sneakoscope 2.0.2 → 2.0.5

package/dist/core/safety/mutation-guard.js

@@ -162,6 +162,8 @@ export async function guardedProcessKill(ctx, pid, opts = {}) {
 export async function guardedPackageInstall(ctx, spec, opts) {
     return guard(ctx, 'package_install', spec, opts, async () => {
         const runOpts = { timeoutMs: opts.timeoutMs ?? 600000 };
+        if (opts.cwd !== undefined)
+            runOpts.cwd = opts.cwd;
         if (opts.env !== undefined)
             runOpts.env = opts.env;
         if (opts.maxOutputBytes !== undefined)

package/dist/core/update-check.js

@@ -1,6 +1,8 @@
 import os from 'node:os';
 import path from 'node:path';
 import { PACKAGE_VERSION, packageRoot, readJson, runProcess, which } from './fsx.js';
+import { createRequestedScopeContract } from './safety/requested-scope-contract.js';
+import { guardedPackageInstall, guardContextForRoute } from './safety/mutation-guard.js';
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
 export async function runSksUpdateCheck(options = {}) {
     const packageName = options.packageName || 'sneakoscope';
@@ -17,9 +19,21 @@ export async function runSksUpdateCheck(options = {}) {
         effectiveOptions.timeoutMs = options.timeoutMs;
     if (options.maxOutputBytes !== undefined)
         effectiveOptions.maxOutputBytes = options.maxOutputBytes;
-    const effective = await detectEffectiveSksVersion(effectiveOptions);
-    const current = effective.current;
     const override = env[versionOverrideEnvName(packageName)];
+    const effectivePromise = detectEffectiveSksVersion(effectiveOptions);
+    const latestPromise = !override && npmBin
+        ? runProcess(npmBin, ['view', packageName, 'version', '--silent', '--registry', registry], {
+            env,
+            timeoutMs: options.timeoutMs ?? 5000,
+            maxOutputBytes: options.maxOutputBytes ?? 4096
+        }).catch((err) => ({
+            code: 1,
+            stdout: '',
+            stderr: err instanceof Error ? err.message : String(err)
+        }))
+        : Promise.resolve(null);
+    const effective = await effectivePromise;
+    const current = effective.current;
     if (override)
         return buildResult({ packageName, current, effective, latest: override, registry, npmBin });
     if (!npmBin) {
@@ -33,16 +47,18 @@ export async function runSksUpdateCheck(options = {}) {
             error: 'npm not found on PATH'
         });
     }
-    const args = ['view', packageName, 'version', '--silent', '--registry', registry];
-    const result = await runProcess(npmBin, args, {
-        env,
-        timeoutMs: options.timeoutMs ?? 5000,
-        maxOutputBytes: options.maxOutputBytes ?? 4096
-    }).catch((err) => ({
-        code: 1,
-        stdout: '',
-        stderr: err instanceof Error ? err.message : String(err)
-    }));
+    const result = await latestPromise;
+    if (!result) {
+        return buildResult({
+            packageName,
+            current,
+            effective,
+            latest: null,
+            registry,
+            npmBin,
+            error: 'npm view failed'
+        });
+    }
     if (result.code !== 0) {
         return buildResult({
             packageName,
