sneakoscope 5.5.2 → 5.6.0

package/dist/core/doctor/computer-use-repair.js

@@ -0,0 +1,166 @@
+import path from 'node:path';
+import { CODEX_APP_DOCS_URL } from '../codex-app.js';
+import { computerUseStatusReport } from '../computer-use-status.js';
+import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
+export const DOCTOR_COMPUTER_USE_REPAIR_SCHEMA = 'sks.doctor-computer-use-repair.v1';
+export async function repairComputerUse(input) {
+    const root = path.resolve(input.root || process.cwd());
+    const apply = input.apply === true;
+    const probe = input.probe || computerUseStatusReport;
+    const steps = [];
+    const before = await probe({ root, codexBin: input.codexBin || undefined, forceMacos: true })
+        .catch((err) => ({ ok: false, status: 'unknown', blockers: [messageOf(err)] }));
+    let codexBin = input.codexBin || await which('codex').catch(() => null);
+    let versionStep;
+    if (codexBin) {
+        const version = await runProcess(codexBin, ['--version'], { timeoutMs: input.timeoutMs || 5000, maxOutputBytes: 16 * 1024 })
+            .catch((err) => ({ code: 1, stdout: '', stderr: messageOf(err) }));
+        versionStep = {
+            id: 'codex_cli_version',
+            ok: version.code === 0,
+            attempted: true,
+            command: `${codexBin} --version`,
+            exit_code: version.code,
+            stdout_tail: tail(version.stdout),
+            stderr_tail: tail(version.stderr),
+            blocker: version.code === 0 ? null : 'codex_cli_version_failed'
+        };
+    }
+    else {
+        versionStep = {
+            id: 'codex_cli_version',
+            ok: false,
+            attempted: false,
+            command: 'codex --version',
+            blocker: 'codex_binary_missing'
+        };
+    }
+    steps.push(versionStep);
+    const beforeReady = before?.status === 'available';
+    const needsFeatureFlag = before?.status === 'codex_app_capability_missing' || before?.status === 'unknown';
+    if (codexBin && !beforeReady && needsFeatureFlag && apply) {
+        const enable = await runProcess(codexBin, ['features', 'enable', 'computer_use'], {
+            timeoutMs: input.timeoutMs || 10000,
+            maxOutputBytes: 32 * 1024
+        }).catch((err) => ({ code: 1, stdout: '', stderr: messageOf(err) }));
+        steps.push({
+            id: 'computer_use_feature_enable',
+            ok: enable.code === 0,
+            attempted: true,
+            command: `${codexBin} features enable computer_use`,
+            exit_code: enable.code,
+            stdout_tail: tail(enable.stdout),
+            stderr_tail: tail(enable.stderr),
+            blocker: enable.code === 0 ? null : 'codex_feature_enable_unsupported_or_failed'
+        });
+    }
+    else {
+        steps.push({
+            id: 'computer_use_feature_enable',
+            ok: beforeReady,
+            attempted: false,
+            command: codexBin ? `${codexBin} features enable computer_use` : 'codex features enable computer_use',
+            blocker: beforeReady
+                ? null
+                : !apply
+                    ? 'doctor_fix_not_requested'
+                    : !codexBin
+                        ? 'codex_cli_missing'
+                        : 'computer_use_capability_missing_not_feature_flag_shaped'
+        });
+    }
+    // codex plugin install subcommand syntax is not documented anywhere in this repo or the
+    // Codex CLI docs snapshot; a real `codex plugin --help` lookup was attempted but the
+    // binary was unavailable/unverified in this environment, so no install command is guessed.
+    const pluginInstallStep = {
+        id: 'computer_use_plugin_install_lookup',
+        ok: false,
+        attempted: false,
+        command: codexBin ? `${codexBin} plugin --help` : 'codex plugin --help',
+        blocker: 'codex_plugin_install_subcommand_unverified'
