+    for (const warning of codexStartupRepair.warnings || [])
+        console.log(`  warning: ${warning}`);
     console.log(`  codex doctor:    ${codexDoctor.available ? (codexDoctor.exit_code === 0 ? 'ok' : 'warning') : 'unavailable'}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
@@ -397,6 +451,12 @@ export async function run(_command, args = []) {
     console.log(`  app screenshot: ${nativeCapabilityStatus(nativeCapabilityRows, 'codex_app_screenshot', 'degraded')}`);
     console.log(`  app handoff: ${nativeCapabilityStatus(nativeCapabilityRows, 'app_handoff', 'unavailable')}`);
     console.log(`  image path exposure: ${nativeCapabilityStatus(nativeCapabilityRows, 'image_path_exposure', 'fallback')}`);
+    const nativeManualActions = uniqueNativeManualActions(nativeCapabilityRows);
+    if (nativeManualActions.length) {
+        console.log('  manual next actions:');
+        for (const action of nativeManualActions)
+            console.log(`    - ${action}`);
+    }
     console.log('SKS Skills:');
     console.log(`  core skills: ${doctorSkillStatus(doctorNativeCapabilityRepair?.core_skills)}`);
     console.log(`  duplicate project skills: ${doctorDedupeStatus(doctorNativeCapabilityRepair?.skill_dedupe)}`);
@@ -408,7 +468,7 @@ export async function run(_command, args = []) {
         console.log(`  report: ${commandAliasCleanup.report_path}`);
     console.log('Secret preservation:');
     console.log(`  Supabase keys: ${doctorNativeCapabilityRepair?.ok === false && String((doctorNativeCapabilityRepair?.blockers || []).join(' ')).includes('secret_preservation_failed') ? 'blocked' : 'preserved'}`);
-    console.log('  secret values: redacted');
+    console.log('  raw secret values: never recorded');
     console.log(`  migration journal: ${doctorNativeCapabilityRepair?.secret_preservation_guard || '.sneakoscope/reports/secret-preservation-guard.json'}`);
     console.log('Codex App Harness:');
     console.log(`  plugins: ${codexAppHarnessMatrix.app_features?.plugin_json ? 'ok' : 'degraded'}`);
@@ -540,6 +600,13 @@ function nativeCapabilityStatus(rows, id, fallback) {
         return fallback;
     if (row.after === 'verified' || row.before === 'verified')
         return 'verified';
+    if (id === 'image_path_exposure') {
+        if (row.before === 'degraded' || row.after === 'degraded' || row.repairability === 'doctor-fix')
+            return 'fallback';
+        return fallback;
+    }
+    if (id === 'app_handoff')
+        return 'unavailable';
     if (row.repairability === 'manual-required')
         return 'manual_required';
     if (row.before === 'degraded' || row.after === 'degraded')
@@ -550,6 +617,12 @@ function nativeCapabilityStatus(rows, id, fallback) {
         return 'unavailable';
     return fallback;
 }
+function uniqueNativeManualActions(rows) {
+    return [...new Set(rows
+            .filter((row) => row?.repairability === 'manual-required' && row?.after !== 'verified')
+            .flatMap((row) => Array.isArray(row.repair_actions) ? row.repair_actions : [])
+            .filter((action) => typeof action === 'string' && action.trim()))];
+}
 function doctorSkillStatus(coreSkills) {
     if (!coreSkills)
         return 'drift_detected';
@@ -696,4 +769,30 @@ function readOption(args = [], name, fallback = null) {
     const index = args.indexOf(name);
     return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
 }
+function mergeObservedCodexStartupWarnings(startupRepair, codexDoctor) {
+    const text = `${codexDoctor?.stdout_tail || ''}\n${codexDoctor?.stderr_tail || ''}`;
+    const manual = new Set(Array.isArray(startupRepair?.manual_actions) ? startupRepair.manual_actions : []);
+    const warnings = new Set(Array.isArray(startupRepair?.warnings) ? startupRepair.warnings : []);
+    const blockers = new Set(Array.isArray(startupRepair?.blockers) ? startupRepair.blockers : []);
+    if (/codex_apps[\s\S]{0,500}token_expired|token_expired[\s\S]{0,500}codex_apps/i.test(text)) {
+        manual.add('Codex Apps MCP token is expired; sign in to Codex App/CLI again so the connector can mint a fresh token.');
+        warnings.add('codex_apps_token_expired_observed');
+        blockers.add('codex_apps_token_expired_manual_reauth_required');
+    }
+    if (/SUPABASE_ACCESS_TOKEN[\s\S]{0,500}mcp server ['"`]?supabase['"`]?|mcp server ['"`]?supabase['"`]?[\s\S]{0,500}SUPABASE_ACCESS_TOKEN/i.test(text)) {
+        manual.add('Supabase MCP uses SUPABASE_ACCESS_TOKEN but the variable is unset; export the token or migrate that server to a read-only remote URL.');
+        warnings.add('supabase_access_token_missing_observed');
+        blockers.add('supabase_access_token_missing_manual_auth_required');
+    }
+    if (/node_repl[\s\S]{0,500}No such file or directory|No such file or directory[\s\S]{0,500}node_repl/i.test(text)) {
+        warnings.add('node_repl_missing_command_observed');
+    }
+    return {
+        ...startupRepair,
+        ok: blockers.size === 0 && startupRepair?.ok !== false,
+        manual_actions: [...manual],
+        warnings: [...warnings],
+        blockers: [...blockers]
+    };
+}
 //# sourceMappingURL=doctor.js.map

