sneakoscope 9.0.5 → 9.0.6

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.0.5** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.0.6** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.0.5"
+version = "9.0.6"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.0.5"
+version = "9.0.6"
 edition = "2021"
 
 [dependencies]

package/dist/commands/doctor.js

@@ -7,10 +7,8 @@ import { ui as cliUi } from '../cli/cli-theme.js';
 import { getCodexInfo } from '../core/codex-adapter.js';
 import { rustInfo } from '../core/rust-accelerator.js';
 import { codexAppIntegrationStatus } from '../core/codex-app.js';
-import { desktopBridgeStatusV3, executeDesktopBridgeCommandV3 } from '../core/codex-lb/desktop-controller-v3.js';
-import { bootstrapExistingDesktopBridgeService, desktopBridgeServiceStatus } from '../core/codex-lb/desktop-service.js';
-import { desktopBridgeRuntimeVersion, desktopBridgeRuntimeVersionStale } from '../core/codex-lb/desktop-bridge/state.js';
-import { PACKAGE_VERSION } from '../core/version.js';
+import { desktopBridgeStatusV3 } from '../core/codex-lb/desktop-controller-v3.js';
+import { repairDoctorDesktopBridgeCatalog } from '../core/doctor/desktop-bridge-catalog-repair.js';
 import { inspectCodexConfigReadability } from '../core/codex/codex-config-readability.js';
 import { inspectOAuthCallbackPortConflict, oauthCallbackDoctorGuidance } from '../core/codex/oauth-callback-port-diagnostic.js';
 import { inventoryCodexPermissionProfiles } from '../core/codex/codex-permission-profiles.js';
@@ -37,29 +35,7 @@ export { buildCodexAppUiDiagnosticFailure, buildRuntimeReadiness, formatCodexDoc
 export function doctorArgWarnings(args = []) {
     return baseDoctorArgWarnings(args);
 }
-export async function restartStaleDesktopBridgeRuntime(input) {
-    if (process.env.SKS_TEST_ISOLATION === '1' || process.env.SKS_RELEASE_UPGRADE_SMOKE === '1') {
-        return { restarted: false, warnings: [], blockers: [] };
-    }
-    const service = await desktopBridgeServiceStatus({ home: input.home }).catch(() => null);
-    if (!service?.running || !desktopBridgeRuntimeVersionStale(service.state)) {
-        return { restarted: false, warnings: [], blockers: [] };
-    }
-    const running = desktopBridgeRuntimeVersion(service.state) || 'pre-8.6.2';
-    if (!input.fix) {
-        return {
-            restarted: false,
-            warnings: [],
-            blockers: [`desktop_bridge_runtime_version_stale:${running}:${PACKAGE_VERSION}`]
-        };
-    }
-    const restarted = await bootstrapExistingDesktopBridgeService({ home: input.home }).catch(() => null);
-    const nowRunning = restarted?.running === true && !desktopBridgeRuntimeVersionStale(restarted.state);
-    return nowRunning
-        ? { restarted: true, warnings: [`desktop_bridge_runtime_restarted:${running}:${PACKAGE_VERSION}`], blockers: [] }
-        : { restarted: false, warnings: [], blockers: [`desktop_bridge_runtime_version_stale:${running}:${PACKAGE_VERSION}`] };
-}
-export const CATALOG_REPAIR_MAX_ATTEMPTS = 2;
+export { CATALOG_REPAIR_MAX_ATTEMPTS, repairDoctorDesktopBridgeCatalog, restartStaleDesktopBridgeRuntime } from '../core/doctor/desktop-bridge-catalog-repair.js';
 export function deferCommandAliasCleanupToMigrationReceipt(result) {
     const observedBlockers = Array.isArray(result?.blockers)
         ? result.blockers.map(String).filter(Boolean)
@@ -214,19 +190,41 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         status: 'failed',
         error: err?.message || String(err)
     }));
-    const menuBar = await installMenuBarImpl({
-        home,
-        root: home,
-        apply: true,
-        launch: !sksMenuBarRestartDeferred(doctorEnv),
-        env: doctorEnv,
-        quiet: flag(args, '--json') || flag(args, '--machine-only')
-    }).catch((err) => ({
-        schema: 'sks.codex-app-sks-menubar.v1',
+    const doctorProfile = doctorProfileFromArgs(args, true);
+    const menuBarPolicy = doctorMenuBarInstallPolicy(args, true, doctorEnv);
+    const menuBar = menuBarPolicy.phase_enabled
+        ? await installMenuBarImpl({
+            home,
+            root: home,
+            apply: true,
+            launch: !sksMenuBarRestartDeferred(doctorEnv),
+            env: doctorEnv,
+            quiet: flag(args, '--json') || flag(args, '--machine-only')
+        }).catch((err) => ({
+            schema: 'sks.codex-app-sks-menubar.v1',
+            ok: false,
+            status: 'blocked',
+            blockers: [err?.message || String(err)],
+            warnings: []
+        }))
+        : {
+            schema: 'sks.codex-app-sks-menubar.v1',
+            ok: true,
+            status: 'skipped_by_profile',
+            skipped: true,
+            blockers: [],
+            warnings: [`sks_menubar_phase_skipped_for_profile:${doctorProfile}`]
+        };
+    const desktopBridgeRepairImpl = deps.desktopBridgeRepairImpl || repairDoctorDesktopBridgeCatalog;
+    const desktopBridgeRepair = await desktopBridgeRepairImpl({ fix: true }).catch((err) => ({
+        id: 'desktop_bridge_catalog_repair',
         ok: false,
-        status: 'blocked',
-        blockers: [err?.message || String(err)],
-        warnings: []
+        repaired: false,
+        required_for_ready: false,
+        manual_required: false,
+        warnings: [],
+        blockers: [`desktop_bridge_catalog_repair_failed:${err?.message || String(err)}`],