+    };
+    let pluginHelpRaw = null;
+    if (codexBin && before?.status === 'codex_app_missing' && apply) {
+        const help = await runProcess(codexBin, ['plugin', '--help'], {
+            timeoutMs: input.timeoutMs || 8000,
+            maxOutputBytes: 32 * 1024
+        }).catch((err) => ({ code: 1, stdout: '', stderr: messageOf(err) }));
+        pluginHelpRaw = tail(help.stdout || help.stderr, 4000);
+        pluginInstallStep.attempted = true;
+        pluginInstallStep.exit_code = help.code;
+        pluginInstallStep.stdout_tail = tail(help.stdout);
+        pluginInstallStep.stderr_tail = tail(help.stderr);
+        const installSubcommand = extractPluginInstallSubcommand(help.stdout || help.stderr || '');
+        if (installSubcommand) {
+            pluginInstallStep.ok = false;
+            pluginInstallStep.blocker = 'codex_plugin_install_subcommand_found_but_not_auto_run';
+        }
+        else {
+            pluginInstallStep.blocker = 'codex_plugin_help_did_not_reveal_install_subcommand';
+        }
+    }
+    steps.push(pluginInstallStep);
+    const after = await probe({ root, codexBin: codexBin || undefined, forceMacos: true })
+        .catch((err) => ({ ok: false, status: 'unknown', blockers: [messageOf(err)] }));
+    steps.push({
+        id: 'computer_use_status_redetect',
+        ok: after?.status === 'available',
+        attempted: true,
+        command: 'codex features list --json',
+        blocker: after?.status === 'available' ? null : String(after?.status || 'unknown')
+    });
+    const recovered = after?.status === 'available';
+    const blockers = recovered ? [] : [
+        ...new Set([
+            String(after?.status || 'computer_use_unavailable'),
+            ...(pluginInstallStep.attempted && !recovered ? [pluginInstallStep.blocker] : [])
+        ].filter(Boolean).map(String))
+    ];
+    const nextActions = recovered ? [] : [
+        'Install/update Codex CLI if missing: npm i -g @openai/codex@latest',
+        'Open Codex App settings and enable Computer Use, or run: codex features enable computer_use',
+        after?.status === 'codex_app_missing'
+            ? 'A live `codex plugin --help` (or equivalent) lookup is required to find the real plugin install subcommand before SKS can auto-install a Computer Use plugin; this was not guessed. A human should run `codex plugin --help` (or check Codex App settings) and report the exact install subcommand back so it can be wired into this repair function.'
+            : 'Verify with: codex features list --json',
+        `Docs: ${CODEX_APP_DOCS_URL}`
+    ];
+    let report = {
+        schema: DOCTOR_COMPUTER_USE_REPAIR_SCHEMA,
+        generated_at: nowIso(),
+        ok: recovered,
+        attempted: !beforeReady,
+        apply,
+        recovered,
+        before,
+        after,
+        steps,
+        blockers,
+        next_actions: nextActions,
+        plugin_help_raw: pluginHelpRaw,
+        docs_url: CODEX_APP_DOCS_URL
+    };
+    if (input.reportPath !== null) {
+        const reportPath = input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-computer-use-repair.json');
+        try {
+            await ensureDir(path.dirname(reportPath));
+            await writeJsonAtomic(reportPath, report);
+            report = { ...report, report_path: reportPath };
+        }
+        catch (err) {
+            report = { ...report, report_write_failed: true, report_write_error: messageOf(err) };
+        }
+    }
+    return report;
+}
+function extractPluginInstallSubcommand(helpText) {
+    const match = String(helpText || '').match(/^\s*install\s+/m);
+    return match ? 'install' : null;
+}
+function tail(value, max = 2000) {
+    const text = String(value || '');
+    return text.length > max ? text.slice(-max) : text;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=computer-use-repair.js.map

