sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/product-design-auto-install-check.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { ensureProductDesignPluginInstalledWithRequest, findProductDesignPluginSummaryFromMarketplaces, productDesignAutoInstallRequested } from '../core/product-design-app-server.js';
+import { PRODUCT_DESIGN_PLUGIN, PRODUCT_DESIGN_REQUIRED_SKILLS } from '../core/product-design-plugin.js';
+import { assertGate, emitGate, readText, releaseGateIds } from './lib/codex-sdk-gate-lib.js';
+function pluginReadResponse({ installed, enabled }) {
+    return {
+        plugin: {
+            marketplaceName: PRODUCT_DESIGN_PLUGIN.marketplace,
+            marketplacePath: null,
+            summary: {
+                id: PRODUCT_DESIGN_PLUGIN.id,
+                remotePluginId: PRODUCT_DESIGN_PLUGIN.remote_plugin_id,
+                name: PRODUCT_DESIGN_PLUGIN.name,
+                installed,
+                enabled,
+                interface: {
+                    displayName: PRODUCT_DESIGN_PLUGIN.display_name
+                }
+            },
+            skills: PRODUCT_DESIGN_REQUIRED_SKILLS.map((name) => ({ name, enabled: true }))
+        }
+    };
+}
+let installed = false;
+const installCalls = [];
+const installResult = await ensureProductDesignPluginInstalledWithRequest(async (method, params) => {
+    installCalls.push({ method, params });
+    if (method === 'plugin/read')
+        return pluginReadResponse({ installed, enabled: installed });
+    if (method === 'plugin/install') {
+        assertGate(params.pluginName === PRODUCT_DESIGN_PLUGIN.remote_plugin_id, 'plugin/install must use Product Design remote plugin id', params);
+        installed = true;
+        return { authPolicy: 'ON_USE', appsNeedingAuth: [] };
+    }
+    if (method === 'plugin/installed')
+        return { marketplaces: [], marketplaceLoadErrors: [] };
+    throw new Error(`unexpected method: ${method}`);
+}, { autoInstallProductDesign: true, env: {} });
+assertGate(installResult.ok, 'Product Design ensure must pass after fake plugin/install', installResult);
+assertGate(installResult.install_attempted === true, 'Product Design ensure must attempt install when read evidence is not ready', installResult);
+assertGate(installCalls.some((call) => call.method === 'plugin/install'), 'Product Design ensure did not call plugin/install', installCalls);
+assertGate(installResult.after_evidence.ok, 'Product Design after_evidence must be ready after install', installResult);
+installed = false;
+const dryCalls = [];
+const dryResult = await ensureProductDesignPluginInstalledWithRequest(async (method, params) => {
+    dryCalls.push({ method, params });
+    if (method === 'plugin/read')
+        return pluginReadResponse({ installed: false, enabled: false });
+    throw new Error(`unexpected dry method: ${method}`);
+}, { autoInstallProductDesign: false, env: {} });
+assertGate(!dryResult.ok, 'Product Design dry ensure must not claim ready when read evidence is not ready', dryResult);
+assertGate(dryResult.install_attempted === false, 'Product Design dry ensure must not attempt install', dryResult);
+assertGate(!dryCalls.some((call) => call.method === 'plugin/install'), 'Product Design dry ensure must not call plugin/install', dryCalls);
+const marketplaceList = {
+    marketplaces: [{
+            name: PRODUCT_DESIGN_PLUGIN.marketplace,
+            plugins: [{
+                    id: PRODUCT_DESIGN_PLUGIN.id,
+                    remotePluginId: PRODUCT_DESIGN_PLUGIN.remote_plugin_id,
+                    name: PRODUCT_DESIGN_PLUGIN.name,
+                    installed: true,
+                    enabled: true,
+                    interface: {
+                        displayName: PRODUCT_DESIGN_PLUGIN.display_name
+                    }
+                }]
+        }],
+    marketplaceLoadErrors: []
+};
+const discovered = findProductDesignPluginSummaryFromMarketplaces(marketplaceList);
+assertGate(discovered?.remotePluginId === PRODUCT_DESIGN_PLUGIN.remote_plugin_id, 'Product Design vertical plugin/list discovery must return remote id', discovered);
+let readCount = 0;
+const listCalls = [];
