sneakoscope 6.0.3 → 6.1.2

package/dist/core/codex-native/native-capability-repair-matrix.js

@@ -17,13 +17,21 @@ export async function buildNativeCapabilityRepairMatrix(input) {
     const root = path.resolve(input.root);
     const selected = new Set(input.capabilities || NATIVE_CAPABILITY_IDS);
     const fixture = input.fixture || false;
+    const needsImageCapability = selected.has('image_generation');
     const imageCapability = fixture
         ? fixtureImageCapability(fixture)
-        : await detectImagegenCapability({ timeoutMs: 2500 }).catch((err) => ({ blockers: [messageOf(err)], auth_readiness: null, codex_app: { available: false } }));
+        : needsImageCapability
+            ? await detectImagegenCapability({ timeoutMs: 2500 }).catch((err) => ({ blockers: [messageOf(err)], auth_readiness: null, codex_app: { available: false } }))
+            : { blockers: [], auth_readiness: null, codex_app: { available: false } };
+    const needsNativeFeatureMatrix = selected.has('app_handoff') || selected.has('image_path_exposure');
     const nativeFeatureMatrix = fixture
         ? fixtureNativeFeatureMatrix(fixture)
-        : await buildCodexNativeFeatureMatrix({ root, mode: 'read-only' }).catch((err) => ({ ok: false, features: {}, blockers: [messageOf(err)], invocation_defaults: {} }));
-    const states = await Promise.all(NATIVE_CAPABILITY_IDS.filter((id) => selected.has(id)).map((id) => stateForCapability(root, id, imageCapability, nativeFeatureMatrix)));
+        : needsNativeFeatureMatrix
+            ? await buildCodexNativeFeatureMatrix({ root, mode: 'read-only' }).catch((err) => ({ ok: false, features: {}, blockers: [messageOf(err)], invocation_defaults: {} }))
+            : { ok: true, features: {}, blockers: [], invocation_defaults: {} };
+    const states = await Promise.all(NATIVE_CAPABILITY_IDS
+        .filter((id) => selected.has(id))
+        .map((id) => stateForCapability(root, id, imageCapability, nativeFeatureMatrix, fixture)));
     const coreBlockers = states.flatMap((state) => state.core_blockers || state.blockers);
     const routeBlockers = mergeRouteBlockers(states);
     const warnings = states.flatMap((state) => state.warnings);
@@ -47,24 +55,47 @@ export async function buildNativeCapabilityRepairMatrix(input) {
         await writeJsonAtomic(reportPath, matrix).catch(() => undefined);
     return matrix;
 }
-async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix) {
+async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix, fixture) {
     const reports = path.join(root, '.sneakoscope', 'reports');
     if (id === 'image_generation') {
-        const verified = imageCapability?.codex_app?.available === true || imageCapability?.auth_readiness?.headless_auto_available === true;
+        const fixtureVerified = fixture === 'all-repairable';
+        const builtInConfigured = imageCapability?.codex_app?.available === true;
+        const authReady = imageCapability?.auth_readiness?.headless_auto_available === true;
+        const realOutputVerified = (builtInConfigured
+            && imageCapability?.real_generation_available === true
+            && imageCapability?.real_output_verified_by_capability_check === true
+            && fixture === false);
+        const verified = fixtureVerified || realOutputVerified;
+        const routeBlocker = builtInConfigured
+            ? 'codex_imagegen_real_output_unverified'
+            : 'codex_app_builtin_imagegen_capability_missing';
         return {
             id,
-            before: verified ? 'verified' : 'blocked',
+            before: verified ? 'verified' : builtInConfigured ? 'degraded' : 'blocked',
             repairability: verified ? 'auto' : 'manual-required',
             availability: verified ? 'verified' : 'manual-required',
             required_for: ['route-image'],
-            repair_actions: verified ? ['postcheck-imagegen-path-contract'] : ['Sign in to Codex App and enable/use the built-in $imagegen / gpt-image-2 surface, then rerun `sks doctor --capabilities --yes`.'],
+            repair_actions: verified
+                ? ['postcheck-imagegen-path-contract']
+                : builtInConfigured
+                    ? ['Invoke Codex App $imagegen with gpt-image-2 in a fresh task and record the selected raster output path before retrying the image route.']
