sneakoscope 7.0.0 → 7.0.3

package/dist/core/codex-lb/codex-lb-env.js

@@ -67,6 +67,7 @@ export async function readCodexLbModelCatalog(opts = {}) {
     try {
         const response = await fetchImpl(`${loaded.base_url}/models`, {
             headers: { Authorization: `Bearer ${loaded.secret_api_key}` },
+            redirect: 'error',
             signal: AbortSignal.timeout(Math.max(250, Number(opts.timeoutMs || 5000)))
         });
         const payload = await response.json().catch(() => null);
@@ -156,11 +157,12 @@ export function codexLbBaseUrlSecurityBlocker(input) {
 }
 export async function loadCodexLbEnv(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
+    const metadataPath = opts.metadataPath || codexLbMetadataPath(home);
     const envPaths = [
         opts.envPath || codexLbEnvPath(home),
         opts.legacyEnvPath || legacyCodexLbEnvPath(home)
     ];
-    const sourcePriority = ['process.env', 'keychain', 'env-file', 'legacy-env-file'];
+    const sourcePriority = ['process.env', 'env-file', 'keychain', 'legacy-env-file'];
     if (opts.allowProjectSecrets)
         sourcePriority.push('project-local');
     const processEnv = pickEnv(opts.processEnv || process.env);
@@ -168,37 +170,54 @@ export async function loadCodexLbEnv(opts = {}) {
     const legacyEnv = await readEnvFile(envPaths[1]);
     const keychain = await readMacKeychain(opts);
     const projectLocal = opts.allowProjectSecrets ? await readEnvFile(path.join(opts.root || process.cwd(), '.env')) : {};
-    const keySource = processEnv.apiKey ? 'process.env'
-        : keychain.apiKey ? 'keychain'
-            : envFile.apiKey ? 'env-file'
-                : legacyEnv.apiKey ? 'legacy-env-file'
-                    : projectLocal.apiKey ? 'project-local'
-                        : 'missing';
-    const baseUrlSource = processEnv.baseUrl ? 'process.env'
-        : envFile.baseUrl ? 'env-file'
-            : legacyEnv.baseUrl ? 'legacy-env-file'
-                : projectLocal.baseUrl ? 'project-local'
-                    : 'missing';
-    const apiKey = processEnv.apiKey || keychain.apiKey || envFile.apiKey || legacyEnv.apiKey || projectLocal.apiKey || '';
-    const baseUrl = normalizeCodexLbBaseUrl(processEnv.baseUrl || envFile.baseUrl || legacyEnv.baseUrl || projectLocal.baseUrl || '');
+    const metadata = await readCodexLbCredentialMetadata(metadataPath);
+    const apiKeyCandidates = [
+        { source: 'process.env', apiKey: processEnv.apiKey },
+        { source: 'env-file', apiKey: envFile.apiKey },
+        { source: 'keychain', apiKey: keychain.apiKey },
+        { source: 'legacy-env-file', apiKey: legacyEnv.apiKey },
+        ...(opts.allowProjectSecrets ? [{ source: 'project-local', apiKey: String(projectLocal.apiKey || '') }] : [])
+    ].filter((candidate) => Boolean(candidate.apiKey));
+    const candidateFingerprints = await Promise.all(apiKeyCandidates.map(async (candidate) => ({
+        ...candidate,
+        sha256: await sha256Full(candidate.apiKey)
+    })));
+    const selectedApiKey = metadata.valid
+        ? candidateFingerprints.find((candidate) => candidate.sha256 === metadata.apiKeySha256) || candidateFingerprints[0]
+        : candidateFingerprints[0];
+    const keySource = selectedApiKey?.source || 'missing';
+    const apiKey = selectedApiKey?.apiKey || '';
+    const configuredBaseUrl = normalizeCodexLbBaseUrl(processEnv.baseUrl || envFile.baseUrl || legacyEnv.baseUrl || projectLocal.baseUrl || '');
+    const apiKeySha256 = selectedApiKey?.sha256 || '';
+    const binding = evaluateCodexLbCredentialBinding({
+        metadata,
+        metadataPath,
+        apiKeySha256,
+        configuredBaseUrl
+    });
+    const baseUrl = binding.present && metadata.baseUrl ? metadata.baseUrl : configuredBaseUrl;
+    const apiKeyUsable = Boolean(apiKey) && binding.blockers.length === 0;
     const missing = [
         ...(apiKey ? [] : ['CODEX_LB_API_KEY']),
-        ...(baseUrl ? [] : ['CODEX_LB_BASE_URL'])
+        ...(baseUrl ? [] : ['CODEX_LB_BASE_URL']),
+        ...(binding.blockers.length ? ['CODEX_LB_CREDENTIAL_BINDING'] : [])
     ];
     return {
         schema: 'sks.codex-lb-env.v1',
-        configured: missing.length === 0,
