sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/sks-3110-all-feature-regression-blackbox.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { root as repoRoot } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, makeTempRoot, writeManagedCoreSkill, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
+import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
+import { dedupeProjectSkills } from '../core/codex-native/project-skill-dedupe.js';
+import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
+import { withSecretPreservationGuard } from '../core/config/secret-preservation.js';
+import { runProcess } from '../core/fsx.js';
+import { buildReleaseGateScriptParityReport } from './release-gate-script-parity-check.js';
+const root = await makeTempRoot('sks-3110-all-feature-');
+process.env.CODEX_HOME = path.join(root, 'codex-home');
+const parity = buildReleaseGateScriptParityReport();
+const coreA = await syncCoreSkillsIntegrity({ root, apply: true });
+const coreB = await syncCoreSkillsIntegrity({ root, apply: true });
+const loopPath = path.join(root, '.agents', 'skills', 'loop', 'SKILL.md');
+await fs.appendFile(loopPath, '\ncorruption\n', 'utf8');
+const coreC = await syncCoreSkillsIntegrity({ root, apply: true });
+await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const dedupeA = await dedupeProjectSkills({ root, fix: true, yes: true });
+await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Loop');
+await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'loop');
+const dedupeB = await dedupeProjectSkills({ root, fix: true, yes: false });
+const dedupeC = await dedupeProjectSkills({ root, fix: true, yes: true, quarantineUserDuplicates: true });
+process.env.SKS_CHROME_EXTENSION_READY = '1';
+process.env.SKS_COMPUTER_USE_CAPABILITY = 'verified';
+const repairable = await repairNativeCapabilities({ root, fix: true, yes: true, fixture: 'all-repairable' });
+delete process.env.SKS_CHROME_EXTENSION_READY;
+delete process.env.SKS_COMPUTER_USE_CAPABILITY;
+const manual = await repairNativeCapabilities({ root, fix: true, yes: true, fixture: 'manual-required' });
+const envFile = path.join(root, '.env.local');
+await writeText(envFile, 'NEXT_PUBLIC_SUPABASE_ANON_KEY=all-feature-secret\nSUPABASE_SERVICE_ROLE_KEY=service-secret\n');
+const deleteSecretGuard = await expectSecretGuardRestored('delete-secret-fixture', async () => {
+    await fs.writeFile(envFile, 'NEXT_PUBLIC_SUPABASE_ANON_KEY=all-feature-secret\n', 'utf8');
+});
+let text = await fs.readFile(envFile, 'utf8');
+assertGate(text.includes('SUPABASE_SERVICE_ROLE_KEY=service-secret'), 'delete fixture must restore missing Supabase service key', text);
+assertGate(deleteSecretGuard.includes('SUPABASE_SERVICE_ROLE_KEY:missing'), 'delete fixture must report restored missing service key', deleteSecretGuard);
+const changeSecretGuard = await expectSecretGuardRestored('change-secret-fixture', async () => {
+    await fs.writeFile(envFile, 'NEXT_PUBLIC_SUPABASE_ANON_KEY=changed\nSUPABASE_SERVICE_ROLE_KEY=service-secret\n', 'utf8');
+});
+text = await fs.readFile(envFile, 'utf8');
+assertGate(text.includes('NEXT_PUBLIC_SUPABASE_ANON_KEY=all-feature-secret'), 'change fixture must rollback Supabase anon key mutation', text);
+assertGate(changeSecretGuard.includes('NEXT_PUBLIC_SUPABASE_ANON_KEY:changed'), 'change fixture must report restored changed anon key', changeSecretGuard);
+const doctorRoot = await makeTempRoot('sks-3110-doctor-fix-');
+await writeText(path.join(doctorRoot, 'package.json'), '{"name":"sks-3110-doctor-fixture","private":true}\n');
+await writeText(path.join(doctorRoot, '.env.local'), 'NEXT_PUBLIC_SUPABASE_ANON_KEY=doctor-secret\n');
+const fixtureBin = path.join(doctorRoot, 'codex-fixture');
+await writeText(fixtureBin, '#!/usr/bin/env node\nconsole.log(JSON.stringify({ checks: { fixture: { category: "runtime", status: "ok" } } }));\n');
+await fs.chmod(fixtureBin, 0o755);
+const doctor = await runProcess(process.execPath, [
+    path.join(repoRoot, 'dist', 'bin', 'sks.js'),
+    'doctor',
+    '--fix',
+    '--local-only',
+    '--yes',
+    '--json',
+    '--codex-bin',
+    fixtureBin
+], {
+    cwd: doctorRoot,
+    env: {
+        HOME: path.join(doctorRoot, 'home'),
+        CODEX_HOME: path.join(doctorRoot, 'codex-home'),
+        SKS_GLOBAL_ROOT: path.join(doctorRoot, 'global-sks'),
+        SKS_CHROME_EXTENSION_READY: '1',
+        SKS_COMPUTER_USE_CAPABILITY: 'verified'
+    },
+    timeoutMs: 120_000,
+    maxOutputBytes: 512 * 1024
+});
+const doctorGuardReport = JSON.parse(await fs.readFile(path.join(doctorRoot, '.sneakoscope', 'reports', 'secret-preservation-guard.json'), 'utf8'));
+const guardReport = JSON.parse(await fs.readFile(path.join(root, '.sneakoscope', 'reports', 'secret-preservation-guard.json'), 'utf8'));
+const reportText = JSON.stringify(await readReports(path.join(root, '.sneakoscope', 'reports')));
+assertGate(parity.ok === true, 'release gate/script/dist parity must pass inside all-feature regression', parity);
+assertGate(coreA.installed_count > 0, 'core skills must install in temp root', coreA);
+assertGate(coreB.installed_count === 0 && coreB.restored_count === 0, 'second core sync must be idempotent', coreB);
+assertGate(coreC.restored_count > 0, 'corrupt managed core skill must restore', coreC);
+assertGate(dedupeA.actions.some((action) => action.action === 'quarantined'), 'managed duplicate must quarantine', dedupeA);
+assertGate(dedupeB.blockers.some((blocker) => blocker.includes('user_duplicate_requires_confirmation')), 'unconfirmed user duplicate must be manual_required', dedupeB);
+assertGate(dedupeC.active_unique_by_canonical_name === true, 'confirmed user duplicate quarantine must restore active uniqueness', dedupeC);
+assertGate(repairable.ok === true, 'all-repairable native fixture must pass postcheck', repairable);
+assertGate(manual.capabilities.some((state) => state.repairability === 'manual-required' && state.after !== 'verified'), 'manual native fixture must not false-verify', manual);
+assertGate(guardReport.rollback_attempted === true && guardReport.rollback_ok === true, 'secret guard must record rollback success', guardReport);
+assertGate(!reportText.includes('all-feature-secret') && !reportText.includes('service-secret'), 'reports must not contain raw secret literals');
+assertGate(doctor.code === 0 || doctor.code === 1, 'doctor --fix fixture must complete with a bounded readiness exit code under secret guard', { code: doctor.code, stdout: doctor.stdout.slice(-2000), stderr: doctor.stderr.slice(-2000) });
+assertGate(doctor.stdout.includes('"schema"') && doctor.stdout.includes('"command_aliases"'), 'doctor --fix fixture must emit structured doctor output', doctor.stdout.slice(-2000));
+assertGate(doctorGuardReport.ok === true && doctorGuardReport.raw_values_recorded === false, 'doctor --fix guard report must be sanitized and successful', doctorGuardReport);
+emitGate('sks:3110-all-feature-regression', {
+    core_installed: coreA.installed_count,
+    manual_native_count: manual.capabilities.filter((state) => state.repairability === 'manual-required' && state.after !== 'verified').length
+});
+async function readReports(dir) {
+    const out = {};
+    const rows = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const row of rows) {
+        if (!row.isFile() || !row.name.endsWith('.json'))
+            continue;
+        out[row.name] = await fs.readFile(path.join(dir, row.name), 'utf8');
+    }
+    return out;
+}
+async function expectSecretGuardRestored(operation, fn) {
+    try {
+        await withSecretPreservationGuard(root, operation, fn);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        assertGate(message.startsWith('secret_preservation_restored:'), `${operation} must be restored and reported by secret guard`, message);
+        return message;
+    }
+    assertGate(false, `${operation} must throw after restoring protected secret mutation`, {});
+    return '';
+}
+//# sourceMappingURL=sks-3110-all-feature-regression-blackbox.js.map

