sneakoscope 2.0.1 → 2.0.4

package/dist/core/update-check.js

@@ -1,5 +1,8 @@
+import os from 'node:os';
 import path from 'node:path';
 import { PACKAGE_VERSION, packageRoot, readJson, runProcess, which } from './fsx.js';
+import { createRequestedScopeContract } from './safety/requested-scope-contract.js';
+import { guardedPackageInstall, guardContextForRoute } from './safety/mutation-guard.js';
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
 export async function runSksUpdateCheck(options = {}) {
     const packageName = options.packageName || 'sneakoscope';
@@ -16,9 +19,21 @@ export async function runSksUpdateCheck(options = {}) {
         effectiveOptions.timeoutMs = options.timeoutMs;
     if (options.maxOutputBytes !== undefined)
         effectiveOptions.maxOutputBytes = options.maxOutputBytes;
-    const effective = await detectEffectiveSksVersion(effectiveOptions);
-    const current = effective.current;
     const override = env[versionOverrideEnvName(packageName)];
+    const effectivePromise = detectEffectiveSksVersion(effectiveOptions);
+    const latestPromise = !override && npmBin
+        ? runProcess(npmBin, ['view', packageName, 'version', '--silent', '--registry', registry], {
+            env,
+            timeoutMs: options.timeoutMs ?? 5000,
+            maxOutputBytes: options.maxOutputBytes ?? 4096
+        }).catch((err) => ({
+            code: 1,
+            stdout: '',
+            stderr: err instanceof Error ? err.message : String(err)
+        }))
+        : Promise.resolve(null);
+    const effective = await effectivePromise;
+    const current = effective.current;
     if (override)
         return buildResult({ packageName, current, effective, latest: override, registry, npmBin });
     if (!npmBin) {
@@ -32,16 +47,18 @@ export async function runSksUpdateCheck(options = {}) {
             error: 'npm not found on PATH'
         });
     }
-    const args = ['view', packageName, 'version', '--silent', '--registry', registry];
-    const result = await runProcess(npmBin, args, {
-        env,
-        timeoutMs: options.timeoutMs ?? 5000,
-        maxOutputBytes: options.maxOutputBytes ?? 4096
-    }).catch((err) => ({
-        code: 1,
-        stdout: '',
-        stderr: err instanceof Error ? err.message : String(err)
-    }));
+    const result = await latestPromise;
+    if (!result) {
+        return buildResult({
+            packageName,
+            current,
+            effective,
+            latest: null,
+            registry,
+            npmBin,
+            error: 'npm view failed'
+        });
+    }
     if (result.code !== 0) {
         return buildResult({
             packageName,
@@ -62,6 +79,142 @@ export async function runSksUpdateCheck(options = {}) {
         npmBin
     });
 }
+export async function runSksUpdateNow(options = {}) {
+    const packageName = options.packageName || 'sneakoscope';
+    const registry = options.registry || DEFAULT_REGISTRY;
+    const env = options.env || process.env;
+    const npmBin = options.npmBin === undefined ? await which('npm') : options.npmBin;
+    const cwd = os.homedir();
+    const check = await runSksUpdateCheck({
+        ...options,
+        packageName,
+        registry,
+        npmBin,
+        env
+    });
+    const requestedVersion = parseVersionText(options.version || '') || null;
+    const installVersion = requestedVersion || check.latest;
+    const npmArgs = installVersion ? sksGlobalInstallArgs(packageName, installVersion, registry) : [];
+    const command = npmBin && npmArgs.length ? [npmBin, ...npmArgs].join(' ') : null;
+    const globalRoot = npmBin ? await detectNpmGlobalRoot(npmBin, env, options).catch(() => null) : null;
+    if (!npmBin) {
+        return buildUpdateNowResult({
+            packageName,
+            from: check.current,
+            latest: check.latest,
+            requestedVersion,
+            installVersion,
+            npmBin: null,
+            npmArgs,
+            command,
+            cwd,
+            registry,
+            globalRoot,
+            status: 'unavailable',
+            ok: false,
+            installCode: null,
+            error: 'npm not found on PATH'
+        });
+    }
+    if (!installVersion) {
+        return buildUpdateNowResult({
+            packageName,
+            from: check.current,
+            latest: check.latest,
+            requestedVersion,
+            installVersion,
+            npmBin,
+            npmArgs,
+            command,
+            cwd,
+            registry,
+            globalRoot,
+            status: 'unavailable',
+            ok: false,
+            installCode: null,
+            error: check.error || 'latest version unavailable'
+        });
+    }
+    if (!requestedVersion && check.latest && !check.update_available) {
+        return buildUpdateNowResult({
+            packageName,
+            from: check.current,
+            latest: check.latest,
+            requestedVersion,
+            installVersion,
+            npmBin,
+            npmArgs,
+            command,
+            cwd,
+            registry,
+            globalRoot,
+            status: 'current',
+            ok: true,
+            installCode: null,
+            error: null
+        });
+    }
+    if (options.dryRun) {
+        return buildUpdateNowResult({
+            packageName,
+            from: check.current,
+            latest: check.latest,
+            requestedVersion,
+            installVersion,
+            npmBin,
+            npmArgs,
+            command,
+            cwd,
+            registry,
+            globalRoot,
+            status: 'dry_run',
+            ok: true,
+            installCode: null,
+            error: null
+        });
+    }
