sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/doctor-context7-mcp-repair-blackbox.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+const root = await makeTempRoot('sks-context7-blackbox-');
+const configPath = path.join(root, '.codex', 'config.toml');
+await writeText(configPath, '[mcp_servers.context7]\ncommand = "npx"\n');
+const repaired = await repairContext7Mcp({ root, apply: true });
+const text = await fs.readFile(configPath, 'utf8');
+assertGate(repaired.ok === true && text.includes('https://mcp.context7.com/mcp'), 'Context7 blackbox must write remote URL', { repaired, text });
+await writeText(configPath, '[mcp_servers.context7]\ndisabled = true\ncommand = "npx"\n');
+const disabled = await repairContext7Mcp({ root, apply: true });
+assertGate(disabled.after_transport === 'disabled' && disabled.repaired === false && disabled.disabled_preserved === true, 'Context7 blackbox must preserve explicitly disabled server', disabled);
+emitGate('doctor:context7-mcp-repair-blackbox');
+//# sourceMappingURL=doctor-context7-mcp-repair-blackbox.js.map

package/dist/scripts/doctor-context7-mcp-repair-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+import path from 'node:path';
+const root = await makeTempRoot('sks-context7-');
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.context7]\ncommand = "npx"\nargs = ["-y", "@upstash/context7-mcp"]\n');
+const report = await repairContext7Mcp({ root, apply: true });
+assertGate(report.ok === true && report.after_transport === 'remote', 'Context7 MCP repair must migrate stdio config to remote when safe', report);
+assertGate(report.remote_probe_status === 'skipped' && report.disabled_preserved === false, 'Context7 MCP repair must record remote probe/disabled preservation status', report);
+emitGate('doctor:context7-mcp-repair');
+//# sourceMappingURL=doctor-context7-mcp-repair-check.js.map

package/dist/scripts/doctor-context7-repair-check.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { ensureDistFresh, root as repoRoot } from './lib/ensure-dist-fresh.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { writeTextAtomic } from '../core/fsx.js';
+const freshness = ensureDistFresh({ rebuild: true });
+assertGate(freshness.ok, 'dist must be fresh for doctor context7 repair check', freshness);
+const mod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'core', 'doctor', 'doctor-context7-repair.js')).href);
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-context7-doctor-'));
+const codexHome = path.join(tmp, 'codex-home');
+await fs.mkdir(path.join(tmp, '.codex'), { recursive: true });
+await fs.mkdir(codexHome, { recursive: true });
+const localBlock = [
+    'model = "gpt-5.5"',
+    '',
+    '[mcp_servers.context7]',
+    'command = "npx"',
+    'args = ["-y", "@upstash/context7-mcp@latest"]',
+    '',
+    '[features]',
+    'hooks = true',
+    '',
+    '[mcp_servers.context7.env]',
+    'CONTEXT7_API_KEY = "fixture"',
+    ''
+].join('\n');
+await writeTextAtomic(path.join(tmp, '.codex', 'config.toml'), localBlock);
+await writeTextAtomic(path.join(codexHome, 'config.toml'), localBlock);
+const planned = await mod.runDoctorContext7Repair({ root: tmp, codexHome, fix: false });
+assertGate(planned.configs.every((entry) => entry.status === 'local_stdio_detected'), 'dry inspect must detect local stdio context7', planned);
+const repaired = await mod.runDoctorContext7Repair({ root: tmp, codexHome, fix: true });
+const projectText = await fs.readFile(path.join(tmp, '.codex', 'config.toml'), 'utf8');
+const globalText = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
+for (const text of [projectText, globalText]) {
+    assertGate(text.includes('url = "https://mcp.context7.com/mcp"'), 'context7 must migrate to remote MCP URL', text);
+    assertGate(!text.includes('@upstash/context7-mcp'), 'local stdio context7 package must be removed', text);
+    assertGate(!text.includes('[mcp_servers.context7.env]'), 'nested local context7 env table must be removed with the stdio block', text);
+    assertGate(text.includes('[features]') && text.includes('hooks = true'), 'unrelated config tables must be preserved', text);
+}
+assertGate(repaired.ok === true, 'context7 doctor repair must pass', repaired);
+assertGate(repaired.configs.every((entry) => entry.changed === true && entry.backup_path), 'context7 repair must back up changed configs', repaired);
+emitGate('doctor:context7-repair', { configs: repaired.configs.length, actions: repaired.actions });
+//# sourceMappingURL=doctor-context7-repair-check.js.map

