sneakoscope 3.1.6 → 3.1.8

package/dist/core/config/managed-config-merge.js

@@ -0,0 +1,105 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { isProtectedSecretKey, PROTECTED_SECRET_KEYS } from './supabase-secret-preservation.js';
+export async function writeManagedJsonConfig(file, current, managed) {
+    const next = safeMergeObject(current, managed);
+    const before = `${JSON.stringify(current, null, 2)}\n`;
+    const after = `${JSON.stringify(next, null, 2)}\n`;
+    return writeMergedText(file, before, after, 'json', protectedKeysPresent(current));
+}
+export async function writeManagedTomlConfig(file, currentText, managedBlocks) {
+    let next = String(currentText || '').trimEnd();
+    for (const block of managedBlocks)
+        next = upsertTomlBlockPreservingSecrets(next, block);
+    return writeMergedText(file, currentText, `${next.trim()}\n`, 'toml', protectedKeysInText(currentText));
+}
+export async function writeManagedEnvConfig(file, currentText, managedLines) {
+    const existingKeys = new Set(String(currentText || '').split(/\r?\n/).map((line) => line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1]).filter((value) => Boolean(value)));
+    const additions = managedLines.filter((line) => {
+        const key = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1] || '';
+        return key && !existingKeys.has(key) && !isProtectedSecretKey(key);
+    });
+    const next = additions.length ? `${String(currentText || '').replace(/\s*$/, '\n')}${additions.join('\n')}\n` : String(currentText || '');
+    return writeMergedText(file, currentText, next, 'env', protectedKeysInText(currentText));
+}
+export function safeMergeObject(current, managed) {
+    const out = { ...current };
+    for (const [key, value] of Object.entries(managed)) {
+        if (isProtectedSecretKey(key) && current[key] != null)
+            continue;
+        if (isPlainObject(value) && isPlainObject(current[key]))
+            out[key] = safeMergeObject(current[key], value);
+        else
+            out[key] = value;
+    }
+    return out;
+}
+function upsertTomlBlockPreservingSecrets(text, block) {
+    const header = block.match(/^\s*\[([^\]]+)\]/)?.[1];
+    if (!header)
+        return text;
+    const lines = String(text || '').trimEnd().split('\n');
+    const start = lines.findIndex((line) => line.trim() === `[${header}]`);
+    const blockLines = block.trim().split('\n');
+    if (start === -1)
+        return [...lines.filter((line) => line.length), '', ...blockLines].join('\n');
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[.+\]\s*$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
+    }
+    const existingSecretLines = lines.slice(start + 1, end).filter((line) => {
+        const key = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        return isProtectedSecretKey(`${header}.${key}`) || isProtectedSecretKey(key);
+    });
+    lines.splice(start, end - start, ...blockLines, ...existingSecretLines.filter((line) => !blockLines.includes(line)));
+    return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+async function writeMergedText(file, before, after, format, preserved) {
+    await ensureDir(path.dirname(file));
+    let backupPath = null;
+    if (before !== after) {
+        if (before.trim()) {
+            backupPath = `${file}.sks-managed-merge-${Date.now()}.bak`;
+            await fs.writeFile(backupPath, before, 'utf8');
+        }
+        await writeTextAtomic(file, after);
+    }
+    return {
+        schema: 'sks.managed-config-merge.v1',
+        generated_at: nowIso(),
+        ok: true,
+        path: file,
+        format,
+        changed: before !== after,
+        backup_path: backupPath,
+        protected_keys_preserved: preserved,
+        blockers: []
+    };
+}
+function protectedKeysPresent(value) {
+    const found = [];
+    for (const key of PROTECTED_SECRET_KEYS)
+        if (lookupPath(value, key) != null)
+            found.push(String(key));
+    return found;
+}
+function protectedKeysInText(text) {
+    return PROTECTED_SECRET_KEYS.filter((key) => new RegExp(`(^|\\n)\\s*(?:export\\s+)?${String(key).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(text)).map(String);
+}
+function lookupPath(value, dotted) {
+    let current = value;
+    for (const part of dotted.split('.')) {
+        if (!current || typeof current !== 'object' || Array.isArray(current))
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=managed-config-merge.js.map

