sneakoscope 9.0.0 → 9.0.2

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.0.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.0.2** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.0.0"
+version = "9.0.2"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.0.0"
+version = "9.0.2"
 edition = "2021"
 
 [dependencies]

package/dist/bin/fast-inline.js

@@ -95,12 +95,16 @@ async function hookUserPromptSubmitPerfInline() {
     })}\n`);
 }
 function findProjectRootSync(fs, start) {
+    const home = process.env.HOME || process.env.USERPROFILE || null;
+    const homeDir = home ? stripTrailingSlash(home) : null;
     let dir = normalizeStart(start);
     for (;;) {
-        if (fs.existsSync(joinPath(dir, '.sneakoscope')))
-            return dir;
-        if (fs.existsSync(joinPath(dir, 'AGENTS.md')) && fs.existsSync(joinPath(dir, 'package.json')))
-            return dir;
+        if (dir !== homeDir) {
+            if (fs.existsSync(joinPath(dir, '.sneakoscope')))
+                return dir;
+            if (fs.existsSync(joinPath(dir, 'AGENTS.md')) && fs.existsSync(joinPath(dir, 'package.json')))
+                return dir;
+        }
         const parent = parentDir(dir);
         if (parent === dir)
             return null;

package/dist/commands/bridge.js

@@ -116,7 +116,7 @@ async function parseInvocation(args, io) {
         return { ...base, request: { operation: 'status' }, label: 'Desktop Bridge status' };
     }
     if (area === 'serve' && action === undefined) {
-        allowOnly(parsed, ['--json'], ['--settings']);
+        allowOnly(parsed, ['--json', '--supervised'], ['--settings']);
         const settingsPath = parsed.values.get('--settings') || '';
         if (!path.isAbsolute(settingsPath)) {
             throw new BridgeCliError('desktop_bridge_settings_path_must_be_absolute');

