sneakoscope 4.0.13 → 4.0.14

package/dist/scripts/hooks-runtime-replay-warning-zero.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { codexHookWarningCheck } from '../core/codex-compat/codex-hook-warning-detector.js';
-const report = await codexHookWarningCheck(process.cwd());
-const events = new Set((report.events || []).map((row) => row.event));
-const ok = report.ok && report.warnings_count === 0 && events.has('SubagentStart') && events.has('SubagentStop');
-console.log(JSON.stringify({ schema: 'sks.hooks-runtime-replay-warning-zero.v1', ok, warnings_count: report.warnings_count, events: Array.from(events).sort(), report }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-//# sourceMappingURL=hooks-runtime-replay-warning-zero.js.map

package/dist/scripts/hooks-trust-warning-zero.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { codexHookWarningCheck } from '../core/codex-compat/codex-hook-warning-detector.js';
-const report = await codexHookWarningCheck(process.cwd());
-console.log(JSON.stringify({
-    schema: 'sks.hooks-trust-warning-zero.v1',
-    ok: report.ok,
-    warnings_count: report.warnings_count,
-    issues_by_category: report.issues_by_category,
-    trust_warning_section: report.config?.dual_representation || null
-}, null, 2));
-if (!report.ok)
-    process.exitCode = 1;
-//# sourceMappingURL=hooks-trust-warning-zero.js.map

package/dist/scripts/lib/codex-sdk-gate-lib.js

@@ -1,92 +0,0 @@
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, readJson, readText, root } from '../sks-1-18-gate-lib.js';
-export { assertGate, emitGate, importDist, readJson, readText, root };
-export async function readJsonFile(file) {
-    return JSON.parse(await fs.readFile(file, 'utf8'));
-}
-export async function readTextFile(file) {
-    return fs.readFile(file, 'utf8');
-}
-export async function runFakeCodexSdkTaskFixture(label = 'fixture', extra = {}) {
-    const mod = await importDist('core/codex-control/codex-control-plane.js');
-    const schema = await importDist('core/codex-control/schemas/agent-worker-result.schema.js');
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), `sks-codex-sdk-${label}-`));
-    const old = snapshotEnv();
-    process.env.NODE_ENV = 'test';
-    process.env.SKS_CODEX_SDK_FAKE = '1';
-    try {
-        const result = await mod.runCodexTask({
-            route: extra.route || '$Agent',
-            missionId: extra.missionId || `M-${label}`,
-            workItemId: extra.workItemId || `${label}-work-item`,
-            slotId: extra.slotId || 'slot-001',
-            generationIndex: extra.generationIndex || 1,
-            sessionId: extra.sessionId || `${label}-session`,
-            cwd: root,
-            prompt: extra.prompt || `Hermetic Codex SDK gate fixture ${label}`,
-            inputFiles: [],
-            inputImages: [],
-            outputSchemaId: schema.CODEX_AGENT_WORKER_RESULT_SCHEMA_ID,
-            outputSchema: schema.codexAgentWorkerResultSchema,
-            sandboxPolicy: extra.sandboxPolicy || 'read-only',
-            requestedScopeContract: {
-                id: `${label}-scope`,
-                route: extra.route || '$Agent',
-                read_only: extra.sandboxPolicy !== 'workspace-write',
-                allowed_paths: extra.allowedPaths || [],
-                write_paths: extra.allowedPaths || [],
-                user_confirmed_full_access: false,
-                mad_sks_authorized: true,
-                ...(extra.requestedScopeContract || {})
-            },
-            mutationLedgerRoot: tmp,
-            zellijPaneId: extra.zellijPaneId || null
-        });
-        const proof = await readJsonFile(path.join(tmp, 'codex-control-proof.json'));
-        const registry = await readJsonFile(path.join(tmp, 'codex-thread-registry.json'));
-        const worker = await readJsonFile(path.join(tmp, 'codex-sdk-worker-result.json'));
-        const eventText = await fs.readFile(path.join(tmp, 'codex-sdk-events.jsonl'), 'utf8');
-        const events = eventText.split(/\n/).filter(Boolean).map((line) => JSON.parse(line));
-        return { tmp, result, proof, registry, worker, events };
-    }
-    finally {
-        restoreEnv(old);
-    }
-}
-export function packageScripts() {
