sneakoscope 2.0.13 → 2.0.15

package/dist/scripts/doctor-fix-proves-codex-read-check.js

@@ -1,64 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-const repo = process.cwd();
-const fixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fix-'));
-const home = path.join(fixture, 'home');
-await fs.mkdir(home, { recursive: true });
-const run = spawnSync(process.execPath, [
-    path.join(repo, 'dist', 'bin', 'sks.js'),
-    'doctor',
-    '--fix',
-    '--json',
-    '--codex-bin',
-    path.join(repo, 'dist', 'scripts', 'fixtures', 'fake-codex-config-loader.js')
-], {
-    cwd: fixture,
-    env: {
-        ...process.env,
-        HOME: home,
-        CODEX_HOME: path.join(home, '.codex'),
-        SKS_FAKE_CODEX_CONFIG_EPERM: '1',
-        SKS_DISABLE_UPDATE_CHECK: '1'
-    },
-    encoding: 'utf8',
-    timeout: 180000
-});
-const parsed = parseLastJson(run.stdout || '{}');
-const ok = run.status !== 0
-    && parsed.ready?.ready === false
-    && parsed.ready?.blockers?.includes('codex_cli_config_eperm')
-    && parsed.ready?.next_actions?.length > 0;
-console.log(JSON.stringify({
-    schema: 'sks.doctor-fix-proves-codex-read-check.v1',
-    ok,
-    status: run.status,
-    signal: run.signal,
-    error: run.error ? String(run.error.message || run.error) : null,
-    parsed,
-    stdout_tail: String(run.stdout || '').slice(-1000),
-    stderr_tail: String(run.stderr || '').slice(-1000)
-}, null, 2));
-if (!ok)
-    process.exitCode = 1;
-function parseLastJson(text) {
-    const source = String(text || '').trim();
-    if (!source)
-        return {};
-    const starts = [];
-    for (let index = source.indexOf('{'); index >= 0; index = source.indexOf('{', index + 1))
-        starts.push(index);
-    for (let i = starts.length - 1; i >= 0; i -= 1) {
-        try {
-            return JSON.parse(source.slice(starts[i]));
-        }
-        catch {
-            // Continue searching for the outer JSON object; pretty JSON may contain nested objects.
-        }
-    }
-    return {};
-}
-//# sourceMappingURL=doctor-fix-proves-codex-read-check.js.map

