sneakoscope 4.8.7 → 5.3.0

package/config/bench-baseline.json

@@ -0,0 +1,7 @@
+{
+  "schema": "sks.coding-bench-baseline.v1",
+  "baseline_version": "5.0.0",
+  "pass_rate": 0,
+  "min_pass_rate": 0,
+  "notes": "Real model coding bench is skipped with no_backend unless SKS_RUN_CODING_BENCH_REAL=1 and a backend credential is present."
+}

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.8.7"
+version = "5.3.0"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.8.7"
+version = "5.3.0"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.8.7"),
+        Some("--version") => println!("sks-rs 5.3.0"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/install.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+const args = process.argv.slice(2);
+const command = args.find((arg) => !arg.startsWith('-')) || 'install';
+const autonomous = args.includes('--no-tui') || args.includes('--yes') || args.includes('-y');
+function run(cmd, cmdArgs) {
+    const result = spawnSync(cmd, cmdArgs, { stdio: 'inherit' });
+    return result.status ?? 1;
+}
+if (!['install', 'setup', 'bootstrap'].includes(command)) {
+    console.error('Usage: npx sneakoscope install [--yes|--no-tui]');
+    process.exit(2);
+}
+console.log('SKS installer - proof-first Codex harness');
+const already = spawnSync('sks', ['--version'], { encoding: 'utf8' });
+if (already.status !== 0) {
+    console.log('> installing global package (npm i -g sneakoscope)...');
+    if (run('npm', ['install', '-g', 'sneakoscope']) !== 0) {
+        console.error('global install failed - check npm permissions');
+        process.exit(1);
+    }
+}
+console.log('> repairing/validating environment (sks doctor --fix)...');
+if (run('sks', ['doctor', '--fix', ...(autonomous ? ['--yes'] : [])]) !== 0) {
+    console.error('doctor reported blockers - see report above');
+    process.exit(1);
+}
+console.log(`
+SKS ready. 다음 3개만 기억하세요 (Codex 입력창에서):
+   $Plan "무엇을 만들지"     - 계획만 세움 (코드 안 건드림)
+   $Work                     - 계획을 증거 기반으로 실행
+   $Swarm "task"             - 동적 병렬 스웜 + 기계 검증 루프
+   실시간 화면: sks ui  (웹 대시보드) / zellij 세션은 자동
+`);
+//# sourceMappingURL=install.js.map

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.8.7';
+const FAST_PACKAGE_VERSION = '5.3.0';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/cli-theme.js

@@ -0,0 +1,51 @@
+import { PACKAGE_VERSION } from '../core/version.js';
+import { ANSI_CODES, paint, resolveZellijTheme } from '../core/zellij/zellij-theme.js';
+const theme = resolveZellijTheme();
+export const ui = {
+    banner(cmd) {
+        console.log(paint(theme, ANSI_CODES.dim, `SKS ${PACKAGE_VERSION} · ${cmd}`));
+    },
+    ok(msg) {
+        console.log(`${paint(theme, ANSI_CODES.green, '✔')} ${msg}`);
+    },
+    warn(msg) {
+        console.log(`${paint(theme, ANSI_CODES.yellow, '▲')} ${msg}`);
+    },
+    fail(msg) {
+        console.log(`${paint(theme, ANSI_CODES.red, '✖')} ${msg}`);
+    },
+    step(msg) {
+        console.log(`${paint(theme, ANSI_CODES.dim, '>')} ${msg}`);
+    },
+    kv(k, v) {
+        console.log(`  ${paint(theme, ANSI_CODES.dim, k.padEnd(18))} ${v}`);
+    },
+    table(rows) {
+        if (!rows.length)
+            return;
+        const widths = rows[0]?.map((_cell, index) => Math.max(...rows.map((row) => String(row[index] || '').length))) || [];
+        for (const [rowIndex, row] of rows.entries()) {
+            const line = row.map((cell, index) => String(cell || '').padEnd(widths[index] || 0)).join('  ').trimEnd();
+            console.log(rowIndex === 0 ? paint(theme, ANSI_CODES.dim, line) : line);
+        }
+    }
+};
+export function withHeartbeat(label, work, opts = {}) {
+    if (process.env.SKS_UPDATE_QUIET || !process.stderr.isTTY)
+        return work;
+    const started = Date.now();
+    let index = 0;
+    const frames = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+    const timer = setInterval(() => {
+        const elapsed = Date.now() - started;
+        const seconds = Math.floor(elapsed / 1000);
+        const warn = opts.warnAfterMs && elapsed > opts.warnAfterMs ? '  (still working; this can be normal)' : '';
+        process.stderr.write(`\r  ${frames[index++ % frames.length]} ${label} ... ${seconds}s${warn}   `);
+    }, 120);
+    timer.unref?.();
+    return work.finally(() => {
+        clearInterval(timer);
+        process.stderr.write(`\r${' '.repeat(80)}\r`);
+    });
+}
+//# sourceMappingURL=cli-theme.js.map

