sneakoscope 2.0.13 → 2.0.15

package/dist/scripts/mad-preflight-blocks-unreadable-config-check.js

@@ -1,35 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root as repoRoot } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const fixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-preflight-'));
-await fs.mkdir(path.join(fixture, '.codex'), { recursive: true });
-await fs.mkdir(path.join(fixture, '.sneakoscope', 'reports'), { recursive: true });
-await fs.writeFile(path.join(fixture, '.codex', 'config.toml'), 'sandbox_mode = "workspace-write"\n');
-const mod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'core', 'preflight', 'parallel-preflight-engine.js')).href);
-const old = process.env.SKS_FAKE_CODEX_CONFIG_EPERM;
-process.env.SKS_FAKE_CODEX_CONFIG_EPERM = '1';
-const report = await mod.runCodexLaunchPreflight(fixture, {
-    fix: false,
-    codexBin: path.join(repoRoot, 'dist', 'scripts', 'fixtures', 'fake-codex-config-loader.js'),
-    tmuxSmoke: false
-});
-if (old === undefined)
-    delete process.env.SKS_FAKE_CODEX_CONFIG_EPERM;
-else
-    process.env.SKS_FAKE_CODEX_CONFIG_EPERM = old;
-const ok = report.ok === false && report.blockers.includes('codex_cli_config_eperm');
-console.log(JSON.stringify({ schema: 'sks.mad-preflight-blocks-unreadable-config-check.v1', ok, report }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-function fail(blocker, detail) {
-    console.log(JSON.stringify({ schema: 'sks.mad-preflight-blocks-unreadable-config-check.v1', ok: false, blocker, detail }, null, 2));
-    process.exit(1);
-}
-//# sourceMappingURL=mad-preflight-blocks-unreadable-config-check.js.map

package/dist/scripts/mad-sks-actual-executor-blackbox.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('actual-executor-blackbox');
-//# sourceMappingURL=mad-sks-actual-executor-blackbox.js.map

package/dist/scripts/mad-sks-app-ui-no-mutation-check.js

@@ -1,92 +0,0 @@
-#!/usr/bin/env node
-import assert from 'node:assert/strict';
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { madHighCommand } from '../core/commands/mad-sks-command.js';
-import { sha256 } from '../core/fsx.js';
-const original = {
-    cwd: process.cwd(),
-    home: process.env.HOME,
-    codexHome: process.env.CODEX_HOME,
-    noAttach: process.env.SKS_NO_ZELLIJ_ATTACH,
-    requireZellij: process.env.SKS_REQUIRE_ZELLIJ,
-    madSwarm: process.env.SKS_MAD_NATIVE_SWARM,
-    skipNpm: process.env.SKS_SKIP_NPM_FRESHNESS_CHECK
-};
-const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-ui-no-mutation-'));
-const home = path.join(tmp, 'home');
-const codexHome = path.join(home, '.codex');
-const configPath = path.join(codexHome, 'config.toml');
-try {
-    await fs.mkdir(codexHome, { recursive: true });
-    await fs.mkdir(path.join(tmp, '.sneakoscope'), { recursive: true });
-    await fs.writeFile(configPath, [
-        'service_tier = "fast"',
-        '[features]',
-        'fast_mode = true',
-        '[plugins."chrome@openai-bundled"]',
-        'enabled = false',
-        ''
-    ].join('\n'));
-    const before = await fs.readFile(configPath, 'utf8');
-    process.chdir(tmp);
-    process.env.HOME = home;
-    process.env.CODEX_HOME = codexHome;
-    process.env.SKS_NO_ZELLIJ_ATTACH = '1';
-    process.env.SKS_REQUIRE_ZELLIJ = '0';
-    process.env.SKS_MAD_NATIVE_SWARM = '0';
-    process.env.SKS_SKIP_NPM_FRESHNESS_CHECK = '1';
-    process.exitCode = 0;
-    await madHighCommand(['--no-attach', '--no-swarm'], {
-        maybePromptSksUpdateForLaunch: async () => ({ status: 'skipped' }),
-        maybePromptCodexUpdateForLaunch: async () => ({ status: 'skipped' }),
-        ensureMadLaunchDependencies: async () => ({ ready: true, actions: [] }),
-        maybePromptCodexLbSetupForLaunch: async () => ({ status: 'skipped' })
-    });
-    const after = await fs.readFile(configPath, 'utf8');
-    const entries = await fs.readdir(codexHome);
-    assert.equal(after, before);
-    assert.equal(entries.some((entry) => entry === 'sks-mad-high.config.toml'), false);
-    assert.equal(/\[profiles\.sks-mad-high\]/.test(after), false);
-    assert.equal(/enabled\s*=\s*false/.test(after), true);
-    process.exitCode = 0;
-    emit({
-        schema: 'sks.mad-sks-app-ui-no-mutation-check.v1',
-        ok: true,
-        before_hash: sha256(before),
-        after_hash: sha256(after),
-        profile_files_written: entries.filter((entry) => /sks-mad-high/.test(entry)),
-        plugin_disabled_preserved: true,
-        blockers: []
-    });
-}
-catch (err) {
-    emit({
-        schema: 'sks.mad-sks-app-ui-no-mutation-check.v1',
-        ok: false,
-        error: err?.message || String(err),
-        blockers: ['mad_sks_app_ui_no_mutation_failed']
-    });
-}
-finally {
-    process.chdir(original.cwd);
-    restoreEnv('HOME', original.home);
-    restoreEnv('CODEX_HOME', original.codexHome);
-    restoreEnv('SKS_NO_ZELLIJ_ATTACH', original.noAttach);
-    restoreEnv('SKS_REQUIRE_ZELLIJ', original.requireZellij);
-    restoreEnv('SKS_MAD_NATIVE_SWARM', original.madSwarm);
-    restoreEnv('SKS_SKIP_NPM_FRESHNESS_CHECK', original.skipNpm);
-}
-function restoreEnv(key, value) {
-    if (value == null)
-        delete process.env[key];
-    else
-        process.env[key] = value;
-}
-function emit(report) {
-    console.log(JSON.stringify(report, null, 2));
-    if (!report.ok)
-        process.exitCode = 1;
-}
-//# sourceMappingURL=mad-sks-app-ui-no-mutation-check.js.map