package/dist/scripts/doctor-fix-recovers-corrupted-config-check.js

@@ -1,122 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// Proves `sks doctor --fix` (via repairCodexConfigEperm) RECOVERS an already-corrupted
-// Codex config — both the project config and the global CODEX_HOME config — by hoisting
-// machine-local keys that a prior buggy move absorbed into a trailing table back to the
-// top of the file, restoring a loadable config.toml. Also proves the structural repair
-// is a no-op on a healthy config.
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root as repoRoot } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const distUrl = (rel) => pathToFileURL(path.join(repoRoot, 'dist', rel)).href;
-const policy = await import(distUrl('core/codex/codex-project-config-policy.js'));
-const eperm = await import(distUrl('core/codex/codex-config-eperm-repair.js'));
-const results = [];
-// Corruption signature: machine-local keys absorbed into the trailing env table.
-const corrupted = [
-    '[mcp_servers.xai-grok]',
-    'command = "npx"',
-    '',
-    '[mcp_servers.xai-grok.env]',
-    'XAI_API_KEY = "xai-123"',
-    '# SKS moved machine-local Codex config from .codex/config.toml at 2026-05-29T00:00:00Z',
-    'model_provider = "codex-lb"',
-    'notify = ["notify-send", "SKS"]',
-    ''
-].join('\n');
-// helper: top-level key index vs first table index
-function keyBeforeFirstTable(text, key) {
-    const lines = text.split('\n');
-    const firstTable = lines.findIndex((l) => /^\s*\[/.test(l));
-    const keyIdx = lines.findIndex((l) => new RegExp(`^\\s*${key}\\s*=`).test(l));
-    return keyIdx >= 0 && firstTable >= 0 && keyIdx < firstTable;
-}
-function envTableHasMachineKey(text) {
-    // model_provider/notify must NOT appear after the env header
-    return /\[mcp_servers\.xai-grok\.env\][\s\S]*\b(model_provider|notify)\s*=/.test(text);
-}
-// --- Case 1: standalone structural repair hoists keys back to root ---
-{
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-struct-'));
-    const cfg = path.join(dir, 'config.toml');
-    await fs.writeFile(cfg, corrupted);
-    const rep = await policy.repairCodexConfigStructure(cfg, { apply: true });
-    const after = await fs.readFile(cfg, 'utf8');
-    const ok = rep.changed === true &&
-        rep.applied === true &&
-        rep.hoisted_keys.includes('model_provider') &&
-        rep.hoisted_keys.includes('notify') &&
-        keyBeforeFirstTable(after, 'model_provider') &&
-        keyBeforeFirstTable(after, 'notify') &&
-        !envTableHasMachineKey(after) &&
-        /XAI_API_KEY = "xai-123"/.test(after) &&
-        rep.backup_path &&
-        rep.parse_smoke.ok === true;
-    results.push({ case: 'structure_repair_hoists_keys', ok, hoisted: rep.hoisted_keys, status: rep.status, after });
-}
-// --- Case 2: structural repair is a no-op on a healthy config ---
-{
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-struct-ok-'));
-    const cfg = path.join(dir, 'config.toml');
-    const healthy = [
-        'model_provider = "codex-lb"',
-        'notify = ["notify-send", "SKS"]',
-        '',
-        '[mcp_servers.xai-grok.env]',
-        'XAI_API_KEY = "xai-123"',
-        '',
-        '[profiles.sks-mad-high]',
-        'model_provider = "codex-lb"',
-        'model_reasoning_effort = "high"',
-        ''
-    ].join('\n');
-    await fs.writeFile(cfg, healthy);
-    const rep = await policy.repairCodexConfigStructure(cfg, { apply: true });
-    const after = await fs.readFile(cfg, 'utf8');
-    // profiles.* model_provider must be preserved inside the profile (NOT hoisted).
-    const profileIntact = /\[profiles\.sks-mad-high\][\s\S]*model_provider = "codex-lb"/.test(after);
-    const ok = rep.changed === false && rep.status === 'structure_ok' && profileIntact;
-    results.push({ case: 'structure_repair_noop_on_healthy', ok, status: rep.status, profile_intact: profileIntact });
-}
-// --- Case 3: doctor --fix recovers the GLOBAL CODEX_HOME config end-to-end ---
-{
-    const fixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fix-'));
-    const codexHome = path.join(fixture, 'home', '.codex');
-    await fs.mkdir(codexHome, { recursive: true });
-    await fs.writeFile(path.join(codexHome, 'config.toml'), corrupted);
-    // Project has only a benign config so the project path is healthy.
-    await fs.mkdir(path.join(fixture, '.codex'), { recursive: true });
-    await fs.writeFile(path.join(fixture, '.codex', 'config.toml'), 'sandbox_mode = "workspace-write"\n');
-    const report = await eperm.repairCodexConfigEperm(fixture, {
-        fix: true,
-        codexHome,
-        // no real codex needed; structural repair runs regardless
-        actualCodex: false,
-        codexProbe: false,
-        writeReport: false
-    });
-    const homeAfter = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
-    const homeRepair = (report.structure_repairs || []).find((r) => r.scope === 'codex_home');
-    const ok = Boolean(homeRepair) &&
-        homeRepair.applied === true &&
-        homeRepair.hoisted_keys.includes('model_provider') &&
-        homeRepair.hoisted_keys.includes('notify') &&
-        keyBeforeFirstTable(homeAfter, 'model_provider') &&
-        keyBeforeFirstTable(homeAfter, 'notify') &&
-        !envTableHasMachineKey(homeAfter);
-    results.push({ case: 'doctor_fix_recovers_codex_home', ok, home_repair: homeRepair, home_after: homeAfter });
-}
-const ok = results.every((r) => r.ok);
-console.log(JSON.stringify({ schema: 'sks.doctor-fix-recovers-corrupted-config-check.v1', ok, results }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-function fail(blocker, detail) {
-    console.log(JSON.stringify({ schema: 'sks.doctor-fix-recovers-corrupted-config-check.v1', ok: false, blocker, detail }, null, 2));
-    process.exit(1);
-}
-//# sourceMappingURL=doctor-fix-recovers-corrupted-config-check.js.map

