sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/sks-3-1-6-directive-check-lib.js

@@ -0,0 +1,522 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { spawnSync } from 'node:child_process';
+export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const REQUIRED_SCRIPT_IDS = [
+    'brand-neutrality:rename-map',
+    'brand-neutrality:zero-leakage',
+    'brand-neutrality:zero-leakage-blackbox',
+    'docs:brand-neutrality',
+    'codex-native:feature-broker',
+    'codex-native:harness-compat',
+    'codex-native:invocation-defaults',
+    'codex-native:invocation-router',
+    'codex-native:route-map',
+    'pipeline:codex-native-loop-routing',
+    'pipeline:codex-native-qa-routing',
+    'pipeline:codex-native-research-routing',
+    'pipeline:codex-native-image-routing',
+    'pipeline:codex-native-doctor-mad-routing',
+    'codex-native:pattern-analysis',
+    'codex-native:reference-evidence',
+    'codex-native:pattern-analysis-blackbox',
+    'codex-native:interop-policy',
+    'codex-native:skill-content',
+    'codex-native:agent-role-content',
+    'codex-native:hook-lifecycle-proof',
+    'init-deep:backup-retention',
+    'init-deep:memory-scope-safety',
+    'release-scripts:type-safe',
+    'lint:no-ts-nocheck-release-scripts',
+    'doctor:codex-native-readiness-ux',
+    'doctor:codex-native-repair-actions',
+    'codex-native:feature-broker-blackbox',
+    'pipeline:codex-native-e2e-blackbox'
+];
+export async function runDirective316Gate(id) {
+    if (id === 'brand-neutrality:rename-map')
+        return brandRenameMap(id);
+    if (id === 'brand-neutrality:zero-leakage')
+        return brandZeroLeakage(id);
+    if (id === 'brand-neutrality:zero-leakage-blackbox')
+        return brandZeroLeakageBlackbox(id);
+    if (id === 'docs:brand-neutrality')
+        return docsBrandNeutrality(id);
+    if (id === 'codex-native:feature-broker')
+        return featureBroker(id);
+    if (id === 'codex-native:harness-compat')
+        return harnessCompat(id);
+    if (id === 'codex-native:invocation-defaults')
+        return invocationDefaults(id);
+    if (id === 'codex-native:invocation-router')
+        return invocationRouter(id);
+    if (id === 'codex-native:route-map')
+        return routeMap(id);
+    if (id.startsWith('pipeline:codex-native-'))
+        return pipelineGate(id);
+    if (id === 'codex-native:pattern-analysis')
+        return patternAnalysis(id);
+    if (id === 'codex-native:reference-evidence')
+        return referenceEvidence(id);
+    if (id === 'codex-native:pattern-analysis-blackbox')
+        return patternAnalysisBlackbox(id);
+    if (id === 'codex-native:interop-policy')
+        return interopPolicy(id);
+    if (id === 'codex-native:skill-content')
+        return skillContent(id);
+    if (id === 'codex-native:agent-role-content')
+        return agentRoleContent(id);
+    if (id === 'codex-native:hook-lifecycle-proof')
+        return hookLifecycleProof(id);
+    if (id === 'init-deep:backup-retention')
+        return initDeepBackupRetention(id);
+    if (id === 'init-deep:memory-scope-safety')
+        return initDeepMemoryScopeSafety(id);
+    if (id === 'release-scripts:type-safe')
+        return releaseScriptsTypeSafe(id);
+    if (id === 'lint:no-ts-nocheck-release-scripts')
+        return noTsNoCheckReleaseScripts(id);
+    if (id === 'doctor:codex-native-readiness-ux')
+        return doctorReadinessUx(id);
+    if (id === 'doctor:codex-native-repair-actions')
+        return doctorRepairActions(id);
+    if (id === 'codex-native:feature-broker-blackbox')
+        return featureBrokerBlackbox(id);
+    throw new Error(`unknown_gate:${id}`);