+const listFallbackResult = await ensureProductDesignPluginInstalledWithRequest(async (method, params) => {
+    listCalls.push({ method, params });
+    if (method === 'plugin/read') {
+        readCount += 1;
+        if (readCount === 1)
+            throw new Error('simulated stale read id');
+        return pluginReadResponse({ installed: true, enabled: true });
+    }
+    if (method === 'plugin/list')
+        return marketplaceList;
+    throw new Error(`unexpected list fallback method: ${method}`);
+}, { autoInstallProductDesign: true, env: {} });
+assertGate(listFallbackResult.ok, 'Product Design ensure must recover through vertical plugin/list discovery', listFallbackResult);
+assertGate(listFallbackResult.install_attempted === false, 'Product Design ensure must not install when list-discovered read is already ready', listFallbackResult);
+assertGate(listCalls.some((call) => call.method === 'plugin/list'), 'Product Design ensure must query vertical plugin/list when direct read fails', listCalls);
+assertGate(productDesignAutoInstallRequested({ env: { SKS_PRODUCT_DESIGN_AUTO_INSTALL: '1' } }), 'Product Design auto-install env gate must be honored');
+const codexAppSource = readText('src/core/codex-app.ts');
+const commandSource = readText('src/commands/codex-app.ts');
+const appServerSource = readText('src/core/product-design-app-server.ts');
+const pkg = JSON.parse(readText('package.json'));
+const releaseGates = releaseGateIds();
+for (const token of [
+    'ensureProductDesignPluginInstalled',
+    'PRODUCT_DESIGN_AUTO_INSTALL_ENV',
+    'autoInstallProductDesign'
+]) {
+    assertGate(codexAppSource.includes(token) || appServerSource.includes(token), `Product Design auto-install source missing token: ${token}`);
+}
+for (const token of [
+    'product-design',
+    'ensure-product-design',
+    '--check-only',
+    '--install-product-design'
+]) {
+    assertGate(commandSource.includes(token), `sks codex-app command missing Product Design token: ${token}`);
+}
+assertGate(Boolean(pkg.scripts?.['codex:product-design-auto-install']), 'package script missing codex:product-design-auto-install');
+assertGate(releaseGates.has('codex:product-design-auto-install'), 'release gate DAG must include Product Design auto-install gate');
+emitGate('codex:product-design-auto-install', {
+    install_calls: installCalls.map((call) => call.method),
+    dry_calls: dryCalls.map((call) => call.method),
+    list_fallback_calls: listCalls.map((call) => call.method),
+    env_gate: true
+});
+//# sourceMappingURL=product-design-auto-install-check.js.map

package/dist/scripts/product-design-plugin-routing-check.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { PRODUCT_DESIGN_PIPELINE_STAGES, PRODUCT_DESIGN_PLUGIN, PRODUCT_DESIGN_REQUIRED_SKILLS, normalizeProductDesignPluginEvidence, productDesignPluginVisibilityFromCodexPluginList } from '../core/product-design-plugin.js';
+import { assertGate, emitGate, readText, releaseGateIds } from './lib/codex-sdk-gate-lib.js';
+const routesSource = readText('src/core/routes.ts');
+const productDesignSource = readText('src/core/product-design-plugin.ts');
+const runtimeSource = readText('src/core/pipeline-internals/runtime-core.ts');
+const pptSource = readText('src/core/ppt.ts');
+const codexAppSource = readText('src/core/codex-app.ts');
+const initSource = readText('src/core/init.ts');
+const pkg = JSON.parse(readText('package.json'));
+const releaseGates = releaseGateIds();
+assertGate(PRODUCT_DESIGN_PLUGIN.id === 'product-design@openai-curated-remote', 'Product Design plugin id must use the remote marketplace');
+assertGate(PRODUCT_DESIGN_PLUGIN.marketplace === 'openai-curated-remote', 'Product Design marketplace must be openai-curated-remote');
+assertGate(PRODUCT_DESIGN_PLUGIN.marketplace_kind === 'vertical', 'Product Design marketplace kind must be vertical');
+assertGate(PRODUCT_DESIGN_PLUGIN.remote_plugin_id === 'Plugin_fa77aec24fc08191bc6e57f377126d76', 'Product Design remote plugin id mismatch');
+assertGate(PRODUCT_DESIGN_PLUGIN.app_server.read_params.remoteMarketplaceName === 'openai-curated-remote', 'plugin/read remote marketplace missing');
+assertGate(PRODUCT_DESIGN_PLUGIN.app_server.install_params.remoteMarketplaceName === 'openai-curated-remote', 'plugin/install remote marketplace missing');