package/dist/core/config/secret-preservation.js

@@ -0,0 +1,169 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { ensureDir, nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { PROTECTED_SECRET_KEYS, PROTECTED_SUPABASE_ENV_KEYS } from './supabase-secret-preservation.js';
+export async function captureSecretPreservationSnapshot(input) {
+    const root = path.resolve(input.root);
+    const sources = secretSources(root);
+    const fingerprints = [];
+    for (const source of sources) {
+        const text = await readText(source, null);
+        if (typeof text !== 'string')
+            continue;
+        if (source.endsWith('.json')) {
+            const json = await readJson(source, {}).catch(() => ({}));
+            fingerprints.push(...fingerprintsFromObject(json, source));
+        }
+        else {
+            fingerprints.push(...fingerprintsFromText(text, source));
+        }
+    }
+    const snapshot = {
+        schema: 'sks.secret-preservation-snapshot.v1',
+        generated_at: nowIso(),
+        root,
+        fingerprints: dedupeFingerprints(fingerprints)
+    };
+    if (input.artifactPath)
+        await writeJsonAtomic(input.artifactPath, snapshot).catch(() => undefined);
+    return snapshot;
+}
+export async function withSecretPreservationGuard(root, operationName, fn) {
+    const resolvedRoot = path.resolve(root);
+    const reportDir = path.join(resolvedRoot, '.sneakoscope', 'reports');
+    await ensureDir(reportDir);
+    const beforePath = path.join(reportDir, 'secret-preservation-before.json');
+    const afterPath = path.join(reportDir, 'secret-preservation-after.json');
+    const guardPath = path.join(reportDir, 'secret-preservation-guard.json');
+    const before = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: beforePath });
+    let result;
+    try {
+        result = await fn();
+    }
+    catch (err) {
+        await writeJsonAtomic(guardPath, {
+            schema: 'sks.secret-preservation-guard.v1',
+            generated_at: nowIso(),
+            ok: false,
+            operation: operationName,
+            before_path: beforePath,
+            after_path: null,
+            restored_keys_count: 0,
+            missing_after: [],
+            raw_values_recorded: false,
+            operation_error: err instanceof Error ? err.message : String(err)
+        }).catch(() => undefined);
+        throw err;
+    }
+    const after = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: afterPath });
+    const missing = missingProtectedSecrets(before, after);
+    const report = {
+        schema: 'sks.secret-preservation-guard.v1',
+        generated_at: nowIso(),
+        ok: missing.length === 0,
+        operation: operationName,
+        before_path: beforePath,
+        after_path: afterPath,
+        restored_keys_count: 0,
+        missing_after: missing,
+        raw_values_recorded: false
+    };
+    await writeJsonAtomic(guardPath, report).catch(() => undefined);
+    if (missing.length) {
+        throw new Error(`secret_preservation_failed:${missing.map((item) => `${item.source}:${item.key}`).join(',')}`);
+    }
+    return result;
+}
+export function missingProtectedSecrets(before, after) {
+    const afterMap = new Map(after.fingerprints.filter((fp) => fp.present).map((fp) => [`${fp.source}\0${fp.key}`, fp]));
+    return before.fingerprints
+        .filter((fp) => fp.present && fp.value_sha256)
+        .filter((fp) => !afterMap.has(`${fp.source}\0${fp.key}`))
+        .map((fp) => ({ key: fp.key, source: fp.source }));
+}
+function secretSources(root) {
+    const home = process.env.HOME || os.homedir();
+    return [
+        '.env',
+        '.env.local',
+        '.env.development',
+        '.env.production',
+        '.sneakoscope/config.json',
+        '.codex/config.toml'
+    ].map((rel) => path.join(root, rel)).concat(path.join(home, '.codex', 'config.toml'));
+}
+function fingerprintsFromText(text, source) {
+    const rows = [];
+    for (const key of PROTECTED_SECRET_KEYS) {
+        const value = readAssignment(text, key);
+        if (!value)
+            continue;
+        rows.push(fingerprint(String(key), source, value));
+    }
+    for (const envKey of PROTECTED_SUPABASE_ENV_KEYS) {
+        const value = readAssignment(text, envKey);
+        if (value)
+            rows.push(fingerprint(envKey, source, value));
+    }
+    return rows;
+}
+function fingerprintsFromObject(value, source) {
+    const flat = flattenObject(value);
+    const rows = [];
+    for (const [key, raw] of Object.entries(flat)) {
+        if (!PROTECTED_SECRET_KEYS.includes(key))
+            continue;
+        rows.push(fingerprint(key, source, String(raw)));
+    }
+    return rows;
+}
+function fingerprint(key, source, value) {
+    return {
+        key,
+        source,
+        present: Boolean(value),
+        redacted_preview: redactPreview(value),
+        value_sha256: value ? sha256(value) : null
+    };
+}
+function readAssignment(text, key) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`^\\s*(?:export\\s+)?${escaped.replace(/\\\./g, '\\s*\\.\\s*')}\\s*=\\s*(.+?)\\s*$`, 'm');
+    const raw = String(text || '').match(re)?.[1]?.trim() || '';
+    return unquote(raw);
+}
+function unquote(value) {
+    const trimmed = String(value || '').trim().replace(/\s+#.*$/, '');
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'")))
+        return trimmed.slice(1, -1);
+    return trimmed;
+}
+function redactPreview(value) {
+    const text = String(value || '');
+    if (!text)
+        return '';
+    const head = text.slice(0, Math.min(3, text.length));
+    const tail = text.length > 6 ? text.slice(-3) : '';
+    return `${head}...${tail || 'redacted'}(${text.length})`;
+}
+function flattenObject(value, prefix = '') {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+        const nextKey = prefix ? `${prefix}.${key}` : key;
+        if (child && typeof child === 'object' && !Array.isArray(child))
+            Object.assign(out, flattenObject(child, nextKey));
+        else if (child != null)
+            out[nextKey] = String(child);
+    }
+    return out;
+}
+function dedupeFingerprints(fingerprints) {
+    const byKey = new Map();
+    for (const fp of fingerprints)
+        byKey.set(`${fp.source}\0${fp.key}`, fp);
+    return [...byKey.values()].sort((a, b) => a.source.localeCompare(b.source) || a.key.localeCompare(b.key));
+}
+//# sourceMappingURL=secret-preservation.js.map