-    return readJson('package.json').scripts || {};
-}
-export function releaseGateIds() {
-    const manifest = readJson('release-gates.v2.json');
-    return new Set((manifest.gates || []).map((gate) => gate.id));
-}
-export function assertSourceIncludes(file, tokens) {
-    const text = readText(file);
-    for (const token of tokens)
-        assertGate(text.includes(token), `${file} missing token ${token}`);
-    return text;
-}
-export function assertScriptPresent(name) {
-    const scripts = packageScripts();
-    assertGate(Boolean(scripts[name]), `package script missing: ${name}`, { script: name });
-    return scripts[name];
-}
-function snapshotEnv() {
-    return {
-        NODE_ENV: process.env.NODE_ENV,
-        SKS_CODEX_SDK_FAKE: process.env.SKS_CODEX_SDK_FAKE,
-        SKS_CODEX_SDK_FIXTURE: process.env.SKS_CODEX_SDK_FIXTURE
-    };
-}
-function restoreEnv(old) {
-    for (const [key, value] of Object.entries(old)) {
-        if (value === undefined)
-            delete process.env[key];
-        else
-            process.env[key] = value;
-    }
-}
-//# sourceMappingURL=codex-sdk-gate-lib.js.map

package/dist/scripts/lib/ensure-dist-fresh.js

@@ -1,142 +0,0 @@
-// @ts-nocheck
-import { spawnSync } from 'node:child_process';
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
-export const distStampPath = path.join(root, 'dist', '.sks-build-stamp.json');
-export const reportStampPath = path.join(root, '.sneakoscope', 'reports', 'dist-build-stamp.json');
-export function sourceSnapshot() {
-    const files = releaseRelevantFiles();
-    const hash = crypto.createHash('sha256');
-    for (const file of files) {
-        const full = path.join(root, file);
-        if (!fs.existsSync(full) || !fs.statSync(full).isFile())
-            continue;
-        const buf = fs.readFileSync(full);
-        hash.update(file);
-        hash.update('\0');
-        hash.update(String(buf.length));
-        hash.update('\0');
-        hash.update(sha256(buf));
-        hash.update('\0');
-    }
-    return { digest: hash.digest('hex'), file_count: files.length, files };
-}
-export function currentDistFreshness() {
-    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
-    const snapshot = sourceSnapshot();
-    const stamp = readJson(distStampPath) || readJson(path.join(root, 'dist', 'build-manifest.json'));
-    const issues = [];
-    if (!stamp)
-        issues.push('dist_build_stamp_missing');
-    if (stamp && stamp.package_version !== pkg.version && stamp.version !== pkg.version)
-        issues.push(`dist_version:${stamp.package_version || stamp.version || 'missing'}!=${pkg.version}`);
-    if (stamp && stamp.source_digest !== snapshot.digest)
-        issues.push('dist_source_digest_stale');
-    if (!fs.existsSync(path.join(root, 'dist', 'bin', 'sks.js')))
-        issues.push('dist_bin_missing');
-    return {
-        schema: 'sks.dist-freshness.v1',
-        ok: issues.length === 0,
-        package_version: pkg.version,
-        source_digest: snapshot.digest,
-        source_file_count: snapshot.file_count,
-        stamp_path: fs.existsSync(distStampPath) ? distStampPath : path.join(root, 'dist', 'build-manifest.json'),
-        stamp,
-        issues
-    };
-}
-export function ensureDistFresh({ rebuild = true } = {}) {
-    let freshness = currentDistFreshness();
-    const rebuildAllowed = rebuild
-        && process.env.SKS_ENSURE_DIST_NO_REBUILD !== '1'
-        && process.env.SKS_RELEASE_DIST_FRESHNESS_NO_REBUILD !== '1';
-    if (freshness.ok || !rebuildAllowed)
-        return freshness;
-    const run = spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['run', 'build', '--silent'], {
-        cwd: root,
-        encoding: 'utf8',
-        stdio: 'pipe'
-    });
-    if (run.status !== 0) {
-        return {
-            ...freshness,
-            ok: false,
-            rebuild_attempted: true,
-            rebuild_status: run.status,
-            issues: [...freshness.issues, `build_failed:${tail(run.stderr || run.stdout)}`]
-        };
-    }
-    freshness = currentDistFreshness();
-    return { ...freshness, rebuild_attempted: true, rebuild_status: run.status };
-}
-export function buildStampPayload() {
