sneakoscope 8.1.2 → 8.2.0

package/dist/core/update/update-migration-state.js

@@ -9,15 +9,12 @@ import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest
 import { enforceRetention } from '../retention.js';
 import { COMMANDS } from '../../cli/command-registry.js';
 import { reconcileLegacyManagedGeneration } from '../init/legacy-generation-convergence.js';
-import { codexHookTrustDoctor } from '../codex-hooks/codex-hook-trust-doctor.js';
-import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
+import { runConfigFastModeNormalizeStage } from './update-migration-state/fast-mode-config.js';
+import { runSessionStateSplitStage } from './update-migration-state/session-state-split.js';
+import { runHookTrustRefreshStage, runOtherHarnessCleanupStage } from './update-migration-state/simple-stages.js';
 import { compareSemVer } from './semver.js';
-import { escapeRegExp } from '../text/regex.js';
-import { sessionStateKey } from '../mission.js';
-import { ensureConfinedDirectory, inspectConfinedPath, moveConfinedPath, uniqueConfinedPath } from '../managed-path-safety.js';
 export const UPDATE_MIGRATION_SCHEMA = 'sks.project-migration-receipt.v2';
 export const INSTALLATION_EPOCH_SCHEMA = 'sks.installation-epoch.v1';
-const LEGACY_CURRENT_STATE_MAX_BYTES = 1024 * 1024;
 export function installationEpochPath() {
     return path.join(globalSksRoot(), 'update', 'installation-epoch.json');
 }
@@ -191,6 +188,7 @@ export async function runUpdateRetentionCleanup(root, source = 'update-migration
         const result = await enforceRetention(root, {
             mode: 'update_migration',
             pruneReportLogs: true,
+            skipSksTempSweep: true,
             policy: { max_tmp_age_hours: 0 }
         });
         return {
@@ -262,37 +260,6 @@ const UPDATE_MIGRATION_STAGES = [
         run: runReceiptRotationStage
     }
 ];
-async function runOtherHarnessCleanupStage(root) {
-    const { scanHarnessConflicts } = await import('../harness-conflicts.js');
-    const scan = await scanHarnessConflicts(root);
-    if (scan.hard_block) {
-        return {
-            ok: false,
-            status: 'failed',
-            actions: ['other_harness_conflict_detected'],
-            blockers: scan.hard.map((row) => `other_harness_conflict:${row.path}`),
-            warnings: [],
-            detail: {
-                cleaned_count: 0,
-                remaining_count: scan.hard.length,
-                error_count: 0,
-                cleanup_prompt_command: 'sks conflicts cleanup --yes'
-            }
-        };
-    }
-    return {
-        ok: true,
-        status: 'ok',
-        actions: ['other_harness_conflict_check_clean'],
-        blockers: [],
-        warnings: [],
-        detail: {
-            cleaned_count: 0,
-            remaining_count: 0,
-            error_count: 0
-        }
-    };
-}
 async function runCurrentPublicSurfaceReconcileStage(root) {
     const [{ runDoctorCommandAliasCleanup }, { migrateSksProfilesToPerFile }, { cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings }] = await Promise.all([
         import('../doctor/command-alias-cleanup.js'),
@@ -402,242 +369,6 @@ async function runUpdateMigrationStages(root, opts = {}) {
     }
     return runs;
 }
-async function runSessionStateSplitStage(root) {
-    const legacyCurrent = path.join(root, '.sneakoscope', 'current.json');
-    const stateCurrent = path.join(root, '.sneakoscope', 'state', 'current.json');
-    const sessionsDir = path.join(root, '.sneakoscope', 'state', 'sessions');
-    await ensureConfinedDirectory(root, sessionsDir);
-    const actions = [];
-    const legacyRead = await readBoundedUpdateState(root, legacyCurrent, { requireLegacyShape: true });
-    if (legacyRead.blocker) {
-        return {
-            ok: false,
-            status: 'failed',
-            actions: ['legacy_current_state_preserved'],
-            blockers: [legacyRead.blocker],
-            warnings: [],
-            detail: { legacy_present: legacyRead.present }
-        };
-    }
-    const currentRead = await readBoundedUpdateState(root, stateCurrent);
-    if (currentRead.blocker) {
-        return {
-            ok: false,
-            status: 'failed',
-            actions: ['current_state_preserved'],
-            blockers: [currentRead.blocker],
-            warnings: [],
-            detail: { legacy_present: legacyRead.present }
-        };
-    }
-    let current = currentRead.value;
-    if (!current && legacyRead.value) {