+        rollback_evidence: 'combined_catalog_previous_generation_preserved'
     }));
     const desktopBridge = await inspectDoctorDesktopBridgeStatus({
         home,
@@ -238,15 +236,54 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
     const globalFastModeReady = globalFastMode?.status !== 'failed'
         && globalFastMode?.ok !== false;
     const menuBarReady = menuBar?.ok !== false;
-    const blockers = [...new Set([
+    const migrationScopeBlockers = [...new Set([
             ...(!globalSkillsReady ? [`global_skills_reconcile_failed:${globalSkills?.error || 'core_skill_integrity'}`] : []),
             ...(currentSurface?.ok !== true ? (currentSurface?.blockers || ['global_current_surface_reconcile_failed']) : []),
-            ...(!globalFastModeReady ? [`global_fast_mode_repair_failed:${globalFastMode?.error || globalFastMode?.status || 'unknown'}`] : []),
-            ...(!menuBarReady ? (menuBar?.blockers || ['sks_menubar_repair_failed']) : []),
+            ...(!globalFastModeReady ? [`global_fast_mode_repair_failed:${globalFastMode?.error || globalFastMode?.status || 'unknown'}`] : [])
+        ].map(String).filter(Boolean))];
+    const bridgeBlockers = [...new Set([
+            ...(desktopBridgeRepair?.ok === false
+                ? (desktopBridgeRepair?.blockers?.length ? desktopBridgeRepair.blockers : ['desktop_bridge_catalog_repair_failed'])
+                : []),
             ...(desktopBridge.ok === false
                 ? (desktopBridge.blockers || ['desktop_bridge_unavailable'])
                 : [])
         ].map(String).filter(Boolean))];
+    const bridgeReadinessRequired = doctorProfileRequiresDesktopBridgeReadiness(doctorProfile);
+    let migrationReceipt = null;
+    if (doctorProfile === 'migration') {
+        const writeReceiptImpl = deps.writeProjectUpdateMigrationReceiptImpl || writeProjectUpdateMigrationReceipt;
+        migrationReceipt = await writeReceiptImpl({
+            root: home,
+            source: `doctor-${doctorProfile}`,
+            blockers: migrationScopeBlockers,
+            warnings: ['global_only_home_scope_migration_receipt'],
+            ...(migrationScopeBlockers.length ? { status: 'blocked' } : {})
+        }).catch((err) => ({
+            schema: 'sks.project-migration-receipt.v2',
+            status: 'blocked',
+            sks_version: null,
+            root: home,
+            source: `doctor-${doctorProfile}`,
+            generated_at: new Date().toISOString(),
+            blockers: [`migration_receipt_failed:${err?.message || String(err)}`],
+            warnings: []
+        }));
+    }
+    const migrationReceiptBlockers = migrationReceipt && !isUpdateMigrationReceiptCurrent(migrationReceipt)
+        ? ((migrationReceipt.blockers || []).length ? migrationReceipt.blockers : ['global_migration_receipt_not_current'])
+        : [];
+    const blockers = [...new Set([
+            ...migrationScopeBlockers,
+            ...(!menuBarReady ? (menuBar?.blockers || ['sks_menubar_repair_failed']) : []),
+            ...(bridgeReadinessRequired ? bridgeBlockers : []),
+            ...migrationReceiptBlockers
+        ].map(String).filter(Boolean))];
+    const warnings = [...new Set([
+            ...(!bridgeReadinessRequired ? bridgeBlockers.map((blocker) => `migration_optional_blocker:${blocker}`) : []),
+            ...(desktopBridgeRepair?.warnings || []),
+            ...(desktopBridge?.warnings || [])
+        ].map(String).filter(Boolean))];
     const ok = blockers.length === 0;
     const projectRootAliasDetected = path.resolve(root) === home;
     return {
@@ -257,6 +294,7 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         diagnostic_depth: 'global-only',
         global_only: true,
         install_scope: 'global',
+        doctor_profile: doctorProfile,
         root,
         home,
         project_root_alias_detected: projectRootAliasDetected,
@@ -268,20 +306,26 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
             'project_supabase_mcp_repair',
             'project_hook_trust_repair',
             'project_command_alias_cleanup',
-            'project_migration_receipt'
+            ...(migrationReceipt ? [] : ['project_migration_receipt'])
         ],
         skills: { global: globalSkills, project: { skipped: true, reason: 'global_only_doctor' } },
         current_public_surface: currentSurface,
         codex_app_fast_mode: globalFastMode,
         openrouter_provider: desktopBridge.providers?.openrouter || null,
         sks_menubar: menuBar,
+        desktop_bridge_repair: desktopBridgeRepair,
         desktop_bridge: desktopBridge,
+        ...(migrationReceipt ? { migration_receipt: migrationReceipt } : {}),
         blockers,
+        warnings,
         next_actions: [
             ...(projectRootAliasDetected
                 ? ['Project checks were skipped because this directory is your home folder. Run them from your project: cd <your-project> && sks doctor --fix']
                 : []),
             ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : []),
+            ...(!bridgeReadinessRequired && bridgeBlockers.length
+                ? ['Desktop Bridge still reports blockers: run `sks doctor --fix` to repair the bridge catalog.']
+                : []),
             'Run `sks doctor --fix --json` from a specific project directory when project-scoped repair is required.'