+}
+async function brandRenameMap(id) {
+    const mod = await importDist('core/codex-native/codex-native-rename-map.js');
+    const targets = mod.codexNativeRenameTargets();
+    for (const expected of [
+        'codex-native:pattern-analysis',
+        'codex-native:reference-evidence',
+        'codex-native:feature-broker',
+        'codex-native:invocation-router',
+        'sks.codex-native-feature-matrix.v1',
+        '.sneakoscope/reports/codex-native-invocation-plan.json'
+    ])
+        assertGate(targets.includes(expected), `rename target missing:${expected}`, { targets });
+    emitGate(id, { targets: targets.length });
+}
+async function brandZeroLeakage(id) {
+    const report = await scanBrandLeakage(root);
+    const out = path.join(root, '.sneakoscope', 'reports', 'brand-neutrality-zero-leakage.json');
+    await fsp.mkdir(path.dirname(out), { recursive: true });
+    await fsp.writeFile(out, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+    assertGate(report.ok, 'brand neutrality leakage detected', report);
+    emitGate(id, { scanned_files: report.scanned_files, forbidden_term_hashes: report.forbidden_term_hashes });
+}
+async function brandZeroLeakageBlackbox(id) {
+    const tmp = await tempRoot(id);
+    await fsp.mkdir(path.join(tmp, 'docs'), { recursive: true });
+    await fsp.writeFile(path.join(tmp, 'docs', 'fixture.md'), 'secret-reference-token appears here\n', 'utf8');
+    const previous = process.env.FORBIDDEN_EXTERNAL_REFERENCE_TERMS;
+    process.env.FORBIDDEN_EXTERNAL_REFERENCE_TERMS = 'secret-reference-token';
+    try {
+        const report = await scanBrandLeakage(tmp);
+        assertGate(report.ok === false && report.redacted_offenders.length === 1, 'blackbox must detect forbidden token without printing it', report);
+        assertGate(!JSON.stringify(report).includes('secret-reference-token'), 'blackbox output leaked forbidden token', report);
+    }
+    finally {
+        if (previous === undefined)
+            delete process.env.FORBIDDEN_EXTERNAL_REFERENCE_TERMS;
+        else
+            process.env.FORBIDDEN_EXTERNAL_REFERENCE_TERMS = previous;
+    }
+    emitGate(id);
+}
+async function docsBrandNeutrality(id) {
+    const report = await scanBrandLeakage(root, ['README.md', 'CHANGELOG.md', 'docs']);
+    assertGate(report.ok, 'docs contain forbidden external reference terms', report);
+    assertGate(fs.existsSync(path.join(root, 'docs', 'codex-native-patterns.md')), 'codex native patterns docs missing');
+    emitGate(id, { scanned_files: report.scanned_files });
+}
+async function featureBroker(id) {
+    const matrix = await buildFixtureMatrix(id, { hook: 'approved', agentType: 'supported' });
+    assertGate(matrix.schema === 'sks.codex-native-feature-matrix.v1', 'matrix schema mismatch', matrix);
+    assertGate(matrix.features.agent_type.ok === true, 'agent_type feature not available in fixture', matrix.features.agent_type);
+    assertGate(matrix.invocation_defaults.loop_worker_role_strategy === 'agent_type', 'loop strategy should use agent_type', matrix.invocation_defaults);
+    emitGate(id, { strategy: matrix.invocation_defaults.loop_worker_role_strategy });
+}
+async function harnessCompat(id) {
+    const previous = fakeEnv({ hook: 'approved', agentType: 'supported' });
+    try {
+        const tmp = await tempRoot(id);
+        const mod = await importDist('core/codex-app/codex-app-harness-matrix.js');
+        const matrix = await mod.buildCodexAppHarnessMatrix({ root: tmp });
+        assertGate(matrix.schema === 'sks.codex-app-harness-matrix.v1', 'compat schema mismatch', matrix);