-        current = legacyRead.value;
-        await writeJsonAtomic(stateCurrent, current);
-        const verified = await readBoundedUpdateState(root, stateCurrent);
-        if (verified.blocker || !verified.value || updateStateDigest(verified.value) !== legacyRead.sha256) {
-            return {
-                ok: false,
-                status: 'failed',
-                actions: ['copy_legacy_current_json_failed_verification'],
-                blockers: [verified.blocker || 'legacy_current_state_copy_verification_failed'],
-                warnings: [],
-                detail: { legacy_present: true }
-            };
-        }
-        actions.push('copied_legacy_current_json_to_state_current');
-    }
-    const missionId = typeof current?.mission_id === 'string' ? current.mission_id : typeof current?.mission === 'string' ? current.mission : null;
-    const rawSessionKey = typeof current?._session_key === 'string' && current._session_key.trim()
-        ? current._session_key
-        : null;
-    const canonicalSessionKey = rawSessionKey ? sessionStateKey(rawSessionKey) : null;
-    if (canonicalSessionKey) {
-        const sessionPath = path.join(sessionsDir, `${canonicalSessionKey}.json`);
-        const sessionRead = await readBoundedUpdateState(root, sessionPath);
-        if (sessionRead.blocker) {
-            return {
-                ok: false,
-                status: 'failed',
-                actions,
-                blockers: [sessionRead.blocker],
-                warnings: [],
-                detail: { legacy_present: legacyRead.present, mission_id: missionId, session_key: canonicalSessionKey }
-            };
-        }
-        if (!sessionRead.present) {
-            await writeJsonAtomic(sessionPath, {
-                ...current,
-                _session_key: canonicalSessionKey,
-                migrated_from: path.relative(root, stateCurrent),
-                migrated_at: nowIso()
-            });
-            const verifiedSession = await readBoundedUpdateState(root, sessionPath);
-            if (verifiedSession.blocker
-                || verifiedSession.value?._session_key !== canonicalSessionKey
-                || verifiedSession.value?.mission_id !== current?.mission_id) {
-                return {
-                    ok: false,
-                    status: 'failed',
-                    actions,
-                    blockers: [verifiedSession.blocker || 'legacy_session_state_copy_verification_failed'],
-                    warnings: [],
-                    detail: { legacy_present: legacyRead.present, mission_id: missionId, session_key: canonicalSessionKey }
-                };
-            }
-            actions.push('wrote_state_session_alias');
-        }
-    }
-    let quarantinePath = null;
-    if (legacyRead.present) {
-        const quarantineBase = path.join(root, '.sneakoscope', 'quarantine', 'update-legacy-state', `current-${legacyRead.sha256?.slice(0, 12) || 'unknown'}.json`);
-        quarantinePath = await uniqueConfinedPath(root, quarantineBase);
-        await moveConfinedPath(root, legacyCurrent, quarantinePath);
-        const quarantined = await readBoundedUpdateState(root, quarantinePath, { requireLegacyShape: true });
-        const legacyAfter = await inspectConfinedPath(root, legacyCurrent);
-        if (legacyAfter.exists
-            || quarantined.blocker
-            || !quarantined.value
-            || quarantined.sha256 !== legacyRead.sha256) {
-            const sourceAfter = await inspectConfinedPath(root, legacyCurrent);
-            if (!sourceAfter.exists && (await inspectConfinedPath(root, quarantinePath)).exists) {
-                await moveConfinedPath(root, quarantinePath, legacyCurrent).catch(() => undefined);
-            }
-            return {
-                ok: false,
-                status: 'failed',
-                actions: [...actions, 'legacy_current_state_quarantine_rolled_back'],
-                blockers: [quarantined.blocker || 'legacy_current_state_quarantine_verification_failed'],
-                warnings: [],
-                detail: { legacy_present: true, mission_id: missionId }
-            };
-        }
-        actions.push('quarantined_legacy_current_json');
-    }
-    if (!actions.length)
-        actions.push('session_state_current');
-    return {
-        ok: true,
-        status: 'ok',
-        actions,
-        blockers: [],
-        warnings: [],
-        detail: {
-            legacy_present: legacyRead.present,