@@ -157,7 +173,17 @@ export async function runSksUpdateNow(options = {}) {
             error: null
         });
     }
-    const install = await runProcess(npmBin, npmArgs, {
+    const mutationLedgerRoot = env.SKS_MUTATION_LEDGER_ROOT || packageRoot();
+    const installContract = createRequestedScopeContract({
+        route: 'update',
+        userRequest: command || `npm global install ${packageName}`,
+        projectRoot: mutationLedgerRoot,
+        overrides: { package_install: true }
+    });
+    const install = await guardedPackageInstall(guardContextForRoute(mutationLedgerRoot, installContract, command || `npm global install ${packageName}`), `${packageName}@${installVersion}`, {
+        confirmed: true,
+        command: npmBin,
+        args: npmArgs,
         cwd,
         env,
         timeoutMs: options.timeoutMs ?? 10 * 60 * 1000,
@@ -202,25 +228,34 @@ export async function detectEffectiveSksVersion(options = {}) {
     };
     add(options.currentVersion || PACKAGE_VERSION, 'runtime');
     add(env.SKS_INSTALLED_SKS_VERSION, 'env:SKS_INSTALLED_SKS_VERSION');
-    const pkg = await readJson(path.join(packageRoot(), 'package.json'), {}).catch(() => ({}));
-    add(pkg?.version, 'packageRoot:package.json');
-    const sks = await which('sks').catch(() => null);
-    if (sks) {
+    const packageRootPromise = readJson(path.join(packageRoot(), 'package.json'), {}).catch(() => ({}));
+    const pathSksPromise = which('sks')
+        .then(async (sks) => {
+        if (!sks)
+            return null;
         const result = await runProcess(sks, ['--version'], {
             timeoutMs: 2000,
             maxOutputBytes: 4096,
             env: { ...env, SKS_DISABLE_UPDATE_CHECK: '1' }
         }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
-        if (result.code === 0)
-            add(result.stdout, `PATH:${sks}`);
-        else
-            errors.push(`path_sks_version:${String(result.stderr || result.stdout || 'failed').trim()}`);
-    }
-    if (npmBin) {
-        const npmGlobal = await detectNpmGlobalPackageVersion(npmBin, packageName, env, {
+        return { sks, result };
+    })
+        .catch(() => null);
+    const npmGlobalPromise = npmBin
+        ? detectNpmGlobalPackageVersion(npmBin, packageName, env, {
             timeoutMs: options.timeoutMs ?? 2500,
             maxOutputBytes: options.maxOutputBytes ?? 8192
-        }).catch((err) => ({ version: null, error: err?.message || String(err) }));
+        }).catch((err) => ({ version: null, error: err?.message || String(err) }))
+        : Promise.resolve(null);
+    const [pkg, pathSks, npmGlobal] = await Promise.all([packageRootPromise, pathSksPromise, npmGlobalPromise]);
+    add(pkg?.version, 'packageRoot:package.json');
+    if (pathSks?.sks) {
+        if (pathSks.result.code === 0)
+            add(pathSks.result.stdout, `PATH:${pathSks.sks}`);
+        else
+            errors.push(`path_sks_version:${String(pathSks.result.stderr || pathSks.result.stdout || 'failed').trim()}`);
+    }
+    if (npmGlobal) {
         add(npmGlobal.version, `npm-global:${packageName}`);
         if (npmGlobal.error)
             errors.push(`npm_global_version:${npmGlobal.error}`);