package/dist/scripts/sks-3112-all-feature-regression-blackbox.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, exists, readJson } from './sks-1-18-gate-lib.js';
+const scripts = readJson('package.json').scripts || {};
+const required = [
+    'release:gate-script-parity',
+    'codex:0140-capability',
+    'codex:0140-feature-probes',
+    'doctor:fix-production-blackbox',
+    'doctor:startup-config-repair-blackbox',
+    'doctor:context7-mcp-repair-blackbox',
+    'doctor:supabase-mcp-repair-blackbox',
+    'native-capability:postcheck',
+    'secret:preservation-guard',
+    'secret:supabase-preservation-blackbox',
+    'update:preserves-supabase-keys',
+    'core-skill:no-drift',
+    'skill:dedupe-blackbox',
+    'release:dag-full-coverage'
+];
+for (const id of required)
+    assertGate(Boolean(scripts[id]), `3.1.12 regression required script missing: ${id}`);
+for (const file of [
+    'src/core/doctor/doctor-transaction.ts',
+    'src/core/codex-control/codex-0140-capability.ts',
+    'src/core/config/secret-preservation.ts'
+])
+    assertGate(exists(file), `3.1.12 regression required file missing: ${file}`);
+emitGate('sks:3112-all-feature-regression', { scenarios: required.length });
+//# sourceMappingURL=sks-3112-all-feature-regression-blackbox.js.map