+        assertGate(matrix.app_features.agent_type_supported === true, 'compat adapter did not expose agent_type', matrix);
+    }
+    finally {
+        restoreEnv(previous);
+    }
+    emitGate(id);
+}
+async function invocationDefaults(id) {
+    const approved = await buildFixtureMatrix(id, { hook: 'approved', agentType: 'supported' });
+    assertGate(approved.invocation_defaults.hook_evidence_policy === 'approved-only', 'approved hook must count', approved.invocation_defaults);
+    const unknown = await buildFixtureMatrix(`${id}-unknown`, { hook: 'unknown', agentType: 'unsupported' });
+    assertGate(unknown.invocation_defaults.hook_evidence_policy === 'unknown-do-not-count', 'unknown hook must not count', unknown.invocation_defaults);
+    assertGate(unknown.invocation_defaults.loop_worker_role_strategy === 'message-role', 'unsupported agent_type must fallback', unknown.invocation_defaults);
+    emitGate(id);
+}
+async function invocationRouter(id) {
+    const previous = fakeEnv({ hook: 'unknown', agentType: 'unsupported' });
+    try {
+        const tmp = await tempRoot(id);
+        const mod = await importDist('core/codex-native/codex-native-invocation-router.js');
+        const agent = await mod.resolveCodexNativeInvocationPlan({ root: tmp, missionId: 'M-router', route: '$Loop', desiredCapability: 'agent-role' });
+        const hook = await mod.resolveCodexNativeInvocationPlan({ root: tmp, missionId: 'M-router', route: '$MAD', desiredCapability: 'hook-evidence' });
+        assertGate(agent.selected_strategy === 'message-role-fallback', 'agent-role should fallback when unsupported', agent);
+        assertGate(hook.selected_strategy === 'blocked' && hook.blockers.includes('hook_approval_not_approved'), 'hook evidence must block when approval unknown', hook);
+        assertGate(fs.existsSync(path.join(tmp, '.sneakoscope', 'missions', 'M-router', 'codex-native-invocation-plan.loop.agent-role.json')), 'mission invocation artifact missing');
+    }
+    finally {
+        restoreEnv(previous);
+    }
+    emitGate(id);
+}
+async function routeMap(id) {
+    const source = readText('src/core/codex-native/codex-native-invocation-router.ts');
+    for (const token of ['$Loop', '$QA-LOOP', '$Research', '$Image', '$MAD', '$Doctor', 'hook_approval_not_approved', 'message-role-fallback']) {
+        assertGate(source.includes(token), `route map token missing:${token}`);
+    }
+    emitGate(id);
+}
+async function pipelineGate(id) {
+    if (id === 'pipeline:codex-native-loop-routing') {
+        const source = readText('src/core/loops/loop-worker-runtime.ts');
+        assertGate(source.includes('resolveCodexNativeInvocationPlan') && source.includes('SKS_CODEX_NATIVE_STRATEGY') && source.includes('codex_native_invocation_plan'), 'loop routing not wired');
+    }
+    else if (id === 'pipeline:codex-native-qa-routing') {
+        const source = readText('src/core/qa-loop.ts');
+        assertGate(source.includes('resolveQaCodexNativeInvocation') && source.includes('hook_evidence_policy') && source.includes('image_path_strategy'), 'QA routing not wired');
+    }
+    else if (id === 'pipeline:codex-native-research-routing') {
+        const source = readText('src/core/research.ts');
+        assertGate(source.includes('resolveResearchCodexNativeInvocation') && source.includes('selected_source_strategy'), 'Research routing not wired');
+    }
+    else if (id === 'pipeline:codex-native-image-routing') {
+        const source = readText('src/core/image/image-artifact-path-contract.ts');
+        assertGate(source.includes('codex_native_followup_strategy') && source.includes('resolveCodexNativeInvocationPlan'), 'Image routing not wired');