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -1,39 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { repairCodexAppFastUi } from '../core/codex-app/codex-app-fast-ui-repair.js';
-const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fast-ui-'));
-const codexHome = path.join(root, 'home', '.codex');
-await fs.mkdir(path.join(root, '.codex'), { recursive: true });
-await fs.mkdir(codexHome, { recursive: true });
-await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model_provider = "codex-lb"\n');
-await fs.writeFile(path.join(codexHome, 'config.toml'), '# SKS forced fast UI during legacy install\nservice_tier = "fast"\n[features]\nfast_mode = false # user disabled, must remain untouched\n');
-const plan = await repairCodexAppFastUi(root, { codexHome, apply: false });
-const repaired = await repairCodexAppFastUi(root, { codexHome, apply: true });
-const projectAfter = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
-const homeAfter = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
-const backups = repaired.actions.filter((action) => action.changed).map((action) => action.backup_path).filter(Boolean);
-const unsafeRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fast-ui-unsafe-'));
-const unsafeCodexHome = path.join(unsafeRoot, 'home', '.codex');
-await fs.mkdir(path.join(unsafeRoot, '.codex'), { recursive: true });
-await fs.mkdir(unsafeCodexHome, { recursive: true });
-await fs.writeFile(path.join(unsafeCodexHome, 'config.toml'), 'service_tier = "standard"\n');
-const unsafePlan = await repairCodexAppFastUi(unsafeRoot, { codexHome: unsafeCodexHome, apply: false });
-const ok = plan.fast_selector === 'manual_action_required'
-    && plan.safe_auto_apply === true
-    && repaired.fast_selector === 'repaired'
-    && repaired.safe_auto_apply === true
-    && backups.length >= 2
-    && !/model_provider\s*=/.test(projectAfter)
-    && !/service_tier\s*=/.test(homeAfter)
-    && /fast_mode = false/.test(homeAfter)
-    && unsafePlan.requires_confirmation === true
-    && unsafePlan.safe_auto_apply === false;
-emit({ schema: 'sks.doctor-fixes-codex-app-fast-ui-check.v1', ok, plan, repaired, unsafe_plan: unsafePlan, project_after: projectAfter, home_after: homeAfter, blockers: ok ? [] : ['doctor_fixes_codex_app_fast_ui_check_failed'] });
-function emit(report) {
-    console.log(JSON.stringify(report, null, 2));
-    if (!report.ok)
-        process.exitCode = 1;
-}
-//# sourceMappingURL=doctor-fixes-codex-app-fast-ui-check.js.map

package/dist/scripts/evidence-fixture-check.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { writeEvidenceIndexForProof } from '../core/evidence/evidence-router.js';
-const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-evidence-fixture-'));
-const mission = path.join(root, '.sneakoscope', 'missions', 'M-evidence');
-await fs.mkdir(mission, { recursive: true });
-await fs.writeFile(path.join(mission, 'completion-proof.json'), '{}\n');
-await fs.writeFile(path.join(mission, 'route-gate.json'), '{}\n');
-const index = await writeEvidenceIndexForProof(root, {
-    schema: 'sks.completion-proof.v1',
-    mission_id: 'M-evidence',
-    route: '$Team',
-    status: 'verified_partial',
-    evidence: { artifacts: ['route-gate.json'] },
-    claims: [],
-    unverified: ['fixture evidence'],
-    blockers: []
-});
-const ok = index.status === 'verified_partial' && index.records.every((record) => record.source !== 'mock' || record.trust !== 'high');
-console.log(JSON.stringify({ schema: 'sks.evidence-fixture-check.v1', ok, status: index.status, records: index.records.length, issues: index.issues }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-//# sourceMappingURL=evidence-fixture-check.js.map