package/dist/commands/doctor-console.js

@@ -0,0 +1,291 @@
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../core/codex-compat/codex-runtime-contract.js';
+import { DOCTOR_CONSOLE_NOT_MEASURED, doctorDedupeStatus, doctorSkillStatus, formatCodexDoctorConsoleStatus, nativeCapabilityStatus, sksMenuBarRunningVersionConsoleLines, uniqueNativeManualActions } from './doctor-helpers.js';
+export { DOCTOR_CONSOLE_NOT_MEASURED };
+export function renderDoctorConsoleReport(result, extras) {
+    const lines = [];
+    const line = (text) => lines.push(text);
+    const skippedOr = (skipped, measured) => (skipped ? DOCTOR_CONSOLE_NOT_MEASURED : measured);
+    const ready = result.ready || {};
+    const codex = result.codex || {};
+    const codexConfig = result.codex_config || {};
+    const oauthDiagnostic = result.oauth_callback_port_diagnostic || { conflict: false, listeners: [], warnings: [] };
+    const context7Repair = result.context7_repair || {};
+    const codexStartupRepair = result.codex_startup_repair || {};
+    const codexConfigSyntaxRepair = result.codex_config_syntax_repair;
+    const rust = result.rust || {};
+    const codexApp = result.codex_app || {};
+    const runtimeReadiness = result.runtime_readiness || { notes: [], repair_actions: [] };
+    const codexNativeFeatureMatrix = result.codex_native_feature_matrix || {};
+    const repair = result.repair || {};
+    const doctorNativeCapabilityRepair = repair.doctor_native_capability;
+    const commandAliasCleanup = result.command_aliases || {};
+    const codexAppHarnessMatrix = result.codex_app_harness_matrix || {};
+    const codexAppUi = result.codex_app_ui || {};
+    const sksMenuBar = result.sks_menubar || {};
+    const providerContext = result.provider_context || {};
+    const imagegen = result.imagegen || {};
+    const imagegenRepair = result.imagegen_repair || {};
+    const computerUseRepair = repair.computer_use || {};
+    const browserUseRepair = repair.browser_use || {};
+    const mcpTransportCollisionRepair = repair.mcp_transport_collision;
+    const codexCurrentAppSection = result.codex_current_app || {};
+    const codexCurrentAppDoctor = codexCurrentAppSection.doctor || {};
+    const pluginPolicy = codexCurrentAppSection.plugin_app_template_policy;
+    const desktopBridge = result.desktop_bridge || {};
+    const permissionProfiles = result.codex_permission_profiles || {};
+    const configRepair = repair.codex_config;
+    const migrationJournal = repair.migration_journal;
+    const sksUpdate = repair.sks_update;
+    const globalSksInstallCleanup = repair.global_sks_installs;
+    line('SKS Doctor');
+    for (const warning of result.arg_warnings || [])
+        line(`Argument warning: ${warning}`);
+    for (const warning of result.official_subagent_config?.warnings || [])
+        line(`Official subagent warning: ${warning}`);
+    line(`Root:      ${result.root}`);
+    if (extras.rootIsHome) {
+        line('Note: this is your home directory, not a project — project rows below describe the home folder. Run from your project: cd <your-project> && sks doctor');
+    }
+    line(`Node:      ${result.node?.ok ? 'ok' : 'fail'} ${result.node?.version || ''}`);
+    line(`Codex:     ${codex.bin ? 'ok' : 'missing'} ${codex.version || ''}`);
+    if (oauthDiagnostic.conflict) {
+        const listeners = (oauthDiagnostic.listeners || [])
+            .map((listener) => `${listener.command} pid ${listener.pid} ${listener.address}`)
+            .join(', ');
+        line(`OAuth callback port 1455: warning (${listeners})`);
+        for (const action of extras.oauthCallbackOperatorActions)
+            line(`  action: ${action}`);
+    }
+    const actual = (codexConfig.checks || []).find((check) => check.name === 'actual_codex_cli_config_load');
+    line('Project config:');
+    line(`  node read:       ${ready.codex_config_readable_by_node ? 'ok' : 'failed'}`);
+    line(`  codex cli read:  ${ready.codex_config_readable_by_codex_cli ? 'ok' : (actual?.status || 'failed')}`);
+    line('Context7 MCP:');
+    line(`  transport: ${context7Repair.preferred_transport || 'remote'}`);
+    line(`  repair: ${context7Repair.ok ? 'ok' : 'blocked'}`);
+    for (const action of context7Repair.actions || [])
+        line(`  - ${action}`);
+    for (const warning of context7Repair.warnings || [])
+        line(`  warning: ${warning}`);
+    line('Codex startup config:');
+    line(`  repair: ${codexStartupRepair.ok ? 'ok' : 'blocked'}`);
+    for (const action of codexStartupRepair.actions || [])
+        line(`  - ${action}`);
+    for (const action of codexStartupRepair.manual_actions || [])
+        line(`  manual: ${action}`);
+    for (const warning of codexStartupRepair.warnings || [])
+        line(`  warning: ${warning}`);
+    if (codexConfigSyntaxRepair) {
+        line('Codex config syntax:');
+        line(`  repair: ${codexConfigSyntaxRepair.ok ? 'ok' : 'blocked'}`);
+        for (const action of codexConfigSyntaxRepair.actions || [])
+            line(`  - ${action}`);
+        for (const action of codexConfigSyntaxRepair.manual_actions || [])
+            line(`  manual: ${action}`);
+        for (const warning of codexConfigSyntaxRepair.warnings || [])
+            line(`  warning: ${warning}`);
+    }
+    line(`  codex doctor:    ${formatCodexDoctorConsoleStatus(result.codex_doctor)}`);
+    line(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
+    line(`Codex App: ${codexApp.skipped === true ? DOCTOR_CONSOLE_NOT_MEASURED : ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
+    const featureMatrixSkipped = codexNativeFeatureMatrix.skipped === true;
+    line('SKS Runtime Readiness:');
+    line(`  Codex Native: ${skippedOr(featureMatrixSkipped, String(runtimeReadiness.codex_native))}`);
+    line(`  Loop Mesh: ${skippedOr(featureMatrixSkipped, String(runtimeReadiness.loop_mesh))}`);
+    line(`  QA Visual: ${skippedOr(featureMatrixSkipped, String(runtimeReadiness.qa_visual))}`);
+    line(`  Research Sources: ${skippedOr(featureMatrixSkipped, String(runtimeReadiness.research_sources))}`);
+    line(`  Image Follow-up: ${skippedOr(featureMatrixSkipped, String(runtimeReadiness.image_followup))}`);
+    if (!featureMatrixSkipped) {
+        for (const note of runtimeReadiness.notes || [])
+            line(`  ${note}`);
+        if ((runtimeReadiness.repair_actions || []).length) {
+            line('Repair actions:');
+            for (const action of runtimeReadiness.repair_actions)
+                line(`  - ${action}`);
+        }
+    }
+    const nativeCapabilitySource = doctorNativeCapabilityRepair?.native_capabilities;
+    const nativeCapabilitiesSkipped = nativeCapabilitySource?.skipped === true;
+    const nativeCapabilityRows = Array.isArray(nativeCapabilitySource?.capabilities)
+        ? nativeCapabilitySource.capabilities
+        : [];
+    const capabilityRow = (id, fallback) => skippedOr(nativeCapabilitiesSkipped, nativeCapabilityStatus(nativeCapabilityRows, id, fallback));
+    line('SKS Native Capabilities:');
+    line(`  image generation: ${capabilityRow('image_generation', 'repair_required')}`);
+    line(`  image follow-up edit: ${capabilityRow('image_followup_edit', 'degraded')}`);
+    line(`  computer use: ${capabilityRow('computer_use', 'manual_required')}`);
+    line(`  Chrome/web review: ${capabilityRow('chrome_web_review', 'manual_required')}`);
+    line(`  app screenshot: ${capabilityRow('codex_app_screenshot', 'degraded')}`);
+    line(`  app handoff: ${capabilityRow('app_handoff', 'unavailable')}`);
+    line(`  image path exposure: ${capabilityRow('image_path_exposure', 'fallback')}`);
+    const nativeManualActions = uniqueNativeManualActions(nativeCapabilityRows);
+    if (nativeManualActions.length) {
+        line('  manual next actions:');
+        for (const action of nativeManualActions)
+            line(`    - ${action}`);
+    }
+    line('SKS Skills:');
+    line(`  core skills: ${doctorSkillStatus(doctorNativeCapabilityRepair?.core_skills)}`);
+    line(`  duplicate project skills: ${doctorDedupeStatus(doctorNativeCapabilityRepair?.skill_dedupe)}`);
+    line('SKS Current Command Surface:');
+    line(`  status: ${commandAliasCleanup.status || (commandAliasCleanup.ok ? 'clean' : 'blocked')}`);
+    line(`  canonical commands: ${commandAliasCleanup.canonical_command_count ?? 0}`);
+    const managedRuntimeCleanup = commandAliasCleanup.cleanup?.managed_runtime;
+    if (managedRuntimeCleanup) {
+        line(`  managed items reconciled: ${managedRuntimeCleanup.removed_managed_artifact_count ?? 0}`);
+        line(`  user-authored collisions preserved: ${managedRuntimeCleanup.preserved_user_file_count ?? 0}`);
+    }
+    if (commandAliasCleanup.report_path)
+        line(`  report: ${commandAliasCleanup.report_path}`);
+    line('Secret preservation:');
+    line(`  Supabase keys: ${doctorNativeCapabilityRepair?.ok === false && String((doctorNativeCapabilityRepair?.blockers || []).join(' ')).includes('secret_preservation_failed') ? 'blocked' : 'preserved'}`);
+    line('  raw secret values: never recorded');
+    line(`  migration journal: ${doctorNativeCapabilityRepair?.secret_preservation_guard || '.sneakoscope/reports/secret-preservation-guard.json'}`);
+    const harnessSkipped = codexAppHarnessMatrix.skipped === true;
+    const appFeatures = codexAppHarnessMatrix.app_features || {};
+    const sksIntegrations = codexAppHarnessMatrix.sks_integrations || {};
+    line('Codex App Harness:');
+    line(`  plugins: ${skippedOr(harnessSkipped, appFeatures.plugin_json ? 'ok' : 'degraded')}`);
+    line(`  hook approval: ${skippedOr(harnessSkipped, appFeatures.hook_approval_state_detectable ? 'ok' : 'unknown')}`);
+    line(`  skills: ${skippedOr(harnessSkipped, sksIntegrations.dollar_skills_synced ? 'ok' : 'degraded')}`);
+    line(`  agent roles: ${skippedOr(harnessSkipped, sksIntegrations.agent_roles_synced ? 'ok' : 'degraded')}`);
