sneakoscope 6.0.3 → 6.1.2

package/dist/core/doctor/computer-use-repair.js

@@ -1,7 +1,9 @@
 import path from 'node:path';
 import { CODEX_APP_DOCS_URL } from '../codex-app.js';
+import { ensureCodexPlugins } from '../codex-plugins/codex-plugin-repair.js';
 import { computerUseStatusReport } from '../computer-use-status.js';
 import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
+import { redactString } from '../secret-redaction.js';
 export const DOCTOR_COMPUTER_USE_REPAIR_SCHEMA = 'sks.doctor-computer-use-repair.v1';
 export async function repairComputerUse(input) {
     const root = path.resolve(input.root || process.cwd());
@@ -69,36 +71,23 @@ export async function repairComputerUse(input) {
                         : 'computer_use_capability_missing_not_feature_flag_shaped'
         });
     }
-    // codex plugin install subcommand syntax is not documented anywhere in this repo or the
-    // Codex CLI docs snapshot; a real `codex plugin --help` lookup was attempted but the
-    // binary was unavailable/unverified in this environment, so no install command is guessed.
+    const repairPlugins = input.pluginRepair || ensureCodexPlugins;
+    const pluginRepair = beforeReady
+        ? null
+        : await repairPlugins({
+            pluginIds: ['computer-use@openai-bundled'],
+            apply,
+            codexBin,
+            timeoutMs: input.timeoutMs || 30_000
+        }).catch((err) => ({ ok: false, changed: false, installs: [], blockers: [messageOf(err)], next_actions: [] }));
     const pluginInstallStep = {
-        id: 'computer_use_plugin_install_lookup',
-        ok: false,
-        attempted: false,
-        command: codexBin ? `${codexBin} plugin --help` : 'codex plugin --help',
-        blocker: 'codex_plugin_install_subcommand_unverified'
+        id: 'computer_use_plugin_repair',
+        ok: beforeReady || pluginRepair?.ok === true,
+        attempted: Boolean(pluginRepair?.installs?.length),
+        command: codexBin ? `${codexBin} plugin add computer-use@openai-bundled --json` : 'codex plugin add computer-use@openai-bundled --json',
+        status: beforeReady ? 'already_ready' : pluginRepair?.ok ? 'ready' : 'blocked',
+        blocker: beforeReady || pluginRepair?.ok === true ? null : pluginRepair?.blockers?.[0] || 'computer_use_plugin_not_ready'
     };
-    let pluginHelpRaw = null;
-    if (codexBin && before?.status === 'codex_app_missing' && apply) {
-        const help = await runProcess(codexBin, ['plugin', '--help'], {
-            timeoutMs: input.timeoutMs || 8000,
-            maxOutputBytes: 32 * 1024
-        }).catch((err) => ({ code: 1, stdout: '', stderr: messageOf(err) }));
-        pluginHelpRaw = tail(help.stdout || help.stderr, 4000);
-        pluginInstallStep.attempted = true;
-        pluginInstallStep.exit_code = help.code;
-        pluginInstallStep.stdout_tail = tail(help.stdout);
-        pluginInstallStep.stderr_tail = tail(help.stderr);
-        const installSubcommand = extractPluginInstallSubcommand(help.stdout || help.stderr || '');
-        if (installSubcommand) {
-            pluginInstallStep.ok = false;
-            pluginInstallStep.blocker = 'codex_plugin_install_subcommand_found_but_not_auto_run';
-        }
-        else {
-            pluginInstallStep.blocker = 'codex_plugin_help_did_not_reveal_install_subcommand';
-        }
-    }
     steps.push(pluginInstallStep);
     const after = await probe({ root, codexBin: codexBin || undefined, forceMacos: true })
         .catch((err) => ({ ok: false, status: 'unknown', blockers: [messageOf(err)] }));
@@ -106,22 +95,24 @@ export async function repairComputerUse(input) {
         id: 'computer_use_status_redetect',
         ok: after?.status === 'available',
         attempted: true,
-        command: 'codex features list --json',
+        command: 'codex features list',
         blocker: after?.status === 'available' ? null : String(after?.status || 'unknown')
     });
     const recovered = after?.status === 'available';
     const blockers = recovered ? [] : [
         ...new Set([
             String(after?.status || 'computer_use_unavailable'),
-            ...(pluginInstallStep.attempted && !recovered ? [pluginInstallStep.blocker] : [])
+            ...(pluginInstallStep.blocker && !recovered ? [pluginInstallStep.blocker] : [])
         ].filter(Boolean).map(String))
     ];
-    const nextActions = recovered ? [] : [
+    const refreshActions = pluginRepair?.changed ? pluginRepair.next_actions || [] : [];
+    const nextActions = recovered ? refreshActions : [
+        ...refreshActions,
         'Install/update Codex CLI if missing: npm i -g @openai/codex@latest',
         'Open Codex App settings and enable Computer Use, or run: codex features enable computer_use',
         after?.status === 'codex_app_missing'
-            ? 'A live `codex plugin --help` (or equivalent) lookup is required to find the real plugin install subcommand before SKS can auto-install a Computer Use plugin; this was not guessed. A human should run `codex plugin --help` (or check Codex App settings) and report the exact install subcommand back so it can be wired into this repair function.'