package/dist/scripts/sks-3113-all-feature-regression-blackbox.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, exists, readJson } from './sks-1-18-gate-lib.js';
+import { REQUIRED_3113_RELEASE_IDS } from './release-3113-required-gates.js';
+const scripts = readJson('package.json').scripts || {};
+for (const id of REQUIRED_3113_RELEASE_IDS)
+    assertGate(Boolean(scripts[id]), `3.1.13 regression required script missing: ${id}`);
+for (const file of [
+    'src/core/codex-control/codex-0140-usage-parser.ts',
+    'src/core/doctor/doctor-transaction.ts',
+    'src/core/codex/agent-config-file-repair.ts',
+    'src/core/mcp/mcp-config-preservation.ts',
+    'src/core/config/secret-preservation.ts',
+    'src/core/codex-native/native-capability-postcheck.ts'
+])
+    assertGate(exists(file), `3.1.13 regression required file missing: ${file}`);
+emitGate('sks:3113-all-feature-regression', { scenarios: REQUIRED_3113_RELEASE_IDS.length });
+//# sourceMappingURL=sks-3113-all-feature-regression-blackbox.js.map

package/dist/scripts/sks-400-all-feature-regression-blackbox.js

@@ -0,0 +1,21 @@
+// @ts-nocheck
+import { assertGate, emitGate, packageScripts, readText } from './sks-1-18-gate-lib.js';
+const scripts = packageScripts();
+const required = [
+    'triwiki:proof-bank',
+    'triwiki:affected-graph',
+    'gate-pack:runner',
+    'scheduler:extreme-parallel',
+    'pipeline:five-minute-sla',
+    'build-once:runner',
+    'probes:memoization',
+    'doctor:dirty-repair',
+    'legacy:gate-inventory',
+    'certificate:sla'
+];
+for (const id of required)
+    assertGate(Boolean(scripts[id]), `4.0.0 script missing: ${id}`);
+const changelog = readText('CHANGELOG.md');
+assertGate(changelog.includes('[4.0.0]'), 'CHANGELOG must include 4.0.0 entry');
+emitGate('sks:400-all-feature-regression', { scripts: required.length });
+//# sourceMappingURL=sks-400-all-feature-regression-blackbox.js.map

package/dist/scripts/sks-400-extreme-parallel-blackbox.js

@@ -0,0 +1,8 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const scheduler = await importDist('core/release/extreme-parallel-scheduler.js');
+const schedule = scheduler.planExtremeParallelSchedule(root);
+assertGate(schedule.sequential_ms > 0 && schedule.critical_path_ms > 0, 'extreme scheduler blackbox must estimate work', schedule);
+assertGate(schedule.critical_path_ms <= schedule.sequential_ms, 'critical path must not exceed sequential path', schedule);
+emitGate('scheduler:extreme-parallel-blackbox', { reduction_ratio: schedule.reduction_ratio, batches: schedule.batches.length });
+//# sourceMappingURL=sks-400-extreme-parallel-blackbox.js.map

package/dist/scripts/sks-400-five-minute-blackbox.js

@@ -0,0 +1,9 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const graphMod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const sla = await importDist('core/release/sla-scheduler.js');
+const graph = graphMod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-proof-bank.ts'], tier: 'affected' });
+const plan = sla.planFiveMinuteSla(root, graph);
+assertGate(plan.certificate.sla_ms === 300000 && plan.graph.release_equivalent_within_scope === true, 'five-minute TriWiki blackbox must produce release-equivalent certificate', plan);
+emitGate('pipeline:five-minute-triwiki-blackbox', { gates: plan.graph.gates.length, ok: plan.ok });
+//# sourceMappingURL=sks-400-five-minute-blackbox.js.map

package/dist/scripts/sks-400-legacy-purge-blackbox.js

@@ -0,0 +1,8 @@
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const registry = readText('src/cli/command-registry.ts');
+const migration = readText('docs/sks-4-migration.md');
+assertGate(!registry.includes('LEGACY_COMMAND_ALIASES = {\\n  auth'), 'legacy alias block must be destructive-purged');
+assertGate(migration.includes('No silent legacy fallback'), 'migration doc must explain no silent fallback');
+emitGate('legacy:purge-blackbox');
+//# sourceMappingURL=sks-400-legacy-purge-blackbox.js.map