-            mission_id: missionId,
-            session_key: canonicalSessionKey,
-            legacy_quarantine_path: quarantinePath ? path.relative(root, quarantinePath) : null
-        }
-    };
-}
-async function readBoundedUpdateState(root, file, opts = {}) {
-    let inspected;
-    try {
-        inspected = await inspectConfinedPath(root, file);
-    }
-    catch (error) {
-        return {
-            present: true,
-            value: null,
-            sha256: null,
-            blocker: `update_state_path_unsafe:${error?.code || error?.message || String(error)}`
-        };
-    }
-    if (!inspected.exists)
-        return { present: false, value: null, sha256: null, blocker: null };
-    if (inspected.leafSymlink) {
-        return { present: true, value: null, sha256: null, blocker: 'update_state_symlink_refused' };
-    }
-    if (!inspected.stat?.isFile()) {
-        return { present: true, value: null, sha256: null, blocker: 'update_state_non_regular_refused' };
-    }
-    if (inspected.stat.size > LEGACY_CURRENT_STATE_MAX_BYTES) {
-        return { present: true, value: null, sha256: null, blocker: 'update_state_size_limit_exceeded' };
-    }
-    let text;
-    let handle = null;
-    try {
-        const noFollow = process.platform === 'win32' ? 0 : fsConstants.O_NOFOLLOW;
-        handle = await fsp.open(file, fsConstants.O_RDONLY | noFollow);
-        const before = await handle.stat();
-        if (!before.isFile()) {
-            return { present: true, value: null, sha256: null, blocker: 'update_state_non_regular_refused' };
-        }
-        if (before.size > LEGACY_CURRENT_STATE_MAX_BYTES) {
-            return { present: true, value: null, sha256: null, blocker: 'update_state_size_limit_exceeded' };
-        }
-        const buffer = Buffer.alloc(LEGACY_CURRENT_STATE_MAX_BYTES + 1);
-        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
-        const after = await handle.stat();
-        const pathAfter = await inspectConfinedPath(root, file);
-        if (bytesRead > LEGACY_CURRENT_STATE_MAX_BYTES
-            || bytesRead !== before.size
-            || after.size !== before.size
-            || after.dev !== before.dev
-            || after.ino !== before.ino
-            || !pathAfter.exists
-            || pathAfter.leafSymlink
-            || pathAfter.stat?.dev !== after.dev
-            || pathAfter.stat?.ino !== after.ino) {
-            return { present: true, value: null, sha256: null, blocker: 'update_state_changed_during_safe_read' };
-        }
-        text = buffer.subarray(0, bytesRead).toString('utf8');
-    }
-    catch (error) {
-        return {
-            present: true,
-            value: null,
-            sha256: null,
-            blocker: `update_state_read_failed:${error?.code || error?.message || String(error)}`
-        };
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-    let value;
-    try {
-        value = JSON.parse(text);
-    }
-    catch {
-        return { present: true, value: null, sha256: null, blocker: 'update_state_json_invalid' };
-    }
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        return { present: true, value: null, sha256: null, blocker: 'update_state_object_required' };
-    }
-    const record = value;
-    if (opts.requireLegacyShape && !isRecognizedLegacyCurrentState(record)) {
-        return { present: true, value: null, sha256: null, blocker: 'legacy_current_state_ownership_unproven' };
-    }
-    return {
-        present: true,
-        value: record,
-        sha256: updateStateDigest(record),
-        blocker: null
-    };
-}
-function isRecognizedLegacyCurrentState(value) {
-    const mission = typeof value.mission_id === 'string'
-        ? value.mission_id.trim()
-        : typeof value.mission === 'string'
-            ? value.mission.trim()
-            : '';
-    if (/^M-[A-Za-z0-9][A-Za-z0-9._-]{2,127}$/.test(mission))
-        return true;
-    const mode = typeof value.mode === 'string' ? value.mode.trim() : '';
-    const phase = typeof value.phase === 'string' ? value.phase.trim() : '';
-    if (mode === 'IDLE' && phase === 'IDLE')
-        return true;
-    if (!mode || !phase)
-        return false;
-    const sessionKey = typeof value._session_key === 'string' && value._session_key.trim().length > 0;
-    const routeCommand = typeof value.route_command === 'string' && value.route_command.trim().startsWith('$');
-    const managedStopGate = ['stop_gate', 'stop_gate_abs_path']
