sneakoscope 8.0.0 → 8.0.2

package/dist/commands/doctor.js

@@ -12,6 +12,7 @@ import { codexLbStatus } from '../cli/install-helpers.js';
 import { codexLbToolOutputRecoveryOverrideAcknowledged } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
 import { normalizeInstallScope } from '../core/init.js';
 import { inspectCodexConfigReadability } from '../core/codex/codex-config-readability.js';
+import { inspectOAuthCallbackPortConflict, oauthCallbackDoctorGuidance } from '../core/codex/oauth-callback-port-diagnostic.js';
 import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
 import { inventoryCodexPermissionProfiles } from '../core/codex/codex-permission-profiles.js';
 import { appendMigrationEvents, hashConfigText } from '../core/migration/migration-transaction-journal.js';
@@ -24,6 +25,7 @@ import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-
 import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 import { reconcileDoctorSkills } from '../core/doctor/doctor-skill-reconcile.js';
+import { buildSksMenuBarDoctorPostcheck } from '../core/doctor/sks-menubar-doctor.js';
 import { isUpdateMigrationReceiptCurrent, projectUpdateMigrationReceiptPath, writeProjectUpdateMigrationReceipt } from '../core/update/update-migration-state.js';
 import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
 import { sweepSksTempDirs } from '../core/retention.js';
@@ -32,6 +34,25 @@ import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-relea
 import { formatHarnessConflictReport, scanHarnessConflicts } from '../core/harness-conflicts.js';
 import { doctorArgWarnings, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs } from './doctor-profile.js';
 export { doctorArgWarnings, doctorMenuBarInstallPolicy, doctorProfileFromArgs } from './doctor-profile.js';
+export function deferCommandAliasCleanupToMigrationReceipt(result) {
+    const observedBlockers = Array.isArray(result?.blockers)
+        ? result.blockers.map(String).filter(Boolean)
+        : [];
+    return {
+        ...result,
+        ok: true,
+        status: 'deferred_to_project_migration_receipt',
+        fix: false,
+        repair_owner: 'project_migration_receipt',
+        pre_migration_blockers: observedBlockers,
+        actions: [],
+        blockers: [],
+        warnings: [
+            ...(Array.isArray(result?.warnings) ? result.warnings.map(String).filter(Boolean) : []),
+            ...(observedBlockers.length ? [`pre_migration_public_surface_findings_deferred:${observedBlockers.length}`] : [])
+        ]
+    };
+}
 export async function run(_command, args = [], deps = {}) {
     const root = await projectRoot();
     if (flag(args, '--search')) {
@@ -268,7 +289,7 @@ async function runDoctorJsonFastPath(args = [], root) {
         requireActualCodex: false,
         codexBin: codexBin || undefined
     };
-    const [codex, rust, codexConfig, sneakoscopeExists] = await Promise.all([
+    const [codex, rust, codexConfig, sneakoscopeExists, oauthCallbackPortDiagnostic] = await Promise.all([
         codexBin
             ? Promise.resolve({ bin: codexBin, version: 'fixture-or-explicit', available: true })
             : getCodexInfo().catch(() => ({ bin: null, version: null, available: false })),
@@ -279,8 +300,10 @@ async function runDoctorJsonFastPath(args = [], root) {
             operator_actions: [],
             blockers: [err?.message || String(err)]
         })),
-        exists(`${root}/.sneakoscope`)
+        exists(`${root}/.sneakoscope`),
+        inspectOAuthCallbackPortConflict()
     ]);
+    const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
     const ready = {
         schema: 'sks.doctor-readiness-matrix.v2',
         generated_at: nowIso(),
@@ -322,8 +345,11 @@ async function runDoctorJsonFastPath(args = [], root) {
         fast_path: true,
         no_fix_write_policy: reportFile ? 'report_file_only' : 'no_writes_performed',
         arg_warnings: doctorArgWarnings(args),
+        warnings: [...oauthCallbackPortDiagnostic.warnings],
+        operator_actions: oauthCallbackOperatorActions,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
+        oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic,
         codex_config: codexConfig,
         rust,
         codex_app: { ok: false, skipped: true, warnings: ['codex_app_optional_diagnostic_skipped'] },
