sneakoscope 4.1.0 → 4.2.0

package/dist/scripts/doctor-warning-only-not-blocker-check.js

@@ -24,16 +24,33 @@ const matrix = buildDoctorReadinessMatrix({
         ]
     },
     codex_doctor: codexDoctor,
-    require_codex_doctor: true
+    require_codex_doctor: true,
+    doctor_native_capability: {
+        ok: true,
+        blockers: [],
+        optional_warnings: ['computer_use_manual_required', 'chrome_extension_manual_required'],
+        native_capabilities: {
+            capabilities: [
+                { id: 'computer_use', availability: 'manual-required', repairability: 'manual-required', after: 'unknown' },
+                { id: 'chrome_web_review', availability: 'manual-required', repairability: 'manual-required', after: 'unknown' }
+            ],
+            route_blockers: {
+                'route-computer-use': ['computer_use_os_permission_or_capability_unknown'],
+                'route-chrome-web-review': ['codex_chrome_extension_readiness_not_verified']
+            }
+        }
+    }
 });
 const report = {
     schema: 'sks.doctor-warning-only-not-blocker-check.v1',
     ready: matrix.ready,
     core_ready: matrix.core_ready,
     primary_blocker: matrix.primary_blocker,
+    optional_capabilities: matrix.optional_capabilities,
     blockers: matrix.blockers,
     warnings: matrix.warnings
 };
 assertGate(matrix.ready === true && matrix.primary_blocker === null && matrix.blockers.length === 0, 'warning-only Codex Doctor must not block readiness', report);
+assertGate(matrix.optional_capabilities.computer_use === 'manual_required' && matrix.optional_capabilities.chrome_web_review === 'manual_required', 'optional native capabilities must remain route-gated warnings', report);
 emitGate('doctor:warning-only-not-blocker', report);
 //# sourceMappingURL=doctor-warning-only-not-blocker-check.js.map

package/dist/scripts/loop-directive-check-lib.js

@@ -343,8 +343,9 @@ async function readJson(file) {
     return JSON.parse(await fs.readFile(file, 'utf8'));
 }
 async function productionFixtureNegativeCheck() {
+    const runtimeModuleUrl = new URL('../core/loops/loop-worker-runtime.js', import.meta.url).href;
     const code = `
-import { runLoopMakerWorkers } from '../core/loops/loop-worker-runtime.js';
+import { runLoopMakerWorkers } from ${JSON.stringify(runtimeModuleUrl)};
 const node = {
   mission_id: 'M-production-fixture-negative',
   loop_id: 'loop-production-fixture-negative',

package/dist/scripts/mad-db-capability-check.js

@@ -7,9 +7,20 @@ const missionMod = await importDist('core/mission.js');
 const capMod = await importDist('core/mad-db/mad-db-capability.js');
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-cap-'));
 const mission = await missionMod.createMission(root, { mode: 'mad-db', prompt: 'fixture' });
-const cap = await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root });
+const cap = await capMod.createMadDbCapability(root, {
+    missionId: mission.id,
+    ack: capMod.MAD_DB_ACK,
+    cwd: root,
+    projectRef: 'fixture-project-ref',
+    runtimeSessionId: 'fixture-session',
+    profilePath: '.sneakoscope/missions/M/mad-db/runtime/codex-mad-db.config.toml',
+    profileSha256: 'fixture-profile-sha',
+    status: 'active'
+});
 assertGate(cap.schema === capMod.MAD_DB_CAPABILITY_SCHEMA, 'Mad-DB capability schema mismatch', cap);
-assertGate(cap.enabled === true && cap.one_cycle_only === true && cap.priority === 'highest', 'Mad-DB capability must be one-cycle highest priority', cap);
+assertGate(cap.legacy_compat?.one_cycle_only === true && cap.legacy_compat?.priority === 'highest', 'Mad-DB capability must retain legacy one-cycle priority metadata', cap);
+assertGate(cap.project_ref === 'fixture-project-ref' && cap.runtime_session_id === 'fixture-session' && cap.transport.profile_sha256 === 'fixture-profile-sha', 'Mad-DB capability v2 must bind project/session/profile', cap);
+assertGate(cap.scope.sql_plane === 'all_mutations' && cap.scope.control_plane === 'deny' && cap.scope.operations.includes('truncate'), 'Mad-DB capability v2 must authorize SQL-plane operation classes only', cap);
 assertGate(capMod.isMadDbCapabilityActive(cap) === true, 'Mad-DB capability must be active before consumption', cap);
 emitGate('mad-db:capability', { mission_id: mission.id, cycle_id: cap.cycle_id });
 //# sourceMappingURL=mad-db-capability-check.js.map