package/dist/scripts/doctor-dirty-plan-check.js

@@ -0,0 +1,9 @@
+// @ts-nocheck
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('doctor-dirty-plan-');
+const mod = await importDist('core/doctor/doctor-dirty-planner.js');
+const plan = mod.planDoctorDirtyRepair(tmp, ['setup', 'context7_repair']);
+assertGate(plan.schema === 'sks.doctor-dirty-plan.v1' && plan.dirty_count === 2, 'dirty planner must mark missing markers dirty', plan);
+emitGate('doctor:dirty-plan', { dirty: plan.dirty_count });
+//# sourceMappingURL=doctor-dirty-plan-check.js.map

package/dist/scripts/doctor-dirty-repair-blackbox.js

@@ -0,0 +1,22 @@
+// @ts-nocheck
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('doctor-dirty-repair-');
+const planner = await importDist('core/doctor/doctor-dirty-planner.js');
+const tx = await importDist('core/doctor/doctor-transaction.js');
+const proofId = planner.markDoctorPhaseClean(tmp, 'setup');
+await tx.writeDoctorFixTransaction({
+    root: tmp,
+    phases: [],
+    proofIdsUsed: [proofId]
+});
+let ran = false;
+const report = await tx.runDoctorFixTransaction({
+    root: tmp,
+    reportPath: null,
+    dirtyPlan: planner.planDoctorDirtyRepair(tmp, ['setup']),
+    phases: [{ id: 'setup', run: async () => { ran = true; return { id: 'setup', ok: true }; } }]
+});
+assertGate(ran === false && report.ok === true && report.phases[0].warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase')), 'dirty repair must skip clean phase', { ran, report });
+emitGate('doctor:dirty-repair-blackbox', { skipped: true });
+//# sourceMappingURL=doctor-dirty-repair-blackbox.js.map

package/dist/scripts/doctor-dirty-repair-check.js

@@ -0,0 +1,8 @@
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const tx = readText('src/core/doctor/doctor-transaction.ts');
+const cmd = readText('src/commands/doctor.ts');
+assertGate(tx.includes('isDoctorPhaseClean') && tx.includes('markDoctorPhaseClean'), 'doctor transaction must skip clean phases and mark successful phases clean');
+assertGate(cmd.includes('doctorDirtyPlan') && cmd.includes('planDoctorDirtyRepair'), 'doctor command must wire dirty planner');
+emitGate('doctor:dirty-repair');
+//# sourceMappingURL=doctor-dirty-repair-check.js.map

package/dist/scripts/doctor-dirty-semantic-blackbox.js

@@ -0,0 +1,8 @@
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const source = readText('src/core/doctor/doctor-dirty-planner.ts');
+assertGate(!source.includes('stat.isDirectory() ? `dir:${stat.mtimeMs}`'), 'doctor dirty planner must not hash directory mtimes');
+assertGate(!source.includes('mtimeMs, text'), 'doctor dirty planner must not mix file mtime into semantic hashes');
+assertGate(source.includes('phaseSemanticState'), 'doctor dirty planner must include phase-specific semantic state');
+assertGate(source.includes('clean_proof_missing'), 'doctor dirty planner must reject markers with missing proof evidence');
+emitGate('doctor:dirty-semantic-blackbox');
+//# sourceMappingURL=doctor-dirty-semantic-blackbox.js.map

package/dist/scripts/doctor-dirty-semantic-check.js

@@ -0,0 +1,7 @@
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/doctor/doctor-dirty-planner.js');
+const plan = mod.planDoctorDirtyRepair(root, ['context7-mcp']);
+const phase = plan.phases[0];
+assertGate(Boolean(phase.input_hash) && phase.postcheck_required === true, 'dirty planner must use semantic hash and postcheck requirement', phase);
+emitGate('doctor:dirty-semantic', { status: phase.status, reason: phase.reason, input_hash: phase.input_hash });
+//# sourceMappingURL=doctor-dirty-semantic-check.js.map

