sneakoscope 7.6.0 → 8.0.1

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 7.6.0** — its own identity, read from `package.json` and verified by the release gate, not advice about what to install.
+This README documents package **SKS 8.0.1** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. SKS stays version-agnostic: older hosts keep working where capabilities allow, while Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is actually supported — feature availability is decided by capability probes, not by a version number printed in a document. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it. Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph with evidence paths rather than lexical guessing — see [docs/architecture/context-graph.md](docs/architecture/context-graph.md) and [docs/architecture/search-engine-target.md](docs/architecture/search-engine-target.md). See [CHANGELOG.md](CHANGELOG.md).
 
@@ -63,17 +63,11 @@ The SKS menu bar shows the installed Codex CLI version and latest known version.
 
 **Manage MCP Servers…** opens a native macOS manager for the global `~/.codex/config.toml`. It can add remote URL or local stdio servers, enable/disable existing entries, remove entries after confirmation, and refresh the current state. Mutations are lock-protected, backed up, TOML-validated, and written with mode `0600`; configured environment values and command arguments are never rendered in the list. Changes apply to new Codex sessions. The same plumbing is available through the canonical `sks mcp config list|get|add|edit|duplicate|enable|disable|remove|test|login|logout|backups|restore` surface for diagnostics and automation.
 
-### Telegram remote coding on this Mac
+### Remote coding: Orca (external option)
 
-Open **SKS Center → Remote & Telegram**, create a bot with BotFather, send `/start` to that bot from the Telegram account you want to pair, then choose **Connect This Project…** and paste the token. SKS verifies the bot, stores the token only in macOS Keychain, pairs only that private chat/user, and registers one dedicated session bound to the current project. Choose **Start Hub**, then send ordinary text to the bot. On the first real message, the Hub creates the Codex thread and starts its first turn in the same App Server connection so the thread is durably resumable; later messages resume that exact thread and return the final response to Telegram.
+SKS no longer provides a first-party Telegram coding bridge. If you want to monitor or steer coding work from another device, consider [Orca](https://github.com/stablyai/orca), an external MIT-licensed project that can launch Codex in a worktree. Orca is not bundled with SKS, supported by SKS, or required to use SKS; SKS adds no Orca dependency or configuration.
 
-Telegram runtime configuration is v2-only. A legacy v1 file cannot start the Hub; Center shows a one-time reconnect prompt, and explicit reconnect/setup atomically writes the verified bot/private-pair identity, token fingerprint, and generation contract as `sks.telegram-config.v2`.
-
-After connection, Center exposes the registered-session selector, the real user/Codex conversation from that Telegram-bound App Server thread, and a live public activity feed for turn, tool, command, file, search, and subagent lifecycle events. **Older**, **Newer**, and **Latest** page the complete stored turn history through opaque App Server cursors. On Latest, Center checks only the bounded local journal every 2.5 seconds and reloads the heavier App Server conversation when a completed-turn revision changes or the user refreshes/navigates; an older page never jumps away while you read it. The feed intentionally excludes reasoning text, raw tool output, arguments/results, credentials, and paths outside the project, and each page/activity view keeps explicit byte and item bounds. Center also shows the ordinary-text workflow and every supported Telegram command.
-
-The Hub runs as a user LaunchAgent and uses `caffeinate -i` while the logged-in Mac is available. The Mac still needs to remain powered on, logged in, awake, and network-connected; closing the lid or logging out can stop access. Telegram input has no arbitrary shell path, runs with approvals disabled and network access disabled inside the Codex workspace sandbox, and cannot target an unpaired chat or another project.
-
-SKS Center is the menu bar companion: install it with `sks menubar install`, then click the SKS icon in the macOS menu bar and choose **Open SKS Control Center…**. Every GUI step above has a CLI equivalent (`sks telegram setup --bot-token-stdin`, `sks telegram hub start`, `sks telegram status`). The hub uses long polling, so a bot with an existing webhook must have that webhook removed before the hub can start; SKS fails closed with `telegram_webhook_conflict` and never clears it automatically. See **[docs/telegram-and-center.md](docs/telegram-and-center.md)** for the complete BotFather setup, optional command menu and privacy-mode guidance, secure token rotation, verification, and troubleshooting.
+Orca's mobile companion and Remote Orca Servers are beta. Their desktop/server runtime remains the source of truth and must keep running; remote access may require a private LAN or Tailscale path. See [the Orca migration and remote-coding guide](docs/orca-remote-coding.md) for scope, setup links, and former Telegram-user migration notes.
 
