sneakoscope 4.1.0 → 4.2.0

package/dist/core/update/update-migration-state.js

@@ -1,7 +1,9 @@
 import fsp from 'node:fs/promises';
 import path from 'node:path';
-import { ensureDir, exists, globalSksRoot, nowIso, packageRoot, PACKAGE_VERSION, projectRoot, readJson, runProcess, which, writeJsonAtomic } from '../fsx.js';
-export const UPDATE_MIGRATION_SCHEMA = 'sks.update-migration.v1';
+import { ensureDir, exists, globalSksRoot, nowIso, packageRoot, PACKAGE_VERSION, projectRoot, readJson, runProcess, sha256, which, writeJsonAtomic } from '../fsx.js';
+import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js';
+export const UPDATE_MIGRATION_SCHEMA = 'sks.project-migration-receipt.v2';
+export const INSTALLATION_EPOCH_SCHEMA = 'sks.installation-epoch.v1';
 const ALLOWLIST_COMMANDS = new Set([
     'doctor',
     'postinstall',
@@ -12,16 +14,38 @@ const ALLOWLIST_COMMANDS = new Set([
     'commands',
     'usage',
     'root',
-    'rollback'
+    'rollback',
+    'status',
+    'paths',
+    'codex',
+    'zellij'
 ]);
+export function installationEpochPath() {
+    return path.join(globalSksRoot(), 'update', 'installation-epoch.json');
+}
 export function pendingUpdateMigrationPath() {
-    return path.join(globalSksRoot(), 'update', 'pending-migration.json');
+    return installationEpochPath();
 }
 export function projectUpdateMigrationReceiptPath(root) {
     return path.join(root, '.sneakoscope', 'update', 'migration-receipt.json');
 }
 export async function readPendingUpdateMigration() {
-    return readJson(pendingUpdateMigrationPath(), null).catch(() => null);
+    const epoch = await readInstallationEpoch();
+    if (!epoch)
+        return null;
+    return {
+        schema: UPDATE_MIGRATION_SCHEMA,
+        status: 'pending_project_receipt',
+        sks_version: epoch.sks_version,
+        root: globalSksRoot(),
+        source: epoch.source,
+        generated_at: epoch.installed_at,
+        pending_marker_path: installationEpochPath(),
+        installation_epoch_path: installationEpochPath(),
+        installation_epoch_sha256: installationEpochSha256(epoch),
+        blockers: [],
+        warnings: []
+    };
 }
 export async function readProjectUpdateMigrationReceipt(root) {
     return readJson(projectUpdateMigrationReceiptPath(root), null).catch(() => null);
@@ -30,11 +54,25 @@ export function isUpdateMigrationReceiptCurrent(receipt) {
     return receipt?.schema === UPDATE_MIGRATION_SCHEMA
         && receipt.status === 'current'
         && receipt.sks_version === PACKAGE_VERSION
+        && typeof receipt.installation_epoch_sha256 === 'string'
         && Array.isArray(receipt.blockers)
-        && receipt.blockers.length === 0;
+        && receipt.blockers.length === 0
+        && (!Array.isArray(receipt.required_blockers) || receipt.required_blockers.length === 0);
+}
+export async function readInstallationEpoch() {
+    return readJson(installationEpochPath(), null).catch(() => null);
+}
+export async function ensureInstallationEpoch(source = 'runtime') {
+    const current = await buildInstallationEpoch(source);
+    const existing = await readInstallationEpoch();
+    if (existing && isInstallationEpochCurrent(existing, current))
+        return existing;
+    await writeJsonAtomic(installationEpochPath(), current);
+    return current;
 }
 export async function writePendingUpdateMigration(input) {
-    const pendingPath = pendingUpdateMigrationPath();
+    const epoch = await ensureInstallationEpoch(input.source);
+    const pendingPath = installationEpochPath();
     const receipt = {
         schema: UPDATE_MIGRATION_SCHEMA,
         status: 'pending_project_receipt',
@@ -43,18 +81,25 @@ export async function writePendingUpdateMigration(input) {
         source: input.source,
         generated_at: nowIso(),
         pending_marker_path: pendingPath,
+        installation_epoch_path: pendingPath,
+        installation_epoch_sha256: installationEpochSha256(epoch),
         doctor: input.doctor || null,
+        required_blockers: input.blockers || [],
+        optional_warnings: input.warnings || [],
         blockers: input.blockers || [],
         warnings: input.warnings || []
     };
-    await writeJsonAtomic(pendingPath, receipt);
