sneakoscope 7.0.2 → 7.0.3

package/dist/core/codex-native/sks-skill-paths.js

@@ -0,0 +1,185 @@
+import path from 'node:path';
+import os from 'node:os';
+import fsp from 'node:fs/promises';
+import { sha256 } from '../fsx.js';
+import { sksPrefixedSkillName } from '../routes/dollar-prefix.js';
+import { inspectConfinedPath, ManagedPathSafetyError } from '../managed-path-safety.js';
+import { buildSksCoreSkillManifest } from './core-skill-manifest.js';
+export const AUTHORITATIVE_SKS_SKILL_ROOT_REFERENCE = '~/.agents/skills';
+const CURRENT_SKS_SKILL_NAME_RE = /^sks(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?$/;
+const SHA256_RE = /^[a-f0-9]{64}$/;
+let packagedSkillDigestsPromise = null;
+export function currentSksSkillName(value) {
+    const name = sksPrefixedSkillName(value);
+    return CURRENT_SKS_SKILL_NAME_RE.test(name) ? name : '';
+}
+export async function inspectCurrentSksManagedSkillContent(text, canonicalName) {
+    const contentSha256 = sha256(text);
+    if (!/BEGIN SKS (?:IMMUTABLE CORE|MANAGED) SKILL/.test(text)) {
+        return { status: 'not_sks_managed', content_sha256: contentSha256 };
+    }
+    const declaredName = String(text.match(/^name:\s*([^\n\r]+)/m)?.[1] || '').trim().replace(/^["']|["']$/g, '');
+    if (currentSksSkillName(declaredName) !== canonicalName) {
+        return { status: 'canonical_name_mismatch', content_sha256: contentSha256 };
+    }
+    const expected = (await currentPackagedSksSkillDigests()).get(canonicalName);
+    if (!expected?.size)
+        return { status: 'authoritative_digest_missing', content_sha256: contentSha256 };
+    return {
+        status: expected.has(contentSha256) ? 'current' : 'content_digest_mismatch',
+        content_sha256: contentSha256
+    };
+}
+export function currentCodexSkillRoots(input) {
+    const projectRoot = path.resolve(input.root);
+    const home = path.resolve(input.home || process.env.HOME || os.homedir());
+    const codexHome = path.resolve(input.codexHome || process.env.CODEX_HOME || path.join(home, '.codex'));
+    return uniqueSkillRoots([
+        { scope: 'global', root: path.join(home, '.agents', 'skills') },
+        { scope: 'project', root: path.join(projectRoot, '.agents', 'skills') },
+        { scope: 'codex-home', root: path.join(codexHome, 'skills') }
+    ]);
+}
+export async function resolveAuthoritativeSksSkillSources(input) {
+    const home = path.resolve(input.home || process.env.HOME || os.homedir());
+    const requested = Array.from(new Set(input.skillNames
+        .map((name) => String(name || '').trim())
+        .filter(Boolean)));
+    const roots = currentCodexSkillRoots({ ...input, home }).filter((entry) => entry.scope === 'global');
+    const sources = [];
+    const unresolved = [];
+    const blockers = [];
+    for (const requestedName of requested) {
+        const canonicalName = currentSksSkillName(requestedName);
+        if (!canonicalName) {
+            blockers.push('invalid_managed_skill_name');
+            continue;
+        }
+        let source = null;
+        let unsafe = false;
+        for (const root of roots) {
+            const candidate = confinedManagedSkillFile(root.root, canonicalName);
+            if (!candidate) {
+                blockers.push(`managed_skill_path_outside_root:${canonicalName}:${root.scope}`);
+                unsafe = true;
+                break;
+            }
+            const inspection = await inspectManagedSkillFile(home, candidate, canonicalName);
+            if (inspection.status === 'missing')
+                continue;
+            if (inspection.status !== 'current') {
+                blockers.push(`${inspection.status}:${canonicalName}:${root.scope}`);
+                unsafe = true;
+                break;
+            }
+            source = {
+                requested_name: requestedName,
+                canonical_name: canonicalName,
+                scope: root.scope,
+                root: root.root,
+                path: candidate
+            };
+            break;
+        }
+        if (source)
+            sources.push(source);
+        else {
+            unresolved.push(canonicalName);
+            if (unsafe)
+                continue;
+        }
+    }
+    return {
+        schema: 'sks.authoritative-skill-sources.v1',