package/dist/core/codex-app/codex-agent-role-sync.js

@@ -56,7 +56,7 @@ export async function syncCodexAgentRoles(input) {
         for (const role of DIRECTIVE_ROLES) {
             const file = path.join(targetDir, `${role}.toml`);
             const current = await fs.readFile(file, 'utf8').catch(() => '');
-            if (current && !current.includes('SKS managed 3.1.4 directive role') && !current.includes('SKS managed 3.1.5 directive role') && !current.includes('SKS managed 3.1.6 directive role') && !current.includes('SKS managed 3.1.6 bounded role') && !current.includes('SKS managed 3.1.7 directive role'))
+            if (current && !isSksManagedDirectiveRole(current))
                 continue;
             await writeTextAtomic(file, roleToml(role, rolePayloads[role]));
             created.push(file);
@@ -84,13 +84,9 @@ export async function syncCodexAgentRoles(input) {
     return report;
 }
 function roleToml(role, payload) {
-    const strategyLine = payload?.strategy === 'agent_type'
-        ? `agent_type = "${payload.agent_type || role}"`
-        : `message_role_prefix = "${escapeToml(payload?.message_role_prefix || `Role: ${role}.`)}"`;
     return [
         `name = "${role}"`,
-        `description = "SKS managed 3.1.7 directive role: ${role}"`,
-        strategyLine,
+        `description = "SKS managed 3.1.11 directive role: ${role}"`,
         'model_reasoning_effort = "medium"',
         role.includes('implementer') ? 'sandbox_mode = "workspace-write"' : 'sandbox_mode = "read-only"',
         'approval_policy = "never"',
@@ -110,6 +106,10 @@ function roleToml(role, payload) {
         ''
     ].join('\n');
 }
+function isSksManagedDirectiveRole(text) {
+    return /SKS managed 3\.1\.(?:4|5|6|7|11) (?:directive|bounded) role/.test(text)
+        || /\bmessage_role_prefix\s*=/.test(text) && /SKS managed 3\.1\./.test(text);
+}
 function blockersOf(value) {
     return Boolean(value) && typeof value === 'object' && Array.isArray(value.blockers)
         ? (value.blockers).map((item) => String(item)).filter(Boolean)