package/dist/scripts/mad-db-command-check.js

@@ -3,11 +3,13 @@ import { DOLLAR_COMMAND_ALIASES, DOLLAR_COMMANDS, routeByDollarCommand } from '.
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 assertGate(readText('src/cli/command-registry.ts').includes("'mad-db'"), 'mad-db command must be registered');
 assertGate(readText('src/commands/mad-db.ts').includes('madDbCommand'), 'mad-db command wrapper missing');
-assertGate(readText('src/core/commands/mad-db-command.ts').includes('I AUTHORIZE ONE-CYCLE DB BREAK-GLASS'), 'mad-db command must require exact ack phrase');
+assertGate(readText('src/core/commands/mad-db-command.ts').includes('deprecated_enable_no_capability'), 'legacy mad-db enable must be deprecated and must not create capabilities');
 assertGate(DOLLAR_COMMANDS.some((entry) => entry.command === '$MAD-DB'), '$MAD-DB dollar command must be visible in sks dollar-commands');
-assertGate(DOLLAR_COMMAND_ALIASES.some((entry) => entry.canonical === '$MAD-SKS' && entry.app_skill === '$mad-db'), '$mad-db app skill alias must be visible in sks dollar-commands');
-assertGate(routeByDollarCommand('MAD-DB')?.command === '$MAD-SKS', '$MAD-DB must resolve to the MAD-SKS permission route');
-assertGate(routeByDollarCommand('mad-db')?.command === '$MAD-SKS', '$mad-db must resolve to the MAD-SKS permission route');
-assertGate(readText('src/core/init.ts').includes("'mad-db':") && readText('src/core/init.ts').includes('sks mad-db enable'), 'mad-db generated picker skill template missing');
+assertGate(DOLLAR_COMMAND_ALIASES.some((entry) => entry.canonical === '$MAD-DB' && entry.app_skill === '$mad-db'), '$mad-db app skill alias must point at first-class $MAD-DB');
+assertGate(routeByDollarCommand('MAD-DB')?.command === '$MAD-DB', '$MAD-DB must resolve to the first-class MadDB route');
+assertGate(routeByDollarCommand('mad-db')?.command === '$MAD-DB', '$mad-db must resolve to the first-class MadDB route');
+const initText = readText('src/core/init.ts');
+assertGate(initText.includes("'mad-db':") && initText.includes('madDbSkillText()') && initText.includes('dbSafetyGuardSkillText()'), 'mad-db generated picker skill template must come from typed SSOT');
+assertGate(readText('src/core/commands/mad-db-command.ts').includes('run|exec|apply-migration'), 'mad-db command must expose execution subcommands');
 emitGate('mad-db:command', { command: 'sks mad-db', dollar_command: '$MAD-DB', app_skill_alias: '$mad-db' });
 //# sourceMappingURL=mad-db-command-check.js.map

