sneakoscope 6.0.3 → 6.1.2

package/dist/core/computer-use-status.js

@@ -1,5 +1,6 @@
 import { codexAppIntegrationStatus } from './codex-app.js';
 import { buildComputerUseLiveEvidence, computerUseLiveEvidencePath, writeComputerUseLiveEvidence } from './computer-use-live-evidence.js';
+export { createOfficialCodexComputerUseScreenshotAdapter } from './computer-use-live-evidence.js';
 export async function computerUseStatusReport(opts = {}) {
     if (process.platform !== 'darwin' && !opts.forceMacos) {
         return baseReport('not_macos', {
@@ -76,7 +77,8 @@ export async function computerUseLiveSmoke(opts = {}) {
     if (liveEvidence && evidencePath)
         await writeComputerUseLiveEvidence(evidencePath, liveEvidence);
     const evidenceMode = liveEvidence?.mode || 'probe_only';
-    const liveCaptureSuccess = evidenceMode === 'live_capture_success';
+    const adapterAttested = liveEvidence?.capture?.screenshot?.adapter_provenance?.verified === true;
+    const liveCaptureSuccess = evidenceMode === 'live_capture_success' && adapterAttested;
     const blockers = [...(liveEvidence?.blockers || [])];
     if (!realOptIn && status.status === 'not_macos')
         blockers.push('not_macos');
@@ -102,7 +104,8 @@ export async function computerUseLiveSmoke(opts = {}) {
         blockers,
         warnings,
         evidence: {
-            screenshot_captured: liveEvidence?.capture?.screenshot?.status === 'captured',
+            screenshot_captured: liveEvidence?.capture?.screenshot?.status === 'captured' && adapterAttested,
+            official_adapter_attested: adapterAttested,
             action_captured: liveEvidence?.capture?.action?.status === 'captured',
             image_voxel_linked: liveEvidence?.image_voxel?.linked === true,
             evidence_path: liveEvidence && evidencePath ? evidencePath : null

package/dist/core/daemon/sksd-hook-daemon-entrypoint.js

@@ -2,11 +2,11 @@
 // Entrypoint for the detached sksd hook daemon process (spawned by
 // spawnSksdHookDaemonDetached). Not invoked directly by users.
 import { startSksdHookDaemon } from './sksd-hook-daemon.js';
-import { evaluateHookPayload } from '../hooks-runtime.js';
+import { evaluateHookPayloadOnce } from '../hooks-runtime.js';
 const root = process.argv[2];
 if (!root) {
     process.stderr.write('sksd-hook-daemon-entrypoint: root argument required\n');
     process.exit(1);
 }
-await startSksdHookDaemon(root, async (name, payload) => evaluateHookPayload(name, payload, { root }));
+await startSksdHookDaemon(root, async (name, payload) => evaluateHookPayloadOnce(name, payload, { root }));
 //# sourceMappingURL=sksd-hook-daemon-entrypoint.js.map