     return receipt;
 }
 export async function clearPendingUpdateMigration() {
-    await fsp.rm(pendingUpdateMigrationPath(), { force: true }).catch(() => undefined);
+    // v2 keeps a persistent installation epoch; project receipts are compared
+    // independently and one project must not consume global migration state.
 }
 export async function writeProjectUpdateMigrationReceipt(input) {
     const receiptPath = projectUpdateMigrationReceiptPath(input.root);
+    const epoch = await ensureInstallationEpoch(input.source);
+    const requiredBlockers = input.blockers || [];
+    const optionalWarnings = input.warnings || [];
     const receipt = {
         schema: UPDATE_MIGRATION_SCHEMA,
         status: input.status || 'current',
@@ -62,15 +107,19 @@ export async function writeProjectUpdateMigrationReceipt(input) {
         root: input.root,
         source: input.source,
         generated_at: nowIso(),
-        pending_marker_path: pendingUpdateMigrationPath(),
+        project_root_hash: projectRootHash(input.root),
+        installation_epoch_sha256: installationEpochSha256(epoch),
+        project_semantic_hash: await projectSemanticHash(input.root),
+        pending_marker_path: installationEpochPath(),
+        installation_epoch_path: installationEpochPath(),
         doctor: input.doctor || null,
         update_stages: input.updateStages || [],
-        blockers: input.blockers || [],
-        warnings: input.warnings || []
+        required_blockers: requiredBlockers,
+        optional_warnings: optionalWarnings,
+        blockers: requiredBlockers,
+        warnings: optionalWarnings
     };
     await writeJsonAtomic(receiptPath, receipt);
-    if (isUpdateMigrationReceiptCurrent(receipt))
-        await clearPendingUpdateMigration();
     return receipt;
 }
 export async function ensureCurrentMigrationBeforeCommand(input) {
@@ -78,13 +127,14 @@ export async function ensureCurrentMigrationBeforeCommand(input) {
     const command = input.command;
     const root = await projectRoot(input.cwd || process.cwd()).catch(() => path.resolve(input.cwd || process.cwd()));
     const receiptPath = projectUpdateMigrationReceiptPath(root);
-    const pendingPath = pendingUpdateMigrationPath();
+    const pendingPath = installationEpochPath();
     const empty = {
         schema: 'sks.update-migration-gate.v1',
         root,
         command,
         receipt_path: receiptPath,
-        pending_marker_path: pendingPath
+        pending_marker_path: pendingPath,
+        installation_epoch_path: pendingPath
     };
     if (env.SKS_UPDATE_MIGRATION_GATE_DISABLED === '1') {
         return { ...empty, ok: true, status: 'skipped', receipt: null, doctor: null, blockers: [], warnings: ['gate_disabled_by_env'] };
@@ -92,49 +142,57 @@ export async function ensureCurrentMigrationBeforeCommand(input) {
     if (ALLOWLIST_COMMANDS.has(command)) {
         return { ...empty, ok: true, status: 'skipped', receipt: null, doctor: null, blockers: [], warnings: [`allowlisted_command:${command}`] };
     }
-    const [pending, receipt] = await Promise.all([
-        readPendingUpdateMigration(),
+    const [epoch, receipt] = await Promise.all([
+        ensureInstallationEpoch('first-command-gate'),
         readProjectUpdateMigrationReceipt(root)
     ]);
     const requireReceipt = env.SKS_REQUIRE_UPDATE_MIGRATION_RECEIPT === '1';
-    if (!pending && isUpdateMigrationReceiptCurrent(receipt) && !requireReceipt) {
+    if (isProjectReceiptCurrentForEpoch(receipt, epoch) && !requireReceipt) {
         return { ...empty, ok: true, status: 'current', receipt, doctor: null, blockers: [], warnings: [] };
     }
-    if (!pending && !requireReceipt) {
-        return { ...empty, ok: true, status: 'skipped', receipt: receipt || null, doctor: null, blockers: [], warnings: ['no_pending_update_migration'] };
-    }
+    const recheck = requireReceipt
+        ? undefined
+        : async () => {
+            const fresh = await readProjectUpdateMigrationReceipt(root);
+            if (isProjectReceiptCurrentForEpoch(fresh, epoch)) {
+                return { ...empty, ok: true, status: 'current', receipt: fresh, doctor: null, blockers: [], warnings: [] };