package/dist/scripts/evidence-flagship-coverage-check.js

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { emitGate, requireContains, root } from './sks-1-12-real-execution-check-lib.js';
-requireContains('evidence:flagship-coverage', 'src/core/commands/image-ux-review-command.ts', [
-    'visualEvidence: { image_ux_review',
-    'IMAGE_UX_REVIEW_CALLOUT_EXTRACTION_REPORT_ARTIFACT'
-]);
-requireContains('evidence:flagship-coverage', 'src/core/commands/ppt-command.ts', [
-    'visualEvidence: { ppt_review',
-    'PPT_REVIEW_ARTIFACT_PATHS'
-]);
-requireContains('evidence:flagship-coverage', 'src/core/dfix.ts', [
-    'visualEvidence: { dfix',
-    'DFIX_VERIFICATION_SUGGESTION_ARTIFACT'
-]);
-requireContains('evidence:flagship-coverage', 'src/scripts/release-readiness-report.ts', [
-    'all_features_completion',
-    'image_ux_review',
-    'ppt_imagegen_review',
-    'dfix'
-]);
-requireContains('evidence:flagship-coverage', 'src/core/proof/route-finalizer.ts', [
-    'wrongnessProofEvidence',
-    'writeRouteCompletionProof'
-]);
-requireContains('evidence:flagship-coverage', 'src/core/trust-kernel/trust-report.ts', [
-    'buildTrustReport',
-    'evaluateWrongnessTrust'
-]);
-requireContains('evidence:flagship-coverage', 'src/core/evidence/flagship-proof-graph-validator.ts', [
-    'completionProofStatusOk',
-    'trustStatusOk'
-]);
-const report = {
-    schema: 'sks.evidence-flagship-coverage.v1',
-    ok: true,
-    gate: 'evidence:flagship-coverage',
-    flagship_routes: ['UX-Review', 'PPT Imagegen Review', 'DFix', 'All-feature completion'],
-    evidence_index_linked: true,
-    completion_proof_linked: true,
-    trust_linked: true,
-    wrongness_behavior_defined: true,
-    completion_proof_link_source: 'static_source_contract_and_status_validator',
-    trust_link_source: 'static_source_contract_and_status_validator',
-    wrongness_link_source: 'static_source_contract',
-    mock_real_cap_checked: true,
-    local_only_policy_checked: true
-};
-const out = path.join(root, '.sneakoscope', 'reports', 'evidence-flagship-coverage.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-emitGate('evidence:flagship-coverage', report);
-//# sourceMappingURL=evidence-flagship-coverage-check.js.map

package/dist/scripts/fake-real-proof-policy-v2-check.js

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/proof/fake-real-proof-policy.js');
-const fixtureReal = mod.evaluateFakeRealProofPolicy({
-    backend: 'codex-sdk',
-    real_parallel_claim: true,
-    output_schema_used: true,
-    output_last_message_path: 'result.json',
-    fixture_instrumented_real: true,
-    work_graph_quality_score: 0.8,
-    cleanup_proof: { ok: true }
-});
-const requiredMissing = mod.evaluateFakeRealProofPolicy({
-    backend: 'codex-sdk',
-    real_parallel_claim: true,
-    integration_optional: true,
-    require_real_dynamic_agents: true
-});
-const zellij = mod.evaluateFakeRealProofPolicy({ backend: 'zellij', zellij_pane_verified: true, work_graph_quality_score: 0.8, cleanup_proof: { ok: true } });
-assertGate(fixtureReal.proof_level === 'fixture_instrumented_real', 'fixture-instrumented real smoke must not be plain proven', fixtureReal);
-assertGate(requiredMissing.proof_level === 'real_required_missing' && requiredMissing.ok === false, 'required missing real runtime must block', requiredMissing);
-assertGate(zellij.subsystem_levels.zellij_pane === 'proven', 'real Zellij pane proof must be subsystem-proven', zellij);
-assertGate(zellij.subsystem_levels.cleanup === 'proven', 'cleanup proof level must be included', zellij);
-assertGate(zellij.subsystem_levels.work_graph === 'proven', 'work graph proof level must be included', zellij);
-emitGate('proof:fake-real-policy-v2', { fixture_real: fixtureReal.proof_level, required_missing: requiredMissing.proof_level });
-//# sourceMappingURL=fake-real-proof-policy-v2-check.js.map