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '2.0.2';
+export const PACKAGE_VERSION = '2.0.5';
 //# sourceMappingURL=version.js.map

package/dist/core/zellij/zellij-lane-runtime.js

@@ -176,10 +176,10 @@ export function extractZellijPaneIdFromOutput(text) {
     }
     const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     for (const line of lines.slice().reverse()) {
-        const direct = line.match(/^(?:pane[_ -]?id[:=]\s*)?([0-9]+)$/i);
+        const direct = line.match(/^(?:pane[_ -]?id[:=]\s*)?([0-9]+|terminal_[0-9]+)$/i);
         if (direct?.[1])
             return direct[1];
-        const embedded = line.match(/\bpane[_ -]?id[:=]\s*([0-9]+)\b/i);
+        const embedded = line.match(/\bpane[_ -]?id[:=]\s*([0-9]+|terminal_[0-9]+)\b/i);
         if (embedded?.[1])
             return embedded[1];
     }

package/dist/core/zellij/zellij-naruto-dashboard.js

@@ -0,0 +1,36 @@
+export function planNarutoZellijDashboard(input) {
+    const targetActiveWorkers = Math.max(1, Math.floor(Number(input.targetActiveWorkers || 1)));
+    const visiblePaneCap = Math.max(1, Math.floor(Number(input.visiblePaneCap || 12)));
+    const visibleWorkerPanes = Math.min(targetActiveWorkers, visiblePaneCap);
+    const headlessWorkers = Math.max(0, targetActiveWorkers - visibleWorkerPanes);
+    const backend = input.backend || 'codex-sdk';
+    const roles = input.roles && input.roles.length ? input.roles : ['implementer', 'modifier', 'verifier', 'test_writer'];
+    const paneTitles = Array.from({ length: visibleWorkerPanes }, (_, index) => {
+        const slot = `slot-${String(index + 1).padStart(3, '0')}`;
+        const role = roles[index % roles.length] || 'worker';
+        return `${slot}/gen-1 · ${role} · ${backend} · active`;
+    });
+    const blockers = [
+        ...(visibleWorkerPanes > visiblePaneCap ? ['naruto_zellij_visible_panes_exceed_cap'] : []),
+        ...(headlessWorkers < 0 ? ['naruto_zellij_headless_negative'] : [])
+    ];
+    return {
+        schema: 'sks.zellij-naruto-dashboard.v1',
+        target_active_workers: targetActiveWorkers,
+        visible_pane_cap: visiblePaneCap,
+        visible_worker_panes: visibleWorkerPanes,
+        headless_workers: headlessWorkers,
+        dashboard: {
+            active: targetActiveWorkers,
+            visible: visibleWorkerPanes,
+            headless: headlessWorkers,
+            completed: Math.max(0, Math.floor(Number(input.completed || 0))),
+            failed: Math.max(0, Math.floor(Number(input.failed || 0))),
+            backpressure: input.backpressure || 'normal'
+        },
+        pane_titles: paneTitles,
+        ok: blockers.length === 0,
+        blockers
+    };
+}
+//# sourceMappingURL=zellij-naruto-dashboard.js.map

package/dist/core/zellij/zellij-worker-pane-manager.js

@@ -9,10 +9,10 @@ export const ZELLIJ_WORKER_PANE_EVENT_SCHEMA = 'sks.zellij-worker-pane-event.v1'
 export function buildWorkerPaneName(slotId, generationIndex) {
     return `${slotId}/gen-${Math.max(1, Math.floor(Number(generationIndex) || 1))}`;
 }
-export function buildWorkerPaneTitle(slotId, generationIndex, context, serviceTier) {
+export function buildWorkerPaneTitle(slotId, generationIndex, context, serviceTier, backend, status) {
     const base = buildWorkerPaneName(slotId, generationIndex);
     const normalized = normalizePaneProviderContext(context, serviceTier);
-    return `${base} · codex-sdk · ${providerPaneLabel(normalized)}`;
+    return `${base} · ${backend || 'codex-sdk'} · ${providerPaneLabel(normalized)} · ${status || 'launching'}`;
 }
 export function isRealZellijWorkerPaneIdSource(value) {
     return value === 'zellij_worker_new_pane_stdout' || value === 'zellij_worker_list_panes';
@@ -22,7 +22,7 @@ export function buildWorkerPaneArtifact(input) {
     const paneIdSource = input.paneIdSource || 'zellij_worker_pane_launch_failed';
     const blockers = input.blockers || [];
     const providerContext = normalizePaneProviderContext(input.providerContext, input.serviceTier);
-    const paneTitle = buildWorkerPaneTitle(input.slotId, input.generationIndex, providerContext, input.serviceTier);
+    const paneTitle = buildWorkerPaneTitle(input.slotId, input.generationIndex, providerContext, input.serviceTier, input.backend, input.status || input.statusLabel);
     return {
         schema: ZELLIJ_WORKER_PANE_SCHEMA,
         generated_at: now,
@@ -82,7 +82,7 @@ export async function openWorkerPane(input) {
         timeoutMs: 5000,
         optional: false
     });
-    const paneName = buildWorkerPaneTitle(input.slotId, input.generationIndex, providerContext, input.serviceTier);
+    const paneName = buildWorkerPaneTitle(input.slotId, input.generationIndex, providerContext, input.serviceTier, input.backend, input.statusLabel || 'running');
     let launch = createSession.ok
         ? await runZellij(['--session', input.sessionName, 'action', 'new-pane', '--direction', 'right', '--name', paneName, '--', 'sh', '-lc', input.workerCommand], {
             cwd,