+                    : ['Sign in to Codex App, enable the built-in $imagegen / gpt-image-2 surface, then verify it with a real generated raster output before retrying the image route.'],
             after: null,
             artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
             core_blockers: [],
-            route_blockers: verified ? {} : { 'route-image': ['imagegen_auth_or_codex_app_builtin_missing'] },
-            manual_actions: verified ? [] : ['Sign in to Codex App and enable/use the built-in $imagegen / gpt-image-2 surface before image routes.'],
+            route_blockers: verified ? {} : { 'route-image': [routeBlocker] },
+            manual_actions: verified ? [] : [
+                builtInConfigured
+                    ? 'Generate one real raster with Codex App $imagegen / gpt-image-2 and bind its output path to the route evidence.'
+                    : 'Sign in to Codex App and enable/use the built-in $imagegen / gpt-image-2 surface before image routes.'
+            ],
             blockers: [],
-            warnings: verified ? [] : ['image_generation_not_verified_without_real_capability']
+            warnings: verified ? [] : [
+                'image_generation_not_verified_without_real_capability',
+                ...(authReady && !builtInConfigured ? ['imagegen_auth_readiness_is_not_builtin_output_proof'] : [])
+            ],
+            evidence_level: fixtureVerified ? 'fixture' : realOutputVerified ? 'real-interaction' : builtInConfigured ? 'configuration' : authReady ? 'environment-hint' : 'none',
+            real_interaction_verified: realOutputVerified
         };
     }
     if (id === 'image_followup_edit') {
@@ -118,38 +149,50 @@ async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix
         };
     }
     if (id === 'computer_use') {
-        const envVerified = process.env.SKS_COMPUTER_USE_CAPABILITY === 'verified';
+        const fixtureVerified = fixture === 'all-repairable';
+        const envHint = process.env.SKS_COMPUTER_USE_CAPABILITY === 'verified';
         return {
             id,
-            before: envVerified ? 'verified' : 'unknown',
-            availability: envVerified ? 'verified' : 'manual-required',
+            before: fixtureVerified ? 'verified' : envHint ? 'degraded' : 'unknown',
+            availability: fixtureVerified ? 'verified' : 'manual-required',
             required_for: ['route-computer-use'],
-            repairability: envVerified ? 'auto' : 'manual-required',
-            repair_actions: envVerified ? ['postcheck-computer-use'] : ['Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions; run `$CU doctor` for native capability diagnostics, then rerun `sks doctor --capabilities --yes`.'],
+            repairability: fixtureVerified ? 'auto' : 'manual-required',
+            repair_actions: fixtureVerified ? ['postcheck-computer-use'] : ['Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions; execute a real native interaction, then rerun `sks doctor --capabilities --yes`.'],
             after: null,
             artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
             core_blockers: [],
-            route_blockers: envVerified ? {} : { 'route-computer-use': ['computer_use_os_permission_or_capability_unknown'] },
-            manual_actions: envVerified ? [] : ['Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions before `$CU` routes.'],
+            route_blockers: fixtureVerified ? {} : { 'route-computer-use': ['computer_use_os_permission_or_capability_unknown'] },
+            manual_actions: fixtureVerified ? [] : ['Enable Codex Computer Use and macOS Screen Recording/Accessibility permissions and verify a real interaction before `$CU` routes.'],
             blockers: [],
-            warnings: envVerified ? [] : ['manual_os_permission_required']
+            warnings: fixtureVerified ? [] : [
+                'manual_os_permission_required',
+                ...(envHint ? ['computer_use_environment_hint_is_not_interaction_proof'] : [])
+            ],
+            evidence_level: fixtureVerified ? 'fixture' : envHint ? 'environment-hint' : 'none',
+            real_interaction_verified: false
         };