package/dist/core/config/supabase-secret-preservation.js

@@ -0,0 +1,29 @@
+export const PROTECTED_SUPABASE_ENV_KEYS = [
+    'SUPABASE_URL',
+    'SUPABASE_ANON_KEY',
+    'SUPABASE_SERVICE_ROLE_KEY',
+    'NEXT_PUBLIC_SUPABASE_URL',
+    'NEXT_PUBLIC_SUPABASE_ANON_KEY',
+    'VITE_SUPABASE_URL',
+    'VITE_SUPABASE_ANON_KEY',
+    'PUBLIC_SUPABASE_URL',
+    'PUBLIC_SUPABASE_ANON_KEY'
+];
+export const PROTECTED_SUPABASE_CONFIG_PATHS = [
+    'supabase.url',
+    'supabase.anon_key',
+    'supabase.service_role_key',
+    'mcp.supabase.url',
+    'mcp.supabase.token',
+    'mcp.supabase.access_token',
+    'mcp.supabase.service_role_key'
+];
+export const PROTECTED_SECRET_KEYS = [
+    ...PROTECTED_SUPABASE_ENV_KEYS,
+    ...PROTECTED_SUPABASE_CONFIG_PATHS
+];
+export function isProtectedSecretKey(key) {
+    const normalized = String(key || '').trim();
+    return PROTECTED_SECRET_KEYS.some((candidate) => candidate === normalized);
+}
+//# sourceMappingURL=supabase-secret-preservation.js.map

