sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/codex-0140-import-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCodex0140FeatureGate } from './codex-0140-feature-gate-lib.js';
+await runCodex0140FeatureGate('codex:0140-import', 'import_command');
+//# sourceMappingURL=codex-0140-import-check.js.map

package/dist/scripts/codex-0140-integration-blackbox.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { detectCodex0140Capability } from '../core/codex-control/codex-0140-capability.js';
+process.env.SKS_CODEX_0140_FAKE = '1';
+process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.140.0';
+process.env.SKS_CODEX_0140_PROBE = '1';
+const report = await detectCodex0140Capability({ codexBin: 'codex' });
+assertGate(report.ok === true && Object.values(report.features).every(Boolean), 'Codex 0.140 integration blackbox requires every fixture feature', report);
+assertGate(Object.values(report.feature_states).every((state) => state.supported === true && state.certainty === 'fixture'), 'Codex 0.140 integration blackbox requires explicit fixture feature states', report);
+assertGate(Object.keys(report.feature_certainty).length === Object.keys(report.features).length, 'Codex 0.140 integration blackbox requires per-feature certainty coverage', report);
+assertGate(JSON.stringify(report).includes('SUPABASE_ACCESS_TOKEN') === false, 'Codex 0.140 blackbox must not serialize secret env values', report);
+emitGate('codex:0140-integration-blackbox', { feature_count: Object.keys(report.features).length });
+//# sourceMappingURL=codex-0140-integration-blackbox.js.map

package/dist/scripts/codex-0140-large-repo-performance-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCodex0140FeatureGate } from './codex-0140-feature-gate-lib.js';
+await runCodex0140FeatureGate('codex:0140-large-repo-performance', 'large_repo_responsiveness');
+//# sourceMappingURL=codex-0140-large-repo-performance-check.js.map

package/dist/scripts/codex-0140-mcp-reliability-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCodex0140FeatureGate } from './codex-0140-feature-gate-lib.js';
+await runCodex0140FeatureGate('codex:0140-mcp-reliability', 'mcp_reliability');
+//# sourceMappingURL=codex-0140-mcp-reliability-check.js.map

package/dist/scripts/codex-0140-non-tty-interrupt-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCodex0140FeatureGate } from './codex-0140-feature-gate-lib.js';
+await runCodex0140FeatureGate('codex:0140-non-tty-interrupt', 'non_tty_interrupt');
+//# sourceMappingURL=codex-0140-non-tty-interrupt-check.js.map

package/dist/scripts/codex-0140-real-probes-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { runCodex0140RealProbes } from '../core/codex-control/codex-0140-real-probes.js';
+const requireReal = process.argv.includes('--require-real');
+const allowNetwork = process.argv.includes('--allow-network');
+const report = await runCodex0140RealProbes({ root, requireReal, allowNetwork });
+assertGate(report.ok === true || !requireReal, requireReal ? 'codex:0140-real-probes:require-real failed' : 'optional Codex 0.140 real probes must skip instead of blocking release', report);
+emitGate(requireReal ? 'codex:0140-real-probes:require-real' : 'codex:0140-real-probes', { probes: report.probes.length, skipped: report.probes.filter((probe) => probe.status === 'skipped').length });
+//# sourceMappingURL=codex-0140-real-probes-check.js.map

package/dist/scripts/codex-0140-session-delete-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCodex0140FeatureGate } from './codex-0140-feature-gate-lib.js';
+await runCodex0140FeatureGate('codex:0140-session-delete', 'session_delete');
+//# sourceMappingURL=codex-0140-session-delete-check.js.map

package/dist/scripts/codex-0140-sqlite-recovery-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCodex0140FeatureGate } from './codex-0140-feature-gate-lib.js';
+await runCodex0140FeatureGate('codex:0140-sqlite-recovery', 'sqlite_auto_recovery');
+//# sourceMappingURL=codex-0140-sqlite-recovery-check.js.map

