sneakoscope 5.5.2 → 5.6.0

package/dist/core/commands/qa-loop-command.js

@@ -24,6 +24,7 @@ import { writeCodexModelEffortCapabilityArtifact } from '../codex-control/codex-
 import { discoverImageArtifactsInDir, writeImageArtifactPathContract } from '../image/image-artifact-path-contract.js';
 import { pluginAppTemplatePolicy } from '../codex-plugins/codex-plugin-json.js';
 import { confirmQaLoopAppHandoff } from '../qa-loop/qa-loop-app-handoff-confirmation.js';
+import { emitStreamEvent } from '../agent-bridge/agent-mode.js';
 import fsp from 'node:fs/promises';
 export async function qaLoopCommand(sub, args = []) {
     const known = new Set(['prepare', 'answer', 'run', 'status', 'app-confirm', 'help', '--help', '-h']);
@@ -44,7 +45,7 @@ export async function qaLoopCommand(sub, args = []) {
 Usage:
   sks qa-loop prepare "target"
   sks qa-loop answer <mission-id|latest> <answers.json>
-  sks qa-loop run <mission-id|latest> [--mock] [--max-cycles N] [--surface auto|codex_in_app_browser|codex_chrome_extension|codex_computer_use] [--report-only] [--app-handoff] [--app-handoff-required] [--app-handoff-launch] [--app-handoff-artifact-only]
+  sks qa-loop run <mission-id|latest> [--mock] [--max-cycles N] [--surface auto|codex_in_app_browser|codex_chrome_extension|codex_computer_use] [--report-only] [--app-handoff] [--app-handoff-required] [--app-handoff-launch] [--app-handoff-artifact-only] [--stream]
   sks qa-loop app-confirm <mission-id|latest> --verdict pass|fail --notes "..."
   sks qa-loop status <mission-id|latest> [--desktop]
 `);
@@ -124,7 +125,10 @@ async function qaLoopRun(args) {
     const id = await resolveMissionId(root, args[0]);
     if (!id)
         throw new Error('Usage: sks qa-loop run <mission-id|latest> [--mock] [--max-cycles N]');
+    const stream = flag(args, '--stream');
     const { dir, mission } = await loadMission(root, id);
+    if (stream)
+        emitStreamEvent('start', { schema: 'sks.qa-loop-run.v1', mission_id: id });
     const contractPath = path.join(dir, 'decision-contract.json');
     if (!(await exists(contractPath)))
         throw new Error('QA-LOOP cannot run: decision-contract.json is missing.');
@@ -149,6 +153,8 @@ async function qaLoopRun(args) {
         console.error('QA-LOOP cannot run: SKS safety scan found unsafe project data-tool configuration.');
         console.error(JSON.stringify(safetyScan.findings, null, 2));
         process.exitCode = 2;
+        if (stream)
+            emitStreamEvent('result', { schema: 'sks.qa-loop-run.v1', ok: false, mission_id: id, status: 'blocked', blocker: 'db_safety_scan_failed', findings: safetyScan.findings });
         return;
     }
     const fallbackCycles = Number.parseInt(contract.answers?.MAX_QA_CYCLES, 10) || DEFAULT_QA_MAX_CYCLES;
@@ -260,8 +266,11 @@ async function qaLoopRun(args) {
         if (appHandoffRequired && appHandoff && appHandoff.ok !== true) {
             await maybeFinalizeRoute(root, { missionId: id, route: '$QA-LOOP', gateFile: 'qa-gate.json', gate: nextGate, artifacts: ['qa-gate.json', 'qa-ledger.json', reportFile, 'qa-loop/app-handoff.json', 'completion-proof.json'], statusHint: 'blocked', blockers: nextGate.blockers, command: { cmd: `sks qa-loop run ${id} --app-handoff-required`, status: 2 } });
             await setCurrent(root, { mission_id: id, mode: 'QALOOP', phase: 'QALOOP_BLOCKED_DESKTOP_APP_HANDOFF', questions_allowed: true });
+            const handoffResult = { schema: 'sks.qa-loop-run.v1', ok: false, status: 'blocked_for_desktop_review', mission_id: id, app_handoff: appHandoff, gate: nextGate };
+            if (stream)
+                emitStreamEvent('result', handoffResult);
             if (flag(args, '--json'))
-                return console.log(JSON.stringify({ schema: 'sks.qa-loop-run.v1', ok: false, status: 'blocked_for_desktop_review', mission_id: id, app_handoff: appHandoff, gate: nextGate }, null, 2));
+                return console.log(JSON.stringify(handoffResult, null, 2));
             console.error('QA-LOOP blocked: Codex Desktop /app handoff is required but unavailable or still pending.');
             process.exitCode = 2;
             return;
@@ -296,8 +305,11 @@ async function qaLoopRun(args) {
             await writeJsonAtomic(path.join(dir, 'qa-gate.json'), blockedGate);