package/dist/cli/command-registry.js

@@ -96,7 +96,13 @@ export const COMMANDS = {
     triwiki: skipMigrationGate(entry('stable', 'Inspect TriWiki index, affected graph, and proof bank', 'dist/core/commands/triwiki-command.js', argsCommand(() => import('../core/commands/triwiki-command.js'), 'triwikiCommand', 'dist/core/commands/triwiki-command.js'))),
     daemon: skipMigrationGate(entry('stable', 'Inspect or warm the local SKS daemon cache', 'dist/core/commands/daemon-command.js', argsCommand(() => import('../core/commands/daemon-command.js'), 'daemonCommand', 'dist/core/commands/daemon-command.js'))),
     run: entry('beta', 'Classify and execute a task through the SKS trust kernel', 'dist/core/commands/run-command.js', argsCommand(() => import('../core/commands/run-command.js'), 'runCommand', 'dist/core/commands/run-command.js')),
+    plan: entry('stable', 'Write a planning-only SKS plan artifact without code edits', 'dist/core/commands/plan-command.js', argsCommand(() => import('../core/commands/plan-command.js'), 'planCommand', 'dist/core/commands/plan-command.js')),
     status: readOnly(entry('stable', 'Show concise active mission and trust status', 'dist/core/commands/status-command.js', argsCommand(() => import('../core/commands/status-command.js'), 'statusCommand', 'dist/core/commands/status-command.js'))),
+    review: entry('stable', 'Review a git diff with machine evidence first', 'dist/core/commands/review-command.js', argsCommand(() => import('../core/commands/review-command.js'), 'reviewCommand', 'dist/core/commands/review-command.js'), {
+        allowedDuringActiveRoute: true,
+        activeRoutePolicy: 'always'
+    }),
+    ui: readOnly(entry('stable', 'Open the localhost SKS swarm dashboard', 'dist/core/commands/ui-command.js', argsCommand(() => import('../core/commands/ui-command.js'), 'uiCommand', 'dist/core/commands/ui-command.js'))),
     root: readOnly(entry('stable', 'Show active SKS root', 'dist/commands/root.js', directCommand(() => import('../commands/root.js'), 'dist/commands/root.js'))),
     update: skipMigrationGate(entry('stable', 'Update the global SKS npm package', 'dist/core/commands/basic-cli.js', subcommand(() => import(basicModule), 'updateCommand', 'dist/core/commands/basic-cli.js', 'now'))),
     uninstall: entry('stable', 'Uninstall SKS global skills, hooks, config, menu bar, and optional project residue', 'dist/core/commands/uninstall-command.js', argsCommand(() => import('../core/commands/uninstall-command.js'), 'uninstallCommand', 'dist/core/commands/uninstall-command.js'), {
@@ -132,9 +138,9 @@ export const COMMANDS = {
     'zellij-viewport-pane': skipMigrationGate(readOnly(entry('beta', 'Render a dynamically bound Zellij worker viewport pane', 'dist/commands/zellij-viewport-pane.js', directCommand(() => import('../commands/zellij-viewport-pane.js'), 'dist/commands/zellij-viewport-pane.js')))),
     'zellij-slot-column-anchor': entry('beta', 'Render the compact SLOTS anchor pane for first-slot-down Zellij stacks', 'dist/commands/zellij-slot-column-anchor.js', directCommand(() => import('../commands/zellij-slot-column-anchor.js'), 'dist/commands/zellij-slot-column-anchor.js')),
     zellij: activeRouteDiagnostic(entry('beta', 'Inspect Zellij runtime status and explain repair (no auto-install)', 'dist/commands/zellij.js', directCommand(() => import('../commands/zellij.js'), 'dist/commands/zellij.js'))),
-    'mad-sks': routeStateMutator(entry('beta', 'MAD-SKS scoped permission modifier', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')), ['mad-sks-gate.json']),
+    'mad-sks': routeStateMutator(entry('beta', 'MAD-SKS scoped permission modifier + SQL-plane execution (merged MAD-DB)', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')), ['mad-sks-gate.json']),
     glm: entry('beta', 'Run GLM 5.2 MAD mode through OpenRouter', 'dist/core/commands/glm-command.js', argsCommand(() => import('../core/commands/glm-command.js'), 'glmCommand', 'dist/core/commands/glm-command.js')),
-    'mad-db': routeStateMutator(entry('beta', 'Run first-class MadDB SQL-plane execution cycles with mission-local Supabase write transport', 'dist/commands/mad-db.js', directCommand(() => import('../commands/mad-db.js'), 'dist/commands/mad-db.js')), ['mad-db-gate.json']),