-        .some((key) => typeof value[key] === 'string' && String(value[key]).trim().length > 0);
-    return sessionKey || routeCommand || managedStopGate;
-}
-function updateStateDigest(value) {
-    return sha256(JSON.stringify(value));
-}
 async function runSkillsReconcileStage(root) {
     if (process.env.SKS_TEST_UPDATE_GLOBAL_SKILLS_FAIL === '1') {
         return {
@@ -754,83 +485,6 @@ async function runMenubarRetargetStage(root) {
         }
     };
 }
-async function runConfigFastModeNormalizeStage() {
-    const { reconcileRetiredSksConfigText } = await import('../auto-review.js');
-    const configPath = path.join(os.homedir(), '.codex', 'config.toml');
-    const text = await readText(configPath, null);
-    if (typeof text !== 'string')
-        return { ok: true, status: 'ok', actions: ['codex_config_absent'], blockers: [], warnings: [] };
-    const normalized = normalizeLegacyFastModeConfigForUpdate(text);
-    const retired = reconcileRetiredSksConfigText(normalized.text);
-    const nextText = ensureTrailingNewline(retired.text);
-    const actions = [
-        ...normalized.actions,
-        ...(retired.detected_count > 0 ? ['stripped_retired_sks_config_profiles_and_policies'] : [])
-    ];
-    if (nextText === ensureTrailingNewline(text)) {
-        return {
-            ok: true,
-            status: 'ok',
-            actions: actions.length ? actions : ['fastmode_config_current'],
-            blockers: [],
-            warnings: [],
-            detail: {
-                config_path: configPath,
-                default_profile: normalized.defaultProfile,
-                retired_config_detected_count: retired.detected_count
-            }
-        };
-    }
-    let guardResult = null;
-    guardResult = await writeCodexConfigGuarded({
-        configPath,
-        before: text,
-        mutate: () => nextText,
-        cause: 'project-update-fastmode-normalize',
-        backupTag: 'project-update-fastmode-normalize',
-        preserveFastUiKeys: true
-    });
-    if (!guardResult.ok) {
-        return {
-            ok: false,
-            status: 'failed',
-            actions: ['normalize_fastmode_config_blocked'],
-            blockers: [`codex_config_guard:${guardResult.status}`],
-            warnings: [],
-            detail: {
-                config_path: configPath,
-                default_profile: normalized.defaultProfile,
-                retired_config_detected_count: retired.detected_count,
-                guard: guardResult
-            }
-        };
-    }
-    return {
-        ok: true,
-        status: 'ok',
-        actions: actions.length ? actions : ['fastmode_config_current'],
-        blockers: [],
-        warnings: [],
-        detail: {
-            config_path: configPath,
-            default_profile: normalized.defaultProfile,
-            retired_config_detected_count: retired.detected_count,
-            guard: guardResult
-        }
-    };
-}
-async function runHookTrustRefreshStage(root) {
-    const result = await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true });
-    const blockers = result.ok === false ? (result.blockers || ['hook_trust_refresh_failed']) : [];
-    return {
-        ok: blockers.length === 0,
-        status: blockers.length ? 'failed' : 'ok',
-        actions: ['refreshed_hook_trust'],
-        blockers,
-        warnings: result.warnings || [],
-        detail: { entries: result.current_hash_count ?? null }
-    };
-}
 async function runReceiptRotationStage(root) {
     const receiptPath = projectUpdateMigrationReceiptPath(root);
     const dir = path.dirname(receiptPath);
@@ -866,137 +520,6 @@ function legacyStageApplies(fromVersion, minFromVersion) {
 function compareVersionLike(a, b) {
     return compareSemVer(a, b) ?? 0;
 }
-function insertTopLevelTomlKey(text, line) {
-    const raw = String(text || '').trimEnd();
-    const firstTable = raw.search(/^\s*\[/m);
-    if (firstTable < 0)
-        return `${line}\n${raw}`.trim() + '\n';
-    return `${raw.slice(0, firstTable).trimEnd()}\n${line}\n\n${raw.slice(firstTable).trimStart()}`.trim() + '\n';
-}
-function normalizeLegacyFastModeConfigForUpdate(text) {
-    let next = String(text || '');
-    const actions = [];
-    const misplaced = tomlTableString(next, 'user.fast_mode', 'default_profile');
-    const topLevel = topLevelTomlString(next, 'default_profile');
-    const legacyFastDefault = misplaced === 'sks-fast-high' || topLevel === 'sks-fast-high';
-    const before = next;