package/dist/core/doctor/imagegen-repair.js

@@ -111,6 +111,14 @@ export async function repairCodexImagegen(input) {
         command: 'codex features list --json',
         blocker: after?.core_ready === true ? null : 'codex_app_builtin_imagegen_capability_missing'
     });
+    // No real generation round-trip primitive exists in imagegen-capability.ts today; this only re-confirms the feature flag, not actual output.
+    const communicationTest = {
+        level: 'flag_level',
+        ok: after?.core_ready === true,
+        checked: 'codex features list --json (feature-flag/plugin metadata only)',
+        real_generation_round_trip_performed: false,
+        blocker: after?.core_ready === true ? null : 'codex_app_builtin_imagegen_capability_missing'
+    };
     const recovered = after?.core_ready === true;
     const blockers = recovered ? [] : [
         ...new Set([
@@ -129,6 +137,7 @@ export async function repairCodexImagegen(input) {
         before,
         after,
         steps,
+        communication_test: communicationTest,
         blockers,
         manual_actions: recovered ? [] : [
             `Install/update Codex CLI if missing: npm i -g @openai/codex@latest`,

package/dist/core/doctor/mcp-transport-collision-repair.js

@@ -0,0 +1,129 @@
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
+import { mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig, tomlTableRange } from '../mcp/mcp-config-preservation.js';
+export async function detectAndRepairMcpTransportCollisions(input) {
+    const root = path.resolve(input.root);
+    const apply = input.apply === true;
+    const project = await readProjectCodexConfig(root);
+    const global = await readGlobalCodexConfigText();
+    const distinctConfigs = path.resolve(global.path) !== path.resolve(project.path);
+    const serverNames = listMcpServerNames(project.text);
+    let workingText = project.text;
+    const servers = [];
+    const blockers = [];
+    const warnings = [];
+    for (const server of serverNames) {
+        const disabled = mcpServerExplicitlyDisabled(workingText, server);
+        if (disabled) {
+            servers.push({ server, status: 'disabled', project_transport: null, global_transport: null });
+            continue;
+        }
+        const projectBlock = mcpServerBlock(workingText, server);
+        const projectTransport = blockTransport(projectBlock);
+        const globalTransport = distinctConfigs ? blockTransport(mcpServerBlock(global.text, server)) : null;
+        const collision = Boolean(projectTransport) && Boolean(globalTransport) && projectTransport !== globalTransport;
+        if (!collision) {
+            servers.push({ server, status: 'no_collision', project_transport: projectTransport, global_transport: globalTransport });
+            continue;
+        }
+        if (!apply) {
+            servers.push({ server, status: 'collision_detected', project_transport: projectTransport, global_transport: globalTransport });
+            blockers.push(`mcp_transport_collision:${server}`);
+            continue;
+        }
+        const range = tomlTableRange(workingText, `mcp_servers.${server}`, true);
+        if (!range) {
+            servers.push({ server, status: 'collision_detected', project_transport: projectTransport, global_transport: globalTransport });
+            blockers.push(`mcp_transport_collision:${server}`);
+            continue;
+        }
+        const commented = commentOutMcpServerBlock(workingText.slice(range.start, range.end), server, projectTransport, globalTransport);
+        const nextText = `${workingText.slice(0, range.start)}${commented}${workingText.slice(range.end)}`;
+        const resolved = nextText !== workingText;
+        if (!resolved) {
+            servers.push({ server, status: 'collision_detected', project_transport: projectTransport, global_transport: globalTransport });
+            blockers.push(`mcp_transport_collision:${server}`);
+            continue;
+        }
+        const before = workingText;
+        workingText = nextText;
+        await writeCodexConfigGuarded({
+            root,
+            configPath: project.path,
+            before,
+            cause: `mcp-transport-collision-repair:${server}`,
+            mutate: () => workingText
+        });
+        servers.push({ server, status: 'collision_resolved', project_transport: projectTransport, global_transport: globalTransport });
+        warnings.push(`mcp_transport_collision_resolved:${server}`);
+    }
+    let report = {
+        schema: 'sks.mcp-transport-collision-repair.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        apply,
+        project_config_path: project.path,
+        global_config_path: global.path,
+        servers,
+        blockers,
+        warnings,
+        raw_secret_values_recorded: false
+    };
+    if (input.reportPath !== null) {
+        const reportPath = input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-mcp-transport-collision-repair.json');
+        try {
+            await writeJsonAtomic(reportPath, report);
+        }
+        catch (err) {
+            report = { ...report, report_write_failed: true };
+            process.stderr.write(`SKS doctor warning: failed to write MCP transport collision repair report ${reportPath}: ${messageOf(err)}\n`);
+        }
+    }
+    return report;
+}
+/** Scans only the top-level project config text for `[mcp_servers.<name>]` headers (not nested child tables like `.env`). */
+function listMcpServerNames(text) {
+    const source = String(text || '');
+    const pattern = /^\s*\[mcp_servers\.([^.\]]+)\]\s*(?:#.*)?$/gm;
+    const names = [];
+    let match;
+    while ((match = pattern.exec(source)) !== null) {
+        const name = match[1];
+        if (name && !names.includes(name))
+            names.push(name);
+    }
+    return names;
+}
+function blockTransport(block) {
+    if (!block)
+        return null;
+    if (/^\s*command\s*=/m.test(block))
+        return 'stdio';
+    if (/^\s*url\s*=/m.test(block))
+        return 'url';
+    return null;
+}
+async function readGlobalCodexConfigText() {
+    const home = process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
+    const file = path.join(home, 'config.toml');
+    const text = await fs.readFile(file, 'utf8').catch(() => '');
+    return { path: file, text };
+}
+/** Comments every line of the colliding project MCP block (header + child tables like .env) so Codex stops merging
+ * two transports for the same server name, while keeping the original text — including secrets — recoverable in place. */
+function commentOutMcpServerBlock(block, server, projectTransport, globalTransport) {
+    const note = `# [sks doctor] MCP server "${server}" project block disabled: project transport (${projectTransport}) collided with the global config's transport (${globalTransport}) for the same server name (Codex refuses the merged config, e.g. "url is not supported for stdio"). Re-add a block with a matching transport if this project needs its own "${server}" MCP server.\n`;
+    const commented = String(block || '')
+        .replace(/\s+$/, '')
+        .split(/\r?\n/)
+        .map((line) => (line.length ? `# ${line}` : '#'))
+        .join('\n');
+    return `${note}${commented}\n`;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=mcp-transport-collision-repair.js.map