+        configured: missing.length === 0 && apiKeyUsable,
         missing,
         source: apiKey ? keySource : 'missing',
         source_priority: sourcePriority,
         base_url: baseUrl || null,
         api_key: {
             present: Boolean(apiKey),
+            usable: apiKeyUsable,
             source: apiKey ? keySource : null,
             redacted: true,
-            fingerprint: apiKey ? await sha256Prefix(apiKey) : null
+            fingerprint: apiKeySha256 ? apiKeySha256.slice(0, 16) : null
         },
-        secret_api_key: apiKey || null,
+        secret_api_key: apiKeyUsable ? apiKey : null,
+        credential_binding: binding,
         env_paths: envPaths,
         keychain: {
             checked: keychain.checked,
@@ -207,6 +226,85 @@ export async function loadCodexLbEnv(opts = {}) {
         }
     };
 }
+async function readCodexLbCredentialMetadata(file) {
+    if (!(await exists(file)))
+        return { present: false, valid: false, baseUrl: '', apiKeySha256: '' };
+    const value = await readJson(file, null).catch(() => null);
+    const baseUrl = normalizeCodexLbBaseUrl(value?.base_url || '');
+    const apiKeySha256 = String(value?.api_key?.sha256 || '').trim().toLowerCase();
+    const valid = value?.schema === 'sks.codex-lb-metadata.v1'
+        && Boolean(baseUrl)
+        && codexLbBaseUrlSecurityBlocker(baseUrl) === null
+        && /^[a-f0-9]{64}$/.test(apiKeySha256);
+    return { present: true, valid, baseUrl, apiKeySha256 };
+}
+function evaluateCodexLbCredentialBinding(input) {
+    const base = {
+        checked: input.metadata.present,
+        present: input.metadata.present,
+        metadata_path: input.metadataPath
+    };
+    if (!input.metadata.present) {
+        return {
+            ...base,
+            valid: false,
+            status: 'missing',
+            api_key_matches: null,
+            base_url_matches: null,
+            blockers: []
+        };
+    }
+    if (!input.metadata.valid) {
+        return {
+            ...base,
+            valid: false,
+            status: 'invalid_metadata',
+            api_key_matches: null,
+            base_url_matches: null,
+            blockers: ['codex_lb_credential_metadata_invalid']
+        };
+    }
+    if (!input.apiKeySha256) {
+        return {
+            ...base,
+            valid: false,
+            status: 'key_missing',
+            api_key_matches: false,
+            base_url_matches: input.configuredBaseUrl ? input.configuredBaseUrl === input.metadata.baseUrl : true,
+            blockers: []
+        };
+    }
+    const apiKeyMatches = input.apiKeySha256 === input.metadata.apiKeySha256;
+    const baseUrlMatches = input.configuredBaseUrl ? input.configuredBaseUrl === input.metadata.baseUrl : true;
+    if (!apiKeyMatches) {
+        return {
+            ...base,
+            valid: false,
+            status: 'api_key_mismatch',
+            api_key_matches: false,
+            base_url_matches: baseUrlMatches,
+            blockers: ['codex_lb_credential_key_fingerprint_mismatch']
+        };
+    }
+    if (!baseUrlMatches) {
+        return {
+            ...base,
+            valid: false,
+            status: 'base_url_mismatch',
+            api_key_matches: true,
+            base_url_matches: false,
+            blockers: ['codex_lb_credential_base_url_mismatch']
+        };
+    }
+    return {
+        ...base,
+        valid: true,
+        status: 'matched',
+        api_key_matches: true,
+        base_url_matches: true,
+        blockers: []
+    };
+}
 export async function writeCodexLbKeychain(apiKey, opts = {}) {
     const key = String(apiKey || '').trim();
     if (!key)
@@ -273,9 +371,9 @@ export function parseShellEnvValue(text = '', key = '') {
         return '';
     return raw;
 }
-async function sha256Prefix(value) {
+async function sha256Full(value) {
     const { createHash } = await import('node:crypto');
-    return createHash('sha256').update(value).digest('hex').slice(0, 16);
+    return createHash('sha256').update(value).digest('hex');
 }
 function redactSecret(text, secret) {
     return String(text || '').split(String(secret || '')).join('[redacted]');