+            }
+            return null;
+        };
     return withUpdateMigrationLock(root, empty, async () => {
+        const reportFile = path.join(root, '.sneakoscope', 'update', `doctor-migration-${Date.now()}.json`);
         const doctor = await runPackageLocalDoctor({
             root,
-            args: ['doctor', '--fix', '--json'],
+            args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', reportFile],
             env: {
                 ...env,
                 SKS_UPDATE_MIGRATION_GATE_DISABLED: '1',
                 SKS_DISABLE_UPDATE_CHECK: '1'
             },
-            timeoutMs: 10 * 60 * 1000,
-            maxOutputBytes: 128 * 1024
+            timeoutMs: 15_000,
+            maxOutputBytes: 32 * 1024
         });
         if (!doctor.ok) {
+            const requiredBlockers = doctor.required_blockers.length ? doctor.required_blockers : ['doctor_migration_profile_failed'];
             const blocked = await writeProjectUpdateMigrationReceipt({
                 root,
                 source: 'first-command-gate',
                 status: 'blocked',
                 doctor,
-                blockers: ['update_migration_doctor_failed'],
-                warnings: pending?.warnings || []
+                blockers: requiredBlockers,
+                warnings: doctor.optional_warnings
             });
-            return { ...empty, ok: false, status: 'blocked', receipt: blocked, doctor, blockers: ['update_migration_doctor_failed'], warnings: [] };
+            return { ...empty, ok: false, status: 'blocked', receipt: blocked, doctor, blockers: requiredBlockers, warnings: doctor.optional_warnings };
         }
         const current = await writeProjectUpdateMigrationReceipt({
             root,
             source: 'first-command-gate',
             doctor,
             blockers: [],
-            warnings: pending?.warnings || []
+            warnings: doctor.optional_warnings
         });
         return { ...empty, ok: true, status: 'repaired', receipt: current, doctor, blockers: [], warnings: [] };
-    });
+    }, recheck ? { recheck } : {});
 }
 export async function runPostinstallGlobalDoctorAndMarkPending(input = {}) {
     const env = input.env || process.env;
@@ -148,15 +206,15 @@ export async function runPostinstallGlobalDoctorAndMarkPending(input = {}) {
     }
     const doctor = await runPackageLocalDoctor({
         root: globalSksRoot(),
-        args: ['doctor', '--fix', '--json'],
+        args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', path.join(globalSksRoot(), 'update', `postinstall-doctor-${Date.now()}.json`)],
         env: {
             ...env,
             SKS_UPDATE_MIGRATION_GATE_DISABLED: '1',
             SKS_DISABLE_UPDATE_CHECK: '1',
             SKS_POSTINSTALL_NO_BOOTSTRAP: '1'
         },
-        timeoutMs: 10 * 60 * 1000,
-        maxOutputBytes: 128 * 1024
+        timeoutMs: 15_000,
+        maxOutputBytes: 32 * 1024
     });
     const pending = await writePendingUpdateMigration({
         source: 'postinstall',
@@ -186,6 +244,8 @@ export async function runPackageLocalDoctor(input = {}) {
             args,
             exit_code: null,
             parsed_ok: null,
+            required_blockers: ['missing_package_local_sks_entrypoint'],
+            optional_warnings: [],
             stdout_tail: '',
             stderr_tail: '',
             error: `missing package-local sks entrypoint: ${entrypoint}`
@@ -206,9 +266,14 @@ export async function runPackageLocalDoctor(input = {}) {
         stdout: '',
         stderr: err?.message || String(err)
     }));
-    const parsed = parseDoctorJson(result.stdout);
+    const reportFile = reportFileFromArgs(args);
+    const parsed = reportFile
+        ? await readJson(reportFile, null).catch(() => null)
+        : parseDoctorJson(result.stdout);
     const parsedOk = typeof parsed?.ok === 'boolean' ? parsed.ok : null;
-    const ok = result.code === 0 && parsedOk !== false;
+    const ok = result.code === 0 && (reportFile ? parsedOk === true : parsedOk !== false);
+    const requiredBlockers = extractRequiredBlockers(parsed, ok);
+    const optionalWarnings = extractOptionalWarnings(parsed);
     return {