+    }
+    else if (id === 'pipeline:codex-native-doctor-mad-routing') {
+        const doctor = readText('src/commands/doctor.ts');
+        const mad = readText('src/core/commands/mad-sks-command.ts');
+        assertGate(doctor.includes('SKS Runtime Readiness') && doctor.includes('buildCodexNativeFeatureMatrix'), 'Doctor readiness not wired');
+        assertGate(mad.includes('codex-native') || doctor.includes('hook-derived evidence will not count'), 'MAD/Doctor hook evidence policy not visible');
+    }
+    else if (id === 'pipeline:codex-native-e2e-blackbox') {
+        await invocationRouter('pipeline:codex-native-e2e-blackbox/router');
+        await pipelineGate('pipeline:codex-native-loop-routing');
+        await pipelineGate('pipeline:codex-native-qa-routing');
+        await pipelineGate('pipeline:codex-native-research-routing');
+        await pipelineGate('pipeline:codex-native-image-routing');
+    }
+    emitGate(id);
+}
+async function referenceEvidence(id) {
+    const previous = fakeEnv({ hook: 'approved', agentType: 'supported' });
+    try {
+        const tmp = await tempRoot(id);
+        const sourceDir = await referenceFixture(tmp);
+        const mod = await importDist('core/codex-native/codex-native-reference-evidence.js');
+        const report = await mod.analyzeCodexNativeReferenceSource({ root: tmp, sourceDir, writeReport: true });
+        assertGate(report.schema === 'sks.codex-native-reference-evidence.v1' && report.evidence.length >= 4, 'reference evidence report incomplete', report);
+        assertGate(!JSON.stringify(report).includes('secret-reference-token'), 'reference evidence should store hashes only', report);
+    }
+    finally {
+        restoreEnv(previous);
+    }
+    emitGate(id);
+}
+async function patternAnalysis(id) {
+    const tmp = await tempRoot(id);
+    const sourceDir = await referenceFixture(tmp);
+    const mod = await importDist('core/codex-native/codex-native-pattern-analysis.js');
+    const report = await mod.writeCodexNativePatternAnalysis(tmp, { sourceDir });
+    assertGate(report.schema === 'sks.codex-native-pattern-analysis.v1' && report.patterns.length >= 12, 'pattern analysis incomplete', report);
+    emitGate(id, { patterns: report.patterns.length });
+}
+async function patternAnalysisBlackbox(id) {
+    await patternAnalysis(id);
+    await brandZeroLeakage('brand-neutrality:zero-leakage');
+    emitGate(id);
+}
+async function interopPolicy(id) {
+    assertGate(readText('src/core/codex-native/codex-native-feature-broker.ts').includes('external route assets') === false, 'broker should not expose interop branding text');
+    emitGate(id);
+}
+async function skillContent(id) {
+    const tmp = await tempRoot(id);
+    const mod = await importDist('core/codex-app/codex-skill-sync.js');
+    const skillsRoot = path.join(tmp, 'skills');
+    const report = await mod.syncCodexSksSkills({ root: tmp, skillsRoot, apply: true });
+    const skill = fs.readFileSync(path.join(skillsRoot, 'loop', 'SKILL.md'), 'utf8');
+    assertGate(skill.includes('Purpose:') && skill.includes('Route:') && skill.includes('Proof paths:') && skill.includes('Failure recovery:'), 'managed skill content incomplete', { skill, report });
+    assertGate(report.interop.clobbered_user_skills === false, 'skill sync clobbered user skills', report);
+    emitGate(id);
+}
+async function agentRoleContent(id) {
+    const previous = fakeEnv({ hook: 'approved', agentType: 'supported' });
+    try {
+        const tmp = await tempRoot(id);
+        const mod = await importDist('core/codex-app/codex-agent-role-sync.js');