+    line(`  native agent_type: ${skippedOr(harnessSkipped, appFeatures.agent_type_supported ? 'ok' : 'fallback message-role')}`);
+    line(`  init-deep memory: ${skippedOr(harnessSkipped, sksIntegrations.init_deep_available ? 'available' : 'missing')}`);
+    line(`  loop mesh app profile: ${skippedOr(harnessSkipped, sksIntegrations.loop_mesh_app_profile_available ? 'available' : 'missing')}`);
+    line('Codex App UI:');
+    line(`  fast selector: ${codexAppUi.fast_selector || 'unknown'}`);
+    line(`  provider selector: ${codexAppUi.provider_selector || 'unknown'}`);
+    if (Array.isArray(codexAppUi.provider_blockers) && codexAppUi.provider_blockers.length) {
+        line(`  provider blockers: ${codexAppUi.provider_blockers.join(', ')}`);
+    }
+    if (Array.isArray(codexAppUi.provider_actions) && codexAppUi.provider_actions.length) {
+        line('  provider actions:');
+        for (const action of codexAppUi.provider_actions)
+            line(`    - ${action}`);
+    }
+    line(`  host-owned config: ${codexAppUi.host_owned_config || 'unknown'}`);
+    if (Array.isArray(codexAppUi.actions) && codexAppUi.actions.some((action) => action.changed)) {
+        line('  repaired files:');
+        for (const action of codexAppUi.actions.filter((entry) => entry.changed))
+            line(`    - ${action.file}${action.backup_path ? ` (backup ${action.backup_path})` : ''}`);
+    }
+    if (codexAppUi.next_action)
+        line(`  next action: ${codexAppUi.next_action}`);
+    line('SKS Menu Bar:');
+    line(`  status: ${sksMenuBar.status || (sksMenuBar.ok ? 'ok' : 'blocked')}`);
+    for (const versionLine of sksMenuBarRunningVersionConsoleLines(sksMenuBar))
+        line(versionLine);
+    const menubarPhase = result.doctor_fix_transaction?.phases?.find((phase) => phase?.id === 'sks_menubar');
+    if (menubarPhase) {
+        const menubarSummary = menubarPhase.ok
+            ? (menubarPhase.repaired ? 'repaired' : 'verified')
+            : `blocked(${(menubarPhase.blockers || []).join(', ') || 'unknown'})`;
+        line(`  menubar: ${menubarSummary}`);
+    }
+    if (sksMenuBar.app_path)
+        line(`  app: ${sksMenuBar.app_path}`);
+    if (sksMenuBar.launch_agent_path)
+        line(`  launch agent: ${sksMenuBar.launch_agent_path}`);
+    if (Array.isArray(sksMenuBar.blockers) && sksMenuBar.blockers.length)
+        line(`  blockers: ${sksMenuBar.blockers.join(', ')}`);
+    if (Array.isArray(sksMenuBar.warnings) && sksMenuBar.warnings.length)
+        line(`  warnings: ${sksMenuBar.warnings.join(', ')}`);
+    line(`Provider: ${providerContext.provider || 'unknown'} ${providerContext.service_tier || ''} (${providerContext.source || 'unknown'}, ${providerContext.confidence || 'low'})`);
+    const imagegenReady = imagegen.auth_readiness;
+    if (imagegenReady) {
+        const paths = imagegenReady.available_paths?.length ? imagegenReady.available_paths.join(', ') : 'none';
+        line(`Image Gen: auth=${imagegenReady.auth_mode} | headless_auto=${imagegenReady.headless_auto_available ? 'available' : 'unavailable'} | paths: ${paths}`);
+        if (!imagegenReady.headless_auto_available) {
+            for (const action of imagegenReady.next_actions || [])
+                line(`  - ${action}`);
+        }
+    }
+    line(`Image Gen repair: ${skippedOr(imagegenRepair.skipped === true, String(extras.nativeCapabilityReadiness?.imagegen?.status))}`);
+    for (const action of imagegenRepair.manual_actions || [])
+        line(`  - ${action}`);
+    line(`Computer Use repair: ${skippedOr(computerUseRepair.skipped === true, computerUseRepair.recovered ? 'ok' : computerUseRepair.attempted ? 'blocked' : 'not-needed')}`);
+    for (const action of computerUseRepair.next_actions || [])
+        line(`  - ${action}`);
+    line(`Browser Use repair: ${skippedOr(browserUseRepair.skipped === true, browserUseRepair.recovered ? 'ok' : browserUseRepair.attempted ? 'blocked' : 'not-needed')}`);
+    for (const action of browserUseRepair.next_actions || [])
+        line(`  - ${action}`);
+    if (mcpTransportCollisionRepair) {
+        const collisionCount = (mcpTransportCollisionRepair.servers || []).filter((server) => server.status === 'collision_resolved').length;
+        line(`MCP transport collision repair: ${mcpTransportCollisionRepair.ok ? 'ok' : 'blocked'}${collisionCount ? ` (${collisionCount} resolved)` : ''}`);
+    }
+    line(`Agent bridge: ${extras.agentBridgeManifestExists ? 'manifest present' : 'not set up'}${extras.agentBridgeManifestExists ? '' : ' — run `sks agent-bridge setup` to publish the manifest and register with an MCP host'}`);
+    const codexCurrentApp = extras.codexCurrentAppCapability?.report || {};
+    const currentAppSkipped = extras.codexCurrentAppCapability?.skipped === true;
+    line('Codex current compatibility:');
+    line(`  target: ${CURRENT_CODEX_RUNTIME_CONTRACT.targetTag}`);
+    line(`  runtime: ${codex.version || 'unknown'}`);
+    line(`  multi-agent mode: ${skippedOr(featureMatrixSkipped, codexNativeFeatureMatrix.features?.multi_agent_mode?.ok ? 'verified' : 'unverified')}`);
+    line(`  rollout budget: ${skippedOr(featureMatrixSkipped, codexNativeFeatureMatrix.features?.rollout_budget?.ok ? 'verified' : 'unverified')}`);
+    line(`  indexed search: ${skippedOr(featureMatrixSkipped, codexNativeFeatureMatrix.features?.indexed_web_search?.ok ? 'verified' : 'unverified')}`);
+    line(`  current time: ${skippedOr(featureMatrixSkipped, codexNativeFeatureMatrix.features?.current_time_read?.ok ? 'verified' : 'unverified')}`);
+    line('Current Codex app features:');
+    line(`  /app handoff: ${skippedOr(currentAppSkipped, codexCurrentApp.supports_app_handoff ? 'ok' : 'unavailable')}`);
+    line(`  plugin JSON: ${skippedOr(currentAppSkipped, codexCurrentApp.supports_plugin_json ? 'ok' : 'unavailable')}`);
+    line(`  image path exposure: ${skippedOr(currentAppSkipped, codexCurrentApp.supports_image_path_exposure ? 'ok' : 'unavailable')}`);
+    line(`  OAuth MCP pre-refresh: ${skippedOr(currentAppSkipped, codexCurrentApp.supports_oauth_mcp_prerefresh ? 'ok' : 'unavailable')}`);
+    const pluginInventorySkipped = extras.pluginInventory?.skipped === true;
+    const pluginReport = extras.pluginInventory?.report;
+    const plugins = pluginReport?.plugins || [];
+    const remoteMcpCount = plugins.flatMap((plugin) => plugin.remote_mcp_servers || []).length;
+    const unavailableTemplates = pluginPolicy?.unavailable_app_templates?.length || 0;
+    line(`Codex plugins: ${skippedOr(pluginInventorySkipped, pluginReport ? 'ok' : 'warning')}`);
+    line(`  Remote MCP servers: ${pluginInventorySkipped ? DOCTOR_CONSOLE_NOT_MEASURED : `${remoteMcpCount} candidates`}`);
+    line(`  Unavailable app templates: ${pluginInventorySkipped ? DOCTOR_CONSOLE_NOT_MEASURED : unavailableTemplates}`);
+    for (const warning of pluginPolicy?.doctor_warnings || [])
+        line(`  warning: ${warning}`);
+    if (codexCurrentAppDoctor.fixed?.length)
+        line(`  doctor --fix repaired: ${codexCurrentAppDoctor.fixed.join(', ')}`);
+    line(`Desktop Bridge: ${desktopBridge.ok ? 'ready' : 'blocked'} (${desktopBridge.status?.readiness?.state || 'unavailable'})`);
+    for (const providerId of ['codex-lb', 'openrouter']) {
+        const provider = desktopBridge.providers?.[providerId];
+        if (!provider)
+            continue;
+        line(`  ${providerId}: ${provider.enabled ? 'enabled' : 'disabled'}; credential ${provider.credential?.state || 'unknown'} (${provider.credential?.source || 'none'}); endpoint ${provider.endpoint?.configured ? 'configured' : 'missing'}`);
+    }
+    for (const warning of desktopBridge.warnings || [])
+        line(`  warning: ${warning}`);
+    for (const blocker of desktopBridge.blockers || [])
+        line(`  blocker: ${blocker}`);
+    if (!desktopBridge.ok)
+        for (const action of desktopBridge.recovery_actions || [])
+            line(`  action: ${action}`);
+    line(`Permissions: config profile and permission profile are tracked separately (${permissionProfiles.codex_config_profile_field}, ${permissionProfiles.codex_permission_profile_field})`);
+    line('Ready:');
+    line(`  cli_ready: ${ready.cli_ready ? 'yes' : 'no'}`);
+    line(`  mad_ready: ${ready.mad_ready ? 'yes' : 'no'}`);
+    line(`  managed_state_current: ${ready.managed_state_current ? 'yes' : 'no'}`);
+    line(`  core_ready: ${ready.core_ready ? 'yes' : 'no'}`);
+    line(`  center_ready: ${ready.center_ready ? 'yes' : 'no'}${ready.center_attempted ? ' (repair attempted)' : ' (not attempted)'}`);
+    line(`  ready:     ${ready.ready ? 'yes' : 'no'}`);
+    if (!ready.ready) {
+        line('Primary blocker:');
+        line(`  ${ready.primary_blocker || 'unknown'}`);
+    }
+    if (configRepair?.repair_actions?.length) {
+        line('What I fixed:');
+        for (const action of configRepair.repair_actions)
+            line(`  - ${action.name}: ${action.ok ? 'ok' : 'failed'}`);
+    }
+    if (migrationJournal?.journal_path) {
+        line(`Migration journal: ${migrationJournal.journal_path} (${migrationJournal.event_count} events, ${migrationJournal.mutations_without_rollback} without rollback)`);
+    }
+    if (sksUpdate) {
+        line(`SKS update: ${sksUpdate.status}${sksUpdate.latest ? ` latest ${sksUpdate.latest}` : ''}${sksUpdate.error ? ` (${sksUpdate.error})` : ''}`);
+    }
+    if (globalSksInstallCleanup) {
+        line(`Global SKS installs: kept ${globalSksInstallCleanup.kept?.length ?? 0}, removed ${globalSksInstallCleanup.removed?.filter((entry) => entry.ok).length ?? 0}, source repo exempt ${globalSksInstallCleanup.candidates?.filter((entry) => entry.source_repo_exempt).length ?? 0}`);
+        if (globalSksInstallCleanup.npm_cache)
+            line(`NPM cache cleanup: ${globalSksInstallCleanup.npm_cache.status}`);
+    }
+    if (!ready.ready && ready.next_actions?.length) {
+        line('What still needs you:');
+        for (const action of ready.next_actions)
+            line(`  - ${action}`);
+    }
+    return lines;
+}