         schema: 'sks.package-local-doctor-run.v1',
         ok,
@@ -218,9 +283,11 @@ export async function runPackageLocalDoctor(input = {}) {
         args,
         exit_code: result.code ?? null,
         parsed_ok: parsedOk,
+        required_blockers: requiredBlockers,
+        optional_warnings: optionalWarnings,
         stdout_tail: tail(result.stdout || ''),
         stderr_tail: tail(result.stderr || ''),
-        error: ok ? null : tail(result.stderr || result.stdout || 'doctor failed')
+        error: ok ? null : tail(result.stderr || result.stdout || requiredBlockers.join(', ') || 'doctor failed')
     };
 }
 export async function resolveInstalledSksEntrypoint(input = {}) {
@@ -235,27 +302,145 @@ export async function resolveInstalledSksEntrypoint(input = {}) {
     }
     return which('sks');
 }
-async function withUpdateMigrationLock(root, base, fn) {
+const MIGRATION_LOCK_WAIT_MS = 20_000;
+const MIGRATION_LOCK_POLL_MS = 150;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function withUpdateMigrationLock(root, base, fn, options = {}) {
     const lockPath = path.join(root, '.sneakoscope', 'update', 'migration.lock');
     await ensureDir(path.dirname(lockPath));
-    let handle = null;
-    try {
-        handle = await fsp.open(lockPath, 'wx');
-        await handle.writeFile(JSON.stringify({ pid: process.pid, created_at: nowIso(), version: PACKAGE_VERSION }) + '\n', 'utf8');
-        return await fn();
-    }
-    catch (err) {
-        if (err?.code === 'EEXIST') {
+    const recheck = options.recheck ?? null;
+    const deadline = Date.now() + (options.maxWaitMs ?? MIGRATION_LOCK_WAIT_MS);
+    let reapedStale = false;
+    for (;;) {
+        let handle = null;
+        try {
+            handle = await fsp.open(lockPath, 'wx');
+        }
+        catch (err) {
+            if (err?.code !== 'EEXIST') {
+                return { ...base, ok: false, status: 'blocked', receipt: null, doctor: null, blockers: [`update_migration_lock_error:${err?.message || String(err)}`], warnings: [] };
+            }
+            // The lock is held by a concurrent process. Cooperate instead of failing fast:
+            // 1) a sibling may have already completed the migration we need.
+            if (recheck) {
+                const done = await recheck();
+                if (done)
+                    return done;
+            }
+            // 2) reap a genuinely stale lock (dead holder or older than the stale threshold).
+            if (!reapedStale && await removeStaleMigrationLock(lockPath)) {
+                reapedStale = true;
+                continue;
+            }
+            // 3) wait for the in-flight holder to finish, then retry acquisition.
+            if (Date.now() < deadline) {
+                await delay(MIGRATION_LOCK_POLL_MS);
+                continue;
+            }
+            // 4) gave up waiting on a live holder.
             return { ...base, ok: false, status: 'blocked', receipt: null, doctor: null, blockers: ['update_migration_lock_held'], warnings: [] };
         }
-        return { ...base, ok: false, status: 'blocked', receipt: null, doctor: null, blockers: [`update_migration_lock_error:${err?.message || String(err)}`], warnings: [] };
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-        if (handle)
+        try {
+            await handle.writeFile(JSON.stringify({ pid: process.pid, created_at: nowIso(), version: PACKAGE_VERSION }) + '\n', 'utf8');
+            return await fn();
+        }
+        catch (err) {
+            return { ...base, ok: false, status: 'blocked', receipt: null, doctor: null, blockers: [`update_migration_lock_error:${err?.message || String(err)}`], warnings: [] };
+        }
+        finally {
+            await handle.close().catch(() => undefined);
             await fsp.rm(lockPath, { force: true }).catch(() => undefined);
+        }
     }
 }
+async function removeStaleMigrationLock(lockPath) {
+    const raw = await fsp.readFile(lockPath, 'utf8').catch(() => '');
+    let parsed = null;
+    try {
+        parsed = raw.trim() ? JSON.parse(raw) : null;
+    }
+    catch {
+        parsed = null;
+    }
+    const pid = Number(parsed?.pid || 0);