+        sources,
+        unresolved: Array.from(new Set(unresolved)).sort(),
+        blockers: Array.from(new Set(blockers)).sort()
+    };
+}
+export async function authoritativeSksSkillContext(input) {
+    const resolution = await resolveAuthoritativeSksSkillSources(input);
+    return renderAuthoritativeSksSkillContext(resolution);
+}
+export function renderAuthoritativeSksSkillContext(resolution) {
+    if (!resolution.sources.length && !resolution.unresolved.length && !resolution.blockers.length)
+        return '';
+    const lines = [
+        'Authoritative SKS skill sources for this turn:',
+        ...resolution.sources.map((source) => `- ${source.canonical_name}: ${JSON.stringify(source.path)}`)
+    ];
+    if (resolution.unresolved.length) {
+        lines.push(`- unresolved current managed skills: ${resolution.unresolved.join(', ')}`);
+    }
+    if (resolution.blockers.length) {
+        lines.push(`- unsafe managed-skill candidates rejected: ${resolution.blockers.join(', ')}`);
+    }
+    lines.push('These existing current files override stale project-local, .codex/skills, plugin-cache, picker, pre-compaction, and prior-message paths for the listed managed SKS skills.', 'Read the resolved file directly. After a successful remap, continue silently and do not report a skill-path mismatch to the user. Never guess a path for an unresolved or rejected skill.', 'For an unresolved skill, do not mention an old or stale path mismatch; report only that the current managed SKS skill is unavailable if it actually blocks the task.');
+    return lines.join('\n');
+}
+function confinedManagedSkillFile(skillsRoot, canonicalName) {
+    const root = path.resolve(skillsRoot);
+    const candidate = path.resolve(root, canonicalName, 'SKILL.md');
+    const relative = path.relative(root, candidate);
+    if (!relative || relative.startsWith(`..${path.sep}`) || relative === '..' || path.isAbsolute(relative))
+        return null;
+    return candidate;
+}
+async function inspectManagedSkillFile(homeBoundary, file, canonicalName) {
+    let inspected;
+    try {
+        inspected = await inspectConfinedPath(homeBoundary, file);
+    }
+    catch (error) {
+        if (error instanceof ManagedPathSafetyError) {
+            if (error.code === 'managed_path_boundary_missing')
+                return { status: 'missing' };
+            if (error.code.includes('symlink'))
+                return { status: 'unsafe_symlink' };
+            return { status: 'not_regular_file' };
+        }
+        throw error;
+    }
+    if (!inspected.exists)
+        return { status: 'missing' };
+    if (inspected.leafSymlink)
+        return { status: 'unsafe_symlink' };
+    if (!inspected.stat?.isFile())
+        return { status: 'not_regular_file' };
+    const text = await fsp.readFile(file, 'utf8').catch(() => '');
+    return inspectCurrentSksManagedSkillContent(text, canonicalName);
+}
+async function currentPackagedSksSkillDigests() {
+    if (!packagedSkillDigestsPromise)
+        packagedSkillDigestsPromise = loadCurrentPackagedSksSkillDigests();
+    return packagedSkillDigestsPromise;
+}
+async function loadCurrentPackagedSksSkillDigests() {
+    const digests = new Map();
+    const add = (nameValue, digestValue) => {
+        const name = currentSksSkillName(nameValue);
+        const digest = String(digestValue || '').trim().toLowerCase();
+        if (!name || !SHA256_RE.test(digest))
+            return;
+        const current = digests.get(name) || new Set();
+        current.add(digest);
+        digests.set(name, current);
+    };
+    for (const skill of buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills) {
+        add(skill.canonical_name, skill.content_sha256);
+    }
+    const manifest = await import('../init/skills.js')
+        .then(({ loadSkillsManifest }) => loadSkillsManifest())
+        .catch(() => null);
+    for (const skill of manifest?.skills || [])
+        add(skill?.canonical_name, skill?.content_sha256);
+    return digests;
+}
+function uniqueSkillRoots(roots) {
+    const unique = new Map();
+    for (const entry of roots) {
+        const resolved = path.resolve(entry.root);
+        if (!unique.has(resolved))
+            unique.set(resolved, { ...entry, root: resolved });
+    }
+    return [...unique.values()];
+}