-    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
-    const snapshot = sourceSnapshot();
-    return {
-        schema: 'sks.dist-build-stamp.v1',
-        package_name: pkg.name,
-        package_version: pkg.version,
-        source_digest: snapshot.digest,
-        source_file_count: snapshot.file_count,
-        built_at_source_time: latestSourceMtime(snapshot.files)
-    };
-}
-export function writeDistFreshStamp() {
-    const payload = buildStampPayload();
-    fs.mkdirSync(path.dirname(distStampPath), { recursive: true });
-    fs.mkdirSync(path.dirname(reportStampPath), { recursive: true });
-    fs.writeFileSync(distStampPath, `${JSON.stringify(payload, null, 2)}\n`);
-    fs.writeFileSync(reportStampPath, `${JSON.stringify(payload, null, 2)}\n`);
-    return payload;
-}
-function releaseRelevantFiles() {
-    const result = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
-        cwd: root,
-        encoding: 'utf8'
-    });
-    const raw = result.status === 0 ? result.stdout.split('\0').filter(Boolean) : walk(root).map((file) => path.relative(root, file).split(path.sep).join('/'));
-    return raw
-        .filter((file) => /^(src|scripts|schemas|docs|test|crates\/sks-core)\//.test(file) || /^(package|package-lock)\.json$|^README\.md$|^CHANGELOG\.md$|^tsconfig\.json$/.test(file))
-        .filter((file) => !file.startsWith('dist/') && !file.startsWith('node_modules/') && !file.startsWith('.sneakoscope/'))
-        .sort();
-}
-function walk(dir, out = []) {
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-        const file = path.join(dir, entry.name);
-        if (entry.name === '.git' || entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.sneakoscope')
-            continue;
-        if (entry.isDirectory())
-            walk(file, out);
-        else if (entry.isFile())
-            out.push(file);
-    }
-    return out;
-}
-function latestSourceMtime(files) {
-    let latest = 0;
-    for (const file of files) {
-        try {
-            latest = Math.max(latest, fs.statSync(path.join(root, file)).mtimeMs);
-        }
-        catch { }
-    }
-    return Math.round(latest);
-}
-function sha256(value) {
-    return crypto.createHash('sha256').update(value).digest('hex');
-}
-function readJson(file) {
-    try {
-        return JSON.parse(fs.readFileSync(file, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-function tail(value) {
-    return String(value || '').slice(-1200).replace(/\s+/g, ' ').trim();
-}
-//# sourceMappingURL=ensure-dist-fresh.js.map

package/dist/scripts/lib/git-worktree-fixture.js

@@ -1,33 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-export function makeGitFixture(name) {
-    const root = fs.mkdtempSync(path.join(os.tmpdir(), `sks-${name}-`));
-    run('git', ['init'], root);
-    run('git', ['config', 'user.email', 'sks@example.invalid'], root);
-    run('git', ['config', 'user.name', 'SKS Test'], root);
-    fs.writeFileSync(path.join(root, 'a.txt'), 'alpha\n');
-    fs.writeFileSync(path.join(root, 'b.txt'), 'bravo\n');
-    run('git', ['add', 'a.txt', 'b.txt'], root);
-    run('git', ['commit', '-m', 'fixture'], root);
-    return root;
-}
-export function makeNonGitFixture(name) {
-    const root = fs.mkdtempSync(path.join(os.tmpdir(), `sks-${name}-`));
-    fs.writeFileSync(path.join(root, 'plain.txt'), 'not git\n');
-    return root;
-}
-export function run(command, args, cwd, input) {
-    const result = spawnSync(command, args, {
-        cwd,
-        input,
-        encoding: 'utf8',
-        stdio: input === undefined ? ['ignore', 'pipe', 'pipe'] : ['pipe', 'pipe', 'pipe']
-    });
-    if (result.status !== 0) {
-        throw new Error(`${command} ${args.join(' ')} failed in ${cwd}: ${result.stderr || result.stdout}`);
-    }
-    return result.stdout || '';
-}
-//# sourceMappingURL=git-worktree-fixture.js.map

package/dist/scripts/lib/mad-sks-actual-executor-check-lib.js

@@ -1,255 +0,0 @@
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './ensure-dist-fresh.js';
-export async function runMadSksExecutorCheck(kind) {
-    const reportDir = path.join(root, '.sneakoscope', 'reports');
-    fs.mkdirSync(reportDir, { recursive: true });
-    const freshness = ensureDistFresh({ rebuild: true });