-            : 'Verify with: codex features list --json',
+            ? 'Open the ChatGPT/Codex desktop app after plugin installation, enable the Computer Use server and skill toggles, and grant Screen Recording/Accessibility when prompted.'
+            : 'Verify with: codex features list',
         `Docs: ${CODEX_APP_DOCS_URL}`
     ];
     let report = {
@@ -134,9 +125,11 @@ export async function repairComputerUse(input) {
         before,
         after,
         steps,
+        plugin_repair: pluginRepair,
+        current_task_tool_manifest_verified: false,
+        requires_new_task: pluginRepair?.requires_new_task === true,
         blockers,
         next_actions: nextActions,
-        plugin_help_raw: pluginHelpRaw,
         docs_url: CODEX_APP_DOCS_URL
     };
     if (input.reportPath !== null) {
@@ -152,12 +145,8 @@ export async function repairComputerUse(input) {
     }
     return report;
 }
-function extractPluginInstallSubcommand(helpText) {
-    const match = String(helpText || '').match(/^\s*install\s+/m);
-    return match ? 'install' : null;
-}
 function tail(value, max = 2000) {
-    const text = String(value || '');
+    const text = redactString(String(value || ''));
     return text.length > max ? text.slice(-max) : text;
 }
 function messageOf(err) {

package/dist/core/doctor/doctor-codex-startup-repair.js

@@ -1,32 +1,16 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import { ensureDir, exists, nowIso, readText, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { exists, nowIso, readText, writeJsonAtomic } from '../fsx.js';
 import { isUnmanagedProjectCodexConfig, writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
 export const DOCTOR_CODEX_STARTUP_REPAIR_SCHEMA = 'sks.doctor-codex-startup-repair.v1';
-const AGENT_ROLE_FILES = new Map([
-    ['analysis_scout', { file: 'analysis-scout.toml', description: 'SKS scout with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Scout', 'Mapper'] }],
-    ['native_agent', { file: 'native-agent-intake.toml', description: 'SKS native agent with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Analysis', 'Mapper'] }],
-    ['team_consensus', { file: 'team-consensus.toml', description: 'SKS planning/debate agent with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Consensus', 'Atlas'] }],
-    ['implementation_worker', { file: 'implementation-worker.toml', description: 'SKS bounded implementation worker.', sandbox: 'workspace-write', nicknames: ['Builder', 'Mason'] }],
-    ['db_safety_reviewer', { file: 'db-safety-reviewer.toml', description: 'DB safety reviewer with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Sentinel', 'Ledger'] }],
-    ['qa_reviewer', { file: 'qa-reviewer.toml', description: 'QA reviewer with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Verifier', 'Reviewer'] }]
-]);
-const DIRECTIVE_ROLE_FILES = [
-    'sks-explorer.toml',
-    'sks-planner.toml',
-    'sks-implementer.toml',
-    'sks-checker.toml',
-    'sks-release-verifier.toml',
-    'sks-zellij-ui-verifier.toml',
-    'sks-codex-probe-verifier.toml'
-];
 export async function runDoctorCodexStartupRepair(input) {
     const root = path.resolve(input.root || process.cwd());
     const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
-    const roleFiles = input.fix
-        ? await repairAgentRoleFiles(root, codexHome)
-        : await inspectAgentRoleFiles(root, codexHome);
+    // Project-scoped official custom-agent installation is owned by repairAgentRoleConfigs.