package/dist/core/codex-runtime/codex-desktop-config-policy.js

@@ -84,8 +84,6 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
     ]) {
         next = upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
     }
-    // Global postinstall must not impose a project concurrency policy. Existing
-    // user [agents] values are preserved verbatim; project setup owns defaults.
     next = removeTomlTable(next, 'features.multi_agent_v2');
     if (process.env.SKS_MANAGE_CODEX_APP_PLUGINS === '1') {
         for (const [name, marketplace] of DEFAULT_CODEX_APP_PLUGINS) {

package/dist/core/commands/agent-bridge-command.js

@@ -1,11 +1,10 @@
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ensureDir, exists, nowIso, projectRoot, runProcess, writeJsonAtomic } from '../fsx.js';
-import { buildAgentManifest, validateAgentManifest } from '../agent-bridge/agent-manifest.js';
+import { agentManifestDigest, buildAgentManifest, validateAgentManifest } from '../agent-bridge/agent-manifest.js';
+import { inspectHostCapabilityRuntime } from '../agent-bridge/host-capability-runtime.js';
 import { flag } from './command-utils.js';
 async function resolveSksEntrypoint() {
-    // Mirrors src/core/agent-bridge/mcp-server.ts's own bin resolution: prefer the
-    // packaged dist entrypoint, fall back to the source-tree relative path in dev.
     const packedBin = fileURLToPath(new URL('../../bin/sks.js', import.meta.url));
     const sourceBin = fileURLToPath(new URL('../../../bin/sks.js', import.meta.url));
     return (await exists(packedBin)) ? packedBin : sourceBin;
@@ -14,9 +13,6 @@ async function runJsonSmoke(entrypoint, args, validate, run) {
     const result = await run(process.execPath, [entrypoint, ...args], {
         env: { SKS_AGENT_MODE: '1' },
         timeoutMs: 15_000,
-        // Status is intentionally bounded but can exceed 32 KiB when several
-        // session summaries are present. Truncating otherwise-valid JSON makes the
-        // bridge report a false non-interactive failure.
         maxOutputBytes: 512 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) }));
     let parsed = null;
@@ -74,6 +70,22 @@ function registrationSnippets() {
         }
     };
 }
+export function buildAgentBridgeSetupMetadata(manifest) {
+    return {
+        compatibility: manifest.compatibility,
+        host_capabilities: manifest.host_capabilities,
+        manifest_digest: agentManifestDigest(manifest),
+        capability_digest: manifest.host_capabilities.capability_digest
+    };
+}
+export async function inspectAgentBridgeHostCapabilities(root, dependencies, projectTrusted = false) {
+    return inspectHostCapabilityRuntime({
+        root,
+        request: { capability_ids: [], workflows: [] },
+        projectTrusted,
+        ...(dependencies ? { dependencies } : {})
+    });
+}
 export async function agentBridgeCommand(subcommand, args = []) {
     const sub = subcommand || 'setup';
     if (sub !== 'setup') {
@@ -87,6 +99,7 @@ export async function agentBridgeCommand(subcommand, args = []) {
     const root = await projectRoot();
     const manifest = buildAgentManifest();
     const manifestValidation = validateAgentManifest(manifest);
+    const setupMetadata = buildAgentBridgeSetupMetadata(manifest);
     const manifestPath = path.join(root, '.sneakoscope', 'agent-bridge', 'manifest.json');
     if (!manifestValidation.ok) {
         const result = {
@@ -95,6 +108,7 @@ export async function agentBridgeCommand(subcommand, args = []) {
             ok: false,
             status: 'manifest_validation_failed',
             manifest_path: manifestPath,
+            ...setupMetadata,
             manifest_validation: manifestValidation
         };
         process.exitCode = 1;
@@ -107,17 +121,22 @@ export async function agentBridgeCommand(subcommand, args = []) {
     await ensureDir(path.dirname(manifestPath));
     await writeJsonAtomic(manifestPath, manifest);
     const entrypoint = await resolveSksEntrypoint();
-    const smokes = await runAgentBridgeContractSmokes(entrypoint, manifest);
+    const [smokes, hostCapabilityInventory] = await Promise.all([
+        runAgentBridgeContractSmokes(entrypoint, manifest),
+        inspectAgentBridgeHostCapabilities(root, undefined, flag(args, '--trusted-project'))
+    ]);
     const result = {
         schema: 'sks.agent-bridge-setup.v1',
         generated_at: nowIso(),
         ok: smokes.status.ok && smokes.naruto_help.ok,
         manifest_path: manifestPath,
         tool_count: manifest.tools.length,
+        ...setupMetadata,
         manifest_validation: manifestValidation,
         registration_snippets: registrationSnippets(),
         non_interactive_smoke: smokes.status,
-        naruto_help_smoke: smokes.naruto_help
+        naruto_help_smoke: smokes.naruto_help,
+        host_capability_inventory: hostCapabilityInventory
     };
     if (!result.ok)
         process.exitCode = 1;
@@ -132,6 +151,7 @@ export async function agentBridgeCommand(subcommand, args = []) {
         console.log(`  ${registrationSnippets().codex_cli}`);
         console.log(`Non-interactive status smoke: ${smokes.status.ok ? 'ok' : 'FAILED'} (${smokes.status.note})`);
         console.log(`Naruto help contract smoke: ${smokes.naruto_help.ok ? 'ok' : 'FAILED'} (${smokes.naruto_help.note})`);
+        console.log(`Host capability inventory: ${hostCapabilityInventory.health_status} (${hostCapabilityInventory.capabilities.filter((entry) => entry.state === 'available').length}/${hostCapabilityInventory.capabilities.length} available)`);
     }
     return result;
 }