package/dist/scripts/mad-db-hook-idempotency-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission } from '../core/mission.js';
+import { checkDbOperation } from '../core/db-safety.js';
+import { createMadDbCapability, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-idempotency-'));
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'idempotency fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const payload = { tool_name: 'supabase.execute_sql', tool_call_id: 'canonical-call-id-1', sql: 'delete from public.fixture;' };
+const first = await checkDbOperation(root, { mission_id: mission.id }, payload);
+const second = await checkDbOperation(root, { mission_id: mission.id }, payload);
+const cap = await readMadDbCapability(root, mission.id);
+assertGate(first.allowed === true && second.allowed === true, 'same canonical call should be allowed while active', { first, second });
+assertGate(first.mad_db.operation_id === second.mad_db.operation_id, 'same canonical tool_call_id must map to the same operation', { first, second });
+assertGate(second.mad_db.idempotent_reservation_reused === true, 'second reservation must be marked reused', second);
+assertGate(Boolean(cap) && cap.counters.attempts === 1 && cap.counters.reserved === 1, 'PreToolUse/PermissionRequest duplicate handling must not double-count one call', cap || {});
+emitGate('mad-db:hook-idempotency', { operation_id: first.mad_db.operation_id, counters: cap.counters });
+//# sourceMappingURL=mad-db-hook-idempotency-check.js.map

package/dist/scripts/mad-db-ledger-check.js

@@ -2,6 +2,7 @@
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const ledger = readText('src/core/mad-db/mad-db-ledger.ts');
 const cap = readText('src/core/mad-db/mad-db-capability.ts');
-assertGate(ledger.includes('mad-db-ledger.jsonl') && cap.includes('capability.consumed'), 'Mad-DB ledger must record lifecycle and consumption events');
+assertGate(ledger.includes('mad-db-ledger.jsonl') && cap.includes('mad-db-capability.closed.json'), 'Mad-DB ledger must record lifecycle and closed capability events');
+assertGate(!ledger.includes('unknown_pending_tool_result'), 'Mad-DB ledger must not use old pending-latest fallback wording');
 emitGate('mad-db:ledger', { file: 'mad-db-ledger.jsonl' });
 //# sourceMappingURL=mad-db-ledger-check.js.map

package/dist/scripts/mad-db-lifecycle-hook-decision-check.js

@@ -5,13 +5,14 @@ import os from 'node:os';
 import path from 'node:path';
 import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
+import { createMission } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-hook-decision-'));
-const missionId = 'M-mad-db-hook-decision';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const decision = await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'hook fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const decision = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'hook-decision-call-1', sql: 'insert into audit_log(id) values (1)' });
 const hook = madDbLifecycleHookFromDecision(decision);
 assertGate(decision.allowed === true && decision.mad_db?.lifecycle_result_pending === true, 'Mad-DB decision must mark pending lifecycle result', decision);
-assertGate(Boolean(hook?.mission_id === missionId && hook?.operation_id && hook?.cycle_id && hook?.tool_name), 'Mad-DB decision must expose ledger result hook', { decision, hook });
+assertGate(Boolean(hook?.mission_id === mission.id && hook?.operation_id && hook?.tool_call_id === 'hook-decision-call-1' && hook?.cycle_id && hook?.tool_name), 'Mad-DB decision must expose canonical tool_call_id ledger result hook', { decision, hook });
 emitGate('mad-db:lifecycle-hook-decision', { operation_id: hook.operation_id, cycle_id: hook.cycle_id });
 //# sourceMappingURL=mad-db-lifecycle-hook-decision-check.js.map

