sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/appshots-triwiki-voxel-check.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/source-intelligence/appshots-evidence.js');
+const fixture = writeAppshotFixture('voxel');
+const evidence = mod.buildAppshotsEvidence({
+    root,
+    prompt: 'visual Appshots voxel',
+    sourcePaths: [fixture.rel],
+    sourceMetadata: [fixture.metadata],
+    operatorActionRecorded: true
+});
+const report = { schema: 'sks.appshots-triwiki-voxel-check.v1', ok: evidence.triwiki_voxel_ready, evidence };
+const out = path.join(root, '.sneakoscope', 'reports', 'appshots-triwiki-voxel.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(evidence.triwiki_voxel_ready === true, 'Appshots visual source must be TriWiki/Voxel ready', report);
+assertGate(evidence.accepted_source_paths.length === 1, 'Appshots TriWiki/Voxel evidence must use verified accepted sources', report);
+emitGate('appshots:triwiki-voxel', { source_count: evidence.source_count });
+function writeAppshotFixture(name) {
+    const dir = path.join(root, '.sneakoscope', 'reports', 'appshots-fixtures');
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, `${name}.redacted-appshot.json`);
+    fs.writeFileSync(file, `${JSON.stringify({ fixture: true, redacted: true, text: '[redacted appshot fixture]' })}\n`);
+    const rel = path.relative(root, file).split(path.sep).join('/');
+    return {
+        rel,
+        metadata: {
+            path: rel,
+            source_type: 'codex_appshot',
+            origin: 'fixture',
+            operator_attached: true,
+            frontmost_window: true,
+            redacted: true,
+            local_only: true,
+            fixture: true,
+            thread_id: 'thread-fixture-voxel',
+            attachment_id: 'attachment-fixture-voxel',
+            source_app: 'Codex',
+            source_window: 'Fixture Appshot'
+        }
+    };
+}
+//# sourceMappingURL=appshots-triwiki-voxel-check.js.map

package/dist/scripts/architecture-guard-check.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const issues = [];
+function read(rel) {
+    return fs.readFileSync(path.join(root, rel), 'utf8');
+}
+function readJson(rel) {
+    return JSON.parse(read(rel));
+}
+function assertIncludes(rel, needle, message = `${rel} missing ${needle}`) {
+    if (!read(rel).includes(needle))
+        issues.push(message);
+}
+function assertScript(name, expected) {
+    const actual = String(pkg.scripts?.[name] || '');
+    if (!actual.includes(expected))
+        issues.push(`package script ${name} must include ${expected}`);
+}
+const pkg = readJson('package.json');
+assertScript('architecture:guard', 'node ./dist/scripts/architecture-guard-check.js');
+assertIncludes('src/core/safety/ssot-guard.ts', 'solid_principles');
+assertIncludes('src/core/safety/ssot-guard.ts', 'single_responsibility');
+assertIncludes('src/core/safety/ssot-guard.ts', 'open_closed');
+assertIncludes('src/core/safety/ssot-guard.ts', 'liskov_substitution');
+assertIncludes('src/core/safety/ssot-guard.ts', 'interface_segregation');
+assertIncludes('src/core/safety/ssot-guard.ts', 'dependency_inversion');
+assertIncludes('src/core/pipeline-internals/runtime-core.ts', "'ssot_guard'");
+assertIncludes('src/core/pipeline-internals/runtime-core.ts', 'buildSsotGuard');
+assertIncludes('src/core/pipeline-internals/runtime-core.ts', 'ssotGuardPolicyText');
+assertIncludes('src/core/pipeline-internals/runtime-gates.ts', 'validateSsotGuardArtifact');
+assertIncludes('src/core/pipeline-internals/runtime-gates.ts', "'ssot_guard'");
+assertIncludes('src/core/commands/team-command.ts', 'SSOT_GUARD_ARTIFACT');
+assertIncludes('src/scripts/release-parallel-check.ts', "task('architecture:guard'");
+assertIncludes('src/core/release/gate-manifest.ts', "'architecture:guard'");
+assertIncludes('src/core/release/gate-manifest.ts', "'architecture:'");
+assertIncludes('docs/architecture-ts-rust-boundary.md', '`architecture:guard`');
+assertIncludes('docs/architecture-ts-rust-boundary.md', 'SOLID');
+const report = {
+    schema: 'sks.architecture-guard-check.v1',
+    ok: issues.length === 0,
+    gate: 'architecture:guard',
+    guarantees: ['ssot', 'solid'],
+    issues
+};
+const reportDir = path.join(root, '.sneakoscope', 'reports');
+fs.mkdirSync(reportDir, { recursive: true });
+fs.writeFileSync(path.join(reportDir, 'architecture-guard.json'), `${JSON.stringify(report, null, 2)}\n`);
+console.log(JSON.stringify(report, null, 2));
+if (!report.ok)
+    process.exitCode = 1;
+//# sourceMappingURL=architecture-guard-check.js.map