+        const report = await mod.syncCodexAgentRoles({ root: tmp, codexHome: path.join(tmp, 'codex-home'), apply: true });
+        const role = fs.readFileSync(path.join(tmp, 'codex-home', 'agents', 'sks-implementer.toml'), 'utf8');
+        assertGate(role.includes('Bounded ownership') && role.includes('Maker/checker separation') && role.includes('Required proof artifacts'), 'agent role content incomplete', { role, report });
+    }
+    finally {
+        restoreEnv(previous);
+    }
+    emitGate(id);
+}
+async function hookLifecycleProof(id) {
+    const previous = fakeEnv({ hook: 'unknown', agentType: 'supported' });
+    try {
+        const tmp = await tempRoot(id);
+        const mod = await importDist('core/codex-app/codex-hook-lifecycle.js');
+        const report = await mod.buildCodexHookLifecycle({ root: tmp });
+        const events = Object.values(report.lifecycle || {});
+        assertGate(events.every((event) => event.counted_as_evidence === false), 'unknown hooks must not count as evidence', report);
+    }
+    finally {
+        restoreEnv(previous);
+    }
+    emitGate(id);
+}
+async function initDeepBackupRetention(id) {
+    const tmp = await tempRoot(id);
+    await fsp.mkdir(path.join(tmp, 'src/core/zellij'), { recursive: true });
+    await fsp.writeFile(path.join(tmp, 'src/core/zellij', 'AGENTS.md'), '# User local guidance\nKeep me.\n', 'utf8');
+    for (let index = 0; index < 18; index += 1)
+        await fsp.writeFile(path.join(tmp, 'src/core/zellij', `f${index}.ts`), 'export {}\n', 'utf8');
+    const previous = process.env.SKS_INIT_DEEP_BACKUP_RETENTION;
+    process.env.SKS_INIT_DEEP_BACKUP_RETENTION = '1';
+    try {
+        const mod = await importDist('core/codex-app/codex-init-deep.js');
+        const first = await mod.runCodexInitDeep({ root: tmp, apply: true, directoryLocal: true });
+        const second = await mod.runCodexInitDeep({ root: tmp, apply: true, directoryLocal: true });
+        assertGate(first.directory_local_agents.changed_only_backup === true, 'changed-only backup flag missing', first);
+        assertGate(second.directory_local_agents.unchanged_files.length >= 1, 'unchanged second run should not create backup', second);
+    }
+    finally {
+        if (previous === undefined)
+            delete process.env.SKS_INIT_DEEP_BACKUP_RETENTION;
+        else
+            process.env.SKS_INIT_DEEP_BACKUP_RETENTION = previous;
+    }
+    emitGate(id);
+}
+async function initDeepMemoryScopeSafety(id) {
+    const planner = readText('src/core/loops/loop-planner.ts');
+    const owner = readText('src/core/loops/loop-owner-inference.ts');
+    assertGate(planner.includes('memory_did_not_expand_scope') && planner.includes('memory_hints_used'), 'loop planner must prove memory scope safety');
+    assertGate(owner.includes('memoryHintMayExpandOwnerScope'), 'owner inference must expose memory scope safety contract');
+    emitGate(id);
+}
+async function releaseScriptsTypeSafe(id) {
+    for (const rel of ['src/scripts/release-dag-full-coverage-check.ts', 'src/scripts/sks-3-1-5-directive-check-lib.ts', 'src/scripts/sks-3-1-6-directive-check-lib.ts', 'src/scripts/sks-3-1-7-directive-check-lib.ts']) {
+        const text = readText(rel);
+        assertGate(!/^\s*\/\/\s*@ts-nocheck\b/m.test(text), `release helper still has ts-nocheck:${rel}`);
+    }
+    assertGate(readText('src/scripts/release-dag-full-coverage-check.ts').includes('interface ReleaseGate'), 'release DAG helper missing typed interfaces');
+    assertGate(readText('src/scripts/sks-3-1-6-directive-check-lib.ts').includes('interface PackageJsonShape'), '3.1.6 helper missing typed package shape');
+    emitGate(id);
+}