+    // This startup repair remains structural/MCP-only and never touches legacy
+    // or user agent TOMLs in project or global directories.
+    const roleFiles = { sanitized: [], created: [], blockers: [] };
     const configs = [];
     for (const candidate of [
         { scope: 'project', path: path.join(root, '.codex', 'config.toml'), agentDir: path.join(root, '.codex', 'agents') },
@@ -117,38 +101,6 @@ async function inspectOrRepairConfig(root, candidate, fix, nodeReplCommandCandid
     next = duplicateRepair.text;
     duplicateTomlBlocksRemoved.push(...duplicateRepair.removed);
     warnings.push(...duplicateRepair.warnings);
-    for (const [tableName, role] of AGENT_ROLE_FILES) {
-        const target = path.join(candidate.agentDir, role.file);
-        let table = tomlBlock(next, `agents.${tableName}`);
-        if (!table)
-            continue;
-        const currentDescription = stringValue(table.text, 'description');
-        if (currentDescription !== role.description) {
-            if (!fix)
-                warnings.push(`agent_description_stale:${tableName}`);
-            else {
-                next = replaceOrInsertKey(next, table, 'description', `"${escapeToml(role.description)}"`);
-                table = tomlBlock(next, `agents.${tableName}`);
-                if (!table)
-                    continue;
-            }
-        }
-        const current = stringValue(table.text, 'config_file');
-        const targetExists = await exists(target);
-        const currentValid = Boolean(current && path.isAbsolute(current) && await exists(current));
-        if (currentValid && current === target)
-            continue;
-        if (!fix) {
-            warnings.push(`agent_config_file_stale:${tableName}`);
-            continue;
-        }
-        if (!targetExists) {
-            await ensureDir(path.dirname(target));
-            await writeTextAtomic(target, roleConfigToml(tableName, role.description, role.sandbox));
-        }
-        next = replaceOrInsertKey(next, table, 'config_file', `"${escapeToml(target)}"`);
-        agentConfigFilesRepaired.push(target);
-    }
     const nodeReplRepair = await inspectOrRepairNodeRepl(next, fix, nodeReplCommandCandidates, includeDefaultNodeReplCandidates);
     next = nodeReplRepair.text;
     warnings.push(...nodeReplRepair.warnings);
@@ -165,29 +117,39 @@ async function inspectOrRepairConfig(root, candidate, fix, nodeReplCommandCandid
     const codexApps = tomlBlock(next, 'mcp_servers.codex_apps');
     if (codexApps && /token_expired|expired/i.test(codexApps.text))
         blockers.push('codex_apps_token_expired');
-    const changed = next !== text;
-    const backupPath = changed && fix ? await backupConfig(candidate.path, text, 'startup') : null;
-    if (changed && fix)
-        await writeCodexConfigGuarded({
+    const plannedChanged = next !== text;
+    let changed = plannedChanged;
+    let backupPath = null;
+    let writeApplied = true;
+    if (plannedChanged && fix) {
+        const guarded = await writeCodexConfigGuarded({
             root,
             configPath: candidate.path,
             before: text,
             cause: 'doctor-codex-startup-repair',
             mutate: () => next.replace(/\n{3,}/g, '\n\n').replace(/\s*$/, '\n')
         });
+        writeApplied = guarded.ok;
+        changed = guarded.ok && guarded.changed;
+        backupPath = guarded.backup_path;
+        if (!guarded.ok) {
+            blockers.push(`config_write_guard:${guarded.status}`);
+            warnings.push(`config_preserved:${guarded.status}`);
+        }
+    }
     return {
         scope: candidate.scope,
         path: candidate.path,
         present: true,
         changed,
         backup_path: backupPath,
-        agent_config_files_repaired: agentConfigFilesRepaired,
-        stale_mcp_blocks_removed: staleMcpBlocksRemoved,
-        mcp_blocks_repaired: mcpBlocksRepaired,
+        agent_config_files_repaired: writeApplied ? agentConfigFilesRepaired : [],
+        stale_mcp_blocks_removed: writeApplied ? staleMcpBlocksRemoved : [],
+        mcp_blocks_repaired: writeApplied ? mcpBlocksRepaired : [],
         optional_mcp_blocks_ignored: optionalMcpBlocksIgnored,
         blockers,
         warnings,
-        duplicate_toml_blocks_removed: duplicateTomlBlocksRemoved
+        duplicate_toml_blocks_removed: writeApplied ? duplicateTomlBlocksRemoved : []
     };
 }
 function inspectOrRepairDuplicateTomlBlocks(text, candidate, fix) {
@@ -234,20 +196,7 @@ function tomlBlocks(text) {
     });
 }
 function selectDuplicateTomlBlockToKeep(header, rows, candidate) {
-    const agentName = header.startsWith('agents.') ? header.slice('agents.'.length) : '';
-    const role = agentName ? AGENT_ROLE_FILES.get(agentName) : undefined;
-    if (role) {
-        const target = path.join(candidate.agentDir, role.file);
-        return maxIndexBy(rows, (block, index) => {
-            const configFile = stringValue(block.text, 'config_file');
-            const description = stringValue(block.text, 'description');
-            return ((configFile === target ? 100 : 0) +
-                (configFile && path.isAbsolute(configFile) ? 20 : 0) +
-                (description === role.description ? 30 : 0) +
-                assignmentCount(block.text) -
-                index / 1000);
-        });
-    }
+    void candidate;
     if (header.startsWith('mcp_servers.'))