package/dist/core/daemon/sksd-hook-daemon.js

@@ -20,16 +20,102 @@ import { sha256 } from '../fsx.js';
 const IDLE_SHUTDOWN_MS = 30 * 60 * 1000;
 const CONNECT_TIMEOUT_MS = 150;
 const REQUEST_TIMEOUT_MS = 5_000;
-// Unix domain socket paths have a ~100 byte limit on macOS/Linux (see
-// ZELLIJ_UNIX_SOCKET_PATH_LIMIT for the same constraint elsewhere in this
-// codebase) — a deeply nested project path under .sneakoscope/ would
-// routinely blow that. Keyed by a root hash under the OS tmpdir instead,
-// same strategy as zellij's socket dir.
+// Unix domain socket paths have a ~100 byte limit on macOS/Linux. TMPDIR can
+// itself be a deeply nested hermetic test root, so sockets use a short,
+// per-user SKS-owned runtime directory under the platform's real /tmp. The
+// project hash keeps independent repositories collision-free.
 export function sksdSocketPath(root) {
-    return path.join(os.tmpdir(), `sksd-${sha256(path.resolve(root)).slice(0, 16)}.sock`);
+    return path.join(sksdRuntimeDir(), `sksd-${projectKey(root)}.sock`);
 }
 function sksdPidFilePath(root) {
-    return path.join(os.tmpdir(), `sksd-${sha256(path.resolve(root)).slice(0, 16)}.pid.json`);
+    return path.join(sksdRuntimeDir(), `sksd-${projectKey(root)}.pid.json`);
+}
+function projectKey(root) {
+    return sha256(path.resolve(root)).slice(0, 16);
+}
+function sksdRuntimeDir() {
+    const owner = typeof process.getuid === 'function'
+        ? String(process.getuid())
+        : sha256(os.userInfo().username).slice(0, 8);
+    const base = process.platform === 'win32'
+        ? os.tmpdir()
+        : fs.realpathSync.native('/tmp');
+    return path.join(base, `sksd-${owner}`);
+}
+async function ensureSafeRuntimeDir(runtimeDir) {
+    await fsp.mkdir(runtimeDir, { recursive: true, mode: 0o700 });
+    const stat = await fsp.lstat(runtimeDir);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('unsafe_sksd_runtime_dir_type');
+    if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+        throw new Error('unsafe_sksd_runtime_dir_owner');
+    if ((stat.mode & 0o077) !== 0)
+        await fsp.chmod(runtimeDir, 0o700);
+    const real = await fsp.realpath(runtimeDir);
+    if (real !== path.resolve(runtimeDir))
+        throw new Error('unsafe_sksd_runtime_dir_symlink');
+}
+async function hardenSocketPermissions(socketPath) {
+    await fsp.chmod(socketPath, 0o600);
+}
+function safeRuntimeDirPresent(runtimeDir) {
+    try {
+        const stat = fs.lstatSync(runtimeDir);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            return false;
+        if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            return false;
+        if ((stat.mode & 0o077) !== 0)
+            return false;
+        return fs.realpathSync(runtimeDir) === path.resolve(runtimeDir);
+    }
+    catch {
+        return false;
+    }
+}
+async function safeExistingPid(pidFilePath) {
+    const stat = await fsp.lstat(pidFilePath).catch((err) => {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    });
+    if (!stat)
+        return undefined;
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('unsafe_sksd_pid_file');
+    const record = await fsp.readFile(pidFilePath, 'utf8').then((raw) => JSON.parse(raw), () => null);
+    return Number.isInteger(record?.pid) ? Number(record.pid) : null;
+}
+async function claimPidFile(pidFilePath, root) {
+    const existingPid = await safeExistingPid(pidFilePath);
+    if (existingPid && pidAlive(existingPid))
+        return false;
+    if (existingPid !== undefined)
+        await fsp.rm(pidFilePath, { force: true });
+    try {
+        const handle = await fsp.open(pidFilePath, 'wx', 0o600);
+        try {
+            await handle.writeFile(JSON.stringify({
+                pid: process.pid,
+                started_at: new Date().toISOString(),
+                root,
+                project_hash: projectKey(root)
+            }));
+            await handle.sync().catch(() => undefined);
+        }
+        finally {
+            await handle.close();
+        }
+        return true;
+    }
+    catch (err) {
+        if (err?.code === 'EEXIST') {
+            const racedPid = await safeExistingPid(pidFilePath);
+            if (racedPid && pidAlive(racedPid))
+                return false;
+        }
+        throw err;
+    }
 }
 function pidAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0)
@@ -42,6 +128,19 @@ function pidAlive(pid) {
         return false;
     }
 }
+async function removeStaleSocketPath(socketPath) {
+    const stat = await fsp.lstat(socketPath).catch((err) => {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    });
+    if (!stat)
+        return;
+    if (stat.isDirectory() && !stat.isSymbolicLink())
+        throw new Error('unsafe_sksd_socket_path_directory');
+    // rm() unlinks a symlink itself; it never follows it to the target.
+    await fsp.rm(socketPath, { force: true });