package/dist/core/commands/basic-cli.js

@@ -314,23 +314,20 @@ export async function setupCommand(args = []) {
         const { ensureRelatedCliTools } = await import('../../cli/install-helpers.js');
         cliTools = await ensureRelatedCliTools(args);
     });
-    const blockers = [
-        ...(res.codex_config_install?.manual_blockers || []),
-        ...(res.agent_install?.manual_blockers || [])
-    ];
-    const warnings = res.codex_config_install?.warnings || [];
+    const readiness = initProjectInstallReadiness(res);
     const result = {
         schema: 'sks.setup.v1',
-        ok: blockers.length === 0 && res.codex_config_install?.ok !== false && res.agent_install?.ok !== false,
-        status: blockers.length ? 'manual_blocked' : 'completed',
+        ok: readiness.ok,
+        status: readiness.status,
         root,
         install_scope: installScope,
         command_prefix: sksCommandPrefix(installScope, { globalCommand: 'sks' }),
         created: res.created || [],
         local_only: flag(args, '--local-only'),
         cli_tools: cliTools,
-        blockers,
-        warnings
+        skill_install: res.skill_install,
+        blockers: readiness.blockers,
+        warnings: readiness.warnings
     };
     if (!result.ok)
         process.exitCode = 1;
@@ -344,9 +341,9 @@ export async function setupCommand(args = []) {
     console.log(`Zellij: ${cliTools.zellij.ok ? 'ok' : cliTools.zellij.repair.status}${cliTools.zellij.version ? ` ${cliTools.zellij.version}` : ''}`);
     for (const file of result.created)
         console.log(`- ${file}`);
-    for (const warning of warnings)
+    for (const warning of readiness.warnings)
         console.log(`Warning: ${warning}`);
-    for (const blocker of blockers)
+    for (const blocker of readiness.blockers)
         console.error(`Blocker: ${blocker}`);
     return result;
 }
@@ -363,20 +360,73 @@ export async function initCommand(args = []) {
 export async function fixPathCommand(args = []) {
     const root = await projectRoot();
     const installScope = installScopeFromArgs(args);
+    let res = null;
     await withSecretPreservationGuard(root, 'fix-path-command', async () => {
-        await initProject(root, { installScope, localOnly: flag(args, '--local-only'), globalCommand: 'sks', force: true });
+        res = await initProject(root, { installScope, localOnly: flag(args, '--local-only'), globalCommand: 'sks', force: true });
     });
+    const readiness = initProjectInstallReadiness(res);
     const result = {
         schema: 'sks.fix-path.v1',
-        ok: true,
+        ok: readiness.ok,
+        status: readiness.status,
         root,
         install_scope: installScope,
         hook_command_prefix: sksCommandPrefix(installScope, { globalCommand: 'sks' }),
-        hooks: path.join(root, '.codex', 'hooks.json')
+        hooks: path.join(root, '.codex', 'hooks.json'),
+        skill_install: res?.skill_install,
+        blockers: readiness.blockers,
+        warnings: readiness.warnings
     };
-    if (flag(args, '--json'))
-        return printJson(result);