package/dist/scripts/codex-0140-unified-mentions-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCodex0140FeatureGate } from './codex-0140-feature-gate-lib.js';
+await runCodex0140FeatureGate('codex:0140-unified-mentions', 'unified_mentions');
+//# sourceMappingURL=codex-0140-unified-mentions-check.js.map

package/dist/scripts/codex-0140-usage-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCodex0140FeatureGate } from './codex-0140-feature-gate-lib.js';
+await runCodex0140FeatureGate('codex:0140-usage', 'usage_views');
+//# sourceMappingURL=codex-0140-usage-check.js.map

package/dist/scripts/codex-0140-usage-real-parser-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { parseCodex0140UsageOutput } from '../core/codex-control/codex-0140-usage-parser.js';
+const json = parseCodex0140UsageOutput(JSON.stringify({
+    daily: { tokens: 1200, limit: 5000 },
+    weekly: { tokens: 7400 },
+    cumulative: { tokens: 120000 }
+}));
+assertGate(json.ok === true && json.source_format === 'json', 'usage parser must parse JSON usage output', json);
+assertGate(json.views.daily === 1200 && json.views.weekly === 7400 && json.views.cumulative === 120000 && json.views.limit === 5000, 'usage parser must retain daily/weekly/cumulative/limit fields', json);
+const text = parseCodex0140UsageOutput('Daily usage: 1,234 tokens\nWeekly quota: 50,000\nCumulative total: 999999\n');
+assertGate(text.ok === true && text.source_format === 'text', 'usage parser must parse text usage output', text);
+assertGate(text.views.daily === 1234 && text.views.weekly === 50000 && text.views.cumulative === 999999, 'usage parser must normalize numeric text output', text);
+const empty = parseCodex0140UsageOutput('');
+assertGate(empty.ok === false && empty.blockers.includes('usage_output_empty'), 'usage parser must reject empty output', empty);
+emitGate('codex:0140-usage-real-parser', { json_fields: Object.keys(json.views).length, text_fields: Object.keys(text.views).length });
+//# sourceMappingURL=codex-0140-usage-real-parser-check.js.map

package/dist/scripts/codex-0141-capability-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { CODEX_0141_FEATURE_KEYS, detectCodex0141Capability } from '../core/codex-control/codex-0141-capability.js';
+process.env.SKS_CODEX_0141_FAKE = '1';
+process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.141.0';
+const cap = await detectCodex0141Capability({ codexBin: 'codex' });
+assertGate(cap.ok === true && cap.supports_0141 === true, 'Codex 0.141 capability fixture must pass', cap);
+assertGate(Object.keys(cap.feature_states).length === CODEX_0141_FEATURE_KEYS.length, 'Codex 0.141 feature key count mismatch', cap);
+assertGate(Object.values(cap.feature_states).every((state) => state.supported === true && state.certainty === 'assumed_by_version'), 'version-only mode must mark 0.141 features as assumed by version', cap);
+assertGate(cap.feature_states.prompt_image_cache_bound_64_mib.sks_policy === 'bound'
+    && cap.feature_states.feedback_upload_bound_8_threads.sks_policy === 'bound'
+    && cap.feature_states.plugin_app_mcp_dedupe.sks_policy === 'dedupe', 'Codex 0.141 SKS policies must encode bound/dedupe/delegate behavior', cap.feature_states);
+process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.140.0';
+const old = await detectCodex0141Capability({ codexBin: 'codex' });
+assertGate(old.ok === false && old.blockers.includes('codex_0_141_required_for_0141_features'), 'Codex 0.140 must not satisfy 0.141 capability', old);
+emitGate('codex:0.141-compat', { features: CODEX_0141_FEATURE_KEYS.length });
+//# sourceMappingURL=codex-0141-capability-check.js.map