package/dist/scripts/sks-401-all-feature-regression-blackbox.js

@@ -0,0 +1,46 @@
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import { REQUIRED_4001_RELEASE_IDS } from './release-4001-required-gates.js';
+import { REQUIRED_4002_RELEASE_IDS } from './release-4002-required-gates.js';
+import fs from 'node:fs';
+import path from 'node:path';
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+const manifest = JSON.parse(fs.readFileSync(path.join(root, 'release-gates.v2.json'), 'utf8'));
+const ids = new Set(manifest.gates.map((gate) => gate.id));
+const required = [...REQUIRED_4001_RELEASE_IDS, ...REQUIRED_4002_RELEASE_IDS];
+const missing = required.filter((id) => !pkg.scripts?.[id] || !ids.has(id));
+assertGate(compareSemver(pkg.version || '0.0.0', '4.0.2') >= 0, 'package version must be at least 4.0.2 after production completion bump', pkg.version);
+assertGate(missing.length === 0, '4.0.1/4.0.2 required scripts/gates missing', missing);
+const graphMod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const schedulerMod = await importDist('core/release/extreme-parallel-scheduler.js');
+const dirtyMod = await importDist('core/doctor/doctor-dirty-planner.js');
+const certificateMod = await importDist('core/triwiki/triwiki-sla-certificate.js');
+const graph = graphMod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-proof-card.ts'], tier: 'confidence' });
+const plan = schedulerMod.planExtremeParallelSchedule(root, graph);
+const dirty = dirtyMod.planDoctorDirtyRepair(root, ['context7']);
+const certificate = certificateMod.buildTriWikiSlaCertificate({
+    graph,
+    mode: 'actual',
+    slaMs: 300_000,
+    estimatedCriticalPathMs: Math.max(1, plan.critical_path_ms || 1),
+    estimatedSequentialMs: Math.max(1, plan.sequential_ms || plan.critical_path_ms || 1),
+    actualDurationMs: 1,
+    executedPacks: Math.max(1, graph.gate_packs.length),
+    reusedProofs: graph.reused_proofs.length,
+    invalidatedProofs: graph.invalidated_proofs.length
+});
+assertGate(graph.gate_packs.length > 0, 'regression must compute affected graph gate packs', graph);
+assertGate(plan.schema === 'sks.extreme-parallel-scheduler.v1', 'regression must exercise scheduler planning', plan);
+assertGate(dirty.schema === 'sks.doctor-dirty-plan.v1', 'regression must exercise semantic dirty doctor', dirty);
+assertGate(certificate.mode === 'actual' && certificate.sla_met === true, 'regression must create actual SLA certificate', certificate);
+emitGate('sks:401-all-feature-regression', { required: required.length, packs: graph.gate_packs.length });
+function compareSemver(left, right) {
+    const a = left.split('.').map((part) => Number.parseInt(part, 10) || 0);
+    const b = right.split('.').map((part) => Number.parseInt(part, 10) || 0);
+    for (let i = 0; i < 3; i += 1) {
+        const diff = (a[i] || 0) - (b[i] || 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+//# sourceMappingURL=sks-401-all-feature-regression-blackbox.js.map

package/dist/scripts/sks-401-five-minute-actual-blackbox.js

@@ -0,0 +1,23 @@
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const graphMod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const certMod = await importDist('core/triwiki/triwiki-sla-certificate.js');
+const graph = graphMod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-sla-certificate.ts'], tier: 'confidence' });
+const cert = certMod.buildTriWikiSlaCertificate({
+    graph,
+    slaMs: 300000,
+    estimatedCriticalPathMs: 1000,
+    estimatedSequentialMs: 2000,
+    mode: 'actual',
+    actualDurationMs: 1000,
+    executedGates: 1,
+    executedPacks: 1,
+    reusedProofs: 0,
+    invalidatedProofs: graph.invalidated_proofs.length,
+    newProofs: 1,
+    skippedAsValidCache: 0,
+    skippedAsUnaffected: 0,
+    backgroundFullRelease: true
+});
+assertGate(cert.mode === 'actual' && cert.ok === true && cert.actual_duration_ms === 1000, 'actual SLA certificate must include execution stats', cert);
+emitGate('sks:401-five-minute-actual-blackbox', { mode: cert.mode, actual_duration_ms: cert.actual_duration_ms });
+//# sourceMappingURL=sks-401-five-minute-actual-blackbox.js.map

package/dist/scripts/sks-402-all-feature-regression-blackbox.js

@@ -0,0 +1,9 @@
+import { assertGate, emitGate, packageScripts, readJson } from './sks-1-18-gate-lib.js';
+import { REQUIRED_4002_RELEASE_IDS } from './release-4002-required-gates.js';
+const scripts = packageScripts();
+const manifest = readJson('release-gates.v2.json');
+const gateIds = new Set(manifest.gates.map((gate) => gate.id));
+const missing = REQUIRED_4002_RELEASE_IDS.filter((id) => !scripts[id] || !gateIds.has(id));
+assertGate(missing.length === 0, '4.0.2 required scripts/gates missing', missing);
+emitGate('sks:402-all-feature-regression', { required: REQUIRED_4002_RELEASE_IDS.length });
+//# sourceMappingURL=sks-402-all-feature-regression-blackbox.js.map