package/dist/scripts/mad-sks-audit-proof-check.js

@@ -1,34 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const permissionMod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'permission-model.js')).href);
-const authMod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'authorization-manifest.js')).href);
-const auditMod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'audit-ledger.js')).href);
-const rollbackMod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'rollback-plan.js')).href);
-const proofMod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'proof-evidence.js')).href);
-const permission = permissionMod.buildMadSksPermissionModel({ targetRoot: root, flags: permissionMod.parseMadSksFlags(['--mad-sks', '--allow-system']) });
-const authorization = authMod.createMadSksAuthorizationManifest({ permission, userIntent: 'fixture' });
-const ledger = auditMod.createMadSksAuditLedger({ targetRoot: root, actions: [auditMod.madSksAuditAction({ type: 'file_write', target: path.join(root, '.sneakoscope/tmp/file'), rollback_available: true })] });
-const rollback = rollbackMod.createMadSksRollbackPlan({ targetRoot: root, fileRollbacks: [{ path: '.sneakoscope/tmp/file', previous_content_hash: 'abc' }] });
-const proof = proofMod.createMadSksProofEvidence({
-    authorizationManifestPath: 'mad-sks-authorization.json',
-    auditLedgerPath: 'mad-sks-audit-ledger.json',
-    rollbackPlanPath: 'mad-sks-rollback-plan.json',
-    protectedCoreComparison: { ok: true },
-    verification: [{ command: 'fixture', ok: true }]
-});
-const ok = authorization.schema === 'sks.mad-sks-authorization.v1'
-    && ledger.schema === 'sks.mad-sks-audit-ledger.v1'
-    && rollback.schema === 'sks.mad-sks-rollback-plan.v1'
-    && proof.schema === 'sks.mad-sks-proof-evidence.v1'
-    && proof.ok === true;
-emit({ schema: 'sks.mad-sks-audit-proof-check.v1', ok, authorization, ledger, rollback, proof });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.mad-sks-audit-proof-check.v1', ok: false, blocker, detail }); process.exit(1); }
-//# sourceMappingURL=mad-sks-audit-proof-check.js.map

package/dist/scripts/mad-sks-db-executor-check.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('db-executor');
-//# sourceMappingURL=mad-sks-db-executor-check.js.map

