sneakoscope 4.8.7 → 5.1.2

package/dist/cli/install-helpers.js

@@ -22,6 +22,7 @@ import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellPr
 import { extractTomlTable, writeCodexConfigGuarded } from '../core/codex/codex-config-guard.js';
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
 import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
+import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
 const CODEX_LB_PROVIDER_NAME = 'openai';
 const CODEX_LB_PROVIDER_ENV_KEY = 'CODEX_LB_API_KEY';
 const CODEX_LB_CANONICAL_FAST_SERVICE_TIER = 'priority';
@@ -90,6 +91,15 @@ export async function postinstall({ bootstrap, args = [] }) {
             console.log(`Codex App Fast mode: skipped (${fastModeRepair.reason}).`);
         else if (fastModeRepair.status === 'failed')
             console.log(`Codex App Fast mode: auto repair failed. Run \`sks setup\`. ${fastModeRepair.error || ''}`.trim());
+        const imagegenRepair = await ensureCodexImagegenDuringInstall();
+        if (imagegenRepair.status === 'ready')
+            console.log('Codex App Image Gen: ready ($imagegen/gpt-image-2 detected).');
+        else if (imagegenRepair.status === 'recovered')
+            console.log('Codex App Image Gen: recovered and re-detected.');
+        else if (imagegenRepair.status === 'blocked')
+            console.log(`Codex App Image Gen: blocked; run \`sks doctor --fix\`. ${(imagegenRepair.blockers || []).join(', ')}`.trim());
+        else if (imagegenRepair.status === 'skipped')
+            console.log(`Codex App Image Gen: skipped (${imagegenRepair.reason}).`);
         const postinstallDoctor = await runPostinstallGlobalDoctorAndMarkPending().catch((err) => ({
             ok: false,
             doctor: null,
@@ -2469,6 +2479,28 @@ async function ensureGlobalGetdesignSkillDuringInstall() {
         return { status: 'present', command: skillsBin };
     return { status: 'failed', command: skillsBin, error: out.trim() || 'skills add failed' };
 }
+export async function ensureCodexImagegenDuringInstall(opts = {}) {
+    if (process.env.SKS_POSTINSTALL_SKIP_IMAGEGEN_REPAIR === '1' || opts.skip === true) {
+        return { status: 'skipped', reason: 'SKS_POSTINSTALL_SKIP_IMAGEGEN_REPAIR' };
+    }
+    const report = await repairCodexImagegen({
+        root: opts.root || process.cwd(),
+        apply: opts.apply !== false,
+        codexBin: opts.codexBin || null,
+        autoInstallCodex: opts.autoInstallCodex === true || process.env.SKS_IMAGEGEN_AUTO_INSTALL_CODEX === '1'
+    }).catch((err) => ({
+        recovered: false,
+        blockers: [err?.message || String(err)],
+        before: null,
+        after: null
+    }));
+    if (report.before?.core_ready === true || (report.after?.core_ready === true && report.attempted === false)) {
+        return { status: 'ready', report };
+    }
+    if (report.recovered === true)
+        return { status: 'recovered', report };
+    return { status: 'blocked', blockers: report.blockers || ['codex_imagegen_unavailable'], report };
+}
 export async function ensureRelatedCliTools(args = []) {
     const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
     const codex = await ensureCodexCliTool({ skip, args });

package/dist/commands/codex-lb.js

@@ -73,6 +73,8 @@ export async function run(command, args = []) {
             codex_lb: status,
             chain,
             evidence,
+            degraded_models: Array.isArray(chain.degraded_models) ? chain.degraded_models : [],
+            quota_low: Boolean(chain.quota_low),
             blockers: [
                 ...(providerReady ? [] : ['codex_lb_provider_contract_drift']),
                 ...(chain.ok