package/dist/scripts/sks-402-five-minute-real-blackbox.js

@@ -0,0 +1,22 @@
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const graphMod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const schedulerMod = await importDist('core/release/extreme-parallel-scheduler.js');
+const certificateMod = await importDist('core/triwiki/triwiki-sla-certificate.js');
+const graph = graphMod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-proof-card.ts'], tier: 'confidence' });
+const plan = schedulerMod.planExtremeParallelSchedule(root, graph);
+const certificate = certificateMod.buildTriWikiSlaCertificate({
+    graph,
+    mode: 'actual',
+    slaMs: 300_000,
+    estimatedCriticalPathMs: Math.max(1, plan.critical_path_ms || 1),
+    estimatedSequentialMs: Math.max(1, plan.sequential_ms || plan.critical_path_ms || 1),
+    actualDurationMs: Math.max(1, Math.min(299_000, plan.critical_path_ms || 1)),
+    executedPacks: Math.max(1, graph.gate_packs.length),
+    reusedProofs: graph.reused_proofs.length,
+    invalidatedProofs: graph.invalidated_proofs.length,
+    skippedAsUnaffected: Math.max(1, plan.batches.length)
+});
+assertGate(certificate.mode === 'actual' && certificate.sla_met === true, '4.0.2 five-minute blackbox must create actual SLA certificate', certificate);
+assertGate(graph.gate_packs.length > 0 && graph.required_new_proofs.length >= 0, '4.0.2 five-minute blackbox must compute affected packs', graph);
+emitGate('sks:402-five-minute-real-blackbox', { packs: graph.gate_packs.length, sla_met: certificate.sla_met });
+//# sourceMappingURL=sks-402-five-minute-real-blackbox.js.map

package/dist/scripts/sksd-daemon-check.js

@@ -0,0 +1,9 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/daemon/sksd-client.js');
+const state = mod.runSksdClient(root, 'status');
+const start = mod.runSksdClient(root, 'start');
+assertGate(state.schema === 'sks.sksd-state.v1', 'sksd status schema mismatch', state);
+assertGate(start.protocol_ok === true && start.status === 'running', 'sksd start must record protocol-ready state', start);
+emitGate('sksd:daemon', { status: start.status });
+//# sourceMappingURL=sksd-daemon-check.js.map

package/dist/scripts/sksd-warm-cache-blackbox.js

@@ -0,0 +1,12 @@
+// @ts-nocheck
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('sksd-warm-');
+const mod = await importDist('core/daemon/sksd-client.js');
+const warm = mod.runSksdClient(tmp, 'warm');
+const status = mod.runSksdClient(tmp, 'status');
+const proofBank = mod.handleSksdRequest(tmp, { type: 'proof-bank-status', root: tmp });
+assertGate(warm.status === 'warm' && status.status === 'warm' && status.proof_bank_ready === true && status.protocol_ok === true, 'sksd warm cache must persist protocol state', { warm, status });
+assertGate(proofBank.schema === 'sks.triwiki-proof-bank.v1', 'sksd proof-bank-status request must roundtrip', proofBank);
+emitGate('sksd:warm-cache-blackbox', { status: status.status });
+//# sourceMappingURL=sksd-warm-cache-blackbox.js.map

package/dist/scripts/source-intelligence-all-modes-check.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/source-intelligence/source-intelligence-runner.js');
+const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-source-intelligence-'));
+const noXai = await mod.runSourceIntelligence({
+    missionDir: dir,
+    route: '$Team',
+    query: 'fixture',
+    context7: async () => [{ title: 'docs' }],
+    codexWebSearch: async () => [{ title: 'web', url: 'https://example.com' }],
+    xaiDetection: { configured: false, search_capable: false, configured_but_unverified: false, status: 'missing' },
+    env: { SKS_CODEX_WEB_SEARCH_AVAILABLE: '1' }
+});
+const withXai = await mod.runSourceIntelligence({
+    missionDir: dir,
+    route: '$Research',
+    query: 'fixture',
+    context7: async () => [{ title: 'docs' }],
+    codexWebSearch: async () => [{ title: 'web', url: 'https://example.com' }],
+    xaiSearch: async () => [{ title: 'x', url: 'https://x.ai' }],
+    xaiDetection: { configured: true, search_capable: true, configured_but_unverified: false, status: 'search_capable' },
+    env: { SKS_CODEX_WEB_SEARCH_AVAILABLE: '1' }
+});
+assertGate(noXai.ok === true && noXai.mode === 'context7_codex_web', 'no-XAI mode must pass with Context7+Codex Web', noXai);
+assertGate(withXai.ok === true && withXai.mode === 'context7_codex_web_xai', 'XAI mode must pass with all providers', withXai);
+assertGate(withXai.parallel.providers_requested.length === 3, 'providers must run through parallel provider plan', withXai.parallel);
+emitGate('source-intelligence:all-modes', { modes: [noXai.mode, withXai.mode] });
+//# sourceMappingURL=source-intelligence-all-modes-check.js.map