             await maybeFinalizeRoute(root, { missionId: id, route: '$QA-LOOP', gateFile: 'qa-gate.json', gate: blockedGate, artifacts: ['qa-gate.json', 'qa-ledger.json', reportFile, 'completion-proof.json'], statusHint: 'blocked', blockers: blockedGate.blockers, command: { cmd: `sks qa-loop run ${id}`, status: 2 } });
             await setCurrent(root, { mission_id: id, mode: 'QALOOP', phase: 'QALOOP_BLOCKED_CHROME_EXTENSION_SETUP_REQUIRED', questions_allowed: true });
+            const chromeBlockedResult = { schema: 'sks.qa-loop-run.v1', ok: false, status: 'blocked', blocker: 'codex_chrome_extension_setup_required', mission_id: id, chrome_extension: chrome, gate: blockedGate };
+            if (stream)
+                emitStreamEvent('result', chromeBlockedResult);
             if (flag(args, '--json'))
-                return console.log(JSON.stringify({ schema: 'sks.qa-loop-run.v1', ok: false, status: 'blocked', blocker: 'codex_chrome_extension_setup_required', mission_id: id, chrome_extension: chrome, gate: blockedGate }, null, 2));
+                return console.log(JSON.stringify(chromeBlockedResult, null, 2));
             console.error('QA-LOOP blocked: this journey was routed to @Chrome, but the Codex Chrome Extension is not connected. Install/enable it, then resume.');
             console.error(chrome.docs_url);
             process.exitCode = 2;
@@ -306,11 +318,15 @@ async function qaLoopRun(args) {
     }
     await setCurrent(root, { mission_id: id, route: 'QALoop', route_command: '$QA-LOOP', mode: 'QALOOP', phase: 'QALOOP_RUNNING_NO_QUESTIONS', questions_allowed: false, stop_gate: 'qa-gate.json', reasoning_effort: 'high', reasoning_profile: 'sks-logic-high', reasoning_temporary: true });
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'qaloop.run.started', maxCycles, mock });
+    if (stream)
+        emitStreamEvent('progress', { mission_id: id, type: 'qaloop.run.started', max_cycles: maxCycles, mock });
     const nativeAgentPlan = await readJson(path.join(dir, 'qa-agent-plan.json'), null);
     const nativeRoster = requestedAgents === 3 ? nativeAgentPlan : null;
     const nativeAgentRun = await runNativeAgentOrchestrator({ root, missionId: id, route: '$QA-LOOP', prompt: mission.prompt || 'QA-LOOP run', backend: mock ? 'fake' : 'codex-sdk', mock, agents: requestedAgents, targetActiveSlots, desiredWorkItemCount, minimumWorkItems, maxQueueExpansion, concurrency: Math.min(requestedAgents, 5), readonly: !(applyPatches && writeMode !== 'off'), profile, writeMode: writeMode, applyPatches, dryRunPatches, maxWriteAgents, roster: nativeRoster, routeCommand: 'sks qa-loop run', routeBlackboxKind: 'actual_qa_command', env: { SKS_CODEX_APP_EXECUTION_PROFILE: executionProfile?.mode || 'unknown', SKS_CODEX_AGENT_ROLE_STRATEGY: executionProfile?.agent_role_strategy || 'message-role' } });
     await writeJsonAtomic(path.join(dir, 'qa-native-agent-run.json'), nativeAgentRun);
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'qaloop.native_agents.completed', backend: nativeAgentRun.backend, ok: nativeAgentRun.ok, proof: nativeAgentRun.proof?.status });
+    if (stream)
+        emitStreamEvent('progress', { mission_id: id, type: 'qaloop.native_agents.completed', backend: nativeAgentRun.backend, ok: nativeAgentRun.ok, proof: nativeAgentRun.proof?.status });
     if (flag(args, '--native-proof-only')) {
         const proofOnlyGate = {
             schema: 'sks.qa-native-proof-only-gate.v1',
@@ -319,17 +335,20 @@ async function qaLoopRun(args) {
             proof_status: nativeAgentRun.proof?.status || null,
             blockers: nativeAgentRun.proof?.blockers || []
         };
+        const proofOnlyResult = {
+            schema: 'sks.qa-loop-run.v1',
+            ok: proofOnlyGate.ok,
+            status: proofOnlyGate.ok ? 'native_proof_ready' : 'blocked',
+            mission_id: id,
+            gate: proofOnlyGate,
+            proof: nativeAgentRun.proof,
+            native_agent_run: nativeAgentRun,
+            native_proof_only: true
+        };
+        if (stream)
+            emitStreamEvent('result', proofOnlyResult);
         if (flag(args, '--json'))
-            return console.log(JSON.stringify({
-                schema: 'sks.qa-loop-run.v1',
-                ok: proofOnlyGate.ok,
-                status: proofOnlyGate.ok ? 'native_proof_ready' : 'blocked',
-                mission_id: id,