+}
 // Called by the daemon entrypoint (registers real process signal handlers
 // and exits the process on shutdown) and directly by tests (which own the
 // returned handle's close() instead and must not have this call
@@ -49,15 +148,21 @@ function pidAlive(pid) {
 export async function startSksdHookDaemon(root, handleHook) {
     const socketPath = sksdSocketPath(root);
     const pidFilePath = sksdPidFilePath(root);
-    const existingPid = await fsp.readFile(pidFilePath, 'utf8').then((raw) => JSON.parse(raw)?.pid, () => null);
-    if (existingPid && pidAlive(existingPid)) {
-        // Another daemon for this root is already up; nothing to do.
-        return null;
+    const runtimeDir = path.dirname(socketPath);
+    await ensureSafeRuntimeDir(runtimeDir);
+    if (!(await claimPidFile(pidFilePath, root))) {
+        return null; // Another daemon for this root owns the live PID claim.
+    }
+    try {
+        await removeStaleSocketPath(socketPath);
+    }
+    catch (err) {
+        await fsp.rm(pidFilePath, { force: true }).catch(() => undefined);
+        throw err;
     }
-    await fsp.rm(socketPath, { force: true }).catch(() => undefined);
-    await fsp.mkdir(path.dirname(pidFilePath), { recursive: true });
-    await fsp.writeFile(pidFilePath, JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), root }));
     let idleTimer = null;
+    let closePromise = null;
+    let signalHandlersRegistered = false;
     const server = net.createServer((socket) => {
         resetIdleTimer();
         let buffer = '';
@@ -95,26 +200,61 @@ export async function startSksdHookDaemon(root, handleHook) {
         idleTimer = setTimeout(() => void idleShutdown(), IDLE_SHUTDOWN_MS);
         idleTimer.unref();
     }
-    async function close() {
-        if (idleTimer)
-            clearTimeout(idleTimer);
-        await new Promise((resolve) => server.close(() => resolve()));
+    const onSigterm = () => void idleShutdown();
+    const onSigint = () => void idleShutdown();
+    function removeSignalHandlers() {
+        if (!signalHandlersRegistered)
+            return;
+        signalHandlersRegistered = false;
+        process.removeListener('SIGTERM', onSigterm);
+        process.removeListener('SIGINT', onSigint);
+    }
+    async function cleanupRuntimeArtifacts() {
         await fsp.rm(socketPath, { force: true }).catch(() => undefined);
-        await fsp.rm(pidFilePath, { force: true }).catch(() => undefined);
+        const claimedPid = await safeExistingPid(pidFilePath).catch(() => null);
+        if (claimedPid === process.pid)
+            await fsp.rm(pidFilePath, { force: true }).catch(() => undefined);
+        await fsp.rmdir(runtimeDir).catch((err) => {
+            if (!['ENOENT', 'ENOTEMPTY'].includes(String(err.code)))
+                throw err;
+        });
+    }
+    function close() {
+        if (closePromise)
+            return closePromise;
+        closePromise = (async () => {
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            removeSignalHandlers();
+            if (server.listening)
+                await new Promise((resolve) => server.close(() => resolve()));
+            await cleanupRuntimeArtifacts();
+        })();
+        return closePromise;
     }
     async function idleShutdown() {
         await close();
         process.exit(0);
     }
-    process.on('SIGTERM', () => void idleShutdown());
-    process.on('SIGINT', () => void idleShutdown());
-    await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(socketPath, () => {
-            server.removeListener('error', reject);
-            resolve();
+    try {
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(socketPath, () => {
+                server.removeListener('error', reject);
+                resolve();
+            });
         });
-    });
+        await hardenSocketPermissions(socketPath);
+    }
+    catch (err) {
+        if (server.listening)
+            await new Promise((resolve) => server.close(() => resolve()));
+        await cleanupRuntimeArtifacts();
+        throw err;
+    }
+    process.on('SIGTERM', onSigterm);
+    process.on('SIGINT', onSigint);
+    signalHandlersRegistered = true;
     resetIdleTimer();
     return { close };
 }
@@ -136,7 +276,10 @@ export function spawnSksdHookDaemonDetached(root) {
 // can fail open to the direct in-process path.
 export async function callSksdHookDaemon(root, name, payload) {
     const socketPath = sksdSocketPath(root);
-    if (!fs.existsSync(socketPath))
+    if (!safeRuntimeDirPresent(path.dirname(socketPath)))
+        return null;
+    const socketStat = fs.lstatSync(socketPath, { throwIfNoEntry: false });
+    if (!socketStat || socketStat.isSymbolicLink() || socketStat.isDirectory())
         return null;
     return new Promise((resolve) => {
         const socket = net.createConnection(socketPath);