package/dist/scripts/brand-neutrality-generated-artifacts-check.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { root } from './sks-3-1-7-directive-check-lib.js';
+const terms = forbiddenTerms();
+const rawSourceUrl = process.env.SKS_CODEX_NATIVE_REFERENCE_SOURCE_URL || '';
+const offenders = [];
+const warnings = [];
+const scope = process.env.SKS_BRAND_NEUTRALITY_SCAN_ALL === '1' ? 'all-generated-artifacts' : 'current-codex-native-artifacts';
+const requiredCurrentArtifacts = [
+    '.sneakoscope/reports/codex-native-reference-cache.json',
+    '.sneakoscope/reports/codex-native-reference-evidence.json',
+    '.sneakoscope/reports/codex-native-pattern-analysis.json',
+    '.sneakoscope/reports/codex-native-feature-matrix.json',
+    '.sneakoscope/reports/codex-native-invocation-plan.json',
+    'docs/codex-native-patterns.md'
+];
+const missingRequired = scope === 'current-codex-native-artifacts'
+    ? requiredCurrentArtifacts.filter((artifact) => !fs.existsSync(path.join(root, artifact)))
+    : [];
+let scanned = 0;
+for (const file of filesForGeneratedArtifacts()) {
+    scanned += 1;
+    scanFile(file);
+}
+assertGate(missingRequired.length === 0 && scanned >= requiredCurrentArtifacts.length && offenders.length === 0, 'generated artifact brand/source leakage detected', {
+    scanned_files: scanned,
+    scope,
+    required_current_artifacts: scope === 'current-codex-native-artifacts' ? requiredCurrentArtifacts : [],
+    missing_required_artifacts: missingRequired,
+    warnings,
+    redacted_offenders: offenders,
+    forbidden_term_hashes: terms.map(hash)
+});
+emitGate('brand-neutrality:generated-artifacts', { scanned_files: scanned, scope, warnings });
+function* filesForGeneratedArtifacts() {
+    if (scope !== 'all-generated-artifacts') {
+        const currentArtifacts = [
+            ...requiredCurrentArtifacts,
+            '.sneakoscope/reports/codex-native-repair-transaction.json',
+            '.sneakoscope/codex-plugin-inventory.json',
+            '.sneakoscope/reports/codex-agent-role-sync.json',
+            '.sneakoscope/reports/codex-skill-sync.json',
+            '.sneakoscope/reports/codex-init-deep.json',
+            '.sneakoscope/reports/codex-hook-lifecycle.json',
+            '.sneakoscope/mcp-plugin-server-candidates.json'
+        ];
+        for (const artifact of currentArtifacts)
+            yield* filesFor(artifact);
+        const missionId = process.env.SKS_MISSION_ID || process.env.SNEAKOSCOPE_MISSION_ID || '';
+        if (missionId)
+            yield* filesFor(path.join('.sneakoscope', 'missions', missionId));
+        return;
+    }
+    yield* filesFor('.sneakoscope/reports');
+    yield* filesFor('docs/codex-native-patterns.md');
+    for (const mission of recentMissionDirs())
+        yield* filesFor(path.relative(root, mission));
+}
+function recentMissionDirs() {
+    const missionsRoot = path.join(root, '.sneakoscope', 'missions');
+    if (!fs.existsSync(missionsRoot))
+        return [];
+    const limit = Math.max(1, Number(process.env.SKS_BRAND_NEUTRALITY_MISSION_LIMIT || 20) || 20);
+    const dirs = fs.readdirSync(missionsRoot, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => {
+        const full = path.join(missionsRoot, entry.name);
+        return { full, mtimeMs: fs.statSync(full).mtimeMs };
+    })
+        .sort((a, b) => b.mtimeMs - a.mtimeMs);
+    if (dirs.length > limit)
+        warnings.push(`mission_scan_limited:${limit}_of_${dirs.length}`);
+    return dirs.slice(0, limit).map((entry) => entry.full);
+}
+function* filesFor(target) {
+    const full = path.join(root, target);
+    if (!fs.existsSync(full))
+        return;
+    const stat = fs.statSync(full);
+    if (stat.isFile()) {
+        if (artifactFile(full))
+            yield full;
+        return;
+    }
+    const stack = [full];
+    while (stack.length) {
+        const dir = stack.pop();
+        if (!dir)
+            continue;
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const child = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                stack.push(child);
+            else if (entry.isFile() && artifactFile(child))
+                yield child;
+        }
+    }
+}
+function artifactFile(file) {
+    return /\.(json|md|txt)$/i.test(file);
+}
+function scanFile(file) {
+    const needles = [
+        ...terms.map((term) => ({ kind: hash(term).slice(0, 12), value: term.toLowerCase() })),
+        ...(rawSourceUrl ? [{ kind: `raw_source_url_${hash(rawSourceUrl).slice(0, 12)}`, value: rawSourceUrl.toLowerCase() }] : [])
+    ].filter((needle) => needle.value);
+    if (!needles.length)
+        return;
+    const maxNeedle = Math.max(...needles.map((needle) => needle.value.length), 1);
+    const fd = fs.openSync(file, 'r');
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    let carry = '';
+    try {
+        while (true) {
+            const bytes = fs.readSync(fd, buffer, 0, buffer.length, null);
+            if (!bytes)
+                break;
+            const text = (carry + buffer.subarray(0, bytes).toString('utf8')).toLowerCase();
+            for (const needle of needles) {
+                if (text.includes(needle.value))
+                    pushOffender(`${rel(file)}#${needle.kind}`);
+            }
+            if (offenders.length)
+                break;
+            carry = text.slice(-Math.max(maxNeedle - 1, 0));
+        }
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function pushOffender(value) {
+    if (offenders.length < 200)
+        offenders.push(value);
+    else if (offenders.length === 200)
+        offenders.push('additional_offenders_redacted');
+}
+function forbiddenTerms() {
+    const raw = process.env.FORBIDDEN_EXTERNAL_REFERENCE_TERMS;
+    if (raw)
+        return raw.split(/[,;\n]/).map((term) => term.trim()).filter(Boolean);
+    return ['bGF6eWNvZGV4', 'b3BlbmNsYXc=', 'aGVybWVz', 'b2gtbXktb3BlbmFnZW50', 'c2lzeXBodXNsYWJz'].map((value) => Buffer.from(value, 'base64').toString('utf8'));
+}
+function rel(file) {
+    return path.relative(root, file).split(path.sep).join('/');
+}
+function hash(text) {
+    return createHash('sha256').update(text).digest('hex');
+}
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate, detail = {}) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate, ...detail }, null, 2));
+}
+//# sourceMappingURL=brand-neutrality-generated-artifacts-check.js.map