@@ -428,6 +454,8 @@ async function runDoctorJsonFastPath(args = [], root) {
 }
 async function runDoctor(args = [], root, doctorFix) {
     const startedAtMs = Date.now();
+    const oauthCallbackPortDiagnostic = await inspectOAuthCallbackPortConflict();
+    const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
     const sksTempSweep = doctorFix ? await sweepSksTempDirs(root, { maxAgeHours: 24 }).catch((err) => ({
         ok: false,
         error: err?.message || String(err),
@@ -445,6 +473,8 @@ async function runDoctor(args = [], root, doctorFix) {
     const shouldEvaluateCodexAppUiRepair = doctorFix || deepDiagnostics || flag(args, '--repair-codex-app-ui');
     const shouldRunZellijRepair = deepDiagnostics || flag(args, '--repair-zellij') || flag(args, '--install-homebrew') || process.env.SKS_REQUIRE_ZELLIJ === '1';
     const nativeCapabilityDiagnosticsRequested = deepDiagnostics || flag(args, '--repair-native-capabilities');
+    const requireLegacyGlobalHookCleanup = doctorFix && doctorProfile === 'migration';
+    const migrationReceiptOwnsReconcile = doctorFix && doctorProfile === 'migration';
     const doctorPhaseIds = doctorPhaseIdsForProfile(doctorProfile);
     const { runDoctorCommandAliasCleanup } = await import('../core/doctor/command-alias-cleanup.js');
     const { runDoctorNativeCapabilityRepair } = await import('../core/doctor/doctor-native-capability-repair.js');
@@ -490,16 +520,16 @@ async function runDoctor(args = [], root, doctorFix) {
             openrouter_provider: openRouterProviderRepair
         };
     }
-    const skillsReconcile = await reconcileDoctorSkills(root, doctorFix);
-    const commandAliasCleanup = await runDoctorCommandAliasCleanup({
+    const skillsReconcile = await reconcileDoctorSkills(root, doctorFix && !migrationReceiptOwnsReconcile);
+    const inspectCommandAliasCleanup = (fix) => runDoctorCommandAliasCleanup({
         root,
-        fix: doctorFix
+        fix
     }).catch((err) => ({
         schema: 'sks.command-alias-cleanup.v1',
         ok: false,
         status: 'blocked',
         root,
-        fix: doctorFix,
+        fix,
         report_path: `${root}/.sneakoscope/reports/command-alias-cleanup.json`,
         canonical_command_count: 0,
         current_alias_count: 0,
@@ -507,12 +537,17 @@ async function runDoctor(args = [], root, doctorFix) {
         actions: [],
         blockers: [err?.message || String(err)]
     }));
+    let commandAliasCleanup = await inspectCommandAliasCleanup(doctorFix && !migrationReceiptOwnsReconcile);
+    const commandAliasCleanupBeforeReceipt = migrationReceiptOwnsReconcile
+        ? deferCommandAliasCleanupToMigrationReceipt(commandAliasCleanup)
+        : commandAliasCleanup;
     const doctorNativeCapabilityRepair = await runDoctorNativeCapabilityRepair({
         root,
         fix: nativeCapabilityDiagnosticsRequested && doctorFix,
         yes: flag(args, '--yes') || flag(args, '-y'),
         flags: args.map((arg) => String(arg)),
-        skipNativeCapabilities: !nativeCapabilityDiagnosticsRequested
+        skipNativeCapabilities: !nativeCapabilityDiagnosticsRequested,
+        requireLegacyGlobalHookCleanup
     }).catch((err) => ({
         schema: 'sks.doctor-native-capability-repair.v1',
         ok: false,
@@ -522,11 +557,19 @@ async function runDoctor(args = [], root, doctorFix) {
         core_skills: null,
         skill_dedupe: null,
         native_capabilities: null,
+        legacy_global_hooks: {
+            ok: false,
+            blockers: [`cleanup_failed_before_report:${err?.message || String(err)}`],
+            warnings: []
+        },
         secret_preservation_guard: '.sneakoscope/reports/secret-preservation-guard.json',
         core_blockers: [err?.message || String(err)],
         route_blockers: {},
         optional_manual_required: [],
         optional_warnings: [],
+        required_blockers: requireLegacyGlobalHookCleanup
+            ? [`legacy_global_hooks:cleanup_failed_before_report:${err?.message || String(err)}`]
+            : [],
         blockers: [err?.message || String(err)]
     }));
     const configProbeOpts = {
@@ -559,6 +602,20 @@ async function runDoctor(args = [], root, doctorFix) {
         : null;
     const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, preRepairCodexDoctor);
     codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, preRepairCodexDoctor);
+    const codexConfigSyntaxRepair = doctorPhaseIds.includes('codex_config_syntax_repair')
+        ? await (await import('../core/doctor/codex-config-syntax-repair.js')).runCodexConfigSyntaxRepair({ root, fix: doctorFix }).catch((err) => ({
+            schema: 'sks.codex-config-syntax-repair.v1',
+            ok: false,
+            generated_at: new Date().toISOString(),
+            fix: doctorFix,
+            configs: [],
+            actions: [],
+            manual_actions: [],
+            blockers: [err?.message || String(err)],
+            warnings: [],
+            report_path: `${root}/.sneakoscope/reports/codex-config-syntax-repair.json`
+        }))
+        : null;
     const codex = codexBin
         ? { bin: codexBin, version: 'fixture-or-explicit', available: true }
         : await getCodexInfo().catch(() => ({ bin: null, version: null, available: false }));
@@ -641,19 +698,7 @@ async function runDoctor(args = [], root, doctorFix) {
         ? await repairCodexAppFastUi(root, {
             apply: false,
             reportPath: `${root}/.sneakoscope/reports/codex-app-fast-ui-repair-plan.json`
-        }).catch((err) => ({
-            schema: 'sks.codex-app-fast-ui-repair.v1',
-            ok: false,
-            apply: false,
-            safe_auto_apply: false,
-            requires_confirmation: true,
-            fast_selector: 'manual_action_required',
-            provider_selector: 'ok',
-            host_owned_config: 'diagnostic_failed',
-            next_action: 'Review Codex App UI config manually.',
-            actions: [],
-            blockers: [err?.message || String(err)]
-        }))
+        }).catch((err) => buildCodexAppUiDiagnosticFailure(false, err))
         : {
             schema: 'sks.codex-app-fast-ui-repair.v1',
             ok: true,
@@ -676,19 +721,7 @@ async function runDoctor(args = [], root, doctorFix) {
             apply: true,
             force: explicitCodexAppUiRepair,
             reportPath: `${root}/.sneakoscope/reports/codex-app-fast-ui-repair.json`
-        }).catch((err) => ({
-            schema: 'sks.codex-app-fast-ui-repair.v1',
-            ok: false,
-            apply: true,
-            safe_auto_apply: false,
-            requires_confirmation: true,
-            fast_selector: 'manual_action_required',
-            provider_selector: 'ok',
-            host_owned_config: 'diagnostic_failed',
-            next_action: 'Review Codex App UI config manually.',
-            actions: [],
-            blockers: [err?.message || String(err)]
-        }))
+        }).catch((err) => buildCodexAppUiDiagnosticFailure(true, err))
         : codexAppUiPlan;
     const menuBarPolicy = doctorMenuBarInstallPolicy(args, doctorFix, process.env);
     const menuBarLaunchRequested = menuBarPolicy.launch;
@@ -810,7 +843,9 @@ async function runDoctor(args = [], root, doctorFix) {
             raw_secret_values_recorded: false
         }))
         : null;
-    const hookTrustRepair = doctorFix && doctorPhaseIds.includes('hook_trust_repair')
+    const hookTrustRepair = doctorFix
+        && !migrationReceiptOwnsReconcile
+        && doctorPhaseIds.includes('hook_trust_repair')
         ? await (await import('../core/codex-hooks/codex-hook-trust-doctor.js')).codexHookTrustDoctor(root, { fix: true, managed: true, actual: true }).catch((err) => ({
             schema: 'sks.codex-hook-trust-doctor.v2',
             ok: false,
@@ -858,6 +893,17 @@ async function runDoctor(args = [], root, doctorFix) {
                         rollback_evidence: startupConfigRepair?.backup_path || 'startup_config_repair_idempotent_report'
                     })
                 },
+                {
+                    id: 'codex_config_syntax_repair',
+                    run: async () => ({
+                        id: 'codex_config_syntax_repair',
+                        ok: codexConfigSyntaxRepair?.ok !== false,
+                        repaired: doctorFix && (codexConfigSyntaxRepair?.configs || []).some((entry) => entry.changed),
+                        blockers: codexConfigSyntaxRepair?.blockers || [],
+                        warnings: codexConfigSyntaxRepair?.warnings || [],
+                        rollback_evidence: codexConfigSyntaxRepair?.report_path || 'codex_config_syntax_repair_report'