package/dist/core/daemon/sksd-hook-dispatch.js

@@ -28,8 +28,8 @@ export async function hookDaemonInline(name) {
     }
     else {
         spawnSksdHookDaemonDetached(root);
-        const { evaluateHookPayload } = await import('../hooks-runtime.js');
-        result = await evaluateHookPayload(name, payload, { root });
+        const { evaluateHookPayloadOnce } = await import('../hooks-runtime.js');
+        result = await evaluateHookPayloadOnce(name, payload, { root });
     }
     process.stdout.write(`${JSON.stringify(normalizeHookResult(name, result))}\n`);
 }

package/dist/core/db-safety.js

@@ -454,10 +454,10 @@ async function writeMadSksTableDeletePending(root, state = {}, decision = {}) {
     return pending;
 }
 function looksLikeConfirmationYes(prompt = '') {
-    return /^(yes|y|confirm|confirmed|approve|approved|proceed|continue|ok|okay|네|예|응|허용|승인|진행|계속|삭제\s*허용|테이블\s*삭제\s*허용)\b/i.test(String(prompt || '').trim());
+    return /^(yes|y|confirm|confirmed|approve|approved|proceed|continue|ok|okay|네|예|응|허용|승인|진행|계속|삭제\s*허용|테이블\s*삭제\s*허용)(?=$|\s|[.!?。！？,，])/i.test(String(prompt || '').trim());
 }
 function looksLikeConfirmationNo(prompt = '') {
-    return /^(no|n|stop|abort|cancel|deny|denied|아니|아니요|중단|취소|거부|멈춰)\b/i.test(String(prompt || '').trim());
+    return /^(no|n|stop|abort|cancel|deny|denied|아니|아니요|중단|취소|거부|멈춰)(?=$|\s|[.!?。！？,，])/i.test(String(prompt || '').trim());
 }
 export async function handleMadSksUserConfirmation(root, state = {}, prompt = '') {
     if (!isMadSksRouteState(state) || !state?.mission_id)

package/dist/core/decision-lattice.js

@@ -68,13 +68,13 @@ const DEFAULT_ACTIONS = Object.freeze([
         notes: ['Checks syntax and behavior for the changed module.']
     },
     {
-        id: 'five_lane_review',
-        label: 'Collect five-lane Team review',
+        id: 'risk_scoped_review',
+        label: 'Collect risk-scoped official review',
         delta: { review: 1 },
         risk: 0.2,
-        friction: 1.1,
+        friction: 0.55,
         info_gain: 1,
-        notes: ['Satisfies Team review gate for broad missions.']
+        notes: ['Starts with one reviewer and expands only for independent risk domains.']
     },
     {
         id: 'honest_mode',
@@ -96,13 +96,13 @@ const DEFAULT_ROUTE_PATHS = Object.freeze([
     {
         id: 'balanced_team_lane',
         label: 'Balanced Team Lane',
-        action_ids: ['seal_contract', 'read_triwiki', 'proof_field_scan', 'minimal_patch', 'focused_verification', 'five_lane_review', 'honest_mode'],
+        action_ids: ['seal_contract', 'read_triwiki', 'proof_field_scan', 'minimal_patch', 'focused_verification', 'risk_scoped_review', 'honest_mode'],
         notes: ['Adds review evidence while preserving a compact change surface.']
     },
     {
         id: 'full_team_honest_path',
         label: 'Full Team Honest Path',
-        action_ids: ['seal_contract', 'read_triwiki', 'proof_field_scan', 'five_lane_review', 'minimal_patch', 'focused_verification', 'five_lane_review', 'honest_mode'],
+        action_ids: ['seal_contract', 'read_triwiki', 'proof_field_scan', 'risk_scoped_review', 'minimal_patch', 'focused_verification', 'risk_scoped_review', 'honest_mode'],
         notes: ['Heaviest default for broad or release-sensitive missions.']
     }
 ]);