package/dist/scripts/fake-vs-real-proof-policy-check.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/proof/fake-real-proof-policy.js');
-const fake = mod.evaluateFakeRealProofPolicy({ backend: 'fake', real_parallel_claim: false });
-assertGate(fake.ok === true && fake.proof_level === 'fixture_only', 'fake backend must be fixture_only', fake);
-const badFake = mod.evaluateFakeRealProofPolicy({ backend: 'fake', real_parallel_claim: true });
-assertGate(badFake.ok === false && badFake.blockers.includes('fake_backend_claimed_real_parallel'), 'fake backend cannot claim real parallel', badFake);
-const zellij = mod.evaluateFakeRealProofPolicy({ backend: 'zellij', zellij_pane_verified: true });
-assertGate(zellij.ok === true && zellij.proof_level === 'proven', 'real Zellij with pane evidence must be proven', zellij);
-const optional = mod.evaluateFakeRealProofPolicy({ backend: 'codex-sdk', real_parallel_claim: true, integration_optional: true });
-assertGate(optional.ok === true && optional.proof_level === 'integration_optional', 'unavailable real smoke must be integration_optional', optional);
-emitGate('proof:fake-vs-real-policy', { fake: fake.proof_level, zellij: zellij.proof_level, optional: optional.proof_level });
-//# sourceMappingURL=fake-vs-real-proof-policy-check.js.map

package/dist/scripts/fast-codex-service-tier-proof-check.js

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const syntax = await import(pathToFileURL(path.join(root, 'dist', 'core', 'codex', 'codex-cli-syntax-builder.js')).href);
-const fastMode = await import(pathToFileURL(path.join(root, 'dist', 'core', 'agents', 'fast-mode-policy.js')).href);
-const args = syntax.buildCodexExecArgs({ prompt: 'fixture', sandbox: 'workspace-write', serviceTier: 'fast' });
-const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-fast-tier-proof-'));
-const reportDir = path.join(temp, 'sessions', 'agent');
-fs.mkdirSync(reportDir, { recursive: true });
-fs.writeFileSync(path.join(reportDir, 'agent-process-report.json'), `${JSON.stringify({
-    schema: 'sks.agent-process-report.v1',
-    backend: 'codex-sdk',
-    fast_mode: true,
-    service_tier: 'fast',
-    sdk_config_service_tier: 'fast'
-})}\n`);
-fs.writeFileSync(path.join(reportDir, 'worker-fast-mode.json'), `${JSON.stringify({
-    schema: 'sks.native-cli-worker-fast-mode.v1',
-    fast_mode: true,
-    service_tier: 'fast'
-})}\n`);
-const proof = await fastMode.writeFastModePropagationProof(temp, { policy: fastMode.resolveFastModePolicy() });
-const ok = args.includes('-c')
-    && args.includes('service_tier=fast')
-    && !args.includes('--full-auto')
-    && !args.includes('--dangerously-bypass-approvals-and-sandbox')
-    && proof.ok === true;
-console.log(JSON.stringify({ schema: 'sks.fast-codex-service-tier-proof-check.v1', ok, args, proof }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-function fail(blocker, detail) {
-    console.log(JSON.stringify({ schema: 'sks.fast-codex-service-tier-proof-check.v1', ok: false, blocker, detail }, null, 2));
-    process.exit(1);
-}
-//# sourceMappingURL=fast-codex-service-tier-proof-check.js.map