         ]
     };
@@ -300,10 +344,19 @@ async function runDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         printJson(result);
     }
     else {
+        const bridgeRepair = result.desktop_bridge_repair;
         console.log(`SKS Doctor global repair: ${result.ok ? 'ok' : 'blocked'}`);
         console.log(`Global skills: ${result.skills.global?.error ? 'blocked' : 'reconciled'}`);
         console.log(`SKS menu bar: ${result.sks_menubar?.status || (result.sks_menubar?.ok ? 'ok' : 'blocked')}`);
+        console.log(`Desktop Bridge repair: ${bridgeRepair?.skipped_reason
+            ? bridgeRepair.skipped_reason
+            : bridgeRepair?.repaired
+                ? 'repaired'
+                : bridgeRepair?.ok === false ? 'failed' : 'nothing_to_repair'}`);
         console.log(`Desktop Bridge: ${result.desktop_bridge.ok ? 'ready' : 'blocked'} (${result.desktop_bridge.status?.readiness?.state || 'unavailable'})`);
+        if (result.migration_receipt) {
+            console.log(`Migration receipt: ${result.migration_receipt.status} (${result.home})`);
+        }
         for (const blocker of result.blockers)
             console.log(`- blocker: ${blocker}`);
         for (const action of result.next_actions)
@@ -1027,61 +1080,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 {
                     id: 'desktop_bridge_catalog_repair',
                     required_for_ready: false,
-                    run: async () => {
-                        const base = {
-                            id: 'desktop_bridge_catalog_repair',
-                            required_for_ready: false,
-                            manual_required: false,
-                            warnings: [],
-                            rollback_evidence: 'combined_catalog_previous_generation_preserved'
-                        };
-                        try {
-                            const bridgeHome = path.resolve(process.env.HOME || os.homedir());
-                            const restarted = await restartStaleDesktopBridgeRuntime({
-                                home: bridgeHome,
-                                fix: doctorFix,
-                            });
-                            const status = await desktopBridgeStatusV3({ home: bridgeHome, env: process.env });
-                            const blockers = (status?.readiness?.blockers || []).map(String);
-                            const stale = blockers.filter((blocker) => blocker.endsWith('_catalog_stale'));
-                            if (!status?.management?.managed || stale.length === 0) {
-                                return {
-                                    ...base,
-                                    ok: restarted.blockers.length === 0,
-                                    repaired: restarted.restarted,
-                                    warnings: restarted.warnings,
-                                    blockers: restarted.blockers
-                                };
-                            }
-                            const attempts = [];
-                            let syncedAndVerified = false;
-                            for (let attempt = 1; attempt <= CATALOG_REPAIR_MAX_ATTEMPTS; attempt += 1) {
-                                const sync = await executeDesktopBridgeCommandV3({ operation: 'catalog.sync' }, { home: bridgeHome, env: process.env });
-                                const commandOk = sync?.ok === true && sync?.execution?.ok === true;
-                                const after = await desktopBridgeStatusV3({ home: bridgeHome, env: process.env });
-                                const stillStale = (after?.readiness?.blockers || [])
-                                    .map(String).filter((blocker) => blocker.endsWith('_catalog_stale'));
-                                if (commandOk && stillStale.length === 0) {
-                                    syncedAndVerified = true;
-                                    break;
-                                }
-                                attempts.push(`catalog_sync_attempt_${attempt}:${commandOk ? `still_stale:${stillStale.join(',')}` : (sync?.execution?.blockers || ['failed']).map(String).join(',')}`);
-                            }
-                            return {
-                                ...base,
-                                ok: syncedAndVerified && restarted.blockers.length === 0,
-                                repaired: syncedAndVerified || restarted.restarted,
-                                warnings: [...restarted.warnings, ...(syncedAndVerified ? attempts : [])],
-                                blockers: [
-                                    ...(syncedAndVerified ? [] : ['desktop_bridge_catalog_still_stale_after_repair', ...attempts]),
-                                    ...restarted.blockers
-                                ]
-                            };
-                        }
-                        catch (error) {
-                            return { ...base, ok: false, repaired: false, blockers: [String(error?.message || 'desktop_bridge_catalog_sync_failed')] };
-                        }
-                    }
+                    run: async () => repairDoctorDesktopBridgeCatalog({ fix: doctorFix })
                 }
             ].filter((phase) => doctorPhaseIds.includes(phase.id))
         }).catch((err) => ({