+assertGate(PRODUCT_DESIGN_PLUGIN.app_server.read_params.pluginName === PRODUCT_DESIGN_PLUGIN.remote_plugin_id, 'plugin/read must use Product Design remote plugin id');
+assertGate(PRODUCT_DESIGN_PLUGIN.app_server.install_params.pluginName === PRODUCT_DESIGN_PLUGIN.remote_plugin_id, 'plugin/install must use Product Design remote plugin id');
+assertGate(PRODUCT_DESIGN_PLUGIN.app_server.list_params.marketplaceKinds.includes('vertical'), 'plugin/list must query vertical marketplaces');
+for (const skill of ['audit', 'design-qa', 'get-context', 'ideate', 'image-to-code', 'prototype', 'research', 'share', 'url-to-code', 'user-context']) {
+    assertGate(PRODUCT_DESIGN_REQUIRED_SKILLS.includes(skill), `Product Design required skill missing: ${skill}`);
+}
+assertGate(PRODUCT_DESIGN_PIPELINE_STAGES.length >= 5, 'Product Design pipeline stage map too small');
+const fakeReadResponse = {
+    plugin: {
+        marketplaceName: PRODUCT_DESIGN_PLUGIN.marketplace,
+        summary: {
+            id: PRODUCT_DESIGN_PLUGIN.id,
+            remotePluginId: PRODUCT_DESIGN_PLUGIN.remote_plugin_id,
+            name: PRODUCT_DESIGN_PLUGIN.name,
+            installed: true,
+            enabled: true
+        },
+        skills: PRODUCT_DESIGN_REQUIRED_SKILLS.map((name) => ({ name, enabled: true }))
+    }
+};
+const evidence = normalizeProductDesignPluginEvidence(fakeReadResponse);
+assertGate(evidence.ok, 'app-server plugin/read evidence parser must accept ready Product Design response', evidence);
+const hiddenFromLocalList = productDesignPluginVisibilityFromCodexPluginList({ installed: [{ id: 'browser@openai-bundled' }] });
+assertGate(hiddenFromLocalList.requires_remote_vertical_lookup, 'missing local plugin-list entry must require remote vertical lookup');
+for (const token of [
+    'productDesignPluginPolicyText',
+    'Product Design plugin tools are allowed and preferred',
+    'project-local cache/compatibility authority',
+    'PRODUCT_DESIGN_PLUGIN_TOOL_ALLOWLIST'
+]) {
+    assertGate(routesSource.includes(token), `routes.ts missing Product Design routing token: ${token}`);
+}
+const recommendedSkillsBlock = routesSource.match(/export const RECOMMENDED_SKILLS = \[([\s\S]*?)\];/)?.[1] || '';
+for (const legacySkill of ['design-artifact-expert', 'design-system-builder', 'design-ui-editor']) {
+    assertGate(!recommendedSkillsBlock.includes(legacySkill), `legacy design skill should not stay in RECOMMENDED_SKILLS: ${legacySkill}`);
+}
+for (const token of [
+    'Product Design plugin policy',
+    'openai-curated-remote',
+    'plugin/read',
+    'plugin/install',
+    'auto-install/ensure',
+    'vertical',
+    'compatibility fallback only',
+    'PRODUCT_DESIGN_LEGACY_DESIGN_FALLBACK_SKILLS'
+]) {
+    assertGate(productDesignSource.includes(token), `product-design-plugin.ts missing policy token: ${token}`);
+}
+for (const token of [
+    'Product Design plugin first',
+    'design-system-builder',
+    'design-ui-editor',
+    'design-artifact-expert'
+]) {
+    assertGate(runtimeSource.includes(token) || initSource.includes(token), `runtime/init missing fallback token: ${token}`);
+}
+for (const token of [
+    'product_design_plugin',
+    'primary_design_plugin',
+    'legacy_design_skills_fallback_only',
+    'remote_plugin_id'
+]) {
+    assertGate(pptSource.includes(token), `ppt.ts missing Product Design evidence token: ${token}`);
+}
+for (const token of [
+    'codexProductDesignPluginStatus',
+    'design_product',
+    'ensureProductDesignPluginInstalled',
+    'product_design_remote_vertical_lookup_required',
+    'remote vertical marketplace plugin'
+]) {
+    assertGate(codexAppSource.includes(token), `codex-app.ts missing Product Design readiness token: ${token}`);
+}
+assertGate(Boolean(pkg.scripts?.['codex:product-design-plugin-routing']), 'package script missing codex:product-design-plugin-routing');
+assertGate(releaseGates.has('codex:product-design-plugin-routing'), 'release gate DAG must include Product Design routing gate');
+emitGate('codex:product-design-plugin-routing', {
+    plugin_id: PRODUCT_DESIGN_PLUGIN.id,
+    remote_plugin_id: PRODUCT_DESIGN_PLUGIN.remote_plugin_id,