package/dist/scripts/mad-sks-executor-proof-graph-check.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('executor-proof-graph');
-//# sourceMappingURL=mad-sks-executor-proof-graph-check.js.map

package/dist/scripts/mad-sks-fast-mode-propagation-check.js

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'agents', 'fast-mode-policy.js')).href);
-const policy = mod.resolveFastModePolicy({});
-const env = mod.fastModeEnv(policy);
-const report = {
-    schema: 'sks.mad-sks-fast-mode-propagation-check.v1',
-    ok: policy.fast_mode === true && policy.service_tier === 'fast' && env.SKS_FAST_MODE === '1' && env.SKS_SERVICE_TIER === 'fast',
-    mad_target_worker_env: env,
-    fast_mode: policy.fast_mode,
-    service_tier: policy.service_tier,
-    proof_level: 'fixture_instrumented_real',
-    blockers: []
-};
-const out = path.join(root, '.sneakoscope', 'reports', 'mad-sks-fast-mode-propagation.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(report.ok, 'MAD-SKS target worker fast env must default to fast', report);
-emitGate('mad-sks:fast-mode-propagation', { service_tier: report.service_tier });
-//# sourceMappingURL=mad-sks-fast-mode-propagation-check.js.map

package/dist/scripts/mad-sks-file-write-executor-check.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('file-write-executor');
-//# sourceMappingURL=mad-sks-file-write-executor-check.js.map

package/dist/scripts/mad-sks-immutable-harness-check.js

@@ -1,36 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'immutable-harness-guard.js')).href);
-const core = mod.resolveProtectedCore({ packageRoot: root, targetRoot: root });
-const engineAllowed = await mod.evaluateMadSksWrite({ packageRoot: root, targetRoot: root, operation: 'file_write', path: path.join(root, 'src', 'core', 'version.ts') });
-const installedRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-installed-core-'));
-await fs.mkdir(path.join(installedRoot, 'src', 'core'), { recursive: true });
-await fs.mkdir(path.join(installedRoot, 'scripts'), { recursive: true });
-await fs.writeFile(path.join(installedRoot, 'package.json'), '{"name":"sneakoscope","version":"1.18.13"}\n');
-await fs.writeFile(path.join(installedRoot, 'src', 'core', 'version.ts'), 'export const PACKAGE_VERSION = "1.18.13";\n');
-const installedCore = mod.resolveProtectedCore({ packageRoot: installedRoot, targetRoot: installedRoot });
-const blocked = await mod.evaluateMadSksWrite({ packageRoot: installedRoot, targetRoot: installedRoot, operation: 'file_write', path: path.join(installedRoot, 'src', 'core', 'version.ts') });
-const allowed = await mod.evaluateMadSksWrite({ packageRoot: root, targetRoot: root, operation: 'file_write', path: path.join(root, '.sneakoscope', 'tmp', 'target.txt') });
-const before = await mod.snapshotProtectedCore(root, 'before');
-const after = await mod.snapshotProtectedCore(root, 'after');
-const comparison = mod.compareProtectedCoreSnapshots(before, after);
-const ok = core.schema === 'sks.mad-sks-protected-core.v1'
-    && core.engine_source_exception === true
-    && engineAllowed.decision === 'allowed'
-    && installedCore.engine_source_exception === false
-    && blocked.decision === 'blocked'
-    && allowed.decision === 'allowed'
-    && comparison.ok === true;
-emit({ schema: 'sks.mad-sks-immutable-harness-check.v1', ok, core_count: core.protected_paths.length, core, engineAllowed, installedCore, blocked, allowed, comparison });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.mad-sks-immutable-harness-check.v1', ok: false, blocker, detail }); process.exit(1); }
-//# sourceMappingURL=mad-sks-immutable-harness-check.js.map