-    if (!freshness.ok)
-        return writeReport(reportDir, kind, { schema: schemaFor(kind), ok: false, blocker: 'dist_not_fresh', freshness });
-    const mods = await loadMadSksDist();
-    const targetRoot = path.join(root, '.sneakoscope', 'tmp', `mad-sks-${kind}-${process.pid}`);
-    const artifactDir = path.join(targetRoot, 'artifacts');
-    fs.mkdirSync(artifactDir, { recursive: true });
-    const { permission, authorization, authorizationPath } = createAuthorization(mods, targetRoot, kind, artifactDir);
-    const common = {
-        target_root: targetRoot,
-        artifact_dir: artifactDir,
-        authorization_manifest: authorization,
-        authorization_manifest_path: authorizationPath,
-        permission_model: permission,
-        yes: true
-    };
-    const protectedBefore = await mods.immutable.snapshotProtectedCore(root, `${kind}-before`);
-    let result;
-    let rollbackApply = null;
-    let protectedBlock = null;
-    let engineSourceProbe = null;
-    const checks = [];
-    if (kind === 'actual-executor-blackbox' || kind === 'file-write-executor') {
-        result = await mods.executors.runMadSksExecutor({
-            ...common,
-            executor: 'file-write',
-            dry_run: false,
-            target_path: path.join('target', 'actual-write.txt'),
-            content: `mad-sks actual executor ${kind}\n`
-        });
-        const targetFile = path.join(targetRoot, 'target', 'actual-write.txt');
-        const resultVerifiedWrite = Array.isArray(result.verification) && result.verification.some((item) => item?.kind === 'file_expectation' && item?.ok === true);
-        checks.push(['target_file_written', result.ok === true && result.status === 'applied' && result.changed_files?.includes(targetFile) && resultVerifiedWrite]);
-        engineSourceProbe = await mods.immutable.evaluateMadSksWrite({
-            packageRoot: root,
-            targetRoot: root,
-            operation: 'file_write',
-            path: path.join(root, 'src', 'core', 'version.ts')
-        });
-        checks.push(['engine_source_repo_write_not_protected_core_blocked', engineSourceProbe.decision === 'allowed']);
-        const installed = await createInstalledCoreFixture();
-        protectedBlock = await mods.immutable.evaluateMadSksWrite({
-            packageRoot: installed.root,
-            targetRoot: installed.root,
-            operation: 'file_write',
-            path: path.join(installed.root, 'src', 'core', 'version.ts')
-        });
-        checks.push(['installed_protected_core_write_blocked', protectedBlock.ok === false && protectedBlock.decision === 'blocked']);
-        rollbackApply = await mods.rollbackApply.applyMadSksRollbackPlan({
-            rollbackPlanPath: result.rollback_plan_path,
-            targetRoot,
-            artifactDir,
-            yes: true,
-            root
-        });
-        checks.push(['rollback_apply_removed_new_file', rollbackApply.ok === true && !fs.existsSync(targetFile)]);
-    }
-    else if (kind === 'shell-executor') {
-        result = await mods.executors.runMadSksExecutor({
-            ...common,
-            executor: 'shell-command',
-            dry_run: false,
-            argv: [process.execPath, '-e', 'console.log("mad-sks-shell-ok")'],
-            command: [process.execPath, '-e', 'console.log("mad-sks-shell-ok")']
-        });
-        checks.push(['argv_no_shell_command_succeeded', result.ok === true && result.status === 'applied' && /mad-sks-shell-ok/.test(String(result.stdout_tail || ''))]);
-    }
-    else if (kind === 'package-executor') {
-        result = await mods.executors.runMadSksExecutor({
-            ...common,
-            executor: 'package-install',
-            dry_run: true,
-            argv: ['npm', 'install', 'left-pad'],
-            command: ['npm', 'install', 'left-pad']
-        });
-        checks.push(['package_command_routed_dry_run', result.ok === true && result.status === 'dry_run' && result.classification?.route_to_executor === 'package_install']);
-    }
-    else if (kind === 'service-executor') {
-        result = await mods.executors.runMadSksExecutor({
-            ...common,
-            executor: 'service-control',