package/dist/scripts/source-intelligence-policy-check.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertFiles, assertGate, emitGate, importDist, SOURCE_INTELLIGENCE_FILES } from './sks-1-18-gate-lib.js';
+assertFiles(SOURCE_INTELLIGENCE_FILES);
+const mod = await importDist('core/source-intelligence/source-intelligence-policy.js');
+const base = mod.buildSourceIntelligencePolicy({ context7Available: true, codexWebCapability: { available: true, status: 'available', reason: 'fixture' }, xaiDetection: { configured: false, search_capable: false, configured_but_unverified: false, status: 'missing' } });
+const xai = mod.buildSourceIntelligencePolicy({ context7Available: true, codexWebCapability: { available: true, status: 'available', reason: 'fixture' }, xaiDetection: { configured: true, search_capable: true, configured_but_unverified: false, status: 'search_capable' } });
+const blocked = mod.buildSourceIntelligencePolicy({ context7Available: false });
+assertGate(base.mode === 'context7_codex_web', 'default mode must be context7_codex_web', base);
+assertGate(xai.mode === 'context7_codex_web_xai' && xai.xai_mcp.required === true, 'X AI available mode must require X evidence', xai);
+assertGate(blocked.mode === 'blocked' && blocked.blockers.includes('docs_context_missing'), 'Context7 missing must block docs context');
+emitGate('source-intelligence:policy', { modes: [base.mode, xai.mode, blocked.mode] });
+//# sourceMappingURL=source-intelligence-policy-check.js.map

package/dist/scripts/strategy-adhd-orchestrating-gate-check.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/strategy/adhd-orchestrating-gate.js');
+const gate = mod.runAdhdOrchestratingGate({
+    prompt: 'Implement strategy-first parallel write gates in `src/core/strategy/strategy-gate.ts` with Appshots evidence.',
+    agentCount: 5,
+    visualRequired: true
+});
+const artifacts = mod.buildDopamineOrchestrationArtifacts(gate);
+const report = { schema: 'sks.strategy-adhd-orchestrating-gate-check.v1', ok: gate.ok, gate, artifacts };
+const out = path.join(root, '.sneakoscope', 'reports', 'strategy-adhd-orchestrating-gate.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(gate.ok === true, 'ADHD orchestration gate must pass a concrete prompt', report);
+assertGate(gate.scheduler_requires_gate === true, 'strategy scheduler gate must be explicit', report);
+assertGate(gate.micro_wins.length >= 4, 'micro-win board must contain executable slices', report);
+assertGate(artifacts.microWinBoard.dashboard_visible === true, 'micro-win board must be dashboard visible', report);
+emitGate('strategy:adhd-orchestrating-gate', { micro_wins: gate.micro_wins.length });
+//# sourceMappingURL=strategy-adhd-orchestrating-gate-check.js.map

package/dist/scripts/strategy-file-ownership-plan-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/strategy/strategy-compiler.js');
+const compiled = mod.compileStrategy({
+    prompt: 'Patch separate source and docs files.',
+    writeTargets: ['src/core/strategy/strategy-gate.ts', 'docs/strategy-first-parallel-write.md']
+});
+const report = { schema: 'sks.strategy-file-ownership-plan-check.v1', ok: compiled.file_ownership_plan.no_overlap, ownership: compiled.file_ownership_plan };
+const out = path.join(root, '.sneakoscope', 'reports', 'strategy-file-ownership-plan.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(compiled.file_ownership_plan.no_overlap === true, 'file ownership plan must prove no overlapping writes', report);
+assertGate(compiled.file_ownership_plan.protected_write_paths.length === 0, 'file ownership plan must block protected paths', report);
+emitGate('strategy:file-ownership-plan', { owners: compiled.file_ownership_plan.owners.length });
+//# sourceMappingURL=strategy-file-ownership-plan-check.js.map