     }
-    const chromeReady = process.env.SKS_CHROME_EXTENSION_READY === '1';
+    const fixtureVerified = fixture === 'all-repairable';
+    const chromeHint = process.env.SKS_CHROME_EXTENSION_READY === '1';
     return {
         id,
-        before: chromeReady ? 'verified' : 'unknown',
-        availability: chromeReady ? 'verified' : 'manual-required',
+        before: fixtureVerified ? 'verified' : chromeHint ? 'degraded' : 'unknown',
+        availability: fixtureVerified ? 'verified' : 'manual-required',
         required_for: ['route-chrome-web-review'],
-        repairability: chromeReady ? 'auto' : 'manual-required',
-        repair_actions: chromeReady ? ['postcheck-chrome-extension-readiness'] : ['Install/enable the official Codex Chrome Extension, approve it in Codex App, then rerun `sks doctor --capabilities --yes`; web/browser/localhost verification must use the Chrome extension path first.'],
+        repairability: fixtureVerified ? 'auto' : 'manual-required',
+        repair_actions: fixtureVerified ? ['postcheck-chrome-extension-readiness'] : ['Install/enable the official Codex Chrome Extension, approve it in Codex App, then verify a real browser interaction; web/browser/localhost verification must use the Chrome extension path first.'],
         after: null,
         artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
         core_blockers: [],
-        route_blockers: chromeReady ? {} : { 'route-chrome-web-review': ['codex_chrome_extension_readiness_not_verified'] },
-        manual_actions: chromeReady ? [] : ['Install/enable the official Codex Chrome Extension before browser/web review routes.'],
+        route_blockers: fixtureVerified ? {} : { 'route-chrome-web-review': ['codex_chrome_extension_readiness_not_verified'] },
+        manual_actions: fixtureVerified ? [] : ['Install/enable the official Codex Chrome Extension and verify a real interaction before browser/web review routes.'],
         blockers: [],
-        warnings: chromeReady ? [] : ['manual_chrome_extension_setup_required']
+        warnings: fixtureVerified ? [] : [
+            'manual_chrome_extension_setup_required',
+            ...(chromeHint ? ['chrome_extension_environment_hint_is_not_interaction_proof'] : [])
+        ],
+        evidence_level: fixtureVerified ? 'fixture' : chromeHint ? 'environment-hint' : 'none',
+        real_interaction_verified: false
     };
 }
 export async function writeSavedArtifactPathContract(root) {
@@ -253,7 +296,13 @@ async function dirWritable(dir) {
 }
 function fixtureImageCapability(mode) {
     return mode === 'all-repairable'
-        ? { codex_app: { available: true }, auth_readiness: { headless_auto_available: true }, blockers: [] }
+        ? {
+            codex_app: { available: true },
+            auth_readiness: { headless_auto_available: true },
+            real_generation_available: true,
+            real_output_verified_by_capability_check: false,
+            blockers: []
+        }
         : { codex_app: { available: false }, auth_readiness: { headless_auto_available: false }, blockers: ['fixture_manual_required'] };
 }
 function fixtureNativeFeatureMatrix(mode) {

package/dist/core/codex-plugins/codex-plugin-json.js

@@ -2,31 +2,36 @@ import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { detectCodex0138Capability } from '../codex-control/codex-0138-capability.js';
 import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
-export async function runCodexPluginListJson() {
+import { redactSecrets, redactString } from '../secret-redaction.js';
+export async function runCodexPluginListJson(codexBin) {
     if (process.env.SKS_CODEX_PLUGIN_JSON_FAKE === '1')
         return fakePluginList();
-    const bin = await findCodexBinary();
+    const bin = codexBin === undefined ? await findCodexBinary() : codexBin;
     if (!bin)
         return { plugins: [], blockers: ['codex_cli_missing'] };
     return runCodexJson(bin, ['plugin', 'list', '--json']);
 }
-export async function runCodexPluginDetailJson(pluginId) {
+export async function runCodexPluginDetailJson(pluginId, codexBin) {
     if (process.env.SKS_CODEX_PLUGIN_JSON_FAKE === '1')
         return fakePluginDetail(pluginId);