package/dist/scripts/blackbox-command-import-smoke.js

@@ -5,6 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
+import { currentDistFreshness } from './lib/ensure-dist-fresh.js';
 const root = process.cwd();
 const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-command-import-smoke-'));
@@ -16,7 +17,15 @@ const rows = [];
 fs.mkdirSync(consumer, { recursive: true });
 fs.writeFileSync(path.join(consumer, 'package.json'), `${JSON.stringify({ name: 'sks-command-smoke-consumer', private: true }, null, 2)}\n`);
 try {
-    run('build', npmBin, ['run', 'build'], { cwd: root });
+    if (process.env.SKS_ENSURE_DIST_NO_REBUILD === '1' || process.env.SKS_RELEASE_DIST_FRESHNESS_NO_REBUILD === '1') {
+        const freshness = currentDistFreshness();
+        rows.push({ label: 'dist_freshness', ok: freshness.ok, status: freshness.ok ? 0 : 1, issues: freshness.issues });
+        if (!freshness.ok)
+            failures.push(`dist_not_fresh:${freshness.issues.join(',')}`);
+    }
+    else {
+        run('build', npmBin, ['run', 'build'], { cwd: root });
+    }
     const pack = run('npm_pack', npmBin, ['pack', '--json', '--ignore-scripts', '--pack-destination', tmp, '--registry', 'https://registry.npmjs.org/'], { cwd: root });
     const info = pack.ok ? JSON.parse(pack.stdout || '[]')[0] : null;
     const tarball = info ? path.join(tmp, info.filename) : null;

package/dist/scripts/check-package-boundary.js

@@ -5,12 +5,21 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { currentDistFreshness } from './lib/ensure-dist-fresh.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 const issues = [];
-const build = spawnSync(npmBin, ['run', 'build'], { cwd: root, encoding: 'utf8', stdio: 'pipe' });
-if (build.status !== 0)
-    issues.push(`build_failed:${tail(build.stderr || build.stdout)}`);
+const noRebuild = process.env.SKS_ENSURE_DIST_NO_REBUILD === '1' || process.env.SKS_RELEASE_DIST_FRESHNESS_NO_REBUILD === '1';
+if (noRebuild) {
+    const freshness = currentDistFreshness();
+    if (!freshness.ok)
+        issues.push(`dist_not_fresh:${freshness.issues.join(',')}`);
+}
+else {
+    const build = spawnSync(npmBin, ['run', 'build'], { cwd: root, encoding: 'utf8', stdio: 'pipe' });
+    if (build.status !== 0)
+        issues.push(`build_failed:${tail(build.stderr || build.stdout)}`);
+}
 const pack = spawnSync(npmBin, ['pack', '--dry-run', '--json', '--ignore-scripts'], {
     cwd: root,
     encoding: 'utf8',

package/dist/scripts/codex-0-137-compat-check.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
+const freshness = ensureDistFresh({ rebuild: true });
+if (!freshness.ok)
+    fail('dist_not_fresh', { freshness });
+const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'codex', 'codex-0-137-compat.js')).href);
+const evidence = await mod.collectCodex0137LocalEvidence();
+const matrix = mod.codex0137Matrix({
+    version: evidence.versionText,
+    available: evidence.available,
+    pluginListText: evidence.pluginListText,
+    debugModelsText: evidence.debugModelsText,
+    doctorText: evidence.doctorText,
+    requireReal: process.argv.includes('--require-real') || process.env.SKS_REQUIRE_CODEX_0137 === '1'
+});
+const report = { ...matrix, local_evidence: evidence };
+await fs.mkdir(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+await fs.writeFile(path.join(root, '.sneakoscope', 'reports', 'codex-0.137-compat.json'), `${JSON.stringify(report, null, 2)}\n`);
+emit(report);
+function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
+    process.exitCode = 1; }
+function fail(blocker, detail) { emit({ schema: 'sks.codex-0.137-compat-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
+//# sourceMappingURL=codex-0-137-compat-check.js.map

package/dist/scripts/codex-environment-scoped-approvals-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+const proof = readText('src/core/codex-control/codex-control-proof.ts');
+const sandbox = readText('src/core/codex-control/codex-sdk-sandbox-policy.ts');
+assertGate(proof.includes('sandbox:'), 'Codex control proof must include sandbox scope');
+assertGate(proof.includes('env:'), 'Codex control proof must include environment proof');
+assertGate(sandbox.includes('mad_sks_authorized') || sandbox.includes('user_confirmed_full_access'), 'Sandbox policy must include scoped authorization signals');
+emitGate('codex:environment-scoped-approvals', { proof: ['sandbox', 'env', 'scoped_authorization'] });
+//# sourceMappingURL=codex-environment-scoped-approvals-check.js.map

package/dist/scripts/codex-plugin-list-json-check.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+const source = readText('src/core/codex/codex-0-137-compat.ts');
+assertGate(source.includes("run(['plugin', 'list', '--json'])"), '0.137 evidence must run codex plugin list --json');
+assertGate(source.includes('looksLikeJson'), '0.137 plugin list JSON parser missing');
+emitGate('codex:plugin-list-json', { detector: 'codex plugin list --json' });
+//# sourceMappingURL=codex-plugin-list-json-check.js.map