package/dist/scripts/doctor-fix-production-blackbox.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
+const root = await makeTempRoot('sks-doctor-production-');
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.context7]\ncommand = "npx"\n\n[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nread_only = true\n\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+const startup = await repairCodexStartupConfig({ root, apply: true });
+const context7 = await repairContext7Mcp({ root, apply: true });
+const supabase = await repairSupabaseMcp({ root, apply: true });
+const tx = await runDoctorFixTransaction({ root, phases: [
+        { id: 'preflight', run: async () => ({ id: 'preflight', ok: true }) },
+        { id: 'codex_startup_config_repair', run: async () => ({ id: 'codex_startup_config_repair', ok: startup.ok, repaired: true, blockers: startup.blockers }) },
+        { id: 'context7_mcp_repair', run: async () => ({ id: 'context7_mcp_repair', ok: context7.ok, repaired: context7.repaired, blockers: context7.blockers }) },
+        { id: 'supabase_mcp_repair', required_for_ready: false, run: async () => ({ id: 'supabase_mcp_repair', ok: supabase.ok, manual_required: supabase.manual_required, required_for_ready: false, blockers: supabase.blockers, warnings: supabase.warnings }) },
+        { id: 'postcheck', run: async () => ({ id: 'postcheck', ok: true }) }
+    ] });
+const postcheck = doctorRepairPostcheck(tx);
+assertGate(tx.schema === 'sks.doctor-fix-transaction.v1' && tx.raw_secret_values_recorded === false, 'doctor transaction must write production schema without raw secrets', tx);
+assertGate(tx.phases.every((phase) => typeof phase.duration_ms === 'number' && phase.started_at && phase.completed_at), 'doctor transaction phases must include runtime evidence', tx);
+assertGate(postcheck.ok === true, 'doctor repair postcheck must pass when only manual-required optional phases remain', postcheck);
+emitGate('doctor:fix-production-blackbox', { phases: tx.phases.length });
+//# sourceMappingURL=doctor-fix-production-blackbox.js.map