package/dist/core/doctor/doctor-native-capability-repair.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
+import { dedupeProjectSkills } from '../codex-native/project-skill-dedupe.js';
+import { repairNativeCapabilities } from '../codex-native/native-capability-repair.js';
+import { withSecretPreservationGuard } from '../config/config-migration-journal.js';
+export async function runDoctorNativeCapabilityRepair(input) {
+    const root = path.resolve(input.root);
+    const operation = async () => {
+        const coreSkills = await syncCoreSkillsIntegrity({ root, apply: input.fix });
+        const skillDedupe = await dedupeProjectSkills({
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            quarantineUserDuplicates: (input.flags || []).includes('--quarantine-user-duplicate-skills')
+        });
+        const nativeCapabilities = await repairNativeCapabilities({
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            allowManualInstructions: true
+        });
+        const blockers = [
+            ...(coreSkills.blockers || []),
+            ...(skillDedupe.blockers || []),
+            ...(nativeCapabilities.blockers || [])
+        ];
+        const report = {
+            schema: 'sks.doctor-native-capability-repair.v1',
+            generated_at: nowIso(),
+            ok: blockers.length === 0,
+            root,
+            fix: input.fix,
+            yes: input.yes,
+            core_skills: coreSkills,
+            skill_dedupe: skillDedupe,
+            native_capabilities: nativeCapabilities,
+            secret_preservation_guard: '.sneakoscope/reports/secret-preservation-guard.json',
+            blockers
+        };
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'doctor-native-capability-repair.json'), report).catch(() => undefined);
+        return report;
+    };
+    if (!input.fix)
+        return operation();
+    return withSecretPreservationGuard(root, 'doctor-native-capability-repair', operation);
+}
+//# sourceMappingURL=doctor-native-capability-repair.js.map

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.6';
+export const PACKAGE_VERSION = '3.1.8';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/init.js

@@ -11,6 +11,7 @@ import { AWESOME_DESIGN_MD_REFERENCE, CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_
 import { SKILL_DREAM_POLICY, skillDreamPolicyText } from './skill-forge.js';
 import { CODEX_HOOK_EVENT_STATE_KEYS } from './codex-compat/codex-hook-events.js';
 import { codexCommandHookCurrentHash } from './codex-hooks/codex-hook-hash.js';
+import { buildSksCoreSkillManifest, isCoreSkillName, renderCoreSkillTemplate } from './codex-native/core-skill-manifest.js';
 const REFLECTION_MEMORY_PATH = '.sneakoscope/memory/q2_facts/post-route-reflection.md';
 const SKS_GENERATED_GIT_PATTERNS = [
     '.sneakoscope/missions/',
@@ -1083,9 +1084,12 @@ export async function installSkills(root) {
         'design-ui-editor': `---\nname: design-ui-editor\ndescription: Legacy fallback UI/UX editor for existing design.md systems when Product Design plugin is unavailable.\n---\n\nUse Product Design plugin first. When falling back, read \`design.md\`, inspect relevant UI/assets/tests, consult getdesign-reference when improving the design system, apply the smallest design-system-conformant change, use imagegen for image/logo/raster assets, and verify render quality. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY} If design.md is missing and Product Design is unavailable, use design-system-builder as fallback.\n`,
         'design-artifact-expert': `---\nname: design-artifact-expert\ndescription: Legacy fallback for high-fidelity HTML/UI/prototype artifacts when Product Design plugin cannot be used.\n---\n\nUse Product Design plugin first for design/UI/prototype work. When falling back, read design.md when present, consult getdesign-reference for design-system grounding, build the usable artifact first, preserve state, verify overlap/readability/responsiveness, and use imagegen for required assets. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY}\n`
     };
+    for (const skill of buildSksCoreSkillManifest().skills) {
+        skills[skill.canonical_name] = renderCoreSkillTemplate(skill.canonical_name);
+    }
     for (const [name, content] of Object.entries(skills)) {
         const dir = path.join(root, '.agents', 'skills', name);
-        const skillContent = enrichSkillContent(name, content);
+        const skillContent = isCoreSkillName(name) ? content : enrichSkillContent(name, content);
         await ensureDir(dir);
         await writeTextAtomic(path.join(dir, 'SKILL.md'), `${skillContent.trim()}\n`);
         await writeSkillMetadata(dir, name);

package/dist/core/loops/loop-planner.js

@@ -59,7 +59,7 @@ export async function planLoopsFromRequest(input) {
         return {
             ...node,
             ...(hints.length ? { memory_hints: hints } : {}),
-            memory_hints_used: hints.length,
+            memory_hints_used: hints,
             memory_did_not_expand_scope: true
         };
     });