-            dry_run: true,
-            argv: ['npm', 'run', 'dev'],
-            command: ['npm', 'run', 'dev']
-        });
-        checks.push(['service_command_guarded_dry_run', result.ok === true && result.status === 'dry_run' && result.previous_state?.captured === true]);
-    }
-    else if (kind === 'db-executor') {
-        result = await mods.executors.runMadSksExecutor({
-            ...common,
-            executor: 'db-write',
-            dry_run: true,
-            sql: 'update accounts set name = name where id = 1',
-            rollback_sql: 'update accounts set name = name where id = 1'
-        });
-        checks.push(['db_write_plan_guarded_dry_run', result.ok === true && result.status === 'dry_run' && result.sql_classification?.destructive === false]);
-    }
-    else if (kind === 'rollback-apply') {
-        const write = await mods.executors.runMadSksExecutor({
-            ...common,
-            executor: 'file-write',
-            dry_run: false,
-            target_path: path.join('target', 'rollback-only.txt'),
-            content: 'rollback target\n'
-        });
-        result = await mods.rollbackApply.applyMadSksRollbackPlan({
-            rollbackPlanPath: write.rollback_plan_path,
-            targetRoot,
-            artifactDir,
-            yes: true,
-            root
-        });
-        checks.push(['rollback_plan_applied', result.ok === true && result.status === 'applied']);
-    }
-    else if (kind === 'live-protected-core-smoke') {
-        engineSourceProbe = await mods.immutable.evaluateMadSksWrite({
-            packageRoot: root,
-            targetRoot: root,
-            operation: 'file_write',
-            path: path.join(root, 'src', 'core', 'version.ts')
-        });
-        const installed = await createInstalledCoreFixture();
-        const decision = await mods.immutable.evaluateMadSksWrite({
-            packageRoot: installed.root,
-            targetRoot: installed.root,
-            operation: 'file_write',
-            path: path.join(installed.root, 'src', 'core', 'version.ts')
-        });
-        result = {
-            schema: 'sks.mad-sks-live-protected-core-smoke.v1',
-            ok: engineSourceProbe.decision === 'allowed' && decision.ok === false,
-            status: engineSourceProbe.decision === 'allowed' && decision.decision === 'blocked' ? 'engine_exception_and_installed_blocked' : 'failed',
-            engine_source_probe: engineSourceProbe,
-            installed_protected_core_probe: decision
-        };
-        checks.push(['live_guard_honors_engine_source_exception', engineSourceProbe.decision === 'allowed']);
-        checks.push(['live_guard_blocks_installed_protected_core', decision.decision === 'blocked']);
-    }
-    else if (kind === 'executor-proof-graph') {
-        const required = [
-            'mad-sks-actual-executor-blackbox.json',
-            'mad-sks-file-write-executor.json',
-            'mad-sks-shell-executor.json',
-            'mad-sks-package-executor.json',
-            'mad-sks-service-executor.json',
-            'mad-sks-db-executor.json',
-            'mad-sks-rollback-apply.json',
-            'mad-sks-live-protected-core-smoke.json'
-        ];
-        const artifacts = required.map((name) => {
-            const file = path.join(reportDir, name);
-            const parsed = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : null;
-            return { path: `.sneakoscope/reports/${name}`, present: Boolean(parsed), ok: parsed?.ok === true, schema: parsed?.schema || null };
-        });
-        result = {
-            schema: 'sks.mad-sks-executor-proof-graph.v1',
-            ok: artifacts.every((artifact) => artifact.present && artifact.ok),
-            artifacts,
-            evidence_index_linked: true,
-            completion_proof_linked: true,
-            trust_report_linked: true,
-            wrongness_linked: true,
-            local_only_artifact_policy: true
-        };
-        checks.push(['executor_reports_ok', result.ok === true]);
-    }
-    else {
-        result = { schema: schemaFor(kind), ok: false, status: 'blocked', blocker: `unknown_check:${kind}` };
-        checks.push(['known_check', false]);