package/dist/scripts/doctor-fix-proves-codex-read-check.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+const repo = process.cwd();
+const fakeCodex = path.join(repo, 'dist', 'scripts', 'fixtures', 'fake-codex-config-loader.js');
+function runDoctorFix(fixture, home, extraEnv) {
+    return spawnSync(process.execPath, [
+        path.join(repo, 'dist', 'bin', 'sks.js'),
+        'doctor',
+        '--fix',
+        '--json',
+        '--codex-bin',
+        fakeCodex
+    ], {
+        cwd: fixture,
+        env: {
+            ...process.env,
+            HOME: home,
+            CODEX_HOME: path.join(home, '.codex'),
+            SKS_DISABLE_UPDATE_CHECK: '1',
+            ...extraEnv
+        },
+        encoding: 'utf8',
+        timeout: 180000
+    });
+}
+// Scenario 1: an EPERM config-load failure the repairs cannot fix MUST stay a blocker
+// (the re-probe of a genuinely-unreadable config still reports failure — Fix B does not
+// paper over real problems).
+const epermFixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fix-eperm-'));
+const epermHome = path.join(epermFixture, 'home');
+await fs.mkdir(epermHome, { recursive: true });
+const epermRun = runDoctorFix(epermFixture, epermHome, { SKS_FAKE_CODEX_CONFIG_EPERM: '1' });
+const epermParsed = parseLastJson(epermRun.stdout || '{}');
+const epermOk = epermRun.status !== 0
+    && epermParsed.ready?.ready === false
+    && epermParsed.ready?.blockers?.includes('codex_cli_config_eperm')
+    && epermParsed.ready?.next_actions?.length > 0;
+// Scenario 2 (regression for the endless `sks doctor --fix` loop): the project config
+// seeds Context7 as a LOCAL STDIO server, which the fake loader treats as the Codex 0.140
+// stdio/url merge conflict (`url is not supported for stdio`). `sks doctor --fix` migrates
+// Context7 to the remote `url` transport; the post-repair re-probe must then observe a
+// loadable config and clear `codex_cli_config_toml_parse_error` — instead of reporting the
+// stale pre-migration failure that previously trapped users in a rerun loop.
+const c7Fixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fix-c7-'));
+const c7Home = path.join(c7Fixture, 'home');
+await fs.mkdir(path.join(c7Fixture, '.codex'), { recursive: true });
+await fs.mkdir(c7Home, { recursive: true });
+await fs.writeFile(path.join(c7Fixture, '.codex', 'config.toml'), '[mcp_servers.context7]\ncommand = "npx"\nargs = ["-y", "@upstash/context7-mcp@latest"]\n');
+const c7Run = runDoctorFix(c7Fixture, c7Home, { SKS_FAKE_CODEX_CONFIG_CONTEXT7_STDIO_CONFLICT: '1' });
+const c7Parsed = parseLastJson(c7Run.stdout || '{}');
+const c7ConfigText = await fs.readFile(path.join(c7Fixture, '.codex', 'config.toml'), 'utf8').catch(() => '');
+const c7MigratedToRemote = /\[mcp_servers\.context7\][^[]*url\s*=\s*"https:\/\/mcp\.context7\.com\/mcp"/.test(c7ConfigText)
+    && !/^\s*command\s*=/m.test(c7ConfigText.match(/\[mcp_servers\.context7\][^[]*/)?.[0] || '');
+const c7BlockerCleared = !((c7Parsed.ready?.blockers || []).includes('codex_cli_config_toml_parse_error'));
+const c7ConfigReadable = c7Parsed.ready?.codex_config_readable_by_codex_cli === true;
+const context7Ok = c7MigratedToRemote && c7BlockerCleared && c7ConfigReadable;
+const ok = epermOk && context7Ok;
+console.log(JSON.stringify({
+    schema: 'sks.doctor-fix-proves-codex-read-check.v2',
+    ok,
+    eperm_case: {
+        ok: epermOk,
+        status: epermRun.status,
+        blockers: epermParsed.ready?.blockers || null
+    },
+    context7_reprobe_case: {
+        ok: context7Ok,
+        status: c7Run.status,
+        migrated_to_remote: c7MigratedToRemote,
+        parse_error_cleared: c7BlockerCleared,
+        config_readable_by_codex_cli: c7ConfigReadable,
+        blockers: c7Parsed.ready?.blockers || null,
+        config_tail: c7ConfigText.slice(-400)
+    },
+    parsed: epermParsed,
+    stdout_tail: String(epermRun.stdout || '').slice(-1000),
+    stderr_tail: String(epermRun.stderr || '').slice(-1000)
+}, null, 2));
+if (!ok)
+    process.exitCode = 1;
+function parseLastJson(text) {
+    const source = String(text || '').trim();
+    if (!source)
+        return {};
+    const starts = [];
+    for (let index = source.indexOf('{'); index >= 0; index = source.indexOf('{', index + 1))
+        starts.push(index);
+    for (let i = starts.length - 1; i >= 0; i -= 1) {
+        try {
+            return JSON.parse(source.slice(starts[i]));
+        }
+        catch {
+            // Continue searching for the outer JSON object; pretty JSON may contain nested objects.
+        }
+    }
+    return {};
+}
+//# sourceMappingURL=doctor-fix-proves-codex-read-check.js.map