+    const createdMs = parsed?.created_at ? Date.parse(parsed.created_at) : 0;
+    const ageMs = Number.isFinite(createdMs) && createdMs > 0 ? Date.now() - createdMs : Number.POSITIVE_INFINITY;
+    const stale = !pidAlive(pid) || ageMs > 120_000;
+    if (!stale)
+        return false;
+    await fsp.rm(lockPath, { force: true }).catch(() => undefined);
+    return true;
+}
+function pidAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err?.code === 'EPERM';
+    }
+}
+async function buildInstallationEpoch(source) {
+    const root = packageRoot();
+    const realpath = await fsp.realpath(root).catch(() => root);
+    return {
+        schema: INSTALLATION_EPOCH_SCHEMA,
+        sks_version: PACKAGE_VERSION,
+        package_realpath: realpath,
+        build_sha256: await packageBuildSha256(root),
+        managed_asset_version: MANAGED_ASSET_VERSION,
+        installed_at: nowIso(),
+        source
+    };
+}
+function isInstallationEpochCurrent(existing, current) {
+    return existing.schema === INSTALLATION_EPOCH_SCHEMA
+        && existing.sks_version === current.sks_version
+        && existing.package_realpath === current.package_realpath
+        && existing.build_sha256 === current.build_sha256
+        && existing.managed_asset_version === current.managed_asset_version;
+}
+async function packageBuildSha256(root) {
+    const candidates = [
+        path.join(root, 'dist', 'build-manifest.json'),
+        path.join(root, 'package.json')
+    ];
+    const rows = await Promise.all(candidates.map(async (file) => {
+        const text = await fsp.readFile(file, 'utf8').catch(() => '');
+        return { file: path.relative(root, file), sha256: text ? sha256(text) : 'missing' };
+    }));
+    return sha256(JSON.stringify(rows));
+}
+function installationEpochSha256(epoch) {
+    return sha256(JSON.stringify({
+        schema: epoch.schema,
+        sks_version: epoch.sks_version,
+        package_realpath: epoch.package_realpath,
+        build_sha256: epoch.build_sha256,
+        managed_asset_version: epoch.managed_asset_version
+    }));
+}
+function isProjectReceiptCurrentForEpoch(receipt, epoch) {
+    return isUpdateMigrationReceiptCurrent(receipt)
+        && receipt?.installation_epoch_sha256 === installationEpochSha256(epoch);
+}
+function projectRootHash(root) {
+    return sha256(path.resolve(root));
+}
+async function projectSemanticHash(root) {
+    const configPath = path.join(root, '.codex', 'config.toml');
+    const config = await fsp.readFile(configPath, 'utf8').catch(() => '');
+    return sha256(JSON.stringify({
+        root: projectRootHash(root),
+        sks_version: PACKAGE_VERSION,
+        managed_asset_version: MANAGED_ASSET_VERSION,
+        codex_config_sha256: config ? sha256(config) : 'missing'
+    }));
+}
 function parseDoctorJson(text) {
     const trimmed = String(text || '').trim();
     if (!trimmed)
@@ -273,6 +458,36 @@ function parseDoctorJson(text) {
     }
     return null;
 }
+function reportFileFromArgs(args) {
+    const index = args.indexOf('--report-file');
+    return index >= 0 && args[index + 1] ? String(args[index + 1]) : null;
+}
+function extractRequiredBlockers(parsed, ok) {
+    if (ok)
+        return [];
+    const candidates = [
+        parsed?.ready?.blockers,
+        parsed?.ready?.repair_readiness?.blockers,
+        parsed?.doctor_fix_postcheck?.required_blockers,
+        parsed?.doctor_fix_postcheck?.blockers,
+        parsed?.blockers
+    ];
+    for (const value of candidates) {
+        if (Array.isArray(value) && value.length)
+            return [...new Set(value.map(String).filter(Boolean))];
+    }
+    return [];
+}
+function extractOptionalWarnings(parsed) {
+    const candidates = [
+        parsed?.ready?.warnings,
+        parsed?.ready?.repair_readiness?.warnings,
+        parsed?.doctor_fix_postcheck?.optional_warnings,
+        parsed?.doctor_native_capability?.optional_warnings,
+        parsed?.warnings
+    ];
+    return [...new Set(candidates.flatMap((value) => Array.isArray(value) ? value.map(String) : []).filter(Boolean))];
+}
 function tail(text, max = 4096) {
     const raw = String(text || '');
     return raw.length <= max ? raw : raw.slice(raw.length - max);