package/dist/scripts/brand-neutrality-rename-map-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('brand-neutrality:rename-map');
+//# sourceMappingURL=brand-neutrality-rename-map-check.js.map

package/dist/scripts/brand-neutrality-zero-leakage-blackbox.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('brand-neutrality:zero-leakage-blackbox');
+//# sourceMappingURL=brand-neutrality-zero-leakage-blackbox.js.map

package/dist/scripts/brand-neutrality-zero-leakage-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('brand-neutrality:zero-leakage');
+//# sourceMappingURL=brand-neutrality-zero-leakage-check.js.map

package/dist/scripts/build-once-runner-blackbox.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('sks-build-once-');
+await writeText(path.join(tmp, 'package.json'), JSON.stringify({
+    version: '4.0.2',
+    scripts: {
+        'build:clean': 'node build.mjs',
+        'build:incremental': 'node build.mjs'
+    }
+}, null, 2));
+await writeText(path.join(tmp, 'package-lock.json'), JSON.stringify({ name: 'fixture', version: '4.0.2', lockfileVersion: 3, packages: { '': { version: '4.0.2' } } }, null, 2));
+await writeText(path.join(tmp, 'tsconfig.json'), JSON.stringify({ compilerOptions: { outDir: 'dist' } }, null, 2));
+await writeText(path.join(tmp, 'src/index.ts'), 'export const value = 1;\n');
+await writeText(path.join(tmp, 'build.mjs'), "import fs from 'node:fs'; fs.mkdirSync('dist/bin',{recursive:true}); fs.writeFileSync('dist/bin/sks.js','#!/usr/bin/env node\\n');\n");
+const mod = await importDist('core/build/build-once-runner.js');
+const first = mod.runBuildOnce({ root: tmp, mode: 'clean', force: true });
+const second = mod.runBuildOnce({ root: tmp, mode: 'incremental' });
+await writeText(path.join(tmp, 'src/index.ts'), 'export const value = 2;\n');
+const third = mod.runBuildOnce({ root: tmp, mode: 'incremental' });
+await writeText(path.join(tmp, 'build.mjs'), "import fs from 'node:fs'; fs.mkdirSync('dist/bin',{recursive:true});\n");
+await fs.rm(path.join(tmp, 'dist', 'bin', 'sks.js'), { force: true });
+const broken = mod.runBuildOnce({ root: tmp, mode: 'incremental', force: true });
+await writeText(path.join(tmp, 'build.mjs'), "import fs from 'node:fs'; fs.mkdirSync('dist/bin',{recursive:true}); fs.writeFileSync('dist/bin/sks.js','#!/usr/bin/env node\\n');\n");
+await writeText(path.join(tmp, 'package-lock.json'), JSON.stringify({ name: 'fixture', version: '4.0.2', lockfileVersion: 3, packages: { '': { version: '4.0.2' } }, changed: true }, null, 2));
+const lockChanged = mod.runBuildOnce({ root: tmp, mode: 'incremental' });
+assertGate(first.ok === true && first.reused === false, 'clean build must write an initial proof', first);
+assertGate(second.ok === true && second.reused === true, 'second unchanged incremental run must reuse proof', second);
+assertGate(third.ok === true && third.reused === false && third.source_hash !== first.source_hash, 'source edit must invalidate proof', { first, third });
+assertGate(broken.ok === false && broken.blockers.some((item) => item.includes('dist_target_missing:dist/bin/sks.js')), 'missing dist/bin/sks.js must fail proof', broken);
+assertGate(lockChanged.ok === true && lockChanged.package_lock_hash !== third.package_lock_hash, 'package-lock change must invalidate proof', { third, lockChanged });
+emitGate('build-once:runner-blackbox', { first: first.ok, reused: second.reused, broken: broken.ok });
+//# sourceMappingURL=build-once-runner-blackbox.js.map

package/dist/scripts/build-once-runner-check.js

@@ -0,0 +1,8 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, readText } from './sks-1-18-gate-lib.js';
+const src = readText('src/core/build/build-once-runner.ts');
+assertGate(src.includes('.sks-build-proof.json') && src.includes('build:incremental'), 'build-once runner must write dist proof and use incremental build', src.slice(0, 500));
+const mod = await importDist('core/build/build-once-runner.js');
+assertGate(mod.BUILD_ONCE_PROOF_SCHEMA === 'sks.build-once-proof.v1', 'build-once proof schema missing');
+emitGate('build-once:runner');
+//# sourceMappingURL=build-once-runner-check.js.map