-    next = removeTopLevelTomlKeyLocal(next, 'default_profile');
-    next = removeTomlTableLocal(next, 'user.fast_mode');
-    next = removeTomlTableLocal(next, 'profiles.sks-fast-high');
-    next = removeTomlTableKeyLocal(next, 'notice', 'fast_default_opt_out');
-    if (next !== before)
-        actions.push('stripped_removed_fastmode_config_schema_keys');
-    if (legacyFastDefault && !topLevelTomlString(next, 'service_tier')) {
-        next = insertTopLevelTomlKey(next, 'service_tier = "fast"');
-        actions.push('migrated_legacy_fast_default_to_service_tier');
-    }
-    return { text: ensureTrailingNewline(next), actions, defaultProfile: misplaced || topLevel };
-}
-function removeTopLevelTomlKeyLocal(text, key) {
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-    const end = firstTable === -1 ? lines.length : firstTable;
-    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
-    return lines.filter((line, index) => index >= end || !keyPattern.test(line)).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-}
-function removeTomlTableLocal(text, table) {
-    const lines = String(text || '').trimEnd().split('\n');
-    const header = `[${table}]`;
-    const start = lines.findIndex((x) => x.trim() === header);
-    if (start === -1)
-        return String(text || '');
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i += 1) {
-        const ln = lines[i];
-        if (ln !== undefined && /^\s*\[.+\]\s*$/.test(ln)) {
-            end = i;
-            break;
-        }
-    }
-    return lines.filter((_, index) => index < start || index >= end).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-}
-function tomlTableString(text, table, key) {
-    const block = tomlTableBlock(text, table);
-    const match = block?.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*$`, 'm'));
-    return match?.[1] || null;
-}
-function topLevelTomlString(text, key) {
-    const source = String(text || '');
-    const firstTable = source.search(/^\s*\[/m);
-    const top = firstTable < 0 ? source : source.slice(0, firstTable);
-    const match = top.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*$`, 'm'));
-    return match?.[1] || null;
-}
-function tomlTableBlock(text, table) {
-    const lines = String(text || '').split(/\r?\n/);
-    const start = lines.findIndex((line) => tableHeaderMatches(line, table));
-    if (start < 0)
-        return null;
-    let end = lines.length;
-    for (let index = start + 1; index < lines.length; index += 1) {
-        if (/^\s*\[[^\]]+\]\s*$/.test(lines[index] || '')) {
-            end = index;
-            break;
-        }
-    }
-    return lines.slice(start, end).join('\n');
-}
-function removeTomlTableKeyLocal(text, table, key) {
-    const lines = String(text || '').split(/\r?\n/);
-    let inTable = false;
-    const out = [];
-    for (const line of lines) {
-        if (/^\s*\[[^\]]+\]\s*$/.test(line))
-            inTable = tableHeaderMatches(line, table);
-        if (inTable && new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(line))
-            continue;
-        out.push(line);
-    }
-    return out.join('\n');
-}
-function upsertTomlTableKeyIfAbsentLocal(text, table, line) {
-    const key = tomlLineKey(line);
-    return tomlTableHasKey(text, table, key) ? text : upsertTomlTableKeyLocal(text, table, line);
-}
-function upsertTomlTableKeyLocal(text, table, line) {
-    const raw = String(text || '').trimEnd();
-    const key = tomlLineKey(line);
-    const lines = raw ? raw.split(/\r?\n/) : [];
-    const start = lines.findIndex((candidate) => tableHeaderMatches(candidate, table));
-    if (start < 0) {
-        return `${raw}${raw ? '\n\n' : ''}[${table}]\n${line}\n`;
-    }
-    let end = lines.length;
-    for (let index = start + 1; index < lines.length; index += 1) {
-        if (/^\s*\[[^\]]+\]\s*$/.test(lines[index] || '')) {
-            end = index;
-            break;
-        }
-    }
-    for (let index = start + 1; index < end; index += 1) {
-        if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[index] || '')) {
-            if (lines[index] === line)
-                return `${lines.join('\n')}\n`;
-            lines[index] = line;
-            return `${lines.join('\n')}\n`;
-        }
-    }
-    lines.splice(end, 0, line);
-    return `${lines.join('\n')}\n`;
-}
-function tomlTableHasKey(text, table, key) {
-    const block = tomlTableBlock(text, table);