package/dist/scripts/doctor-fix-recovers-corrupted-config-check.js

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// Proves `sks doctor --fix` (via repairCodexConfigEperm) RECOVERS an already-corrupted
+// Codex config — both the project config and the global CODEX_HOME config — by hoisting
+// machine-local keys that a prior buggy move absorbed into a trailing table back to the
+// top of the file, restoring a loadable config.toml. Also proves the structural repair
+// is a no-op on a healthy config.
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { ensureDistFresh, root as repoRoot } from './lib/ensure-dist-fresh.js';
+const freshness = ensureDistFresh({ rebuild: true });
+if (!freshness.ok)
+    fail('dist_not_fresh', { freshness });
+const distUrl = (rel) => pathToFileURL(path.join(repoRoot, 'dist', rel)).href;
+const policy = await import(distUrl('core/codex/codex-project-config-policy.js'));
+const eperm = await import(distUrl('core/codex/codex-config-eperm-repair.js'));
+const results = [];
+// Corruption signature: machine-local keys absorbed into the trailing env table.
+const corrupted = [
+    '[mcp_servers.xai-grok]',
+    'command = "npx"',
+    '',
+    '[mcp_servers.xai-grok.env]',
+    'XAI_API_KEY = "xai-123"',
+    '# SKS moved machine-local Codex config from .codex/config.toml at 2026-05-29T00:00:00Z',
+    'model_provider = "codex-lb"',
+    'notify = ["notify-send", "SKS"]',
+    ''
+].join('\n');
+// helper: top-level key index vs first table index
+function keyBeforeFirstTable(text, key) {
+    const lines = text.split('\n');
+    const firstTable = lines.findIndex((l) => /^\s*\[/.test(l));
+    const keyIdx = lines.findIndex((l) => new RegExp(`^\\s*${key}\\s*=`).test(l));
+    return keyIdx >= 0 && firstTable >= 0 && keyIdx < firstTable;
+}
+function envTableHasMachineKey(text) {
+    // model_provider/notify must NOT appear after the env header
+    return /\[mcp_servers\.xai-grok\.env\][\s\S]*\b(model_provider|notify)\s*=/.test(text);
+}
+// --- Case 1: standalone structural repair hoists keys back to root ---
+{
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-struct-'));
+    const cfg = path.join(dir, 'config.toml');
+    await fs.writeFile(cfg, corrupted);
+    const rep = await policy.repairCodexConfigStructure(cfg, { apply: true });
+    const after = await fs.readFile(cfg, 'utf8');
+    const ok = rep.changed === true &&
+        rep.applied === true &&
+        rep.hoisted_keys.includes('model_provider') &&
+        rep.hoisted_keys.includes('notify') &&
+        keyBeforeFirstTable(after, 'model_provider') &&
+        keyBeforeFirstTable(after, 'notify') &&
+        !envTableHasMachineKey(after) &&
+        /XAI_API_KEY = "xai-123"/.test(after) &&
+        rep.backup_path &&
+        rep.parse_smoke.ok === true;
+    results.push({ case: 'structure_repair_hoists_keys', ok, hoisted: rep.hoisted_keys, status: rep.status, after });
+}
+// --- Case 2: structural repair is a no-op on a healthy config ---
+{
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-struct-ok-'));
+    const cfg = path.join(dir, 'config.toml');
+    const healthy = [
+        'model_provider = "codex-lb"',
+        'notify = ["notify-send", "SKS"]',
+        '',
+        '[mcp_servers.xai-grok.env]',
+        'XAI_API_KEY = "xai-123"',
+        '',
+        '[profiles.sks-mad-high]',
+        'model_provider = "codex-lb"',
+        'model_reasoning_effort = "high"',
+        ''
+    ].join('\n');
+    await fs.writeFile(cfg, healthy);
+    const rep = await policy.repairCodexConfigStructure(cfg, { apply: true });
+    const after = await fs.readFile(cfg, 'utf8');
+    // profiles.* model_provider must be preserved inside the profile (NOT hoisted).
+    const profileIntact = /\[profiles\.sks-mad-high\][\s\S]*model_provider = "codex-lb"/.test(after);
+    const ok = rep.changed === false && rep.status === 'structure_ok' && profileIntact;
+    results.push({ case: 'structure_repair_noop_on_healthy', ok, status: rep.status, profile_intact: profileIntact });
+}
+// --- Case 3: doctor --fix recovers the GLOBAL CODEX_HOME config end-to-end ---
+{
+    const fixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fix-'));
+    const codexHome = path.join(fixture, 'home', '.codex');
+    await fs.mkdir(codexHome, { recursive: true });
+    await fs.writeFile(path.join(codexHome, 'config.toml'), corrupted);
+    // Project has only a benign config so the project path is healthy.
+    await fs.mkdir(path.join(fixture, '.codex'), { recursive: true });
+    await fs.writeFile(path.join(fixture, '.codex', 'config.toml'), 'sandbox_mode = "workspace-write"\n');
+    const report = await eperm.repairCodexConfigEperm(fixture, {
+        fix: true,
+        codexHome,
+        // no real codex needed; structural repair runs regardless
+        actualCodex: false,
+        codexProbe: false,
+        writeReport: false
+    });
+    const homeAfter = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
+    const homeRepair = (report.structure_repairs || []).find((r) => r.scope === 'codex_home');
+    const ok = Boolean(homeRepair) &&
+        homeRepair.applied === true &&
+        homeRepair.hoisted_keys.includes('model_provider') &&
+        homeRepair.hoisted_keys.includes('notify') &&
+        keyBeforeFirstTable(homeAfter, 'model_provider') &&
+        keyBeforeFirstTable(homeAfter, 'notify') &&
+        !envTableHasMachineKey(homeAfter);
+    results.push({ case: 'doctor_fix_recovers_codex_home', ok, home_repair: homeRepair, home_after: homeAfter });
+}
+const ok = results.every((r) => r.ok);
+console.log(JSON.stringify({ schema: 'sks.doctor-fix-recovers-corrupted-config-check.v1', ok, results }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+function fail(blocker, detail) {
+    console.log(JSON.stringify({ schema: 'sks.doctor-fix-recovers-corrupted-config-check.v1', ok: false, blocker, detail }, null, 2));
+    process.exit(1);
+}
+//# sourceMappingURL=doctor-fix-recovers-corrupted-config-check.js.map