+    'mad-db': routeStateMutator(entry('beta', 'Deprecated alias for MAD-SKS SQL-plane execution; redirects to sks mad-sks sql|apply-migration', 'dist/commands/mad-db.js', directCommand(() => import('../commands/mad-db.js'), 'dist/commands/mad-db.js')), ['mad-sks-gate.json']),
     'auto-review': entry('beta', 'Manage auto-review profile', 'dist/commands/auto-review.js', directCommand(() => import('../commands/auto-review.js'), 'dist/commands/auto-review.js')),
     'dollar-commands': entry('stable', 'List Codex App dollar commands', 'dist/core/commands/basic-cli.js', basicArgs('dollarCommandsCommand')),
     'fast-mode': entry('stable', 'Toggle SKS Fast mode default for dollar-command routes', 'dist/core/commands/fast-mode-command.js', argsCommand(() => import('../core/commands/fast-mode-command.js'), 'fastModeCommand', 'dist/core/commands/fast-mode-command.js')),
@@ -166,7 +172,7 @@ export const COMMANDS = {
     reasoning: entry('labs', 'Show reasoning route', 'dist/core/commands/basic-cli.js', basicArgs('reasoningCommand')),
     aliases: entry('stable', 'Show command aliases', 'dist/core/commands/basic-cli.js', basicNoArgs('aliasesCommand')),
     selftest: entry('stable', 'Run local mock selftest', 'dist/core/commands/basic-cli.js', basicArgs('selftestCommand')),
-    goal: routeStateMutator(entry('beta', 'Manage Goal bridge workflow', 'dist/core/commands/goal-command.js', subcommand(() => import('../core/commands/goal-command.js'), 'goalCommand', 'dist/core/commands/goal-command.js')), ['goal-gate.json']),
+    goal: routeStateMutator(entry('beta', 'Manage Goal bridge workflow', 'dist/core/commands/goal-command.js', subcommand(() => import('../core/commands/goal-command.js'), 'goalCommand', 'dist/core/commands/goal-command.js')), ['loop-graph-proof.json']),
     'seo-geo-optimizer': entry('beta', 'Run unified SEO/GEO optimizer audit/plan/apply/verify on the search-visibility kernel', 'dist/core/commands/seo-command.js', argsCommand(() => import('../core/commands/seo-command.js'), 'seoGeoOptimizerCommand', 'dist/core/commands/seo-command.js')),
     hook: entry('beta', 'Codex hook entrypoint', 'dist/commands/hook.js', directCommand(() => import('../commands/hook.js'), 'dist/commands/hook.js')),
     profile: entry('labs', 'Inspect/set profile', 'dist/commands/profile.js', directCommand(() => import('../commands/profile.js'), 'dist/commands/profile.js')),
@@ -184,6 +190,7 @@ export const COMMANDS = {
     eval: entry('labs', 'Run eval reports', 'dist/core/commands/eval-command.js', subcommand(() => import('../core/commands/eval-command.js'), 'evalCommand', 'dist/core/commands/eval-command.js', 'run')),
     harness: entry('labs', 'Run harness fixtures', 'dist/core/commands/harness-command.js', subcommand(() => import('../core/commands/harness-command.js'), 'harnessCommand', 'dist/core/commands/harness-command.js', 'fixture')),
     wiki: activeRouteDiagnostic(entry('beta', 'Manage TriWiki and image voxel ledgers', 'dist/commands/wiki.js', directCommand(() => import('../commands/wiki.js'), 'dist/commands/wiki.js'))),
+    memory: entry('beta', 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', 'dist/commands/memory.js', directCommand(() => import('../commands/memory.js'), 'dist/commands/memory.js')),
     gc: activeRouteDiagnostic(entry('labs', 'Compact/prune runtime state', 'dist/core/commands/gc-command.js', gcArgs('gcCommand'))),
     stats: readOnly(entry('labs', 'Show storage stats', 'dist/core/commands/gc-command.js', gcArgs('statsCommand'))),
     features: entry('beta', 'Validate feature registry', 'dist/commands/features.js', directCommand(() => import('../commands/features.js'), 'dist/commands/features.js')),
@@ -202,8 +209,12 @@ export const COMMAND_ALIASES = {
     '--mad': 'mad-sks',
     '--MAD': 'mad-sks',
     '--mad-sks': 'mad-sks',
+    'ux-review': 'image-ux-review',
+    'visual-review': 'image-ux-review',
+    'ui-ux-review': 'image-ux-review',
     '--agent': 'agent',
-    '--naruto': 'naruto'
+    '--naruto': 'naruto',
+    swarm: 'naruto'
 };
 export function commandNames() {
     return Object.keys(COMMANDS).sort();