 ## The Front Door
 

package/config/perf-budgets.v1.json

@@ -18,7 +18,6 @@
     { "id": "control_center_open", "budget_p95_ms": 400, "measured_runs": 5 },
     { "id": "mcp_static_list", "budget_p95_ms": 250, "measured_runs": 9 },
     { "id": "update_cache_read", "budget_p95_ms": 50, "measured_runs": 15 },
-    { "id": "telegram_callback_ack", "budget_p95_ms": 1000, "measured_runs": 7 },
     { "id": "ssh_worker_hello", "budget_p95_ms": 3000, "measured_runs": 5 }
   ]
 }

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "7.6.0"
+version = "8.0.1"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "7.6.0"
+version = "8.0.1"
 edition = "2021"
 
 [dependencies]

package/dist/cli/command-manifest-lite.js

@@ -37,7 +37,6 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'codex-lb', summary: 'Inspect codex-lb status and circuit health', maturity: 'beta', skipMigrationGate: true },
     { name: 'menubar', summary: 'Inspect/install/restart/uninstall SKS menu bar', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'remote', summary: 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', maturity: 'beta' },
-    { name: 'telegram', summary: 'Pair and run the private local Codex Telegram Hub', maturity: 'beta' },
     { name: 'hooks', summary: 'Explain and inspect Codex hooks', maturity: 'beta', skipMigrationGate: true },
     { name: 'zellij-lane', summary: 'Render a Zellij lane frame for SKS sessions', maturity: 'beta' },
     { name: 'zellij-slot-pane', summary: 'Render a compact Zellij worker slot pane', maturity: 'beta' },
@@ -73,7 +72,7 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'versioning', summary: 'Manage release version metadata', maturity: 'stable' },
     { name: 'reasoning', summary: 'Show reasoning route', maturity: 'labs' },
     { name: 'aliases', summary: 'Show command aliases', maturity: 'stable' },
-    { name: 'align', summary: 'Prepare or inspect the $sks-align GPT-5.6 / openai/skills modernization mission', maturity: 'beta', mutatesRouteState: true },
+    { name: 'align', summary: 'Prepare or inspect the evidence-gated $sks-align GPT-5.6 / Plugins modernization mission', maturity: 'beta', mutatesRouteState: true },
     { name: 'selftest', summary: 'Run local mock selftest', maturity: 'stable' },
     { name: 'goal', summary: 'Print stateless Codex native Goal controls', maturity: 'beta' },
     { name: 'seo-geo-optimizer', summary: 'Run unified SEO/GEO optimizer audit/plan/apply/verify plus research/strategy (--include-marketing) on the search-visibility kernel', maturity: 'beta' },
@@ -107,7 +106,6 @@ const SAFE_COMMAND_CONTRACT_LITE = {
     latency: 'normal',
     supportsJson: false,
     remoteAllowed: false,
-    telegramAllowed: false,
     inputProfile: 'none',
     requiredCapabilities: []
 };
@@ -122,8 +120,7 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
     'dollar-commands': { risk: 'R2', latency: 'normal' },
     eval: { latency: 'long' },
     gates: {
-        risk: 'R1', latency: 'long', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'gates', requiredCapabilities: ['project.git', 'proof.gates']
+        risk: 'R1', latency: 'long', supportsJson: true, remoteAllowed: true, inputProfile: 'gates', requiredCapabilities: ['project.git', 'proof.gates']
     },
     harness: { latency: 'long' },
     'image-ux-review': { latency: 'long' },
@@ -131,8 +128,7 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
     'mad-sks': { risk: 'R3', latency: 'long' },
     mcp: { risk: 'R2', latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     naruto: {
-        risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false,
-        inputProfile: 'naruto'
+        risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'naruto'
     },
     paths: {
         supportsJson: true, remoteAllowed: true, inputProfile: 'paths',
@@ -146,13 +142,12 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
     postinstall: { latency: 'long' },
     ppt: { latency: 'long' },
     proof: {
-        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'proof', requiredCapabilities: ['proof.read']
+        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'proof', requiredCapabilities: ['proof.read']
     },
     'qa-loop': { latency: 'long' },
     recallpulse: { latency: 'long' },
     release: { risk: 'R1', latency: 'long' },
-    remote: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false, inputProfile: 'json-only' },
+    remote: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     research: { latency: 'long' },
     review: { risk: 'R1' },
     run: { latency: 'long' },
@@ -162,18 +157,16 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
         requiredCapabilities: ['project.fs.read']
     },
     status: {
-        supportsJson: true, remoteAllowed: true, telegramAllowed: true, inputProfile: 'json-only',
+        supportsJson: true, remoteAllowed: true, inputProfile: 'json-only',
         requiredCapabilities: ['proof.read']
     },
     'stop-gate': {
-        supportsJson: true, remoteAllowed: true, telegramAllowed: true, inputProfile: 'stop-gate',
+        supportsJson: true, remoteAllowed: true, inputProfile: 'stop-gate',
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
-    telegram: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false, inputProfile: 'json-only' },
     trust: {
-        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'trust', requiredCapabilities: ['proof.trust']
+        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },
     uninstall: { risk: 'R3', latency: 'long' },
     update: { latency: 'long' },