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.0.5",
+  "package_version": "9.0.6",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -274,7 +274,13 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 const statusCode = response.statusCode || 502;
                 if (statusCode >= 400) {
                     void readRedactedUpstreamError(response).then(({ body, upstreamCode, upstreamType }) => {
-                        const transientMislabel = statusCode === 404 && upstreamType === 'upstream_error' && !upstreamCode;
+                        const transientMislabel = statusCode === 404
+                            && (upstreamType === 'upstream_error' || upstreamCode === 'upstream_error');
+                        if (transientMislabel && replayable && !useFreshConnection) {
+                            responseStarted = true;
+                            finish(new StalePooledSocketFailure(new DesktopBridgeError('bridge_upstream_transient_mislabel')));
+                            return;
+                        }
                         const clientStatus = transientMislabel ? 503 : statusCode;
                         logHttpRejection({
                             code: transientMislabel

package/dist/core/commands/basic-cli.js

@@ -255,6 +255,11 @@ export async function updateCommand(sub = 'now', args = []) {
         console.log(`New version: ${result.new_version}`);
     if (result.project_receipt)
         console.log(`Migration receipt: ${result.project_receipt.root} (${result.migration_current ? 'current' : 'not current'})`);
+    for (const warning of (result.project_receipt?.optional_warnings || [])
+        .filter((entry) => String(entry).includes('sks doctor --fix'))
+        .slice(0, 3)) {
+        console.log(`Follow-up: ${warning}`);
+    }
     if (result.sks_menubar)
         console.log(`SKS menu bar: ${result.sks_menubar.status}${result.sks_menubar.app_path ? ` (${result.sks_menubar.app_path})` : ''}`);
     if (result.operation_receipt_path)