-                gate: proofOnlyGate,
-                proof: nativeAgentRun.proof,
-                native_agent_run: nativeAgentRun,
-                native_proof_only: true
-            }, null, 2));
+            return console.log(JSON.stringify(proofOnlyResult, null, 2));
         console.log(`QA-LOOP native proof ready: ${id}`);
         return;
     }
@@ -366,18 +385,21 @@ async function qaLoopRun(args) {
             command: { cmd: `sks qa-loop run ${id} --mock`, status: 0 }
         });
         await setCurrent(root, { mission_id: id, mode: 'QALOOP', phase: gate.passed ? 'QALOOP_DONE' : 'QALOOP_PAUSED', questions_allowed: true });
+        const mockResult = {
+            schema: 'sks.qa-loop-run.v1',
+            ok: proof.ok && (!needsVisual || gate.passed === true),
+            status: needsVisual && gate.passed !== true ? 'verified_partial_mock_no_live_web_evidence' : (gate.passed ? 'passed' : 'blocked'),
+            mission_id: id,
+            gate,
+            proof: proof.validation,
+            native_agent_run: nativeAgentRun,
+            mock_only: true,
+            live_web_evidence: !needsVisual || gate.passed === true
+        };
+        if (stream)
+            emitStreamEvent('result', mockResult);
         if (flag(args, '--json'))
-            return console.log(JSON.stringify({
-                schema: 'sks.qa-loop-run.v1',
-                ok: proof.ok && (!needsVisual || gate.passed === true),
-                status: needsVisual && gate.passed !== true ? 'verified_partial_mock_no_live_web_evidence' : (gate.passed ? 'passed' : 'blocked'),
-                mission_id: id,
-                gate,
-                proof: proof.validation,
-                native_agent_run: nativeAgentRun,
-                mock_only: true,
-                live_web_evidence: !needsVisual || gate.passed === true
-            }, null, 2));
+            return console.log(JSON.stringify(mockResult, null, 2));
         console.log(`Mock QA-LOOP done: ${id}`);
         console.log(`Gate: ${gate.passed ? 'passed' : 'blocked'}`);
         return;
@@ -386,6 +408,8 @@ async function qaLoopRun(args) {
         await maybeFinalizeRoute(root, { missionId: id, route: '$QA-LOOP', gateFile: 'qa-gate.json', gate: await readJson(path.join(dir, 'qa-gate.json'), null), artifacts: ['agents/agent-proof-evidence.json', 'qa-native-agent-run.json', 'completion-proof.json'], statusHint: 'blocked', blockers: nativeAgentRun.proof?.blockers || ['native_agent_backend_blocked'], command: { cmd: `sks qa-loop run ${id}`, status: 2 } });
         await setCurrent(root, { mission_id: id, mode: 'QALOOP', phase: 'QALOOP_BLOCKED_NATIVE_AGENTS', questions_allowed: true });
         process.exitCode = 2;
+        if (stream)
+            emitStreamEvent('result', { schema: 'sks.qa-loop-run.v1', ok: false, mission_id: id, status: 'blocked', blocker: 'native_agent_backend_blocked', blockers: nativeAgentRun.proof?.blockers || ['native_agent_backend_blocked'] });
         return;
     }
     const codex = await getCodexInfo();
@@ -394,6 +418,8 @@ async function qaLoopRun(args) {
         await maybeFinalizeRoute(root, { missionId: id, route: '$QA-LOOP', gateFile: 'qa-gate.json', gate: await readJson(path.join(dir, 'qa-gate.json'), null), artifacts: ['agents/agent-proof-evidence.json', 'qa-native-agent-run.json', 'completion-proof.json'], statusHint: 'blocked', blockers: ['codex_cli_missing'], command: { cmd: `sks qa-loop run ${id}`, status: 2 } });
         await setCurrent(root, { mission_id: id, mode: 'QALOOP', phase: 'QALOOP_BLOCKED_REAL_RUN_REQUIRED', questions_allowed: true });
         process.exitCode = 2;
+        if (stream)
+            emitStreamEvent('result', { schema: 'sks.qa-loop-run.v1', ok: false, mission_id: id, status: 'blocked', blocker: 'codex_cli_missing' });
         return;
     }
     let last = '';
@@ -402,11 +428,15 @@ async function qaLoopRun(args) {
         const outputFile = path.join(cycleDir, 'final.md');
         const prompt = buildQaLoopPrompt({ id, mission, contract, cycle, previous: last, reportFile, imagePathContract: imagePathContract?.contract || null, appHandoff, executionProfile });
         await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'qaloop.cycle.start', cycle });
+        if (stream)
+            emitStreamEvent('progress', { mission_id: id, type: 'qaloop.cycle.start', cycle, max_cycles: maxCycles });