package/dist/scripts/codex-sdk-team-naruto-agent-pipeline-check.js

@@ -6,6 +6,7 @@ const naruto = readText('src/core/commands/naruto-command.ts');
 const agent = readText('src/core/agents/agent-command-surface.ts');
 assertGate(team.includes("backend: mock ? 'fake' : 'codex-sdk'"), 'Team must default to codex-sdk');
 assertGate(naruto.includes("backend: 'codex-sdk'"), 'Naruto help/defaults must expose codex-sdk');
-assertGate(agent.includes("hasFlag(args, '--mock') ? 'fake' : 'codex-sdk'"), 'Agent command surface must default to codex-sdk');
+assertGate(agent.includes("useOllama && !noOllama ? 'ollama' : 'codex-sdk'"), 'Agent command surface must default to codex-sdk unless local model is explicit');
+assertGate(agent.includes('backendExplicit'), 'Agent command surface must preserve explicit backend/local-model intent');
 emitGate('codex-sdk:team-naruto-agent-pipeline', { routes: ['$Team', '$Naruto', '$Agent'] });
 //# sourceMappingURL=codex-sdk-team-naruto-agent-pipeline-check.js.map

package/dist/scripts/codex-thread-runtime-choice-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+const runner = readText('src/core/codex-control/codex-task-runner.ts');
+const registry = readText('src/core/codex-control/codex-thread-registry.ts');
+assertGate(runner.includes('backendPreference'), 'Codex task runner must carry backend/runtime preference');
+assertGate(runner.includes('backend_family'), 'Codex task runner must persist backend family');
+assertGate(registry.includes('recordCodexThread'), 'Codex thread registry missing');
+emitGate('codex:thread-runtime-choice', { runtime_choice: 'backendPreference/backend_family' });
+//# sourceMappingURL=codex-thread-runtime-choice-check.js.map

package/dist/scripts/gpt-final-arbiter-check.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, readJsonFile, root } from './lib/codex-sdk-gate-lib.js';
+const mod = await importDist('core/codex-control/gpt-final-arbiter.js');
+const old = snapshotEnv();
+process.env.NODE_ENV = 'test';
+process.env.SKS_CODEX_SDK_FAKE = '1';
+delete process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE;
+try {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-gpt-final-arbiter-'));
+    const approved = await mod.runGptFinalArbiter(fixtureInput('approved'), { cwd: root, mutationLedgerRoot: tmp });
+    assertGate(approved.ok === true, 'GPT final arbiter fixture must approve safe candidate', approved);
+    assertGate(approved.backend === 'codex-sdk', 'GPT final arbiter backend must be codex-sdk');
+    assertGate(approved.result.status === 'approved', 'safe candidate must return approved');
+    assertGate(approved.final_gate.ok === true, 'approved arbiter result must pass final gate');
+    const artifact = await readJsonFile(path.join(tmp, 'gpt-final-arbiter.json'));
+    assertGate(artifact.result.schema === 'sks.gpt-final-arbiter-result.v1', 'arbiter artifact must contain schema-valid result');
+    const unsafeTmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-gpt-final-arbiter-unsafe-'));
+    const rejected = await mod.runGptFinalArbiter({ ...fixtureInput('unsafe'), candidate_diff: 'unsafe delete all credential patch' }, { cwd: root, mutationLedgerRoot: unsafeTmp });
+    assertGate(rejected.ok === false, 'unsafe candidate must not pass final arbiter');
+    assertGate(rejected.result.status === 'rejected', 'unsafe candidate must be rejected');
+    assertGate(rejected.blockers.includes('unsafe_candidate_patch'), 'unsafe rejection blocker must be preserved');
+    emitGate('local-collab:gpt-final-arbiter', { approved: approved.result.status, rejected: rejected.result.status });
+}
+finally {
+    restoreEnv(old);
+}
+function fixtureInput(label) {
+    return {
+        schema: 'sks.gpt-final-arbiter-input.v1',
+        route: '$Naruto',
+        mission_id: `M-${label}`,
+        local_mode: 'local-parallel-gpt-final',
+        local_outputs: [
+            { worker_id: 'slot-001/gen-1', backend: 'local-llm', summary: 'candidate patch drafted', patch_envelopes: [], proof: 'local draft' }
+        ],
+        candidate_diff: 'diff --git a/example.ts b/example.ts',
+        candidate_patch_envelopes: [],
+        verification_results: [{ ok: true, status: 'passed' }],
+        side_effect_report: { ok: true },
+        mutation_ledger: { ok: true },
+        rollback_plan: { ok: true }
+    };
+}
+function snapshotEnv() {
+    return {
+        NODE_ENV: process.env.NODE_ENV,
+        SKS_CODEX_SDK_FAKE: process.env.SKS_CODEX_SDK_FAKE,
+        SKS_GPT_FINAL_ARBITER_UNAVAILABLE: process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE
+    };
+}
+function restoreEnv(old) {
+    for (const [key, value] of Object.entries(old)) {
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+}
+//# sourceMappingURL=gpt-final-arbiter-check.js.map