+async function noTsNoCheckReleaseScripts(id) {
+    const offenders = [];
+    const checked = listFiles(path.join(root, 'src/scripts')).filter((file) => {
+        const rel = path.relative(root, file).split(path.sep).join('/');
+        return /^src\/scripts\/release-dag-full-coverage-check\.ts$/.test(rel)
+            || /^src\/scripts\/sks-3-1-[567]-directive-check-lib\.ts$/.test(rel)
+            || /^src\/scripts\/no-ts-nocheck-release-scripts-check\.ts$/.test(rel)
+            || /^src\/scripts\/release-script-type-safety-check\.ts$/.test(rel);
+    });
+    for (const file of checked) {
+        if (/^\s*\/\/\s*@ts-nocheck\b/m.test(fs.readFileSync(file, 'utf8')))
+            offenders.push(path.relative(root, file));
+    }
+    assertGate(offenders.length === 0, 'release script ts-nocheck offenders found', { offenders, checked: checked.length });
+    emitGate(id, { checked: checked.length });
+}
+async function doctorReadinessUx(id) {
+    const source = readText('src/commands/doctor.ts');
+    for (const token of ['SKS Runtime Readiness', 'Codex Native:', 'Loop Mesh:', 'QA Visual:', 'Research Sources:', 'hook-derived evidence will not count', 'message-role fallback active']) {
+        assertGate(source.includes(token), `doctor readiness token missing:${token}`);
+    }
+    emitGate(id);
+}
+async function doctorRepairActions(id) {
+    const source = readText('src/commands/doctor.ts');
+    for (const token of ['sks doctor --fix --yes', 'sks doctor --fix --repair-codex-native --yes', 'sks codex-native init-deep --apply --directory-local']) {
+        assertGate(source.includes(token), `doctor repair action missing:${token}`);
+    }
+    emitGate(id);
+}
+async function featureBrokerBlackbox(id) {
+    const all = await buildFixtureMatrix(`${id}-all`, { hook: 'approved', agentType: 'supported' });
+    assertGate(all.invocation_defaults.loop_worker_role_strategy === 'agent_type', 'all-ready scenario should use agent_type', all);
+    const unknownHook = await buildFixtureMatrix(`${id}-hook`, { hook: 'unknown', agentType: 'supported' });
+    assertGate(unknownHook.invocation_defaults.hook_evidence_policy === 'unknown-do-not-count', 'unknown hook scenario should not count', unknownHook);
+    const noAgent = await buildFixtureMatrix(`${id}-agent`, { hook: 'approved', agentType: 'unsupported' });
+    assertGate(noAgent.invocation_defaults.loop_worker_role_strategy === 'message-role', 'agent unsupported scenario should fallback', noAgent);
+    emitGate(id);
+}
+async function buildFixtureMatrix(id, opts) {
+    const previous = fakeEnv({ hook: opts.hook, agentType: opts.agentType });
+    try {
+        const tmp = await tempRoot(id);
+        const mod = await importDist('core/codex-native/codex-native-feature-broker.js');
+        return await mod.buildCodexNativeFeatureMatrix({ root: tmp });
+    }
+    finally {
+        restoreEnv(previous);
+    }
+}
+async function referenceFixture(tmp) {
+    const dir = path.join(tmp, 'reference-source');
+    await fsp.mkdir(dir, { recursive: true });
+    await fsp.writeFile(path.join(dir, 'README.md'), [
+        'Use npx for optional no-global setup.',
+        'Codex plugin lifecycle keeps install and approval separate.',
+        'Hook approval requires startup review before evidence counts.',
+        '$Loop and $Research are command picker route bridges.',
+        'spawn_agent uses agent_type when present and message-role fallback otherwise.',
+        'Directory-local AGENTS.md memory is guidance only.',
+        'Plan work proof separation keeps long tasks resumable.',
+        'Doctor readiness matrix lists MCP server candidates and non-clobber managed assets.'