package/dist/core/doctor/supabase-mcp-repair.js

@@ -1,7 +1,9 @@
+import os from 'node:os';
 import path from 'node:path';
+import fs from 'node:fs/promises';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
-import { mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig, replaceOrAppendMcpServerBlock } from '../mcp/mcp-config-preservation.js';
+import { mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig, replaceOrAppendMcpServerBlock, tomlTableRange } from '../mcp/mcp-config-preservation.js';
 export async function repairSupabaseMcp(input) {
     const root = path.resolve(input.root);
     const config = await readProjectCodexConfig(root);
@@ -11,9 +13,37 @@ export async function repairSupabaseMcp(input) {
     const tokenEnvPresent = Boolean(process.env.SUPABASE_ACCESS_TOKEN);
     const readOnlyBefore = /read[_-]?only\s*=\s*true|access_mode\s*=\s*"read-only"|--read-only/.test(block);
     const unsafeWriteAccessBefore = configured && !disabled && !readOnlyBefore && /write|service_role|SUPABASE_ACCESS_TOKEN/.test(block);
+    // Codex merges the global (~/.codex) and project (.codex) config per key. When
+    // the project defines a stdio supabase server (command=...) while the global
+    // one uses a streamable-http url, the merged table has both `command` and
+    // `url`, and Codex refuses to load with "url is not supported for stdio",
+    // blocking every chat/task in that project. Detect and disable the project's
+    // stdio block so it inherits the safe global read-only url form.
+    const globalConfig = await readGlobalCodexConfigText();
+    const distinctConfigs = path.resolve(globalConfig.path) !== path.resolve(config.path);
+    const projectTransport = blockTransport(block);
+    const globalTransport = distinctConfigs ? blockTransport(mcpServerBlock(globalConfig.text, 'supabase')) : null;
+    const stdioUrlTransportCollision = configured && !disabled && projectTransport === 'stdio' && globalTransport === 'url';
     let afterText = config.text;
     let readOnlyMigrated = false;
-    if (configured && !disabled && !readOnlyBefore && input.apply) {
+    let transportCollisionResolved = false;
+    if (stdioUrlTransportCollision && input.apply) {
+        const range = tomlTableRange(config.text, 'mcp_servers.supabase', true);
+        if (range) {
+            const commented = commentOutStdioSupabaseBlock(config.text.slice(range.start, range.end));
+            afterText = `${config.text.slice(0, range.start)}${commented}${config.text.slice(range.end)}`;
+            transportCollisionResolved = afterText !== config.text;
+            if (transportCollisionResolved)
+                await writeCodexConfigGuarded({
+                    root,
+                    configPath: config.path,
+                    before: config.text,
+                    cause: 'supabase-mcp-transport-collision',
+                    mutate: () => afterText
+                });
+        }
+    }
+    else if (configured && !disabled && !readOnlyBefore && input.apply) {
         afterText = replaceOrAppendMcpServerBlock(config.text, 'supabase', setReadOnly(block));
         readOnlyMigrated = afterText !== config.text;
         if (readOnlyMigrated)
@@ -25,16 +55,20 @@ export async function repairSupabaseMcp(input) {
                 mutate: () => afterText
             });
     }
-    const afterBlock = readOnlyMigrated ? mcpServerBlock(afterText, 'supabase') || '' : block;
+    // A resolved collision comments the whole stdio block out, so the project no
+    // longer contributes an active supabase server at all.
+    const effectivelyConfigured = configured && !transportCollisionResolved;
+    const afterBlock = transportCollisionResolved ? '' : readOnlyMigrated ? mcpServerBlock(afterText, 'supabase') || '' : block;
     const readOnlyAfter = /read[_-]?only\s*=\s*true|access_mode\s*=\s*"read-only"|--read-only/.test(afterBlock);
-    const unsafeWriteAccess = configured && !disabled && !readOnlyAfter && /write|service_role|SUPABASE_ACCESS_TOKEN/.test(afterBlock);
-    const writeScopeRequiresConfirmation = configured && !disabled && (unsafeWriteAccessBefore || !readOnlyAfter);
-    const readyBlocking = unsafeWriteAccess;
-    const manualRequired = configured && !disabled && (!tokenEnvPresent || writeScopeRequiresConfirmation);
+    const unsafeWriteAccess = effectivelyConfigured && !disabled && !readOnlyAfter && /write|service_role|SUPABASE_ACCESS_TOKEN/.test(afterBlock);
+    const transportCollisionUnresolved = stdioUrlTransportCollision && !transportCollisionResolved;
+    const writeScopeRequiresConfirmation = effectivelyConfigured && !disabled && (unsafeWriteAccessBefore || !readOnlyAfter);