package/dist/scripts/gpt-final-arbiter-performance-check.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const compressor = await importDist('core/codex-control/gpt-final-context-compressor.js');
+const local_outputs = Array.from({ length: 20 }, (_, index) => ({
+    worker_id: `slot-${String(index + 1).padStart(3, '0')}/gen-1`,
+    backend: 'local-llm',
+    status: 'done',
+    summary: `worker ${index + 1} summarized a bounded shard`,
+    changed_files: [`src/example-${index + 1}.ts`],
+    blockers: []
+}));
+const candidate_patch_envelopes = local_outputs.map((output, index) => ({
+    id: `patch-${index + 1}`,
+    agent_id: output.worker_id,
+    source: 'model_authored',
+    lease_id: `lease-${index + 1}`,
+    rollback_hint: { ok: true },
+    operations: [{ op: 'replace', path: output.changed_files[0], search: 'before', replace: 'after' }]
+}));
+const report = compressor.compressGptFinalContext({
+    route: '$Naruto',
+    mission_id: 'M-20-local-workers',
+    local_mode: 'local-parallel-gpt-final',
+    local_outputs,
+    candidate_patch_envelopes,
+    verification_results: [{ ok: true, status: 'passed' }],
+    side_effect_report: { ok: true },
+    mutation_ledger: { ok: true },
+    rollback_plan: { ok: true }
+});
+assertGate(report.proof_pack.worker_count === 20, 'proof pack must include 20 worker summaries');
+assertGate(report.proof_pack.token_budget_estimate < 8000, '20-worker proof pack must stay under token budget', report.proof_pack);
+assertGate(report.latency_budget.ok === true, 'GPT final latency budget report must pass');
+emitGate('local-collab:gpt-final-performance', { workers: report.proof_pack.worker_count, token_budget_estimate: report.proof_pack.token_budget_estimate });
+//# sourceMappingURL=gpt-final-arbiter-performance-check.js.map

package/dist/scripts/local-collab-all-pipelines-final-gpt-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const finalizer = await importDist('core/pipeline/finalize-pipeline-result.js');
+const blocked = await finalizer.finalizePipelineResult({
+    route: '$Team',
+    missionId: 'M-local-final-gpt',
+    localParticipated: true,
+    candidateResults: [{ backend: 'local-llm', summary: 'draft' }],
+    candidatePatchEnvelopes: [],
+    verificationResults: [],
+    sideEffectReport: {},
+    mutationLedger: {},
+    rollbackPlan: {},
+    applyPatches: true,
+    forceGptFinalUnavailable: true
+});
+assertGate(blocked.ok === false, 'local participation without GPT final must block finalization');
+assertGate(blocked.blockers.includes('gpt_final_arbiter_required_not_passed'), 'missing GPT final blocker required');
+emitGate('local-collab:all-pipelines-final-gpt', { final_status: blocked.final_status, blockers: blocked.blockers.length });
+//# sourceMappingURL=local-collab-all-pipelines-final-gpt-check.js.map