package/dist/cli/help-fast.js

@@ -5,18 +5,28 @@ export function helpFast() {
     console.log(`SKS
 SNEAKOSCOPE CODEX v${PACKAGE_VERSION}
 
-Usage
+3-pillar frontdoor
 
-  sks
-  sks help [topic]
-  sks commands [--json]
-  sks dollar-commands [--json]
-  sks proof show --json
+  $Plan "task"              plan only; writes .sneakoscope/plans, no code edits
+  $Work                     execute the latest plan with evidence gates
+  $Swarm "task"             dynamic Naruto swarm with machine verification
+
+Local surfaces
+
+  sks ui                    localhost live dashboard
+  sks review --staged       machine-first diff review
+  sks doctor --fix          repair/validate the harness
+
+Discovery
+
+  sks commands [--json]     all commands
+  sks dollar-commands       all Codex App $ routes
+  sks help [topic]          focused help
 `);
-    for (const row of commandRows().filter((entry) => entry.maturity !== 'labs')) {
+    for (const row of commandRows().filter((entry) => entry.maturity !== 'labs').slice(0, 18)) {
         console.log(`  ${row.usage.padEnd(58)} ${row.description}`);
     }
-    console.log('\nThree core promises: Completion Proof for serious routes, Image Voxel TriWiki for visual routes, and release-gated Codex App/codex-lb/hooks/Rust evidence.');
+    console.log('\nRun `sks commands` for the full catalog. Core promise: machine-verified completion, not vibes.');
 }
 function commandRows() {
     const registry = new Map(Object.entries(COMMANDS).map(([name, meta]) => [name, meta]));