+    const readyBlocking = unsafeWriteAccess || transportCollisionUnresolved;
+    const manualRequired = effectivelyConfigured && !disabled && (!tokenEnvPresent || writeScopeRequiresConfirmation);
     let report = {
         schema: 'sks.doctor-supabase-mcp-repair.v1',
         generated_at: nowIso(),
-        ok: !configured || disabled || !unsafeWriteAccess,
+        ok: (!configured || disabled || !unsafeWriteAccess) && !transportCollisionUnresolved,
         apply: input.apply === true,
         configured,
         disabled,
@@ -42,18 +76,26 @@ export async function repairSupabaseMcp(input) {
         token_env_present: tokenEnvPresent,
         unsafe_write_access: unsafeWriteAccess,
         read_only_migrated: readOnlyMigrated,
+        stdio_url_transport_collision: stdioUrlTransportCollision,
+        transport_collision_resolved: transportCollisionResolved,
         write_scope_requires_confirmation: writeScopeRequiresConfirmation,
         ready_blocking: readyBlocking,
         manual_required: manualRequired,
-        next_action: manualRequired
-            ? tokenEnvPresent
-                ? 'Set persistent Supabase MCP to read-only. Write-scoped Supabase MCP is allowed only through a mission-local MadDB runtime profile.'
-                : 'Set SUPABASE_ACCESS_TOKEN only when an explicit MadDB run needs Supabase MCP auth; otherwise keep persistent Supabase MCP disabled/read-only.'
-            : null,
-        blockers: readyBlocking ? ['supabase_mcp_write_access_not_safe_by_default'] : [],
+        next_action: transportCollisionUnresolved
+            ? 'Project Supabase MCP uses stdio while the global config uses a streamable-http url; Codex rejects the merged config with "url is not supported for stdio". Run `sks doctor --fix` to disable the project stdio block so it inherits the safe global read-only url.'
+            : manualRequired
+                ? tokenEnvPresent
+                    ? 'Set persistent Supabase MCP to read-only. Write-scoped Supabase MCP is allowed only through a mission-local MadDB runtime profile.'
+                    : 'Set SUPABASE_ACCESS_TOKEN only when an explicit MadDB run needs Supabase MCP auth; otherwise keep persistent Supabase MCP disabled/read-only.'
+                : null,
+        blockers: [
+            ...(unsafeWriteAccess ? ['supabase_mcp_write_access_not_safe_by_default'] : []),
+            ...(transportCollisionUnresolved ? ['supabase_mcp_stdio_url_transport_collision'] : [])
+        ],
         warnings: [
-            ...(configured && !tokenEnvPresent ? ['supabase_access_token_unset_write_features_manual_required'] : []),
-            ...(readOnlyMigrated ? ['supabase_mcp_migrated_to_read_only'] : [])
+            ...(effectivelyConfigured && !tokenEnvPresent ? ['supabase_access_token_unset_write_features_manual_required'] : []),
+            ...(readOnlyMigrated ? ['supabase_mcp_migrated_to_read_only'] : []),
+            ...(transportCollisionResolved ? ['supabase_mcp_stdio_block_disabled_for_url_collision'] : [])
         ],
         raw_secret_values_recorded: false
     };
@@ -81,4 +123,31 @@ function setReadOnly(block) {
         lines.push('read_only = true');
     return `${lines.join('\n')}\n`;
 }
+async function readGlobalCodexConfigText() {
+    const home = process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
+    const file = path.join(home, 'config.toml');
+    const text = await fs.readFile(file, 'utf8').catch(() => '');
+    return { path: file, text };
+}
+function blockTransport(block) {
+    if (!block)
+        return null;
+    if (/^\s*command\s*=/m.test(block))
+        return 'stdio';
+    if (/^\s*url\s*=/m.test(block))
+        return 'url';
+    return null;
+}
+/** Comment every line of a supabase MCP block (header + child .env table) so
+ * Codex stops loading it as a stdio server, while keeping the original text —
+ * including the access token — recoverable in place. */
+function commentOutStdioSupabaseBlock(block) {
+    const note = '# [sks doctor] Supabase MCP stdio block disabled: it collided with the global read-only URL Supabase entry (Codex: "url is not supported for stdio"). Re-add a read-only URL form (url = "https://mcp.supabase.com/mcp?project_ref=<ref>&read_only=true&features=database,docs") if this project needs its own Supabase MCP.\n';
+    const commented = String(block || '')
+        .replace(/\s+$/, '')
+        .split(/\r?\n/)
+        .map((line) => (line.length ? `# ${line}` : '#'))
+        .join('\n');
+    return `${note}${commented}\n`;
+}
 //# sourceMappingURL=supabase-mcp-repair.js.map

