sneakoscope 8.3.2 → 8.6.0

package/dist/core/codex-lb/request-route-resolver.js

@@ -22,11 +22,13 @@ export function resolveBridgeRequestRoute(request, policy, options) {
     if (options.active_catalog_generation && options.active_catalog_generation !== policy.catalog_generation) {
         return blocked(base, 'catalog_route_index_stale');
     }
-    const pin = request.thread_id ? findSessionPin(options.session_pins, request.thread_id) : null;
-    if (pin && canonicalizeBridgeModelId(pin.public_model) === model) {
-        const pinBlocker = validateSessionPin(pin, policy, options.route_index, options.registry);
-        if (pinBlocker)
-            return blocked(base, pinBlocker);
+    const threadPin = request.thread_id ? findSessionPin(options.session_pins, request.thread_id) : null;
+    const pin = threadPin && canonicalizeBridgeModelId(threadPin.public_model) === model ? threadPin : null;
+    const pinAffinity = pin ? sessionPinAffinity(pin, policy, options.route_index, options.registry) : null;
+    if (pinAffinity === 'unprovable')
+        return blocked(base, 'session_pin_route_unavailable');
+    const pinClaim = pinAffinity && pinAffinity !== 'honored' ? pinAffinity : null;
+    if (pin && pinAffinity === 'honored') {
         const route = { provider_id: pin.provider_id, upstream_model: pin.upstream_model };
         const providerBlocker = validateProviderRoute(route, request.requested_endpoint_origin, options.registry, options.route_index);
         if (providerBlocker)
@@ -51,6 +53,8 @@ export function resolveBridgeRequestRoute(request, policy, options) {
         return blocked(base, 'catalog_model_route_missing');
     if (!sameTarget(indexed, policyTarget))
         return blocked(base, 'bridge_route_policy_route_index_mismatch');
+    if (pinClaim && !sameTarget(indexed, pinClaim))
+        return blocked(base, 'session_pin_route_unavailable');
     const providerBlocker = validateProviderRoute(indexed, request.requested_endpoint_origin, options.registry, options.route_index);
     if (providerBlocker)
         return blocked(base, providerBlocker);
@@ -76,23 +80,22 @@ export function resolveBridgeRequestRoute(request, policy, options) {
         recovery_action: null
     };
 }
-function validateSessionPin(pin, policy, routeIndex, registry) {
-    if (pin.catalog_generation !== policy.catalog_generation
-        || pin.route_policy_generation !== policy.policy_generation) {
-        return 'session_pin_route_unavailable';
-    }
-    if (!isProviderId(pin.provider_id) || !registry.profiles[pin.provider_id]) {
-        return 'session_pin_route_unavailable';
-    }
+function sessionPinAffinity(pin, policy, routeIndex, registry) {
+    if (!isProviderId(pin.provider_id) || !registry.profiles[pin.provider_id])
+        return 'unprovable';
     const model = canonicalizeBridgeModelId(pin.public_model);
     const upstream = normalizeBridgeUpstreamModelId(pin.upstream_model);
     if (!model || !upstream)
-        return 'session_pin_route_unavailable';
-    const indexed = routeIndex.routes[model] || routeIndex.routes[`${pin.provider_id}:${model}`];
-    if (!indexed || indexed.provider_id !== pin.provider_id || indexed.upstream_model !== upstream) {
-        return 'session_pin_route_unavailable';
+        return 'unprovable';
+    const claim = { provider_id: pin.provider_id, upstream_model: upstream };
+    if (pin.catalog_generation !== policy.catalog_generation
+        || pin.route_policy_generation !== policy.policy_generation) {
+        return claim;
     }
-    return null;
+    const indexed = routeIndex.routes[model] || routeIndex.routes[`${pin.provider_id}:${model}`];
+    if (!indexed || !sameTarget(indexed, claim))
+        return claim;
+    return 'honored';
 }
 function validateProviderRoute(route, requestedOrigin, registry, routeIndex) {
     if (!isProviderId(route.provider_id))