package/dist/scripts/strategy-parallel-modification-plan-check.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/strategy/strategy-compiler.js');
+const compiled = mod.compileStrategy({
+    prompt: 'Update independent release files.',
+    writeTargets: ['src/core/version.ts', 'README.md', 'CHANGELOG.md'],
+    agentCount: 5
+});
+const report = { schema: 'sks.strategy-parallel-modification-plan-check.v1', ok: compiled.parallel_modification_plan.can_parallelize_writes, plan: compiled.parallel_modification_plan };
+const out = path.join(root, '.sneakoscope', 'reports', 'strategy-parallel-modification-plan.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(compiled.parallel_modification_plan.batches.length >= 1, 'parallel modification plan must include a batch', report);
+assertGate(compiled.parallel_modification_plan.serial_conflicts.length === 0, 'independent write targets must not serialize', report);
+emitGate('strategy:parallel-modification-plan', { batches: compiled.parallel_modification_plan.batches.length });
+//# sourceMappingURL=strategy-parallel-modification-plan-check.js.map

package/dist/scripts/strategy-verification-rollback-dag-check.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/strategy/strategy-compiler.js');
+const compiled = mod.compileStrategy({
+    prompt: 'Patch with rollback proof.',
+    writeTargets: ['src/core/agents/agent-patch-proof.ts']
+});
+const dag = compiled.verification_rollback_dag;
+const report = { schema: 'sks.strategy-verification-rollback-dag-check.v1', ok: dag.rollback_ready, dag };
+const out = path.join(root, '.sneakoscope', 'reports', 'strategy-verification-rollback-dag.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(dag.rollback_ready === true, 'verification rollback DAG must include rollback node', report);
+assertGate(dag.nodes.some((node) => node.kind === 'verification'), 'verification rollback DAG must include verification node', report);
+emitGate('strategy:verification-rollback-dag', { nodes: dag.nodes.length });
+//# sourceMappingURL=strategy-verification-rollback-dag-check.js.map

package/dist/scripts/supabase-secret-preservation-blackbox.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { captureSecretPreservationSnapshot, withSecretPreservationGuard } from '../core/config/secret-preservation.js';
+const root = await makeTempRoot('sks-supabase-blackbox-');
+const envFile = path.join(root, '.env.local');
+await writeText(envFile, 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=super-secret-anon\n');
+const before = await captureSecretPreservationSnapshot({ root });
+await withSecretPreservationGuard(root, 'blackbox-preserve', async () => {
+    await fs.appendFile(envFile, 'SKS_MANAGED=true\n', 'utf8');
+});
+const after = await captureSecretPreservationSnapshot({ root });
+assertGate(JSON.stringify(before.fingerprints.map((fp) => fp.value_sha256).sort()) === JSON.stringify(after.fingerprints.map((fp) => fp.value_sha256).sort()), 'Supabase secret fingerprints must remain stable across guarded update', { before, after });
+assertGate(!JSON.stringify(after).includes('super-secret-anon'), 'reports must not include raw Supabase values', after);
+let blocked = false;
+try {
+    await withSecretPreservationGuard(root, 'blackbox-change', async () => {
+        await fs.writeFile(envFile, 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=mutated-secret\n', 'utf8');
+    });
+}
+catch {
+    blocked = true;
+}
+const restored = await fs.readFile(envFile, 'utf8');
+assertGate(blocked, 'Supabase value mutation must be blocked after rollback');
+assertGate(restored.includes('super-secret-anon') && !restored.includes('mutated-secret'), 'Supabase value mutation must be rolled back');
+emitGate('secret:supabase-preservation-blackbox');
+//# sourceMappingURL=supabase-secret-preservation-blackbox.js.map

package/dist/scripts/team-actual-route-backfill-check.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runActualTeamBackfillBlackbox } from './agent-route-blackbox-lib.js';
+runActualTeamBackfillBlackbox('team:actual-route-backfill');
+//# sourceMappingURL=team-actual-route-backfill-check.js.map

package/dist/scripts/team-alias-to-naruto-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const team = readText('src/core/commands/team-command.ts');
+assertGate(team.includes('redirectTeamCreateToNaruto') && team.includes('team-alias-to-naruto.json'), 'sks team create path must redirect to Naruto and write proof artifact');
+assertGate(team.includes('narutoCommand'), 'team command must call Naruto command');
+emitGate('team:alias-to-naruto', { command: 'sks team', redirects_to: 'sks naruto run' });
+//# sourceMappingURL=team-alias-to-naruto-check.js.map

package/dist/scripts/team-backfill-route-blackbox.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runRouteBackfillBlackbox } from './agent-route-blackbox-lib.js';
+runRouteBackfillBlackbox('$Team', 'team:backfill-route-blackbox');
+//# sourceMappingURL=team-backfill-route-blackbox.js.map