package/dist/core/loops/loop-worker-prompts.js

@@ -10,6 +10,7 @@ export function buildLoopMakerPrompt(input) {
         `Owner directories: ${node.owner_scope.directories.join(', ') || '-'}`,
         `Allowed mutation scope: ${ownerScopeText(node)}`,
         'Do not mutate outside the owner scope.',
+        'Memory hints are guidance only; memory never grants write permission or expands owner scope.',
         `Selected local gates: ${allGateIds(node.gates).join(', ') || '-'}`,
         `Budget: ${JSON.stringify(node.budget)}`,
         `Worktree path: ${input.worktreePath || '-'}`,
@@ -30,6 +31,7 @@ export function buildLoopCheckerPrompt(input) {
         `Selected gates: ${allGateIds(node.gates).join(', ') || '-'}`,
         `Risk: ${node.risk.level} (${node.risk.reasons.join(', ') || '-'})`,
         'Reject unrequested side effects and owner-scope violations.',
+        'Memory hints are guidance only; memory never grants write permission or expands owner scope.',
         'Write checker-findings.json with fresh_session, reviewed_maker_artifacts, side_effects_detected, and approved.',
         'No synthetic pass is allowed for production proof.'
     ].join('\n');

package/dist/core/loops/loop-worker-runtime.js

@@ -159,6 +159,12 @@ async function runLoopWorkerFixture(input) {
     });
     const dir = path.join(loopNodeRoot(input.root, input.plan.mission_id, input.node.loop_id), input.phase);
     await ensureDir(dir);
+    const invocationPlan = await resolveCodexNativeInvocationPlan({
+        root: input.root,
+        missionId: input.plan.mission_id,
+        route: '$Loop',
+        desiredCapability: 'agent-role'
+    }).catch(() => null);
     const resultPath = path.join(dir, 'worker-runtime-result.json');
     const childInputPath = path.join(dir, 'worker-fixture-intake.json');
     await writeJsonAtomic(childInputPath, {
@@ -170,7 +176,8 @@ async function runLoopWorkerFixture(input) {
         worker_count: input.phase === 'maker' ? input.node.maker.worker_count : input.node.checker.worker_count,
         result_path: resultPath,
         owner_scope: input.node.owner_scope,
-        maker_artifacts: input.makerArtifacts || []
+        maker_artifacts: input.makerArtifacts || [],
+        codex_native_invocation_plan: invocationPlan ? compactInvocationPlan(invocationPlan) : null
     });
     const child = await runProcess(process.execPath, [fixtureChildEntrypoint(), childInputPath], {
         cwd: input.root,

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '3.1.6';
+export const PACKAGE_VERSION = '3.1.8';
 //# sourceMappingURL=version.js.map