package/dist/core/feature-fixtures.js

@@ -44,6 +44,14 @@ const FIXTURES = Object.freeze({
     'cli-versioning': fixture('execute', 'sks versioning status --json', [], 'pass'),
     'cli-aliases': fixture('execute', 'sks aliases', [], 'pass'),
     'cli-fix-path': fixture('execute', 'sks fix-path --json', [], 'pass'),
+    // selftest --real executes this fixture directly against this real repo (no
+    // hermetic isolation for execute/execute_and_validate_artifacts fixtures - see
+    // feature-fixture-executor.ts), so a real full scan (~79 modules) needs a
+    // realistic budget; the 8000 default is sized for smaller/typical repos, not
+    // this one, so pass an explicit larger budget rather than lowering the gate.
+    'cli-wiki-code': fixture('execute_and_validate_artifacts', 'sks wiki refresh --code --token-budget 20000 --json', [{ path: '.sneakoscope/wiki/code-pack.json', schema: 'sks.code-pack.v1', optional: true }], 'pass'),
+    'cli-agent-bridge': fixture('execute_and_validate_artifacts', 'sks agent-bridge setup --json', [{ path: '.sneakoscope/agent-bridge/manifest.json', schema: 'sks.agent-manifest.v1', optional: true }], 'pass'),
+    'cli-mcp-server': fixture('execute', 'sks mcp-server --probe', [], 'pass'),
     'cli-selftest': fixture('execute', 'sks selftest --mock', [], 'pass'),
     'cli-git': fixture('execute', 'sks git policy --json', [], 'pass'),
     'cli-uninstall': fixture('execute', 'sks uninstall --dry-run --json', [], 'pass'),