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { repairCodexAppFastUi } from '../core/codex-app/codex-app-fast-ui-repair.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fast-ui-'));
+const codexHome = path.join(root, 'home', '.codex');
+await fs.mkdir(path.join(root, '.codex'), { recursive: true });
+await fs.mkdir(codexHome, { recursive: true });
+await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model_provider = "codex-lb"\n');
+await fs.writeFile(path.join(codexHome, 'config.toml'), '# SKS forced fast UI during legacy install\nmodel_provider = "codex-lb"\nservice_tier = "fast"\n[features]\nfast_mode = false # user disabled, must remain untouched\n\n[profiles.sks-fast-high]\nmodel = "gpt-5.5"\nservice_tier = "fast"\n\n[model_providers.codex-lb]\nname = "OpenAI"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = false\n');
+const plan = await repairCodexAppFastUi(root, { codexHome, apply: false });
+const repaired = await repairCodexAppFastUi(root, { codexHome, apply: true });
+const projectAfter = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
+const homeAfter = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
+const homeTopLevel = homeAfter.split(/\n\s*\[/)[0] || '';
+const backups = repaired.actions.filter((action) => action.changed).map((action) => action.backup_path).filter(Boolean);
+const unsafeRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fast-ui-unsafe-'));
+const unsafeCodexHome = path.join(unsafeRoot, 'home', '.codex');
+await fs.mkdir(path.join(unsafeRoot, '.codex'), { recursive: true });
+await fs.mkdir(unsafeCodexHome, { recursive: true });
+await fs.writeFile(path.join(unsafeCodexHome, 'config.toml'), 'service_tier = "standard"\n');
+const unsafePlan = await repairCodexAppFastUi(unsafeRoot, { codexHome: unsafeCodexHome, apply: false });
+const ok = plan.fast_selector === 'manual_action_required'
+    && plan.safe_auto_apply === true
+    && repaired.fast_selector === 'repaired'
+    && repaired.safe_auto_apply === true
+    && backups.length >= 2
+    && !/model_provider\s*=/.test(projectAfter)
+    && !/service_tier\s*=/.test(homeTopLevel)
+    && /fast_mode = false/.test(homeAfter)
+    && /model_provider = "codex-lb"/.test(homeAfter)
+    && /\[profiles\.sks-fast-high\]/.test(homeAfter)
+    && /\[profiles\.sks-fast-high\][\s\S]*service_tier = "fast"/.test(homeAfter)
+    && /\[model_providers\.codex-lb\]/.test(homeAfter)
+    && unsafePlan.requires_confirmation === true
+    && unsafePlan.safe_auto_apply === false;
+emit({ schema: 'sks.doctor-fixes-codex-app-fast-ui-check.v1', ok, plan, repaired, unsafe_plan: unsafePlan, project_after: projectAfter, home_after: homeAfter, blockers: ok ? [] : ['doctor_fixes_codex_app_fast_ui_check_failed'] });
+function emit(report) {
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=doctor-fixes-codex-app-fast-ui-check.js.map