-    console.log(`SKS hook path refreshed: ${path.relative(root, result.hooks)}`);
+    if (!result.ok)
+        process.exitCode = 1;
+    if (flag(args, '--json')) {
+        printJson(result);
+        return result;
+    }
+    console.log(`${result.ok ? 'SKS hook path refreshed' : 'SKS hook path refresh blocked'}: ${path.relative(root, result.hooks)}`);
+    for (const warning of readiness.warnings)
+        console.log(`Warning: ${warning}`);
+    for (const blocker of readiness.blockers)
+        console.error(`Blocker: ${blocker}`);
+    return result;
+}
+function initProjectInstallReadiness(res) {
+    const manualBlockers = [
+        ...(res?.codex_config_install?.manual_blockers || []),
+        ...(res?.agent_install?.manual_blockers || [])
+    ].map(String);
+    const skillWarnings = Array.isArray(res?.skill_install?.warnings)
+        ? res.skill_install.warnings.map(String)
+        : [];
+    const skillBlockers = res?.skill_install?.ok === false
+        ? ['authoritative_sks_skill_install_failed', ...skillWarnings.map((warning) => `skill_install:${warning}`)]
+        : [];
+    const installBlockers = [
+        ...(res?.codex_config_install?.ok === false && !res?.codex_config_install?.manual_blockers?.length
+            ? ['codex_config_install_failed']
+            : []),
+        ...(res?.agent_install?.ok === false && !res?.agent_install?.manual_blockers?.length
+            ? ['official_subagent_agent_install_failed']
+            : [])
+    ];
+    const blockers = [...new Set([...manualBlockers, ...skillBlockers, ...installBlockers])];
+    const warnings = [...new Set([
+            ...(res?.codex_config_install?.warnings || []).map(String),
+            ...(res?.agent_install?.warnings || []).map(String),
+            ...skillWarnings
+        ])];
+    const ok = blockers.length === 0
+        && res?.skill_install?.ok !== false
+        && res?.codex_config_install?.ok !== false
+        && res?.agent_install?.ok !== false;
+    const status = manualBlockers.length
+        ? 'manual_blocked'
+        : skillBlockers.length
+            ? 'skill_blocked'
+            : installBlockers.length
+                ? 'install_blocked'
+                : 'completed';
+    return { ok, status, blockers, warnings };
 }
 export async function depsCommand(sub = 'check', args = []) {
     const action = sub || 'check';
@@ -460,15 +510,6 @@ export async function selftestCommand(args = []) {
         await rmrf(tmp);
     }
 }
-/**
- * `sks selftest --real`: actually spawns every feature fixture whose kind is
- * 'execute' or 'execute_and_validate_artifacts', derives real pass/fail status
- * from the process exit code (and, for execute_and_validate_artifacts, from
- * whether the declared expected_artifacts actually exist and match their
- * declared schema), and writes a JSON report that explicitly lists fixtures
- * skipped because they are mock/wiring_only kind rather than silently omitting
- * them. This is additive: plain `sks selftest --mock` behavior is unchanged.
- */
 export async function selftestRealCommand(args = []) {
     process.env.CI = 'true';
     const root = await projectRoot();