package/dist/core/codex-lb/codex-lb-tool-catalog.js

@@ -26,8 +26,6 @@ const REQUIRED_CODEX_0144_MODEL_FIELDS = {
     supports_parallel_tool_calls: ['boolean'],
     experimental_supported_tools: ['array']
 };
-// Exact union observed in Codex CLI 0.144.5's native cache and codex-lb catalog.
-// Unknown response fields are deliberately not persisted into a Codex-owned file.
 const CODEX_0144_MODEL_FIELD_TYPES = {
     ...REQUIRED_CODEX_0144_MODEL_FIELDS,
     description: ['string'],
@@ -94,8 +92,6 @@ export function normalizeCodexLbToolCatalog(payload, opts = {}) {
             return sanitized;
         if (row.use_responses_lite !== false)
             patchedModels.push(model);
-        // Codex 0.144.5 omits the request's `tools` field for Responses Lite.
-        // Preserve the provider's tool_mode contract, but force full Responses.
         return { ...sanitized, use_responses_lite: false };
     });
     const compatibleRows = models.filter((row) => isCodexLbGpt56Model(row.slug));

package/dist/core/codex-lb/codex-lb-tool-output-recovery.js

@@ -57,7 +57,7 @@ export async function probeCodexLbToolOutputRecovery(opts = {}) {
         const response = await fetchImpl(healthUrl, {
             method: 'GET',
             headers: { accept: 'application/json' },
-            redirect: 'follow',
+            redirect: 'error',
             signal: controller.signal
         });
         if (!response.ok) {

package/dist/core/codex-model-guard.js

@@ -1,30 +1,16 @@
-/**
- * Codex owns the model catalog. SKS must never maintain a finite allowlist or
- * silently replace a model selected by the user, workspace, or Codex client.
- *
- * Reasoning effort remains an SKS scheduling hint because it is independent of
- * the model identifier and can be ignored by clients that do not advertise it.
- */
 export const DEFAULT_CODEX_REASONING_EFFORT = 'high';
 function copyArgs(args = []) {
     return Array.isArray(args) ? args.map((value) => String(value)) : [];
 }
-/** Return Codex arguments exactly as supplied, including future model IDs. */
 export function preserveCodexModelArgs(args = []) {
     return copyArgs(args);
 }
-/**
- * Backward-compatible aliases for callers compiled against older SKS builds.
- * Despite the historical name, these functions intentionally do not force a
- * model anymore.
- */
 export function forceRequiredCodexModelArgs(args = []) {
     return preserveCodexModelArgs(args);
 }
 export function forceRequiredCodexModelConfigArgs(args = []) {
     return preserveCodexModelArgs(args);
 }
-/** No model is forbidden by SKS; availability is decided by Codex itself. */
 export function isForbiddenCodexModel(_value = '') {
     return false;
 }