package/dist/cli/command-registry.js

@@ -4,7 +4,6 @@ const SAFE_COMMAND_CONTRACT = {
     latency: 'normal',
     supportsJson: false,
     remoteAllowed: false,
-    telegramAllowed: false,
     inputProfile: 'none',
     requiredCapabilities: []
 };
@@ -134,7 +133,6 @@ function applyCommandManifestContract(commands) {
             latency: manifest.latency,
             supportsJson: manifest.supportsJson,
             remoteAllowed: manifest.remoteAllowed,
-            telegramAllowed: manifest.telegramAllowed,
             inputProfile: manifest.inputProfile,
             requiredCapabilities: [...manifest.requiredCapabilities]
         });
@@ -187,7 +185,6 @@ const COMMAND_DEFINITIONS = {
     'codex-lb': skipMigrationGate(entry('beta', 'Inspect codex-lb status and circuit health', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js'))),
     menubar: activeRouteDiagnostic(entry('beta', 'Inspect/install/restart/uninstall SKS menu bar', 'dist/core/commands/menubar-command.js', subcommand(() => import('../core/commands/menubar-command.js'), 'menubarCommand', 'dist/core/commands/menubar-command.js', 'status'))),
     remote: entry('beta', 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', 'dist/core/commands/remote-command.js', argsCommand(() => import('../core/commands/remote-command.js'), 'remoteCommand', 'dist/core/commands/remote-command.js')),
-    telegram: entry('beta', 'Pair and run the private local Codex Telegram Hub', 'dist/core/commands/telegram-command.js', argsCommand(() => import('../core/commands/telegram-command.js'), 'telegramCommand', 'dist/core/commands/telegram-command.js')),
     hooks: skipMigrationGate(entry('beta', 'Explain and inspect Codex hooks', 'dist/commands/hooks.js', directCommand(() => import('../commands/hooks.js'), 'dist/commands/hooks.js'))),
     'zellij-lane': entry('beta', 'Render a Zellij lane frame for SKS sessions', 'dist/commands/zellij-lane.js', directCommand(() => import('../commands/zellij-lane.js'), 'dist/commands/zellij-lane.js')),
     'zellij-slot-pane': entry('beta', 'Render a compact Zellij worker slot pane', 'dist/commands/zellij-slot-pane.js', directCommand(() => import('../commands/zellij-slot-pane.js'), 'dist/commands/zellij-slot-pane.js')),
@@ -223,7 +220,7 @@ const COMMAND_DEFINITIONS = {
     versioning: entry('stable', 'Manage release version metadata', 'dist/commands/versioning.js', directCommand(() => import('../commands/versioning.js'), 'dist/commands/versioning.js')),
     reasoning: entry('labs', 'Show reasoning route', 'dist/core/commands/basic-cli.js', basicArgs('reasoningCommand')),
     aliases: entry('stable', 'Show command aliases', 'dist/core/commands/basic-cli.js', basicNoArgs('aliasesCommand')),
-    align: routeStateMutator(entry('beta', 'Prepare or inspect the $sks-align GPT-5.6 / openai/skills modernization mission', 'dist/core/commands/align-command.js', subcommand(() => import('../core/commands/align-command.js'), 'alignCommand', 'dist/core/commands/align-command.js', 'prepare')), ['align-gate.json']),
+    align: routeStateMutator(entry('beta', 'Prepare or inspect the evidence-gated $sks-align GPT-5.6 / Plugins modernization mission', 'dist/core/commands/align-command.js', subcommand(() => import('../core/commands/align-command.js'), 'alignCommand', 'dist/core/commands/align-command.js', 'prepare')), ['align-gate.json']),