package/dist/scripts/local-collab-gpt-final-availability-check.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './lib/codex-sdk-gate-lib.js';
+const arbiterMod = await importDist('core/codex-control/gpt-final-arbiter.js');
+const doctorMod = await importDist('core/doctor/doctor-readiness-matrix.js');
+const old = snapshotEnv();
+try {
+    process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE = '1';
+    const unavailable = await arbiterMod.runGptFinalArbiter(input('unavailable'), { writeArtifact: false, forceUnavailable: true });
+    assertGate(unavailable.ok === false, 'GPT unavailable fixture must block final apply');
+    assertGate(unavailable.blockers.includes('gpt_final_arbiter_unavailable'), 'GPT unavailable blocker must be present');
+    const doctor = doctorMod.buildDoctorReadinessMatrix({
+        codex: { available: false },
+        codex_config: { ok: true, checks: [] },
+        local_collaboration: { mode: 'local-parallel-gpt-final', gpt_final_arbiter_available: false }
+    });
+    assertGate(doctor.blockers.includes('gpt_final_arbiter_unavailable'), 'doctor must report gpt_final_arbiter_unavailable');
+    delete process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE;
+    process.env.NODE_ENV = 'test';
+    process.env.SKS_CODEX_SDK_FAKE = '1';
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-gpt-final-available-'));
+    const available = await arbiterMod.runGptFinalArbiter(input('available'), { cwd: root, mutationLedgerRoot: tmp });
+    assertGate(available.ok === true, 'GPT available fixture must pass final arbiter');
+    emitGate('local-collab:gpt-final-availability', { unavailable: unavailable.result.status, available: available.result.status });
+}
+finally {
+    restoreEnv(old);
+}
+function input(label) {
+    return {
+        schema: 'sks.gpt-final-arbiter-input.v1',
+        route: '$Team',
+        mission_id: `M-${label}`,
+        local_mode: 'local-parallel-gpt-final',
+        local_outputs: [{ worker_id: 'local', backend: 'local-llm', summary: 'candidate' }],
+        candidate_patch_envelopes: [],
+        verification_results: []
+    };
+}
+function snapshotEnv() {
+    return {
+        NODE_ENV: process.env.NODE_ENV,
+        SKS_CODEX_SDK_FAKE: process.env.SKS_CODEX_SDK_FAKE,
+        SKS_GPT_FINAL_ARBITER_UNAVAILABLE: process.env.SKS_GPT_FINAL_ARBITER_UNAVAILABLE
+    };
+}
+function restoreEnv(old) {
+    for (const [key, value] of Object.entries(old)) {
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+}
+//# sourceMappingURL=local-collab-gpt-final-availability-check.js.map

package/dist/scripts/local-collab-no-local-only-final-check.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const policyMod = await importDist('core/local-llm/local-collaboration-policy.js');
+const arbiterMod = await importDist('core/codex-control/gpt-final-arbiter.js');
+const gate = policyMod.evaluateLocalCollaborationFinalGate({
+    mode: 'local-only-draft',
+    localParticipated: true,
+    gptFinalStatus: null,
+    gptFinalAvailable: false,
+    applyPatches: true
+});
+assertGate(gate.ok === false, 'local-only-draft must not be final accepted');
+assertGate(gate.final_status === 'draft_only', 'local-only-draft must end as draft_only');
+assertGate(gate.apply_allowed === false, 'local-only-draft must block apply');
+const result = await arbiterMod.runGptFinalArbiter({
+    schema: 'sks.gpt-final-arbiter-input.v1',
+    route: '$DFix',
+    mission_id: 'M-local-only-draft',
+    local_mode: 'local-only-draft',
+    local_outputs: [{ worker_id: 'local', backend: 'local-llm', summary: 'draft only' }],
+    candidate_patch_envelopes: []
+}, { writeArtifact: false });
+assertGate(result.ok === false, 'local-only-draft arbiter result must not pass');
+assertGate(result.blockers.includes('needs_gpt_final_review'), 'local-only-draft arbiter must include needs_gpt_final_review');
+emitGate('local-collab:no-local-only-final', { final_status: gate.final_status, blockers: result.blockers.length });
+//# sourceMappingURL=local-collab-no-local-only-final-check.js.map