+    const mutationLedgerRoot = env.SKS_MUTATION_LEDGER_ROOT || packageRoot();
+    const installContract = createRequestedScopeContract({
+        route: 'update',
+        userRequest: command || `npm global install ${packageName}`,
+        projectRoot: mutationLedgerRoot,
+        overrides: { package_install: true }
+    });
+    const install = await guardedPackageInstall(guardContextForRoute(mutationLedgerRoot, installContract, command || `npm global install ${packageName}`), `${packageName}@${installVersion}`, {
+        confirmed: true,
+        command: npmBin,
+        args: npmArgs,
+        cwd,
+        env,
+        timeoutMs: options.timeoutMs ?? 10 * 60 * 1000,
+        maxOutputBytes: options.maxOutputBytes ?? 128 * 1024
+    }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err instanceof Error ? err.message : String(err)
+    }));
+    const ok = install.code === 0;
+    return buildUpdateNowResult({
+        packageName,
+        from: check.current,
+        latest: check.latest,
+        requestedVersion,
+        installVersion,
+        npmBin,
+        npmArgs,
+        command,
+        cwd,
+        registry,
+        globalRoot,
+        status: ok ? 'updated' : 'failed',
+        ok,
+        installCode: install.code,
+        error: ok ? null : `${install.stderr || install.stdout || 'npm global install failed'}`.trim()
+    });
+}
+export function sksGlobalInstallArgs(packageName, version, registry = DEFAULT_REGISTRY) {
+    return ['install', '--global', `${packageName}@${version}`, '--registry', registry];
+}
 export async function detectEffectiveSksVersion(options = {}) {
     const packageName = options.packageName || 'sneakoscope';
     const env = options.env || process.env;
@@ -75,25 +228,34 @@ export async function detectEffectiveSksVersion(options = {}) {
     };
     add(options.currentVersion || PACKAGE_VERSION, 'runtime');
     add(env.SKS_INSTALLED_SKS_VERSION, 'env:SKS_INSTALLED_SKS_VERSION');
-    const pkg = await readJson(path.join(packageRoot(), 'package.json'), {}).catch(() => ({}));
-    add(pkg?.version, 'packageRoot:package.json');
-    const sks = await which('sks').catch(() => null);
-    if (sks) {
+    const packageRootPromise = readJson(path.join(packageRoot(), 'package.json'), {}).catch(() => ({}));
+    const pathSksPromise = which('sks')
+        .then(async (sks) => {
+        if (!sks)
+            return null;
         const result = await runProcess(sks, ['--version'], {
             timeoutMs: 2000,
             maxOutputBytes: 4096,
             env: { ...env, SKS_DISABLE_UPDATE_CHECK: '1' }
         }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
-        if (result.code === 0)
-            add(result.stdout, `PATH:${sks}`);
-        else
-            errors.push(`path_sks_version:${String(result.stderr || result.stdout || 'failed').trim()}`);
-    }
-    if (npmBin) {
-        const npmGlobal = await detectNpmGlobalPackageVersion(npmBin, packageName, env, {
+        return { sks, result };
+    })
+        .catch(() => null);
+    const npmGlobalPromise = npmBin
+        ? detectNpmGlobalPackageVersion(npmBin, packageName, env, {
             timeoutMs: options.timeoutMs ?? 2500,
             maxOutputBytes: options.maxOutputBytes ?? 8192
-        }).catch((err) => ({ version: null, error: err?.message || String(err) }));
+        }).catch((err) => ({ version: null, error: err?.message || String(err) }))
+        : Promise.resolve(null);
+    const [pkg, pathSks, npmGlobal] = await Promise.all([packageRootPromise, pathSksPromise, npmGlobalPromise]);
+    add(pkg?.version, 'packageRoot:package.json');
+    if (pathSks?.sks) {
+        if (pathSks.result.code === 0)
+            add(pathSks.result.stdout, `PATH:${pathSks.sks}`);
+        else
+            errors.push(`path_sks_version:${String(pathSks.result.stderr || pathSks.result.stdout || 'failed').trim()}`);
+    }
+    if (npmGlobal) {
         add(npmGlobal.version, `npm-global:${packageName}`);
         if (npmGlobal.error)
             errors.push(`npm_global_version:${npmGlobal.error}`);
@@ -183,12 +345,40 @@ function buildResult(input) {
         mode: 'function',
         route_required: false,
         pipeline_required: false,
-        command: updateAvailable ? `npm i -g ${input.packageName}@${input.latest} --registry ${input.registry}` : null,
+        command: updateAvailable ? `sks update now --version ${input.latest}` : null,
         npm_bin: input.npmBin,
         registry: input.registry,
         error: input.error || null
     };
 }
+function buildUpdateNowResult(input) {
+    return {
+        schema: 'sks.update-now.v1',
+        ok: input.ok,
+        status: input.status,
+        package: input.packageName,
+        from: input.from,
+        latest: input.latest,
+        requested_version: input.requestedVersion,
+        install_version: input.installVersion,
+        npm_bin: input.npmBin,
+        npm_args: input.npmArgs,
+        command: input.command,
+        cwd: input.cwd,
+        registry: input.registry,
+        global_root: input.globalRoot,
+        install_code: input.installCode,
+        error: input.error
+    };
+}
+async function detectNpmGlobalRoot(npmBin, env, opts = {}) {
+    const result = await runProcess(npmBin, ['root', '--global', '--silent'], {
+        env,
+        timeoutMs: opts.timeoutMs ?? 2500,
+        maxOutputBytes: opts.maxOutputBytes ?? 4096
+    }).catch(() => ({ code: 1, stdout: '', stderr: '' }));
+    return result.code === 0 ? String(result.stdout || '').trim().split(/\r?\n/).pop() || null : null;
+}
 function versionOverrideEnvName(packageName) {
     return `SKS_NPM_VIEW_${packageName.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_VERSION`;
 }