         const result = await runCodexExec({ root, prompt, outputFile, json: true, profile, logDir: cycleDir });
         await writeJsonAtomic(path.join(cycleDir, 'process.json'), { code: result.code, stdout_tail: result.stdout, stderr_tail: result.stderr, stdout_bytes: result.stdoutBytes, stderr_bytes: result.stderrBytes, truncated: result.truncated, timed_out: result.timedOut });
         last = await safeReadTextFile(fsp, outputFile, result.stdout || result.stderr || '');
         if (containsUserQuestion(last)) {
             await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'qaloop.guard.question_blocked', cycle });
+            if (stream)
+                emitStreamEvent('progress', { mission_id: id, type: 'qaloop.guard.question_blocked', cycle });
             last = `${last}\n\n${noQuestionContinuationReason()}`;
             continue;
         }
@@ -415,18 +445,26 @@ async function qaLoopRun(args) {
             const proof = await maybeFinalizeRoute(root, { missionId: id, route: '$QA-LOOP', gateFile: 'qa-gate.json', gate: gate.gate || gate, artifacts: ['agents/agent-proof-evidence.json', 'qa-native-agent-run.json', 'qa-gate.json', 'qa-ledger.json', reportFile, 'completion-proof.json'], visual: uiRequired, command: { cmd: `sks qa-loop run ${id}`, status: 0 } });
             await setCurrent(root, { mission_id: id, mode: 'QALOOP', phase: 'QALOOP_DONE', questions_allowed: true });
             await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'qaloop.done', cycle });
+            const doneResult = { schema: 'sks.qa-loop-run.v1', ok: proof.ok, mission_id: id, gate, proof: proof.validation };
+            if (stream)
+                emitStreamEvent('result', doneResult);
             if (flag(args, '--json'))
-                return console.log(JSON.stringify({ schema: 'sks.qa-loop-run.v1', ok: proof.ok, mission_id: id, gate, proof: proof.validation }, null, 2));
+                return console.log(JSON.stringify(doneResult, null, 2));
             console.log(`QA-LOOP done: ${id}`);
             return;
         }
         await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'qaloop.cycle.continue', cycle, reasons: gate.reasons });
+        if (stream)
+            emitStreamEvent('progress', { mission_id: id, type: 'qaloop.cycle.continue', cycle, reasons: gate.reasons });
     }
     const gate = await evaluateQaGate(dir);
     const proof = await maybeFinalizeRoute(root, { missionId: id, route: '$QA-LOOP', gateFile: 'qa-gate.json', gate: gate.gate || gate, artifacts: ['agents/agent-proof-evidence.json', 'qa-native-agent-run.json', 'qa-gate.json', 'qa-ledger.json', reportFile, 'completion-proof.json'], mock: false, statusHint: 'blocked', reason: 'max_cycles', command: { cmd: `sks qa-loop run ${id}`, status: 2 } });
     await setCurrent(root, { mission_id: id, mode: 'QALOOP', phase: 'QALOOP_PAUSED_MAX_CYCLES', questions_allowed: true });
+    const pausedResult = { schema: 'sks.qa-loop-run.v1', ok: false, mission_id: id, gate, proof: proof.validation };
+    if (stream)
+        emitStreamEvent('result', pausedResult);
     if (flag(args, '--json'))
-        return console.log(JSON.stringify({ schema: 'sks.qa-loop-run.v1', ok: false, mission_id: id, gate, proof: proof.validation }, null, 2));
+        return console.log(JSON.stringify(pausedResult, null, 2));
     console.log(`QA-LOOP paused after max cycles: ${id}`);
 }
 async function qaLoopStatus(args) {

package/dist/core/commands/team-command.js

@@ -19,7 +19,7 @@ async function redirectTeamCreateToNaruto(args = []) {
     const result = jsonRequested
         ? await withSuppressedConsoleLog(() => narutoCommand(narutoArgs))
         : await narutoCommand(narutoArgs);
-    const missionId = result?.mission_id || await findLatestMission(root);
+    const missionId = result?.mission_id || await findLatestMission(root, { mode: 'naruto' });
     const nativeAgentRun = missionId ? await buildTeamNativeAgentCompatibility(root, missionId, result) : null;
     if (missionId) {
         await writeJsonAtomic(path.join(root, '.sneakoscope', 'missions', missionId, 'team-alias-to-naruto.json'), {

package/dist/core/commands/wiki-command.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import fsp from 'node:fs/promises';