package/dist/commands/doctor-helpers.js

@@ -258,8 +258,11 @@ export function buildCodexAppUiDiagnosticFailure(apply, error) {
         blockers: [error instanceof Error ? error.message : String(error)]
     };
 }
+export const DOCTOR_CONSOLE_NOT_MEASURED = 'not measured (run: sks doctor --full)';
 export function formatCodexDoctorConsoleStatus(report) {
-    if (!report || report.available !== true)
+    if (!report)
+        return DOCTOR_CONSOLE_NOT_MEASURED;
+    if (report.available !== true)
         return 'unavailable';
     return report.disposition || (report.exit_code === 0 ? 'pass' : 'warn');
 }

package/dist/commands/doctor-profile.js

@@ -1,5 +1,15 @@
+import path from 'node:path';
 import { flag } from '../cli/args.js';
 import { sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
+export function doctorGlobalOnlySelection(input) {
+    if (!input.doctorFix)
+        return { global_only: false, reason: null };
+    if (flag(input.args, '--global-only'))
+        return { global_only: true, reason: 'explicit_flag' };
+    if (path.resolve(input.root) === path.resolve(input.home))
+        return { global_only: true, reason: 'home_is_root' };
+    return { global_only: false, reason: null };
+}
 export function doctorProfileFromArgs(args = [], doctorFix = false) {
     const explicit = readOption(args, '--profile');
     if (isDoctorProfile(explicit))