         return 0;
     return maxIndexBy(rows, (block, index) => assignmentCount(block.text) - index / 1000);
@@ -315,55 +264,6 @@ async function inspectOrRepairNodeRepl(text, fix, extraCandidates, includeDefaul
         repaired: []
     };
 }
-async function inspectAgentRoleFiles(root, codexHome) {
-    const dirs = [path.join(root, '.codex', 'agents'), path.join(codexHome, 'agents')];
-    const sanitized = [];
-    for (const dir of dirs) {
-        for (const file of DIRECTIVE_ROLE_FILES) {
-            const full = path.join(dir, file);
-            const text = await readText(full, null);
-            if (typeof text === 'string' && /\bmessage_role_prefix\s*=/.test(text) && /SKS managed 3\.1\./.test(text))
-                sanitized.push(full);
-        }
-    }
-    return { sanitized, created: [], blockers: [] };
-}
-async function repairAgentRoleFiles(root, codexHome) {
-    const dirs = [path.join(root, '.codex', 'agents'), path.join(codexHome, 'agents')];
-    const sanitized = [];
-    const created = [];
-    const blockers = [];
-    for (const dir of dirs) {
-        for (const [name, role] of AGENT_ROLE_FILES) {
-            const file = path.join(dir, role.file);
-            const text = await readText(file, null);
-            if (text == null) {
-                await ensureDir(dir);
-                await writeTextAtomic(file, roleConfigToml(name, role.description, role.sandbox));
-                created.push(file);
-                continue;
-            }
-            if (!text.includes(`sandbox_mode = "${role.sandbox}"`) || text.includes('Do not edit files.')) {
-                await backupConfig(file, text, 'role-write-capable');
-                await writeTextAtomic(file, roleConfigToml(name, role.description, role.sandbox));
-                sanitized.push(file);
-            }
-        }
-        for (const file of DIRECTIVE_ROLE_FILES) {
-            const full = path.join(dir, file);
-            const text = await readText(full, null);
-            if (typeof text !== 'string')
-                continue;
-            if (!/\bmessage_role_prefix\s*=/.test(text) || !/SKS managed 3\.1\./.test(text))
-                continue;
-            const next = text.split('\n').filter((line) => !/^\s*message_role_prefix\s*=/.test(line)).join('\n');
-            await backupConfig(full, text, 'role');
-            await writeTextAtomic(full, next.replace(/\s*$/, '\n'));
-            sanitized.push(full);
-        }
-    }
-    return { sanitized, created, blockers };
-}
 function tomlBlock(text, table) {
     const header = new RegExp(`(^|\\n)\\s*\\[${escapeRegExp(table)}\\]\\s*(?:#.*)?(?:\\n|$)`, 'g');
     const match = header.exec(text);
@@ -470,31 +370,6 @@ function stringValues(text, key) {
     const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"`, 'gm');
     return [...text.matchAll(re)].map((match) => String(match[1] || '')).filter(Boolean);
 }
-async function backupConfig(configPath, text, label) {
-    try {
-        const backupPath = `${configPath}.sks-${label}-${Date.now().toString(36)}.bak`;
-        await ensureDir(path.dirname(backupPath));
-        await writeTextAtomic(backupPath, text);
-        return backupPath;
-    }
-    catch {
-        return null;
-    }
-}
-function roleConfigToml(name, description, sandbox) {
-    return [
-        `name = "${name}"`,
-        `description = "${description}"`,
-        `sandbox_mode = "${sandbox}"`,
-        'approval_policy = "never"',
-        'developer_instructions = """',
-        `You are the SKS ${name} role.`,
-        sandbox === 'read-only' ? 'Do not edit files.' : 'Only edit the bounded files assigned by the parent orchestrator.',
-        'Return concise source-backed findings and LIVE_EVENT lines when applicable.',