package/dist/scripts/certificate-sla-check.js

@@ -0,0 +1,9 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const graphMod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const certMod = await importDist('core/triwiki/triwiki-sla-certificate.js');
+const graph = graphMod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-proof-bank.ts'], tier: 'affected' });
+const cert = certMod.buildTriWikiSlaCertificate({ graph, slaMs: 300000, estimatedCriticalPathMs: 1000, estimatedSequentialMs: 5000 });
+assertGate(cert.schema === 'sks.triwiki-sla-certificate.v1' && cert.ok === true && cert.release_equivalent_within_scope === true, 'SLA certificate must pass for in-budget affected graph', cert);
+emitGate('certificate:sla', { reduction_ratio: cert.reduction_ratio });
+//# sourceMappingURL=certificate-sla-check.js.map

package/dist/scripts/changelog-check.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const changelogPath = path.join(root, 'CHANGELOG.md');
+const packagePath = path.join(root, 'package.json');
+function fail(message) {
+    console.error(`Changelog check failed: ${message}`);
+    process.exit(2);
+}
+function escapeRegExp(value) {
+    return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function sectionFor(text, headingRe) {
+    const match = headingRe.exec(text);
+    if (!match)
+        return null;
+    const start = match.index + match[0].length;
+    const rest = text.slice(start);
+    const next = rest.search(/^##\s+/m);
+    return next >= 0 ? rest.slice(0, next) : rest;
+}
+function hasReleaseEntry(section) {
+    return /^###\s+(Added|Changed|Fixed|Docs|Internal|Security|Removed)\s*$/m.test(section)
+        && /^\s*-\s+\S/m.test(section);
+}
+const pkg = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+const version = pkg.version;
+if (!version)
+    fail('package.json has no version.');
+if (!fs.existsSync(changelogPath))
+    fail('CHANGELOG.md is missing.');
+const text = fs.readFileSync(changelogPath, 'utf8');
+if (!/^#\s+Changelog\s*$/m.test(text))
+    fail('CHANGELOG.md must start with a Changelog title.');
+if (!/^##\s+\[Unreleased\]\s*$/m.test(text))
+    fail('CHANGELOG.md must include an [Unreleased] section.');
+const versionHeading = new RegExp(`^##\\s+\\[${escapeRegExp(version)}\\]\\s+-\\s+\\d{4}-\\d{2}-\\d{2}\\s*$`, 'm');
+const versionSection = sectionFor(text, versionHeading);
+if (!versionSection)
+    fail(`CHANGELOG.md is missing a [${version}] - YYYY-MM-DD section.`);
+if (!hasReleaseEntry(versionSection))
+    fail(`CHANGELOG.md [${version}] section must include at least one categorized bullet.`);
+console.log(`Changelog check passed: ${version}`);
+//# sourceMappingURL=changelog-check.js.map

package/dist/scripts/changelog-loop-productionization-check.js

@@ -0,0 +1,3 @@
+import { runLoopHardeningCheck } from './loop-hardening-check-lib.js';
+await runLoopHardeningCheck('changelog:loop-productionization');
+//# sourceMappingURL=changelog-loop-productionization-check.js.map

package/dist/scripts/cli-check-tiers-check.js

@@ -0,0 +1,10 @@
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const check = readText('src/core/commands/check-command.ts');
+const registry = readText('src/cli/command-registry.ts');
+for (const token of ['instant', 'affected', 'confidence', 'release', 'real-check'])
+    assertGate(check.includes(token), `check tier missing: ${token}`);
+for (const token of ['task:', 'release:', 'triwiki:', 'daemon:'])
+    assertGate(registry.includes(token), `CLI registry missing ${token}`);
+emitGate('cli:check-tiers');
+//# sourceMappingURL=cli-check-tiers-check.js.map

package/dist/scripts/cli-five-minute-task-check.js

@@ -0,0 +1,6 @@
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const task = readText('src/core/commands/task-command.ts');
+assertGate(task.includes('--tier') && task.includes('confidence') && task.includes('--sla'), 'task command must route to SLA confidence check');
+emitGate('cli:five-minute-task');
+//# sourceMappingURL=cli-five-minute-task-check.js.map