package/dist/cli/insane-search-command.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { runUltraSearch } from '../core/ultra-search/index.js';
+import { evaluateLocalGate } from '../core/commands/route-success-helpers.js';
 export async function insaneSearchCommand(sub = 'help', args = []) {
     const action = sub || 'help';
     if (action === 'run')
@@ -35,16 +36,25 @@ async function runCommand(args) {
         query,
         ...(mode ? { mode } : {})
     });
+    const gate = await evaluateUltraSearchGate(missionDir);
+    const finalResult = {
+        ...result,
+        ok: result.ok === true && gate.ok === true,
+        blockers: [...new Set([...(result.blockers || []), ...gate.blockers])],
+        gate_evaluation: gate
+    };
     if (json)
-        console.log(JSON.stringify(result, null, 2));
+        console.log(JSON.stringify(finalResult, null, 2));
     else {
-        console.log(`InsaneSearch ${result.ok ? 'completed' : 'partial/blocked'}: ${result.mode}`);
+        console.log(`InsaneSearch ${finalResult.ok ? 'completed' : 'partial/blocked'}: ${result.mode}`);
         console.log(`Mission: ${missionDir}`);
         console.log(`Sources: ${result.sources.length}, verified: ${result.proof.verified_source_count}`);
-        if (result.blockers.length)
-            console.log(`Blockers: ${result.blockers.join(', ')}`);
+        if (finalResult.blockers.length)
+            console.log(`Blockers: ${finalResult.blockers.join(', ')}`);
     }
-    return result;
+    if (!finalResult.ok)
+        process.exitCode = 1;
+    return finalResult;
 }
 async function doctorCommand(args) {
     const json = args.includes('--json');
@@ -74,11 +84,16 @@ async function inspectCommand(action, args) {
     const target = mission === 'latest' ? await latestMissionDir() : mission;
     const file = path.join(target, 'ultra-search', action === 'sources' ? 'source-ledger.json' : action === 'claims' ? 'claim-ledger.json' : 'ultra-search-result.json');
     const text = await fs.readFile(file, 'utf8');
+    const parsed = JSON.parse(text);
+    const gate = await evaluateUltraSearchGate(target);
+    const result = { ...parsed, ok: parsed.ok === true && gate.ok === true, gate_evaluation: gate, blockers: [...new Set([...(parsed.blockers || []), ...gate.blockers])] };
+    if (!result.ok)
+        process.exitCode = 1;
     if (json)
-        console.log(text.trim());
+        console.log(JSON.stringify(result, null, 2));
     else
-        console.log(text);
-    return JSON.parse(text);
+        console.log(JSON.stringify(result, null, 2));
+    return result;
 }
 async function cacheCommand(args) {
     const sub = positional(args)[0] || 'status';
@@ -164,4 +179,17 @@ async function latestMissionDir() {
 function asyncDirLikelyUltra(dir) {
     return Boolean(dir);
 }
+async function evaluateUltraSearchGate(missionDir) {
+    return evaluateLocalGate({
+        root: process.cwd(),
+        dir: missionDir,
+        gateFile: path.join('ultra-search', 'ultra-search-gate.json'),
+        requiredArtifacts: [
+            path.join('ultra-search', 'source-ledger.json'),
+            path.join('ultra-search', 'claim-ledger.json'),
+            path.join('ultra-search', 'ultra-search-proof.json'),
+            path.join('ultra-search', 'ultra-search-result.json')
+        ]
+    });
+}
 //# sourceMappingURL=insane-search-command.js.map

package/dist/cli/install-helpers.js

@@ -22,6 +22,7 @@ import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellPr
 import { extractTomlTable, writeCodexConfigGuarded } from '../core/codex/codex-config-guard.js';
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
 import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
+import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
 const CODEX_LB_PROVIDER_NAME = 'openai';
 const CODEX_LB_PROVIDER_ENV_KEY = 'CODEX_LB_API_KEY';
 const CODEX_LB_CANONICAL_FAST_SERVICE_TIER = 'priority';
@@ -90,6 +91,15 @@ export async function postinstall({ bootstrap, args = [] }) {
             console.log(`Codex App Fast mode: skipped (${fastModeRepair.reason}).`);
         else if (fastModeRepair.status === 'failed')
             console.log(`Codex App Fast mode: auto repair failed. Run \`sks setup\`. ${fastModeRepair.error || ''}`.trim());
+        const imagegenRepair = await ensureCodexImagegenDuringInstall();
+        if (imagegenRepair.status === 'ready')
+            console.log('Codex App Image Gen: ready ($imagegen/gpt-image-2 detected).');
+        else if (imagegenRepair.status === 'recovered')
+            console.log('Codex App Image Gen: recovered and re-detected.');
+        else if (imagegenRepair.status === 'blocked')
+            console.log(`Codex App Image Gen: blocked; run \`sks doctor --fix\`. ${(imagegenRepair.blockers || []).join(', ')}`.trim());
+        else if (imagegenRepair.status === 'skipped')
+            console.log(`Codex App Image Gen: skipped (${imagegenRepair.reason}).`);
         const postinstallDoctor = await runPostinstallGlobalDoctorAndMarkPending().catch((err) => ({
             ok: false,
             doctor: null,
@@ -2469,6 +2479,28 @@ async function ensureGlobalGetdesignSkillDuringInstall() {
         return { status: 'present', command: skillsBin };
     return { status: 'failed', command: skillsBin, error: out.trim() || 'skills add failed' };
 }
+export async function ensureCodexImagegenDuringInstall(opts = {}) {
+    if (process.env.SKS_POSTINSTALL_SKIP_IMAGEGEN_REPAIR === '1' || opts.skip === true) {
+        return { status: 'skipped', reason: 'SKS_POSTINSTALL_SKIP_IMAGEGEN_REPAIR' };
+    }
+    const report = await repairCodexImagegen({
+        root: opts.root || process.cwd(),
+        apply: opts.apply !== false,
+        codexBin: opts.codexBin || null,
+        autoInstallCodex: opts.autoInstallCodex === true || process.env.SKS_IMAGEGEN_AUTO_INSTALL_CODEX === '1'
+    }).catch((err) => ({
+        recovered: false,
+        blockers: [err?.message || String(err)],
+        before: null,
+        after: null
+    }));
+    if (report.before?.core_ready === true || (report.after?.core_ready === true && report.attempted === false)) {
+        return { status: 'ready', report };
+    }
+    if (report.recovered === true)
+        return { status: 'recovered', report };
+    return { status: 'blocked', blockers: report.blockers || ['codex_imagegen_unavailable'], report };
+}
 export async function ensureRelatedCliTools(args = []) {
     const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
     const codex = await ensureCodexCliTool({ skip, args });