package/dist/scripts/codex-native-runtime-e2e-fixture.js

@@ -0,0 +1,75 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+export async function createCodexNativeRuntimeFixture(input) {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-native-e2e-'));
+    const missionId = `M-check-${Date.now().toString(36)}`;
+    const home = path.join(root, 'home');
+    const codexHome = path.join(root, 'codex-home');
+    await fs.mkdir(home, { recursive: true });
+    await fs.mkdir(codexHome, { recursive: true });
+    await fs.mkdir(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+    await fs.mkdir(path.join(root, '.sneakoscope', 'missions', missionId), { recursive: true });
+    await fs.mkdir(path.join(root, 'src', 'core', 'loops'), { recursive: true });
+    await fs.mkdir(path.join(root, 'src', 'core', 'qa'), { recursive: true });
+    await fs.mkdir(path.join(root, 'src', 'core', 'research'), { recursive: true });
+    await fs.mkdir(path.join(root, 'docs'), { recursive: true });
+    await fs.writeFile(path.join(root, 'package.json'), '{"name":"fixture","version":"3.1.7","scripts":{}}\n', 'utf8');
+    await fs.writeFile(path.join(root, 'src', 'core', 'loops', 'fixture.ts'), 'export const loopFixture = true\n', 'utf8');
+    await fs.writeFile(path.join(root, 'src', 'core', 'qa', 'fixture.ts'), 'export const qaFixture = true\n', 'utf8');
+    await fs.writeFile(path.join(root, 'src', 'core', 'research', 'fixture.ts'), 'export const researchFixture = true\n', 'utf8');
+    await fs.writeFile(path.join(root, 'docs', 'fixture.md'), '# Fixture\n', 'utf8');
+    return {
+        root,
+        missionId,
+        matrixPath: path.join(root, '.sneakoscope', 'reports', 'codex-native-feature-matrix.json'),
+        env: {
+            ...process.env,
+            HOME: home,
+            USERPROFILE: home,
+            CODEX_HOME: codexHome,
+            CODEX_BIN: 'codex',
+            SKS_CODEX_0138_FAKE: '1',
+            SKS_CODEX_0138_PROBE: '1',
+            SKS_CODEX_0139_FAKE: '1',
+            SKS_CODEX_0139_PROBE: '1',
+            SKS_CODEX_PLUGIN_JSON_FAKE: '1',
+            SKS_CODEX_HOOK_APPROVAL_FIXTURE: input.hook,
+            SKS_CODEX_AGENT_TYPE_FIXTURE: input.agentType,
+            SKS_CODEX_0138_FAKE_APP_HANDOFF_FAIL: input.appHandoff ? '0' : '1',
+            SKS_CODEX_0138_FAKE_IMAGE_PATH_FAIL: input.imagePathExposure ? '0' : '1',
+            SKS_CODEX_0138_FAKE_PLUGIN_JSON_FAIL: '0',
+            SKS_CODEX_PLUGIN_JSON_FAKE_NO_MCP: input.mcpCandidates ? '0' : '1',
+            SKS_CODEX_0139_FAKE_WEB_SEARCH_FAIL: input.codeModeWebSearch ? '0' : '1',
+            SKS_CODEX_0139_FAKE_MARKETPLACE_FAIL: '0',
+            SKS_CODEX_0139_FAKE_PROFILE_ALIAS_FAIL: '0',
+            SKS_CODEX_0139_FAKE_INTERRUPT_FAIL: '0',
+            SKS_CODEX_0139_FAKE_RICH_SCHEMA_FAIL: '0',
+            SKS_CODEX_0139_FAKE_DOCTOR_ENV_FAIL: '0',
+            SKS_LOOP_RUNTIME_FIXTURE: '1',
+            SKS_TEST_RUNTIME_FIXTURE_ALLOWED: '1'
+        }
+    };
+}
+export async function withFixtureEnv(fixture, fn) {
+    const previous = new Map();
+    for (const [key, value] of Object.entries(fixture.env)) {
+        previous.set(key, process.env[key]);
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        for (const [key, value] of previous) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+    }
+}
+//# sourceMappingURL=codex-native-runtime-e2e-fixture.js.map

package/dist/scripts/loop-worker-fixture-child.js

@@ -48,6 +48,7 @@ await fs.writeFile(intake.result_path, `${JSON.stringify({
     blockers: [],
     runtime_proof_path: intake.result_path,
     worker_ids: workerIds,
-    session_ids: sessionIds
+    session_ids: sessionIds,
+    codex_native_invocation_plan: intake.codex_native_invocation_plan || null
 }, null, 2)}\n`);
 //# sourceMappingURL=loop-worker-fixture-child.js.map

package/dist/scripts/sizecheck.js

@@ -7,11 +7,15 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const limits = {
-    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || 1024 * 1024),
-    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || 5 * 1024 * 1024),
+    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || 1536 * 1024),
+    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || 6 * 1024 * 1024),
     packFiles: Number(process.env.SKS_MAX_PACK_FILES || 1200),
     trackedFileBytes: Number(process.env.SKS_MAX_TRACKED_FILE_BYTES || 384 * 1024)
 };
+const trackedFileSizeAllowlist = new Set([
+    // Historical source documentation export; not included in the npm package payload.
+    'docs/sks-local-llm-mode/exports/sks-local-llm-mode-deck.pdf'
+]);
 const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 function fail(message, detail = '') {
     console.error(`Size check failed: ${message}`);
@@ -40,6 +44,8 @@ function checkTrackedFiles() {
     const files = result.stdout.toString('utf8').split('\0').filter(Boolean);
     const oversized = [];
     for (const file of files) {
+        if (trackedFileSizeAllowlist.has(file))
+            continue;
         let stat;
         try {
             stat = fs.statSync(path.join(root, file));

package/dist/scripts/sks-3-1-5-directive-check-lib.js

@@ -259,7 +259,7 @@ async function richContentGate(id) {
         const codexHome = path.join(rootDir, 'codex-home');
         const report = await mod.syncCodexAgentRoles({ root: rootDir, codexHome, apply: true });
         const role = fs.readFileSync(path.join(codexHome, 'agents', 'sks-checker.toml'), 'utf8');
-        assertGate(role.includes('SKS managed 3.1.6 directive role') && role.includes('Execution role strategy'), 'managed agent role must include rich directive content', { role, report });
+        assertGate(/SKS managed 3\.1\.[67] directive role/.test(role) && role.includes('Execution role strategy'), 'managed agent role must include rich directive content', { role, report });
         emitGate(id, { roles: report.created.length });
     }
     finally {