+    required_skills: PRODUCT_DESIGN_REQUIRED_SKILLS.length,
+    stages: PRODUCT_DESIGN_PIPELINE_STAGES.length,
+    local_list_hidden_requires_remote_lookup: hiddenFromLocalList.requires_remote_vertical_lookup
+});
+//# sourceMappingURL=product-design-plugin-routing-check.js.map

package/dist/scripts/project-skill-dedupe-blackbox.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { assertGate, emitGate, makeTempRoot, writeManagedCoreSkill, writeUserSkill } from './sks-3-1-8-check-lib.js';
+import { dedupeProjectSkills } from '../core/codex-native/project-skill-dedupe.js';
+import { syncCodexSksSkills, withSkillSyncLock } from '../core/codex-app/codex-skill-sync.js';
+import { buildSkillRegistryLedger } from '../core/codex-native/skill-registry-ledger.js';
+const root = await makeTempRoot('sks-skill-dedupe-blackbox-');
+process.env.CODEX_HOME = path.join(root, 'codex-home');
+await writeManagedCoreSkill(root, '.agents/skills', 'loop');
+await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const scenarioA = await dedupeProjectSkills({ root, fix: true, yes: true });
+await writeUserSkill(root, '.agents/skills', 'user-loop', 'loop');
+await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const scenarioB = await dedupeProjectSkills({ root, fix: true, yes: true });
+await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Loop');
+await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'loop');
+const scenarioC = await dedupeProjectSkills({ root, fix: true, yes: false });
+const scenarioD = await dedupeProjectSkills({ root, fix: true, yes: true, quarantineUserDuplicates: true });
+const staleRoot = await makeTempRoot('sks-skill-stale-lock-');
+const lockPath = path.join(staleRoot, '.sneakoscope', 'locks', 'skill-sync.lock');
+await fs.mkdir(lockPath, { recursive: true });
+await fs.writeFile(path.join(lockPath, 'owner.json'), JSON.stringify({ schema: 'sks.skill-sync-lock.v1', pid: 999999, acquired_at: '1970-01-01T00:00:00.000Z', stale_after_ms: 1 }), 'utf8');
+await withSkillSyncLock(staleRoot, async () => undefined);
+const concurrentRoot = await makeTempRoot('sks-skill-concurrent-');
+process.env.CODEX_HOME = path.join(concurrentRoot, 'codex-home');
+const skillsRoot = path.join(process.env.CODEX_HOME, 'skills');
+await Promise.all(Array.from({ length: 20 }, () => syncCodexSksSkills({ root: concurrentRoot, apply: true, skillsRoot })));
+const concurrentLedger = await buildSkillRegistryLedger({ root: concurrentRoot });
+assertGate(scenarioA.actions.some((action) => action.action === 'quarantined'), 'scenario A must quarantine SKS-managed duplicate', scenarioA);
+assertGate(scenarioB.actions.some((action) => action.reason.includes('user-authored skill preserved')), 'scenario B must preserve user-authored skill', scenarioB);
+assertGate(scenarioC.blockers.some((blocker) => blocker.includes('user_duplicate_requires_confirmation')), 'scenario C must not auto-delete user-authored duplicates', scenarioC);
+assertGate(scenarioD.active_unique_by_canonical_name === true, 'scenario D must quarantine confirmed user-authored duplicate', scenarioD);
+assertGate(concurrentLedger.active_unique_by_canonical_name === true, 'scenario F must keep exactly one active canonical name after concurrent sync', concurrentLedger);
+emitGate('skill:dedupe-blackbox');
+//# sourceMappingURL=project-skill-dedupe-blackbox.js.map

package/dist/scripts/project-skill-dedupe-check.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeManagedCoreSkill } from './sks-3-1-8-check-lib.js';
+import { dedupeProjectSkills } from '../core/codex-native/project-skill-dedupe.js';
+const root = await makeTempRoot('sks-skill-dedupe-');
+process.env.CODEX_HOME = path.join(root, 'codex-home');
+await writeManagedCoreSkill(root, '.agents/skills', 'loop');
+await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const report = await dedupeProjectSkills({ root, fix: true, yes: true });
+const agentsSkill = await fs.stat(path.join(root, '.agents', 'skills', 'loop', 'SKILL.md')).then(() => true, () => false);
+const codexSkill = await fs.stat(path.join(root, '.codex', 'skills', 'loop', 'SKILL.md')).then(() => true, () => false);