package/dist/core/doctor/desktop-bridge-catalog-repair.js

@@ -0,0 +1,102 @@
+import os from 'node:os';
+import path from 'node:path';
+import { desktopBridgeStatusV3, executeDesktopBridgeCommandV3 } from '../codex-lb/desktop-controller-v3.js';
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServiceStatus } from '../codex-lb/desktop-service.js';
+import { desktopBridgeRuntimeVersion, desktopBridgeRuntimeVersionStale } from '../codex-lb/desktop-bridge/state.js';
+import { PACKAGE_VERSION } from '../version.js';
+export async function restartStaleDesktopBridgeRuntime(input) {
+    if (process.env.SKS_TEST_ISOLATION === '1' || process.env.SKS_RELEASE_UPGRADE_SMOKE === '1') {
+        return { restarted: false, warnings: [], blockers: [] };
+    }
+    const service = await desktopBridgeServiceStatus({ home: input.home }).catch(() => null);
+    if (!service?.running || !desktopBridgeRuntimeVersionStale(service.state)) {
+        return { restarted: false, warnings: [], blockers: [] };
+    }
+    const running = desktopBridgeRuntimeVersion(service.state) || 'pre-8.6.2';
+    if (!input.fix) {
+        return {
+            restarted: false,
+            warnings: [],
+            blockers: [`desktop_bridge_runtime_version_stale:${running}:${PACKAGE_VERSION}`]
+        };
+    }
+    const restarted = await bootstrapExistingDesktopBridgeService({ home: input.home }).catch(() => null);
+    const nowRunning = restarted?.running === true && !desktopBridgeRuntimeVersionStale(restarted.state);
+    return nowRunning
+        ? { restarted: true, warnings: [`desktop_bridge_runtime_restarted:${running}:${PACKAGE_VERSION}`], blockers: [] }
+        : { restarted: false, warnings: [], blockers: [`desktop_bridge_runtime_version_stale:${running}:${PACKAGE_VERSION}`] };
+}
+export const CATALOG_REPAIR_MAX_ATTEMPTS = 2;
+export async function repairDoctorDesktopBridgeCatalog(input, deps = {}) {
+    const base = {
+        id: 'desktop_bridge_catalog_repair',
+        required_for_ready: false,
+        manual_required: false,
+        warnings: [],
+        rollback_evidence: 'combined_catalog_previous_generation_preserved'
+    };
+    const usingRealImpls = !deps.restartStaleDesktopBridgeRuntimeImpl
+        && !deps.desktopBridgeStatusImpl
+        && !deps.executeDesktopBridgeCommandImpl;
+    if (usingRealImpls
+        && (process.env.NODE_TEST_CONTEXT !== undefined
+            || process.env.SKS_TEST_ISOLATION === '1'
+            || process.env.SKS_RELEASE_UPGRADE_SMOKE === '1')) {
+        return {
+            ...base,
+            ok: true,
+            repaired: false,
+            blockers: [],
+            skipped_reason: 'desktop_bridge_catalog_repair_skipped_under_tests'
+        };
+    }
+    const restartImpl = deps.restartStaleDesktopBridgeRuntimeImpl || restartStaleDesktopBridgeRuntime;
+    const statusImpl = deps.desktopBridgeStatusImpl || desktopBridgeStatusV3;
+    const executeImpl = deps.executeDesktopBridgeCommandImpl || executeDesktopBridgeCommandV3;
+    try {
+        const bridgeHome = path.resolve(process.env.HOME || os.homedir());
+        const restarted = await restartImpl({
+            home: bridgeHome,
+            fix: input.fix
+        });
+        const status = await statusImpl({ home: bridgeHome, env: process.env });
+        const blockers = (status?.readiness?.blockers || []).map(String);
+        const stale = blockers.filter((blocker) => blocker.endsWith('_catalog_stale'));
+        if (!status?.management?.managed || stale.length === 0) {
+            return {
+                ...base,
+                ok: restarted.blockers.length === 0,
+                repaired: restarted.restarted,
+                warnings: restarted.warnings,
+                blockers: restarted.blockers
+            };
+        }
+        const attempts = [];
+        let syncedAndVerified = false;
+        for (let attempt = 1; attempt <= CATALOG_REPAIR_MAX_ATTEMPTS; attempt += 1) {
+            const sync = await executeImpl({ operation: 'catalog.sync' }, { home: bridgeHome, env: process.env });
+            const commandOk = sync?.ok === true && sync?.execution?.ok === true;
+            const after = await statusImpl({ home: bridgeHome, env: process.env });
+            const stillStale = (after?.readiness?.blockers || [])
+                .map(String).filter((blocker) => blocker.endsWith('_catalog_stale'));
+            if (commandOk && stillStale.length === 0) {
+                syncedAndVerified = true;
+                break;
+            }
+            attempts.push(`catalog_sync_attempt_${attempt}:${commandOk ? `still_stale:${stillStale.join(',')}` : (sync?.execution?.blockers || ['failed']).map(String).join(',')}`);
+        }
+        return {
+            ...base,
+            ok: syncedAndVerified && restarted.blockers.length === 0,
+            repaired: syncedAndVerified || restarted.restarted,
+            warnings: [...restarted.warnings, ...(syncedAndVerified ? attempts : [])],
+            blockers: [
+                ...(syncedAndVerified ? [] : ['desktop_bridge_catalog_still_stale_after_repair', ...attempts]),
+                ...restarted.blockers
+            ]
+        };
+    }
+    catch (error) {
+        return { ...base, ok: false, repaired: false, blockers: [String(error?.message || 'desktop_bridge_catalog_sync_failed')] };
+    }
+}