+                    })
+                },
                 {
                     id: 'context7_repair',
                     run: async () => ({
@@ -900,10 +946,12 @@ async function runDoctor(args = [], root, doctorFix) {
                     run: async () => ({
                         id: 'hook_trust_repair',
                         ok: hookTrustRepair?.ok !== false,
-                        repaired: doctorFix,
+                        repaired: doctorFix && !migrationReceiptOwnsReconcile,
                         blockers: hookTrustRepair?.blockers || [],
                         warnings: hookTrustRepair?.warnings || [],
-                        rollback_evidence: hookTrustRepair?.fixed?.managed_hook_file || 'codex_hook_trust_repair_idempotent'
+                        rollback_evidence: migrationReceiptOwnsReconcile
+                            ? 'project_migration_receipt_owns_hook_trust_refresh'
+                            : hookTrustRepair?.fixed?.managed_hook_file || 'codex_hook_trust_repair_idempotent'
                     })
                 },
                 {
@@ -927,29 +975,18 @@ async function runDoctor(args = [], root, doctorFix) {
                             blockers: [err?.message || String(err)],
                             warnings: []
                         }));
-                        const blockers = [
-                            ...(status.launchd?.ok === true ? [] : [`launchd_not_running:${status.launchd?.error || status.launchd?.state || 'unknown'}`]),
-                            ...(status.action_target?.ok === true ? [] : [`action_script_smoke_failed:${status.action_target?.smoke_code ?? 'no_code'}`]),
-                            ...(status.ok === true ? [] : (status.blockers || ['menubar_status_not_ok']))
-                        ];
-                        return {
-                            ok: blockers.length === 0,
-                            blockers,
-                            warnings: [
-                                ...(status.warnings || []),
-                                blockers.length === 0 ? 'menubar_postcheck_passed' : 'menubar_postcheck_failed'
-                            ]
-                        };
+                        return buildSksMenuBarDoctorPostcheck(status);
                     }
                 },
                 {
                     id: 'command_alias_cleanup',
                     run: async () => ({
                         id: 'command_alias_cleanup',
-                        ok: commandAliasCleanup?.ok !== false,
-                        repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
-                        blockers: commandAliasCleanup?.blockers || [],
-                        rollback_evidence: commandAliasCleanup?.report_path || 'command_alias_cleanup_report'
+                        ok: commandAliasCleanupBeforeReceipt?.ok !== false,
+                        repaired: Array.isArray(commandAliasCleanupBeforeReceipt?.actions) && commandAliasCleanupBeforeReceipt.actions.length > 0,
+                        blockers: commandAliasCleanupBeforeReceipt?.blockers || [],
+                        warnings: commandAliasCleanupBeforeReceipt?.warnings || [],
+                        rollback_evidence: commandAliasCleanupBeforeReceipt?.report_path || 'command_alias_cleanup_report'
                     })
                 },
                 {
@@ -1219,7 +1256,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const authoritativeCodexDoctor = postRepairCodexDoctor;
     const codexDoctorAuthoritativeDiff = compareCodexDoctorBridge(codexDoctorBefore, authoritativeCodexDoctor);
     const pkgBytes = 0;
-    const ready = await writeDoctorReadinessMatrix(root, {
+    const doctorReadinessInput = {
         codex,
         codex_config: codexConfig,
         codex_app: codexApp,
@@ -1232,12 +1269,15 @@ async function runDoctor(args = [], root, doctorFix) {
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
         startup_config_repair: startupConfigRepair,
+        codex_config_syntax_repair: codexConfigSyntaxRepair,
         context7_mcp_repair: context7McpRepair,
         supabase_mcp_repair: supabaseMcpRepair,
         doctor_fix_transaction: doctorFixTransaction,
         doctor_dirty_plan: doctorDirtyPlan,
         doctor_fix_postcheck: doctorFixPostcheck,