-    const bin = await findCodexBinary();
+    const bin = codexBin === undefined ? await findCodexBinary() : codexBin;
     if (!bin)
         return { blockers: ['codex_cli_missing'] };
     return runCodexJson(bin, ['plugin', 'detail', pluginId, '--json']);
 }
-export async function buildCodexPluginInventory() {
+export async function buildCodexPluginInventory(input = {}) {
     const started = Date.now();
     const capability = await detectCodex0138Capability();
-    const listJson = await runCodexPluginListJson();
+    const codexBin = input.codexBin === undefined ? await findCodexBinary() : input.codexBin;
+    const listJson = input.listJson === undefined ? await runCodexPluginListJson(codexBin) : input.listJson;
     const summaries = normalizePluginList(listJson);
     const concurrency = Math.max(1, Number(process.env.SKS_CODEX_PLUGIN_DETAIL_CONCURRENCY || 6) || 6);
+    const detailJsonSupported = input.detailJsonSupported ?? await codexPluginDetailJsonSupported(codexBin);
     let failed = 0;
     const plugins = await mapWithConcurrency(summaries, concurrency, async (summary) => {
-        const detail = await runCodexPluginDetailJson(summary.id || summary.name).catch((err) => ({ error: err?.message || String(err) }));
+        const detail = detailJsonSupported
+            ? await runCodexPluginDetailJson(pluginSelector(summary), codexBin).catch((err) => ({ error: err?.message || String(err) }))
+            : {};
         if (detail?.error || normalizeList(detail?.blockers).length > 0)
             failed += 1;
         return normalizePlugin(summary, detail);
@@ -36,18 +41,19 @@ export async function buildCodexPluginInventory() {
         ...normalizeList(listJson?.blockers),
         ...(process.env.SKS_CODEX_PLUGIN_JSON_FAKE_NO_MCP === '1' ? ['fixture_mcp_candidates_disabled'] : [])
     ];
-    return {
+    return redactSecrets({
         schema: 'sks.codex-plugin-inventory.v1',
         generated_at: nowIso(),
         codex_0138_capability: capability,
         fetch_concurrency: concurrency,
-        detail_fetch_count: summaries.length,
+        detail_fetch_count: detailJsonSupported ? summaries.length : 0,
         detail_fetch_failed_count: failed,
+        detail_json_supported: detailJsonSupported,
         duration_ms: Date.now() - started,
         plugins,
-        marketplace_available: plugins.some((plugin) => plugin.source === 'marketplace' || plugin.source === 'remote') || Boolean(listJson?.marketplace_available || listJson?.marketplaceAvailable),
+        marketplace_available: plugins.some((plugin) => plugin.source === 'marketplace' || plugin.source === 'remote' || plugin.marketplace) || Boolean(listJson?.marketplace_available || listJson?.marketplaceAvailable),
         blockers
-    };
+    });
 }
 export async function mapWithConcurrency(items, concurrency, fn) {
     const limit = Math.max(1, Math.floor(concurrency || 1));
@@ -93,39 +99,79 @@ async function runCodexJson(bin, args) {
         return text ? JSON.parse(text) : {};
     }
     catch {
-        return { raw_text: text, blockers: [`codex_plugin_json_parse_failed:${args.join(' ')}`] };
+        return { raw_text: redactString(text), blockers: [`codex_plugin_json_parse_failed:${args.join(' ')}`] };
     }
 }
-function normalizePluginList(value) {
+export function normalizePluginList(value) {
     if (Array.isArray(value))
         return value;
-    for (const key of ['plugins', 'installed_plugins', 'installedPlugins', 'items']) {
-        if (Array.isArray(value?.[key]))
-            return value[key];
+    const rows = [];
+    const append = (items, installed = null) => {
+        if (!Array.isArray(items))
+            return;
+        for (const item of items)
+            rows.push(installed === null ? item : { ...item, installed: item?.installed ?? installed });
+    };
+    append(value?.installed, true);
+    append(value?.available, false);
+    for (const key of ['plugins', 'installed_plugins', 'installedPlugins', 'items'])
+        append(value?.[key]);
+    const deduped = new Map();
+    for (const row of rows) {
+        const selector = pluginSelector(row);
+        const current = deduped.get(selector);