package/dist/scripts/flagship-proof-graph-v2-check.js

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { writeCodexHookOfficialParityReport } from '../core/codex-hooks/codex-hook-official-parity.js';
-import { validateFlagshipProofGraph } from '../core/evidence/flagship-proof-graph-validator.js';
-const root = process.cwd();
-await refreshDependencyReports(root);
-const report = await validateFlagshipProofGraph(process.cwd());
-const out = path.join(process.cwd(), '.sneakoscope', 'reports', 'flagship-proof-graph-v2.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-console.log(JSON.stringify(report, null, 2));
-if (!report.ok)
-    process.exitCode = 1;
-async function refreshDependencyReports(root) {
-    await writeCodexHookOfficialParityReport(root, {
-        outputPath: path.join(root, '.sneakoscope', 'reports', 'codex-hook-parity-1.14.1.json')
-    });
-    for (const script of [
-        './dist/scripts/imagegen-real-smoke-check.js',
-        './dist/scripts/ppt-full-e2e-blackbox-check.js',
-        './dist/scripts/evidence-flagship-coverage-check.js'
-    ]) {
-        const run = spawnSync(process.execPath, [script], {
-            cwd: root,
-            env: process.env,
-            encoding: 'utf8',
-            maxBuffer: 8 * 1024 * 1024
-        });
-        if (run.status !== 0) {
-            const report = {
-                schema: 'sks.flagship-proof-graph.v2',
-                ok: false,
-                blocker: `dependency_report_failed:${script}`,
-                stdout_tail: run.stdout.slice(-2000),
-                stderr_tail: run.stderr.slice(-2000)
-            };
-            const out = path.join(root, '.sneakoscope', 'reports', 'flagship-proof-graph-v2.json');
-            fs.mkdirSync(path.dirname(out), { recursive: true });
-            fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-            console.log(JSON.stringify(report, null, 2));
-            process.exit(1);
-        }
-    }
-}
-//# sourceMappingURL=flagship-proof-graph-v2-check.js.map

package/dist/scripts/flagship-proof-graph-v3-check.js

@@ -1,67 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const reportDir = path.join(root, '.sneakoscope', 'reports');
-fs.mkdirSync(reportDir, { recursive: true });
-const initialFreshness = ensureDistFresh({ rebuild: true });
-if (!initialFreshness.ok) {
-    const report = { schema: 'sks.flagship-proof-graph.v3', ok: false, blocker: 'dist_not_fresh_before_dependencies', freshness: initialFreshness };
-    fs.writeFileSync(path.join(reportDir, 'flagship-proof-graph-v3.json'), `${JSON.stringify(report, null, 2)}\n`);
-    console.log(JSON.stringify(report, null, 2));
-    process.exit(1);
-}
-const dependencies = [
-    ['flagship-proof-graph-v2.json', './dist/scripts/flagship-proof-graph-v2-check.js'],
-    ['mad-sks-permission-model.json', './dist/scripts/mad-sks-permission-model-check.js'],
-    ['mad-sks-immutable-harness.json', './dist/scripts/mad-sks-immutable-harness-check.js'],
-    ['mad-sks-write-guard.json', './dist/scripts/mad-sks-write-guard-check.js'],
-    ['mad-sks-audit-proof.json', './dist/scripts/mad-sks-audit-proof-check.js'],
-    ['mad-sks-no-harness-modification.json', './dist/scripts/mad-sks-no-harness-modification-check.js'],
-    ['legacy-multiagent-removal.json', './dist/scripts/legacy-multiagent-removal-check.js'],
-    ['release-native-agent-fixture-check.json', './dist/scripts/release-native-agent-fixture-check.js'],
-    ['codex-exec-output-schema-actual-syntax.json', './dist/scripts/codex-exec-output-schema-actual-syntax-check.js'],
-    ['release-dist-freshness.json', './dist/scripts/release-dist-freshness-check.js']
-];
-for (const [name, script] of dependencies) {
-    const run = spawnSync(process.execPath, [script], { cwd: root, encoding: 'utf8', env: process.env, maxBuffer: 20 * 1024 * 1024 });
-    const parsed = parseLastJson(run.stdout);
-    if (parsed)
-        fs.writeFileSync(path.join(reportDir, name), `${JSON.stringify(parsed, null, 2)}\n`);
-    if (run.status !== 0) {
-        const report = { schema: 'sks.flagship-proof-graph.v3', ok: false, blocker: `dependency_failed:${script}`, stdout_tail: run.stdout.slice(-3000), stderr_tail: run.stderr.slice(-3000) };
-        fs.writeFileSync(path.join(reportDir, 'flagship-proof-graph-v3.json'), `${JSON.stringify(report, null, 2)}\n`);
-        console.log(JSON.stringify(report, null, 2));
-        process.exit(1);
-    }
-}
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok) {
-    const report = { schema: 'sks.flagship-proof-graph.v3', ok: false, blocker: 'dist_not_fresh', freshness };
-    fs.writeFileSync(path.join(reportDir, 'flagship-proof-graph-v3.json'), `${JSON.stringify(report, null, 2)}\n`);
-    console.log(JSON.stringify(report, null, 2));
-    process.exit(1);
-}
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'evidence', 'flagship-proof-graph-validator.js')).href);
-const report = await mod.validateFlagshipProofGraphV3(root);
-fs.writeFileSync(path.join(reportDir, 'flagship-proof-graph-v3.json'), `${JSON.stringify(report, null, 2)}\n`);
-console.log(JSON.stringify(report, null, 2));
-if (!report.ok)
-    process.exitCode = 1;
-function parseLastJson(text) {
-    const raw = String(text || '').trim();
-    if (!raw)
-        return null;
-    const start = raw.lastIndexOf('\n{');
-    const jsonText = start >= 0 ? raw.slice(start + 1) : raw;
-    try {
-        return JSON.parse(jsonText);
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=flagship-proof-graph-v3-check.js.map