package/dist/core/commands/triwiki-atlas-command.js

@@ -0,0 +1,372 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { flag, readOption } from '../../cli/args.js';
+import { ARCHITECTURE_MAP_MANIFEST_SCHEMA, ARCHITECTURE_MAP_VIEW_IDS, GLOBAL_ARCHITECTURE_MAP_VIEW_IDS } from '../triwiki/context-graph/architecture/contracts.js';
+import { ARCHITECTURE_MAP_DIR_REL } from '../triwiki/context-graph/store/architecture-map-store.js';
+export const TRIWIKI_ATLAS_SUBCOMMANDS = [
+    'atlas-status',
+    'atlas-lint',
+    'atlas-list',
+    'atlas-show',
+    'atlas-why'
+];
+const REPAIR_COMMAND = 'sks align run';
+const VIEW_ID_SET = new Set(ARCHITECTURE_MAP_VIEW_IDS);
+const GLOBAL_VIEW_ID_SET = new Set(GLOBAL_ARCHITECTURE_MAP_VIEW_IDS);
+export function isTriWikiAtlasSubcommand(value) {
+    return typeof value === 'string' && TRIWIKI_ATLAS_SUBCOMMANDS.includes(value);
+}
+function mapRoot(root) {
+    return path.join(root, ...ARCHITECTURE_MAP_DIR_REL.split('/'));
+}
+function missionMapRoot(root, missionId) {
+    return path.join(root, '.sneakoscope', 'missions', missionId, 'architecture-map');
+}
+function resolveMapDir(root, args) {
+    const missionId = readOption(args, '--mission', '') || null;
+    if (missionId) {
+        return { dir: missionMapRoot(root, missionId), mode: 'mission', missionId };
+    }
+    return { dir: mapRoot(root), mode: 'global', missionId: null };
+}
+function readJsonFile(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function loadManifest(dir) {
+    const file = path.join(dir, 'manifest.json');
+    if (!fs.existsSync(file))
+        return { ok: false, manifest: null, path: file };
+    const manifest = readJsonFile(file);
+    return { ok: Boolean(manifest && manifest.schema === ARCHITECTURE_MAP_MANIFEST_SCHEMA), manifest, path: file };
+}
+function loadFindings(dir) {
+    const file = path.join(dir, 'findings.json');
+    const doc = readJsonFile(file);
+    return Array.isArray(doc?.findings) ? doc.findings : [];
+}
+function countBySeverity(findings) {
+    let blocking = 0;
+    let warning = 0;
+    let info = 0;
+    for (const finding of findings) {
+        if (finding.severity === 'blocking')
+            blocking += 1;
+        else if (finding.severity === 'warning')
+            warning += 1;
+        else
+            info += 1;
+    }
+    return { blocking, warning, info };
+}
+function graphFreshness(root, manifest) {
+    if (!manifest)
+        return 'missing';
+    const graphPath = path.join(root, '.sneakoscope', 'wiki', 'context-graph.json');
+    if (!fs.existsSync(graphPath))
+        return 'missing';
+    const graph = readJsonFile(graphPath);
+    const expected = String(graph?.snapshotHash || '');
+    const observed = String(manifest.graphHash || manifest.sourceBinding?.graphHash || '');
+    if (!expected || !observed)
+        return 'missing';
+    return expected === observed ? 'fresh' : 'stale';
+}
+async function atlasStatus(root, args) {
+    const resolved = resolveMapDir(root, args);
+    const loaded = loadManifest(resolved.dir);
+    const findings = loaded.manifest ? loadFindings(resolved.dir) : [];
+    const severity = countBySeverity(findings);
+    const freshness = graphFreshness(root, loaded.manifest);
+    const ok = loaded.ok && freshness === 'fresh' && severity.blocking === 0;
+    const result = {
+        schema: 'sks.triwiki-atlas-status.v1',
+        ok,
+        mode: resolved.mode,
+        mission_id: resolved.missionId,
+        manifest_schema: loaded.manifest?.schema ?? null,
+        graph_hash: loaded.manifest?.graphHash ?? null,
+        policy_hash: loaded.manifest?.policyHash ?? null,
+        generated_from: loaded.manifest?.canonicalHash ?? null,
+        freshness,
+        view_count: loaded.manifest?.views?.length ?? 0,
+        blocking_count: severity.blocking,
+        warning_count: severity.warning,
+        projection_accounting: loaded.manifest?.projectionAccounting ?? null,
+        next_action: ok ? null : REPAIR_COMMAND,
+        repair_command: REPAIR_COMMAND
+    };
+    const lines = [
+        `Architecture map (${resolved.mode}): ${ok ? 'ok' : 'blocked'}`,
+        `Freshness: ${freshness}`,
+        `Views: ${result.view_count}; blocking=${severity.blocking} warning=${severity.warning}`,
+        ...(ok ? [] : [`Repair: ${REPAIR_COMMAND}`])
+    ];
+    return { result, ok, lines };
+}
+async function atlasLint(root, args) {
+    const resolved = resolveMapDir(root, args);
+    const loaded = loadManifest(resolved.dir);
+    const errors = [];
+    if (!loaded.manifest)
+        errors.push('manifest_missing');
+    else {
+        if (loaded.manifest.schema !== ARCHITECTURE_MAP_MANIFEST_SCHEMA)
+            errors.push('schema');
+        if (!loaded.manifest.graphHash)
+            errors.push('graph_hash');