package/dist/scripts/sks-3-1-6-directive-check-lib.js

@@ -321,7 +321,7 @@ async function initDeepMemoryScopeSafety(id) {
     emitGate(id);
 }
 async function releaseScriptsTypeSafe(id) {
-    for (const rel of ['src/scripts/release-dag-full-coverage-check.ts', 'src/scripts/sks-3-1-5-directive-check-lib.ts', 'src/scripts/sks-3-1-6-directive-check-lib.ts']) {
+    for (const rel of ['src/scripts/release-dag-full-coverage-check.ts', 'src/scripts/sks-3-1-5-directive-check-lib.ts', 'src/scripts/sks-3-1-6-directive-check-lib.ts', 'src/scripts/sks-3-1-7-directive-check-lib.ts']) {
         const text = readText(rel);
         assertGate(!/^\s*\/\/\s*@ts-nocheck\b/m.test(text), `release helper still has ts-nocheck:${rel}`);
     }
@@ -334,7 +334,7 @@ async function noTsNoCheckReleaseScripts(id) {
     const checked = listFiles(path.join(root, 'src/scripts')).filter((file) => {
         const rel = path.relative(root, file).split(path.sep).join('/');
         return /^src\/scripts\/release-dag-full-coverage-check\.ts$/.test(rel)
-            || /^src\/scripts\/sks-3-1-[56]-directive-check-lib\.ts$/.test(rel)
+            || /^src\/scripts\/sks-3-1-[567]-directive-check-lib\.ts$/.test(rel)
             || /^src\/scripts\/no-ts-nocheck-release-scripts-check\.ts$/.test(rel)
             || /^src\/scripts\/release-script-type-safety-check\.ts$/.test(rel);
     });

package/dist/scripts/sks-3-1-7-directive-check-lib.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const RELEASE_HELPERS = [
+    'src/scripts/release-dag-full-coverage-check.ts',
+    'src/scripts/sks-3-1-5-directive-check-lib.ts',
+    'src/scripts/sks-3-1-6-directive-check-lib.ts',
+    'src/scripts/sks-3-1-7-directive-check-lib.ts',
+    'src/scripts/release-script-type-safety-check.ts',
+    'src/scripts/no-ts-nocheck-release-scripts-check.ts'
+];
+export async function runDirective317Gate(id) {
+    if (id === 'release-scripts:type-safe')
+        return releaseScriptsTypeSafe(id);
+    if (id === 'lint:no-ts-nocheck-release-scripts')
+        return noTsNoCheckReleaseScripts(id);
+    throw new Error(`unknown_3_1_7_gate:${id}`);
+}
+function releaseScriptsTypeSafe(id) {
+    checkNoTsNoCheckReleaseScripts();
+    const dag = readText('src/scripts/release-dag-full-coverage-check.ts');
+    for (const token of [
+        'interface PackageJsonShape',
+        'interface ReleaseGate',
+        'interface ReleaseGateManifest',
+        'function readPackageJson',
+        'function readReleaseGateManifest',
+        'function isReleaseGate',
+        'function normalizeStringList',
+        'const parsed: unknown'
+    ]) {
+        assertGate(dag.includes(token), `release DAG helper missing typed token:${token}`);
+    }
+    emitGate(id, { checked_files: RELEASE_HELPERS });
+}
+function noTsNoCheckReleaseScripts(id) {
+    checkNoTsNoCheckReleaseScripts();
+    emitGate(id, { checked_files: RELEASE_HELPERS });
+}
+function checkNoTsNoCheckReleaseScripts() {
+    const offenders = RELEASE_HELPERS.filter((rel) => /^\s*\/\/\s*@ts-nocheck\b/m.test(readText(rel)));
+    assertGate(offenders.length === 0, 'release script ts-nocheck offenders found', { offenders, checked_files: RELEASE_HELPERS });
+}
+function readText(rel) {
+    return fs.readFileSync(path.join(root, rel), 'utf8');
+}
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate, detail = {}) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate, ...detail }, null, 2));
+}
+//# sourceMappingURL=sks-3-1-7-directive-check-lib.js.map