package/dist/core/update-check.js

@@ -191,10 +191,10 @@ export async function runSksUpdateNow(options = {}) {
     }
     const oldVersionDoctor = await runPackageLocalDoctor({
         root: projectReceiptRoot,
-        args: ['doctor', '--json'],
+        args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', path.join(projectReceiptRoot, '.sneakoscope', 'update', `old-version-doctor-${Date.now()}.json`)],
         env,
-        timeoutMs: options.timeoutMs ?? 10 * 60 * 1000,
-        maxOutputBytes: options.maxOutputBytes ?? 128 * 1024
+        timeoutMs: 15_000,
+        maxOutputBytes: 32 * 1024
     });
     stage('old_version_doctor_preflight', oldVersionDoctor.ok, oldVersionDoctor.status, { entrypoint: oldVersionDoctor.entrypoint, exit_code: oldVersionDoctor.exit_code });
     if (!oldVersionDoctor.ok && env.SKS_UPDATE_SKIP_OLD_DOCTOR_PREFLIGHT !== '1') {
@@ -292,10 +292,10 @@ export async function runSksUpdateNow(options = {}) {
             newVersionDoctor = await runPackageLocalDoctor({
                 root: globalSksRootPath(),
                 entrypoint: newBinary,
-                args: ['doctor', '--json'],
+                args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', path.join(globalSksRootPath(), 'update', `new-version-doctor-${Date.now()}.json`)],
                 env,
-                timeoutMs: options.timeoutMs ?? 10 * 60 * 1000,
-                maxOutputBytes: options.maxOutputBytes ?? 128 * 1024
+                timeoutMs: 15_000,
+                maxOutputBytes: 32 * 1024
             });
             stage('new_version_global_doctor', newVersionDoctor.ok, newVersionDoctor.status, { entrypoint: newBinary, exit_code: newVersionDoctor.exit_code });
         }