package/dist/commands/doctor.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { projectRoot, exists, formatBytes } from '../core/fsx.js';
 import { flag } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
+import { ui as cliUi } from '../cli/cli-theme.js';
 import { getCodexInfo } from '../core/codex-adapter.js';
 import { rustInfo } from '../core/rust-accelerator.js';
 import { codexAppIntegrationStatus } from '../core/codex-app.js';
@@ -44,9 +45,16 @@ import { writeProjectUpdateMigrationReceipt } from '../core/update/update-migrat
 import { installSksMenuBar } from '../core/codex-app/sks-menubar.js';
 import { sweepSksTempDirs } from '../core/retention.js';
 import { reconcileSkills } from '../core/init/skills.js';
+import { codexHookTrustDoctor } from '../core/codex-hooks/codex-hook-trust-doctor.js';
+import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
+import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
 export async function run(_command, args = []) {
     const root = await projectRoot();
     const doctorFix = flag(args, '--fix');
+    if (!flag(args, '--json')) {
+        cliUi.banner('doctor');
+        cliUi.step(doctorFix ? 'repairing and validating' : 'validating');
+    }
     if (doctorFix)
         return withSecretPreservationGuard(root, 'doctor-fix', () => runDoctor(args, root, doctorFix));
     return runDoctor(args, root, doctorFix);
@@ -302,7 +310,8 @@ async function runDoctor(args = [], root, doctorFix) {
     const sksMenuBar = await installSksMenuBar({
         root,
         apply: doctorFix,
-        launch: doctorFix
+        launch: doctorFix,
+        quiet: machineOnly || flag(args, '--json')
     }).catch((err) => ({
         schema: 'sks.codex-app-sks-menubar.v1',
         ok: false,
@@ -415,10 +424,22 @@ async function runDoctor(args = [], root, doctorFix) {
             raw_secret_values_recorded: false
         }))
         : null;
+    const hookTrustRepair = doctorFix && doctorPhaseIds.includes('hook_trust_repair')
+        ? await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true }).catch((err) => ({
+            schema: 'sks.codex-hook-trust-doctor.v2',
+            ok: false,
+            actual: true,
+            blockers: [`hook_trust_repair_failed:${err?.message || String(err)}`],
+            warnings: [],
+            repair_actions: ['sks codex trust-doctor --fix --managed --actual']
+        }))
+        : null;
     const doctorFixTransaction = doctorFix
         ? await runDoctorFixTransaction({
             root,
             dirtyPlan: doctorDirtyPlan,
+            json: flag(args, '--json'),
+            machineOnly,
             phases: [
                 {
                     id: 'setup',
@@ -488,6 +509,17 @@ async function runDoctor(args = [], root, doctorFix) {
                         rollback_evidence: 'optional_supabase_no_ready_mutation_required'
                     })
                 },
+                {
+                    id: 'hook_trust_repair',
+                    run: async () => ({
+                        id: 'hook_trust_repair',
+                        ok: hookTrustRepair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: hookTrustRepair?.blockers || [],
+                        warnings: hookTrustRepair?.warnings || [],
+                        rollback_evidence: hookTrustRepair?.fixed?.managed_hook_file || 'codex_hook_trust_repair_idempotent'
+                    })
+                },
                 {
                     id: 'sks_menubar',
                     required_for_ready: false,
@@ -572,10 +604,29 @@ async function runDoctor(args = [], root, doctorFix) {
     const globalSksInstallCleanup = flag(args, '--fix') && !flag(args, '--local-only')
         ? await cleanDuplicateGlobalSksInstalls({ root, fix: true }).catch((err) => ({ schema: 'sks.global-sks-install-cleanup.v1', ok: false, fix: true, error: err?.message || String(err), blockers: ['global_sks_install_cleanup_exception'] }))
         : null;
-    const { detectImagegenCapability } = await import('../core/imagegen/imagegen-capability.js');
-    const imagegen = deepDiagnostics
-        ? await detectImagegenCapability({ codexBin: codexBin || undefined }).catch((err) => ({ ok: false, error: err.message, auth_readiness: null }))
-        : { ok: false, skipped: true, auth_readiness: null, warnings: ['imagegen_optional_diagnostic_skipped'] };
+    const imagegen = await detectImagegenCapability({ codexBin: codexBin || undefined }).catch((err) => ({ ok: false, error: err.message, auth_readiness: null, core_ready: false, blockers: ['imagegen_detection_exception'] }));
+    const imagegenRepair = imagegen.core_ready === true
+        ? {
+            schema: 'sks.doctor-imagegen-repair.v1',
+            ok: true,
+            attempted: false,
+            apply: doctorFix,
+            recovered: true,
+            before: imagegen,
+            after: imagegen,
+            steps: [],
+            blockers: [],
+            manual_actions: []
+        }
+        : await repairCodexImagegen({ root, apply: doctorFix, codexBin: codexBin || null }).catch((err) => ({
+            schema: 'sks.doctor-imagegen-repair.v1',
+            ok: false,
+            attempted: true,
+            apply: doctorFix,
+            recovered: false,
+            blockers: [err?.message || String(err)],
+            manual_actions: ['Run `sks doctor --fix --json` after enabling Codex App image_generation.']
+        }));
     const codex0138Capability = deepDiagnostics
         ? await writeCodex0138CapabilityArtifacts(root, { codexBin: codexBin || null }).catch((err) => ({ error: err?.message || String(err), report: null }))
         : { skipped: true, report: null };
@@ -768,6 +819,7 @@ async function runDoctor(args = [], root, doctorFix) {
             auth_readiness: imagegen.auth_readiness || null,
             codex_app_builtin_available: imagegen.codex_app?.available === true
         },
+        imagegen_repair: imagegenRepair,
         codex_0138: {
             capability: codex0138Capability.report || null,
             doctor: codex0138Doctor,
@@ -782,7 +834,7 @@ async function runDoctor(args = [], root, doctorFix) {
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
         skills: skillsReconcile,
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, sks_menubar: sksMenuBar, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup, skills: skillsReconcile, sks_temp_sweep: sksTempSweep }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, imagegen: imagegenRepair, hook_trust: hookTrustRepair, sks_menubar: sksMenuBar, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup, skills: skillsReconcile, sks_temp_sweep: sksTempSweep }
     };
     if (reportFile)
         await writeJsonReportFile(reportFile, result);
@@ -928,6 +980,9 @@ async function runDoctor(args = [], root, doctorFix) {
                 console.log(`  - ${action}`);
         }
     }
+    console.log(`Image Gen repair: ${imagegenRepair.recovered ? 'ok' : imagegenRepair.attempted ? 'blocked' : 'not-needed'}`);
+    for (const action of imagegenRepair.manual_actions || [])
+        console.log(`  - ${action}`);
     const codex0138 = codex0138Capability.report || {};
     console.log('Codex current compatibility:');
     console.log(`  target: rust-v0.142.0`);
@@ -1115,6 +1170,7 @@ function doctorPhaseIdsForProfile(profile) {
         'startup_config_repair',
         'context7_repair',
         'context7_mcp_repair',
+        'hook_trust_repair',
         'command_alias_cleanup'
     ];
     if (profile === 'migration')