package/dist/core/verification/verification-worker-pool.js

@@ -87,6 +87,7 @@ export async function runVerificationTask(task, opts = {}) {
         let timedOut = false;
         const timeoutMs = task.timeout_ms || 10 * 60 * 1000;
         let killTimeout = null;
+        let exitFallback = null;
         const finish = (payload) => {
             if (settled)
                 return;
@@ -94,6 +95,8 @@ export async function runVerificationTask(task, opts = {}) {
             clearTimeout(timeout);
             if (killTimeout)
                 clearTimeout(killTimeout);
+            if (exitFallback)
+                clearTimeout(exitFallback);
             resolve(payload);
         };
         const timeout = setTimeout(() => {
@@ -113,6 +116,15 @@ export async function runVerificationTask(task, opts = {}) {
         child.on('error', (err) => {
             finish({ code: null, error: err.message });
         });
+        child.on('exit', (code) => {
+            if (settled)
+                return;
+            exitFallback = setTimeout(async () => {
+                if (timedOut)
+                    await waitForProcessTreeExit(child.pid, 2_000);
+                finish({ code, ...(timedOut ? { error: `timeout:${timeoutMs}` } : {}) });
+            }, 1_000);
+        });
         child.on('close', async (code) => {
             if (timedOut)
                 await waitForProcessTreeExit(child.pid, 2_000);