+        if (!current || (row?.installed === true && current?.installed !== true))
+            deduped.set(selector, row);
     }
-    return [];
+    return [...deduped.values()];
 }
 function normalizePlugin(summary, detail) {
     const raw = { summary, detail };
-    const id = String(detail?.id || summary?.id || summary?.plugin_id || summary?.name || 'unknown');
+    const id = String(detail?.id || detail?.pluginId || summary?.id || summary?.pluginId || summary?.plugin_id || pluginSelector(summary) || summary?.name || 'unknown');
     const name = String(detail?.name || summary?.name || id);
-    const sourceText = String(detail?.source || detail?.marketplaceSource || summary?.source || summary?.marketplaceSource || '').toLowerCase();
+    const marketplace = stringOrNull(detail?.marketplaceName || detail?.marketplace || summary?.marketplaceName || summary?.marketplace);
+    const sourceText = sourceValue(detail?.source || detail?.marketplaceSource || summary?.source || summary?.marketplaceSource).toLowerCase();
     const source = sourceText.includes('marketplace') ? 'marketplace'
         : sourceText.includes('remote') ? 'remote'
             : sourceText.includes('local') ? 'local'
                 : 'unknown';
+    const installed = boolish(detail?.installed ?? summary?.installed, false);
     return {
         id,
         name,
         source,
-        installed: boolish(detail?.installed ?? summary?.installed, true),
-        enabled: boolish(detail?.enabled ?? summary?.enabled, true),
+        marketplace,
+        version: stringOrNull(detail?.version || summary?.version),
+        installed,
+        enabled: boolish(detail?.enabled ?? summary?.enabled, installed),
         default_prompts: normalizeList(detail?.default_prompts || detail?.defaultPrompts || detail?.prompts),
         remote_mcp_servers: normalizeMcpServers(detail?.remote_mcp_servers || detail?.remoteMcpServers || detail?.mcp_servers || detail?.mcpServers),
         unavailable_app_templates: normalizeList(detail?.unavailable_app_templates || detail?.unavailableAppTemplates || detail?.app_templates_unavailable),
         raw
     };
 }
+function pluginSelector(value) {
+    const explicit = String(value?.pluginId || value?.plugin_id || value?.id || '').trim();
+    if (explicit)
+        return explicit;
+    const name = String(value?.name || '').trim();
+    const marketplace = String(value?.marketplaceName || value?.marketplace || '').trim();
+    return name && marketplace ? `${name}@${marketplace}` : name;
+}
+function sourceValue(value) {
+    if (value && typeof value === 'object') {
+        return String(value.source || value.sourceType || value.type || value.path || '');
+    }
+    return String(value || '');
+}
+async function codexPluginDetailJsonSupported(codexBin) {
+    if (process.env.SKS_CODEX_PLUGIN_JSON_FAKE === '1')
+        return true;
+    if (!codexBin)
+        return false;
+    const help = await runProcess(codexBin, ['plugin', '--help'], { timeoutMs: 5000, maxOutputBytes: 32 * 1024 }).catch(() => null);
+    return help?.code === 0 && /^\s*detail\s+/m.test(`${help.stdout || ''}\n${help.stderr || ''}`);
+}
 function normalizeMcpServers(value) {
     const rows = Array.isArray(value) ? value : value && typeof value === 'object' ? Object.entries(value).map(([name, row]) => ({ name, ...(row || {}) })) : [];
     return rows.map((row, index) => ({

package/dist/core/codex-plugins/codex-plugin-repair.js

@@ -0,0 +1,118 @@
+import { findCodexBinary } from '../codex-adapter.js';
+import { nowIso, runProcess } from '../fsx.js';
+import { redactSecrets, redactString } from '../secret-redaction.js';
+import { buildCodexPluginInventory } from './codex-plugin-json.js';
+export const CODEX_PLUGIN_REPAIR_SCHEMA = 'sks.codex-plugin-repair.v1';
+export async function ensureCodexPlugins(input) {
+    const pluginIds = [...new Set((input.pluginIds || []).map(String))];
+    const invalid = pluginIds.filter((id) => !/^[a-z0-9][a-z0-9._-]*@[a-z0-9][a-z0-9._-]*$/i.test(id));
+    if (invalid.length) {
+        return report({
+            ok: false,
+            apply: input.apply === true,
+            codexBin: null,
+            pluginIds,