package/dist/core/codex-app/codex-skill-sync.js

@@ -1,11 +1,12 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { ensureDir, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { buildSksCoreSkillManifest } from '../codex-native/core-skill-manifest.js';
 import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
 import { dedupeProjectSkills } from '../codex-native/project-skill-dedupe.js';
 const EXTERNAL_ROUTE_RESERVED = new Set(['ulw-loop', 'ulw-plan', 'start-work']);
+const SKILL_SYNC_LOCK_STALE_AFTER_MS = 30000;
 export async function syncCodexSksSkills(input) {
     const root = path.resolve(input.root);
     const skillsRoot = input.skillsRoot || path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'skills');
@@ -71,6 +72,8 @@ export async function withSkillSyncLock(root, fn) {
             const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
             if (code !== 'EEXIST')
                 throw err;
+            if (await recoverStaleSkillSyncLock(lockPath))
+                continue;
             if (Date.now() - started > 30000)
                 throw new Error(`Timed out waiting for skill sync lock: ${lockPath}`);
             await new Promise((resolve) => setTimeout(resolve, 25));
@@ -80,7 +83,8 @@ export async function withSkillSyncLock(root, fn) {
         await writeJsonAtomic(path.join(lockPath, 'owner.json'), {
             schema: 'sks.skill-sync-lock.v1',
             pid: process.pid,
-            acquired_at: nowIso()
+            acquired_at: nowIso(),
+            stale_after_ms: SKILL_SYNC_LOCK_STALE_AFTER_MS
         }).catch(() => undefined);
         return await fn();
     }
@@ -88,6 +92,37 @@ export async function withSkillSyncLock(root, fn) {
         await fs.rm(lockPath, { recursive: true, force: true }).catch(() => undefined);
     }
 }
+async function recoverStaleSkillSyncLock(lockPath) {
+    const ownerPath = path.join(lockPath, 'owner.json');
+    const stat = await fs.stat(lockPath).catch(() => null);
+    const owner = await readJson(ownerPath, null).catch(() => null);
+    const staleAfterMs = Number(owner?.stale_after_ms || SKILL_SYNC_LOCK_STALE_AFTER_MS);
+    const acquiredAt = owner?.acquired_at ? Date.parse(owner.acquired_at) : NaN;
+    const ageMs = Number.isFinite(acquiredAt) ? Date.now() - acquiredAt : stat ? Date.now() - stat.mtimeMs : 0;
+    if (owner?.schema === 'sks.skill-sync-lock.v1' && Number.isFinite(owner.pid)) {
+        if (ageMs <= staleAfterMs || pidAlive(Number(owner.pid)))
+            return false;
+        await fs.rm(lockPath, { recursive: true, force: true }).catch(() => undefined);
+        return true;
+    }
+    if (stat && Date.now() - stat.mtimeMs > staleAfterMs) {
+        await fs.rm(lockPath, { recursive: true, force: true }).catch(() => undefined);
+        return true;
+    }
+    return false;
+}
+function pidAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+        return code === 'EPERM';
+    }
+}
 async function listSkillNames(root) {
     const rows = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
     return rows.filter((row) => row.isDirectory()).map((row) => row.name).sort();

package/dist/core/codex-native/core-skill-integrity.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
-import { buildSksCoreSkillManifest, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
+import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
 import { canonicalSkillName } from './skill-name-canonicalizer.js';
 export async function syncCoreSkillsIntegrity(input) {
     const root = path.resolve(input.root);
@@ -69,7 +69,12 @@ export async function syncCoreSkillsIntegrity(input) {
         root,
         apply,
         skills_root: skillsRoot,
+        template_version: CORE_SKILL_TEMPLATE_VERSION,
         manifest_sha256: sha256(JSON.stringify(manifest.skills.map((skill) => [skill.canonical_name, skill.content_sha256]))),
+        drift_detected_count: rows.filter((row) => row.action === 'restore-corrupted-managed-copy' || row.action === 'skip-user-authored').length,
+        restored_count: restored.length,
+        installed_count: installed.length,
+        user_collision_count: skippedUserAuthored.length,
         rows,
         installed,
         restored,

package/dist/core/codex-native/core-skill-manifest.js

@@ -1,6 +1,6 @@
 import { PACKAGE_VERSION, nowIso, sha256 } from '../fsx.js';
 import { canonicalSkillName } from './skill-name-canonicalizer.js';
-export const CORE_SKILL_TEMPLATE_VERSION = '3.1.8-core-skill-template.v1';
+export const CORE_SKILL_TEMPLATE_VERSION = 'sks-core-skill-template.v1';
 export const CORE_SKILL_MANAGED_BEGIN = '<!-- BEGIN SKS IMMUTABLE CORE SKILL -->';
 export const CORE_SKILL_MANAGED_END = '<!-- END SKS IMMUTABLE CORE SKILL -->';
 const CORE_SKILL_DEFINITIONS = [