package/dist/scripts/codex-0142-app-server-v2-check.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+import { createCodexAppServerV2Client, currentTimeResponse } from '../core/codex-control/codex-app-server-v2-client.js';
+const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_CODEX_0142_APP_SERVER === '1';
+const clientSource = readText('src/core/codex-control/codex-app-server-v2-client.ts');
+const schema = readText('schemas/codex/app-server-0.142/codex_app_server_protocol.v2.schemas.json');
+assertGate(clientSource.includes('resolveCodexRuntime'), 'app-server-v2 client must use the shared Codex runtime resolver');
+assertGate(clientSource.includes('currentTime/read'), 'app-server-v2 client must implement currentTime/read server request handling');
+assertGate(clientSource.includes("request('thread/list'"), 'app-server-v2 client must wrap native thread/list');
+assertGate(clientSource.includes("request('thread/read'"), 'app-server-v2 client must wrap native thread/read');
+assertGate(clientSource.includes('searchThreads'), 'app-server-v2 client must expose search over native thread list searchTerm');
+assertGate(schema.includes('"thread/list"'), 'generated 0.142 schema must contain thread/list');
+assertGate(schema.includes('"thread/read"'), 'generated 0.142 schema must contain thread/read');
+assertGate(schema.includes('"searchTerm"'), 'generated 0.142 schema must contain ThreadListParams.searchTerm');
+assertGate(schema.includes('"ThreadSearchResult"'), 'generated 0.142 schema must contain ThreadSearchResult');
+const deterministic = currentTimeResponse(new Date('2026-06-23T00:00:00.000Z'));
+assertGate(deterministic.utcIso === '2026-06-23T00:00:00.000Z', 'currentTime/read UTC ISO must be deterministic');
+assertGate(deterministic.unixTimeSeconds === 1782172800, 'currentTime/read seconds must be Unix UTC seconds');
+assertGate(deterministic.timezone === 'UTC', 'currentTime/read canonical timezone must be UTC');
+let realProbe = null;
+if (requireReal) {
+    const { client, runtimeIdentity } = await createCodexAppServerV2Client({ requestedBy: 'codex-0142-app-server-v2-check' });
+    try {
+        await client.initialize();
+        const list = await client.listThreads({ limit: 1, useStateDbOnly: true });
+        realProbe = {
+            runtime_version: runtimeIdentity.version,
+            runtime_sha256: runtimeIdentity.sha256,
+            list_returned_object: Boolean(list && typeof list === 'object')
+        };
+        assertGate(runtimeIdentity.version === '0.142.0', 'app-server-v2 require-real must resolve Codex 0.142.0', realProbe);
+        assertGate(realProbe.list_returned_object === true, 'app-server-v2 require-real thread/list must return an object', realProbe);
+    }
+    finally {
+        await client.close();
+    }
+}
+emitGate('codex:0142:app-server-v2', {
+    current_time_handler: true,
+    thread_list: true,
+    thread_read: true,
+    thread_search_method: schema.includes('"thread/search"'),
+    thread_search_via_list_search_term: true,
+    real_probe: realProbe
+});
+//# sourceMappingURL=codex-0142-app-server-v2-check.js.map

package/dist/scripts/codex-0142-binary-identity-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
+import { compareSemverLike } from '../core/codex-compat/codex-version-policy.js';
+import { resolveCodexRuntime } from '../core/codex-runtime/resolve-codex-runtime.js';
+const resolved = await resolveCodexRuntime({ requestedBy: 'codex-0142-binary-identity-check' });
+assertGate(resolved.ok && resolved.identity !== null, 'Codex runtime identity must resolve', resolved);
+const identity = resolved.identity;
+assertGate(compareSemverLike(identity.version, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion) >= 0, 'Codex runtime must satisfy 0.142.0', identity);
+assertGate(identity.sha256.length === 64, 'Codex runtime identity must include SHA-256', identity);
+emitGate('codex:0142:binary-identity', {
+    realpath: identity.realpath,
+    version: identity.version,
+    sha256: identity.sha256,
+    source: identity.source
+});
+//# sourceMappingURL=codex-0142-binary-identity-check.js.map