+        if (!loaded.manifest.policyHash)
+            errors.push('policy_hash');
+        if (!Array.isArray(loaded.manifest.views) || loaded.manifest.views.length === 0)
+            errors.push('views');
+        if (!loaded.manifest.projectionAccounting)
+            errors.push('projection_accounting');
+        for (const view of loaded.manifest.views ?? []) {
+            if (!VIEW_ID_SET.has(view.viewId))
+                errors.push(`unknown_view:${view.viewId}`);
+            const viewPath = path.join(resolved.dir, 'views', `${view.viewId}.mmd`);
+            if (!fs.existsSync(viewPath)) {
+                errors.push(`missing_view_file:${view.viewId}`);
+                continue;
+            }
+            const text = fs.readFileSync(viewPath, 'utf8');
+            if (!text.startsWith('%% GENERATED BY SKS'))
+                errors.push(`header:${view.viewId}`);
+            if (!/\bflowchart (TD|LR)\b/.test(text))
+                errors.push(`grammar:${view.viewId}`);
+            if (/\/Users\/|\/home\/|C:\\\\/.test(text))
+                errors.push(`absolute_path:${view.viewId}`);
+            const rel = path.relative(resolved.dir, viewPath);
+            if (rel.startsWith('..') || path.isAbsolute(rel))
+                errors.push(`path_escape:${view.viewId}`);
+        }
+    }
+    const freshness = graphFreshness(root, loaded.manifest);
+    if (freshness !== 'fresh')
+        errors.push(`freshness_${freshness}`);
+    const ok = errors.length === 0;
+    const result = {
+        schema: 'sks.triwiki-atlas-lint.v1',
+        ok,
+        mode: resolved.mode,
+        mission_id: resolved.missionId,
+        error_count: errors.length,
+        errors,
+        repair_command: REPAIR_COMMAND
+    };
+    return {
+        result,
+        ok,
+        lines: [
+            `Architecture map lint: ${ok ? 'ok' : 'blocked'} (${errors.length} errors)`,
+            ...errors.slice(0, 20).map((error) => `- ${error}`),
+            ...(ok ? [] : [`Repair: ${REPAIR_COMMAND}`])
+        ]
+    };
+}
+async function atlasList(root, args) {
+    const resolved = resolveMapDir(root, args);
+    const loaded = loadManifest(resolved.dir);
+    if (!loaded.manifest) {
+        return {
+            result: {
+                schema: 'sks.triwiki-atlas-list.v1',
+                ok: false,
+                error_code: 'manifest_missing',
+                repair_command: REPAIR_COMMAND
+            },
+            ok: false,
+            lines: ['Architecture map list: manifest_missing', `Repair: ${REPAIR_COMMAND}`]
+        };
+    }
+    const views = (loaded.manifest.views ?? []).map((view) => {
+        const rel = `${ARCHITECTURE_MAP_DIR_REL}/views/${view.viewId}.mmd`;
+        const abs = path.join(resolved.dir, 'views', `${view.viewId}.mmd`);
+        let direction = null;
+        let nodeCount = 0;
+        let edgeCount = 0;
+        if (fs.existsSync(abs)) {
+            const text = fs.readFileSync(abs, 'utf8');
+            direction = text.match(/\bflowchart (TD|LR)\b/)?.[1] ?? null;
+            nodeCount = [...text.matchAll(/^\s*[A-Za-z0-9_]+\[/gm)].length;
+            edgeCount = [...text.matchAll(/-->/g)].length;
+        }
+        return {
+            view_id: view.viewId,
+            path: rel,
+            direction,
+            node_count: nodeCount,
+            edge_count: edgeCount,
+            byte_count: view.byteLength,
+            hash: view.contentHash
+        };
+    });
+    const result = {
+        schema: 'sks.triwiki-atlas-list.v1',
+        ok: true,
+        mode: resolved.mode,
+        mission_id: resolved.missionId,
+        views
+    };
+    return {
+        result,
+        ok: true,
+        lines: views.map((view) => `${view.view_id}  ${view.direction ?? '?'}  nodes=${view.node_count} edges=${view.edge_count} bytes=${view.byte_count} ${view.hash.slice(0, 12)}`)
+    };
+}
+async function atlasShow(root, args) {
+    const viewId = args.find((arg) => !arg.startsWith('-')) ?? '';
+    if (!viewId || !VIEW_ID_SET.has(viewId)) {
+        return {
+            result: {
+                schema: 'sks.triwiki-atlas-show.v1',
+                ok: false,
+                error_code: 'invalid_view_id',
+                allowed: [...ARCHITECTURE_MAP_VIEW_IDS]
+            },
+            ok: false,
+            lines: [
+                'Usage: sks triwiki atlas-show <view-id> [--mission <id>] [--format mermaid|json]',
+                `Allowed: ${ARCHITECTURE_MAP_VIEW_IDS.join(', ')}`
+            ]
+        };
+    }
+    if (!GLOBAL_VIEW_ID_SET.has(viewId) && !readOption(args, '--mission', '')) {
+        return {
+            result: {
+                schema: 'sks.triwiki-atlas-show.v1',
+                ok: false,
+                error_code: 'mission_view_requires_mission',