-import { appendJsonlBounded, ensureDir, exists, formatBytes, nowIso, PACKAGE_VERSION, readJson, sksRoot, writeJsonAtomic } from '../fsx.js';
+import { appendJsonlBounded, ensureDir, exists, formatBytes, nowIso, PACKAGE_VERSION, readJson, runProcess, sksRoot, writeJsonAtomic } from '../fsx.js';
 import { contextCapsule } from '../triwiki-attention.js';
 import { rgbaKey, rgbaToWikiCoord, validateWikiCoordinateIndex } from '../wiki-coordinate.js';
 import { pruneWikiArtifacts } from '../retention.js';
@@ -19,6 +19,8 @@ import { wikiWrongnessCommand } from '../triwiki-wrongness/wrongness-cli.js';
 import { wrongnessContextForRoute } from '../triwiki-wrongness/wrongness-retrieval.js';
 import { recordImageWrongnessFromValidation } from '../triwiki-wrongness/image-wrongness.js';
 import { publishSharedMemory, rebuildSharedIndexes, sharedMemorySummary, validateSharedMemory } from '../git-hygiene/shared-memory-publish.js';
+import { scanCodebaseIndex } from '../triwiki/code-index-scanner.js';
+import { buildCodePack, validateCodePack, writeCodePackAtomic } from '../triwiki/code-pack.js';
 import { flag, positionalArgs, readFlagValue, readOption, resolveMissionId } from './command-utils.js';
 export async function wikiCommand(sub, args = []) {
     if (!sub || sub === 'help' || sub === '--help') {
@@ -108,6 +110,9 @@ export async function wikiCommand(sub, args = []) {
         console.log(`Memory summary rebuilt: ${result.ok ? 'ok' : 'blocked'}`);
         return;
     }
+    if (sub === 'refresh' && flag(args, '--code')) {
+        return wikiRefreshCode(args);
+    }
     if (sub === 'refresh') {
         const root = await sksRoot();
         const dryRun = flag(args, '--dry-run');
@@ -194,19 +199,68 @@ export async function wikiCommand(sub, args = []) {
         const target = positionalArgs(args)[0] || path.join(root, '.sneakoscope', 'wiki', 'context-pack.json');
         const pack = await readJson(path.resolve(target));
         const { result, trustAnchors } = wikiValidationResult(pack);
+        const codePack = await codePackFreshness(root);
         if (flag(args, '--json'))
-            return console.log(JSON.stringify(result, null, 2));
+            return console.log(JSON.stringify({ ...result, code_pack: codePack }, null, 2));
         console.log(`Wiki coordinate index: ${result.ok ? 'ok' : 'failed'}`);
         console.log(`Anchors checked: ${result.checked}`);
         console.log(`Trust anchors: ${trustAnchors}/${result.checked}`);
         for (const issue of result.issues)
             console.log(`- ${issue.severity}: ${issue.id}${issue.anchor ? ` ${issue.anchor}` : ''}`);
+        console.log(`Code pack: ${codePack.status}${codePack.status === 'stale' ? ' — run `sks wiki refresh --code`' : ''}`);
         process.exitCode = result.ok ? 0 : 2;
         return;
     }
     console.error('Usage: sks wiki coords|pack|refresh|publish|rebuild-index|rebuild-summary|validate|validate-shared|wrongness|image-ingest|anchor-add|relation-add|image-validate|image-summary');
     process.exitCode = 1;
 }
+async function wikiRefreshCode(args = []) {
+    const root = await sksRoot();
+    const index = await scanCodebaseIndex(root);
+    const tokenBudgetRaw = readFlagValue(args, '--token-budget', null);
+    const tokenBudget = tokenBudgetRaw ? Number.parseInt(String(tokenBudgetRaw), 10) : undefined;
+    const pack = tokenBudget && Number.isFinite(tokenBudget) ? buildCodePack(root, index, tokenBudget) : buildCodePack(root, index);
+    const validation = await validateCodePack(pack, root);
+    const written = validation.ok ? await writeCodePackAtomic(root, pack) : null;
+    const result = {
+        schema: 'sks.wiki-refresh-code.v1',
+        ok: validation.ok,
+        issues: validation.issues,
+        modules: index.modules.length,
+        truncated: index.truncated,
+        scanned_file_count: index.scanned_file_count,
+        entries: pack.entries.length,
+        token_cost: pack.total_token_cost,
+        token_budget: pack.token_budget,
+        written: written ? written.path : null
+    };
+    process.exitCode = validation.ok ? 0 : 2;
+    // Always note the counts/issues on stderr (even in --json mode, where stdout must
+    // stay pure JSON) so a blocked run is diagnosable from stderr_tail alone without
+    // needing to reproduce it separately in an isolated environment.