+assertGate(report.actions.some((action) => action.action === 'quarantined'), 'managed duplicate skill must be quarantined under --fix', report);
+assertGate([agentsSkill, codexSkill].filter(Boolean).length === 1, 'exactly one managed duplicate should remain active', { agentsSkill, codexSkill });
+emitGate('skill:dedupe', { actions: report.actions.length });
+//# sourceMappingURL=project-skill-dedupe-check.js.map

package/dist/scripts/prompt-placeholder-guard-check.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const guardMod = await importDist('core/prompt/prompt-placeholder-guard.js');
+const blocked = guardMod.checkPromptPlaceholders({
+    prompt: 'Use @filename and INSERT_PATH_HERE to patch the bug',
+    writeCapable: true,
+    targetPaths: ['src/core/example.ts']
+});
+const emptyTarget = guardMod.checkPromptPlaceholders({
+    prompt: 'Patch the bug',
+    writeCapable: true,
+    targetPaths: []
+});
+const pass = guardMod.checkPromptPlaceholders({
+    prompt: 'Patch src/core/example.ts',
+    writeCapable: true,
+    targetPaths: ['src/core/example.ts']
+});
+const readonlyWarn = guardMod.checkPromptPlaceholders({
+    prompt: 'Inspect @filename',
+    writeCapable: false
+});
+assertGate(blocked.ok === false && blocked.blockers.some((item) => String(item).startsWith('unresolved_prompt_placeholder')), 'write-capable Naruto prompt with @filename must block', blocked);
+assertGate(emptyTarget.ok === false && emptyTarget.blockers.includes('write_capable_prompt_target_paths_empty'), 'write-capable Naruto route with empty target paths must block', emptyTarget);
+assertGate(pass.ok === true, 'resolved write-capable prompt must pass placeholder guard', pass);
+assertGate(readonlyWarn.ok === true && readonlyWarn.warnings.length > 0, 'read-only route may warn on placeholders instead of blocking', readonlyWarn);
+emitGate('prompt:placeholder-guard', {
+    blocked_placeholders: blocked.placeholders,
+    empty_target_blockers: emptyTarget.blockers,
+    readonly_warnings: readonlyWarn.warnings
+});
+//# sourceMappingURL=prompt-placeholder-guard-check.js.map

package/dist/scripts/proof-root-cause-policy-check.js

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { writeRouteCompletionProof } from '../core/proof/route-adapter.js';
+import { finalizeRouteWithProof } from '../core/proof/route-finalizer.js';
+import { validateRouteCompletionProof } from '../core/proof/route-proof-gate.js';
+import { buildRouteCompletionContract } from '../core/trust-kernel/route-contract.js';
+import { validateCompletionContract } from '../core/trust-kernel/completion-contract.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-root-cause-policy-'));
+await writeRouteCompletionProof(root, {
+    missionId: 'M-root-cause-missing',
+    route: '$Wiki',
+    status: 'verified_partial',
+    unverified: ['fallback path was used without RCA']
+});
+const missingGate = await validateRouteCompletionProof(root, {
+    missionId: 'M-root-cause-missing',
+    route: '$Wiki'
+});
+assert.equal(missingGate.ok, false);
+assert.ok(missingGate.issues.includes('root_cause_analysis_missing'));
+const fixed = await writeRouteCompletionProof(root, {
+    missionId: 'M-root-cause-complete',
+    route: '$Wiki',
+    status: 'verified_partial',
+    unverified: ['fallback path was used, root cause corrected below'],
+    failureAnalysis: {
+        status: 'complete',
+        root_cause: 'The fallback branch stayed reachable after route validation issues because completion proof did not require RCA.',
+        corrective_action: 'Completion proof and trust contract now require failure analysis before problem-bearing routes can pass.',
+        evidence: ['src/core/proof/root-cause-policy.ts', 'src/core/proof/route-proof-gate.ts']
+    }
+});
+const fixedGate = await validateRouteCompletionProof(root, {
+    missionId: 'M-root-cause-complete',
+    route: '$Wiki'
+});
+assert.equal(fixedGate.ok, true);
+const contract = buildRouteCompletionContract(fixed.proof, { records: [] });
+const contractValidation = validateCompletionContract(contract, fixed.proof, { records: [] });
+assert.equal(contractValidation.ok, true);
+await fs.mkdir(path.join(root, '.sneakoscope', 'missions', 'M-root-cause-finalizer'), { recursive: true });