+                view_id: viewId
+            },
+            ok: false,
+            lines: [`View ${viewId} is mission-scoped; pass --mission <id>`]
+        };
+    }
+    const format = readOption(args, '--format', 'mermaid') || 'mermaid';
+    const resolved = resolveMapDir(root, args);
+    const viewPath = path.join(resolved.dir, 'views', `${viewId}.mmd`);
+    const confined = path.relative(resolved.dir, viewPath);
+    if (confined.startsWith('..') || path.isAbsolute(confined)) {
+        return {
+            result: { schema: 'sks.triwiki-atlas-show.v1', ok: false, error_code: 'path_escape' },
+            ok: false,
+            lines: ['Architecture map show blocked: path_escape']
+        };
+    }
+    if (!fs.existsSync(viewPath)) {
+        return {
+            result: {
+                schema: 'sks.triwiki-atlas-show.v1',
+                ok: false,
+                error_code: 'view_missing',
+                view_id: viewId,
+                repair_command: REPAIR_COMMAND
+            },
+            ok: false,
+            lines: [`Architecture map show: view_missing (${viewId})`, `Repair: ${REPAIR_COMMAND}`]
+        };
+    }
+    const text = fs.readFileSync(viewPath, 'utf8');
+    if (format === 'json') {
+        const result = {
+            schema: 'sks.triwiki-atlas-show.v1',
+            ok: true,
+            view_id: viewId,
+            format: 'json',
+            path: `${ARCHITECTURE_MAP_DIR_REL}/views/${viewId}.mmd`,
+            text
+        };
+        return { result, ok: true, lines: [JSON.stringify(result, null, 2)] };
+    }
+    return {
+        result: {
+            schema: 'sks.triwiki-atlas-show.v1',
+            ok: true,
+            view_id: viewId,
+            format: 'mermaid',
+            path: `${ARCHITECTURE_MAP_DIR_REL}/views/${viewId}.mmd`,
+            text
+        },
+        ok: true,
+        lines: [text.trimEnd()]
+    };
+}
+async function atlasWhy(root, args) {
+    const findingId = args.find((arg) => !arg.startsWith('-')) ?? '';
+    const missionId = readOption(args, '--mission', '');
+    if (!findingId || !missionId) {
+        return {
+            result: { schema: 'sks.triwiki-atlas-why.v1', ok: false, error_code: 'usage' },
+            ok: false,
+            lines: ['Usage: sks triwiki atlas-why <finding-id> --mission <id> [--json]']
+        };
+    }
+    const resolved = resolveMapDir(root, [`--mission`, missionId]);
+    const findings = loadFindings(resolved.dir);
+    const finding = findings.find((entry) => entry.id === findingId) ?? null;
+    if (!finding) {
+        return {
+            result: {
+                schema: 'sks.triwiki-atlas-why.v1',
+                ok: false,
+                error_code: 'finding_not_found',
+                finding_id: findingId,
+                mission_id: missionId
+            },
+            ok: false,
+            lines: [`Architecture map why: finding_not_found (${findingId})`]
+        };
+    }
+    const result = {
+        schema: 'sks.triwiki-atlas-why.v1',
+        ok: true,
+        finding_id: finding.id,
+        code: finding.code ?? null,
+        severity: finding.severity ?? null,
+        subject: finding.subjectIds ?? [],
+        evidence_path: finding.evidenceIds ?? [],
+        before: null,
+        after: null,
+        policy_rule: finding.ruleId ?? null,
+        exception: finding.disposition ?? null,
+        inspect_nodes: finding.subjectIds ?? [],
+        message: finding.message ?? null
+    };
+    return {
+        result,
+        ok: true,
+        lines: [
+            `${finding.id}: ${finding.code ?? 'unknown'} (${finding.severity ?? 'info'})`,
+            ...(finding.subjectIds?.length ? [`Subject: ${finding.subjectIds.join(', ')}`] : []),
+            ...(finding.message ? [finding.message] : [])
+        ]
+    };
+}
+export async function triwikiAtlasCommand(root, sub, args) {
+    let answer;
+    if (sub === 'atlas-status')
+        answer = await atlasStatus(root, args);
+    else if (sub === 'atlas-lint')
+        answer = await atlasLint(root, args);
+    else if (sub === 'atlas-list')
+        answer = await atlasList(root, args);
+    else if (sub === 'atlas-show')
+        answer = await atlasShow(root, args);
+    else
+        answer = await atlasWhy(root, args);
+    const usageFailed = typeof answer.result === 'object' &&
+        answer.result !== null &&
+        'error_code' in answer.result &&
+        answer.result.error_code === 'usage';
+    const invalidView = typeof answer.result === 'object' &&
+        answer.result !== null &&
+        'error_code' in answer.result &&
+        answer.result.error_code === 'invalid_view_id';
+    const exitCode = answer.ok ? 0 : usageFailed || invalidView ? 2 : 1;
+    return { ...answer, exitCode };
+}