package/dist/scripts/mad-sks-no-harness-modification-check.js

@@ -1,25 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'immutable-harness-guard.js')).href);
-const before = await mod.snapshotProtectedCore(root, 'before');
-const engineSource = await mod.evaluateMadSksWrite({ packageRoot: root, targetRoot: root, operation: 'file_write', path: path.join(root, 'dist', 'bin', 'sks.js') });
-const installedRoot = path.join(root, 'node_modules', 'sneakoscope');
-const blocked = await mod.evaluateMadSksWrite({ packageRoot: installedRoot, targetRoot: installedRoot, operation: 'file_write', path: path.join(installedRoot, 'dist', 'bin', 'sks.js') });
-const after = await mod.snapshotProtectedCore(root, 'after');
-const comparison = mod.compareProtectedCoreSnapshots(before, after);
-const ok = engineSource.decision === 'allowed'
-    && engineSource.protected_core?.engine_source_exception === true
-    && blocked.decision === 'blocked'
-    && blocked.protected_core?.engine_source_exception === false
-    && comparison.ok === true;
-emit({ schema: 'sks.mad-sks-no-harness-modification-check.v1', ok, engineSource, blocked, comparison });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.mad-sks-no-harness-modification-check.v1', ok: false, blocker, detail }); process.exit(1); }
-//# sourceMappingURL=mad-sks-no-harness-modification-check.js.map

package/dist/scripts/mad-sks-package-executor-check.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('package-executor');
-//# sourceMappingURL=mad-sks-package-executor-check.js.map

package/dist/scripts/mad-sks-permission-model-check.js

@@ -1,22 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'permission-model.js')).href);
-const permission = mod.buildMadSksPermissionModel({
-    targetRoot: path.join(root, 'fixture-target'),
-    flags: mod.parseMadSksFlags(['--mad-sks', '--allow-system', '--allow-db-write', '--allow-package-install', '--allow-service-control', '--allow-network', '--allow-computer-use'])
-});
-const ok = permission.schema === 'sks.mad-sks-permission-model.v1'
-    && permission.mode === 'full_system_authority'
-    && permission.forbidden_scopes.includes('sks_harness_code')
-    && permission.allowed_scopes.includes('computer_use');
-emit({ schema: 'sks.mad-sks-permission-model-check.v1', ok, permission });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.mad-sks-permission-model-check.v1', ok: false, blocker, detail }); process.exit(1); }
-//# sourceMappingURL=mad-sks-permission-model-check.js.map

package/dist/scripts/mad-sks-rollback-apply-check.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('rollback-apply');
-//# sourceMappingURL=mad-sks-rollback-apply-check.js.map

package/dist/scripts/mad-sks-service-executor-check.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('service-executor');
-//# sourceMappingURL=mad-sks-service-executor-check.js.map

package/dist/scripts/mad-sks-shell-executor-check.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('shell-executor');
-//# sourceMappingURL=mad-sks-shell-executor-check.js.map

package/dist/scripts/mad-sks-write-guard-check.js

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mad-sks', 'write-guard.js')).href);
-const engineSource = await mod.guardMadSksFileOperation({ targetPath: path.join(root, 'package.json'), operation: 'file_write', root, targetRoot: root });
-const installedRoot = path.join(root, 'node_modules', 'sneakoscope');
-const blocked = await mod.guardMadSksFileOperation({ targetPath: path.join(installedRoot, 'package.json'), operation: 'file_write', root: installedRoot, targetRoot: installedRoot });
-const shell = await mod.classifyMadSksShellCommand({ command: 'sudo rm -rf ./src/core', cwd: root, root });
-const fakeOpenAi = `${'OPENAI'}_${'API'}_${'KEY'}=${'sk'}-${'proj'}-${'secretsecretsecret'}`;
-const fakeGithub = `${'github'}_${'pat'}_${'abcdef'}`;
-const redacted = mod.redactMadSksSecrets(`${fakeOpenAi} ${fakeGithub}`);
-const ok = engineSource.action === 'allow'
-    && engineSource.protected_core?.engine_source_exception === true
-    && blocked.action === 'block'
-    && blocked.protected_core?.engine_source_exception === false
-    && shell.action === 'confirm'
-    && !redacted.includes(fakeOpenAi.split('=').at(-1))
-    && !redacted.includes(fakeGithub);
-emit({ schema: 'sks.mad-sks-write-guard-check.v1', ok, engineSource, blocked, shell, redacted });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.mad-sks-write-guard-check.v1', ok: false, blocker, detail }); process.exit(1); }
-//# sourceMappingURL=mad-sks-write-guard-check.js.map