package/dist/scripts/codex-0142-capability-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { CODEX_0142_FEATURE_KEYS, detectCodex0142Capability, writeCodex0142CapabilityArtifacts } from '../core/codex-control/codex-0142-capability.js';
+const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_CODEX_0142 === '1';
+if (!requireReal)
+    process.env.SKS_CODEX_0142_FAKE = '1';
+const cap = await detectCodex0142Capability({ requireReal });
+assertGate(cap.ok === true, 'Codex 0.142 capability probe must pass', cap);
+assertGate(Object.keys(cap.feature_states).length === CODEX_0142_FEATURE_KEYS.length, 'Codex 0.142 feature count mismatch', cap);
+assertGate(Object.values(cap.feature_states).every((state) => String(state.certainty) !== 'assumed_by_version'), 'Codex 0.142 capability must not use assumed_by_version evidence', cap);
+if (requireReal) {
+    assertGate(cap.probe_mode === 'real-schema', 'Codex 0.142 require-real must use generated schema evidence', cap);
+    assertGate(cap.release_authorizing === true, 'Codex 0.142 require-real must be release-authorizing', cap);
+    await writeCodex0142CapabilityArtifacts(process.cwd(), { requireReal: true });
+}
+emitGate('codex:0142-capability', {
+    features: CODEX_0142_FEATURE_KEYS.length,
+    probe_mode: cap.probe_mode,
+    release_authorizing: cap.release_authorizing
+});
+//# sourceMappingURL=codex-0142-capability-check.js.map

package/dist/scripts/codex-0142-manifest-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readJson, root } from './sks-1-18-gate-lib.js';
+import { codexReleaseManifestParity } from '../core/codex-compat/codex-release-manifest.js';
+const parity = await codexReleaseManifestParity(root);
+const pkg = readJson('package.json');
+const lock = readJson('package-lock.json');
+const manifest = parity.manifest;
+const dep = pkg.dependencies?.['@openai/codex-sdk'];
+const lockSdk = lock.packages?.['node_modules/@openai/codex-sdk']?.version;
+const lockCli = lock.packages?.['node_modules/@openai/codex']?.version;
+assertGate(parity.ok, 'Codex release manifest TS/JSON parity must hold', parity);
+assertGate(dep === manifest.sdkVersion, 'package.json must pin @openai/codex-sdk exactly to manifest sdkVersion', { dep, sdkVersion: manifest.sdkVersion });
+assertGate(lockSdk === manifest.sdkVersion, 'package-lock must resolve @openai/codex-sdk to manifest sdkVersion', { lockSdk, sdkVersion: manifest.sdkVersion });
+assertGate(lockCli === manifest.requiredCliVersion, 'package-lock must resolve @openai/codex to manifest requiredCliVersion', { lockCli, requiredCliVersion: manifest.requiredCliVersion });
+assertGate(pkg.version === '4.0.15', 'package version must be 4.0.15', { version: pkg.version });
+emitGate('codex:0142:manifest', {
+    manifest_sha256: parity.manifest_sha256,
+    target_tag: manifest.targetTag,
+    sdk_version: manifest.sdkVersion
+});
+//# sourceMappingURL=codex-0142-manifest-check.js.map

package/dist/scripts/codex-0142-policy-check.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildCodexExecutionPolicy } from '../core/codex-control/codex-sdk-config-policy.js';
+import { buildCodexSdkEnv } from '../core/codex-control/codex-sdk-env-policy.js';
+process.env.AWS_SECRET_ACCESS_KEY = 'fixture-secret-aws';
+process.env.GITHUB_TOKEN = 'fixture-secret-github';
+process.env.SLACK_BOT_TOKEN = 'fixture-secret-slack';
+const input = {
+    route: 'test',
+    tier: 'worker',
+    missionId: 'M-test',
+    cwd: process.cwd(),
+    prompt: 'fixture',
+    outputSchemaId: 'fixture',
+    outputSchema: {},
+    sandboxPolicy: 'workspace-write',
+    requestedScopeContract: {},
+    mutationLedgerRoot: '.sneakoscope/tmp/codex-policy-check'
+};
+const env = buildCodexSdkEnv(input);
+const policy = buildCodexExecutionPolicy(input);
+for (const key of ['AWS_SECRET_ACCESS_KEY', 'GITHUB_TOKEN', 'SLACK_BOT_TOKEN']) {
+    assertGate(!(key in env.env), `secret env must not be inherited: ${key}`, env.proof);
+}
+assertGate(policy.network === 'disabled' && policy.approval === 'on-request' && policy.gitRepoCheck === 'required', 'default Codex execution policy must be conservative', policy);
+emitGate('codex:0142:policy', {
+    inherited_key_count: env.proof.inherited_key_count,
+    blocked_sensitive_host_env_key_count: env.proof.blocked_sensitive_host_env_key_count,
+    network: policy.network,
+    approval: policy.approval
+});
+//# sourceMappingURL=codex-0142-policy-check.js.map