package/dist/scripts/codex-0-133-official-compat-report.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { codex0133Matrix, CODEX_0_133_RELEASE_EVIDENCE } from '../core/codex-compat/codex-0-133.js';
+const versionRun = spawnSync('codex', ['--version'], { encoding: 'utf8' });
+const resumeHelp = spawnSync('codex', ['exec', 'resume', '--help'], { encoding: 'utf8', maxBuffer: 256 * 1024 });
+const execHelp = spawnSync('codex', ['exec', '--help'], { encoding: 'utf8', maxBuffer: 256 * 1024 });
+const matrix = codex0133Matrix({
+    version: `${versionRun.stdout || ''}${versionRun.stderr || ''}`,
+    available: versionRun.status === 0,
+    execResumeHelp: resumeHelp.stdout || resumeHelp.stderr || '',
+    execHelp: execHelp.stdout || execHelp.stderr || ''
+});
+const topics = [
+    'goals_default_enabled',
+    'remote_control_foreground_app_server',
+    'permission_profiles_requirements',
+    'plugin_discovery_marketplaces',
+    'extension_lifecycle_events',
+    'exec_resume_output_schema'
+];
+const rows = topics.map((topic) => {
+    const cap = matrix.capabilities.find((item) => item.id === topic);
+    return {
+        topic,
+        result: cap?.status || 'missing',
+        official_source_checked: true,
+        release_readiness_row_added: true,
+        notes: cap?.notes || ['capability row missing']
+    };
+});
+const blockers = rows.filter((row) => row.result === 'missing').map((row) => `missing:${row.topic}`);
+const report = {
+    schema: 'sks.codex-0-133-official-compat.v1',
+    ok: blockers.length === 0,
+    status: versionRun.status === 0 ? 'checked' : 'integration_optional',
+    release_source_url: CODEX_0_133_RELEASE_EVIDENCE.tag_url,
+    release_tag: CODEX_0_133_RELEASE_EVIDENCE.tag,
+    source_delta: rows,
+    structured_output_inheritance: rows.find((row) => row.topic === 'exec_resume_output_schema')?.result || 'missing',
+    local_codex_version: `${versionRun.stdout || versionRun.stderr || ''}`.trim() || null,
+    matrix,
+    blockers
+};
+const out = path.join(process.cwd(), '.sneakoscope', 'reports', 'codex-0-133-official-compat.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+console.log(JSON.stringify(report, null, 2));
+if (!report.ok)
+    process.exitCode = 1;
+//# sourceMappingURL=codex-0-133-official-compat-report.js.map