-        '"""',
-        ''
-    ].join('\n');
-}
 function escapeToml(value) {
     return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }

package/dist/core/doctor/doctor-context7-repair.js

@@ -154,7 +154,7 @@ async function backupConfig(configPath, text) {
     try {
         const backupPath = `${configPath}.sks-context7-${Date.now().toString(36)}.bak`;
         await ensureDir(path.dirname(backupPath));
-        await writeTextAtomic(backupPath, text);
+        await writeTextAtomic(backupPath, text, { mode: 0o600 });
         return backupPath;
     }
     catch {

package/dist/core/doctor/doctor-dirty-planner.js

@@ -123,7 +123,7 @@ function phaseInputFiles(id) {
         return ['src/core/codex-native', 'src/scripts/native-capability-postcheck-check.ts'];
     if (id.includes('secret'))
         return ['safety-mutation-allowlist.json', 'src/scripts/secret-preservation-check.ts'];
-    return ['package.json', 'config/codex-releases/rust-v0.142.0.json'];
+    return ['package.json', 'config/codex-releases/rust-v0.144.1.json'];
 }
 function packageIdentity() {
     const root = packageRoot();

package/dist/core/doctor/doctor-native-capability-repair.js

@@ -1,11 +1,16 @@
+import fs from 'node:fs/promises';
 import path from 'node:path';
-import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { nowIso, readText, writeJsonAtomic } from '../fsx.js';
 import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
 import { dedupeProjectSkills } from '../codex-native/project-skill-dedupe.js';
 import { repairNativeCapabilities } from '../codex-native/native-capability-repair.js';
 import { withSecretPreservationGuard } from '../config/config-migration-journal.js';
+import { ensureProductDesignPluginInstalled } from '../product-design-app-server.js';
+import { cleanupLegacyGlobalSksHooks } from './legacy-global-hook-cleanup.js';
+import { redactSecrets } from '../secret-redaction.js';
 export async function runDoctorNativeCapabilityRepair(input) {
     const root = path.resolve(input.root);
+    const fixRequested = input.fix || (input.flags || []).includes('--fix');
     const operation = async () => {
         const coreSkills = await syncCoreSkillsIntegrity({ root, apply: input.fix });
         const skillDedupe = await dedupeProjectSkills({
@@ -22,6 +27,30 @@ export async function runDoctorNativeCapabilityRepair(input) {
                 yes: input.yes,
                 allowManualInstructions: true
             });
+        const probeArtifactCleanup = await cleanupNativeCapabilityProbeArtifacts(root, { apply: fixRequested });
+        const legacyGlobalHooks = await cleanupLegacyGlobalSksHooks({
+            root,
+            ...(input.home ? { home: input.home } : {}),
+            apply: fixRequested
+        });
+        const productDesignRaw = input.fix
+            ? await ensureProductDesignPluginInstalled({
+                cwd: root,
+                autoInstallProductDesign: true,
+                timeoutMs: 12_000
+            }).catch((err) => ({ ok: false, status: 'app_server_unavailable', blockers: [messageOf(err)] }))
+            : { ok: true, skipped: true, status: 'deferred_to_explicit_native_capability_repair', blockers: [] };
+        const productDesignWithActions = productDesignRaw?.install_attempted === true ? {
+            ...productDesignRaw,
+            current_task_tool_manifest_verified: false,
+            requires_new_task: true,
+            restart_app_if_stale: true,
+            next_actions: [
+                'Start a new Codex/Work task so Product Design skills and tools are attached to a fresh task manifest.',
+                'If Product Design is still missing, restart the ChatGPT/Codex desktop app and rerun the native capability doctor.'