package/dist/scripts/codex-0142-thread-store-check.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { readCodexThreadRegistry, recordCodexThread } from '../core/codex-control/codex-thread-registry.js';
+const tmp = await fsp.mkdtemp(path.join(os.tmpdir(), 'sks-codex-0142-thread-store-'));
+try {
+    await Promise.all(Array.from({ length: 100 }, async (_, index) => {
+        await recordCodexThread(tmp, {
+            backend: 'app-server-v2',
+            thread_id: `thread-${index}`,
+            sdk_thread_id: `thread-${index}`,
+            session_id: 'session-a',
+            work_item_id: `work-${index}`,
+            parent_thread_id: index === 0 ? null : 'thread-0',
+            recency_at: 1_782_172_800 + index,
+            status: 'completed'
+        });
+    }));
+    const registry = await readCodexThreadRegistry(tmp);
+    const threads = Array.isArray(registry?.threads) ? registry.threads : [];
+    const keys = new Set(threads.map((row) => String(row.registry_key || '')));
+    const journal = await fsp.readFile(path.join(tmp, 'codex-thread-registry.events.jsonl'), 'utf8');
+    const events = journal.trim().split(/\r?\n/).filter(Boolean);
+    assertGate(registry?.thread_count === 100, 'thread registry must preserve 100 concurrent writes', registry);
+    assertGate(keys.size === 100, 'thread registry keys must remain unique after concurrent writes', { keys: keys.size });
+    assertGate(registry?.storage_mode === 'json-with-atomic-lock-and-journal', 'thread registry must use atomic lock storage mode', registry);
+    assertGate(registry?.lock_strategy === 'atomic-mkdir', 'thread registry lock strategy must be explicit', registry);
+    assertGate(events.length === 100, 'thread registry journal must record every write', { events: events.length });
+    assertGate(!await exists(path.join(tmp, 'codex-thread-registry.lock')), 'thread registry lock directory must be released');
+    await fsp.writeFile(path.join(tmp, 'codex-thread-registry.json'), '{broken', 'utf8');
+    await recordCodexThread(tmp, { thread_id: 'after-corruption', session_id: 'session-b', work_item_id: 'work-corrupt' });
+    const repaired = await readCodexThreadRegistry(tmp);
+    assertGate(repaired?.corruption?.preserved_path, 'thread registry corruption must be preserved with evidence', repaired);
+    emitGate('codex:0142:thread-store', {
+        concurrent_writes: 100,
+        storage_mode: registry.storage_mode,
+        corruption_preserved: true
+    });
+}
+finally {
+    await fsp.rm(tmp, { recursive: true, force: true }).catch(() => { });
+}
+async function exists(file) {
+    try {
+        await fsp.access(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=codex-0142-thread-store-check.js.map