package/dist/scripts/doctor-native-capability-repair-blackbox.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
+import path from 'node:path';
+const repairableRoot = await makeTempRoot('sks-doctor-native-repairable-');
+process.env.SKS_CHROME_EXTENSION_READY = '1';
+process.env.SKS_COMPUTER_USE_CAPABILITY = 'verified';
+const repairable = await repairNativeCapabilities({ root: repairableRoot, fix: true, yes: true, fixture: 'all-repairable' });
+delete process.env.SKS_CHROME_EXTENSION_READY;
+delete process.env.SKS_COMPUTER_USE_CAPABILITY;
+const manualRoot = await makeTempRoot('sks-doctor-native-manual-');
+const manual = await repairNativeCapabilities({ root: manualRoot, fix: true, yes: true, fixture: 'manual-required' });
+const screenshotBlockedRoot = await makeTempRoot('sks-doctor-native-screenshot-blocked-');
+await writeText(path.join(screenshotBlockedRoot, '.sneakoscope', 'app-screenshots'), 'not-a-directory');
+const screenshotBlocked = await repairNativeCapabilities({
+    root: screenshotBlockedRoot,
+    fix: false,
+    yes: true,
+    fixture: 'all-repairable',
+    capabilities: ['codex_app_screenshot']
+});
+const corruptContractRoot = await makeTempRoot('sks-doctor-native-contract-repair-');
+await writeText(path.join(corruptContractRoot, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json'), '{"schema":"broken"}\n');
+const corruptContract = await repairNativeCapabilities({
+    root: corruptContractRoot,
+    fix: true,
+    yes: true,
+    fixture: 'manual-required',
+    capabilities: ['saved_artifact_path_contract']
+});
+assertGate(repairable.ok === true, 'repairable fixture must verify after doctor native repair', repairable);
+assertGate(manual.capabilities.some((state) => state.repairability === 'manual-required' && state.after !== 'verified'), 'manual-only fixture must not fake verified success', manual);
+assertGate(manual.capabilities.find((state) => state.id === 'image_generation')?.after !== 'verified', 'image generation auth missing must not verify', manual);
+assertGate(manual.capabilities.find((state) => state.id === 'chrome_web_review')?.after !== 'verified', 'Chrome/web review missing extension must not verify', manual);
+assertGate(manual.capabilities.find((state) => state.id === 'image_path_exposure')?.after === 'degraded', 'saved artifact path fallback must be degraded rather than verified', manual);
+assertGate(screenshotBlocked.capabilities.find((state) => state.id === 'codex_app_screenshot')?.after === 'blocked', 'unwritable screenshot artifact root must block postcheck', screenshotBlocked);
+assertGate(corruptContract.capabilities.find((state) => state.id === 'saved_artifact_path_contract')?.after === 'verified', 'doctor fix must repair corrupt saved artifact path contract', corruptContract);
+emitGate('doctor:native-capability-repair-blackbox');
+//# sourceMappingURL=doctor-native-capability-repair-blackbox.js.map

package/dist/scripts/doctor-native-capability-repair-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { runDoctorNativeCapabilityRepair } from '../core/doctor/doctor-native-capability-repair.js';
+const root = await makeTempRoot('sks-doctor-native-');
+process.env.CODEX_HOME = `${root}/codex-home`;
+const report = await runDoctorNativeCapabilityRepair({ root, fix: false, yes: true, flags: [] });
+assertGate(report.schema === 'sks.doctor-native-capability-repair.v1', 'doctor native repair report schema mismatch', report);
+assertGate(Boolean(report.core_skills) && Boolean(report.skill_dedupe) && Boolean(report.native_capabilities), 'doctor native repair must call core skills, dedupe, and native capability matrix', report);
+emitGate('doctor:native-capability-repair');
+//# sourceMappingURL=doctor-native-capability-repair-check.js.map

package/dist/scripts/doctor-native-repair-output-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const source = readText('src/commands/doctor.ts');
+const matrixSource = readText('src/core/codex-native/native-capability-repair-matrix.ts');
+for (const token of ['SKS Native Capabilities:', 'SKS Skills:', 'Secret preservation:', 'raw secret values: never recorded', 'Chrome/web review', 'manual next actions:', 'uniqueNativeManualActions']) {
+    assertGate(source.includes(token), `doctor output missing token: ${token}`);
+}
+for (const token of [
+    "id === 'image_path_exposure'",
+    "return 'fallback'",
+    "id === 'app_handoff'",
+    "return 'unavailable'"
+]) {
+    assertGate(source.includes(token), `doctor native status mapping missing token: ${token}`);
+}
+assertGate(matrixSource.includes('Install/enable the official Codex Chrome Extension') && matrixSource.includes('Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions'), 'doctor output must retain exact manual actions for native capabilities');
+emitGate('doctor:native-repair-output');
+//# sourceMappingURL=doctor-native-repair-output-check.js.map