package/dist/core/feature-registry.js

@@ -54,6 +54,7 @@ export async function buildFeatureRegistry({ root = packageRoot(), generatedAt =
     features.push(agentProofEvidenceFeature());
     features.push(doctorImagegenRepairFeature());
     features.push(...imagegenWiringFeatures());
+    features.push(wikiCodePackFeature());
     for (const skillName of skillNames) {
         if (!skillCoveredByRoute(skillName))
             features.push(skillFeature(skillName));
@@ -714,6 +715,26 @@ function agentProofEvidenceFeature() {
         }
     });
 }
+function wikiCodePackFeature() {
+    return baseFeature({
+        id: 'cli-wiki-code',
+        commands: ['sks wiki refresh --code --json', 'sks wiki validate --json'],
+        aliases: ['wiki.code_pack', 'code_pack_refresh'],
+        category: 'triwiki',
+        maturity: 'beta',
+        intent: 'Deterministic codebase scan (any repo, not just this one) turned into a source-cited, quality-gated code pack, wired into TriWiki attention as a dedicated code: sub-budget so LLM handoffs see accurate codebase context at low token cost.',
+        voxel_triwiki_integration: 'code: entries ranked into attention.use_first/hydrate_first by trust_score, independent of the policy-claim RGBA/geometric selection',
+        completion_proof_integration: 'sks wiki validate --json reports code_pack freshness (fresh/stale/missing) by comparing the pack\'s recorded git HEAD sha to the current one',
+        known_gaps: ['ranking is by trust_score only, not live per-prompt keyword relevance, since contextCapsule\'s call site here refreshes a project-wide pack rather than a per-mission one'],
+        source_refs: {
+            cli_command_names: ['wiki'],
+            handler_keys: ['wiki'],
+            dollar_commands: [],
+            app_skill_aliases: [],
+            skills: ['triwiki']
+        }
+    });
+}
 function doctorImagegenRepairFeature() {
     return baseFeature({
         id: 'doctor:imagegen-repair',

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '5.5.2';
+export const PACKAGE_VERSION = '5.6.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/mad-db/mad-db-capability.js

@@ -88,7 +88,7 @@ export async function resolveMadDbMissionId(root, state = {}, explicitMissionId
         return String(state.mad_db_capability_mission_id);
     if (state?.mission_id)
         return String(state.mission_id);
-    return findLatestMission(root);
+    return findLatestMission(root, { mode: 'mad-db' });
 }
 export function isMadDbCapabilityActive(capability, nowMs = Date.now()) {
     if (!capability)

package/dist/core/mission.js

@@ -46,24 +46,40 @@ export async function loadMission(root, id) {
     const mission = await readJson(path.join(dir, 'mission.json'));
     return { id, dir, mission };
 }
-export async function findLatestMission(root) {
+function normalizeMissionRoute(value) {
+    return String(value || '').replace(/^\$/, '').replace(/_/g, '-').toLowerCase();
+}
+export async function findLatestMission(root, opts = {}) {
+    const { route = null, mode = null, gateFile = null } = opts || {};
     const dir = missionsDir(root);
     if (!(await exists(dir)))
         return null;
     const fs = await import('node:fs/promises');
     const entries = await fs.readdir(dir, { withFileTypes: true });
     const ids = entries.filter((e) => e.isDirectory() && e.name.startsWith('M-')).map((e) => e.name);
-    const candidates = await Promise.all(ids.map(async (id) => {
+    const candidates = (await Promise.all(ids.map(async (id) => {
         const dirPath = missionDir(root, id);
         const stat = await fs.stat(dirPath).catch(() => null);
         const mission = await readJson(path.join(dirPath, 'mission.json'), {}).catch(() => ({}));
+        if (mode && mission.mode !== mode)
+            return null;
+        // Route scoping is indirect: mission.json never carries a route field, so the
+        // caller must name the route-specific gate artifact to probe for.
+        if (route && gateFile) {
+            const gate = await readJson(path.join(dirPath, gateFile), null).catch(() => null);
+            if (!gate)
+                return null;
+            const actual = normalizeMissionRoute(gate.route || gate.route_command || '');
+            if (actual && actual !== normalizeMissionRoute(route))
+                return null;
+        }
         const createdMs = Date.parse(mission.created_at || mission.updated_at || '');
         return {
             id,
             createdMs: Number.isFinite(createdMs) ? createdMs : 0,
             mtimeMs: stat?.mtimeMs || 0
         };
-    }));
+    }))).filter((candidate) => candidate !== null);
     candidates.sort((a, b) => (a.createdMs - b.createdMs) || (a.mtimeMs - b.mtimeMs) || a.id.localeCompare(b.id));
     return candidates.at(-1)?.id || null;
 }