package/dist/core/dfix/verification-selector.js

@@ -16,10 +16,12 @@ export async function buildDfixVerificationSelection(root, input = {}) {
     const candidates = [];
     if (changedFiles.some((file) => /(?:^|\/)test\/.*\.(?:test|spec)\.(?:mjs|js|ts)$/.test(file)) && scripts['test:unit'])
         candidates.push({ command: 'npm run test:unit', reason: 'test_file_changed', confidence: 0.82, expected_duration_budget_ms: 15000 });
-    if (changedFiles.some((file) => /^src\/core\/dfix/.test(file)) && scripts['dfix:fixture'])
-        candidates.push({ command: 'npm run dfix:fixture', reason: 'dfix_source_changed', confidence: 0.9, expected_duration_budget_ms: 3000 });
-    if (changedFiles.some((file) => /^src\/core\/dfix/.test(file)) && scripts['dfix:verification'])
-        candidates.push({ command: 'npm run dfix:verification', reason: 'dfix_source_changed', confidence: 0.88, expected_duration_budget_ms: 3000 });
+    if (changedFiles.some((file) => /^src\/core\/dfix/.test(file)) && await existsFile(path.join(root, 'dist', 'scripts', 'dfix-fixture-check.js'))) {
+        candidates.push({ command: 'node ./dist/scripts/dfix-fixture-check.js', reason: 'dfix_source_changed', confidence: 0.9, expected_duration_budget_ms: 3000 });
+    }
+    if (changedFiles.some((file) => /^src\/core\/dfix/.test(file)) && await existsFile(path.join(root, 'dist', 'scripts', 'dfix-verification-check.js'))) {
+        candidates.push({ command: 'node ./dist/scripts/dfix-verification-check.js', reason: 'dfix_source_changed', confidence: 0.88, expected_duration_budget_ms: 3000 });
+    }
     if (changedFiles.some((file) => /\.(?:json|schema\.json)$/.test(file)) && scripts['schema:check'])
         candidates.push({ command: 'npm run schema:check', reason: 'schema_file_changed', confidence: 0.76, expected_duration_budget_ms: 10000 });
     if (changedFiles.some((file) => /^docs\/|\.md$/.test(file)) && scripts.packcheck)