+    ].join('\n'), 'utf8');
+    return dir;
+}
+async function scanBrandLeakage(base, customTargets) {
+    const terms = forbiddenTerms();
+    const targets = customTargets || ['src/core', 'src/scripts', 'docs', 'README.md', 'CHANGELOG.md', 'package.json', 'release-gates.v2.json', 'schemas'];
+    const files = targets.flatMap((target) => {
+        const full = path.join(base, target);
+        if (!fs.existsSync(full))
+            return [];
+        return fs.statSync(full).isDirectory() ? listFiles(full) : [full];
+    }).filter((file) => !/\/(?:node_modules|dist|\.git)\//.test(file));
+    const offenders = [];
+    for (const file of files) {
+        const text = fs.readFileSync(file, 'utf8');
+        for (const term of terms) {
+            if (term && text.toLowerCase().includes(term.toLowerCase())) {
+                offenders.push(`${path.relative(base, file)}#${hash(term).slice(0, 12)}`);
+            }
+        }
+    }
+    return {
+        schema: 'sks.brand-neutrality-zero-leakage.v1',
+        ok: offenders.length === 0,
+        scanned_files: files.length,
+        redacted_offenders: offenders,
+        forbidden_term_hashes: terms.map((term) => hash(term))
+    };
+}
+function forbiddenTerms() {
+    const raw = process.env.FORBIDDEN_EXTERNAL_REFERENCE_TERMS;
+    if (raw) {
+        try {
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed))
+                return parsed.map(String).filter(Boolean);
+        }
+        catch { }
+        return raw.split(/[,;\n]/).map((term) => term.trim()).filter(Boolean);
+    }
+    return ['bGF6eWNvZGV4', 'b3BlbmNsYXc=', 'aGVybWVz', 'b2gtbXktb3BlbmFnZW50', 'c2lzeXBodXNsYWJz'].map((value) => Buffer.from(value, 'base64').toString('utf8'));
+}
+function fakeEnv(opts) {
+    return swapEnv({
+        SKS_CODEX_0138_FAKE: '1',
+        SKS_CODEX_0139_FAKE: '1',
+        SKS_CODEX_PLUGIN_JSON_FAKE: '1',
+        SKS_CODEX_HOOK_APPROVAL_FIXTURE: opts.hook,
+        SKS_CODEX_AGENT_TYPE_FIXTURE: opts.agentType,
+        CODEX_BIN: 'codex'
+    });
+}
+function swapEnv(values) {
+    const previous = {};
+    for (const [key, value] of Object.entries(values)) {
+        previous[key] = process.env[key];
+        process.env[key] = value;
+    }
+    return previous;
+}
+function restoreEnv(previous) {
+    for (const [key, value] of Object.entries(previous)) {
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+}
+async function tempRoot(id) {
+    const dir = await fsp.mkdtemp(path.join(os.tmpdir(), `${id.replace(/[^a-z0-9-]/gi, '-')}-`));
+    await fsp.mkdir(path.join(dir, '.sneakoscope', 'reports'), { recursive: true });
+    await fsp.mkdir(path.join(dir, 'docs'), { recursive: true });
+    await fsp.writeFile(path.join(dir, 'package.json'), '{"name":"fixture","version":"3.1.6","scripts":{}}\n', 'utf8');
+    return dir;
+}
+function listFiles(dir) {
+    const out = [];
+    const walk = (current) => {
+        for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+            if (['.git', 'node_modules', 'dist'].includes(entry.name))
+                continue;
+            const full = path.join(current, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (entry.isFile())
+                out.push(full);
+        }
+    };
+    if (fs.existsSync(dir))
+        walk(dir);
+    return out.filter((file) => /\.(ts|js|json|md|txt|toml|ya?ml)$/i.test(file));
+}
+async function importDist(rel) {
+    const absolute = path.join(root, 'dist', rel);
+    assertGate(fs.existsSync(absolute), `dist module missing:${rel}`, { hint: 'run npm run build first' });
+    return import(pathToFileURL(absolute).href);
+}
+function readText(rel) {
+    return fs.readFileSync(path.join(root, rel), 'utf8');
+}
+function readJson(rel) {
+    return JSON.parse(readText(rel));
+}
+function hash(text) {
+    return createHash('sha256').update(text).digest('hex');
+}