+        command_aliases: migrationReceiptOwnsReconcile ? commandAliasCleanupBeforeReceipt : undefined,
         doctor_native_capability: doctorNativeCapabilityRepair,
+        require_legacy_global_hook_cleanup: requireLegacyGlobalHookCleanup,
         skills: skillsReconcile,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
@@ -1254,28 +1294,45 @@ async function runDoctor(args = [], root, doctorFix) {
             ...(configRepair?.operator_actions || []),
             ...(zellijRepair && !zellijRepair.ok && zellijRepair.command ? [`Run: ${zellijRepair.command}`] : []),
             ...(codexStartupRepair.manual_actions || []),
+            ...(codexConfigSyntaxRepair?.manual_actions || []),
             ...(pluginPolicy?.doctor_warnings || [])
         ]
-    });
+    };
+    let ready = await writeDoctorReadinessMatrix(root, doctorReadinessInput);
     if (doctorFix) {
+        if (migrationReceiptOwnsReconcile) {
+            commandAliasCleanup = await inspectCommandAliasCleanup(false);
+            doctorReadinessInput.command_aliases = commandAliasCleanup;
+            ready = await writeDoctorReadinessMatrix(root, doctorReadinessInput);
+        }
         const readinessBlockers = [
             ...(Array.isArray(ready.blockers) ? ready.blockers.map(String).filter(Boolean) : []),
             ...(openRouterProviderRepair?.ok === false
                 ? ((openRouterProviderRepair?.blockers || ['openrouter_provider_repair_failed']).map(String))
                 : [])
         ];
+        const preservedUserOwnedConfig = doctorProfile === 'migration'
+            && readinessBlockers.length > 0
+            && readinessBlockers.every(isMigrationUserOwnedProjectConfigBlocker);
+        const receiptBlockers = preservedUserOwnedConfig ? [] : readinessBlockers;
         const migrationWarnings = [
             ...(doctorNativeCapabilityRepair?.optional_warnings || []),
-            ...(doctorFixPostcheck?.optional_warnings || [])
+            ...(doctorFixPostcheck?.optional_warnings || []),
+            ...(preservedUserOwnedConfig
+                ? [
+                    'migration_doctor_preserved_user_owned_project_config',
+                    ...readinessBlockers.map((blocker) => `migration_optional_blocker:${blocker}`)
+                ]
+                : [])
         ];
         try {
             const receiptInput = {
                 root,
                 source: `doctor-${doctorProfile}`,
-                blockers: readinessBlockers,
+                blockers: receiptBlockers,
                 warnings: migrationWarnings
             };
-            if (readinessBlockers.length)
+            if (receiptBlockers.length)
                 receiptInput.status = 'blocked';
             const receipt = await writeProjectUpdateMigrationReceipt(receiptInput);
             sksUpdate = {
@@ -1310,6 +1367,7 @@ async function runDoctor(args = [], root, doctorFix) {
         && (!sksUpdate || sksUpdate.ok !== false)
         && commandAliasCleanup.ok !== false
         && codexStartupRepair.ok !== false
+        && codexConfigSyntaxRepair?.ok !== false
         && agentRoleConfigRepair.ok !== false
         && openRouterProviderRepair.ok !== false
         && (officialSubagentConfig.blockers || []).length === 0
@@ -1319,14 +1377,20 @@ async function runDoctor(args = [], root, doctorFix) {
         elapsed_ms: Date.now() - startedAtMs,
         ok: resultOk,
         status: resultOk ? (doctorFix ? 'fix_ok' : deepDiagnostics ? 'full_ok' : 'fast_ok') : 'blocked',
+        core_ready: ready.core_ready === true,
+        center_ready: ready.center_ready === true,
+        center_attempted: ready.center_attempted === true,
         diagnostic_depth: deepDiagnostics ? 'full' : doctorFix ? 'fix' : 'fast',
         deep_diagnostics_skipped: !deepDiagnostics,
         deep_ok: deepDiagnostics ? resultOk : null,
         not_counted_as_full_doctor: !deepDiagnostics,
         root,
         arg_warnings: argWarnings,
+        warnings: [...oauthCallbackPortDiagnostic.warnings],
+        operator_actions: oauthCallbackOperatorActions,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
+        oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic,
         codex_config: codexConfig,
         rust,
         codex_app: codexApp,