package/dist/scripts/codex-account-usage-autodiscovery-check.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import http from 'node:http';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const server = http.createServer((req, res) => {
+    res.setHeader('content-type', 'application/json');
+    res.end(JSON.stringify({ account_id: 'fixture', token_usage: { input_tokens: 1, output_tokens: 2, total_tokens: 3 }, usage_limit_tokens: 100 }));
+});
+await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+const port = server.address().port;
+process.env.CODEX_APP_SERVER_USAGE_URL = `http://127.0.0.1:${port}/usage`;
+const mod = await importDist('core/usage/codex-account-usage.js');
+const usage = await mod.collectCodexAccountUsage();
+server.close();
+assertGate(usage.ok === true && usage.attempted_sources.includes('CODEX_APP_SERVER_USAGE_URL') && usage.token_usage.total_tokens === 3, 'account usage auto-discovery must record attempted sources and normalize usage');
+delete process.env.CODEX_APP_SERVER_USAGE_URL;
+delete process.env.SKS_CODEX_APP_SERVER_USAGE_URL;
+process.env.CODEX_BIN = '/bin/false';
+const unavailable = await mod.collectCodexAccountUsage();
+assertGate(unavailable.ok === false && unavailable.source === 'unavailable' && unavailable.token_usage === null, 'unavailable account usage must not be reported as ok', unavailable);
+emitGate('codex:account-usage-autodiscovery', { attempted_sources: usage.attempted_sources });
+//# sourceMappingURL=codex-account-usage-autodiscovery-check.js.map

package/dist/scripts/codex-account-usage-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+process.env.SKS_CODEX_ACCOUNT_USAGE_FAKE = '1';
+const mod = await importDist('core/usage/codex-account-usage.js');
+const usage = await mod.collectCodexAccountUsage();
+assertGate(usage.ok === true && usage.source === 'fake' && usage.token_usage.total_tokens === 1500, 'Codex account usage telemetry must normalize app-server/fake token usage', usage);
+emitGate('codex:account-usage', { source: usage.source, total_tokens: usage.token_usage.total_tokens });
+//# sourceMappingURL=codex-account-usage-check.js.map

package/dist/scripts/codex-agent-role-rich-content-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
+await runDirective315Gate('codex-app:agent-role-rich-content');
+//# sourceMappingURL=codex-agent-role-rich-content-check.js.map

package/dist/scripts/codex-agent-role-sync-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
+await runDirective314Gate('codex-app:agent-role-sync');
+//# sourceMappingURL=codex-agent-role-sync-check.js.map

package/dist/scripts/codex-agent-type-blackbox.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
+await runDirective315Gate('codex-app:agent-type-blackbox');
+//# sourceMappingURL=codex-agent-type-blackbox.js.map

package/dist/scripts/codex-agent-type-probe-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
+await runDirective315Gate('codex-app:agent-type-probe');
+//# sourceMappingURL=codex-agent-type-probe-check.js.map

package/dist/scripts/codex-agent-type-routing-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
+await runDirective315Gate('codex-app:agent-type-routing');
+//# sourceMappingURL=codex-agent-type-routing-check.js.map

package/dist/scripts/codex-app-execution-profile-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
+await runDirective314Gate('codex-app:execution-profile');
+//# sourceMappingURL=codex-app-execution-profile-check.js.map

package/dist/scripts/codex-app-fast-ui-preservation-check.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { evaluateCodexAppFastUiPreservation } from '../core/codex-app/codex-app-fast-ui-preservation.js';
+import { snapshotCodexAppUiState } from '../core/codex-app/codex-app-ui-state-snapshot.js';
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-fast-ui-preservation-'));
+const codexHome = path.join(tmp, 'home', '.codex');
+await fs.mkdir(path.join(tmp, '.codex'), { recursive: true });
+await fs.mkdir(codexHome, { recursive: true });
+await fs.writeFile(path.join(tmp, '.codex', 'config.toml'), 'sandbox_mode = "workspace-write"\n');
+await fs.writeFile(path.join(codexHome, 'config.toml'), '[features]\nfast_mode = true\n');
+await fs.writeFile(path.join(codexHome, 'auth.json'), '{"access_token":"secret-should-not-leak","account_id":"acct_fixture"}\n');
+const before = await snapshotCodexAppUiState(tmp, { codexHome });
+const after = await snapshotCodexAppUiState(tmp, { codexHome });
+const clean = await evaluateCodexAppFastUiPreservation(tmp, { before, after, codexHome });
+const badRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-fast-ui-preservation-bad-'));
+await fs.mkdir(path.join(badRoot, '.codex'), { recursive: true });
+await fs.mkdir(path.join(badRoot, 'home', '.codex'), { recursive: true });
+await fs.writeFile(path.join(badRoot, '.codex', 'config.toml'), 'model_provider = "codex-lb"\n');
+await fs.writeFile(path.join(badRoot, 'home', '.codex', 'config.toml'), '');
+const bad = await evaluateCodexAppFastUiPreservation(badRoot, { codexHome: path.join(badRoot, 'home', '.codex') });
+const serialized = JSON.stringify({ clean, bad });
+const secretSafe = !serialized.includes('secret-should-not-leak');
+const ok = clean.ok && !bad.ok && bad.project_local_forbidden_keys.includes('model_provider') && secretSafe;
+emit({ schema: 'sks.codex-app-fast-ui-preservation-check.v1', ok, clean, bad, secret_safe: secretSafe, blockers: ok ? [] : ['codex_app_fast_ui_preservation_check_failed'] });
+function emit(report) {
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=codex-app-fast-ui-preservation-check.js.map