package/dist/core/update/update-migration-state/current-public-surface-stage.js

@@ -0,0 +1,67 @@
+import os from 'node:os';
+import path from 'node:path';
+export async function runCurrentPublicSurfaceReconcileStage(root) {
+    const [{ runDoctorCommandAliasCleanup }, { migrateSksProfilesToPerFile }, { cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings }] = await Promise.all([
+        import('../../doctor/command-alias-cleanup.js'),
+        import('../../auto-review.js'),
+        import('../../codex-app/menubar/migration.js')
+    ]);
+    const home = path.resolve(process.env.HOME || os.homedir());
+    const globalRuntimeRoot = path.resolve(process.env.SKS_GLOBAL_ROOT || path.join(home, '.sneakoscope-global'));
+    const publicSurface = await runDoctorCommandAliasCleanup({
+        root,
+        home,
+        globalRuntimeRoot,
+        fix: true,
+        managedGenerationAlreadyConverged: true
+    });
+    const profileMigration = await migrateSksProfilesToPerFile({ env: process.env }).catch((err) => ({
+        error: err?.message || String(err),
+        retired_profile_table_count: 0,
+        retired_profile_file_removed_count: 0
+    }));
+    const retiredLaunchAgent = await cleanupRetiredRemoteBridgeLaunchAgent({ home, env: process.env });
+    const retiredBindings = await quarantineRetiredRemoteBridgeBindings(root);
+    const remainingCount = Number(publicSurface.cleanup?.remaining_count || 0)
+        + Number(publicSurface.cleanup?.managed_runtime?.remaining_managed_artifact_count || 0)
+        + Number(publicSurface.cleanup?.project_guidance?.remaining_count || 0);
+    const blockers = [
+        ...(publicSurface.ok === true ? [] : ['public_surface_reconcile_failed']),
+        ...(retiredLaunchAgent.ok ? [] : retiredLaunchAgent.blockers),
+        ...(retiredBindings.ok ? [] : retiredBindings.blockers),
+        ...(profileMigration.error ? [`retired_profile_migration_failed:${profileMigration.error}`] : []),
+        ...(remainingCount > 0 ? [`public_surface_remaining:${remainingCount}`] : [])
+    ];
+    return {
+        ok: blockers.length === 0,
+        status: blockers.length ? 'failed' : 'ok',
+        actions: [
+            'reconciled_current_public_surface',
+            ...(retiredLaunchAgent.status === 'removed' ? ['retired_remote_bridge_launch_agent_removed'] : []),
+            ...(retiredBindings.status === 'quarantined' ? ['retired_remote_bridge_bindings_quarantined'] : [])
+        ],
+        blockers,
+        warnings: [
+            ...(publicSurface.warnings || []),
+            ...retiredLaunchAgent.warnings,
+            ...retiredBindings.warnings
+        ],
+        detail: {
+            removed_skill_count: Number(publicSurface.cleanup?.removed_count || 0),
+            quarantined_skill_collision_count: Number(publicSurface.cleanup?.preserved_user_collision_count || 0),
+            removed_runtime_artifact_count: Number(publicSurface.cleanup?.managed_runtime?.removed_managed_artifact_count || 0),
+            quarantined_runtime_collision_count: Number(publicSurface.cleanup?.managed_runtime?.preserved_user_file_count || 0),
+            reconciled_guidance_count: Number(publicSurface.cleanup?.project_guidance?.reconciled_count || 0),
+            quarantined_guidance_collision_count: Number(publicSurface.cleanup?.project_guidance?.preserved_user_file_count || 0),
+            removed_retired_role_count: 0,
+            quarantined_retired_role_collision_count: 0,
+            retired_profile_table_count: Number(profileMigration.retired_profile_table_count || 0),
+            retired_profile_file_removed_count: Number(profileMigration.retired_profile_file_removed_count || 0),
+            retired_remote_bridge_launch_agent_status: retiredLaunchAgent.status,
+            retired_remote_bridge_binding_status: retiredBindings.status,
+            retired_remote_bridge_binding_count: retiredBindings.retired_binding_count,
+            retired_remote_bridge_binding_quarantine_path: retiredBindings.quarantine_path,
+            remaining_count: remainingCount
+        }
+    };
+}