package/dist/scripts/mad-sks-zellij-default-pane-worker-check.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { packageRoot } from '../core/fsx.js';
-const root = packageRoot();
-const mad = await fs.readFile(path.join(root, 'src', 'core', 'commands', 'mad-sks-command.ts'), 'utf8');
-const parser = await fs.readFile(path.join(root, 'src', 'core', 'agents', 'agent-command-surface.ts'), 'utf8');
-const swarm = await fs.readFile(path.join(root, 'src', 'core', 'agents', 'native-cli-session-swarm.ts'), 'utf8');
-const manager = await fs.readFile(path.join(root, 'src', 'core', 'zellij', 'zellij-worker-pane-manager.ts'), 'utf8');
-const commandBody = mad.slice(mad.indexOf('export async function madHighCommand'), mad.indexOf('export async function startMadNativeSwarm'));
-const launchIndex = commandBody.indexOf('launchMadZellijUi(');
-const swarmIndex = commandBody.indexOf('startMadNativeSwarm(');
-const checks = {
-    no_runtime_enable_profile: !commandBody.includes('enableMadHighProfile('),
-    read_only_launch_profile: mad.includes('buildMadHighLaunchProfileNoWrite()'),
-    preflight_fix_default_false: mad.includes('fix: allowMadRepair'),
-    zellij_session_before_swarm: launchIndex >= 0 && swarmIndex >= 0 && launchIndex < swarmIndex,
-    main_only_session: mad.includes('slotCount: 0'),
-    zellij_default_backend: /return 'zellij'/.test(mad) && mad.includes("list.includes('--json')") && mad.includes("list.includes('--no-attach')"),
-    worker_command_real_zellij: mad.includes("command.push('--real')") && mad.includes("command.push('--zellij-session-name'") && mad.includes("command.push('--zellij-pane-worker')") && mad.includes("command.push('--worker-placement'"),
-    parser_accepts_worker_flags: parser.includes('--zellij-session-name') && parser.includes('--zellij-pane-worker') && parser.includes('--no-zellij-pane-worker'),
-    native_worker_pane_path: swarm.includes("this.input.backend === 'zellij'") && swarm.includes('ctx.opts.zellijPaneWorker !== false') && swarm.includes('openWorkerPane({'),
-    right_pane_requested: manager.includes("'--direction', directionRequested") && manager.includes("'--near-current-pane'")
-};
-const ok = Object.values(checks).every(Boolean);
-emit({
-    schema: 'sks.mad-sks-zellij-default-pane-worker-check.v1',
-    ok,
-    checks,
-    blockers: ok ? [] : Object.entries(checks).filter(([, passed]) => !passed).map(([name]) => name)
-});
-function emit(report) {
-    console.log(JSON.stringify(report, null, 2));
-    if (!report.ok)
-        process.exitCode = 1;
-}
-//# sourceMappingURL=mad-sks-zellij-default-pane-worker-check.js.map