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.1.0';
+export const PACKAGE_VERSION = '4.2.0';
 //# sourceMappingURL=version.js.map

package/dist/core/zellij/zellij-launcher.js

@@ -47,7 +47,7 @@ export async function launchZellijLayout(opts = {}) {
         && capability.status === 'ok'
         && process.env.SKS_ZELLIJ_KEEP_SESSION !== '1';
     const sessionReset = resetSession
-        ? await runZellij(['kill-session', sessionName], { cwd: opts.cwd || root, timeoutMs: 5000, optional: true })
+        ? await runZellij(['kill-session', sessionName], { cwd: opts.cwd || root, timeoutMs: 200, optional: true })
         : null;
     const launch = opts.dryRun === true || capability.status !== 'ok'
         ? null
@@ -65,10 +65,21 @@ export async function launchZellijLayout(opts = {}) {
     };
     if (layout.main_pane_kind === 'codex_interactive')
         paneProofOpts.expectedMainCommandIncludes = 'codex';
-    const paneProof = await writeZellijPaneProof(root, paneProofOpts).catch((err) => ({
-        ok: false,
-        blockers: [`zellij_pane_proof_exception:${err?.message || String(err)}`]
-    }));
+    const strictPaneProof = opts.requireZellij === true || opts.dryRun === true || process.env.SKS_ZELLIJ_STRICT_PANE_PROOF === '1';
+    const paneProof = strictPaneProof
+        ? await writeZellijPaneProof(root, paneProofOpts).catch((err) => ({
+            ok: false,
+            blockers: [`zellij_pane_proof_exception:${err?.message || String(err)}`]
+        }))
+        : {
+            ok: true,
+            status: 'deferred_background',
+            blockers: [],
+            warnings: ['zellij_pane_proof_deferred_until_after_attach']
+        };
+    if (!strictPaneProof && opts.dryRun !== true && capability.status === 'ok') {
+        void writeZellijPaneProof(root, paneProofOpts).catch(() => undefined);
+    }
     if (launch?.create_background) {
         launch.create_background = normalizeExistingZellijSession(sessionName, launch.create_background);
     }
@@ -113,6 +124,7 @@ export async function launchZellijLayout(opts = {}) {
         clipboard_mouse_mode: clipboard.mouse_mode,
         pane_proof_path: path.join(root, '.sneakoscope', 'missions', missionId, 'zellij-pane-proof.json'),
         pane_proof: paneProof,
+        pane_proof_background: !strictPaneProof,
         dry_run: opts.dryRun === true,
         capability,
         launch,

package/dist/core/zellij/zellij-slot-column-anchor.js

@@ -115,7 +115,11 @@ function renderTelemetrySlotRows(snapshot) {
     });
 }
 function isMadDbActive(capability) {
-    if (!capability || capability.enabled !== true || capability.consumed === true)
+    if (!capability)
+        return false;
+    if (capability.schema === 'sks.mad-db-capability.v2' && !['transport_ready', 'active'].includes(String(capability.status || '')))
+        return false;
+    if (capability.schema !== 'sks.mad-db-capability.v2' && (capability.enabled !== true || capability.consumed === true))
         return false;
     const expires = Date.parse(capability.expires_at || '');
     return Number.isFinite(expires) && expires > Date.now();

package/dist/scripts/check-dist-runtime.js

@@ -8,6 +8,7 @@ import { sourceSnapshot } from './lib/ensure-dist-fresh.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const distRoot = path.join(root, 'dist');
 const issues = [];
+const contractOnlyMarker = 'contract' + '_only';
 if (!fs.existsSync(distRoot))
     issues.push('dist_missing');
 requiredFile('dist/bin/sks.js');
@@ -63,8 +64,8 @@ if (fs.existsSync(distRoot)) {
         if (!rel.endsWith('.js'))
             continue;
         const text = fs.readFileSync(file, 'utf8');
-        if (text.includes('contract_only'))
-            issues.push(`contract_only:${rel}`);
+        if (text.includes(contractOnlyMarker))
+            issues.push(`${contractOnlyMarker}:${rel}`);
         if (/from\s+['"][^'"]+\.mjs['"]|import\(\s*['"][^'"]+\.mjs['"]\s*\)/.test(text)) {
             issues.push(`imports_mjs:${rel}`);
         }