     selftest: entry('stable', 'Run local mock selftest', 'dist/core/commands/basic-cli.js', basicArgs('selftestCommand')),
     goal: entry('beta', 'Print stateless Codex native Goal controls', 'dist/core/commands/goal-command.js', subcommand(() => import('../core/commands/goal-command.js'), 'goalCommand', 'dist/core/commands/goal-command.js')),
     'seo-geo-optimizer': entry('beta', 'Run unified SEO/GEO optimizer audit/plan/apply/verify plus research/strategy (--include-marketing) on the search-visibility kernel', 'dist/core/commands/seo-command.js', argsCommand(() => import('../core/commands/seo-command.js'), 'seoGeoOptimizerCommand', 'dist/core/commands/seo-command.js')),
@@ -266,8 +263,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     dfix: { latency: 'long' },
     eval: { latency: 'long' },
     gates: {
-        risk: 'R1', latency: 'long', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'gates', requiredCapabilities: ['project.git', 'proof.gates']
+        risk: 'R1', latency: 'long', supportsJson: true, remoteAllowed: true, inputProfile: 'gates', requiredCapabilities: ['project.git', 'proof.gates']
     },
     harness: { latency: 'long' },
     'image-ux-review': { latency: 'long' },
@@ -275,8 +271,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     'mad-sks': { risk: 'R3', latency: 'long' },
     mcp: { risk: 'R2', latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     naruto: {
-        risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false,
-        inputProfile: 'naruto'
+        risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'naruto'
     },
     paths: {
         supportsJson: true, remoteAllowed: true, inputProfile: 'paths',
@@ -290,13 +285,12 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     postinstall: { latency: 'long' },
     ppt: { latency: 'long' },
     proof: {
-        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'proof', requiredCapabilities: ['proof.read']
+        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'proof', requiredCapabilities: ['proof.read']
     },
     'qa-loop': { latency: 'long' },
     recallpulse: { latency: 'long' },
     release: { risk: 'R1', latency: 'long' },
-    remote: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false, inputProfile: 'json-only' },
+    remote: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     research: { latency: 'long' },
     review: { risk: 'R1' },
     run: { latency: 'long' },
@@ -305,18 +299,16 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
         requiredCapabilities: ['project.fs.read']
     },
     status: {
-        supportsJson: true, remoteAllowed: true, telegramAllowed: true, inputProfile: 'json-only',
+        supportsJson: true, remoteAllowed: true, inputProfile: 'json-only',
         requiredCapabilities: ['proof.read']
     },
     'stop-gate': {
-        supportsJson: true, remoteAllowed: true, telegramAllowed: true, inputProfile: 'stop-gate',
+        supportsJson: true, remoteAllowed: true, inputProfile: 'stop-gate',
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
-    telegram: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false, inputProfile: 'json-only' },
     trust: {
-        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'trust', requiredCapabilities: ['proof.trust']
+        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },
     uninstall: { risk: 'R3', latency: 'long' },
     update: { latency: 'long' },