+            ]
+        } : productDesignRaw;
+        const productDesign = redactSecrets(productDesignWithActions);
         const blockers = [
             ...(coreSkills.blockers || []),
             ...(skillDedupe.blockers || []),
@@ -31,7 +60,10 @@ export async function runDoctorNativeCapabilityRepair(input) {
         const optionalManualRequired = nativeCapabilities.optional_manual_required || [];
         const optionalWarnings = [
             ...(nativeCapabilities.warnings || []),
-            ...optionalManualRequired.map((id) => `${id}_manual_required`)
+            ...optionalManualRequired.map((id) => `${id}_manual_required`),
+            ...(legacyGlobalHooks.blockers || []).map((blocker) => `legacy_global_hooks:${blocker}`),
+            ...(legacyGlobalHooks.warnings || []),
+            ...(productDesign.ok === false ? (productDesign.blockers || ['product_design_not_ready']).map((blocker) => `product_design:${blocker}`) : [])
         ];
         let report = {
             schema: 'sks.doctor-native-capability-repair.v1',
@@ -43,6 +75,9 @@ export async function runDoctorNativeCapabilityRepair(input) {
             core_skills: coreSkills,
             skill_dedupe: skillDedupe,
             native_capabilities: nativeCapabilities,
+            product_design: productDesign,
+            legacy_global_hooks: legacyGlobalHooks,
+            probe_artifact_cleanup: probeArtifactCleanup,
             secret_preservation_guard: '.sneakoscope/reports/secret-preservation-guard.json',
             core_blockers: blockers,
             route_blockers: routeBlockers,
@@ -60,10 +95,46 @@ export async function runDoctorNativeCapabilityRepair(input) {
         }
         return report;
     };
-    if (!input.fix)
+    if (!fixRequested)
         return operation();
     return withSecretPreservationGuard(root, 'doctor-native-capability-repair', operation);
 }
+export async function cleanupNativeCapabilityProbeArtifacts(root, opts = { apply: true }) {
+    const sentinel = 'sks-native-capability-postcheck\n';
+    const candidates = [
+        path.join(root, '.sneakoscope', 'image-artifacts', 'postcheck-followup-sample.txt'),
+        path.join(root, '.sneakoscope', 'app-screenshots', 'postcheck-screenshot-sample.txt'),
+        path.join(root, '.sneakoscope', 'image-artifacts', 'postcheck-contract-image.txt'),
+        path.join(root, '.sneakoscope', 'app-screenshots', 'postcheck-contract-screenshot.txt')
+    ];
+    const removed = [];
+    const planned = [];
+    const preserved = [];
+    for (const file of candidates) {
+        const text = await readText(file, '');
+        if (!text)
+            continue;
+        if (text !== sentinel) {
+            preserved.push(file);
+            continue;
+        }
+        if (opts.apply !== false) {
+            await fs.rm(file, { force: true });
+            removed.push(file);
+        }
+        else {
+            planned.push(file);
+        }
+    }
+    return {
+        schema: 'sks.native-capability-probe-artifact-cleanup.v1',
+        ok: true,
+        apply: opts.apply !== false,
+        removed,
+        planned,
+        preserved_non_probe_files: preserved
+    };
+}
 function messageOf(err) {
     return err instanceof Error ? err.message : String(err);
 }

package/dist/core/doctor/imagegen-repair.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { CODEX_APP_IMAGE_GENERATION_DOC_URL } from '../routes.js';
 import { detectImagegenCapability } from '../imagegen/imagegen-capability.js';
 import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
+import { redactString } from '../secret-redaction.js';
 export const DOCTOR_IMAGEGEN_REPAIR_SCHEMA = 'sks.doctor-imagegen-repair.v1';
 export async function repairCodexImagegen(input) {
     const root = path.resolve(input.root || process.cwd());
@@ -108,22 +109,45 @@ export async function repairCodexImagegen(input) {
         id: 'imagegen_capability_redetect',
         ok: after?.core_ready === true,
         attempted: true,
-        command: 'codex features list --json',
+        command: 'codex features list',
+        status: after?.core_ready === true ? 'configuration_ready_output_unverified' : 'configuration_missing',
+        evidence_level: 'configuration',
         blocker: after?.core_ready === true ? null : 'codex_app_builtin_imagegen_capability_missing'
     });
-    // No real generation round-trip primitive exists in imagegen-capability.ts today; this only re-confirms the feature flag, not actual output.