package/dist/scripts/team-legacy-create-removed-check.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const src = readText('src/core/commands/team-command.ts');
+const body = src.slice(src.indexOf('export async function team'), src.indexOf('async function redirectTeamCreateToNaruto'));
+const forbidden = ['native_agent_intake', 'development_team', 'review_team', 'runNativeAgentOrchestrator', 'buildTeamPlan', 'parseTeamCreateArgs'];
+assertGate(body.includes('redirectTeamCreateToNaruto') && !body.includes('runNativeAgentOrchestrator') && !body.includes('jsonOutput'), 'Team create legacy code must not remain in team() body');
+assertGate(forbidden.every((token) => !src.includes(token)), 'Team create legacy planning/runtime tokens must not remain in team-command.ts', { forbidden, present: forbidden.filter((token) => src.includes(token)) });
+assertGate(readText('src/core/commands/team-legacy-observe-command.ts').includes('teamLegacyObserveCommand'), 'legacy observe/watch commands must be isolated in team-legacy-observe-command.ts');
+assertGate(readText('src/cli/command-registry.ts').includes('Deprecated alias. New execution redirects to Naruto; legacy observe/watch remains.'), 'Team registry description must describe deprecated alias behavior');
+emitGate('team:legacy-create-removed', { isolated: true });
+//# sourceMappingURL=team-legacy-create-removed-check.js.map

package/dist/scripts/team-parallel-write-blackbox.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mergeMod = await importDist('core/agents/agent-merge-coordinator.js');
+const applyMod = await importDist('core/agents/agent-patch-apply-worker.js');
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-team-patch-'));
+fs.writeFileSync(path.join(tmp, 'team-a.txt'), 'lane-a\n');
+fs.writeFileSync(path.join(tmp, 'team-b.txt'), 'lane-b\n');
+const envelopes = [
+    { schema: 'sks.agent-patch-envelope.v1', agent_id: 'reviewer-a', session_id: 'team-session-a', slot_id: 'team-slot-a', generation_index: 1, lease_id: 'lease:reviewer-a:team-a.txt', operations: [{ op: 'replace', path: 'team-a.txt', search: 'lane-a', replace: 'lane-a-done' }] },
+    { schema: 'sks.agent-patch-envelope.v1', agent_id: 'reviewer-b', session_id: 'team-session-b', slot_id: 'team-slot-b', generation_index: 1, lease_id: 'lease:reviewer-b:team-b.txt', operations: [{ op: 'replace', path: 'team-b.txt', search: 'lane-b', replace: 'lane-b-done' }] }
+];
+const merge = mergeMod.coordinateAgentPatchMerge(envelopes);
+const applyResults = [];
+for (const envelope of envelopes)
+    applyResults.push(await applyMod.applyAgentPatchEnvelope(tmp, envelope));
+const teamRun = spawnSync(process.execPath, [
+    'dist/bin/sks.js',
+    'team',
+    'team parallel write blackbox route fixture',
+    'executor:1',
+    'reviewer:5',
+    '--mock',
+    '--write-mode',
+    'parallel',
+    '--apply-patches',
+    '--dry-run-patches',
+    '--max-write-agents',
+    '1',
+    '--json'
+], { cwd: root, encoding: 'utf8', maxBuffer: 2 * 1024 * 1024 });
+const teamJson = parseJson(teamRun.stdout);
+const routePolicy = teamJson?.parallel_write_policy || teamJson?.run?.parallel_write_policy || teamJson?.native_agent_run?.parallel_write_policy || null;
+const report = { schema: 'sks.team-parallel-write-blackbox.v1', ok: merge.ok && applyResults.every((item) => item.ok) && teamRun.status === 0 && routePolicy?.route_level_flags_wired === true, merge, applyResults, route_command: { status: teamRun.status, stderr_tail: teamRun.stderr.slice(-2000), mission_id: teamJson?.mission_id || null, route_policy: routePolicy } };
+const out = path.join(root, '.sneakoscope', 'reports', 'team-parallel-write-blackbox.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(report.ok === true, 'Team parallel write blackbox must pass', report);
+assertGate(routePolicy?.write_mode === 'parallel', 'Team route must carry --write-mode parallel into native agent policy', report);
+assertGate(routePolicy?.apply_patches === true, 'Team route must carry --apply-patches into native agent policy', report);
+assertGate(routePolicy?.dry_run_patches === true, 'Team route must carry --dry-run-patches into native agent policy', report);
+emitGate('team:parallel-write-blackbox', { changed_files: applyResults.flatMap((item) => item.changed_files).length });
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=team-parallel-write-blackbox.js.map

package/dist/scripts/team-patch-swarm-route-blackbox.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runPatchSwarmRouteBlackbox } from './agent-patch-swarm-gate-lib.js';
+await runPatchSwarmRouteBlackbox({
+    gate: 'team:patch-swarm-route-blackbox',
+    route: '$Team',
+    routeCommand: 'sks team',
+    reportName: 'team-patch-swarm-route-blackbox'
+});
+//# sourceMappingURL=team-patch-swarm-route-blackbox.js.map