-    return Boolean(block && new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`, 'm').test(block));
-}
-function tableHeaderMatches(line, table) {
-    return new RegExp(`^\\s*\\[${escapeRegExp(table)}\\]\\s*$`).test(line || '');
-}
-function tomlLineKey(line) {
-    return String(line || '').split('=')[0]?.trim() || '';
-}
-function ensureTrailingNewline(text) {
-    return `${String(text || '').trim()}\n`;
-}
 export async function ensureCurrentMigrationBeforeCommand(input) {
     const env = input.env || process.env;
     const command = input.command;

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.1.2';
+export const PACKAGE_VERSION = '8.2.0';

package/dist/native/sks-menubar/Sources/OperationCoordinator.swift

@@ -40,7 +40,7 @@ final class OperationCoordinator {
                 state: .queued, stage: "queued", progress: 0, startedAt: now,
                 updatedAt: now, publicSummary: summary, logPath: AppRuntime.lastActionLogPath,
                 retryable: true, targetVersion: targetVersion, projectRoot: projectRoot,
-                registry: registry, recovery: nil, providerApply: providerApply
+                registry: registry, recovery: nil, providerApply: providerApply, diagnostic: nil
             )
             if let group = mutationGroup { activeMutation = (snapshot.id, group) }
             write(snapshot)
@@ -65,7 +65,7 @@ final class OperationCoordinator {
                 publicSummary: summary, logPath: snapshot.logPath, retryable: retryable,
                 targetVersion: snapshot.targetVersion, projectRoot: snapshot.projectRoot,
                 registry: snapshot.registry, recovery: snapshot.recovery,
-                providerApply: snapshot.providerApply
+                providerApply: snapshot.providerApply, diagnostic: snapshot.diagnostic
             )
             write(next)
             if releaseMutationGuard, [.succeeded, .failed, .cancelled, .terminalUncertain].contains(state) {
@@ -118,7 +118,7 @@ final class OperationCoordinator {
                 retryable: status.state == .autoResumePending || status.state == .pausedResumable,
                 targetVersion: snapshot.targetVersion, projectRoot: snapshot.projectRoot,
                 registry: snapshot.registry, recovery: status,
-                providerApply: snapshot.providerApply
+                providerApply: snapshot.providerApply, diagnostic: snapshot.diagnostic
             )
             write(next)
             if status.state == .pausedResumable, activeMutation?.id == snapshot.id {
@@ -153,7 +153,7 @@ final class OperationCoordinator {
                 retryable: projection.failedStage != nil,
                 targetVersion: snapshot.targetVersion, projectRoot: snapshot.projectRoot,
                 registry: snapshot.registry, recovery: snapshot.recovery,
-                providerApply: projection
+                providerApply: projection, diagnostic: snapshot.diagnostic
             )
             write(next)
             if (nextState == .waitingForConfirmation || nextState == .succeeded)
@@ -164,6 +164,30 @@ final class OperationCoordinator {
         }
     }
 
+    /// Persists only the non-secret diagnostic identity/readiness projection on
+    /// the operation receipt. The CLI report body and provider credentials never
+    /// enter the operation store.
+    func recordDiagnostic(
+        _ snapshot: OperationSnapshot,
+        metadata: DiagnosticOperationMetadata
+    ) -> OperationSnapshot {
+        queue.sync {
+            let next = OperationSnapshot(
+                schema: snapshot.schema, id: snapshot.id, kind: snapshot.kind,
+                state: snapshot.state, stage: snapshot.stage, progress: snapshot.progress,
+                startedAt: snapshot.startedAt,
+                updatedAt: ISO8601DateFormatter().string(from: Date()),
+                publicSummary: snapshot.publicSummary, logPath: snapshot.logPath,
+                retryable: snapshot.retryable, targetVersion: snapshot.targetVersion,
+                projectRoot: snapshot.projectRoot, registry: snapshot.registry,
+                recovery: snapshot.recovery, providerApply: snapshot.providerApply,
+                diagnostic: metadata
+            )
+            write(next)
+            return next
+        }
+    }
+
     /// Executes one caller-declared retry-safe operation. The exact same closure
     /// may be re-entered only for a transient network classification and at most
     /// twice. Authentication, provider mode, account binding, external settings,