package/dist/scripts/mad-sks-zellij-launch-check.js

@@ -1,102 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'zellij', 'zellij-launcher.js')).href);
-const report = await mod.launchMadZellijUi(['--workspace', 'sks-mad-check'], {
-    root,
-    missionId: 'M-zellij-launch-check',
-    ledgerRoot: path.join(root, '.sneakoscope', 'missions', 'M-zellij-launch-check', 'agents'),
-    dryRun: true,
-    codexArgs: ['--profile', 'sks-mad-high', '--sandbox', 'danger-full-access', '--ask-for-approval', 'never', '-c', 'service_tier=fast', '-c', 'model_provider="codex-lb"'],
-    launchEnv: { SKS_MAD_SKS_TARGET_ROOT: root, SKS_PROTECTED_CORE_POLICY: path.join(root, '.sneakoscope', 'missions', 'M-zellij-launch-check', 'mad-sks-protected-core-policy.json') }
-});
-const paneProofExists = await fs.access(path.join(root, '.sneakoscope', 'missions', 'M-zellij-launch-check', 'zellij-pane-proof.json')).then(() => true).catch(() => false);
-const layoutText = await fs.readFile(report.layout_path, 'utf8');
-const installHelpers = await fs.readFile(path.join(root, 'src', 'cli', 'install-helpers.ts'), 'utf8');
-const madCommand = await fs.readFile(path.join(root, 'src', 'core', 'commands', 'mad-sks-command.ts'), 'utf8');
-const installSafetyOk = !installHelpers.includes("--from-postinstall', '--install-scope', 'global', '--force', '--yes")
-    && installHelpers.includes('SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS')
-    && installHelpers.includes('(zellijRepair as any).error || zellij.blockers[0]')
-    && installHelpers.includes('Codex CLI is missing. Install latest Codex CLI');
-const consoleDetailOk = madCommand.includes("['stderr_tail'")
-    && madCommand.includes("['stdout_tail'")
-    && madCommand.includes('report: ${launch.report_path}');
-const autoAttachOk = madCommand.includes('shouldAutoAttachZellij(args)')
-    && madCommand.includes('attachZellijSessionInteractive(launch.session_name')
-    && madCommand.includes("list.includes('--no-attach')")
-    && madCommand.includes("list.includes('--json')")
-    && madCommand.includes('process.env.ZELLIJ')
-    && madCommand.includes("list.includes('--attach')")
-    && madCommand.includes('process.stdout.isTTY && process.stdin.isTTY');
-const nativeSwarmOk = madCommand.includes('startMadNativeSwarm(')
-    && madCommand.includes('stripMadLaunchOnlyArgs(args)')
-    && madCommand.includes('function madLaunchValueFlags()')
-    && madCommand.includes("route: '$MAD-SKS'")
-    && madCommand.includes("route_command: 'sks --mad native swarm'")
-    && madCommand.includes("same_mission_ledger: true")
-    && madCommand.includes('slotCount: 0')
-    && madCommand.includes('zellijSessionName: launch.session_name')
-    && madCommand.includes('mad_sks.native_swarm_started');
-const codexPaneChecks = {
-    main_pane_kind: report.main_pane_kind === 'codex_interactive',
-    report_enabled: report.codex_pane?.enabled === true,
-    report_no_alt_screen_arg: report.codex_pane.args.includes('--no-alt-screen'),
-    report_profile_arg: report.codex_pane.args.includes('--profile') && report.codex_pane.args.includes('sks-mad-high'),
-    report_sandbox_arg: report.codex_pane.args.includes('--sandbox') && report.codex_pane.args.includes('danger-full-access'),
-    report_approval_arg: report.codex_pane.args.includes('--ask-for-approval') && report.codex_pane.args.includes('never'),
-    report_service_tier_arg: report.codex_pane.args.includes('service_tier=fast'),
-    report_provider_arg: report.codex_pane.args.some((arg) => /model_provider=.*codex-lb/.test(arg)),
-    report_target_env: report.codex_pane.launch_env_keys.includes('SKS_MAD_SKS_TARGET_ROOT'),
-    report_policy_env: report.codex_pane.launch_env_keys.includes('SKS_PROTECTED_CORE_POLICY'),
-    layout_orchestrator_pane: layoutText.includes('pane name="orchestrator" command="sh"'),
-    layout_codex_exec: /exec\s+'?codex'?/.test(layoutText),
-    layout_no_alt_screen_arg: layoutText.includes('--no-alt-screen'),
-    layout_profile_arg: layoutText.includes('--profile') && layoutText.includes('sks-mad-high'),
-    layout_sandbox_arg: layoutText.includes('--sandbox') && layoutText.includes('danger-full-access'),
-    layout_approval_arg: layoutText.includes('--ask-for-approval') && layoutText.includes('never'),
-    layout_service_tier_arg: layoutText.includes('service_tier=fast'),
-    layout_provider_arg: /model_provider=.*codex-lb/.test(layoutText),
-    layout_not_status_shell: !layoutText.includes('sks status --json || true; exec')
-};
-const codexPaneOk = Object.values(codexPaneChecks).every(Boolean);
-const clipboardCliOk = report.launch_command.includes('--copy-command')
-    && report.launch_command.includes('pbcopy')
-    && report.launch_command.includes('--copy-on-select')
-    && report.launch_command.includes('true')
-    && report.launch_command.includes('--mouse-mode')
-    && report.launch_command[report.launch_command.indexOf('--mouse-mode') + 1] === 'true'
-    && report.clipboard_mouse_mode === true
-    && !report.launch_command.includes('--copy-clipboard');
-const ok = report.kind === 'mad'
-    && report.layout_artifact
-    && report.layout_path
-    && report.pane_proof_path
-    && paneProofExists
-    && Array.isArray(report.launch_command)
-    && report.launch_command.join(' ').includes('attach --create-background')
-    && report.launch_command.includes('--default-layout')
-    && !report.launch_command.includes('--layout')
-    && !JSON.stringify(report).includes('tmux attach')
-    && installSafetyOk
-    && consoleDetailOk
-    && autoAttachOk
-    && nativeSwarmOk
-    && clipboardCliOk
-    && codexPaneOk;
-const gate = { schema: 'sks.mad-sks-zellij-launch-check.v1', ok, install_safety_ok: installSafetyOk, console_detail_ok: consoleDetailOk, auto_attach_ok: autoAttachOk, native_swarm_ok: nativeSwarmOk, clipboard_cli_ok: clipboardCliOk, codex_pane_ok: codexPaneOk, codex_pane_checks: codexPaneChecks, report };
-await writeMadZellijLaunchGate(gate);
-emit(gate);
-async function writeMadZellijLaunchGate(gate) {
-    await fs.mkdir(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-    await fs.writeFile(path.join(root, '.sneakoscope', 'reports', 'mad-sks-zellij-launch.json'), `${JSON.stringify(gate, null, 2)}\n`);
-}
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.mad-sks-zellij-launch-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
-//# sourceMappingURL=mad-sks-zellij-launch-check.js.map