package/dist/core/commands/triwiki-command.js

@@ -5,6 +5,7 @@ import { computeTriWikiAffectedGraph } from '../triwiki/triwiki-affected-graph.j
 import { buildTriWikiGateImpactMap } from '../triwiki/triwiki-gate-impact-map.js';
 import { DEFAULT_TRIWIKI_MODULE_CARDS } from '../triwiki/triwiki-module-card.js';
 import { summarizeTriWikiProofBank } from '../triwiki/triwiki-proof-bank.js';
+import { isTriWikiAtlasSubcommand, triwikiAtlasCommand } from './triwiki-atlas-command.js';
 import { isTriWikiGraphSubcommand, triwikiGraphCommand } from './triwiki-graph-command.js';
 export async function triwikiCommand(args = []) {
     const root = await projectRoot();
@@ -20,6 +21,16 @@ export async function triwikiCommand(args = []) {
             console.log(line);
         return answer.result;
     }
+    if (isTriWikiAtlasSubcommand(sub)) {
+        const answer = await triwikiAtlasCommand(root, sub, args.slice(1));
+        process.exitCode = answer.exitCode;
+        if (json)
+            return printJson(answer.result);
+        const stream = answer.ok ? console.log : console.error;
+        for (const line of answer.lines)
+            stream(line);
+        return answer.result;
+    }
     if (sub === 'index') {
         result = {
             schema: 'sks.triwiki-index.v1',
@@ -36,7 +47,7 @@ export async function triwikiCommand(args = []) {
         result = summarizeTriWikiProofBank(root);
     }
     else {
-        console.error('Usage: sks triwiki index|affected|proof-bank|graph-status|graph-lint|graph-query [--json]');
+        console.error('Usage: sks triwiki index|affected|proof-bank|graph-status|graph-lint|graph-query|atlas-status|atlas-lint|atlas-list|atlas-show|atlas-why [--json]');
         process.exitCode = 1;
         return null;
     }