package/dist/scripts/codex-0142-manifest-check.js

@@ -8,11 +8,12 @@ const manifest = parity.manifest;
 const dep = pkg.dependencies?.['@openai/codex-sdk'];
 const lockSdk = lock.packages?.['node_modules/@openai/codex-sdk']?.version;
 const lockCli = lock.packages?.['node_modules/@openai/codex']?.version;
+const lockRootVersion = lock.packages?.['']?.version || lock.version;
 assertGate(parity.ok, 'Codex release manifest TS/JSON parity must hold', parity);
 assertGate(dep === manifest.sdkVersion, 'package.json must pin @openai/codex-sdk exactly to manifest sdkVersion', { dep, sdkVersion: manifest.sdkVersion });
 assertGate(lockSdk === manifest.sdkVersion, 'package-lock must resolve @openai/codex-sdk to manifest sdkVersion', { lockSdk, sdkVersion: manifest.sdkVersion });
 assertGate(lockCli === manifest.requiredCliVersion, 'package-lock must resolve @openai/codex to manifest requiredCliVersion', { lockCli, requiredCliVersion: manifest.requiredCliVersion });
-assertGate(pkg.version === '4.1.0', 'package version must be 4.1.0', { version: pkg.version });
+assertGate(pkg.version === lockRootVersion, 'package version must match package-lock root version', { version: pkg.version, lockRootVersion });
 emitGate('codex:0142:manifest', {
     manifest_sha256: parity.manifest_sha256,
     target_tag: manifest.targetTag,

package/dist/scripts/config-managed-merge-callsite-coverage-check.js

@@ -113,6 +113,12 @@ const ALLOWLIST = [
         pattern: /writeJsonAtomic|writeTextAtomic/,
         reason: 'migration journal writes hashes and rollback metadata, not raw secret config values',
         expires: '3.2.0'
+    },
+    {
+        file: 'src/core/providers/glm/naruto/glm-naruto-trace.ts',
+        pattern: /mission-result\.json|sanitizeArtifact/,
+        reason: 'GLM Naruto trace writer persists sanitized mission-result proof artifacts, not raw env secret files',
+        expires: '4.2.0'
     }
 ];
 const sources = listSourceFiles().map((file) => ({

package/dist/scripts/doctor-dirty-plan-check.js

@@ -4,6 +4,6 @@ import { importDist } from './sks-1-18-gate-lib.js';
 const tmp = await makeTempRoot('doctor-dirty-plan-');
 const mod = await importDist('core/doctor/doctor-dirty-planner.js');
 const plan = mod.planDoctorDirtyRepair(tmp, ['setup', 'context7_repair']);
-assertGate(plan.schema === 'sks.doctor-dirty-plan.v1' && plan.dirty_count === 2, 'dirty planner must mark missing markers dirty', plan);
+assertGate(plan.schema === 'sks.doctor-dirty-plan.v2' && plan.dirty_count === 2, 'dirty planner must mark missing markers dirty', plan);
 emitGate('doctor:dirty-plan', { dirty: plan.dirty_count });
 //# sourceMappingURL=doctor-dirty-plan-check.js.map

package/dist/scripts/doctor-transaction-engine-check.js

@@ -27,5 +27,6 @@ const postcheck = doctorRepairPostcheck(tx);
 assertGate(rollbackCalled && tx.rollback_performed === true, 'doctor transaction runner must execute rollback hooks for failed phases', tx);
 assertGate(tx.ok === false && postcheck.ok === false, 'required failed phase must block readiness', { tx, postcheck });
 assertGate(tx.phases.find((phase) => phase.id === 'optional_manual')?.required_for_ready === false, 'optional manual phase must be explicitly marked', tx);
+assertGate(!postcheck.blockers.includes('operator_action_required') && postcheck.optional_warnings.includes('optional:operator_action_required'), 'optional blockers must stay out of required blocker output', { tx, postcheck });
 emitGate('doctor:transaction-engine', { phases: tx.phases.length });
 //# sourceMappingURL=doctor-transaction-engine-check.js.map