package/dist/core/codex-native/codex-native-feature-broker.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import os from 'node:os';
 import fs from 'node:fs/promises';
 import { findCodexBinary } from '../codex-adapter.js';
 import { codexAppIntegrationStatus } from '../codex-app.js';
@@ -9,12 +10,14 @@ import { detectCodex0139Capability } from '../codex-control/codex-0139-capabilit
 import { detectCodex0140Capability } from '../codex-control/codex-0140-capability.js';
 import { detectCodex0144Capability } from '../codex-control/codex-0144-capability.js';
 import { buildCodexPluginInventory } from '../codex-plugins/codex-plugin-json.js';
-import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
+import { nowIso, runProcess, sha256, writeJsonAtomic } from '../fsx.js';
+import { inspectConfinedPath } from '../managed-path-safety.js';
 import { MANAGED_OFFICIAL_SUBAGENT_ROLES, MANAGED_SKILLS, managedOfficialSubagentRoleOwnsText } from '../managed-assets/managed-assets-manifest.js';
 import { buildMcpPluginServerCandidates } from '../mcp/mcp-plugin-inventory.js';
 import { codexNativeFeatureState, computeCodexNativeInvocationDefaults } from './codex-native-feature-matrix.js';
+import { currentCodexSkillRoots, currentSksSkillName, resolveAuthoritativeSksSkillSources } from './sks-skill-paths.js';
 const REPORT_PATH = '.sneakoscope/reports/codex-native-feature-matrix.json';
-const REQUIRED_SKILL_NAMES = MANAGED_SKILLS.map((skill) => skill.id);
+const REQUIRED_SKILL_NAMES = MANAGED_SKILLS.map((skill) => currentSksSkillName(skill.id));
 const REQUIRED_AGENT_ROLES = MANAGED_OFFICIAL_SUBAGENT_ROLES.map((role) => role.id);
 const invocationMatrixCache = new Map();
 export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd() }) {
@@ -218,24 +221,12 @@ export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd(
     return matrix;
 }
 async function inspectManagedSkillState(root) {
-    const skillRoots = [
-        path.join(root, '.agents', 'skills'),
-        ...(process.env.CODEX_HOME ? [path.join(process.env.CODEX_HOME, 'skills')] : [])
-    ];
-    let existingCount = 0;
-    const managed = new Set();
-    for (const dir of skillRoots) {
-        const rows = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
-        existingCount += rows.filter((row) => row.isDirectory()).length;
-        for (const name of REQUIRED_SKILL_NAMES) {
-            if (managed.has(name))
-                continue;
-            const text = await fs.readFile(path.join(dir, name, 'SKILL.md'), 'utf8').catch(() => '');
-            if (text.includes('BEGIN SKS MANAGED SKILL') || text.includes('BEGIN SKS IMMUTABLE CORE SKILL'))
-                managed.add(name);
-        }
-    }
+    const home = path.resolve(process.env.HOME || os.homedir());
+    const authoritativeRoot = currentCodexSkillRoots({ root, home }).find((entry) => entry.scope === 'global')?.root;
+    const resolution = await resolveAuthoritativeSksSkillSources({ root, home, skillNames: REQUIRED_SKILL_NAMES });
+    const managed = new Set(resolution.sources.map((source) => source.canonical_name));
     const missing = REQUIRED_SKILL_NAMES.filter((name) => !managed.has(name));
+    const existingCount = authoritativeRoot ? await countConfinedSkillDirectories(home, authoritativeRoot) : 0;
     return {
         ok: missing.length === 0,
         apply: false,
@@ -243,7 +234,10 @@ async function inspectManagedSkillState(root) {
         existing_count: existingCount,
         managed_count: managed.size,