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '2.0.1';
+export const PACKAGE_VERSION = '2.0.4';
 //# sourceMappingURL=version.js.map

package/dist/core/zellij/zellij-worker-pane-manager.js

@@ -57,6 +57,8 @@ export function buildWorkerPaneArtifact(input) {
         opened_at: now,
         closed_at: null,
         close: null,
+        direction_requested: 'right',
+        direction_applied: input.directionApplied || 'not_applied',
         sdk_thread_id: input.sdkThreadId || null,
         sdk_run_id: input.sdkRunId || null,
         stream_event_count: Number(input.streamEventCount || 0),
@@ -81,13 +83,25 @@ export async function openWorkerPane(input) {
         optional: false
     });
     const paneName = buildWorkerPaneTitle(input.slotId, input.generationIndex, providerContext, input.serviceTier);
-    const launch = createSession.ok
-        ? await runZellij(['--session', input.sessionName, 'action', 'new-pane', '--name', paneName, '--', 'sh', '-lc', input.workerCommand], {
+    let launch = createSession.ok
+        ? await runZellij(['--session', input.sessionName, 'action', 'new-pane', '--direction', 'right', '--name', paneName, '--', 'sh', '-lc', input.workerCommand], {
             cwd,
             timeoutMs: 5000,
             optional: false
         })
         : null;
+    let directionApplied = launch?.ok ? 'right' : 'not_applied';
+    if (createSession.ok && launch && !launch.ok) {
+        const fallback = await runZellij(['--session', input.sessionName, 'action', 'new-pane', '--name', paneName, '--', 'sh', '-lc', input.workerCommand], {
+            cwd,
+            timeoutMs: 5000,
+            optional: false
+        });
+        if (fallback.ok) {
+            launch = fallback;
+            directionApplied = 'unknown';
+        }
+    }
     const stdoutPaneId = launch?.ok ? extractZellijPaneIdFromOutput(launch.stdout_tail) : null;
     const reconciledPane = stdoutPaneId ? null : launch?.ok ? await reconcileZellijWorkerPaneId(input.sessionName, paneName, path.join(root, input.resultPath), cwd) : null;
     const paneId = stdoutPaneId || reconciledPane?.pane_id || null;
@@ -110,6 +124,7 @@ export async function openWorkerPane(input) {
         createSession,
         launch,
         paneReconciliation: reconciledPane,
+        directionApplied,
         status: blockers.length ? 'failed' : 'running',
         providerContext,
         serviceTier: input.serviceTier || providerContext.service_tier,
@@ -139,6 +154,8 @@ export async function openWorkerPane(input) {
         provider: record.provider,
         service_tier: record.service_tier,
         provider_context: record.provider_context,
+        direction_requested: record.direction_requested,
+        direction_applied: record.direction_applied,
         command: '<native-cli-worker-command>',
         worker_artifact_dir: input.workerArtifactDir,
         worker_result_path: input.resultPath,

package/dist/scripts/agent-ast-aware-work-graph-check.js

@@ -20,6 +20,6 @@ assertGate(Object.keys(graph.command_to_module_ownership).length > 0, 'AST-aware
 assertGate(graph.test_ownership_confidence >= 0, 'AST-aware work graph must record test ownership confidence', graph);
 assertGate(['proven', 'partial', 'blocked'].includes(graph.proof_level), 'AST-aware work graph must report an honest proof level', graph);
 fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', `agent-intelligent-work-graph-v2-${releaseVersion}.json`), `${JSON.stringify(graph, null, 2)}\n`);
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', `agent-intelligent-work-graph-v2-${releaseVersion}.json`), `${JSON.stringify(graphMod.compactIntelligentWorkGraph(graph), null, 2)}\n`);
 emitGate('agent:ast-aware-work-graph', { score: graph.work_graph_quality_score, ast_coverage: graph.ast_coverage, proof_level: graph.proof_level });
 //# sourceMappingURL=agent-ast-aware-work-graph-check.js.map

package/dist/scripts/codex-sdk-team-naruto-agent-pipeline-check.js

@@ -6,6 +6,7 @@ const naruto = readText('src/core/commands/naruto-command.ts');
 const agent = readText('src/core/agents/agent-command-surface.ts');
 assertGate(team.includes("backend: mock ? 'fake' : 'codex-sdk'"), 'Team must default to codex-sdk');
 assertGate(naruto.includes("backend: 'codex-sdk'"), 'Naruto help/defaults must expose codex-sdk');
-assertGate(agent.includes("hasFlag(args, '--mock') ? 'fake' : 'codex-sdk'"), 'Agent command surface must default to codex-sdk');
+assertGate(agent.includes("useOllama && !noOllama ? 'ollama' : 'codex-sdk'"), 'Agent command surface must default to codex-sdk unless local model is explicit');
+assertGate(agent.includes('backendExplicit'), 'Agent command surface must preserve explicit backend/local-model intent');
 emitGate('codex-sdk:team-naruto-agent-pipeline', { routes: ['$Team', '$Naruto', '$Agent'] });
 //# sourceMappingURL=codex-sdk-team-naruto-agent-pipeline-check.js.map