+    process.stderr.write(`wiki-refresh-code: root=${root} modules=${index.modules.length} entries=${pack.entries.length} token_cost=${pack.total_token_cost}/${pack.token_budget} issues=${JSON.stringify(validation.issues)}\n`);
+    if (flag(args, '--json'))
+        return console.log(JSON.stringify(result, null, 2));
+    console.log('Sneakoscope TriWiki Code Pack Refresh');
+    console.log(`Code pack refresh: ${validation.ok ? 'ok' : 'blocked'} (${pack.entries.length} entries from ${index.modules.length} modules${index.truncated ? ', truncated' : ''})`);
+    for (const issue of validation.issues)
+        console.log(`- ${issue}`);
+}
+/** Cheap freshness check: compares the code pack's recorded git HEAD sha (at
+ * generation time) against the current HEAD. Any uncertainty (no pack, no git,
+ * spawn failure) resolves to 'stale' rather than 'fresh', never overclaiming. */
+async function codePackFreshness(root) {
+    const packPath = path.join(root, '.sneakoscope', 'wiki', 'code-pack.json');
+    if (!(await exists(packPath)))
+        return { status: 'missing', git_head_sha: null, pack_sha: null };
+    const pack = await readJson(packPath, null).catch(() => null);
+    const packSha = pack?.git_head_sha || null;
+    if (!packSha)
+        return { status: 'missing', git_head_sha: null, pack_sha: null };
+    const head = await runProcess('git', ['rev-parse', 'HEAD'], { cwd: root, timeoutMs: 5000 }).catch(() => null);
+    const currentSha = head && head.code === 0 ? head.stdout.trim() : null;
+    return { status: currentSha && currentSha === packSha ? 'fresh' : 'stale', git_head_sha: currentSha, pack_sha: packSha };
+}
 function wikiRefreshFailureAnalysis(validationResult, gate = {}) {
     if (validationResult?.ok) {
         return {
@@ -327,6 +381,8 @@ async function wikiImageLinkProof(args = []) {
 export async function writeWikiContextPack(root, args = [], opts = {}) {
     const role = readFlagValue(args, '--role', 'worker');
     const maxAnchors = Number(readFlagValue(args, '--max-anchors', role.includes('verifier') ? 48 : 32));
+    const codePackData = await readJson(path.join(root, '.sneakoscope', 'wiki', 'code-pack.json'), null).catch(() => null);
+    const codePackEntries = Array.isArray(codePackData?.entries) ? codePackData.entries : [];
     const pack = contextCapsule({
         mission: { id: 'project-wiki', coord: { rgba: { r: 48, g: 132, b: 212, a: 240 } } },
         role,
@@ -334,11 +390,23 @@ export async function writeWikiContextPack(root, args = [], opts = {}) {
         claims: await projectWikiClaims(root),
         q4: { mode: 'project-continuity', package: PACKAGE_VERSION, hydrate: 'anchor-first' },
         q3: ['sks', 'llm-wiki', 'wiki-coordinate', 'gx', 'skills'],
-        budget: { maxWikiAnchors: maxAnchors, includeTrustSummary: true }
+        budget: { maxWikiAnchors: maxAnchors, includeTrustSummary: true },
+        codePackEntries
     });
     const wrongnessContext = await wrongnessContextForRoute(root, { route: '$Wiki', limit: 12 });
+    // buildTriWikiAttention's use_first/hydrate_first can reference code: ids that were
+    // never routed through selectClaims (no fabricated RGBA coordinate for them — see
+    // codePackAttentionRows), so append their real summary text here or a recallpulse
+    // consumer resolving pack.claims by id would only see the bare id string.