package/dist/core/doctor/doctor-dirty-planner.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js';
@@ -104,7 +105,21 @@ function phaseInputHash(root, id) {
             return { rel, hash: 'missing' };
         return hashSemanticPath(root, rel);
     });
-    return hashJson({ id, package: packageIdentity(), files, env: phaseEnvPresence(id), semantic_state: phaseSemanticState(root, id), phase_schema_version: 2 });
+    return hashJson({
+        id,
+        package: packageIdentity(),
+        files,
+        env: phaseEnvPresence(id),
+        semantic_state: phaseSemanticState(root, id),
+        project_codex_config: hashSemanticPath(root, '.codex/config.toml').hash,
+        codex_home_config: hashFileIfExists(codexHomeConfigPath()),
+        phase_schema_version: 3
+    });
+}
+function codexHomeConfigPath() {
+    const codexHome = process.env.CODEX_HOME
+        || path.join(process.env.HOME || os.homedir(), '.codex');
+    return path.join(codexHome, 'config.toml');
 }
 function phaseInputFiles(id) {
     if (id.includes('context7'))

package/dist/core/doctor/doctor-idempotence.js

@@ -17,6 +17,8 @@ export async function runDoctorIdempotence(root) {
         blockers.push(`second_doctor_exit_${second.exit_code}`);
     if (changedFilesSecond.length > 0)
         blockers.push('second_doctor_not_noop');
+    if (!reportsChangedFiles(second))
+        blockers.push('second_doctor_changed_files_unavailable');
     const report = {
         schema: 'sks.doctor-idempotence.v1',
         ok: blockers.length === 0,
@@ -60,6 +62,15 @@ async function runDoctor(root, home, codexHome) {
         parsed
     };
 }
+function reportsChangedFiles(run) {
+    if (!run.parsed)
+        return false;
+    return [
+        run.parsed?.repair?.doctor_transaction?.changed_files,
+        run.parsed?.doctor_fix_transaction?.changed_files,
+        run.parsed?.changed_files
+    ].some((value) => Array.isArray(value));
+}
 function extractChangedFiles(run) {
     const repair = run.parsed?.repair || {};
     const candidates = [

package/dist/core/doctor/doctor-repair-postcheck.js

@@ -1,4 +1,53 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { inspectOfficialSubagentToml, readOfficialSubagentConfig } from '../subagents/official-subagent-config.js';
 import {} from './doctor-transaction.js';
+export async function verifyCodexConfigsOnDisk(input) {
+    const root = path.resolve(input.root);
+    const home = input.home || process.env.HOME || os.homedir();
+    const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(home, '.codex');
+    const projectConfigPath = path.join(root, '.codex', 'config.toml');
+    const codexHomeConfigPath = path.join(codexHome, 'config.toml');
+    const blockers = [];
+    const [projectText, homeText] = await Promise.all([
+        fs.readFile(projectConfigPath, 'utf8').catch(() => null),
+        fs.readFile(codexHomeConfigPath, 'utf8').catch(() => null)
+    ]);
+    if (projectText !== null && !inspectOfficialSubagentToml(projectText).ok) {
+        blockers.push('project_codex_config_unparseable_after_repair');
+    }
+    if (homeText !== null && !inspectOfficialSubagentToml(homeText).ok) {
+        blockers.push('codex_home_config_unparseable_after_repair');
+    }
+    let multiAgentV2Enabled = null;
+    let agentsEnabled = null;
+    if (!blockers.length) {
+        const config = await readOfficialSubagentConfig(root, { home, codexHome }).catch(() => null);
+        if (config) {
+            multiAgentV2Enabled = config.multiAgentV2.enabled;
+            agentsEnabled = config.enabled;
+            for (const blocker of config.blockers)
+                blockers.push(`official_subagent_config:${blocker}`);
+            if (multiAgentV2Enabled === false) {
+                blockers.push('official_subagent_multi_agent_v2_disabled_after_repair');
+                if (agentsEnabled === false)
+                    blockers.push('official_subagent_agents_disabled_after_repair');
+            }
+        }
+    }
+    return {
+        schema: 'sks.doctor-config-disk-verification.v1',
+        ok: blockers.length === 0,
+        project_config_path: projectConfigPath,
+        codex_home_config_path: codexHomeConfigPath,
+        project_config_present: projectText !== null,
+        codex_home_config_present: homeText !== null,
+        multi_agent_v2_enabled: multiAgentV2Enabled,
+        agents_enabled: agentsEnabled,
+        blockers: [...new Set(blockers)]
+    };
+}
 export function doctorRepairPostcheck(transaction) {
     const phases = transaction?.phases || [];
     const requiredBlockers = phases