package/dist/cli/router.js

@@ -212,9 +212,6 @@ export function safeReadOnlySubcommand(command, args) {
     if (command === 'remote' && ['machines', 'machine'].includes(sub) && ['list', 'validate'].includes(nested)) {
         return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
     }
-    if (command === 'telegram' && (sub === 'center-snapshot' || sub === 'center-live' || sub === 'validate-config' || (sub === 'hub' && nested === 'status'))) {
-        return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
-    }
     if (!['status', 'show', 'list', 'observe', 'watch', 'doctor', 'help'].includes(sub))
         return false;
     return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));

package/dist/commands/codex-lb.js

@@ -777,11 +777,16 @@ async function readDeepEvidenceOptions(args = []) {
             : []
     };
 }
-function controllerOptions(args = []) {
+export function controllerOptions(args = []) {
     const rawGatewayAuth = flag(args, '--compat-bearer')
         ? 'authorization-bearer-compat'
-        : normalizeGatewayAuthChoice(readOption(args, '--gateway-auth', readOption(args, '--gateway-auth-transport', 'x-codex-lb-api-key')));
-    const gatewayAuthTransport = parseCodexLbGatewayAuthTransport(rawGatewayAuth);
+        : (() => {
+            const explicit = readOption(args, '--gateway-auth', readOption(args, '--gateway-auth-transport', null));
+            return explicit === null ? null : normalizeGatewayAuthChoice(explicit);
+        })();
+    const gatewayAuthTransport = rawGatewayAuth === null
+        ? null
+        : parseCodexLbGatewayAuthTransport(rawGatewayAuth);
     const home = readOption(args, '--home', null);
     const configPath = readOption(args, '--config', readOption(args, '--config-path', null));
     const authPath = readOption(args, '--auth', readOption(args, '--auth-path', null));
@@ -799,7 +804,7 @@ function controllerOptions(args = []) {
     const capabilityTimeoutText = readOption(args, '--capability-timeout-ms', null);
     const capabilityTimeoutMs = capabilityTimeoutText === null ? null : Number(capabilityTimeoutText);
     return {
-        gatewayAuthTransport,
+        ...(gatewayAuthTransport ? { gatewayAuthTransport } : {}),
         restartApp: flag(args, '--restart-app') || flag(args, '--restart'),
         networkProbes: !flag(args, '--no-network'),
         ...(home ? { home: String(home) } : {}),
@@ -816,7 +821,7 @@ function controllerOptions(args = []) {
                 settings: {
                     ...(normalizedListenHost ? { listen_host: normalizedListenHost } : {}),
                     ...(listenPort !== null && Number.isInteger(listenPort) ? { listen_port: listenPort } : {}),
-                    gateway_auth_transport: gatewayAuthTransport
+                    ...(gatewayAuthTransport ? { gateway_auth_transport: gatewayAuthTransport } : {})
                 }
             }
             : {})

package/dist/commands/doctor-profile.js

@@ -35,6 +35,7 @@ export function doctorPhaseIdsForProfile(profile) {
     const required = [
         'codex_startup_repair',
         'startup_config_repair',
+        'codex_config_syntax_repair',
         'context7_repair',
         'context7_mcp_repair',
         'hook_trust_repair',