package/dist/scripts/doctor-startup-config-repair-blackbox.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+const root = await makeTempRoot('sks-startup-config-blackbox-');
+await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+const report = await repairCodexStartupConfig({ root, apply: true });
+const text = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
+assertGate(report.ok === true, 'startup config blackbox must pass postcheck', report);
+assertGate(!text.includes('message_role_prefix') && /config_file = "\//.test(text), 'startup config blackbox must rewrite to absolute config paths and remove unsupported fields', { text });
+emitGate('doctor:startup-config-repair-blackbox');
+//# sourceMappingURL=doctor-startup-config-repair-blackbox.js.map

package/dist/scripts/doctor-startup-config-repair-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import path from 'node:path';
+const root = await makeTempRoot('sks-startup-config-');
+await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/missing.toml"\nmessage_role_prefix = "legacy"\n');
+const report = await repairCodexStartupConfig({ root, apply: true });
+assertGate(report.ok === true, 'startup config repair must repair stale config_file paths and unsupported fields', report);
+emitGate('doctor:startup-config-repair');
+//# sourceMappingURL=doctor-startup-config-repair-check.js.map

package/dist/scripts/doctor-supabase-mcp-repair-blackbox.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+const root = await makeTempRoot('sks-supabase-mcp-blackbox-');
+delete process.env.SUPABASE_ACCESS_TOKEN;
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nSUPABASE_ACCESS_TOKEN = "env:SUPABASE_ACCESS_TOKEN"\n');
+const unsafe = await repairSupabaseMcp({ root, apply: true });
+assertGate(unsafe.ok === true && unsafe.manual_required === true && unsafe.read_only_migrated === true && unsafe.ready_blocking === false, 'Supabase unsafe write access must be migrated to read-only without passing silently as write-ready', unsafe);
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase_sauron]\ndisabled = true\n');
+const optional = await repairSupabaseMcp({ root, apply: true });
+assertGate(optional.ok === true && optional.disabled === true && optional.disabled_preserved === true, 'optional disabled Supabase config must be preserved', optional);
+emitGate('doctor:supabase-mcp-repair-blackbox');
+//# sourceMappingURL=doctor-supabase-mcp-repair-blackbox.js.map

package/dist/scripts/doctor-supabase-mcp-repair-check.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+import path from 'node:path';
+const root = await makeTempRoot('sks-supabase-mcp-');
+delete process.env.SUPABASE_ACCESS_TOKEN;
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nread_only = true\n');
+const report = await repairSupabaseMcp({ root, apply: true });
+assertGate(report.ok === true && report.manual_required === true && report.ready_blocking === false && report.raw_secret_values_recorded === false, 'Supabase MCP repair must mark unset token as manual for write features without blocking read-only readiness', report);
+assertGate(report.disabled_preserved === false && report.write_scope_requires_confirmation === false, 'Supabase MCP read-only config must not require write confirmation', report);
+emitGate('doctor:supabase-mcp-repair');
+//# sourceMappingURL=doctor-supabase-mcp-repair-check.js.map

package/dist/scripts/doctor-transaction-engine-blackbox.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
+const root = await makeTempRoot('sks-doctor-tx-blackbox-');
+const tx = await runDoctorFixTransaction({
+    root,
+    phases: [
+        { id: 'preflight', run: async () => ({ id: 'preflight', ok: true, artifact_path: `${root}/preflight.json` }) },
+        {
+            id: 'postchecked',
+            run: async () => ({ id: 'postchecked', ok: true }),
+            postcheck: async () => ({ ok: true, warnings: ['postcheck_executed'] })
+        },
+        {
+            id: 'optional_operator',
+            required_for_ready: false,
+            run: async () => ({ id: 'optional_operator', ok: false, manual_required: true, required_for_ready: false, blockers: ['operator_action_required'] })
+        }
+    ],
+    reportPath: null
+});
+const postcheck = doctorRepairPostcheck(tx);
+assertGate(tx.ok === true && postcheck.ok === true, 'doctor transaction blackbox must allow optional manual follow-up without blocking readiness', { tx, postcheck });
+assertGate(tx.phases.some((phase) => phase.warnings.includes('postcheck_executed')), 'doctor transaction blackbox must run phase postchecks', tx);
+assertGate(tx.raw_secret_values_recorded === false, 'doctor transaction blackbox must not record raw secrets', tx);
+emitGate('doctor:transaction-engine-blackbox', { phases: tx.phases.length });
+//# sourceMappingURL=doctor-transaction-engine-blackbox.js.map