package/dist/core/doctor/browser-use-repair.js

@@ -1,7 +1,9 @@
 import path from 'node:path';
 import { codexChromeExtensionStatus, CODEX_CHROME_EXTENSION_SETUP_DOCS_URL } from '../codex-app.js';
+import { ensureCodexPlugins } from '../codex-plugins/codex-plugin-repair.js';
 import { runDoctorCodexStartupRepair } from './doctor-codex-startup-repair.js';
 import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
+import { redactString } from '../secret-redaction.js';
 export const DOCTOR_BROWSER_USE_REPAIR_SCHEMA = 'sks.doctor-browser-use-repair.v1';
 export async function repairBrowserUse(input) {
     const root = path.resolve(input.root || process.cwd());
@@ -25,10 +27,15 @@ export async function repairBrowserUse(input) {
         command: 'which codex',
         blocker: codexBin ? null : 'codex_binary_missing'
     });
-    const flagsNeedingEnable = ['browser_use_external', 'plugins'];
+    const requiredChromeFlags = new Set(['browser_use_external', 'plugins', 'apps']);
+    const flagsNeedingEnable = [...requiredChromeFlags, 'in_app_browser', 'browser_use'];
     for (const flag of flagsNeedingEnable) {
-        const alreadyOk = before?.ok === true || (before?.blockers || []).every((b) => !b.includes(`${flag}_feature_missing`));
-        if (codexBin && apply) {
+        const detectorRequiresFlag = Array.isArray(before?.required_flags) && before.required_flags.includes(flag);
+        const detectorReportsMissing = (before?.blockers || []).some((b) => b.includes(`${flag}_feature_missing`));
+        const explicitlyEnabled = before?.features?.[flag] === true || before?.feature_flags?.[flag] === true;
+        const alreadyOk = explicitlyEnabled
+            || (requiredChromeFlags.has(flag) && (before?.ok === true || (detectorRequiresFlag && !detectorReportsMissing)));
+        if (codexBin && apply && !alreadyOk) {
             const enable = await runProcess(codexBin, ['features', 'enable', flag], {
                 timeoutMs: input.timeoutMs || 10000,
                 maxOutputBytes: 32 * 1024
@@ -41,6 +48,7 @@ export async function repairBrowserUse(input) {
                 exit_code: enable.code,
                 stdout_tail: tail(enable.stdout),
                 stderr_tail: tail(enable.stderr),
+                status: enable.code === 0 ? 'enabled' : 'unsupported_or_failed',
                 blocker: enable.code === 0 ? null : 'codex_feature_enable_unsupported_or_failed'
             });
         }
@@ -50,19 +58,27 @@ export async function repairBrowserUse(input) {
                 ok: alreadyOk,
                 attempted: false,
                 command: codexBin ? `${codexBin} features enable ${flag}` : `codex features enable ${flag}`,
+                status: alreadyOk ? 'already_enabled' : apply ? 'blocked' : 'detect_only',
                 blocker: alreadyOk ? null : apply ? 'codex_cli_missing' : 'doctor_fix_not_requested'
             });
         }
     }
-    // codex plugin enable/install has no documented CLI subcommand for the bundled chrome plugin
-    // in this repo's evidence (only `plugin list --json` / app-server plugin RPCs are attested); do not guess one.
+    const repairPlugins = input.pluginRepair || ensureCodexPlugins;
+    const pluginRepair = before?.ok === true
+        ? null
+        : await repairPlugins({
+            pluginIds: ['browser@openai-bundled', 'chrome@openai-bundled'],
+            apply,
+            codexBin,
+            timeoutMs: input.timeoutMs || 30_000
+        }).catch((err) => ({ ok: false, changed: false, installs: [], blockers: [messageOf(err)], next_actions: [] }));
     steps.push({
-        id: 'chrome_plugin_enable',
-        ok: false,
-        attempted: false,
-        command: null,
-        status: 'needs_more_info',
-        blocker: 'chrome_plugin_enable_cli_subcommand_unknown'
+        id: 'browser_chrome_plugin_repair',
+        ok: before?.ok === true || pluginRepair?.ok === true,
+        attempted: Boolean(pluginRepair?.installs?.length),
+        command: codexBin ? `${codexBin} plugin add <browser|chrome>@openai-bundled --json` : 'codex plugin add <browser|chrome>@openai-bundled --json',
+        status: before?.ok === true ? 'already_ready' : pluginRepair?.ok ? 'ready' : 'blocked',
+        blocker: before?.ok === true || pluginRepair?.ok === true ? null : pluginRepair?.blockers?.[0] || 'codex_browser_plugins_not_ready'
     });
     let nodeReplStep;
     if (apply) {
@@ -104,7 +120,16 @@ export async function repairBrowserUse(input) {
         blockers.push('chrome_extension_manual_install_required');
     }
     const recovered = after?.ok === true;
-    const nextActions = recovered ? [] : [
+    const optionalFeatureSteps = steps.filter((step) => step.id === 'in_app_browser_feature_enable' || step.id === 'browser_use_feature_enable');
+    const optionalFeatureEnablementBlockers = optionalFeatureSteps
+        .filter((step) => step.attempted && !step.ok)
+        .map((step) => `${step.id}:codex_feature_enable_unsupported_or_failed`);
+    // This repair can establish configuration/plugin capability only. A live Browser or
+    // Chrome action in a fresh Codex task is required before any route may claim use proof.
+    const realBrowserInteractionVerified = false;
+    const refreshActions = pluginRepair?.changed ? pluginRepair.next_actions || [] : [];
+    const nextActions = recovered ? refreshActions : [
+        ...refreshActions,
         'Open the Codex Desktop app and check its settings for the Chrome/Browser Use plugin entry (exact menu wording may vary by version; check Codex app settings generically if unsure).',
         'If a Chrome extension install/enable action is offered from within Codex App settings, follow it there rather than the Chrome Web Store directly, since Codex App is the source of truth for what "ready" means for this feature.',
         `If no in-app action is available, consult the setup docs: ${CODEX_CHROME_EXTENSION_SETUP_DOCS_URL}`,
@@ -115,12 +140,28 @@ export async function repairBrowserUse(input) {
         schema: DOCTOR_BROWSER_USE_REPAIR_SCHEMA,
         generated_at: nowIso(),
         ok: recovered,
+        ok_scope: 'configuration',
         attempted: before?.ok !== true,
         apply,
         recovered,
+        capability_ready: recovered,
+        configuration_ready: recovered,
+        configuration_recovered: before?.ok !== true && recovered,
+        route_ready: realBrowserInteractionVerified,
+        real_browser_interaction_verified: realBrowserInteractionVerified,
+        evidence_level: recovered ? 'configuration' : 'none',
         before,
         after,
         steps,
+        plugin_repair: pluginRepair,
+        current_task_tool_manifest_verified: false,
+        requires_new_task: pluginRepair?.requires_new_task === true,
+        optional_feature_enablement_blockers: optionalFeatureEnablementBlockers,
+        completion_blockers: realBrowserInteractionVerified ? [] : ['codex_browser_real_interaction_unverified'],
+        completion_actions: realBrowserInteractionVerified ? [] : [
+            'Start a fresh Codex task so repaired Browser/Chrome tools are attached to the new task manifest.',
+            'Perform and retain one real Browser or Chrome interaction before claiming browser-route completion.'
+        ],
         blockers: [...new Set(blockers)],
         next_actions: nextActions,
         manual_actions: nextActions,
@@ -140,7 +181,7 @@ export async function repairBrowserUse(input) {
     return report;
 }
 function tail(value, max = 2000) {
-    const text = String(value || '');
+    const text = redactString(String(value || ''));
     return text.length > max ? text.slice(-max) : text;
 }
 function messageOf(err) {