+    const codePackClaimRows = codePackEntries.map((entry) => ({
+        id: entry.id,
+        text: `${entry.text}${Array.isArray(entry.citations) && entry.citations.length ? ` (source: ${entry.citations.map((c) => c?.path).filter(Boolean).join(', ')})` : ''}`,
+        source: 'code-pack',
+        trust: entry.trust_score
+    }));
     const enrichedPack = {
         ...pack,
+        claims: [...(pack.claims || []), ...codePackClaimRows],
         wrongness_context: wrongnessContext,
         q3: Array.from(new Set([...(pack.q3 || []), 'wrongness-memory', 'negative-evidence']))
     };

package/dist/core/config/secret-preservation.js

@@ -56,7 +56,7 @@ export async function withSecretPreservationGuard(root, operationName, fn) {
     }
     try {
         const after = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: afterPath });
-        const changedOrMissing = changedOrMissingProtectedSecrets(before, after);
+        const changedOrMissing = await withoutSecretsPreservedInComments(changedOrMissingProtectedSecrets(before, after));
         let rollbackAttempted = false;
         let rollbackOk = false;
         let restoredKeysCount = 0;
@@ -118,6 +118,48 @@ export function changedOrMissingProtectedSecrets(before, after) {
     })
         .filter((item) => Boolean(item));
 }
+// A repair that intentionally deactivates a config block (e.g. commenting out
+// a colliding stdio MCP server) makes the secret disappear from the *live*
+// scan even though its value is still sitting right there in a comment, fully
+// recoverable. Without this check the guard treats that as an accidental loss,
+// rolls the whole file back (undoing the repair), and still throws — so the
+// repair can never stick. Only 'missing' entries are reconsidered here: a
+// 'changed' entry means a live value actually differs and must still trip the
+// guard. Never reads the pre-image value itself — only re-hashes whatever text
+// is currently on disk, so raw_values_recorded stays false throughout.
+async function withoutSecretsPreservedInComments(entries) {
+    const textBySource = new Map();
+    const kept = [];
+    for (const entry of entries) {
+        if (entry.reason !== 'missing' || !entry.before_sha256) {
+            kept.push(entry);
+            continue;
+        }
+        let text = textBySource.get(entry.source);
+        if (text === undefined) {
+            text = await fs.readFile(entry.source, 'utf8').catch(() => '');
+            textBySource.set(entry.source, text);
+        }
+        const preserved = readAllAssignmentValues(text, entry.key).some((value) => sha256(value) === entry.before_sha256);
+        if (!preserved)
+            kept.push(entry);
+    }
+    return kept;
+}
+/** Like readAssignment, but also matches the same key commented out (`# KEY = ...`)
+ * and returns every candidate value found, not just the first. */
+function readAllAssignmentValues(text, key) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\\\./g, '\\s*\\.\\s*');
+    const re = new RegExp(`^\\s*#?\\s*(?:export\\s+)?${escaped}\\s*=\\s*(.+?)\\s*$`, 'gm');
+    const values = [];
+    let match;
+    while ((match = re.exec(text))) {
+        const raw = match[1]?.trim();
+        if (raw)
+            values.push(unquote(raw));
+    }
+    return values;
+}
 function secretSources(root) {
     const home = process.env.HOME || os.homedir();
     return [

package/dist/core/doctor/browser-use-repair.js

@@ -0,0 +1,149 @@
+import path from 'node:path';
+import { codexChromeExtensionStatus, CODEX_CHROME_EXTENSION_SETUP_DOCS_URL } from '../codex-app.js';
+import { runDoctorCodexStartupRepair } from './doctor-codex-startup-repair.js';
+import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
+export const DOCTOR_BROWSER_USE_REPAIR_SCHEMA = 'sks.doctor-browser-use-repair.v1';
+export async function repairBrowserUse(input) {
+    const root = path.resolve(input.root || process.cwd());
+    const apply = input.apply === true;
+    const detect = input.detectChromeExtensionStatus || codexChromeExtensionStatus;
+    const repairNodeReplEnv = input.nodeReplRepair || runDoctorCodexStartupRepair;
+    const steps = [];
+    const before = await detect({}).catch((err) => ({
+        ok: false,
+        status: 'setup_required',
+        blockers: [messageOf(err)],
+        plugin: { installed: false, enabled: false },
+        required_flags: ['browser_use_external', 'plugins', 'apps'],
+        guidance: []
+    }));
+    const codexBin = input.codexBin || await which('codex').catch(() => null);
+    steps.push({
+        id: 'codex_cli_present',
+        ok: Boolean(codexBin),
+        attempted: false,
+        command: 'which codex',
+        blocker: codexBin ? null : 'codex_binary_missing'
+    });
+    const flagsNeedingEnable = ['browser_use_external', 'plugins'];
+    for (const flag of flagsNeedingEnable) {
+        const alreadyOk = before?.ok === true || (before?.blockers || []).every((b) => !b.includes(`${flag}_feature_missing`));
+        if (codexBin && apply) {
+            const enable = await runProcess(codexBin, ['features', 'enable', flag], {
+                timeoutMs: input.timeoutMs || 10000,
+                maxOutputBytes: 32 * 1024
+            }).catch((err) => ({ code: 1, stdout: '', stderr: messageOf(err) }));
+            steps.push({
+                id: `${flag}_feature_enable`,
+                ok: enable.code === 0,
+                attempted: true,
+                command: `${codexBin} features enable ${flag}`,
+                exit_code: enable.code,
+                stdout_tail: tail(enable.stdout),
+                stderr_tail: tail(enable.stderr),
+                blocker: enable.code === 0 ? null : 'codex_feature_enable_unsupported_or_failed'
+            });
+        }
+        else {
+            steps.push({
+                id: `${flag}_feature_enable`,
+                ok: alreadyOk,
+                attempted: false,
+                command: codexBin ? `${codexBin} features enable ${flag}` : `codex features enable ${flag}`,
+                blocker: alreadyOk ? null : apply ? 'codex_cli_missing' : 'doctor_fix_not_requested'
+            });
+        }
+    }
+    // codex plugin enable/install has no documented CLI subcommand for the bundled chrome plugin
+    // in this repo's evidence (only `plugin list --json` / app-server plugin RPCs are attested); do not guess one.