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -14,13 +14,23 @@ const repaired = await repairCodexAppFastUi(root, { codexHome, apply: true });
 const projectAfter = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
 const homeAfter = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
 const backups = repaired.actions.filter((action) => action.changed).map((action) => action.backup_path).filter(Boolean);
+const unsafeRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fast-ui-unsafe-'));
+const unsafeCodexHome = path.join(unsafeRoot, 'home', '.codex');
+await fs.mkdir(path.join(unsafeRoot, '.codex'), { recursive: true });
+await fs.mkdir(unsafeCodexHome, { recursive: true });
+await fs.writeFile(path.join(unsafeCodexHome, 'config.toml'), 'service_tier = "standard"\n');
+const unsafePlan = await repairCodexAppFastUi(unsafeRoot, { codexHome: unsafeCodexHome, apply: false });
 const ok = plan.fast_selector === 'manual_action_required'
+    && plan.safe_auto_apply === true
     && repaired.fast_selector === 'repaired'
+    && repaired.safe_auto_apply === true
     && backups.length >= 2
     && !/model_provider\s*=/.test(projectAfter)
     && !/service_tier\s*=/.test(homeAfter)
-    && /fast_mode = false/.test(homeAfter);
-emit({ schema: 'sks.doctor-fixes-codex-app-fast-ui-check.v1', ok, plan, repaired, project_after: projectAfter, home_after: homeAfter, blockers: ok ? [] : ['doctor_fixes_codex_app_fast_ui_check_failed'] });
+    && /fast_mode = false/.test(homeAfter)
+    && unsafePlan.requires_confirmation === true
+    && unsafePlan.safe_auto_apply === false;
+emit({ schema: 'sks.doctor-fixes-codex-app-fast-ui-check.v1', ok, plan, repaired, unsafe_plan: unsafePlan, project_after: projectAfter, home_after: homeAfter, blockers: ok ? [] : ['doctor_fixes_codex_app_fast_ui_check_failed'] });
 function emit(report) {
     console.log(JSON.stringify(report, null, 2));
     if (!report.ok)

package/dist/scripts/gpt-final-arbiter-check.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, readJsonFile, root } from './lib/codex-sdk-gate-lib.js';
+const mod = await importDist('core/codex-control/gpt-final-arbiter.js');
+const old = snapshotEnv();
+process.env.NODE_ENV = 'test';
+process.env.SKS_CODEX_SDK_FAKE = '1';
+delete process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE;
+try {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-gpt-final-arbiter-'));
+    const approved = await mod.runGptFinalArbiter(fixtureInput('approved'), { cwd: root, mutationLedgerRoot: tmp });
+    assertGate(approved.ok === true, 'GPT final arbiter fixture must approve safe candidate', approved);
+    assertGate(approved.backend === 'codex-sdk', 'GPT final arbiter backend must be codex-sdk');
+    assertGate(approved.result.status === 'approved', 'safe candidate must return approved');
+    assertGate(approved.final_gate.ok === true, 'approved arbiter result must pass final gate');
+    const artifact = await readJsonFile(path.join(tmp, 'gpt-final-arbiter.json'));
+    assertGate(artifact.result.schema === 'sks.gpt-final-arbiter-result.v1', 'arbiter artifact must contain schema-valid result');
+    const unsafeTmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-gpt-final-arbiter-unsafe-'));
+    const rejected = await mod.runGptFinalArbiter({ ...fixtureInput('unsafe'), candidate_diff: 'unsafe delete all credential patch' }, { cwd: root, mutationLedgerRoot: unsafeTmp });
+    assertGate(rejected.ok === false, 'unsafe candidate must not pass final arbiter');
+    assertGate(rejected.result.status === 'rejected', 'unsafe candidate must be rejected');
+    assertGate(rejected.blockers.includes('unsafe_candidate_patch'), 'unsafe rejection blocker must be preserved');
+    emitGate('local-collab:gpt-final-arbiter', { approved: approved.result.status, rejected: rejected.result.status });
+}
+finally {
+    restoreEnv(old);
+}
+function fixtureInput(label) {
+    return {
+        schema: 'sks.gpt-final-arbiter-input.v1',
+        route: '$Naruto',
+        mission_id: `M-${label}`,
+        local_mode: 'local-parallel-gpt-final',
+        local_outputs: [
+            { worker_id: 'slot-001/gen-1', backend: 'local-llm', summary: 'candidate patch drafted', patch_envelopes: [], proof: 'local draft' }
+        ],
+        candidate_diff: 'diff --git a/example.ts b/example.ts',
+        candidate_patch_envelopes: [],
+        verification_results: [{ ok: true, status: 'passed' }],
+        side_effect_report: { ok: true },
+        mutation_ledger: { ok: true },
+        rollback_plan: { ok: true }
+    };
+}
+function snapshotEnv() {
+    return {
+        NODE_ENV: process.env.NODE_ENV,
+        SKS_CODEX_SDK_FAKE: process.env.SKS_CODEX_SDK_FAKE,
+        SKS_GPT_FINAL_ARBITER_UNAVAILABLE: process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE
+    };
+}
+function restoreEnv(old) {
+    for (const [key, value] of Object.entries(old)) {
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+}
+//# sourceMappingURL=gpt-final-arbiter-check.js.map