package/dist/core/commands/bench-command.js

@@ -1,3 +1,4 @@
+import { fileURLToPath } from 'node:url';
 import { TRUST_VALIDATE_BENCH_COMMAND, benchRoot, runCoreBench, runLeanPolicyBench } from '../bench.js';
 import { runProcess } from '../fsx.js';
 import { flag, readFlagValue } from './command-utils.js';
@@ -47,7 +48,7 @@ async function commandBench(schema, commandArgs, args = []) {
     }
     const root = await benchRoot();
     const start = Date.now();
-    const result = await runProcess(process.execPath, [new URL('../../bin/sks.js', import.meta.url).pathname, ...commandArgs], {
+    const result = await runProcess(process.execPath, [benchCliEntrypoint(), ...commandArgs], {
         cwd: root,
         timeoutMs: 120_000,
         maxOutputBytes: 512 * 1024,
@@ -61,3 +62,6 @@ async function commandBench(schema, commandArgs, args = []) {
         process.exitCode = 1;
     return report;
 }
+export function benchCliEntrypoint(moduleUrl = import.meta.url) {
+    return fileURLToPath(new URL('../../bin/sks.js', moduleUrl));
+}

package/dist/core/commands/command-utils.js

@@ -1,11 +1,6 @@
 import { findLatestMission, listSessionStates } from '../mission.js';
 import { DOLLAR_SKILL_NAMES, RECOMMENDED_SKILLS } from '../routes.js';
 export const flag = (args = [], name) => args.includes(name);
-// Blindly dropping every "--"-prefixed argv token (the previous behavior of
-// promptOf/positionalArgs) silently deletes any part of an unquoted work-order
-// prompt that happens to contain a flag-lookalike phrase (e.g. "--files 로
-// 확인해라"). Only strip tokens that are actually recognized boolean/global
-// flags; anything else stays in the reconstructed prompt.
 const KNOWN_BOOLEAN_FLAGS = new Set([
     '--json', '--mock', '--execute', '--auto', '--visual', '--research', '--db',
     '--legacy-goal-runtime', '--help', '-h'

package/dist/core/commands/image-ux-review-command.js

@@ -136,10 +136,6 @@ async function runImageUxReview(root, command, args = []) {
         await attachGeneratedReviewImage(root, dir, contract, generatedImage, { realGenerated: !flag(args, '--mock'), mock: flag(args, '--mock') });
     if (!generatedImage && shouldGenerateCallouts) {
         const outputDir = path.join(dir, 'generated-callouts');
-        // Auto-discover the Codex App GUI $imagegen output from ~/.codex/generated_images.
-        // --strict-generated-since limits discovery to images created at/after this run
-        // started (use when an old GUI image could be mistaken for this run's output);
-        // otherwise a max-age window guards against stale reuse.
         const missionStartMs = Date.parse(mission.created_at || '') || undefined;
         const maxAgeOverride = readOption(args, '--generated-image-max-age-min', null);
         const result = await generateGptImage2CalloutReview({
@@ -200,11 +196,6 @@ async function runImageUxReview(root, command, args = []) {
     console.log(`Image UX review: ${result.ok ? 'ok' : 'blocked'} ${id}`);
     return result;
 }
-/**
- * Read-only source validation shared with the active-route dispatcher. A
- * blocked result is terminal and guarantees that the run cannot create a
- * mission or write route evidence.
- */
 export async function imageUxReviewSourcePreflight(args = []) {
     const fromChromeExtension = flag(args, '--from-chrome-extension') || Boolean(readOption(args, '--from-chrome-extension', null));
     const fromComputerUse = flag(args, '--from-computer-use') || Boolean(readOption(args, '--from-computer-use', null));