         missing_required: missing,
-        blockers: missing.length ? [`managed_skills_missing:${missing.join(',')}`] : [],
+        blockers: [
+            ...(missing.length ? [`managed_skills_missing:${missing.join(',')}`] : []),
+            ...resolution.blockers.map((blocker) => `managed_skill_${blocker}`)
+        ],
         warnings: existingCount > managed.size ? ['non_sks_skill_dirs_ignored'] : []
     };
 }
@@ -271,12 +265,17 @@ async function inspectManagedAgentRoleState(root) {
     };
 }
 async function readManagedAssetFingerprint(root) {
+    const home = path.resolve(process.env.HOME || os.homedir());
+    const authoritativeSkillRoots = currentCodexSkillRoots({ root, home })
+        .filter((entry) => entry.scope === 'global')
+        .map((entry) => entry.root);
     const dirs = [
-        path.join(root, '.agents', 'skills'),
         path.join(root, '.codex', 'agents'),
-        ...(process.env.CODEX_HOME ? [path.join(process.env.CODEX_HOME, 'skills'), path.join(process.env.CODEX_HOME, 'agents')] : [])
+        ...(process.env.CODEX_HOME ? [path.join(process.env.CODEX_HOME, 'agents')] : [])
     ];
     const rows = [];
+    for (const dir of authoritativeSkillRoots)
+        rows.push(...await readConfinedSkillRootFingerprint(home, dir));
     for (const dir of dirs) {
         const stat = await fs.stat(dir).catch(() => null);
         rows.push(`${dir}:${stat ? `${stat.mtimeMs}:${stat.size}` : 'missing'}`);
@@ -295,6 +294,52 @@ async function readManagedAssetFingerprint(root) {
     }
     return rows;
 }
+async function countConfinedSkillDirectories(home, skillsRoot) {
+    try {
+        const inspection = await inspectConfinedPath(home, skillsRoot);
+        if (!inspection.exists || inspection.leafSymlink || !inspection.stat?.isDirectory())
+            return 0;
+        const rows = await fs.readdir(skillsRoot, { withFileTypes: true });
+        return rows.filter((row) => row.isDirectory()).length;
+    }
+    catch {
+        return 0;
+    }
+}
+async function readConfinedSkillRootFingerprint(home, skillsRoot) {
+    try {
+        const inspection = await inspectConfinedPath(home, skillsRoot);
+        if (!inspection.exists)
+            return [`${skillsRoot}:missing`];
+        if (inspection.leafSymlink || !inspection.stat?.isDirectory())
+            return [`${skillsRoot}:unsafe`];
+        const rows = [`${skillsRoot}:directory`];
+        const entries = await fs.readdir(skillsRoot, { withFileTypes: true });
+        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            const file = path.join(skillsRoot, entry.name, 'SKILL.md');
+            try {
+                const child = await inspectConfinedPath(home, file);
+                if (!child.exists) {
+                    rows.push(`${entry.name}:missing`);
+                }
+                else if (child.leafSymlink || !child.stat?.isFile()) {
+                    rows.push(`${entry.name}:unsafe`);
+                }
+                else {
+                    const text = await fs.readFile(file, 'utf8');
+                    rows.push(`${entry.name}:file:${sha256(text)}`);
+                }
+            }
+            catch {
+                rows.push(`${entry.name}:unsafe`);
+            }
+        }
+        return rows;
+    }
+    catch {
+        return [`${skillsRoot}:unsafe`];
+    }
+}
 export async function writeCodexNativeFeatureMatrix(root, matrix, missionDir) {
     await writeJsonAtomic(path.join(root, REPORT_PATH), matrix);
     if (missionDir)