package/dist/commands/doctor.js

@@ -29,7 +29,8 @@ import { sweepSksTempDirs } from '../core/retention.js';
 import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
 import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../core/codex-compat/codex-runtime-contract.js';
 import { formatHarnessConflictReport, scanHarnessConflicts } from '../core/harness-conflicts.js';
-import { doctorArgWarnings as baseDoctorArgWarnings, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs, doctorProfileRequiresDesktopBridgeReadiness } from './doctor-profile.js';
+import { doctorArgWarnings as baseDoctorArgWarnings, doctorGlobalOnlySelection, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs, doctorProfileRequiresDesktopBridgeReadiness } from './doctor-profile.js';
+import { renderDoctorConsoleReport } from './doctor-console.js';
 import { buildCodexAppUiDiagnosticFailure, buildRuntimeReadiness, captureCodexConfigSnapshot, deferredNativeRepair, doctorDedupeStatus, doctorSkillStatus, fallbackCodexNativeFeatureMatrix, formatCodexDoctorConsoleStatus, installScopeFromArgs, isMigrationUserOwnedProjectConfigBlocker, mergeObservedCodexStartupWarnings, nativeCapabilityStatus, readOption, rebootstrapSksMenuBarLaunchdForDoctorFix, sksMenuBarRunningVersionConsoleLines, uniqueNativeManualActions, writeFixMigrationJournal, writeJsonReportFile } from './doctor-helpers.js';
 export { doctorMenuBarInstallPolicy, doctorProfileFromArgs, doctorProfileRequiresDesktopBridgeReadiness } from './doctor-profile.js';
 export { buildCodexAppUiDiagnosticFailure, buildRuntimeReadiness, formatCodexDoctorConsoleStatus, rebootstrapSksMenuBarLaunchdForDoctorFix, sksMenuBarRunningVersionConsoleLines };
@@ -134,7 +135,8 @@ export async function run(_command, args = [], deps = {}) {
         return report;
     }
     const doctorFix = flag(args, '--fix');
-    const globalOnly = doctorFix && flag(args, '--global-only');
+    const homeDir = path.resolve(deps.home || process.env.HOME || os.homedir());
+    const globalOnly = doctorGlobalOnlySelection({ args, doctorFix, root, home: homeDir }).global_only;
     if (doctorFix) {
         const conflictScan = await scanHarnessConflicts(root);
         if (conflictScan.hard_block) {
@@ -167,9 +169,7 @@ export async function run(_command, args = [], deps = {}) {
     if (!doctorFix && flag(args, '--json') && doctorProfile === 'fast')
         return runDoctorJsonFastPath(args, root);
     if (doctorFix) {
-        const guardRoot = globalOnly
-            ? path.resolve(deps.home || process.env.HOME || os.homedir())
-            : root;
+        const guardRoot = globalOnly ? homeDir : root;
         return withSecretPreservationGuard(guardRoot, 'doctor-fix', async () => (globalOnly
             ? runDoctorGlobalOnlyFix(args, root, deps)
             : runDoctor(args, root, doctorFix, deps)));
@@ -248,6 +248,7 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
                 : [])
         ].map(String).filter(Boolean))];
     const ok = blockers.length === 0;
+    const projectRootAliasDetected = path.resolve(root) === home;
     return {
         schema: 'sks.doctor-status.v3',
         elapsed_ms: Date.now() - startedAtMs,
@@ -258,7 +259,7 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         install_scope: 'global',
         root,
         home,
-        project_root_alias_detected: path.resolve(root) === home,
+        project_root_alias_detected: projectRootAliasDetected,
         no_project_writes_performed: true,
         project_phases_skipped: [
             'project_skills_reconcile',
@@ -277,6 +278,9 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         desktop_bridge: desktopBridge,
         blockers,
         next_actions: [
+            ...(projectRootAliasDetected
+                ? ['Project checks were skipped because this directory is your home folder. Run them from your project: cd <your-project> && sks doctor --fix']
+                : []),
             ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : []),
             'Run `sks doctor --fix --json` from a specific project directory when project-scoped repair is required.'
         ]
@@ -1597,246 +1601,17 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
             process.exitCode = 1;
         return;
     }
-    console.log('SKS Doctor');
-    for (const warning of argWarnings)
-        console.log(`Argument warning: ${warning}`);
-    for (const warning of officialSubagentConfig.warnings || [])
-        console.log(`Official subagent warning: ${warning}`);
-    console.log(`Root:      ${root}`);
-    console.log(`Node:      ${result.node.ok ? 'ok' : 'fail'} ${result.node.version}`);
-    console.log(`Codex:     ${codex.bin ? 'ok' : 'missing'} ${codex.version || ''}`);
-    if (oauthCallbackPortDiagnostic.conflict) {
-        const listeners = oauthCallbackPortDiagnostic.listeners
-            .map((listener) => `${listener.command} pid ${listener.pid} ${listener.address}`)
-            .join(', ');
-        console.log(`OAuth callback port 1455: warning (${listeners})`);
-        for (const action of oauthCallbackOperatorActions)
-            console.log(`  action: ${action}`);
-    }
-    const actual = (codexConfig.checks || []).find((check) => check.name === 'actual_codex_cli_config_load');
-    console.log('Project config:');
-    console.log(`  node read:       ${ready.codex_config_readable_by_node ? 'ok' : 'failed'}`);
-    console.log(`  codex cli read:  ${ready.codex_config_readable_by_codex_cli ? 'ok' : (actual?.status || 'failed')}`);
-    console.log('Context7 MCP:');
-    console.log(`  transport: ${context7Repair.preferred_transport || 'remote'}`);
-    console.log(`  repair: ${context7Repair.ok ? 'ok' : 'blocked'}`);
-    for (const action of context7Repair.actions || [])
-        console.log(`  - ${action}`);
-    for (const warning of context7Repair.warnings || [])
-        console.log(`  warning: ${warning}`);
-    console.log('Codex startup config:');
-    console.log(`  repair: ${codexStartupRepair.ok ? 'ok' : 'blocked'}`);
-    for (const action of codexStartupRepair.actions || [])
-        console.log(`  - ${action}`);
-    for (const action of codexStartupRepair.manual_actions || [])
-        console.log(`  manual: ${action}`);
-    for (const warning of codexStartupRepair.warnings || [])
-        console.log(`  warning: ${warning}`);
-    if (codexConfigSyntaxRepair) {
-        console.log('Codex config syntax:');
-        console.log(`  repair: ${codexConfigSyntaxRepair.ok ? 'ok' : 'blocked'}`);
-        for (const action of codexConfigSyntaxRepair.actions || [])
-            console.log(`  - ${action}`);
-        for (const action of codexConfigSyntaxRepair.manual_actions || [])
-            console.log(`  manual: ${action}`);
-        for (const warning of codexConfigSyntaxRepair.warnings || [])
-            console.log(`  warning: ${warning}`);
-    }
-    console.log(`  codex doctor:    ${formatCodexDoctorConsoleStatus(authoritativeCodexDoctor)}`);
-    console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
-    console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
-    console.log('SKS Runtime Readiness:');
-    console.log(`  Codex Native: ${runtimeReadiness.codex_native}`);
-    console.log(`  Loop Mesh: ${runtimeReadiness.loop_mesh}`);
-    console.log(`  QA Visual: ${runtimeReadiness.qa_visual}`);
-    console.log(`  Research Sources: ${runtimeReadiness.research_sources}`);
-    console.log(`  Image Follow-up: ${runtimeReadiness.image_followup}`);
-    for (const note of runtimeReadiness.notes)
-        console.log(`  ${note}`);
-    if (runtimeReadiness.repair_actions.length) {
-        console.log('Repair actions:');
-        for (const action of runtimeReadiness.repair_actions)
-            console.log(`  - ${action}`);
-    }
-    const nativeCapabilityRows = Array.isArray(doctorNativeCapabilityRepair?.native_capabilities?.capabilities)
-        ? doctorNativeCapabilityRepair.native_capabilities.capabilities
-        : [];
-    console.log('SKS Native Capabilities:');
-    console.log(`  image generation: ${nativeCapabilityStatus(nativeCapabilityRows, 'image_generation', 'repair_required')}`);
-    console.log(`  image follow-up edit: ${nativeCapabilityStatus(nativeCapabilityRows, 'image_followup_edit', 'degraded')}`);
-    console.log(`  computer use: ${nativeCapabilityStatus(nativeCapabilityRows, 'computer_use', 'manual_required')}`);
-    console.log(`  Chrome/web review: ${nativeCapabilityStatus(nativeCapabilityRows, 'chrome_web_review', 'manual_required')}`);
-    console.log(`  app screenshot: ${nativeCapabilityStatus(nativeCapabilityRows, 'codex_app_screenshot', 'degraded')}`);
-    console.log(`  app handoff: ${nativeCapabilityStatus(nativeCapabilityRows, 'app_handoff', 'unavailable')}`);
-    console.log(`  image path exposure: ${nativeCapabilityStatus(nativeCapabilityRows, 'image_path_exposure', 'fallback')}`);
-    const nativeManualActions = uniqueNativeManualActions(nativeCapabilityRows);
-    if (nativeManualActions.length) {
-        console.log('  manual next actions:');
-        for (const action of nativeManualActions)
-            console.log(`    - ${action}`);
-    }
-    console.log('SKS Skills:');
-    console.log(`  core skills: ${doctorSkillStatus(doctorNativeCapabilityRepair?.core_skills)}`);
-    console.log(`  duplicate project skills: ${doctorDedupeStatus(doctorNativeCapabilityRepair?.skill_dedupe)}`);
-    console.log('SKS Current Command Surface:');
-    console.log(`  status: ${commandAliasCleanup.status || (commandAliasCleanup.ok ? 'clean' : 'blocked')}`);
-    console.log(`  canonical commands: ${commandAliasCleanup.canonical_command_count ?? 0}`);
-    const managedRuntimeCleanup = commandAliasCleanup?.cleanup?.managed_runtime;
-    if (managedRuntimeCleanup) {
-        console.log(`  managed items reconciled: ${managedRuntimeCleanup.removed_managed_artifact_count ?? 0}`);
-        console.log(`  user-authored collisions preserved: ${managedRuntimeCleanup.preserved_user_file_count ?? 0}`);
-    }
-    if (commandAliasCleanup.report_path)
-        console.log(`  report: ${commandAliasCleanup.report_path}`);
-    console.log('Secret preservation:');
-    console.log(`  Supabase keys: ${doctorNativeCapabilityRepair?.ok === false && String((doctorNativeCapabilityRepair?.blockers || []).join(' ')).includes('secret_preservation_failed') ? 'blocked' : 'preserved'}`);
-    console.log('  raw secret values: never recorded');
-    console.log(`  migration journal: ${doctorNativeCapabilityRepair?.secret_preservation_guard || '.sneakoscope/reports/secret-preservation-guard.json'}`);
-    console.log('Codex App Harness:');
-    console.log(`  plugins: ${codexAppHarnessMatrix.app_features?.plugin_json ? 'ok' : 'degraded'}`);
-    console.log(`  hook approval: ${codexAppHarnessMatrix.app_features?.hook_approval_state_detectable ? 'ok' : 'unknown'}`);