package/dist/scripts/codex-0-134-official-compat-report.js

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import https from 'node:https';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/codex/codex-0-134-compat.js');
+const versionRun = spawnSync('codex', ['--version'], { encoding: 'utf8' });
+const execHelp = spawnSync('codex', ['exec', '--help'], { encoding: 'utf8', maxBuffer: 256 * 1024 });
+const mcpHelp = spawnSync('codex', ['mcp', '--help'], { encoding: 'utf8', maxBuffer: 256 * 1024 });
+const searchHelp = spawnSync('codex', ['search', '--help'], { encoding: 'utf8', maxBuffer: 256 * 1024 });
+const release = await fetchJson('https://api.github.com/repos/openai/codex/releases/tags/rust-v0.134.0');
+const releaseBody = String(release.json?.body || '');
+const matrix = mod.codex0134Matrix({
+    version: `${versionRun.stdout || ''}${versionRun.stderr || ''}`,
+    available: versionRun.status === 0,
+    execHelp: `${execHelp.stdout || ''}${execHelp.stderr || ''}`,
+    mcpHelp: `${mcpHelp.stdout || ''}${mcpHelp.stderr || ''}`,
+    historyHelp: `${searchHelp.stdout || ''}${searchHelp.stderr || ''}`,
+    historyCommandAvailable: searchHelp.status === 0 && /^\s*Usage:\s+codex\s+search\b/m.test(`${searchHelp.stdout || ''}${searchHelp.stderr || ''}`),
+    schemaPolicyText: '$ref $defs readOnlyHint'
+});
+const topics = {
+    local_conversation_history_search: ['search across local conversation history', 'case-insensitive content matches'],
+    profile_primary_selector: ['--profile', 'primary profile selector'],
+    mcp_per_server_environment: ['per-server environment targeting'],
+    mcp_streamable_http_oauth: ['OAuth options', 'streamable HTTP servers'],
+    connector_schema_refs_defs_compaction: ['$ref', '$defs', 'compacting oversized schemas'],
+    mcp_readonly_parallel_hint: ['readOnlyHint'],
+    hook_subagent_context: ['subagent identity in hook inputs'],
+    managed_network_proxy_env: ['managed network proxy environment']
+};
+const rows = Object.entries(topics).map(([topic, needles]) => {
+    const capability = matrix.capabilities.find((item) => item.id === topic);
+    const missingOfficialNeedles = release.ok === true ? needles.filter((needle) => !releaseBody.includes(needle)) : [];
+    return {
+        topic,
+        result: capability?.status || 'missing',
+        official_source_checked: release.ok === true,
+        official_release_needles: needles,
+        official_release_missing: missingOfficialNeedles,
+        release_readiness_row_added: true,
+        notes: capability?.notes || ['capability row missing']
+    };
+});
+const blockers = [
+    ...rows.filter((row) => row.result === 'missing').map((row) => `missing:${row.topic}`),
+    ...rows.filter((row) => row.official_release_missing.length > 0).map((row) => `official_release_topic_missing:${row.topic}:${row.official_release_missing.join('|')}`)
+];
+const warnings = [
+    ...(release.ok ? [] : [`official_release_fetch_unavailable:${release.error || release.statusCode || 'unknown'}`])
+];
+const report = {
+    schema: 'sks.codex-0-134-official-compat.v1',
+    ok: blockers.length === 0 && matrix.ok === true,
+    status: versionRun.status === 0 ? 'checked' : 'integration_optional',
+    release_source_url: mod.CODEX_0_134_RELEASE_EVIDENCE.tag_url,
+    release_tag: mod.CODEX_0_134_RELEASE_EVIDENCE.tag,
+    release_date: release.json?.published_at || mod.CODEX_0_134_RELEASE_EVIDENCE.release_date,
+    official_source: {
+        api_url: 'https://api.github.com/repos/openai/codex/releases/tags/rust-v0.134.0',
+        ok: release.ok,
+        status_code: release.statusCode || null,
+        tag_name: release.json?.tag_name || null,
+        html_url: release.json?.html_url || mod.CODEX_0_134_RELEASE_EVIDENCE.tag_url
+    },
+    source_delta: rows,
+    local_codex_version: `${versionRun.stdout || versionRun.stderr || ''}`.trim() || null,
+    matrix,
+    blockers: [...blockers, ...(matrix.blockers || [])],
+    warnings
+};
+const out = path.join(root, '.sneakoscope', 'reports', 'codex-0-134-official-compat.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+console.log(JSON.stringify(report, null, 2));
+assertGate(report.ok, 'Codex 0.134 official compatibility report has blockers', report);
+emitGate('codex:0.134-official-compat', { topics: rows.length, version: report.local_codex_version });
+function fetchJson(url) {
+    return new Promise((resolve) => {
+        const req = https.get(url, {
+            headers: {
+                'User-Agent': 'sneakoscope-release-check',
+                Accept: 'application/vnd.github+json'
+            },
+            timeout: 20000
+        }, (res) => {
+            let body = '';
+            res.setEncoding('utf8');
+            res.on('data', (chunk) => { body += chunk; });
+            res.on('end', () => {
+                try {
+                    const json = JSON.parse(body);
+                    resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, statusCode: res.statusCode, json });
+                }
+                catch (err) {
+                    resolve({ ok: false, statusCode: res.statusCode, error: err.message, body: body.slice(0, 1000) });
+                }
+            });
+        });
+        req.on('timeout', () => {
+            req.destroy(new Error('timeout'));
+        });
+        req.on('error', (err) => {
+            resolve({ ok: false, error: err.message });
+        });
+    });
+}
+//# sourceMappingURL=codex-0-134-official-compat-report.js.map