package/dist/scripts/mad-db-mad-command-check.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { madHighCommand } from '../core/commands/mad-sks-command.js';
+import { madHighCommand, resolveMadLaunchMadDbGrant } from '../core/commands/mad-sks-command.js';
 import { checkDbOperation } from '../core/db-safety.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const original = {
@@ -53,27 +53,29 @@ try {
     assertGate(launch?.ok === true && launch.status === 'headless-fallback', 'sks --mad fixture launch must complete headless', launch);
     const state = await readJson(path.join(tmp, '.sneakoscope', 'state', 'current.json'));
     assert.equal(state.mad_sks_active, true);
-    assert.equal(state.mad_db_active, true);
-    assert.equal(state.mad_db_grant_source, 'sks_mad_default');
-    assert.equal(state.mad_db_priority_override_active, true);
+    assert.notEqual(state.mad_db_active, true);
+    assert.notEqual(state.mad_db_grant_source, 'sks_mad_default');
+    assert.notEqual(state.mad_db_priority_override_active, true);
     const missionDir = path.join(tmp, '.sneakoscope', 'missions', state.mission_id);
-    const grants = await readJson(path.join(missionDir, 'mad-sks-launch-grants.json'));
-    const capability = await readJson(path.join(missionDir, 'mad-db-capability.json'));
-    assert.equal(grants.mad_sks_active, true);
-    assert.equal(grants.mad_db_active, true);
-    assert.equal(grants.mad_db_default_grant, true);
-    assert.equal(capability.enabled, true);
-    assert.equal(capability.one_cycle_only, true);
-    assert.equal(capability.consumed, false);
+    await assertMissing(path.join(missionDir, 'mad-db-capability.json'), 'bare sks --mad must not create a MadDB capability');
+    await assertMissing(path.join(missionDir, 'mad-sks-launch-grants.json'), 'bare sks --mad must not create MadDB grant artifacts');
     const decision = await checkDbOperation(tmp, state, {
         tool_name: 'supabase.execute_sql',
-        sql: "insert into sks_mad_db_probe(message) values ('default grant proof');"
+        tool_call_id: 'mad-sks-default-does-not-open-maddb',
+        sql: 'truncate sks_mad_db_probe;'
     });
-    assertGate(decision.allowed === true && decision.mad_db?.active === true, 'sks --mad default MAD-DB grant must satisfy DB mutation policy locally', decision);
+    assertGate(decision.allowed === false && decision.mad_db?.active !== true, 'sks --mad default must not satisfy MadDB mutation policy locally', decision);
+    const defaultGrant = resolveMadLaunchMadDbGrant([]);
+    const explicitGrant = resolveMadLaunchMadDbGrant(['--mad-db']);
+    assert.equal(defaultGrant.enabled, false);
+    assert.equal(defaultGrant.requested, false);
+    assert.equal(explicitGrant.enabled, false);
+    assert.equal(explicitGrant.requested, true);
+    assert.equal(explicitGrant.source, 'mad_db_first_class_route_required');
     emitGate('mad-db:mad-command', {
         mission_id: state.mission_id,
-        grant_source: state.mad_db_grant_source,
-        cycle_id: capability.cycle_id
+        default_mad_db_active: state.mad_db_active === true,
+        explicit_flag_source: explicitGrant.source
     });
 }
 finally {
@@ -91,6 +93,17 @@ finally {
 async function readJson(file) {
     return JSON.parse(await fs.readFile(file, 'utf8'));
 }
+async function assertMissing(file, message) {
+    try {
+        await fs.access(file);
+        assertGate(false, message, { file });
+    }
+    catch (err) {
+        if (err?.code === 'ENOENT')
+            return;
+        throw err;
+    }
+}
 function restoreEnv(key, value) {
     if (value == null)
         delete process.env[key];