-    }
-    const protectedAfter = await mods.immutable.snapshotProtectedCore(root, `${kind}-after`);
-    const protectedComparison = mods.immutable.compareProtectedCoreSnapshots(protectedBefore, protectedAfter);
-    const report = {
-        schema: schemaFor(kind),
-        ok: Boolean(result?.ok) && protectedComparison.ok === true && checks.every(([, ok]) => ok === true),
-        status: result?.status || null,
-        generated_at: new Date().toISOString(),
-        target_root: targetRoot,
-        checks: Object.fromEntries(checks),
-        result,
-        rollback_apply: rollbackApply,
-        protected_core_block_probe: protectedBlock,
-        engine_source_exception_probe: engineSourceProbe,
-        protected_core_unchanged: protectedComparison.ok === true,
-        protected_core_comparison: protectedComparison,
-        local_only_artifact_policy: true
-    };
-    return writeReport(reportDir, kind, report);
-}
-async function createInstalledCoreFixture() {
-    const fixtureRoot = path.join(root, '.sneakoscope', 'tmp', `mad-sks-installed-core-${process.pid}-${Date.now()}`);
-    const artifactDir = path.join(fixtureRoot, 'artifacts');
-    fs.mkdirSync(path.join(fixtureRoot, 'src', 'core'), { recursive: true });
-    fs.mkdirSync(path.join(fixtureRoot, 'scripts'), { recursive: true });
-    fs.mkdirSync(artifactDir, { recursive: true });
-    fs.writeFileSync(path.join(fixtureRoot, 'package.json'), '{"name":"sneakoscope","version":"1.18.13"}\n');
-    fs.writeFileSync(path.join(fixtureRoot, 'src', 'core', 'version.ts'), 'export const PACKAGE_VERSION = "1.18.13";\n');
-    return { root: fixtureRoot, artifactDir };
-}
-function createAuthorization(mods, targetRoot, kind, artifactDir) {
-    const flags = [
-        '--mad-sks',
-        '--allow-system',
-        '--allow-db-write',
-        '--allow-package-install',
-        '--allow-service-control',
-        '--allow-network',
-        '--allow-computer-use',
-        '--allow-browser-use',
-        '--allow-generated-assets',
-        '--yes'
-    ];
-    const permission = mods.permission.buildMadSksPermissionModel({
-        targetRoot,
-        userIntent: `MAD-SKS ${kind} release check`,
-        flags: mods.permission.parseMadSksFlags(flags)
-    });
-    const authorization = mods.auth.createMadSksAuthorizationManifest({ permission, userIntent: `MAD-SKS ${kind} release check` });
-    const authorizationPath = path.join(artifactDir, 'mad-sks-authorization.json');
-    fs.writeFileSync(authorizationPath, `${JSON.stringify(authorization, null, 2)}\n`);
-    return { permission, authorization, authorizationPath };
-}
-async function loadMadSksDist() {
-    return {
-        executors: await importDist('core/mad-sks/executors/index.js'),
-        permission: await importDist('core/mad-sks/permission-model.js'),
-        auth: await importDist('core/mad-sks/authorization-manifest.js'),
-        immutable: await importDist('core/mad-sks/immutable-harness-guard.js'),
-        rollbackApply: await importDist('core/mad-sks/rollback-apply.js')
-    };
-}
-async function importDist(rel) {
-    return import(pathToFileURL(path.join(root, 'dist', rel)).href);
-}
-function schemaFor(kind) {
-    return `sks.mad-sks-${kind}.v1`;
-}
-function writeReport(reportDir, kind, report) {
-    const fileName = `mad-sks-${kind.replace(/^actual-executor-blackbox$/, 'actual-executor-blackbox')}.json`;
-    const file = path.join(reportDir, fileName);
-    fs.writeFileSync(file, `${JSON.stringify(report, null, 2)}\n`);
-    console.log(JSON.stringify(report, null, 2));
-    if (!report.ok)
-        process.exitCode = 1;
-    return report;
-}
-//# sourceMappingURL=mad-sks-actual-executor-check-lib.js.map

package/dist/scripts/lib/native-cli-session-swarm-check-lib.js

@@ -1,79 +0,0 @@
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { assertGate, root } from '../sks-1-18-gate-lib.js';
-export function runNativeCliSwarmCheck({ agents, workItems = agents, reportName, backend = 'fake', extraArgs = [], expectedFastMode = null }) {
-    const distCli = path.join(root, 'dist', 'bin', 'sks.js');
-    assertGate(fs.existsSync(distCli), 'dist CLI missing for native CLI swarm check', { distCli });
-    const args = [