package/dist/scripts/gpt-final-arbiter-performance-check.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const compressor = await importDist('core/codex-control/gpt-final-context-compressor.js');
+const local_outputs = Array.from({ length: 20 }, (_, index) => ({
+    worker_id: `slot-${String(index + 1).padStart(3, '0')}/gen-1`,
+    backend: 'local-llm',
+    status: 'done',
+    summary: `worker ${index + 1} summarized a bounded shard`,
+    changed_files: [`src/example-${index + 1}.ts`],
+    blockers: []
+}));
+const candidate_patch_envelopes = local_outputs.map((output, index) => ({
+    id: `patch-${index + 1}`,
+    agent_id: output.worker_id,
+    source: 'model_authored',
+    lease_id: `lease-${index + 1}`,
+    rollback_hint: { ok: true },
+    operations: [{ op: 'replace', path: output.changed_files[0], search: 'before', replace: 'after' }]
+}));
+const report = compressor.compressGptFinalContext({
+    route: '$Naruto',
+    mission_id: 'M-20-local-workers',
+    local_mode: 'local-parallel-gpt-final',
+    local_outputs,
+    candidate_patch_envelopes,
+    verification_results: [{ ok: true, status: 'passed' }],
+    side_effect_report: { ok: true },
+    mutation_ledger: { ok: true },
+    rollback_plan: { ok: true }
+});
+assertGate(report.proof_pack.worker_count === 20, 'proof pack must include 20 worker summaries');
+assertGate(report.proof_pack.token_budget_estimate < 8000, '20-worker proof pack must stay under token budget', report.proof_pack);
+assertGate(report.latency_budget.ok === true, 'GPT final latency budget report must pass');
+emitGate('local-collab:gpt-final-performance', { workers: report.proof_pack.worker_count, token_budget_estimate: report.proof_pack.token_budget_estimate });
+//# sourceMappingURL=gpt-final-arbiter-performance-check.js.map

package/dist/scripts/local-collab-gpt-final-availability-check.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './lib/codex-sdk-gate-lib.js';
+const arbiterMod = await importDist('core/codex-control/gpt-final-arbiter.js');
+const doctorMod = await importDist('core/doctor/doctor-readiness-matrix.js');
+const old = snapshotEnv();
+try {
+    process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE = '1';
+    const unavailable = await arbiterMod.runGptFinalArbiter(input('unavailable'), { writeArtifact: false, forceUnavailable: true });
+    assertGate(unavailable.ok === false, 'GPT unavailable fixture must block final apply');
+    assertGate(unavailable.blockers.includes('gpt_final_arbiter_unavailable'), 'GPT unavailable blocker must be present');
+    const doctor = doctorMod.buildDoctorReadinessMatrix({
+        codex: { available: false },
+        codex_config: { ok: true, checks: [] },
+        local_collaboration: { mode: 'local-parallel-gpt-final', gpt_final_arbiter_available: false }
+    });
+    assertGate(doctor.blockers.includes('gpt_final_arbiter_unavailable'), 'doctor must report gpt_final_arbiter_unavailable');
+    delete process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE;
+    process.env.NODE_ENV = 'test';
+    process.env.SKS_CODEX_SDK_FAKE = '1';
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-gpt-final-available-'));
+    const available = await arbiterMod.runGptFinalArbiter(input('available'), { cwd: root, mutationLedgerRoot: tmp });
+    assertGate(available.ok === true, 'GPT available fixture must pass final arbiter');
+    emitGate('local-collab:gpt-final-availability', { unavailable: unavailable.result.status, available: available.result.status });
+}
+finally {
+    restoreEnv(old);
+}
+function input(label) {
+    return {
+        schema: 'sks.gpt-final-arbiter-input.v1',
+        route: '$Team',
+        mission_id: `M-${label}`,
+        local_mode: 'local-parallel-gpt-final',
+        local_outputs: [{ worker_id: 'local', backend: 'local-llm', summary: 'candidate' }],
+        candidate_patch_envelopes: [],
+        verification_results: []
+    };
+}
+function snapshotEnv() {
+    return {
+        NODE_ENV: process.env.NODE_ENV,
+        SKS_CODEX_SDK_FAKE: process.env.SKS_CODEX_SDK_FAKE,
+        SKS_GPT_FINAL_ARBITER_UNAVAILABLE: process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE
+    };
+}
+function restoreEnv(old) {
+    for (const [key, value] of Object.entries(old)) {
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+}
+//# sourceMappingURL=local-collab-gpt-final-availability-check.js.map