package/dist/scripts/flagship-proof-graph-v4-check.js

@@ -1,61 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const reportDir = path.join(root, '.sneakoscope', 'reports');
-fs.mkdirSync(reportDir, { recursive: true });
-const initialFreshness = ensureDistFresh({ rebuild: true });
-if (!initialFreshness.ok)
-    fail('dist_not_fresh_before_dependencies', { freshness: initialFreshness });
-const dependencies = [
-    ['flagship-proof-graph-v3.json', './dist/scripts/flagship-proof-graph-v3-check.js'],
-    ['mad-sks-actual-executor-blackbox.json', './dist/scripts/mad-sks-actual-executor-blackbox.js'],
-    ['mad-sks-file-write-executor.json', './dist/scripts/mad-sks-file-write-executor-check.js'],
-    ['mad-sks-shell-executor.json', './dist/scripts/mad-sks-shell-executor-check.js'],
-    ['mad-sks-package-executor.json', './dist/scripts/mad-sks-package-executor-check.js'],
-    ['mad-sks-service-executor.json', './dist/scripts/mad-sks-service-executor-check.js'],
-    ['mad-sks-db-executor.json', './dist/scripts/mad-sks-db-executor-check.js'],
-    ['mad-sks-rollback-apply.json', './dist/scripts/mad-sks-rollback-apply-check.js'],
-    ['mad-sks-live-protected-core-smoke.json', './dist/scripts/mad-sks-live-protected-core-smoke.js'],
-    ['mad-sks-executor-proof-graph.json', './dist/scripts/mad-sks-executor-proof-graph-check.js']
-];
-for (const [name, script] of dependencies) {
-    const run = spawnSync(process.execPath, [script], { cwd: root, encoding: 'utf8', env: process.env, maxBuffer: 20 * 1024 * 1024 });
-    const parsed = parseLastJson(run.stdout);
-    if (parsed)
-        fs.writeFileSync(path.join(reportDir, name), `${JSON.stringify(parsed, null, 2)}\n`);
-    if (run.status !== 0)
-        fail(`dependency_failed:${script}`, { stdout_tail: run.stdout.slice(-3000), stderr_tail: run.stderr.slice(-3000) });
-}
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'evidence', 'flagship-proof-graph-validator.js')).href);
-const report = await mod.validateFlagshipProofGraphV4(root);
-fs.writeFileSync(path.join(reportDir, 'flagship-proof-graph-v4.json'), `${JSON.stringify(report, null, 2)}\n`);
-console.log(JSON.stringify(report, null, 2));
-if (!report.ok)
-    process.exitCode = 1;
-function fail(blocker, extra = {}) {
-    const report = { schema: 'sks.flagship-proof-graph.v4', ok: false, blocker, ...extra };
-    fs.writeFileSync(path.join(reportDir, 'flagship-proof-graph-v4.json'), `${JSON.stringify(report, null, 2)}\n`);
-    console.log(JSON.stringify(report, null, 2));
-    process.exit(1);
-}
-function parseLastJson(text) {
-    const raw = String(text || '').trim();
-    if (!raw)
-        return null;
-    const start = raw.lastIndexOf('\n{');
-    const jsonText = start >= 0 ? raw.slice(start + 1) : raw;
-    try {
-        return JSON.parse(jsonText);
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=flagship-proof-graph-v4-check.js.map