package/dist/commands/codex-lb.js

@@ -73,6 +73,8 @@ export async function run(command, args = []) {
             codex_lb: status,
             chain,
             evidence,
+            degraded_models: Array.isArray(chain.degraded_models) ? chain.degraded_models : [],
+            quota_low: Boolean(chain.quota_low),
             blockers: [
                 ...(providerReady ? [] : ['codex_lb_provider_contract_drift']),
                 ...(chain.ok

package/dist/commands/doctor.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { projectRoot, exists, formatBytes } from '../core/fsx.js';
 import { flag } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
+import { ui as cliUi } from '../cli/cli-theme.js';
 import { getCodexInfo } from '../core/codex-adapter.js';
 import { rustInfo } from '../core/rust-accelerator.js';
 import { codexAppIntegrationStatus } from '../core/codex-app.js';
@@ -41,12 +42,19 @@ import { planDoctorDirtyRepair } from '../core/doctor/doctor-dirty-planner.js';
 import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 import { writeProjectUpdateMigrationReceipt } from '../core/update/update-migration-state.js';
-import { installSksMenuBar } from '../core/codex-app/sks-menubar.js';
+import { inspectSksMenuBarStatus, installSksMenuBar } from '../core/codex-app/sks-menubar.js';
 import { sweepSksTempDirs } from '../core/retention.js';
 import { reconcileSkills } from '../core/init/skills.js';
+import { codexHookTrustDoctor } from '../core/codex-hooks/codex-hook-trust-doctor.js';
+import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
+import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
 export async function run(_command, args = []) {
     const root = await projectRoot();
     const doctorFix = flag(args, '--fix');
+    if (!flag(args, '--json')) {
+        cliUi.banner('doctor');
+        cliUi.step(doctorFix ? 'repairing and validating' : 'validating');
+    }
     if (doctorFix)
         return withSecretPreservationGuard(root, 'doctor-fix', () => runDoctor(args, root, doctorFix));
     return runDoctor(args, root, doctorFix);
@@ -302,7 +310,8 @@ async function runDoctor(args = [], root, doctorFix) {
     const sksMenuBar = await installSksMenuBar({
         root,
         apply: doctorFix,
-        launch: doctorFix
+        launch: doctorFix,
+        quiet: machineOnly || flag(args, '--json')
     }).catch((err) => ({
         schema: 'sks.codex-app-sks-menubar.v1',
         ok: false,
@@ -415,10 +424,22 @@ async function runDoctor(args = [], root, doctorFix) {
             raw_secret_values_recorded: false
         }))
         : null;
+    const hookTrustRepair = doctorFix && doctorPhaseIds.includes('hook_trust_repair')
+        ? await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true }).catch((err) => ({
+            schema: 'sks.codex-hook-trust-doctor.v2',
+            ok: false,
+            actual: true,
+            blockers: [`hook_trust_repair_failed:${err?.message || String(err)}`],
+            warnings: [],
+            repair_actions: ['sks codex trust-doctor --fix --managed --actual']
+        }))
+        : null;
     const doctorFixTransaction = doctorFix
         ? await runDoctorFixTransaction({
             root,
             dirtyPlan: doctorDirtyPlan,
+            json: flag(args, '--json'),
+            machineOnly,
             phases: [
                 {
                     id: 'setup',
@@ -488,19 +509,52 @@ async function runDoctor(args = [], root, doctorFix) {
                         rollback_evidence: 'optional_supabase_no_ready_mutation_required'
                     })
                 },
+                {
+                    id: 'hook_trust_repair',
+                    run: async () => ({
+                        id: 'hook_trust_repair',
+                        ok: hookTrustRepair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: hookTrustRepair?.blockers || [],
+                        warnings: hookTrustRepair?.warnings || [],
+                        rollback_evidence: hookTrustRepair?.fixed?.managed_hook_file || 'codex_hook_trust_repair_idempotent'
+                    })
+                },
                 {
                     id: 'sks_menubar',
                     required_for_ready: false,
                     run: async () => ({
                         id: 'sks_menubar',
-                        ok: sksMenuBar?.ok !== false,
+                        ok: sksMenuBar?.ok === true,
                         repaired: doctorFix && Array.isArray(sksMenuBar?.actions) && sksMenuBar.actions.length > 0,
                         required_for_ready: false,
                         blockers: sksMenuBar?.blockers || [],
                         warnings: sksMenuBar?.warnings || [],
                         artifact_path: sksMenuBar?.report_path || null,
                         rollback_evidence: sksMenuBar?.launch_agent_path || sksMenuBar?.report_path || 'sks_menubar_optional_no_core_mutation'
-                    })
+                    }),
+                    postcheck: async () => {
+                        const status = await inspectSksMenuBarStatus({ root }).catch((err) => ({
+                            ok: false,
+                            launchd: { ok: false, state: null, pid: null, error: err?.message || String(err) },
+                            action_target: { ok: false, smoke_code: null, smoke_output: null },
+                            blockers: [err?.message || String(err)],
+                            warnings: []
+                        }));
+                        const blockers = [