package/dist/core/codex-native/native-capability-postcheck.js

@@ -1,22 +1,13 @@
+import fs from 'node:fs/promises';
 import path from 'node:path';
-import { writeJsonAtomic } from '../fsx.js';
+import { ensureDir, readJson, writeJsonAtomic } from '../fsx.js';
 import { buildNativeCapabilityRepairMatrix } from './native-capability-repair-matrix.js';
 export async function postcheckNativeCapabilities(input) {
     const root = path.resolve(input.root);
-    const matrix = input.matrix || await buildNativeCapabilityRepairMatrix({ root, fixture: input.fixture || false, reportPath: null });
-    const capabilities = matrix.capabilities.map((state) => {
-        const verifiedAfterRepair = state.repairability === 'auto' || state.repairability === 'doctor-fix';
-        if (state.id === 'computer_use' && process.env.SKS_COMPUTER_USE_CAPABILITY !== 'verified') {
-            return { ...state, after: 'unknown', blockers: ['computer_use_os_permission_or_capability_unknown'] };
-        }
-        if (state.id === 'chrome_web_review' && process.env.SKS_CHROME_EXTENSION_READY !== '1' && input.fixture !== 'all-repairable') {
-            return { ...state, after: 'unknown', blockers: ['codex_chrome_extension_readiness_not_verified'] };
-        }
-        if (state.blockers.length === 0 || verifiedAfterRepair)
-            return { ...state, after: state.repairability === 'manual-required' ? 'unknown' : 'verified', blockers: state.repairability === 'manual-required' ? state.blockers : [] };
-        return { ...state, after: 'blocked' };
-    });
-    const blockers = capabilities.flatMap((state) => state.after === 'verified' ? [] : state.blockers);
+    const fixture = input.fixture || false;
+    const matrix = input.matrix || await buildNativeCapabilityRepairMatrix({ root, fixture, reportPath: null });
+    const capabilities = await Promise.all(matrix.capabilities.map((state) => postcheckCapability(root, state, fixture)));
+    const blockers = capabilities.flatMap((state) => state.after === 'verified' || state.after === 'degraded' ? [] : state.blockers);
     const checked = {
         ...matrix,
         generated_at: new Date().toISOString(),
@@ -32,4 +23,141 @@ export async function postcheckNativeCapabilities(input) {
         await writeJsonAtomic(reportPath, checked).catch(() => undefined);
     return checked;
 }
+async function postcheckCapability(root, state, fixture) {
+    if (state.id === 'image_generation')
+        return postcheckImageGeneration(state, fixture);
+    if (state.id === 'image_followup_edit')
+        return postcheckImageFollowupEdit(root, state);
+    if (state.id === 'computer_use')
+        return postcheckComputerUse(state, fixture);
+    if (state.id === 'chrome_web_review')
+        return postcheckChromeWebReview(state, fixture);
+    if (state.id === 'codex_app_screenshot')
+        return postcheckAppScreenshot(root, state);
+    if (state.id === 'app_handoff')
+        return postcheckAppHandoff(state, fixture);
+    if (state.id === 'image_path_exposure')
+        return postcheckImagePathExposure(root, state, fixture);
+    if (state.id === 'saved_artifact_path_contract')
+        return postcheckSavedArtifactPathContract(root, state);
+    return { ...state, after: 'blocked', blockers: [...state.blockers, `unknown_capability:${state.id}`] };
+}
+function postcheckImageGeneration(state, fixture) {
+    if (fixture === 'all-repairable' || state.before === 'verified')
+        return verified(state);
+    return {
+        ...state,
+        after: 'unknown',
+        blockers: ['imagegen_auth_or_codex_app_builtin_missing'],
+        warnings: [...new Set([...state.warnings, 'image_generation_not_verified_without_real_capability'])]
+    };
+}
+async function postcheckImageFollowupEdit(root, state) {
+    const contract = await validateSavedArtifactPathContract(root);
+    if (!contract.ok)
+        return { ...state, after: 'blocked', blockers: contract.blockers };
+    const sample = path.join(contract.imageArtifacts, 'postcheck-followup-sample.txt');
+    if (!(await writeReadSample(sample)))
+        return { ...state, after: 'blocked', blockers: ['image_followup_sample_artifact_unwritable'] };
+    return verified(state);
+}
+function postcheckComputerUse(state, _fixture) {
+    if (process.env.SKS_COMPUTER_USE_CAPABILITY === 'verified')
+        return verified(state);
+    return {
+        ...state,
+        after: 'unknown',
+        blockers: ['computer_use_os_permission_or_capability_unknown'],
+        warnings: [...new Set([...state.warnings, 'manual_os_permission_required'])]
+    };
+}
+function postcheckChromeWebReview(state, fixture) {
+    if (fixture === 'all-repairable' || process.env.SKS_CHROME_EXTENSION_READY === '1')