package/dist/core/doctor/doctor-transaction.js

@@ -3,6 +3,47 @@ import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { isDoctorPhaseClean, markDoctorPhaseClean } from './doctor-dirty-planner.js';
 import { ui as cliUi } from '../../cli/cli-theme.js';
 import { messageOf } from '../errors/message.js';
+const CHANGED_PATH_KEYS = Object.freeze([
+    'repaired_paths', 'created_files', 'created', 'updated', 'changed_files',
+    'written_files', 'removed_files', 'removed', 'quarantined', 'backups'
+]);
+export function changedFilesFromRepairReport(report) {
+    const found = new Set();
+    const walk = (value, depth) => {
+        if (depth > 6 || !value || typeof value !== 'object')
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                walk(item, depth + 1);
+            return;
+        }
+        const row = value;
+        for (const key of CHANGED_PATH_KEYS) {
+            const entries = row[key];
+            if (Array.isArray(entries)) {
+                for (const entry of entries) {
+                    const text = String(entry || '').trim();
+                    if (text)
+                        found.add(text);
+                }
+            }
+            else if (typeof entries === 'string' && entries.trim()) {
+                found.add(entries.trim());
+            }
+        }
+        if (row.changed === true || row.applied === true) {
+            for (const key of ['config_path', 'backup_path', 'path', 'file']) {
+                const text = String(row[key] || '').trim();
+                if (text)
+                    found.add(text);
+            }
+        }
+        for (const nested of Object.values(row))
+            walk(nested, depth + 1);
+    };
+    walk(report, 0);
+    return [...found].sort();
+}
 export async function runDoctorFixTransaction(input) {
     const startedAt = nowIso();
     const phases = [];
@@ -110,7 +151,8 @@ export async function writeDoctorFixTransaction(input) {
         started_at: phase.started_at || null,
         completed_at: phase.completed_at || null,
         duration_ms: Number.isFinite(phase.duration_ms) ? Number(phase.duration_ms) : null,
-        rollback_performed: phase.rollback_performed === true
+        rollback_performed: phase.rollback_performed === true,
+        changed_files: [...new Set(phase.changed_files || [])].sort()
     }));
     const postcheckOk = phases.every((phase) => phase.ok || phase.required_for_ready === false);
     const mutationsWithoutRollback = phases.filter((phase) => phase.required_for_ready && phase.repaired && !phase.rollback_evidence).length;
@@ -124,6 +166,7 @@ export async function writeDoctorFixTransaction(input) {
         postcheck_ok: postcheckOk && mutationsWithoutRollback === 0,
         rollback_performed: input.rollbackPerformed === true,
         mutations_without_rollback: mutationsWithoutRollback,
+        changed_files: [...new Set(phases.flatMap((phase) => phase.changed_files))].sort(),
         raw_secret_values_recorded: false,
         skipped_clean_phases: phases.filter((phase) => phase.warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase'))).map((phase) => phase.id),
         dirty_phases: input.dirtyPlan?.phases.filter((phase) => phase.status === 'dirty').map((phase) => phase.id) || phases.filter((phase) => !phase.warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase'))).map((phase) => phase.id),
@@ -158,7 +201,9 @@ function normalizePhase(definition, result, fallback, startedMs) {
         started_at: phase.started_at || fallback.started_at || nowIso(),
         completed_at: phase.completed_at || nowIso(),
         duration_ms: phase.duration_ms ?? Math.max(0, Date.now() - startedMs),
-        rollback_performed: phase.rollback_performed === true
+        rollback_performed: phase.rollback_performed === true,
+        changed_files: phase.changed_files
+            ?? (definition.report ? changedFilesFromRepairReport(definition.report()) : [])
     };
 }
 function mergePhase(phase, update) {

package/dist/core/doctor/legacy-global-hook-cleanup.js

@@ -144,7 +144,7 @@ function projectSksHookCommand(value) {
     const command = String(value || '').trim();
     if (/[;&|`$<>\r\n]/.test(command))
         return null;
-    return command.match(/^node\s+\.\/dist\/bin\/sks\.js\s+hook\s+([a-z0-9-]+)$/i)?.[1] || null;
+    return command.match(/^(?:\S*[\\/])?(?:node\s+\S*sks\.js|sks)\s+hook\s+([a-z0-9-]+)$/i)?.[1] || null;
 }
 function hookRef(event, matcher, command) {
     return `${event}:${String(matcher ?? '')}:${command}`;