+await fs.writeFile(path.join(root, '.sneakoscope', 'missions', 'M-root-cause-finalizer', 'wiki-gate.json'), JSON.stringify({ schema_version: 1, ok: true, passed: true }, null, 2));
+await finalizeRouteWithProof(root, {
+    missionId: 'M-root-cause-finalizer',
+    route: '$Wiki',
+    gateFile: 'wiki-gate.json',
+    statusHint: 'verified_partial',
+    unverified: ['verified_partial route finalization requires RCA'],
+    failureAnalysis: {
+        status: 'complete',
+        root_cause: 'The route finalizer previously had no explicit pass-through for route-level failure analysis.',
+        corrective_action: 'The route finalizer now forwards failureAnalysis to the completion proof writer.',
+        evidence: ['src/core/proof/route-finalizer.ts', 'src/core/proof/auto-finalize.ts']
+    }
+});
+const finalizerGate = await validateRouteCompletionProof(root, {
+    missionId: 'M-root-cause-finalizer',
+    route: '$Wiki'
+});
+assert.equal(finalizerGate.ok, true);
+console.log(JSON.stringify({
+    ok: true,
+    missing_gate_issues: missingGate.issues,
+    fixed_gate_status: fixedGate.status,
+    contract_status: contractValidation.status,
+    finalizer_gate_status: finalizerGate.status
+}));
+//# sourceMappingURL=proof-root-cause-policy-check.js.map

package/dist/scripts/provider-badge-context-check.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { providerBadgeText } from '../core/provider/provider-badge.js';
+import { resolveProviderContext } from '../core/provider/provider-context.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-provider-context-'));
+const codexHome = path.join(root, '.codex-home');
+await fs.mkdir(codexHome, { recursive: true });
+await fs.writeFile(path.join(codexHome, 'auth.json'), '{"account_id":"acct_fixture"}\n');
+const openai = await resolveProviderContext({ root, codexHome, env: { OPENAI_API_KEY: 'sk-fixture', HOME: root }, route: '$Agent', serviceTier: 'fast' });
+const lb = await resolveProviderContext({ root, codexHome, env: { CODEX_LB_API_KEY: 'lb-fixture', SKS_PROVIDER: 'codex-lb', HOME: root }, route: '$Naruto', serviceTier: 'fast' });
+const app = await resolveProviderContext({ root, codexHome, env: { HOME: root }, route: '$Agent', serviceTier: 'standard' });
+const conflict = await resolveProviderContext({ root, codexHome, env: { OPENAI_API_KEY: 'sk-fixture', CODEX_LB_API_KEY: 'lb-fixture', HOME: root } });
+const ok = openai.provider === 'openai'
+    && lb.provider === 'codex-lb'
+    && app.provider === 'codex-app'
+    && conflict.conflict
+    && providerBadgeText(lb) === 'Provider: codex-lb · Fast';
+emit({ schema: 'sks.provider-badge-context-check.v1', ok, openai, lb, app, conflict, blockers: ok ? [] : ['provider_badge_context_check_failed'] });
+function emit(report) {
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=provider-badge-context-check.js.map

package/dist/scripts/provider-context-config-toml-check.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { resolveProviderContext } from '../core/provider/provider-context.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-provider-context-'));
+const codexHome = path.join(root, '.codex');
+await fs.mkdir(codexHome, { recursive: true });
+const codexLbConfig = [
+    'model_provider = "codex-lb"',
+    '',
+    '[model_providers.codex-lb]',
+    'name = "OpenAI"',
+    'base_url = "https://lb.example.test"',
+    'wire_api = "responses"',
+    'env_key = "CODEX_LB_API_KEY"',
+    'requires_openai_auth = false',
+    ''
+].join('\n');
+await fs.writeFile(path.join(codexHome, 'config.toml'), codexLbConfig);
+const configOnlyLb = await resolveProviderContext({
+    root,
+    codexHome,
+    env: { HOME: root, CODEX_LB_API_KEY: 'lb-fixture' },
+    route: '$Naruto',
+    serviceTier: 'fast'
+});
+await fs.writeFile(path.join(codexHome, 'config.toml'), codexLbConfig.replace('model_provider = "codex-lb"', 'model_provider = "openai"'));
+const openaiSelected = await resolveProviderContext({
+    root,
+    codexHome,
+    env: { HOME: root, OPENAI_API_KEY: 'sk-fixture', CODEX_LB_API_KEY: 'lb-fixture' },
+    route: '$Doctor',
+    serviceTier: 'fast'
+});