package/dist/core/commands/mad-sks-command.js

@@ -45,10 +45,6 @@ const UNSUPPORTED_MAD_ARGUMENT_NAMES = new Set([
 ]);
 export async function madHighCommand(args = [], deps = {}) {
     const rawArgsForHelp = (args || []).map((arg) => String(arg));
-    // 20차 P2-2: --help previously fell through to the full MAD launch flow
-    // below (dependency checks, update prompts) with the flag simply ignored
-    // — `sks mad-sks --help` took ~22s instead of printing usage. Must exit
-    // before any of that work starts.
     if (rawArgsForHelp.includes('--help') || rawArgsForHelp.includes('-h')) {
         const usage = [
             'Usage: sks mad-sks [subcommand] [flags]',
@@ -217,11 +213,6 @@ export async function madHighCommand(args = [], deps = {}) {
     const uiSnapshotId = Date.now().toString(36);
     const strictUiSnapshot = process.env.SKS_MAD_STRICT_UI_SNAPSHOT === '1';
     const beforeUi = strictUiSnapshot ? await writeCodexAppUiSnapshot(launchRoot, `mad-before-${uiSnapshotId}`).catch(() => null) : null;
-    // launchFast skips the redundant live-`codex exec` config probe (up to ~20s, run
-    // up to 3x via repair re-inspections): the real codex profile is exercised moments
-    // later when the Zellij session opens. All filesystem/permission/EPERM/symlink/ACL
-    // readability + repair checks still run. SKS_LAUNCH_FULL_CODEX_PROBE=1 restores the
-    // old behavior.
     const allowMadRepair = rawArgs.includes('--repair-config') || rawArgs.includes('--fix') || rawArgs.includes('--yes-repair');
     const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args: rawArgs });
     const launchPreflightOpts = {
@@ -237,12 +228,6 @@ export async function madHighCommand(args = [], deps = {}) {
             : {})
     };
     let launchPreflight = await runCodexLaunchPreflight(launchRoot, launchPreflightOpts);
-    // Fresh-project bootstrap: when the ONLY blocker is that the managed Codex config does
-    // not exist yet (`.codex/config.toml` absent), regenerate it — exactly what the blocker
-    // action tells the user to run via `sks doctor --fix` — and re-run the preflight once,
-    // instead of blocking the launch on a trivially-fixable missing config. An EXISTING but
-    // unreadable/broken config is NOT auto-fixed here: it still blocks and routes the user
-    // to `sks doctor --fix`, so genuine permission/EPERM/parse problems are never masked.
     if (!launchPreflight.ok && !fs.existsSync(path.join(launchRoot, '.codex', 'config.toml'))) {
         try {
             await initProject(launchRoot, { installScope: rawArgs.includes('--local-only') ? 'project' : 'global', localOnly: rawArgs.includes('--local-only'), globalCommand: 'sks' });
@@ -334,9 +319,6 @@ export async function madHighCommand(args = [], deps = {}) {
                 explicitWorkspace
             })
             : codexLbImmediateLaunchOpts(cleanArgs, launchLb, { codexArgs: launchProfile.launch_args, conciseBlockers: true, madSksEnv, launchEnv: madSksEnv, recoveryAllowUnverified: allowUnverifiedToolOutputRecovery });
-        // Only the auto-derived stable `sks-mad-<cwd>` name accumulates panes across
-        // runs; when the user names a session explicitly (or codex-lb already minted a
-        // fresh unique session) respect it and skip the reset.
         const autoDerivedMadSession = !explicitWorkspace && !launchOpts.session;
         const workspace = explicitWorkspace || launchOpts.session || `sks-mad-${sanitizeZellijSessionName(process.cwd())}`;
         const launch = headlessZellij
@@ -399,9 +381,6 @@ export async function madHighCommand(args = [], deps = {}) {
             }));
             launchLifecycleTasks.push(zellijUpdateNoticePromise);