package/dist/scripts/codex-app-handoff-check.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+process.env.SKS_CODEX_0138_FAKE = '1';
+const mod = await importDist('core/codex-app/codex-app-handoff.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-app-handoff-'));
+const result = await mod.runCodexAppHandoff(root, {
+    schema: 'sks.codex-app-handoff-request.v1',
+    mission_id: 'M-fixture',
+    route: '$QA-LOOP',
+    reason: 'fixture',
+    workspace_path: root,
+    artifacts: ['qa-gate.json'],
+    prompt: 'fixture prompt',
+    require_desktop: false,
+    capability_required: 'codex-0.138'
+});
+const artifact = JSON.parse(await fs.readFile(result.artifact_path, 'utf8'));
+assertGate(result.ok === true && artifact.operator_instruction.open === 'codex /app', 'Codex App handoff must write operator handoff artifact', result);
+assertGate(String(await fs.readFile(result.prompt_artifact_path, 'utf8')).includes('Do not treat this handoff artifact as web UI verification evidence'), 'handoff prompt must preserve web evidence boundary');
+emitGate('codex-app:handoff', { status: result.status });
+//# sourceMappingURL=codex-app-handoff-check.js.map

package/dist/scripts/codex-app-handoff-launch-check.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+process.env.SKS_CODEX_0138_FAKE = '1';
+process.env.SKS_CODEX_APP_LAUNCH_FAKE = '1';
+const mod = await importDist('core/codex-app/codex-app-handoff.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-app-handoff-launch-'));
+const result = await mod.runCodexAppHandoff(root, {
+    schema: 'sks.codex-app-handoff-request.v1',
+    mission_id: 'M-fixture',
+    route: '$QA-LOOP',
+    reason: 'fixture',
+    workspace_path: root,
+    artifacts: ['qa-gate.json'],
+    prompt: 'fixture prompt',
+    require_desktop: true,
+    capability_required: 'codex-0.138',
+    launch_mode: 'attempt-launch'
+});
+assertGate(result.launch_attempt?.attempted === true && result.status === 'launched_pending_confirmation' && result.confirmation_required === true, 'Codex App handoff launch mode must record launched_pending_confirmation and require confirmation', result);
+emitGate('codex-app:handoff-launch', { status: result.status });
+//# sourceMappingURL=codex-app-handoff-launch-check.js.map

package/dist/scripts/codex-app-harness-blackbox.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
+await runDirective314Gate('codex-app:harness-blackbox');
+//# sourceMappingURL=codex-app-harness-blackbox.js.map

package/dist/scripts/codex-app-harness-matrix-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
+await runDirective314Gate('codex-app:harness-matrix');
+//# sourceMappingURL=codex-app-harness-matrix-check.js.map