-    console.log(`  skills: ${codexAppHarnessMatrix.sks_integrations?.dollar_skills_synced ? 'ok' : 'degraded'}`);
-    console.log(`  agent roles: ${codexAppHarnessMatrix.sks_integrations?.agent_roles_synced ? 'ok' : 'degraded'}`);
-    console.log(`  native agent_type: ${codexAppHarnessMatrix.app_features?.agent_type_supported ? 'ok' : 'fallback message-role'}`);
-    console.log(`  init-deep memory: ${codexAppHarnessMatrix.sks_integrations?.init_deep_available ? 'available' : 'missing'}`);
-    console.log(`  loop mesh app profile: ${codexAppHarnessMatrix.sks_integrations?.loop_mesh_app_profile_available ? 'available' : 'missing'}`);
-    const codexAppUiStatus = codexAppUi;
-    console.log('Codex App UI:');
-    console.log(`  fast selector: ${codexAppUi.fast_selector || 'unknown'}`);
-    console.log(`  provider selector: ${codexAppUi.provider_selector || 'unknown'}`);
-    if (Array.isArray(codexAppUiStatus.provider_blockers) && codexAppUiStatus.provider_blockers.length) {
-        console.log(`  provider blockers: ${codexAppUiStatus.provider_blockers.join(', ')}`);
-    }
-    if (Array.isArray(codexAppUiStatus.provider_actions) && codexAppUiStatus.provider_actions.length) {
-        console.log('  provider actions:');
-        for (const action of codexAppUiStatus.provider_actions)
-            console.log(`    - ${action}`);
-    }
-    console.log(`  host-owned config: ${codexAppUi.host_owned_config || 'unknown'}`);
-    if (Array.isArray(codexAppUi.actions) && codexAppUi.actions.some((action) => action.changed)) {
-        console.log('  repaired files:');
-        for (const action of codexAppUi.actions.filter((entry) => entry.changed))
-            console.log(`    - ${action.file}${action.backup_path ? ` (backup ${action.backup_path})` : ''}`);
-    }
-    if (codexAppUi.next_action)
-        console.log(`  next action: ${codexAppUi.next_action}`);
-    console.log('SKS Menu Bar:');
-    console.log(`  status: ${sksMenuBar.status || (sksMenuBar.ok ? 'ok' : 'blocked')}`);
-    for (const line of sksMenuBarRunningVersionConsoleLines(sksMenuBar))
-        console.log(line);
-    const menubarPhase = doctorFixTransaction?.phases?.find((phase) => phase?.id === 'sks_menubar');
-    if (menubarPhase) {
-        const menubarSummary = menubarPhase.ok
-            ? (menubarPhase.repaired ? 'repaired' : 'verified')
-            : `blocked(${(menubarPhase.blockers || []).join(', ') || 'unknown'})`;
-        console.log(`  menubar: ${menubarSummary}`);
-    }
-    if (sksMenuBar.app_path)
-        console.log(`  app: ${sksMenuBar.app_path}`);
-    if (sksMenuBar.launch_agent_path)
-        console.log(`  launch agent: ${sksMenuBar.launch_agent_path}`);
-    if (Array.isArray(sksMenuBar.blockers) && sksMenuBar.blockers.length)
-        console.log(`  blockers: ${sksMenuBar.blockers.join(', ')}`);
-    if (Array.isArray(sksMenuBar.warnings) && sksMenuBar.warnings.length)
-        console.log(`  warnings: ${sksMenuBar.warnings.join(', ')}`);
-    console.log(`Provider: ${providerContext.provider || 'unknown'} ${providerContext.service_tier || ''} (${providerContext.source || 'unknown'}, ${providerContext.confidence || 'low'})`);
-    const imagegenReady = imagegen.auth_readiness;
-    if (imagegenReady) {
-        const paths = imagegenReady.available_paths?.length ? imagegenReady.available_paths.join(', ') : 'none';
-        console.log(`Image Gen: auth=${imagegenReady.auth_mode} | headless_auto=${imagegenReady.headless_auto_available ? 'available' : 'unavailable'} | paths: ${paths}`);
-        if (!imagegenReady.headless_auto_available) {
-            for (const action of imagegenReady.next_actions || [])
-                console.log(`  - ${action}`);
-        }
-    }
-    console.log(`Image Gen repair: ${nativeCapabilityReadiness.imagegen.status}`);
-    for (const action of imagegenRepair.manual_actions || [])
-        console.log(`  - ${action}`);
-    console.log(`Computer Use repair: ${computerUseRepair.recovered ? 'ok' : computerUseRepair.attempted ? 'blocked' : 'not-needed'}`);
-    for (const action of computerUseRepair.next_actions || [])
-        console.log(`  - ${action}`);
-    console.log(`Browser Use repair: ${browserUseRepair.recovered ? 'ok' : browserUseRepair.attempted ? 'blocked' : 'not-needed'}`);
-    for (const action of browserUseRepair.next_actions || [])
-        console.log(`  - ${action}`);
-    if (mcpTransportCollisionRepair) {
-        const collisionCount = (mcpTransportCollisionRepair.servers || []).filter((s) => s.status === 'collision_resolved').length;
-        console.log(`MCP transport collision repair: ${mcpTransportCollisionRepair.ok ? 'ok' : 'blocked'}${collisionCount ? ` (${collisionCount} resolved)` : ''}`);
-    }
-    {
-        const manifestPath = path.join(root, '.sneakoscope', 'agent-bridge', 'manifest.json');
-        const manifestExists = await exists(manifestPath);
-        console.log(`Agent bridge: ${manifestExists ? 'manifest present' : 'not set up'}${manifestExists ? '' : ' — run `sks agent-bridge setup` to publish the manifest and register with an MCP host'}`);
-    }
-    const codexCurrentApp = codexCurrentAppCapability.report || {};
-    console.log('Codex current compatibility:');
-    console.log(`  target: ${CURRENT_CODEX_RUNTIME_CONTRACT.targetTag}`);
-    console.log(`  runtime: ${codex.version || 'unknown'}`);
-    console.log(`  multi-agent mode: ${codexNativeFeatureMatrix.features?.multi_agent_mode?.ok ? 'verified' : 'unverified'}`);
-    console.log(`  rollout budget: ${codexNativeFeatureMatrix.features?.rollout_budget?.ok ? 'verified' : 'unverified'}`);
-    console.log(`  indexed search: ${codexNativeFeatureMatrix.features?.indexed_web_search?.ok ? 'verified' : 'unverified'}`);
-    console.log(`  current time: ${codexNativeFeatureMatrix.features?.current_time_read?.ok ? 'verified' : 'unverified'}`);
-    console.log('Current Codex app features:');
-    console.log(`  /app handoff: ${codexCurrentApp.supports_app_handoff ? 'ok' : 'unavailable'}`);
-    console.log(`  plugin JSON: ${codexCurrentApp.supports_plugin_json ? 'ok' : 'unavailable'}`);
-    console.log(`  image path exposure: ${codexCurrentApp.supports_image_path_exposure ? 'ok' : 'unavailable'}`);
-    console.log(`  OAuth MCP pre-refresh: ${codexCurrentApp.supports_oauth_mcp_prerefresh ? 'ok' : 'unavailable'}`);
-    const plugins = pluginInventory?.report?.plugins || [];
-    const remoteMcpCount = plugins.flatMap((plugin) => plugin.remote_mcp_servers || []).length;
-    const unavailableTemplates = pluginPolicy?.unavailable_app_templates?.length || 0;
-    console.log(`Codex plugins: ${pluginInventory?.report ? 'ok' : 'warning'}`);
-    console.log(`  Remote MCP servers: ${remoteMcpCount} candidates`);
-    console.log(`  Unavailable app templates: ${unavailableTemplates}`);
-    for (const warning of pluginPolicy?.doctor_warnings || [])
-        console.log(`  warning: ${warning}`);
-    if (codexCurrentAppDoctor?.fixed?.length)
-        console.log(`  doctor --fix repaired: ${codexCurrentAppDoctor.fixed.join(', ')}`);
-    console.log(`Desktop Bridge: ${desktopBridge.ok ? 'ready' : 'blocked'} (${desktopBridge.status?.readiness?.state || 'unavailable'})`);
-    for (const providerId of ['codex-lb', 'openrouter']) {
-        const provider = desktopBridge.providers?.[providerId];
-        if (!provider)
-            continue;
-        console.log(`  ${providerId}: ${provider.enabled ? 'enabled' : 'disabled'}; credential ${provider.credential?.state || 'unknown'} (${provider.credential?.source || 'none'}); endpoint ${provider.endpoint?.configured ? 'configured' : 'missing'}`);
-    }
-    for (const warning of desktopBridge.warnings || [])
-        console.log(`  warning: ${warning}`);
-    for (const blocker of desktopBridge.blockers || [])
-        console.log(`  blocker: ${blocker}`);
-    if (!desktopBridge.ok)
-        for (const action of desktopBridge.recovery_actions || [])
-            console.log(`  action: ${action}`);
-    console.log(`Permissions: config profile and permission profile are tracked separately (${permissionProfiles.codex_config_profile_field}, ${permissionProfiles.codex_permission_profile_field})`);
-    console.log('Ready:');
-    console.log(`  cli_ready: ${ready.cli_ready ? 'yes' : 'no'}`);
-    console.log(`  mad_ready: ${ready.mad_ready ? 'yes' : 'no'}`);
-    console.log(`  managed_state_current: ${ready.managed_state_current ? 'yes' : 'no'}`);
-    console.log(`  core_ready: ${ready.core_ready ? 'yes' : 'no'}`);
-    console.log(`  center_ready: ${ready.center_ready ? 'yes' : 'no'}${ready.center_attempted ? ' (repair attempted)' : ' (not attempted)'}`);
-    console.log(`  ready:     ${ready.ready ? 'yes' : 'no'}`);
-    if (!ready.ready) {
-        console.log('Primary blocker:');
-        console.log(`  ${ready.primary_blocker || 'unknown'}`);
-    }
-    if (configRepair?.repair_actions?.length) {
-        console.log('What I fixed:');
-        for (const action of configRepair.repair_actions)
-            console.log(`  - ${action.name}: ${action.ok ? 'ok' : 'failed'}`);
-    }
-    if (migrationJournal?.journal_path) {
-        console.log(`Migration journal: ${migrationJournal.journal_path} (${migrationJournal.event_count} events, ${migrationJournal.mutations_without_rollback} without rollback)`);
-    }
-    if (sksUpdate) {
-        console.log(`SKS update: ${sksUpdate.status}${sksUpdate.latest ? ` latest ${sksUpdate.latest}` : ''}${sksUpdate.error ? ` (${sksUpdate.error})` : ''}`);
-    }
-    if (globalSksInstallCleanup) {
-        console.log(`Global SKS installs: kept ${globalSksInstallCleanup.kept?.length ?? 0}, removed ${globalSksInstallCleanup.removed?.filter((entry) => entry.ok).length ?? 0}, source repo exempt ${globalSksInstallCleanup.candidates?.filter((entry) => entry.source_repo_exempt).length ?? 0}`);
-        if (globalSksInstallCleanup.npm_cache)
-            console.log(`NPM cache cleanup: ${globalSksInstallCleanup.npm_cache.status}`);
-    }
-    if (!ready.ready && ready.next_actions?.length) {
-        console.log('What still needs you:');
-        for (const action of ready.next_actions)
-            console.log(`  - ${action}`);
-    }
+    const agentBridgeManifestExists = await exists(path.join(root, '.sneakoscope', 'agent-bridge', 'manifest.json'));
+    const consoleLines = renderDoctorConsoleReport(result, {
+        oauthCallbackOperatorActions,
+        nativeCapabilityReadiness,
+        agentBridgeManifestExists,
+        codexCurrentAppCapability,
+        pluginInventory,
+        rootIsHome: path.resolve(root) === path.resolve(deps.home || process.env.HOME || os.homedir())
+    });
+    for (const consoleLine of consoleLines)
+        console.log(consoleLine);
     if (!result.ok)
         process.exitCode = 1;
 }