package/dist/scripts/git-precommit-fixture-check.js

@@ -1,41 +0,0 @@
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import assert from 'node:assert/strict';
-import { runProcess } from '../core/fsx.js';
-const bin = path.join(process.cwd(), 'dist', 'bin', 'sks.js');
-const runtimeRoot = await fixtureRoot('runtime');
-await runProcess('git', ['init'], { cwd: runtimeRoot });
-await runSks(runtimeRoot, ['git', 'install', '--json']);
-await fs.mkdir(path.join(runtimeRoot, '.sneakoscope', 'missions'), { recursive: true });
-await fs.writeFile(path.join(runtimeRoot, '.sneakoscope', 'missions', 'runtime.json'), '{}\n');
-await runProcess('git', ['add', '-f', '.sneakoscope/missions/runtime.json'], { cwd: runtimeRoot });
-const blocked = await runProcess(process.execPath, [bin, 'git', 'precommit', '--json'], { cwd: runtimeRoot });
-assert.equal(blocked.code, 1, blocked.stdout || blocked.stderr);
-assert.match(blocked.stdout, /runtime_noise_not_staged/);
-const sharedRoot = await fixtureRoot('shared');
-await runProcess('git', ['init'], { cwd: sharedRoot });
-await runSks(sharedRoot, ['git', 'install', '--json']);
-await fs.mkdir(path.join(sharedRoot, '.sneakoscope', 'wiki', 'records', 'claims'), { recursive: true });
-await fs.writeFile(path.join(sharedRoot, '.sneakoscope', 'wiki', 'records', 'claims', 'ok.json'), JSON.stringify({
-    schema: 'sks.triwiki-claim-record.v1',
-    id: 'ok',
-    status: 'supported',
-    claim: { text: 'Valid shared claim.' }
-}, null, 2));
-await runProcess('git', ['add', '.sneakoscope/wiki/records/claims/ok.json'], { cwd: sharedRoot });
-const allowed = await runProcess(process.execPath, [bin, 'git', 'precommit', '--json'], { cwd: sharedRoot });
-assert.equal(allowed.code, 0, allowed.stdout || allowed.stderr);
-console.log(JSON.stringify({ ok: true, schema: 'sks.git-precommit-fixture.v1' }, null, 2));
-async function fixtureRoot(name) {
-    const root = await fs.mkdtemp(path.join(os.tmpdir(), `sks-precommit-fixture-${name}-`));
-    await fs.writeFile(path.join(root, 'package.json'), '{"name":"fixture","private":true}\n');
-    return root;
-}
-async function runSks(root, args) {
-    const result = await runProcess(process.execPath, [bin, ...args], { cwd: root, env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' } });
-    assert.equal(result.code, 0, result.stdout || result.stderr);
-    return JSON.parse(result.stdout);
-}
-//# sourceMappingURL=git-precommit-fixture-check.js.map

package/dist/scripts/git-worktree-cache-performance-check.js

@@ -1,25 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const policyMod = await importDist('core/git/git-worktree-cache-policy.js');
-const now = Date.now();
-const entries = Array.from({ length: 1000 }, (_, index) => ({
-    path: `/tmp/wt-${index}`,
-    updated_at_ms: now - index * 60000,
-    bytes: 1024 * (index + 1),
-    dirty: index % 137 === 0
-}));
-const start = Date.now();
-const plan = policyMod.planGitWorktreeCachePolicy({ entries, nowMs: now, maxEntries: 120, maxBytes: 40 * 1024 * 1024, ttlMs: 2 * 60 * 60 * 1000 });
-const elapsed = Date.now() - start;
-assertGate(plan.ok === true, 'cache policy plan must pass', plan);
-assertGate(plan.keep.length <= 120 || plan.dirty_retained.length > 0, 'cache policy must bound retained clean entries', plan);
-assertGate(plan.dirty_retained.length > 0, 'dirty entries must be retained by cache policy', plan);
-assertGate(elapsed < 250, 'cache policy must stay fast on 1000 entries', { elapsed });
-emitGate('git:worktree-cache-performance', {
-    elapsed_ms: elapsed,
-    keep: plan.keep.length,
-    prune: plan.prune.length,
-    dirty_retained: plan.dirty_retained.length
-});
-//# sourceMappingURL=git-worktree-cache-performance-check.js.map