@@ -1345,6 +1409,7 @@ async function runDoctor(args = [], root, doctorFix) {
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
         startup_config_repair: startupConfigRepair,
+        codex_config_syntax_repair: codexConfigSyntaxRepair,
         context7_mcp_repair: context7McpRepair,
         supabase_mcp_repair: supabaseMcpRepair,
         doctor_fix_transaction: doctorFixTransaction,
@@ -1415,6 +1480,14 @@ async function runDoctor(args = [], root, doctorFix) {
     console.log(`Root:      ${root}`);
     console.log(`Node:      ${result.node.ok ? 'ok' : 'fail'} ${result.node.version}`);
     console.log(`Codex:     ${codex.bin ? 'ok' : 'missing'} ${codex.version || ''}`);
+    if (oauthCallbackPortDiagnostic.conflict) {
+        const listeners = oauthCallbackPortDiagnostic.listeners
+            .map((listener) => `${listener.command} pid ${listener.pid} ${listener.address}`)
+            .join(', ');
+        console.log(`OAuth callback port 1455: warning (${listeners})`);
+        for (const action of oauthCallbackOperatorActions)
+            console.log(`  action: ${action}`);
+    }
     const actual = (codexConfig.checks || []).find((check) => check.name === 'actual_codex_cli_config_load');
     console.log('Project config:');
     console.log(`  node read:       ${ready.codex_config_readable_by_node ? 'ok' : 'failed'}`);
@@ -1443,6 +1516,16 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  manual: ${action}`);
     for (const warning of codexStartupRepair.warnings || [])
         console.log(`  warning: ${warning}`);
+    if (codexConfigSyntaxRepair) {
+        console.log('Codex config syntax:');
+        console.log(`  repair: ${codexConfigSyntaxRepair.ok ? 'ok' : 'blocked'}`);
+        for (const action of codexConfigSyntaxRepair.actions || [])
+            console.log(`  - ${action}`);
+        for (const action of codexConfigSyntaxRepair.manual_actions || [])
+            console.log(`  manual: ${action}`);
+        for (const warning of codexConfigSyntaxRepair.warnings || [])
+            console.log(`  warning: ${warning}`);
+    }
     console.log(`  codex doctor:    ${formatCodexDoctorConsoleStatus(authoritativeCodexDoctor)}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
@@ -1613,6 +1696,8 @@ async function runDoctor(args = [], root, doctorFix) {
     console.log(`  cli_ready: ${ready.cli_ready ? 'yes' : 'no'}`);
     console.log(`  mad_ready: ${ready.mad_ready ? 'yes' : 'no'}`);
     console.log(`  managed_state_current: ${ready.managed_state_current ? 'yes' : 'no'}`);
+    console.log(`  core_ready: ${ready.core_ready ? 'yes' : 'no'}`);
+    console.log(`  center_ready: ${ready.center_ready ? 'yes' : 'no'}${ready.center_attempted ? ' (repair attempted)' : ' (not attempted)'}`);
     console.log(`  ready:     ${ready.ready ? 'yes' : 'no'}`);
     if (!ready.ready) {
         console.log('Primary blocker:');
@@ -1895,10 +1980,32 @@ function installScopeFromArgs(args = []) {
     const index = args.indexOf('--install-scope');
     return normalizeInstallScope(index >= 0 && args[index + 1] ? args[index + 1] : 'global');
 }
+function isMigrationUserOwnedProjectConfigBlocker(blocker) {
+    const value = String(blocker || '').trim();
+    return value === 'user_owned_file_without_sks_marker'
+        || value.endsWith(':user_owned_file_without_sks_marker')
+        || value === 'config_write_guard:blocked_unmanaged_project_config'
+        || value.endsWith(':config_write_guard:blocked_unmanaged_project_config');
+}
 function readOption(args = [], name, fallback = null) {
     const index = args.indexOf(name);
     return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
 }
+export function buildCodexAppUiDiagnosticFailure(apply, error) {
+    return {
+        schema: 'sks.codex-app-fast-ui-repair.v1',
+        ok: false,
+        apply,
+        safe_auto_apply: false,
+        requires_confirmation: true,
+        fast_selector: 'manual_action_required',
+        provider_selector: 'manual_action_required',
+        host_owned_config: 'diagnostic_failed',
+        next_action: 'Review Codex App UI config manually.',
+        actions: [],
+        blockers: [error instanceof Error ? error.message : String(error)]
+    };
+}
 export function formatCodexDoctorConsoleStatus(report) {
     if (!report || report.available !== true)
         return 'unavailable';