package/dist/core/doctor/codex-0139-doctor.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
 import { readJson } from '../fsx.js';
 export async function readCodex0139DoctorRealProbeStatus(root) {
     const summary = await readJson(path.join(root, '.sneakoscope', 'codex-0139-real-probe-summary.json'), null);
@@ -6,10 +7,10 @@ export async function readCodex0139DoctorRealProbeStatus(root) {
     return {
         schema: 'sks.doctor-codex-0139-real-probes.v1',
         codex_cli_version: result?.version_text || null,
-        capability_version_flag: Boolean(result?.parsed_version && String(result.parsed_version).startsWith('0.139')),
+        capability_version_flag: result?.parsed_version === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
         real_probes_last_run_status: summary ? (summary.ok ? 'ok' : 'blocked') : 'not_run',
         skipped_probes: result?.skipped || [],
-        strict_probe_command: 'npm run codex:0139-real-probes:require-real',
+        strict_probe_command: 'node ./dist/scripts/codex-0144-core-real-probes-check.js --require-real --allow-network',
         unsafe_auto_fix: false
     };
 }

package/dist/core/doctor/codex-startup-config-repair.js

@@ -8,16 +8,21 @@ export async function repairCodexStartupConfig(input) {
     const roleRepair = await repairAgentRoleConfigs({
         root,
         apply: input.apply === true,
-        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json')
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json'),
+        ...(input.codexHome ? { codexHome: input.codexHome } : {})
     });
     const fileRepair = await repairAgentConfigFileReferences({
         root,
         apply: input.apply === true,
-        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-config-file-repair.json')
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-config-file-repair.json'),
+        ...(input.home ? { home: input.home } : {}),
+        ...(input.codexHome ? { codexHome: input.codexHome } : {})
     });
     const postcheck = await postcheckCodexStartupConfig({
         root,
-        reportPath: path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json')
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json'),
+        ...(input.home ? { home: input.home } : {}),
+        ...(input.codexHome ? { codexHome: input.codexHome } : {})
     });
     let report = {
         schema: 'sks.codex-startup-config-repair.v1',