package/dist/commands/proof.js

@@ -99,6 +99,7 @@ export async function run(_command, args = []) {
         const result = await writeRouteCompletionProof(root, {
             missionId,
             route: '$SKS',
+            executionClass: 'real',
             status: 'verified_partial',
             evidence,
             summary: {
@@ -119,8 +120,9 @@ export async function run(_command, args = []) {
     if (action === 'smoke') {
         const evidence = await collectProofEvidence(root);
         const result = await writeCompletionProof(root, {
+            execution_class: 'mock_fixture',
             route: '$SKS',
-            status: 'verified_partial',
+            status: 'mock_only',
             summary: {
                 files_changed: evidence.files?.length || 0,
                 commands_run: 1,
@@ -130,8 +132,9 @@ export async function run(_command, args = []) {
             },
             evidence,
             claims: [{ id: 'proof-smoke', status: 'supported', evidence: '.sneakoscope/proof/latest.json' }],
-            unverified: ['Smoke proof is fixture evidence, not a real route completion.']
-        }, { command: { cmd: 'sks proof smoke', status: 'verified_partial' } });
+            unverified: ['Smoke proof is fixture evidence, not a real route completion.'],
+            blockers: ['proof_smoke_fixture_cannot_claim_real_completion']
+        }, { command: { cmd: 'sks proof smoke', status: 'mock_only' } });
         if (flag(args, '--json'))
             return printJson(result);
         console.log(`Completion proof written: ${result.files.latest_json}`);