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.0.0",
+  "package_version": "9.0.2",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -252,6 +252,15 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
             upstream.once('response', (response) => {
                 const statusCode = response.statusCode || 502;
                 if (statusCode >= 400) {
+                    logHttpRejection({
+                        code: `bridge_upstream_status_${statusCode}`,
+                        transport: 'http',
+                        ...(req.method === undefined ? {} : { method: req.method }),
+                        ...(req.url === undefined ? {} : { url: req.url }),
+                        status: statusCode,
+                        provider_id: provider.provider_id,
+                        public_model: request.route.public_model,
+                    });
                     void readRedactedUpstreamError(response).then((body) => {
                         responseStarted = true;
                         const responseHeaders = rewriteResponseHeaders(response.headers, provider.base_url, authenticatedLocalBaseUrl);

package/dist/core/codex-lb/desktop-bridge/rejection-log.js

@@ -2,6 +2,10 @@ import { PACKAGE_VERSION } from '../../version.js';
 export const DESKTOP_BRIDGE_LOG_SCHEMA = 'sks.desktop-bridge-log.v2';
 export const REJECTION_LOG_BURST = 5;
 export const REJECTION_LOG_SUMMARY_INTERVAL_MS = 60_000;
+function safeCatalogId(value) {
+    const text = String(value ?? '').replace(/[\r\n\0]/g, '').trim().slice(0, 128);
+    return text.length > 0 ? text : null;
+}
 function safePathname(url) {
     const raw = String(url || '').trim();
     if (!raw.startsWith('/'))
@@ -62,6 +66,8 @@ export function createDesktopBridgeRejectionLogger(options = {}) {
         windows.set(code, window);
         const pathname = safePathname(event.url);
         const method = safeMethod(event.method);
+        const providerId = safeCatalogId(event.provider_id);
+        const publicModel = safeCatalogId(event.public_model);
         emit({
             event: 'sks.desktop_bridge.rejected',
             code,
@@ -69,6 +75,8 @@ export function createDesktopBridgeRejectionLogger(options = {}) {
             ...(method ? { method } : {}),
             ...(pathname ? { pathname } : {}),
             ...(Number.isInteger(event.status) ? { status: event.status } : {}),
+            ...(providerId ? { provider_id: providerId } : {}),
+            ...(publicModel ? { public_model: publicModel } : {}),
         });
     };
 }

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -6,6 +6,7 @@ import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { assertAllowedOrigin, assertAllowedPath, assertLoopbackPeer, assertLoopbackListenHost, assertWebSocketUpgrade, prepareDesktopBridgeConfig, safeBridgeErrorCode, validatePreparedDesktopBridgeConfig, } from './security.js';
 import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridgeStatePath, refreshDesktopBridgeState, removeDesktopBridgeStateIfOwned, writeDesktopBridgeState, } from './state.js';
 import { DesktopBridgeError } from './types.js';
+import { PACKAGE_VERSION } from '../../version.js';
 import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL } from './types.js';
 import { forwardWebSocket } from './websocket-forward.js';
 function authenticateDesktopBridgeClient(req, input) {
@@ -316,6 +317,27 @@ export async function startPreparedDesktopBridge(input, options = {}) {
         void refreshDesktopBridgeState(statePath, state, new Date(), freshnessMs).catch(() => undefined);
     }, Math.max(1_000, Math.floor(freshnessMs / 3))) : null;
     heartbeat?.unref();
+    let skewCandidate = null;
+    let skewFired = false;
+    const versionCheck = options.versionSkew ? setInterval(() => {
+        void options.versionSkew.readInstalledVersion().then((installed) => {
+            if (skewFired)
+                return;
+            if (!installed || installed === PACKAGE_VERSION) {
+                skewCandidate = null;
+                return;
+            }
+            if (skewCandidate !== installed) {
+                skewCandidate = installed;
+                return;
+            }
+            skewFired = true;
+            if (versionCheck)
+                clearInterval(versionCheck);
+            options.versionSkew.onSkew(installed);
+        }).catch(() => undefined);
+    }, Math.max(1_000, options.versionSkew.intervalMs ?? 60_000)) : null;
+    versionCheck?.unref();
     let stopped = false;
     const handle = {
         server,
@@ -328,6 +350,8 @@ export async function startPreparedDesktopBridge(input, options = {}) {
             stopped = true;
             if (heartbeat)
                 clearInterval(heartbeat);
+            if (versionCheck)
+                clearInterval(versionCheck);
             await closeServer(server, sockets, () => activeRequests);
             destroyDesktopBridgeUpstreamAgents();
             if (statePath)

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -152,14 +152,10 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         connected = true;
         clearTimeout(timer);
         upstream.setNoDelay(true);
-        upstream.setTimeout(config.idleTimeoutMs, () => {
-            logWebSocketRejection({
-                code: 'bridge_websocket_upstream_idle_timeout',
-                transport: 'websocket',
-                ...(req.url === undefined ? {} : { url: req.url }),
-            });
-            upstream.destroy(new DesktopBridgeError('bridge_websocket_upstream_idle_timeout'));
-        });
+        upstream.setKeepAlive(true, 30_000);
+        const clientSocket = client;
+        if (typeof clientSocket.setKeepAlive === 'function')
+            clientSocket.setKeepAlive(true, 30_000);
         const headers = buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential }, target.host);
         upstream.write([`${req.method || 'GET'} ${target.pathname}${target.search} HTTP/1.1`, ...serializeHeaders(headers), '', ''].join('\r\n'));
         if (head.length)