+    steps.push({
+        id: 'chrome_plugin_enable',
+        ok: false,
+        attempted: false,
+        command: null,
+        status: 'needs_more_info',
+        blocker: 'chrome_plugin_enable_cli_subcommand_unknown'
+    });
+    let nodeReplStep;
+    if (apply) {
+        const nodeReplResult = await repairNodeReplEnv({ root, fix: true }).catch((err) => ({
+            ok: false,
+            blockers: [messageOf(err)]
+        }));
+        nodeReplStep = {
+            id: 'node_repl_env_block_repair',
+            ok: nodeReplResult?.ok !== false,
+            attempted: true,
+            command: 'runDoctorCodexStartupRepair({ fix: true })',
+            blocker: nodeReplResult?.ok === false ? (nodeReplResult?.blockers?.[0] || 'node_repl_env_block_repair_incomplete') : null
+        };
+    }
+    else {
+        nodeReplStep = {
+            id: 'node_repl_env_block_repair',
+            ok: true,
+            attempted: false,
+            command: 'runDoctorCodexStartupRepair({ fix: true })',
+            blocker: 'doctor_fix_not_requested'
+        };
+    }
+    steps.push(nodeReplStep);
+    const after = await detect({}).catch((err) => ({
+        ok: false,
+        status: 'setup_required',
+        blockers: [messageOf(err)],
+        plugin: { installed: false, enabled: false },
+        required_flags: ['browser_use_external', 'plugins', 'apps'],
+        guidance: []
+    }));
+    const extensionMissing = (after?.blockers || []).some((b) => b.startsWith('chrome_extension_plugin_missing')
+        || b.startsWith('chrome_extension_plugin_not_installed')
+        || b.startsWith('chrome_extension_plugin_cache_only_unverified'));
+    const blockers = [...(after?.blockers || [])];
+    if (extensionMissing && !blockers.includes('chrome_extension_manual_install_required')) {
+        blockers.push('chrome_extension_manual_install_required');
+    }
+    const recovered = after?.ok === true;
+    const nextActions = recovered ? [] : [
+        'Open the Codex Desktop app and check its settings for the Chrome/Browser Use plugin entry (exact menu wording may vary by version; check Codex app settings generically if unsure).',
+        'If a Chrome extension install/enable action is offered from within Codex App settings, follow it there rather than the Chrome Web Store directly, since Codex App is the source of truth for what "ready" means for this feature.',
+        `If no in-app action is available, consult the setup docs: ${CODEX_CHROME_EXTENSION_SETUP_DOCS_URL}`,
+        'After installing/enabling the extension, tell SKS it is installed and rerun this repair to re-detect.',
+        'Verify with: codex features list | rg "browser_use_external|plugins|apps"'
+    ];
+    let report = {
+        schema: DOCTOR_BROWSER_USE_REPAIR_SCHEMA,
+        generated_at: nowIso(),
+        ok: recovered,
+        attempted: before?.ok !== true,
+        apply,
+        recovered,
+        before,
+        after,
+        steps,
+        blockers: [...new Set(blockers)],
+        next_actions: nextActions,
+        manual_actions: nextActions,
+        docs_url: CODEX_CHROME_EXTENSION_SETUP_DOCS_URL
+    };
+    if (input.reportPath !== null) {
+        const reportPath = input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-browser-use-repair.json');
+        try {
+            await ensureDir(path.dirname(reportPath));
+            await writeJsonAtomic(reportPath, report);
+            report = { ...report, report_path: reportPath };
+        }
+        catch (err) {
+            report = { ...report, report_write_failed: true, report_write_error: messageOf(err) };
+        }
+    }
+    return report;
+}
+function tail(value, max = 2000) {
+    const text = String(value || '');
+    return text.length > max ? text.slice(-max) : text;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=browser-use-repair.js.map