package/dist/scripts/mcp-0-134-modernization-check.js

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/mcp/mcp-0-134-policy.js');
-const policy = mod.detectMcp0134PolicyFromConfig([
-    {
-        path: 'fixture.json',
-        text: JSON.stringify({
-            mcp_servers: {
-                docs: {
-                    transport: 'streamable_http',
-                    env: { DOCS_TOKEN: 'x' },
-                    oauth: { client_id: 'fixture' }
-                }
-            }
-        })
-    },
-    {
-        path: 'fixture.toml',
-        text: '[mcp_servers.docs_toml]\ntransport = "streamable_http"\n[mcp_servers.docs_toml.env]\nDOCS_TOKEN = "x"\n[mcp_servers.docs_toml.oauth]\nclient_id = "fixture"\n'
-    }
-]);
-const readOnly = mod.classifyMcpToolForConcurrency({ name: 'docs_search', annotations: { readOnlyHint: true }, inputSchema: { type: 'object' } });
-const destructive = mod.classifyMcpToolForConcurrency({ name: 'docs_delete', annotations: { readOnlyHint: true }, inputSchema: { type: 'object' } });
-const camelCaseDestructive = mod.classifyMcpToolForConcurrency({ name: 'writeFile', annotations: { readOnlyHint: true }, inputSchema: { type: 'object' } });
-const namespacedDestructive = mod.classifyMcpToolForConcurrency({ name: 'filesystem.writeFile', annotations: { readOnlyHint: true }, inputSchema: { type: 'object' } });
-const compacted = mod.compactMcpToolSchema({ type: 'object', properties: { item: { $ref: '#/$defs/Item' } }, $defs: { Item: { type: 'string' } }, description: 'x'.repeat(10000) }, 512);
-const compactedDefinitions = mod.compactMcpToolSchema({ type: 'object', properties: { item: { $ref: '#/definitions/Item' } }, definitions: { Item: { type: 'string' } }, description: 'x'.repeat(10000) }, 512);
-const report = {
-    schema: 'sks.mcp-0.134-modernization-check.v1',
-    ok: true,
-    policy,
-    readOnly,
-    destructive,
-    camelCaseDestructive,
-    namespacedDestructive,
-    compacted,
-    compactedDefinitions
-};
-assertGate(policy.per_server_environment_supported === true, 'MCP 0.134 policy must detect per-server env targeting', report);
-assertGate(policy.streamable_http_oauth_supported === true, 'MCP 0.134 policy must detect streamable HTTP OAuth', report);
-assertGate(policy.servers.some((server) => server.name === 'docs_toml' && server.environment_keys.includes('DOCS_TOKEN')), 'MCP 0.134 policy must detect nested TOML per-server env tables', report);
-assertGate(readOnly.concurrency === 'candidate_parallel_readonly', 'readOnlyHint safe tool should be candidate parallel readonly', report);
-assertGate(destructive.concurrency === 'serial_required', 'destructive readOnlyHint tool must remain serial', report);
-assertGate(camelCaseDestructive.concurrency === 'serial_required', 'camelCase destructive readOnlyHint tool must remain serial', report);
-assertGate(namespacedDestructive.concurrency === 'serial_required', 'namespaced destructive readOnlyHint tool must remain serial', report);
-assertGate(compacted.preserved_ref_defs === true, 'schema compaction must preserve $ref/$defs evidence', report);
-assertGate(compactedDefinitions.schema.definitions?.Item?.type === 'string', 'schema compaction must preserve definitions refs without moving them to $defs', report);
-const out = path.join(root, '.sneakoscope', 'reports', 'mcp-0-134-modernization.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-emitGate('mcp:0.134-modernization', { servers: policy.servers.length });
-//# sourceMappingURL=mcp-0-134-modernization-check.js.map