+await fs.writeFile(path.join(codexHome, 'config.toml'), 'model_provider = "codex-lb"\n');
+const malformed = await resolveProviderContext({
+    root,
+    codexHome,
+    env: { HOME: root },
+    route: '$Agent',
+    serviceTier: 'standard'
+});
+const checks = {
+    config_only_codex_lb: configOnlyLb.provider === 'codex-lb' && configOnlyLb.confidence === 'high' && configOnlyLb.source === 'config',
+    config_env_key_recorded: configOnlyLb.signals.codex_lb_env_key === 'CODEX_LB_API_KEY',
+    openai_selected_with_lb_available: openaiSelected.provider === 'openai' && openaiSelected.signals.codex_lb_available === true,
+    malformed_unknown: malformed.provider === 'unknown' && malformed.warnings.includes('codex_lb_provider_config_missing_or_invalid')
+};
+const ok = Object.values(checks).every(Boolean);
+emit({
+    schema: 'sks.provider-context-config-toml-check.v1',
+    ok,
+    checks,
+    cases: { configOnlyLb, openaiSelected, malformed },
+    blockers: ok ? [] : Object.entries(checks).filter(([, passed]) => !passed).map(([name]) => name)
+});
+function emit(report) {
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=provider-context-config-toml-check.js.map

package/dist/scripts/python-codex-sdk-all-pipelines-check.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+import { importDist, root } from './lib/codex-sdk-gate-lib.js';
+const plane = readText('src/core/codex-control/codex-control-plane.ts');
+const adapter = readText('src/core/codex-control/python-codex-sdk-adapter.ts');
+assertGate(plane.includes("'python-codex-sdk'"), 'Codex Control backend union must include python-codex-sdk');
+assertGate(adapter.includes('runPythonCodexSdkTask'), 'Python SDK adapter must expose a task runner');
+const mod = await importDist('core/codex-control/codex-control-plane.js');
+const schema = await importDist('core/codex-control/schemas/agent-worker-result.schema.js');
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-python-codex-sdk-pipeline-'));
+const oldFake = process.env.SKS_PYTHON_CODEX_SDK_FAKE;
+process.env.SKS_PYTHON_CODEX_SDK_FAKE = '1';
+try {
+    const result = await mod.runCodexTask({
+        route: '$Agent',
+        missionId: 'M-python-sdk-all-pipelines',
+        workItemId: 'python-sdk-fixture',
+        slotId: 'slot-python-fixture',
+        generationIndex: 1,
+        sessionId: 'python-sdk-fixture-session',
+        cwd: root,
+        prompt: 'Hermetic Python Codex SDK backend fixture.',
+        inputFiles: [],
+        inputImages: [],
+        outputSchemaId: schema.CODEX_AGENT_WORKER_RESULT_SCHEMA_ID,
+        outputSchema: schema.codexAgentWorkerResultSchema,
+        sandboxPolicy: 'read-only',
+        requestedScopeContract: { id: 'python-sdk-fixture', read_only: true, allowed_paths: [], write_paths: [] },
+        backendPreference: ['python-codex-sdk'],
+        mutationLedgerRoot: tmp
+    });
+    assertGate(result.ok === true, 'Python SDK backend fixture must pass', result);
+    assertGate(result.backend === 'python-codex-sdk', 'Python SDK backend fixture must select python-codex-sdk', result);
+    assertGate(result.pythonSdkProofPath && result.streamEventCount > 0, 'Python SDK backend fixture must write proof and events', result);
+    emitGate('python-sdk:all-pipelines', { backend: result.backend, backend_family: result.backend_family, stream_event_count: result.streamEventCount });
+}
+finally {
+    if (oldFake === undefined)
+        delete process.env.SKS_PYTHON_CODEX_SDK_FAKE;
+    else
+        process.env.SKS_PYTHON_CODEX_SDK_FAKE = oldFake;
+}
+//# sourceMappingURL=python-codex-sdk-all-pipelines-check.js.map

package/dist/scripts/python-codex-sdk-capability-check.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const mod = await importDist('core/codex-control/python-codex-sdk-adapter.js');
+const cap = await mod.detectPythonCodexSdkCapability();
+assertGate(['codex-app-server', 'openai-codex', 'openai-codex-sdk'].includes(cap.package_name), 'Python Codex SDK package name mismatch');
+assertGate(cap.ok === true || cap.blockers.includes('python_codex_sdk_unavailable') || cap.blockers.includes('python_missing') || cap.blockers.includes('python_version_below_3_10'), 'Python SDK unavailable must be a capability blocker');