package/dist/scripts/local-collab-policy-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, readText } from './lib/codex-sdk-gate-lib.js';
+const policyMod = await importDist('core/local-llm/local-collaboration-policy.js');
+const schemaText = readText('schemas/local-llm/local-collaboration-policy.schema.json');
+const policy = policyMod.resolveLocalCollaborationPolicy({ env: {} });
+assertGate(policy.mode === 'local-parallel-gpt-final', 'default local collaboration mode must be local-parallel-gpt-final');
+assertGate(policy.gpt_final_required === true, 'default local collaboration mode must require GPT final');
+assertGate(policy.final_patch_source_when_enabled === 'gpt_final_arbiter', 'final patch source must be GPT final arbiter');
+assertGate(schemaText.includes('local-only-draft'), 'policy schema must include local-only-draft mode');
+const draft = policyMod.resolveLocalCollaborationPolicy({ mode: 'local-only-draft' });
+const draftGate = policyMod.evaluateLocalCollaborationFinalGate({ policy: draft, localParticipated: true, applyPatches: true });
+assertGate(draftGate.ok === false, 'local-only-draft must not pass final gate');
+assertGate(draftGate.blockers.includes('needs_gpt_final_review'), 'local-only-draft must carry needs_gpt_final_review');
+assertGate(draftGate.blockers.includes('local_only_draft_apply_blocked'), 'local-only-draft must block apply');
+emitGate('local-collab:policy', { default_mode: policy.mode, draft_blockers: draftGate.blockers.length });
+//# sourceMappingURL=local-collab-policy-check.js.map

package/dist/scripts/local-llm-all-pipelines-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+const router = readText('src/core/agents/native-worker-backend-router.ts');
+const control = readText('src/core/codex-control/codex-task-runner.ts');
+const policy = readText('src/core/local-llm/local-worker-eligibility.ts');
+assertGate(router.includes("backend === 'local-llm'"), 'native worker router must support local-llm backend');
+assertGate(control.includes('runLocalLlmTask'), 'Codex Control Plane must call local LLM task adapter');
+assertGate(policy.includes('requires_gpt_final'), 'local worker eligibility must require GPT final');
+emitGate('local-llm:all-pipelines', { local_backend: 'local-llm', requires_gpt_final: true });
+//# sourceMappingURL=local-llm-all-pipelines-check.js.map

package/dist/scripts/local-llm-cache-performance-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const cache = await importDist('core/local-llm/local-llm-prompt-cache.js');
+const a = cache.buildLocalLlmPromptCacheRecord({ routeSystemEnvelopeHash: 'a', localWorkerPolicyHash: 'b', coreSkillSnapshotHash: 'c', triwikiContextPackHash: 'd', repoSummaryHash: 'e', capabilityCardHash: 'f' });
+const b = cache.buildLocalLlmPromptCacheRecord({ routeSystemEnvelopeHash: 'a', localWorkerPolicyHash: 'b', coreSkillSnapshotHash: 'c', triwikiContextPackHash: 'd2', repoSummaryHash: 'e', capabilityCardHash: 'f' });
+assertGate(a.cacheable === true, 'prompt cache record should be cacheable when hashes exist');
+assertGate(a.cache_key !== b.cache_key, 'source hash change must invalidate cache');
+emitGate('local-llm:cache-performance', { cacheable: a.cacheable, invalidates_on_hash_change: true });
+//# sourceMappingURL=local-llm-cache-performance-check.js.map

package/dist/scripts/local-llm-capability-check.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, readText } from './lib/codex-sdk-gate-lib.js';
+const mod = await importDist('core/agents/ollama-worker-config.js');
+const schemaText = readText('schemas/local-llm/local-model-config.schema.json');
+const config = mod.normalizeLocalModelConfig({ enabled: true, status: 'enabled_unverified' });
+const mlx = mod.normalizeLocalModelConfig({ enabled: true, provider: 'mlx-lm', model: 'mlx-community/Qwen3.6-35B-A3B-4bit', base_url: 'http://127.0.0.1:8080' });
+assertGate(config.schema === 'sks.local-model-config.v2', 'local model config must use v2 schema');
+assertGate(config.status === 'enabled_unverified', 'enabled without smoke must be enabled_unverified');
+assertGate(mlx.provider === 'mlx-lm' && mlx.base_url === 'http://127.0.0.1:8080', 'local model config must preserve MLX LM provider settings');
+assertGate(schemaText.includes('verified'), 'local model schema must include verified status');
+assertGate(schemaText.includes('mlx-lm'), 'local model schema must allow MLX LM provider');
+emitGate('local-llm:capability', { status: config.status, schema: config.schema, mlx_provider: mlx.provider });
+//# sourceMappingURL=local-llm-capability-check.js.map