+                            ...(status.launchd?.ok === true ? [] : [`launchd_not_running:${status.launchd?.error || status.launchd?.state || 'unknown'}`]),
+                            ...(status.action_target?.ok === true ? [] : [`action_script_smoke_failed:${status.action_target?.smoke_code ?? 'no_code'}`]),
+                            ...(status.ok === true ? [] : (status.blockers || ['menubar_status_not_ok']))
+                        ];
+                        return {
+                            ok: blockers.length === 0,
+                            blockers,
+                            warnings: [
+                                ...(status.warnings || []),
+                                blockers.length === 0 ? 'menubar_postcheck_passed' : 'menubar_postcheck_failed'
+                            ]
+                        };
+                    }
                 },
                 {
                     id: 'command_alias_cleanup',
@@ -572,10 +626,29 @@ async function runDoctor(args = [], root, doctorFix) {
     const globalSksInstallCleanup = flag(args, '--fix') && !flag(args, '--local-only')
         ? await cleanDuplicateGlobalSksInstalls({ root, fix: true }).catch((err) => ({ schema: 'sks.global-sks-install-cleanup.v1', ok: false, fix: true, error: err?.message || String(err), blockers: ['global_sks_install_cleanup_exception'] }))
         : null;
-    const { detectImagegenCapability } = await import('../core/imagegen/imagegen-capability.js');
-    const imagegen = deepDiagnostics
-        ? await detectImagegenCapability({ codexBin: codexBin || undefined }).catch((err) => ({ ok: false, error: err.message, auth_readiness: null }))
-        : { ok: false, skipped: true, auth_readiness: null, warnings: ['imagegen_optional_diagnostic_skipped'] };
+    const imagegen = await detectImagegenCapability({ codexBin: codexBin || undefined }).catch((err) => ({ ok: false, error: err.message, auth_readiness: null, core_ready: false, blockers: ['imagegen_detection_exception'] }));
+    const imagegenRepair = imagegen.core_ready === true
+        ? {
+            schema: 'sks.doctor-imagegen-repair.v1',
+            ok: true,
+            attempted: false,
+            apply: doctorFix,
+            recovered: true,
+            before: imagegen,
+            after: imagegen,
+            steps: [],
+            blockers: [],
+            manual_actions: []
+        }
+        : await repairCodexImagegen({ root, apply: doctorFix, codexBin: codexBin || null }).catch((err) => ({
+            schema: 'sks.doctor-imagegen-repair.v1',
+            ok: false,
+            attempted: true,
+            apply: doctorFix,
+            recovered: false,
+            blockers: [err?.message || String(err)],
+            manual_actions: ['Run `sks doctor --fix --json` after enabling Codex App image_generation.']
+        }));
     const codex0138Capability = deepDiagnostics
         ? await writeCodex0138CapabilityArtifacts(root, { codexBin: codexBin || null }).catch((err) => ({ error: err?.message || String(err), report: null }))
         : { skipped: true, report: null };
@@ -768,6 +841,7 @@ async function runDoctor(args = [], root, doctorFix) {
             auth_readiness: imagegen.auth_readiness || null,
             codex_app_builtin_available: imagegen.codex_app?.available === true
         },
+        imagegen_repair: imagegenRepair,
         codex_0138: {
             capability: codex0138Capability.report || null,
             doctor: codex0138Doctor,
@@ -782,7 +856,7 @@ async function runDoctor(args = [], root, doctorFix) {
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
         skills: skillsReconcile,
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, sks_menubar: sksMenuBar, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup, skills: skillsReconcile, sks_temp_sweep: sksTempSweep }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, imagegen: imagegenRepair, hook_trust: hookTrustRepair, sks_menubar: sksMenuBar, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup, skills: skillsReconcile, sks_temp_sweep: sksTempSweep }
     };
     if (reportFile)
         await writeJsonReportFile(reportFile, result);
@@ -910,6 +984,13 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  next action: ${codexAppUi.next_action}`);
     console.log('SKS Menu Bar:');
     console.log(`  status: ${sksMenuBar.status || (sksMenuBar.ok ? 'ok' : 'blocked')}`);
+    const menubarPhase = doctorFixTransaction?.phases?.find((phase) => phase?.id === 'sks_menubar');
+    if (menubarPhase) {
+        const menubarSummary = menubarPhase.ok
+            ? (menubarPhase.repaired ? 'repaired' : 'verified')
+            : `blocked(${(menubarPhase.blockers || []).join(', ') || 'unknown'})`;
+        console.log(`  menubar: ${menubarSummary}`);
+    }
     if (sksMenuBar.app_path)
         console.log(`  app: ${sksMenuBar.app_path}`);
     if (sksMenuBar.launch_agent_path)
@@ -928,6 +1009,9 @@ async function runDoctor(args = [], root, doctorFix) {
                 console.log(`  - ${action}`);
         }
     }
+    console.log(`Image Gen repair: ${imagegenRepair.recovered ? 'ok' : imagegenRepair.attempted ? 'blocked' : 'not-needed'}`);
+    for (const action of imagegenRepair.manual_actions || [])
+        console.log(`  - ${action}`);
     const codex0138 = codex0138Capability.report || {};
     console.log('Codex current compatibility:');
     console.log(`  target: rust-v0.142.0`);
@@ -1115,6 +1199,7 @@ function doctorPhaseIdsForProfile(profile) {
         'startup_config_repair',
         'context7_repair',
         'context7_mcp_repair',
+        'hook_trust_repair',
         'command_alias_cleanup'
     ];
     if (profile === 'migration')