+const requireReal = process.env.SKS_REQUIRE_PYTHON_CODEX_SDK === '1' || process.argv.includes('--require-real');
+if (requireReal && !cap.ok) {
+    console.log(JSON.stringify({
+        schema: 'sks.release-gate.v1',
+        ok: false,
+        gate: 'python-sdk:real-smoke',
+        capability_ok: cap.ok,
+        capability_blockers: cap.blockers,
+        setup_action: cap.setup_action,
+        python_bin: cap.python_bin,
+        python_version: cap.python_version,
+        blockers: cap.blockers
+    }, null, 2));
+    process.exit(1);
+}
+if (requireReal) {
+    const plane = await importDist('core/codex-control/codex-control-plane.js');
+    const smokeSchema = {
+        type: 'object',
+        required: ['status', 'summary', 'blockers'],
+        properties: {
+            status: { type: 'string', enum: ['done'] },
+            summary: { type: 'string' },
+            blockers: { type: 'array', items: { type: 'string' } }
+        },
+        additionalProperties: false
+    };
+    const result = await plane.runCodexTask({
+        route: '$Agent',
+        missionId: 'M-python-codex-sdk-real-smoke',
+        workItemId: 'python-real-smoke',
+        slotId: 'slot-python-real',
+        generationIndex: 1,
+        sessionId: 'python-real-smoke-session',
+        cwd: process.cwd(),
+        prompt: 'Read-only Python Codex SDK smoke. Do not edit files. Return exactly JSON: {"status":"done","summary":"python-codex-sdk real smoke passed","blockers":[]}',
+        inputFiles: [],
+        inputImages: [],
+        outputSchemaId: 'sks.python-codex-sdk-real-smoke-result.v1',
+        outputSchema: smokeSchema,
+        sandboxPolicy: 'read-only',
+        requestedScopeContract: { id: 'python-real-smoke', read_only: true, allowed_paths: [], write_paths: [] },
+        backendPreference: ['python-codex-sdk'],
+        mutationLedgerRoot: '.sneakoscope/reports/python-codex-sdk-real-smoke'
+    });
+    assertGate(result.ok === true, 'real Python Codex SDK smoke failed', result);
+    emitGate('python-sdk:real-smoke', {
+        status: 'proven',
+        capability_ok: cap.ok,
+        package_name: cap.package_name,
+        import_name: cap.import_name,
+        python_bin: cap.python_bin,
+        sdk_thread_id: result.sdkThreadId,
+        stream_event_count: result.streamEventCount,
+        backend: result.backend,
+        backend_family: result.backend_family
+    });
+}
+else {
+    emitGate('python-sdk:capability', {
+        capability_ok: cap.ok,
+        capability_blockers: cap.blockers,
+        package_name: cap.package_name,
+        import_name: cap.import_name,
+        setup_action: cap.setup_action
+    });
+}
+//# sourceMappingURL=python-codex-sdk-capability-check.js.map

package/dist/scripts/python-codex-sdk-sandbox-policy-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+const adapter = readText('src/core/codex-control/python-codex-sdk-adapter.ts');
+const runner = readText('pytools/codex_sdk_runner.py');
+assertGate(adapter.includes("workspace_write"), 'TS -> Python sandbox mapping must include workspace_write');
+assertGate(adapter.includes("full_access"), 'TS -> Python sandbox mapping must include full_access');
+assertGate(runner.includes('Sandbox.workspace_write'), 'Python runner must use SDK Sandbox presets');
+emitGate('python-sdk:sandbox-policy', { sandboxes: ['read_only', 'workspace_write', 'full_access'] });
+//# sourceMappingURL=python-codex-sdk-sandbox-policy-check.js.map

package/dist/scripts/python-codex-sdk-stream-bridge-check.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const mod = await importDist('core/codex-control/python-codex-sdk-event-translator.js');
+const events = mod.translatePythonCodexSdkEvents([
+    { event: 'thread_started', thread_id: 't' },
+    { event: 'turn_completed', turn_id: 'u', status: 'completed', final_response: '{}' }
+]);
+assertGate(events.length === 2, 'Python SDK event translator must preserve stream events');
+assertGate(events[1].event_type === 'turn_completed', 'Python SDK turn completion event missing');
+emitGate('python-sdk:stream-bridge', { event_count: events.length });
+//# sourceMappingURL=python-codex-sdk-stream-bridge-check.js.map