package/dist/core/codex-native/codex-native-interop-policy.js

@@ -1,20 +1,33 @@
 import path from 'node:path';
 import os from 'node:os';
 import fs from 'node:fs/promises';
-import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { nowIso } from '../fsx.js';
 import { buildCodexPluginInventory } from '../codex-plugins/codex-plugin-json.js';
+import { inspectConfinedPath, isLexicallyConfined } from '../managed-path-safety.js';
+import { currentCodexSkillRoots } from './sks-skill-paths.js';
+import { writeRootConfinedJsonReport } from './confined-report-writer.js';
 const RESERVED_EXTERNAL_ROUTE_SKILLS = ['ulw-loop', 'ulw-plan', 'start-work'];
 export async function buildCodexNativeInteropPolicy(input) {
     const root = path.resolve(input.root);
     const inventory = normalizeInventory(input.inventory || await buildCodexPluginInventory().catch((err) => ({ plugins: [], blockers: [messageOf(err)] })));
-    const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
-    const skillNames = await discoverSkillNames([path.join(root, '.agents', 'skills'), path.join(codexHome, 'skills')]);
+    const home = path.resolve(process.env.HOME || os.homedir());
+    const codexHome = path.resolve(input.codexHome || process.env.CODEX_HOME || path.join(home, '.codex'));
+    const codexHomeBoundary = isLexicallyConfined(home, codexHome) ? home : path.dirname(codexHome);
+    const skillScan = await discoverSkillNames(currentCodexSkillRoots({ root, home, codexHome }).map((entry) => ({
+        ...entry,
+        boundary: entry.scope === 'global'
+            ? home
+            : entry.scope === 'project'
+                ? root
+                : codexHomeBoundary
+    })));
+    const skillNames = skillScan.names;
     const pluginIds = (inventory.plugins || []).map((plugin) => `${plugin.id || ''} ${plugin.name || ''}`.toLowerCase()).filter(Boolean);
     const preservedSkillNames = RESERVED_EXTERNAL_ROUTE_SKILLS.filter((name) => skillNames.includes(name));
     const report = {
         schema: 'sks.codex-native-interop-policy.v1',
         generated_at: nowIso(),
-        ok: true,
+        ok: skillScan.blockers.length === 0,
         mode: input.mode || 'coexist',
         detection: {
             plugin_inventory_ids: pluginIds,
@@ -28,9 +41,18 @@ export async function buildCodexNativeInteropPolicy(input) {
             artifact_names_brand_neutral: true
         },
         actions: preservedSkillNames.map((name) => `preserve_existing_skill:${name}`),
-        blockers: []
+        blockers: skillScan.blockers
     };
-    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-native-interop-policy.json'), report).catch(() => undefined);
+    const reportPath = input.reportPath === null
+        ? null
+        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-native-interop-policy.json');
+    if (reportPath) {
+        const written = await writeRootConfinedJsonReport({ root, reportPath, value: report });
+        if (!written) {
+            report.ok = false;
+            report.blockers = [...new Set([...report.blockers, 'codex_native_interop_report_path_unsafe'])].sort();
+        }
+    }
     return report;
 }
 function normalizeInventory(value) {
@@ -47,11 +69,61 @@ function messageOf(err) {
 }
 async function discoverSkillNames(roots) {
     const names = new Set();
-    for (const root of roots) {
-        const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
+    const blockers = new Set();
+    for (const candidate of roots) {
+        let inspection;
+        try {
+            inspection = await inspectConfinedPath(candidate.boundary, candidate.root);
+        }
+        catch (error) {
+            blockers.add(unsafeSkillScanRootBlocker(candidate.scope, skillScanRootInspectionFailureReason(error)));
+            continue;
+        }
+        if (!inspection.exists)
+            continue;
+        if (inspection.leafSymlink) {
+            blockers.add(unsafeSkillScanRootBlocker(candidate.scope, 'leaf_symlink'));
+            continue;
+        }
+        if (!inspection.stat?.isDirectory()) {
+            blockers.add(unsafeSkillScanRootBlocker(candidate.scope, 'not_directory'));
+            continue;
+        }
+        let entries;
+        try {
+            entries = await fs.readdir(candidate.root, { withFileTypes: true });
+        }
+        catch {
+            blockers.add(unsafeSkillScanRootBlocker(candidate.scope, 'readdir_failed'));
+            continue;
+        }
         for (const entry of entries)
             if (entry.isDirectory())
                 names.add(entry.name);
     }
-    return [...names].sort();
+    return { names: [...names].sort(), blockers: [...blockers].sort() };
+}
+function unsafeSkillScanRootBlocker(scope, reason) {
+    return `unsafe_skill_scan_root:${skillScanRootScopeCode(scope)}:${reason}`;
+}
+function skillScanRootScopeCode(scope) {
+    if (scope === 'global' || scope === 'project' || scope === 'codex-home')
+        return scope;
+    return 'unknown';
+}
+function skillScanRootInspectionFailureReason(error) {
+    const code = error && typeof error === 'object' && 'code' in error ? error.code : null;
+    if (code === 'managed_path_boundary_missing')
+        return 'boundary_missing';
+    if (code === 'managed_path_boundary_symlink_refused')
+        return 'boundary_symlink';
+    if (code === 'managed_path_boundary_not_directory')
+        return 'boundary_not_directory';
+    if (code === 'managed_path_escape_refused')
+        return 'escape_refused';
+    if (code === 'managed_path_ancestor_symlink_refused')
+        return 'ancestor_symlink';
+    if (code === 'managed_path_ancestor_not_directory')
+        return 'ancestor_not_directory';
+    return 'inspection_failed';
 }

package/dist/core/codex-native/confined-report-writer.js

@@ -0,0 +1,21 @@
+import path from 'node:path';
+import { writeJsonAtomic } from '../fsx.js';
+import { ensureConfinedDirectory, inspectConfinedPath, isLexicallyConfined } from '../managed-path-safety.js';
+export async function writeRootConfinedJsonReport(input) {
+    const root = path.resolve(input.root);
+    const reportPath = path.resolve(input.reportPath);
+    if (!isLexicallyConfined(root, reportPath) || reportPath === root)
+        return false;
+    try {
+        await ensureConfinedDirectory(root, path.dirname(reportPath));
+        const before = await inspectConfinedPath(root, reportPath);
+        if (before.exists && (before.leafSymlink || !before.stat?.isFile()))
+            return false;
+        await writeJsonAtomic(reportPath, input.value);
+        const after = await inspectConfinedPath(root, reportPath);
+        return after.exists && !after.leafSymlink && Boolean(after.stat?.isFile());
+    }
+    catch {
+        return false;
+    }
+}