package/dist/scripts/local-collab-no-local-only-final-check.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const policyMod = await importDist('core/local-llm/local-collaboration-policy.js');
+const arbiterMod = await importDist('core/codex-control/gpt-final-arbiter.js');
+const gate = policyMod.evaluateLocalCollaborationFinalGate({
+    mode: 'local-only-draft',
+    localParticipated: true,
+    gptFinalStatus: null,
+    gptFinalAvailable: false,
+    applyPatches: true
+});
+assertGate(gate.ok === false, 'local-only-draft must not be final accepted');
+assertGate(gate.final_status === 'draft_only', 'local-only-draft must end as draft_only');
+assertGate(gate.apply_allowed === false, 'local-only-draft must block apply');
+const result = await arbiterMod.runGptFinalArbiter({
+    schema: 'sks.gpt-final-arbiter-input.v1',
+    route: '$DFix',
+    mission_id: 'M-local-only-draft',
+    local_mode: 'local-only-draft',
+    local_outputs: [{ worker_id: 'local', backend: 'local-llm', summary: 'draft only' }],
+    candidate_patch_envelopes: []
+}, { writeArtifact: false });
+assertGate(result.ok === false, 'local-only-draft arbiter result must not pass');
+assertGate(result.blockers.includes('needs_gpt_final_review'), 'local-only-draft arbiter must include needs_gpt_final_review');
+emitGate('local-collab:no-local-only-final', { final_status: gate.final_status, blockers: result.blockers.length });
+//# sourceMappingURL=local-collab-no-local-only-final-check.js.map

package/dist/scripts/local-collab-policy-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, readText } from './lib/codex-sdk-gate-lib.js';
+const policyMod = await importDist('core/local-llm/local-collaboration-policy.js');
+const schemaText = readText('schemas/local-llm/local-collaboration-policy.schema.json');
+const policy = policyMod.resolveLocalCollaborationPolicy({ env: {} });
+assertGate(policy.mode === 'local-parallel-gpt-final', 'default local collaboration mode must be local-parallel-gpt-final');
+assertGate(policy.gpt_final_required === true, 'default local collaboration mode must require GPT final');
+assertGate(policy.final_patch_source_when_enabled === 'gpt_final_arbiter', 'final patch source must be GPT final arbiter');
+assertGate(schemaText.includes('local-only-draft'), 'policy schema must include local-only-draft mode');
+const draft = policyMod.resolveLocalCollaborationPolicy({ mode: 'local-only-draft' });
+const draftGate = policyMod.evaluateLocalCollaborationFinalGate({ policy: draft, localParticipated: true, applyPatches: true });
+assertGate(draftGate.ok === false, 'local-only-draft must not pass final gate');
+assertGate(draftGate.blockers.includes('needs_gpt_final_review'), 'local-only-draft must carry needs_gpt_final_review');
+assertGate(draftGate.blockers.includes('local_only_draft_apply_blocked'), 'local-only-draft must block apply');
+emitGate('local-collab:policy', { default_mode: policy.mode, draft_blockers: draftGate.blockers.length });
+//# sourceMappingURL=local-collab-policy-check.js.map