+    const capabilityReady = after?.core_ready === true;
+    const realGenerationVerified = capabilityReady
+        && after?.real_generation_available === true
+        && after?.real_output_verified_by_capability_check === true;
+    // No real generation round-trip primitive exists in imagegen-capability.ts today.
+    // Keep configuration detection separate from route/output proof.
     const communicationTest = {
-        level: 'flag_level',
-        ok: after?.core_ready === true,
-        checked: 'codex features list --json (feature-flag/plugin metadata only)',
-        real_generation_round_trip_performed: false,
-        blocker: after?.core_ready === true ? null : 'codex_app_builtin_imagegen_capability_missing'
+        level: realGenerationVerified ? 'real_output' : 'flag_level',
+        ok: realGenerationVerified,
+        checked: realGenerationVerified
+            ? 'real Codex App $imagegen generated-output evidence'
+            : 'codex features list (feature-flag/plugin metadata only)',
+        real_generation_round_trip_performed: realGenerationVerified,
+        configuration_ready: capabilityReady,
+        blocker: realGenerationVerified
+            ? null
+            : capabilityReady
+                ? 'codex_imagegen_real_output_unverified'
+                : 'codex_app_builtin_imagegen_capability_missing'
     };
-    const recovered = after?.core_ready === true;
+    const recovered = realGenerationVerified;
+    const featureEnableStep = steps.find((step) => step.id === 'image_generation_feature_enable');
+    const configurationRecovered = before?.core_ready !== true && capabilityReady && featureEnableStep?.attempted === true && featureEnableStep.ok === true;
+    const requiresNewTask = !recovered;
+    const refreshActions = requiresNewTask ? [
+        'Start a new Codex/Work task so the repaired $imagegen tool is attached to a fresh task manifest.',
+        'Invoke Codex App $imagegen with gpt-image-2 and bind the selected raster output path to the route evidence.',
+        'If $imagegen is missing in the new task, restart the ChatGPT/Codex desktop app and rerun `sks doctor --fix --repair-native-capabilities --yes`.'
+    ] : [];
     const blockers = recovered ? [] : [
         ...new Set([
             ...(after?.core_blockers || []),
             ...(after?.blockers || []),
+            ...(capabilityReady ? ['codex_imagegen_real_output_unverified'] : []),
             'codex_imagegen_unavailable'
         ].map(String))
     ];
@@ -134,15 +158,26 @@ export async function repairCodexImagegen(input) {
         attempted: before?.core_ready !== true,
         apply,
         recovered,
+        capability_ready: capabilityReady,
+        configuration_ready: capabilityReady,
+        configuration_recovered: configurationRecovered,
+        route_ready: recovered,
+        real_generation_verified: realGenerationVerified,
+        evidence_level: realGenerationVerified ? 'real-output' : capabilityReady ? 'configuration' : 'none',
         before,
         after,
         steps,
         communication_test: communicationTest,
+        current_task_tool_manifest_verified: false,
+        requires_new_task: requiresNewTask,
         blockers,
         manual_actions: recovered ? [] : [
-            `Install/update Codex CLI if missing: npm i -g @openai/codex@latest`,
-            `Open Codex App settings and enable image_generation / $imagegen.`,
-            `Verify with: codex features list --json`,
+            ...refreshActions,
+            ...(!capabilityReady ? [
+                `Install/update Codex CLI if missing: npm i -g @openai/codex@latest`,
+                `Open Codex App settings and enable image_generation / $imagegen.`,
+                `Verify configuration with: codex features list`
+            ] : []),
             `Docs: ${CODEX_APP_IMAGE_GENERATION_DOC_URL}`
         ],
         docs_url: CODEX_APP_IMAGE_GENERATION_DOC_URL
@@ -161,7 +196,7 @@ export async function repairCodexImagegen(input) {
     return report;
 }
 function tail(value, max = 2000) {
-    const text = String(value || '');
+    const text = redactString(String(value || ''));
     return text.length > max ? text.slice(-max) : text;
 }
 function messageOf(err) {