package/dist/core/update/update-migration-state/desktop-bridge-catalog-repair-stage.js

@@ -0,0 +1,45 @@
+import os from 'node:os';
+import path from 'node:path';
+import { exists } from '../../fsx.js';
+import { desktopBridgeServicePaths } from '../../codex-lb/desktop-service.js';
+import { repairDoctorDesktopBridgeCatalog } from '../../doctor/desktop-bridge-catalog-repair.js';
+export async function runDesktopBridgeCatalogRepairStage() {
+    const skip = (reason) => ({ ok: true, status: 'ok', actions: [reason], blockers: [], warnings: [] });
+    if (process.platform !== 'darwin')
+        return skip('desktop_bridge_catalog_repair_not_macos');
+    if (process.env.NODE_TEST_CONTEXT !== undefined)
+        return skip('desktop_bridge_catalog_repair_skipped_under_tests');
+    if (process.env.SKS_TEST_ISOLATION === '1')
+        return skip('desktop_bridge_catalog_repair_skipped_under_tests');
+    if (process.env.SKS_SKIP_BRIDGE_CATALOG_REPAIR === '1')
+        return skip('desktop_bridge_catalog_repair_disabled');
+    const home = path.resolve(process.env.HOME || os.homedir());
+    if (!(await exists(desktopBridgeServicePaths(home).settings_path))) {
+        return skip('desktop_bridge_catalog_repair_no_managed_bridge');
+    }
+    const repair = await repairDoctorDesktopBridgeCatalog({ fix: true }).catch((error) => ({
+        ok: false,
+        repaired: false,
+        warnings: [],
+        blockers: [`desktop_bridge_catalog_repair_failed:${error?.message || String(error)}`]
+    }));
+    if (repair.ok) {
+        return {
+            ok: true,
+            status: 'ok',
+            actions: [repair.repaired ? 'desktop_bridge_catalog_repaired' : 'desktop_bridge_catalog_clean'],
+            blockers: [],
+            warnings: repair.warnings || []
+        };
+    }
+    return {
+        ok: true,
+        status: 'ok',
+        actions: [],
+        blockers: [],
+        warnings: [
+            ...(repair.blockers || []).map((blocker) => `desktop_bridge_catalog_repair_incomplete:${blocker}`),
+            'Desktop Bridge catalog still needs repair: run `sks doctor --fix`'
+        ]
+    };
+}