package/dist/commands/proof.js

@@ -99,6 +99,7 @@ export async function run(_command, args = []) {
         const result = await writeRouteCompletionProof(root, {
             missionId,
             route: '$SKS',
+            executionClass: 'real',
             status: 'verified_partial',
             evidence,
             summary: {
@@ -119,8 +120,9 @@ export async function run(_command, args = []) {
     if (action === 'smoke') {
         const evidence = await collectProofEvidence(root);
         const result = await writeCompletionProof(root, {
+            execution_class: 'mock_fixture',
             route: '$SKS',
-            status: 'verified_partial',
+            status: 'mock_only',
             summary: {
                 files_changed: evidence.files?.length || 0,
                 commands_run: 1,
@@ -130,8 +132,9 @@ export async function run(_command, args = []) {
             },
             evidence,
             claims: [{ id: 'proof-smoke', status: 'supported', evidence: '.sneakoscope/proof/latest.json' }],
-            unverified: ['Smoke proof is fixture evidence, not a real route completion.']
-        }, { command: { cmd: 'sks proof smoke', status: 'verified_partial' } });
+            unverified: ['Smoke proof is fixture evidence, not a real route completion.'],
+            blockers: ['proof_smoke_fixture_cannot_claim_real_completion']
+        }, { command: { cmd: 'sks proof smoke', status: 'mock_only' } });
         if (flag(args, '--json'))
             return printJson(result);
         console.log(`Completion proof written: ${result.files.latest_json}`);