package/dist/scripts/codex-app-launcher-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { writeTextAtomic } from '../core/fsx.js';
+process.env.SKS_CODEX_APP_LAUNCH_FAKE = '1';
+const mod = await importDist('core/codex-app/codex-app-launcher.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-app-launcher-'));
+const prompt = path.join(root, 'prompt.md');
+await writeTextAtomic(prompt, 'fixture');
+const artifactOnly = await mod.attemptCodexAppLaunch({ cwd: root, promptArtifactPath: prompt, mode: 'artifact-only', codexBin: 'codex' });
+const launched = await mod.attemptCodexAppLaunch({ cwd: root, promptArtifactPath: prompt, mode: 'attempt-launch', codexBin: 'codex' });
+assertGate(artifactOnly.attempted === false && launched.attempted === true && launched.launched === true, 'Codex App launcher must keep artifact-only safe mode and support opt-in launch attempts', { artifactOnly, launched });
+emitGate('codex-app:launcher', { mode: launched.mode });
+//# sourceMappingURL=codex-app-launcher-check.js.map

package/dist/scripts/codex-app-provider-badge-check.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import { buildCodexAppProviderBadgeStatus } from '../core/codex-app/codex-app-provider-badge.js';
+const providerContext = {
+    schema: 'sks.provider-context.v1',
+    generated_at: new Date().toISOString(),
+    provider: 'codex-lb',
+    auth_mode: 'codex_lb_key',
+    route: '$Agent',
+    service_tier: 'fast',
+    source: 'codex_lb',
+    confidence: 'high',
+    conflict: false,
+    warnings: [],
+    signals: {
+        openai_api_key_present: false,
+        codex_lb_key_present: true,
+        codex_lb_explicit: true,
+        codex_app_auth_present: false,
+        model_provider: 'codex-lb'
+    }
+};
+const unsupported = await buildCodexAppProviderBadgeStatus(process.cwd(), { providerContext, officialCapability: false });
+const supported = await buildCodexAppProviderBadgeStatus(process.cwd(), { providerContext, officialCapability: true });
+const ok = unsupported.ok
+    && supported.ok
+    && unsupported.native_app_badge_supported === false
+    && unsupported.private_app_mutation === false
+    && unsupported.fallback_surfaces.includes('doctor --json')
+    && supported.native_app_badge_status === 'available'
+    && unsupported.badge_text === 'Provider: codex-lb · Fast';
+emit({ schema: 'sks.codex-app-provider-badge-check.v1', ok, unsupported, supported, blockers: ok ? [] : ['codex_app_provider_badge_check_failed'] });
+function emit(report) {
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=codex-app-provider-badge-check.js.map

package/dist/scripts/codex-app-skill-agent-blackbox.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
+await runDirective314Gate('codex-app:skill-agent-blackbox');
+//# sourceMappingURL=codex-app-skill-agent-blackbox.js.map

package/dist/scripts/codex-app-type-safety-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
+await runDirective315Gate('codex-app:type-safety');
+//# sourceMappingURL=codex-app-type-safety-check.js.map

package/dist/scripts/codex-app-ui-clobber-guard-check.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { codexAppUiMutationAllowed, evaluateCodexAppUiClobberGuard } from '../core/codex-app/codex-app-ui-clobber-guard.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-ui-clobber-guard-'));
+await fs.mkdir(path.join(root, '.codex'), { recursive: true });
+await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'sandbox_mode = "workspace-write"\n');
+await fs.writeFile(path.join(root, 'package.json'), '{"scripts":{"postinstall":"node ./dist/bin/sks.js postinstall"}}\n');
+const clean = await evaluateCodexAppUiClobberGuard(root);
+await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model_provider = "codex-lb"\n');
+const badProject = await evaluateCodexAppUiClobberGuard(root);
+const defaultDenied = !codexAppUiMutationAllowed({ kind: 'codex_app_ui_state', scope: 'default' });
+const repairAllowed = codexAppUiMutationAllowed({ kind: 'codex_app_ui_state', scope: 'codex-app-ui-repair', backupPath: path.join(root, 'backup.bak') });
+const ok = clean.ok && !badProject.ok && defaultDenied && repairAllowed;
+emit({ schema: 'sks.codex-app-ui-clobber-guard-check.v1', ok, clean, bad_project: badProject, default_denied: defaultDenied, repair_allowed: repairAllowed, blockers: ok ? [] : ['codex_app_ui_clobber_guard_check_failed'] });
+function emit(report) {
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=codex-app-ui-clobber-guard-check.js.map