package/dist/core/naruto/naruto-real-worker-child.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { appendJsonlBounded, ensureDir, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { runCodexTask } from '../codex-control/codex-control-plane.js';
 import { CODEX_AGENT_WORKER_RESULT_SCHEMA_ID, codexAgentWorkerResultSchema } from '../codex-control/schemas/agent-worker-result.schema.js';
+import { normalizeWorkerPromptText } from './normalize-worker-prompt-text.js';
 async function main() {
     const intakePath = process.argv[2];
     if (!intakePath)
@@ -78,6 +79,8 @@ async function main() {
                 sdk_run_id: taskResult.sdkRunId || null
             },
             changed_files: Array.isArray(workerResult?.changed_files) ? workerResult.changed_files : [],
+            parent_prompt_truncated: intake.parent_prompt_truncated === true,
+            parent_prompt_dropped_chars: Number(intake.parent_prompt_dropped_chars || 0),
             blockers
         });
         finished = true;
@@ -167,7 +170,8 @@ function backendPreference(value) {
 }
 function buildNarutoWorkerPrompt(item, parentPrompt) {
     const writeAllowed = item?.write_allowed === true;
-    const parentObjective = normalizeWorkerPromptText(parentPrompt);
+    const parentObjectiveNormalized = normalizeWorkerPromptText(parentPrompt);
+    const parentObjective = parentObjectiveNormalized.text;
     return [
         'You are a Naruto route worker. Complete only this assigned work item and return JSON matching the required schema.',
         parentObjective ? `Parent Naruto objective:\n${parentObjective}` : null,
@@ -196,9 +200,6 @@ function buildNarutoWorkerPrompt(item, parentPrompt) {
         'Include verification checks, rollback notes, blockers, findings, and changed_files.'
     ].filter(Boolean).join('\n');
 }
-function normalizeWorkerPromptText(value) {
-    return String(value || '').replace(/\s+/g, ' ').trim().slice(0, 4000);
-}
 main().then(() => {
     process.exit(0);
 }).catch((err) => {

package/dist/core/naruto/naruto-real-worker-runtime.js

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { ensureDir, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { allocateWorkerWorktree } from '../git/git-worktree-manager.js';
 import { cleanupGitWorktree } from '../git/git-worktree-cleanup.js';
+import { normalizeWorkerPromptText } from './normalize-worker-prompt-text.js';
 export async function spawnActualNarutoWorker(input) {
     const workerDir = path.join(input.root, '.sneakoscope', 'missions', input.missionId, 'agents', 'naruto-real-workers', input.item.id);
     await ensureDir(workerDir);
@@ -26,12 +27,15 @@ export async function spawnActualNarutoWorker(input) {
     const resultPath = path.join(workerDir, 'worker-result.json');
     const heartbeatPath = path.join(workerDir, 'worker-heartbeat.jsonl');
     const intakePath = path.join(workerDir, 'worker-intake.json');
+    const normalizedParentPrompt = normalizeWorkerPromptText(input.parentPrompt);
     await writeJsonAtomic(intakePath, {
         schema: 'sks.naruto-actual-worker-intake.v1',
         generated_at: nowIso(),
         mission_id: input.missionId,
         item: input.item,
-        parent_prompt: normalizeWorkerPromptText(input.parentPrompt),
+        parent_prompt: normalizedParentPrompt.text,
+        parent_prompt_truncated: normalizedParentPrompt.truncated,
+        parent_prompt_dropped_chars: normalizedParentPrompt.dropped_chars,
         placement: input.placement,
         backend: input.backend,
         result_path: resultPath,
@@ -88,9 +92,6 @@ export async function collectActualNarutoWorker(handle) {
         blockers
     };
 }
-function normalizeWorkerPromptText(value) {
-    return String(value || '').replace(/\s+/g, ' ').trim().slice(0, 4000);
-}
 function actualWorkerEntrypoint() {
     return fileURLToPath(new URL('./naruto-real-worker-child.js', import.meta.url));
 }