+        return verified(state);
+    return {
+        ...state,
+        after: 'unknown',
+        blockers: ['codex_chrome_extension_readiness_not_verified'],
+        warnings: [...new Set([...state.warnings, 'manual_chrome_extension_setup_required'])]
+    };
+}
+async function postcheckAppScreenshot(root, state) {
+    const dir = path.join(root, '.sneakoscope', 'app-screenshots');
+    const registry = path.join(dir, 'screenshot-registry.json');
+    if (!(await writeReadSample(path.join(dir, 'postcheck-screenshot-sample.txt')))) {
+        return { ...state, after: 'blocked', blockers: ['app_screenshot_directory_unwritable'] };
+    }
+    await writeJsonAtomic(registry, { schema: 'sks.app-screenshot-registry.v1', generated_at: new Date().toISOString(), screenshots: [] }).catch(() => undefined);
+    const json = await readJson(registry, {}).catch(() => ({}));
+    if (json.schema !== 'sks.app-screenshot-registry.v1')
+        return { ...state, after: 'blocked', blockers: ['app_screenshot_registry_invalid'] };
+    return verified(state);
+}
+function postcheckAppHandoff(state, fixture) {
+    if (fixture === 'all-repairable' || state.before === 'verified')
+        return verified(state);
+    return {
+        ...state,
+        after: 'unknown',
+        blockers: ['codex_app_handoff_not_verified'],
+        warnings: [...new Set([...state.warnings, 'manual_app_handoff_approval_required'])]
+    };
+}
+async function postcheckImagePathExposure(root, state, fixture) {
+    if (fixture === 'all-repairable' || state.before === 'verified')
+        return verified(state);
+    const contract = await validateSavedArtifactPathContract(root);
+    if (contract.ok) {
+        return {
+            ...state,
+            after: 'degraded',
+            blockers: [],
+            warnings: [...new Set([...state.warnings, 'using_saved_artifact_path_contract_fallback'])]
+        };
+    }
+    return { ...state, after: 'blocked', blockers: ['image_path_exposure_missing_without_fallback_contract', ...contract.blockers] };
+}
+async function postcheckSavedArtifactPathContract(root, state) {
+    const contract = await validateSavedArtifactPathContract(root);
+    if (!contract.ok)
+        return { ...state, after: 'blocked', blockers: contract.blockers };
+    if (!(await writeReadSample(path.join(contract.imageArtifacts, 'postcheck-contract-image.txt'))))
+        return { ...state, after: 'blocked', blockers: ['image_artifacts_directory_unwritable'] };
+    if (!(await writeReadSample(path.join(contract.appScreenshots, 'postcheck-contract-screenshot.txt'))))
+        return { ...state, after: 'blocked', blockers: ['app_screenshots_directory_unwritable'] };
+    return verified(state);
+}
+function verified(state) {
+    return { ...state, after: 'verified', blockers: [] };
+}
+async function validateSavedArtifactPathContract(root) {
+    const contractPath = path.join(root, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json');
+    const contract = await readJson(contractPath, null).catch(() => null);
+    const imageArtifacts = String(contract?.image_artifacts || path.join(root, '.sneakoscope', 'image-artifacts'));
+    const appScreenshots = String(contract?.app_screenshots || path.join(root, '.sneakoscope', 'app-screenshots'));
+    const blockers = [];
+    if (contract?.schema !== 'sks.saved-artifact-path-contract.v1')
+        blockers.push('saved_artifact_path_contract_schema_invalid');
+    for (const dir of [imageArtifacts, appScreenshots]) {
+        try {
+            await ensureDir(dir);
+            await fs.access(dir);
+        }
+        catch {
+            blockers.push(`directory_unwritable:${path.basename(dir)}`);
+        }
+    }
+    return { ok: blockers.length === 0, imageArtifacts, appScreenshots, blockers };
+}
+async function writeReadSample(file) {
+    try {
+        await ensureDir(path.dirname(file));
+        await fs.writeFile(file, 'sks-native-capability-postcheck\n', 'utf8');
+        const text = await fs.readFile(file, 'utf8');
+        return text === 'sks-native-capability-postcheck\n';
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=native-capability-postcheck.js.map

package/dist/core/codex-native/native-capability-repair-matrix.js

@@ -109,7 +109,7 @@ async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix
             warnings: envVerified ? [] : ['manual_os_permission_required']
         };
     }
-    const chromeReady = process.env.SKS_CHROME_EXTENSION_READY === '1' || featureOk(nativeFeatureMatrix, 'plugin_json');
+    const chromeReady = process.env.SKS_CHROME_EXTENSION_READY === '1';
     return {
         id,
         before: chromeReady ? 'verified' : 'unknown',