         }
-        // The launcher only creates a detached background session. In an interactive
-        // terminal, immediately attach so the session actually opens for the user
-        // instead of leaving them to copy/paste the attach command by hand.
         if (!headlessZellij && shouldAutoAttachZellij(args)) {
             console.log(`Opening Zellij session: ${launch.session_name} (detach with Ctrl+q, re-attach later with: ${launch.attach_command_with_env})`);
             const attached = attachZellijSessionInteractive(launch.session_name, { cwd: process.cwd(), configPath: launch.clipboard_config_path });
@@ -528,12 +507,6 @@ function buildGlmMadLaunchOpts(cleanArgs = [], opts = {}) {
 function missionDirLike(root, missionId) {
     return path.join(root, '.sneakoscope', 'missions', missionId);
 }
-// Decide whether to take over the current terminal with a foreground Zellij
-// attach. We only do this for genuinely interactive launches; piped, JSON,
-// non-TTY, or already-inside-Zellij invocations keep the previous behaviour of
-// printing a manual "Attach with:" hint. Use --no-attach (or
-// SKS_NO_ZELLIJ_ATTACH=1) to force the background-only behaviour, and --attach
-// to force attaching even without a detected TTY.
 function shouldAutoAttachZellij(args) {
     const list = (args || []).map((arg) => String(arg));
     if (list.includes('--no-attach'))
@@ -542,7 +515,6 @@ function shouldAutoAttachZellij(args) {
         return false;
     if (process.env.SKS_NO_ZELLIJ_ATTACH === '1')
         return false;
-    // Nested attach is rejected by Zellij when already inside a session.
     if (process.env.ZELLIJ)
         return false;
     if (list.includes('--attach'))
@@ -599,11 +571,6 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
     const dbWriteAllowed = has('db_write');
     const { id, dir } = await createMission(root, { mode: 'mad-sks', prompt: `${activatedBy} Zellij scoped high-power maintenance session` });
     const protectedCore = resolveProtectedCore({ packageRoot: packageRoot(), targetRoot: cwd });
-    // The interactive launch 'before' snapshot is only persisted (env + policy json)
-    // and is never compared against an 'after' snapshot during the session, so the
-    // strong full-content hash is wasted here. Use the cheap metadata digest (no file
-    // reads) on the launch hot path. run/apply and the release gates still take their
-    // own strong content snapshots where the digest is actually compared.
     const protectedCoreBefore = await snapshotProtectedCore(packageRoot(), 'mad-live-before', { mode: 'metadata' });
     const protectedCorePolicyPath = path.join(dir, 'mad-sks-protected-core-policy.json');
     const protectedCoreBeforePath = path.join(dir, 'mad-sks-live-protected-core-before.json');
@@ -878,11 +845,6 @@ async function madSksSubcommand(subcommand, args = []) {
     const targetRoot = path.resolve(readOption(args, '--target-root', process.cwd()));
     const userIntent = readOption(args, '--intent', 'MAD-SKS user-authorized maintenance');
     const sqlPlaneSubcommand = subcommand === 'sql' || subcommand === 'apply-migration';
-    // --allow-db-write scope is implied by choosing the sql/apply-migration
-    // subcommand itself, but --yes (explicit destructive-action confirmation)
-    // must come from the caller's actual args — auto-injecting it here used to
-    // silently satisfy guard-middleware's high_risk_confirmation_required check
-    // for every sql/apply-migration call regardless of user intent (20차 P0-10).
     const flags = parseMadSksFlags([
         '--mad-sks',
         subcommand === 'plan' ? '--plan-only' : '',