+            before: null,
+            after: null,
+            installs: [],
+            blockers: invalid.map((id) => `invalid_plugin_selector:${id}`)
+        });
+    }
+    const codexBin = input.codexBin === undefined ? await findCodexBinary() : input.codexBin;
+    const inventory = input.inventoryFactory || (() => buildCodexPluginInventory({ codexBin }));
+    const before = await inventory().catch((err) => failedInventory(err));
+    const missingBefore = pluginIds.filter((id) => !pluginReady(before, id));
+    const installs = [];
+    if (input.apply === true && codexBin) {
+        const run = input.run || (async (bin, args) => runProcess(bin, args, {
+            timeoutMs: input.timeoutMs || 30_000,
+            maxOutputBytes: 128 * 1024
+        }));
+        for (const pluginId of missingBefore) {
+            const result = await run(codexBin, ['plugin', 'add', pluginId, '--json']).catch((err) => ({
+                code: 1,
+                stdout: '',
+                stderr: messageOf(err)
+            }));
+            installs.push({
+                plugin_id: pluginId,
+                attempted: true,
+                ok: result.code === 0,
+                command: `${codexBin} plugin add ${pluginId} --json`,
+                exit_code: result.code,
+                stdout_tail: tail(result.stdout),
+                stderr_tail: tail(result.stderr)
+            });
+        }
+    }
+    const after = installs.length ? await inventory().catch((err) => failedInventory(err)) : before;
+    const missingAfter = pluginIds.filter((id) => !pluginReady(after, id));
+    const blockers = [
+        ...(!codexBin && missingAfter.length ? ['codex_cli_missing'] : []),
+        ...(input.apply !== true ? missingAfter.map((id) => `codex_plugin_repair_not_applied:${id}`) : []),
+        ...missingAfter.map((id) => `codex_plugin_not_ready_after_recheck:${id}`),
+        ...installs.filter((step) => !step.ok).map((step) => `codex_plugin_add_failed:${step.plugin_id}`)
+    ];
+    return report({
+        ok: missingAfter.length === 0,
+        apply: input.apply === true,
+        codexBin,
+        pluginIds,
+        before,
+        after,
+        installs,
+        blockers: [...new Set(blockers)]
+    });
+}
+function report(input) {
+    const changed = input.installs.some((step) => step.ok);
+    return redactSecrets({
+        schema: CODEX_PLUGIN_REPAIR_SCHEMA,
+        generated_at: nowIso(),
+        ok: input.ok,
+        apply: input.apply,
+        codex_bin: input.codexBin,
+        plugin_ids: input.pluginIds,
+        before: input.before,
+        after: input.after,
+        installs: input.installs,
+        changed,
+        rechecked_after_install: input.installs.length > 0,
+        current_task_tool_manifest_verified: false,
+        requires_new_task: changed,
+        restart_app_if_stale: changed,
+        next_actions: changed
+            ? [
+                'Start a new Codex/Work task so the repaired plugin skills and tools are attached to a fresh task manifest.',
+                'If the plugin is still missing in the new task, restart the ChatGPT/Codex desktop app and re-run `sks doctor --fix --repair-native-capabilities --yes`.'
+            ]
+            : [],
+        blockers: input.blockers
+    });
+}
+function pluginReady(inventory, pluginId) {
+    return inventory.plugins.some((plugin) => plugin.id === pluginId && plugin.installed === true && plugin.enabled === true);
+}
+function failedInventory(err) {
+    return {
+        schema: 'sks.codex-plugin-inventory.v1',
+        generated_at: nowIso(),
+        codex_0138_capability: null,
+        fetch_concurrency: 0,
+        detail_fetch_count: 0,
+        detail_fetch_failed_count: 0,
+        detail_json_supported: false,
+        duration_ms: 0,
+        plugins: [],
+        marketplace_available: false,
+        blockers: [`codex_plugin_inventory_failed:${redactString(messageOf(err))}`]
+    };
+}
+function tail(value, max = 2000) {
+    const text = redactString(String(value || ''));
+    return text.length > max ? text.slice(-max) : text;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=codex-plugin-repair.js.map