package/dist/commands/doctor.js

@@ -559,6 +559,20 @@ async function runDoctor(args = [], root, doctorFix) {
         : null;
     const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, preRepairCodexDoctor);
     codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, preRepairCodexDoctor);
+    const codexConfigSyntaxRepair = doctorPhaseIds.includes('codex_config_syntax_repair')
+        ? await (await import('../core/doctor/codex-config-syntax-repair.js')).runCodexConfigSyntaxRepair({ root, fix: doctorFix }).catch((err) => ({
+            schema: 'sks.codex-config-syntax-repair.v1',
+            ok: false,
+            generated_at: new Date().toISOString(),
+            fix: doctorFix,
+            configs: [],
+            actions: [],
+            manual_actions: [],
+            blockers: [err?.message || String(err)],
+            warnings: [],
+            report_path: `${root}/.sneakoscope/reports/codex-config-syntax-repair.json`
+        }))
+        : null;
     const codex = codexBin
         ? { bin: codexBin, version: 'fixture-or-explicit', available: true }
         : await getCodexInfo().catch(() => ({ bin: null, version: null, available: false }));
@@ -858,6 +872,17 @@ async function runDoctor(args = [], root, doctorFix) {
                         rollback_evidence: startupConfigRepair?.backup_path || 'startup_config_repair_idempotent_report'
                     })
                 },
+                {
+                    id: 'codex_config_syntax_repair',
+                    run: async () => ({
+                        id: 'codex_config_syntax_repair',
+                        ok: codexConfigSyntaxRepair?.ok !== false,
+                        repaired: doctorFix && (codexConfigSyntaxRepair?.configs || []).some((entry) => entry.changed),
+                        blockers: codexConfigSyntaxRepair?.blockers || [],
+                        warnings: codexConfigSyntaxRepair?.warnings || [],
+                        rollback_evidence: codexConfigSyntaxRepair?.report_path || 'codex_config_syntax_repair_report'
+                    })
+                },
                 {
                     id: 'context7_repair',
                     run: async () => ({
@@ -1232,6 +1257,7 @@ async function runDoctor(args = [], root, doctorFix) {
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
         startup_config_repair: startupConfigRepair,
+        codex_config_syntax_repair: codexConfigSyntaxRepair,
         context7_mcp_repair: context7McpRepair,
         supabase_mcp_repair: supabaseMcpRepair,
         doctor_fix_transaction: doctorFixTransaction,
@@ -1254,6 +1280,7 @@ async function runDoctor(args = [], root, doctorFix) {
             ...(configRepair?.operator_actions || []),
             ...(zellijRepair && !zellijRepair.ok && zellijRepair.command ? [`Run: ${zellijRepair.command}`] : []),
             ...(codexStartupRepair.manual_actions || []),
+            ...(codexConfigSyntaxRepair?.manual_actions || []),
             ...(pluginPolicy?.doctor_warnings || [])
         ]
     });
@@ -1310,6 +1337,7 @@ async function runDoctor(args = [], root, doctorFix) {
         && (!sksUpdate || sksUpdate.ok !== false)
         && commandAliasCleanup.ok !== false
         && codexStartupRepair.ok !== false
+        && codexConfigSyntaxRepair?.ok !== false
         && agentRoleConfigRepair.ok !== false
         && openRouterProviderRepair.ok !== false
         && (officialSubagentConfig.blockers || []).length === 0
@@ -1345,6 +1373,7 @@ async function runDoctor(args = [], root, doctorFix) {
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
         startup_config_repair: startupConfigRepair,
+        codex_config_syntax_repair: codexConfigSyntaxRepair,
         context7_mcp_repair: context7McpRepair,
         supabase_mcp_repair: supabaseMcpRepair,
         doctor_fix_transaction: doctorFixTransaction,
@@ -1443,6 +1472,16 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  manual: ${action}`);
     for (const warning of codexStartupRepair.warnings || [])
         console.log(`  warning: ${warning}`);
+    if (codexConfigSyntaxRepair) {
+        console.log('Codex config syntax:');
+        console.log(`  repair: ${codexConfigSyntaxRepair.ok ? 'ok' : 'blocked'}`);
+        for (const action of codexConfigSyntaxRepair.actions || [])
+            console.log(`  - ${action}`);
+        for (const action of codexConfigSyntaxRepair.manual_actions || [])
+            console.log(`  manual: ${action}`);
+        for (const warning of codexConfigSyntaxRepair.warnings || [])
+            console.log(`  warning: ${warning}`);
+    }
     console.log(`  codex doctor:    ${formatCodexDoctorConsoleStatus(authoritativeCodexDoctor)}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);