package/dist/core/codex-lb/desktop-service.js

@@ -3,7 +3,7 @@ import { constants as fsConstants } from 'node:fs';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { ensureDir, exists, runProcess, which, writeTextAtomic } from '../fsx.js';
+import { ensureDir, exists, packageRoot, runProcess, which, writeTextAtomic } from '../fsx.js';
 import { withFileLock } from '../locks/file-lock.js';
 import { loadCodexLbEnv } from './codex-lb-env.js';
 import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
@@ -352,7 +352,7 @@ export async function installAndStartDesktopBridgeService(options = {}) {
         return failedStatus(paths, settings, launchService(options.uid), 'settings_missing', 'desktop_bridge_sks_executable_missing');
     await prepareDesktopBridgeServicePaths(paths);
     await writeDesktopBridgeServiceSettings(paths.settings_path, { ...settings, provider_registry: runtime.config.providerRegistry, route_policy: runtime.config.routePolicy });
-    await writeDesktopBridgeLaunchdPlist(paths.launch_agent_path, { executablePath: command.executable, arguments: [...command.arguments, 'bridge', 'serve', '--settings', paths.settings_path, '--json'], stdoutPath: paths.stdout_log_path, stderrPath: paths.stderr_log_path });
+    await writeDesktopBridgeLaunchdPlist(paths.launch_agent_path, { executablePath: command.executable, arguments: [...command.arguments, 'bridge', 'serve', '--settings', paths.settings_path, '--json', '--supervised'], stdoutPath: paths.stdout_log_path, stderrPath: paths.stderr_log_path });
     const run = options.run || runProcess;
     const ctl = options.launchctl || '/bin/launchctl';
     const service = launchService(options.uid);
@@ -421,11 +421,36 @@ export async function stopDesktopBridgeService(options = {}) {
     const status = await desktopBridgeServiceStatus({ ...options, home });
     return { ...status, ok: !status.running, blockers: status.running ? ['desktop_bridge_process_still_running'] : [] };
 }
+function desktopBridgeIsSupervised(env = process.env, argv = process.argv) {
+    return env.XPC_SERVICE_NAME === DESKTOP_BRIDGE_LAUNCHD_LABEL || argv.includes('--supervised');
+}
+async function installedPackageVersion() {
+    try {
+        const raw = await fsp.readFile(path.join(packageRoot(), 'package.json'), 'utf8');
+        const version = JSON.parse(raw).version;
+        return typeof version === 'string' && version.length > 0 ? version : null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function serveDesktopBridge(options = {}) {
     let handle = null;
     try {
         const runtime = await resolveDesktopBridgeRuntimeConfig(options);
-        handle = await startPreparedDesktopBridge(await preflightDesktopBridge(runtime.config), { statePath: runtime.paths.state_path });
+        const supervised = desktopBridgeIsSupervised();
+        handle = await startPreparedDesktopBridge(await preflightDesktopBridge(runtime.config), {
+            statePath: runtime.paths.state_path,
+            versionSkew: {
+                readInstalledVersion: installedPackageVersion,
+                onSkew: (installedVersion) => {
+                    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.version_skew', running: PACKAGE_VERSION, installed: installedVersion, supervised, action: supervised ? 'restarting' : 'logged_only', secret_fields_redacted: true })}\n`);
+                    if (!supervised)
+                        return;
+                    void handle?.stop().catch(() => undefined).finally(() => process.exit(64));
+                },
+            },
+        });
         process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.started', pid: handle.state.pid, process_generation: handle.state.schema === DESKTOP_BRIDGE_STATE_SCHEMA ? handle.state.process_generation : null, provider_registry_generation: runtime.config.providerRegistry?.generation, route_policy_generation: runtime.config.routePolicy?.policy_generation, secret_fields_redacted: true })}\n`);
         await waitForShutdown(handle);
         return { schema: 'sks.desktop-bridge-serve.v1', ok: true, status: 'stopped', state: handle.state };

package/dist/core/fsx.js

@@ -342,17 +342,23 @@ export async function findUp(start, names) {
 }
 export async function findProjectRoot(start = process.cwd()) {
     const resolved = path.resolve(start);
-    const sine = await findUp(resolved, ['.sneakoscope', '.dcodex']);
-    if (sine) {
-        const rootDir = path.dirname(sine);
-        if (rootDir !== path.parse(rootDir).root)
-            return rootDir;
-    }
-    const git = await findUp(resolved, ['.git']);
-    if (git) {
-        const rootDir = path.dirname(git);
-        if (rootDir !== path.parse(rootDir).root)
-            return rootDir;
+    const home = path.resolve(os.homedir());
+    for (const markers of [['.sneakoscope', '.dcodex'], ['.git']]) {
+        let from = resolved;
+        while (true) {
+            const marker = await findUp(from, markers);
+            if (!marker)
+                break;
+            const rootDir = path.dirname(marker);
+            if (rootDir === path.parse(rootDir).root)
+                break;
+            if (rootDir !== home)
+                return rootDir;
+            const parent = path.dirname(rootDir);
+            if (parent === rootDir)
+                break;
+            from = parent;
+        }
     }
     return null;
 }

package/dist/core/triwiki/context-graph/paths.js

@@ -106,11 +106,3 @@ export function contextGraphExperimentLogPath(root) {
 export function contextPackPath(root) {
     return path.join(contextGraphDir(root), 'context-pack.json');
 }
-export function contextGraphArtifactPaths(root) {
-    return [
-        contextGraphSnapshotPath(root),
-        contextGraphMetaPath(root),
-        contextGraphPrevSnapshotPath(root),
-        contextGraphEventLogPath(root)
-    ];
-}

package/dist/core/update/update-migration-state/desktop-bridge-restage.js

@@ -0,0 +1,46 @@
+import os from 'node:os';
+import path from 'node:path';
+import { exists, PACKAGE_VERSION, readJson, runProcess } from '../../fsx.js';
+export async function runDesktopBridgeRestageStage() {
+    const skip = (reason) => ({ ok: true, status: 'ok', actions: [reason], blockers: [], warnings: [] });
+    if (process.platform !== 'darwin')
+        return skip('desktop_bridge_restage_not_macos');
+    if (process.env.NODE_TEST_CONTEXT !== undefined)
+        return skip('desktop_bridge_restage_skipped_under_tests');
+    if (process.env.SKS_SKIP_BRIDGE_RESTAGE === '1')
+        return skip('desktop_bridge_restage_disabled');
+    const home = os.homedir();
+    const plist = path.join(home, 'Library', 'LaunchAgents', 'com.sneakoscope.desktop-bridge.plist');
+    if (!(await exists(plist)))
+        return skip('desktop_bridge_restage_no_launch_agent');
+    const state = await readJson(path.join(home, '.codex', 'sks', 'desktop-bridge-state.json'), null);
+    const runningVersion = typeof state?.sks_version === 'string' ? state.sks_version : null;
+    const pid = typeof state?.pid === 'number' && Number.isInteger(state.pid) && state.pid > 1 ? state.pid : null;
+    if (!pid)
+        return skip('desktop_bridge_restage_no_running_bridge');
+    try {
+        process.kill(pid, 0);
+    }
+    catch {
+        return skip('desktop_bridge_restage_no_running_bridge');
+    }
+    if (runningVersion === PACKAGE_VERSION)
+        return skip('desktop_bridge_restage_already_current');
+    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    if (uid === null)
+        return skip('desktop_bridge_restage_no_uid');
+    const kick = await runProcess('/bin/launchctl', ['kickstart', '-k', `gui/${uid}/com.sneakoscope.desktop-bridge`], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch(() => null);
+    if (!kick || kick.code !== 0) {
+        return {
+            ok: true, status: 'ok',
+            actions: [],
+            blockers: [],
+            warnings: [`desktop_bridge_restage_kickstart_failed:${runningVersion || 'pre-8.6.2'}`]
+        };
+    }
+    return {
+        ok: true, status: 'ok',
+        actions: [`desktop_bridge_restarted:${runningVersion || 'pre-8.6.2'}:${PACKAGE_VERSION}`],
+        blockers: [], warnings: []
+    };
+}

package/dist/core/update/update-migration-state.js

@@ -10,6 +10,7 @@ import { enforceRetention } from '../retention.js';
 import { COMMANDS } from '../../cli/command-registry.js';
 import { reconcileLegacyManagedGeneration } from '../init/legacy-generation-convergence.js';
 import { runConfigFastModeNormalizeStage } from './update-migration-state/fast-mode-config.js';
+import { runDesktopBridgeRestageStage } from './update-migration-state/desktop-bridge-restage.js';
 import { runSessionStateSplitStage } from './update-migration-state/session-state-split.js';
 import { runHookTrustRefreshStage, runOtherHarnessCleanupStage } from './update-migration-state/simple-stages.js';
 import { compareSemVer } from './semver.js';
@@ -258,6 +259,11 @@ const UPDATE_MIGRATION_STAGES = [
         id: 'receipt-rotation',
         min_from_version: '0.0.0',
         run: runReceiptRotationStage
+    },
+    {
+        id: 'desktop-bridge-restage',
+        min_from_version: '0.0.0',
+        run: runDesktopBridgeRestageStage
     }
 ];
 async function runCurrentPublicSurfaceReconcileStage(root) {
@@ -325,7 +331,7 @@ async function runCurrentPublicSurfaceReconcileStage(root) {
         }
     };
 }
-async function runUpdateMigrationStages(root, opts = {}) {
+export async function runUpdateMigrationStages(root, opts = {}) {
     const fromVersion = opts.fromVersion || null;
     const runs = [];
     for (const stage of UPDATE_MIGRATION_STAGES) {

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '9.0.0';
+export const PACKAGE_VERSION = '9.0.2';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "9.0.0",
+  "version": "9.0.2",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",