-        distCli,
-        'agent',
-        'run',
-        `native cli session swarm ${agents}`,
-        '--backend',
-        backend,
-        '--mock',
-        '--agents',
-        String(agents),
-        '--concurrency',
-        String(agents),
-        '--work-items',
-        String(workItems),
-        '--minimum-work-items',
-        String(agents),
-        '--json',
-        ...extraArgs
-    ];
-    const stdout = execFileSync(process.execPath, args, {
-        cwd: root,
-        encoding: 'utf8',
-        env: {
-            ...process.env,
-            ...(backend === 'codex-sdk' ? { SKS_CODEX_SDK_FAKE: '1', NODE_ENV: 'test' } : {})
-        },
-        maxBuffer: 96 * 1024 * 1024
-    });
-    const result = JSON.parse(stdout);
-    const proof = result.native_cli_session_proof || {};
-    const noSubagent = result.no_subagent_scaling_policy || {};
-    const officialHelper = result.official_subagent_helper_policy || {};
-    const fast = result.fast_mode_propagation || {};
-    const policy = fast.policy || result.fast_mode_policy || {};
-    const expectedFast = expectedFastMode === null || expectedFastMode === undefined ? Boolean(policy.fast_mode) : Boolean(expectedFastMode);
-    const expectedTier = expectedFast ? 'fast' : 'standard';
-    const report = {
-        schema: 'sks.native-cli-session-swarm-check.v1',
-        ok: result.ok === true,
-        agents,
-        work_items: workItems,
-        mission_id: result.mission_id,
-        backend: result.backend,
-        native_cli_session_proof: proof,
-        no_subagent_scaling_policy: noSubagent,
-        official_subagent_helper_policy: officialHelper,
-        fast_mode_propagation: fast,
-        proof_status: result.proof?.status || null
-    };
-    const out = path.join(root, '.sneakoscope', 'reports', reportName);
-    fs.mkdirSync(path.dirname(out), { recursive: true });
-    fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-    assertGate(result.ok === true, 'native CLI session swarm run must pass', report);
-    assertGate(proof.spawned_worker_process_count >= agents, 'spawned native worker process count below requested agents', report);
-    assertGate(proof.unique_worker_session_count >= agents, 'unique worker session count below requested agents', report);
-    assertGate(proof.unique_slot_count >= agents, 'unique slot count below requested agents', report);
-    assertGate(Array.isArray(proof.process_ids) && proof.process_ids.length >= agents, 'process ids missing from native CLI proof', report);
-    assertGate(proof.close_report_count >= agents, 'worker close report count below requested agents', report);
-    assertGate(noSubagent.ok === true && noSubagent.subagent_events_counted_as_worker_sessions === false, 'no-subagent scaling policy must pass', report);
-    assertGate(officialHelper.ok === true && officialHelper.official_codex_subagent_helper_lane_enabled === true, 'official subagent helper policy must pass', report);
-    assertGate(officialHelper.worker_capacity_credit === 0 && officialHelper.subagent_events_counted_as_worker_sessions === false, 'official helper lane must not count toward worker capacity', report);
-    assertGate(noSubagent.official_codex_subagent_helper_lane_allowed === true && noSubagent.official_helper_lane_worker_capacity_credit === 0, 'no-subagent policy must allow helper lane with zero capacity credit', report);
-    assertGate(fast.ok === true, 'fast mode propagation proof must pass', report);
-    assertGate(fast.fast_mode === expectedFast && fast.service_tier === expectedTier, 'worker service tier must match the selected fast-mode policy', { ...report, expected_fast_mode: expectedFast, expected_service_tier: expectedTier });
-    if (expectedFast) {
-        assertGate(policy.explicit_fast === true || policy.preference_mode === 'fast' || policy.explicit_service_tier === 'fast', 'fast-mode propagation gate must use explicit fast opt-in', report);
-    }
-    assertGate((proof.worker_command_lines || []).every((line) => line.includes('--agent') && line.includes('worker')), 'worker command lines must use --agent worker', report);
-    return report;
-}
-//# sourceMappingURL=native-cli-session-swarm-check-lib.js.map