package/dist/scripts/mcp-readonly-concurrency-check.js

@@ -1,17 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/mcp/mcp-0-134-policy.js');
-const readOnly = mod.classifyMcpToolForConcurrency({ name: 'search_docs', annotations: { readOnlyHint: true }, inputSchema: { type: 'object' } });
-const destructive = mod.classifyMcpToolForConcurrency({ name: 'delete_docs', annotations: { readOnlyHint: true }, inputSchema: { type: 'object' } });
-const report = { schema: 'sks.mcp-readonly-concurrency-check.v1', ok: readOnly.concurrency === 'candidate_parallel_readonly' && destructive.concurrency === 'serial_required', readOnly, destructive };
-const out = path.join(root, '.sneakoscope', 'reports', 'mcp-readonly-concurrency.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(readOnly.concurrency === 'candidate_parallel_readonly', 'readOnlyHint non-destructive tools may be parallel candidates', report);
-assertGate(destructive.concurrency === 'serial_required', 'destructive tools remain serial even with readOnlyHint', report);
-assertGate(readOnly.advisory_only === true, 'readOnlyHint must remain advisory only', report);
-emitGate('mcp:readonly-concurrency', { read_only: readOnly.concurrency, destructive: destructive.concurrency });
-//# sourceMappingURL=mcp-readonly-concurrency-check.js.map

package/dist/scripts/mcp-readonly-runtime-scheduler-check.js

@@ -1,20 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/mcp/mcp-0-134-policy.js');
-const proof = await mod.proveMcpReadOnlyRuntimeScheduler();
-const report = { schema: 'sks.mcp-readonly-runtime-scheduler-check.v1', ok: proof.ok, proof };
-const out = path.join(root, '.sneakoscope', 'reports', 'mcp-readonly-runtime-scheduler.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(proof.read_only_parallel === true, 'readOnlyHint fixtures must overlap at runtime', report);
-assertGate(proof.write_serial === true, 'write-capable MCP fixtures must be serialized', report);
-assertGate(proof.destructive_false_positive_blocked === true, 'destructive readOnlyHint false positive must be blocked', report);
-assertGate(proof.tools.every((row) => Number.isFinite(row.started_at_ms) && Number.isFinite(row.ended_at_ms)), 'MCP scheduler proof must include timestamps', report);
-assertGate(proof.ok === true, 'MCP runtime scheduler proof must be blocker-free', report);
-assertGate(proof.overlap_evidence.length >= 1, 'MCP scheduler proof must include actual overlap evidence rows', report);
-assertGate(proof.tools.filter((row) => row.scheduled_mode === 'parallel_readonly_batch').length >= 3, 'MCP scheduler proof must use at least three read-only tools', report);
-emitGate('mcp:readonly-runtime-scheduler', { overlaps: proof.overlap_evidence.length });
-//# sourceMappingURL=mcp-readonly-runtime-scheduler-check.js.map

package/dist/scripts/mcp-tool-naming-parity-check.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mcp', 'mcp-tool-name-normalizer.js')).href);
-const report = mod.normalizeMcpToolInventory([{ server: 'github', name: 'search issues' }, { server: 'github', name: 'search_issues' }]);
-const ok = report.ok && report.collision_count === 1 && report.normalized.every((row) => row.normalized_name.includes('github'));
-emit({ schema: 'sks.mcp-tool-naming-parity-check.v1', ok, report });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.mcp-tool-naming-parity-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
-//# sourceMappingURL=mcp-tool-naming-parity-check.js.map