package/dist/core/update/update-migration-state.js

@@ -10,6 +10,8 @@ import { enforceRetention } from '../retention.js';
 import { COMMANDS } from '../../cli/command-registry.js';
 import { reconcileLegacyManagedGeneration } from '../init/legacy-generation-convergence.js';
 import { runConfigFastModeNormalizeStage } from './update-migration-state/fast-mode-config.js';
+import { runCurrentPublicSurfaceReconcileStage } from './update-migration-state/current-public-surface-stage.js';
+import { runDesktopBridgeCatalogRepairStage } from './update-migration-state/desktop-bridge-catalog-repair-stage.js';
 import { runDesktopBridgeRestageStage } from './update-migration-state/desktop-bridge-restage.js';
 import { runSessionStateSplitStage } from './update-migration-state/session-state-split.js';
 import { runHookTrustRefreshStage, runOtherHarnessCleanupStage } from './update-migration-state/simple-stages.js';
@@ -264,73 +266,13 @@ const UPDATE_MIGRATION_STAGES = [
         id: 'desktop-bridge-restage',
         min_from_version: '0.0.0',
         run: runDesktopBridgeRestageStage
+    },
+    {
+        id: 'desktop-bridge-catalog-repair',
+        min_from_version: '0.0.0',
+        run: runDesktopBridgeCatalogRepairStage
     }
 ];
-async function runCurrentPublicSurfaceReconcileStage(root) {
-    const [{ runDoctorCommandAliasCleanup }, { migrateSksProfilesToPerFile }, { cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings }] = await Promise.all([
-        import('../doctor/command-alias-cleanup.js'),
-        import('../auto-review.js'),
-        import('../codex-app/menubar/migration.js')
-    ]);
-    const home = path.resolve(process.env.HOME || os.homedir());
-    const globalRuntimeRoot = path.resolve(process.env.SKS_GLOBAL_ROOT || path.join(home, '.sneakoscope-global'));
-    const publicSurface = await runDoctorCommandAliasCleanup({
-        root,
-        home,
-        globalRuntimeRoot,
-        fix: true,
-        managedGenerationAlreadyConverged: true
-    });
-    const profileMigration = await migrateSksProfilesToPerFile({ env: process.env }).catch((err) => ({
-        error: err?.message || String(err),
-        retired_profile_table_count: 0,
-        retired_profile_file_removed_count: 0
-    }));
-    const retiredLaunchAgent = await cleanupRetiredRemoteBridgeLaunchAgent({ home, env: process.env });
-    const retiredBindings = await quarantineRetiredRemoteBridgeBindings(root);
-    const remainingCount = Number(publicSurface.cleanup?.remaining_count || 0)
-        + Number(publicSurface.cleanup?.managed_runtime?.remaining_managed_artifact_count || 0)
-        + Number(publicSurface.cleanup?.project_guidance?.remaining_count || 0);
-    const blockers = [
-        ...(publicSurface.ok === true ? [] : ['public_surface_reconcile_failed']),
-        ...(retiredLaunchAgent.ok ? [] : retiredLaunchAgent.blockers),
-        ...(retiredBindings.ok ? [] : retiredBindings.blockers),
-        ...(profileMigration.error ? [`retired_profile_migration_failed:${profileMigration.error}`] : []),
-        ...(remainingCount > 0 ? [`public_surface_remaining:${remainingCount}`] : [])
-    ];
-    return {
-        ok: blockers.length === 0,
-        status: blockers.length ? 'failed' : 'ok',
-        actions: [
-            'reconciled_current_public_surface',
-            ...(retiredLaunchAgent.status === 'removed' ? ['retired_remote_bridge_launch_agent_removed'] : []),
-            ...(retiredBindings.status === 'quarantined' ? ['retired_remote_bridge_bindings_quarantined'] : [])
-        ],
-        blockers,
-        warnings: [
-            ...(publicSurface.warnings || []),
-            ...retiredLaunchAgent.warnings,
-            ...retiredBindings.warnings
-        ],
-        detail: {
-            removed_skill_count: Number(publicSurface.cleanup?.removed_count || 0),
-            quarantined_skill_collision_count: Number(publicSurface.cleanup?.preserved_user_collision_count || 0),
-            removed_runtime_artifact_count: Number(publicSurface.cleanup?.managed_runtime?.removed_managed_artifact_count || 0),
-            quarantined_runtime_collision_count: Number(publicSurface.cleanup?.managed_runtime?.preserved_user_file_count || 0),
-            reconciled_guidance_count: Number(publicSurface.cleanup?.project_guidance?.reconciled_count || 0),
-            quarantined_guidance_collision_count: Number(publicSurface.cleanup?.project_guidance?.preserved_user_file_count || 0),
-            removed_retired_role_count: 0,
-            quarantined_retired_role_collision_count: 0,
-            retired_profile_table_count: Number(profileMigration.retired_profile_table_count || 0),
-            retired_profile_file_removed_count: Number(profileMigration.retired_profile_file_removed_count || 0),
-            retired_remote_bridge_launch_agent_status: retiredLaunchAgent.status,
-            retired_remote_bridge_binding_status: retiredBindings.status,
-            retired_remote_bridge_binding_count: retiredBindings.retired_binding_count,
-            retired_remote_bridge_binding_quarantine_path: retiredBindings.quarantine_path,
-            remaining_count: remainingCount
-        }
-    };
-}
 export async function runUpdateMigrationStages(root, opts = {}) {
     const fromVersion = opts.fromVersion || null;
     const runs = [];

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '9.0.5';
+export const PACKAGE_VERSION = '9.0.6';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "9.0.5",
+  "version": "9.0.6",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",