package/dist/scripts/codex-0-134-runner-truth-check.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const runner = await importDist('core/agents/agent-runner-codex-exec.js');
+const compat = await importDist('core/codex/codex-0-134-compat.js');
+const history = await importDist('core/source-intelligence/codex-history-search.js');
+const agentRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-codex-0134-runner-'));
+const agent = { id: 'agent-0134', session_id: 'session-0134', persona_id: 'verifier', session_artifact_dir: 'sessions/agent-0134' };
+const command = runner.buildCodexExecAgentArgs(agent, 'runner truth fixture', { profile: 'sks-fast-high', resultFile: path.join(agentRoot, 'result.json') });
+const result = await runner.runCodexExecAgent(agent, { id: 'slice-0134', description: 'runner truth fixture' }, {
+    agentRoot,
+    cwd: root,
+    dryRun: true,
+    profile: 'sks-fast-high',
+    resultFile: path.join(agentRoot, 'result.json'),
+    env: {
+        HTTPS_PROXY: 'http://user:secret@example.test:8080',
+        NO_PROXY: 'localhost,127.0.0.1'
+    }
+});
+const processReportPath = path.join(agentRoot, 'sessions/agent-0134/agent-process-report.json');
+const processReport = JSON.parse(fs.readFileSync(processReportPath, 'utf8'));
+const codexHome = path.join(agentRoot, 'codex-home');
+fs.mkdirSync(path.join(codexHome, 'sessions'), { recursive: true });
+fs.writeFileSync(path.join(codexHome, 'sessions', 'history.jsonl'), '{"message":"Codex 0.134 runner truth history"}\n');
+const historyReport = await history.searchCodexHistory({ codexHome, query: 'runner truth', maxFiles: 5, maxResults: 3 });
+const matrix = compat.codex0134Matrix({
+    version: 'codex-cli 0.134.0',
+    available: true,
+    execHelp: 'Usage: codex exec --profile <PROFILE>',
+    mcpHelp: 'Usage: codex mcp --env KEY --oauth streamable',
+    historyHelp: 'Usage: codex search history',
+    historyCommandAvailable: true,
+    schemaPolicyText: '$ref $defs readOnlyHint'
+});
+const require0134 = process.env.SKS_REQUIRE_CODEX_0_134 === '1';
+const blockers = [
+    ...(command.args.includes('--profile') ? [] : ['codex_profile_arg_missing']),
+    ...(command.args.includes('--ignore-user-config') ? ['codex_profile_combined_with_ignore_user_config'] : []),
+    ...(processReport.profile === 'sks-fast-high' ? [] : ['codex_process_report_profile_missing']),
+    ...(Array.isArray(processReport.managed_proxy_env_keys) && processReport.managed_proxy_env_keys.includes('HTTPS_PROXY') ? [] : ['codex_managed_proxy_keys_missing']),
+    ...(JSON.stringify(processReport).includes('secret') ? ['codex_process_report_leaked_proxy_secret'] : []),
+    ...(historyReport.ok === true && historyReport.results.length === 1 ? [] : ['codex_history_search_evidence_missing']),
+    ...(matrix.ok === true ? [] : ['codex_0_134_matrix_not_ok']),
+    ...(require0134 && matrix.ok !== true ? ['codex_0_134_required_mode_blocked'] : [])
+];
+const report = {
+    schema: 'sks.codex-0.134-runner-truth-check.v1',
+    ok: blockers.length === 0,
+    required_mode: require0134,
+    command_args: command.args,
+    process_report: processReport,
+    history_report: historyReport,
+    matrix,
+    runner_result_status: result.status,
+    blockers
+};
+const out = path.join(root, '.sneakoscope', 'reports', 'codex-0-134-runner-truth.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(report.ok === true, 'Codex 0.134 runner truth has blockers', report);
+emitGate('codex:0.134-runner-truth', { profile: processReport.profile, history_results: historyReport.results.length });
+//# sourceMappingURL=codex-0-134-runner-truth-check.js.map