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+function emitGate(name, detail = {}) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate: name, ...detail }, null, 2));
+}
+export function packageJson() {
+    return readJson('package.json');
+}
+export function gateManifest() {
+    return readJson('release-gates.v2.json');
+}
+export function required316ScriptIds() {
+    return [...REQUIRED_SCRIPT_IDS];
+}
+export function checkCommand(command, args) {
+    const result = spawnSync(command, args, { cwd: root, encoding: 'utf8', timeout: 120_000 });
+    return { status: result.status, stdout: result.stdout || '', stderr: result.stderr || '' };
+}
+//# sourceMappingURL=sks-3-1-6-directive-check-lib.js.map

package/dist/scripts/sks-3-1-7-directive-check-lib.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const RELEASE_HELPERS = [
+    'src/scripts/release-dag-full-coverage-check.ts',
+    'src/scripts/sks-3-1-5-directive-check-lib.ts',
+    'src/scripts/sks-3-1-6-directive-check-lib.ts',
+    'src/scripts/sks-3-1-7-directive-check-lib.ts',
+    'src/scripts/release-script-type-safety-check.ts',
+    'src/scripts/no-ts-nocheck-release-scripts-check.ts'
+];
+export async function runDirective317Gate(id) {
+    if (id === 'release-scripts:type-safe')
+        return releaseScriptsTypeSafe(id);
+    if (id === 'lint:no-ts-nocheck-release-scripts')
+        return noTsNoCheckReleaseScripts(id);
+    throw new Error(`unknown_3_1_7_gate:${id}`);
+}
+function releaseScriptsTypeSafe(id) {
+    checkNoTsNoCheckReleaseScripts();
+    const dag = readText('src/scripts/release-dag-full-coverage-check.ts');
+    for (const token of [
+        'interface PackageJsonShape',
+        'interface ReleaseGate',
+        'interface ReleaseGateManifest',
+        'function readPackageJson',
+        'function readReleaseGateManifest',
+        'function isReleaseGate',
+        'function normalizeStringList',
+        'const parsed: unknown'
+    ]) {
+        assertGate(dag.includes(token), `release DAG helper missing typed token:${token}`);
+    }
+    emitGate(id, { checked_files: RELEASE_HELPERS });
+}
+function noTsNoCheckReleaseScripts(id) {
+    checkNoTsNoCheckReleaseScripts();
+    emitGate(id, { checked_files: RELEASE_HELPERS });
+}
+function checkNoTsNoCheckReleaseScripts() {
+    const offenders = RELEASE_HELPERS.filter((rel) => /^\s*\/\/\s*@ts-nocheck\b/m.test(readText(rel)));
+    assertGate(offenders.length === 0, 'release script ts-nocheck offenders found', { offenders, checked_files: RELEASE_HELPERS });
+}
+function readText(rel) {
+    return fs.readFileSync(path.join(root, rel), 'utf8');
+}
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate, detail = {}) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate, ...detail }, null, 2));
+}
+//# sourceMappingURL=sks-3-1-7-directive-check-lib.js.map

package/dist/scripts/sks-3-1-8-check-lib.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+export { assertGate, emitGate };
+export async function makeTempRoot(prefix) {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), prefix));
+    await fs.mkdir(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+    await fs.mkdir(path.join(root, '.sneakoscope', 'locks'), { recursive: true });
+    return root;
+}
+export async function writeText(file, text) {
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, text, 'utf8');
+}
+export async function readJson(file) {
+    return JSON.parse(await fs.readFile(file, 'utf8'));
+}
+export async function writeManagedCoreSkill(root, relRoot, name) {
+    const file = path.join(root, relRoot, name, 'SKILL.md');
+    await writeText(file, renderCoreSkillTemplate(name));
+    return file;
+}
+export async function writeUserSkill(root, relRoot, name, display = name) {
+    const file = path.join(root, relRoot, name, 'SKILL.md');
+    await writeText(file, `---\nname: ${display}\ndescription: user-authored fixture\n---\n\nUser skill fixture.\n`);
+    return file;
+}
+//# sourceMappingURL=sks-3-1-8-check-lib.js.map