package/dist/scripts/mad-db-mcp-result-lifecycle-check.js

@@ -6,25 +6,26 @@ import path from 'node:path';
 import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
 import { evaluateHookPayload } from '../core/hooks-runtime.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
-import { missionDir } from '../core/mission.js';
+import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-mcp-result-'));
-const missionId = 'M-mad-db-mcp-result';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const successPayload = { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' };
-const successDecision = await checkDbOperation(root, { mission_id: missionId }, successPayload);
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'mcp result fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const successPayload = { tool_name: 'supabase.execute_sql', tool_call_id: 'mcp-success-call', sql: 'insert into audit_log(id) values (1)' };
+const successDecision = await checkDbOperation(root, { mission_id: mission.id }, successPayload);
 const successHook = madDbLifecycleHookFromDecision(successDecision);
 assertGate(Boolean(successHook), 'Mad-DB lifecycle hook missing before post-tool success result', successDecision);
-await evaluateHookPayload('post-tool', { tool_name: successPayload.tool_name, success: true, row_count: 1 }, { root, state: { mission_id: missionId } });
-const failurePayload = { tool_name: 'supabase.execute_sql', sql: 'update audit_log set id = 2 where id = 1' };
-const failureDecision = await checkDbOperation(root, { mission_id: missionId }, failurePayload);
+await evaluateHookPayload('post-tool', { tool_name: successPayload.tool_name, tool_call_id: successHook.tool_call_id, success: true, row_count: 1 }, { root, state: { mission_id: mission.id } });
+const failurePayload = { tool_name: 'supabase.execute_sql', tool_call_id: 'mcp-failure-call', sql: 'update audit_log set id = 2 where id = 1' };
+const failureDecision = await checkDbOperation(root, { mission_id: mission.id }, failurePayload);
 const failureHook = madDbLifecycleHookFromDecision(failureDecision);
 assertGate(Boolean(failureHook), 'Mad-DB lifecycle hook missing before post-tool MCP isError result', failureDecision);
 await evaluateHookPayload('post-tool', {
     tool_name: failurePayload.tool_name,
+    tool_call_id: failureHook.tool_call_id,
     result: { isError: true, content: [{ type: 'text', text: 'fixture MCP error' }] }
-}, { root, state: { mission_id: missionId } });
-const ledger = await fs.readFile(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), 'utf8');
+}, { root, state: { mission_id: mission.id } });
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
 assertGate(ledger.includes('db_operation.succeeded') && ledger.includes('db_operation.failed') && ledger.includes('fixture MCP error'), 'PostToolUse must append succeeded and MCP isError failed lifecycle events', { ledger });
 emitGate('mad-db:mcp-result-lifecycle', { success_operation_id: successHook.operation_id, failure_operation_id: failureHook.operation_id, status: 'succeeded_and_failed_checked' });
 //# sourceMappingURL=mad-db-mcp-result-lifecycle-check.js.map

package/dist/scripts/mad-db-one-cycle-bounded-check.js

@@ -3,25 +3,22 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { closeMadDbCycle, createMadDbCapability, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { closeMadDbCycle, createMadDbCapability, isMadDbCapabilityActive, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
 import { checkDbOperation } from '../core/db-safety.js';
+import { createMission } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-bounded-'));
-const missionId = 'M-mad-db-bounded';
-process.env.SKS_MAD_DB_MAX_OPERATIONS = '2';
-const cap = await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-assertGate(cap.max_operations >= 2 && cap.operation_count === 0, 'capability must start as bounded one-cycle', cap);
-const payload = { tool_name: 'supabase.execute_sql', sql: 'update users set flag = true where id = 1' };
-const first = await checkDbOperation(root, { mission_id: missionId }, payload);
-const afterFirst = await readMadDbCapability(root, missionId);
-assertGate(first.allowed === true && afterFirst.operation_count === 1 && afterFirst.consumed === false, 'capability must remain active after operation 1 when max_operations > 1', { first, afterFirst });
-const second = await checkDbOperation(root, { mission_id: missionId }, payload);
-const afterSecond = await readMadDbCapability(root, missionId);
-assertGate(second.allowed === true && afterSecond.operation_count === 2 && afterSecond.consumed === true, 'capability must be consumed when operation_count reaches max_operations', { second, afterSecond });
-const closeMissionId = 'M-mad-db-close-cycle';
-process.env.SKS_MAD_DB_MAX_OPERATIONS = '20';
-const closeCap = await createMadDbCapability(root, { missionId: closeMissionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const closed = await closeMadDbCycle(root, closeMissionId, closeCap.cycle_id);
-assertGate(closed?.consumed === true && closed?.consumed_by === 'mad-db-cycle-close', 'explicit cycle close must consume active capability', closed);
-emitGate('mad-db:one-cycle-bounded', { cycle_id: cap.cycle_id, operation_count: afterSecond.operation_count, max_operations: afterSecond.max_operations, close_cycle: closed?.consumed === true });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'bounded fixture' });
+const cap = await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+assertGate(isMadDbCapabilityActive(cap) === true && Date.parse(cap.expires_at) > Date.now(), 'capability must start active with bounded TTL', cap);
+const payload = { tool_name: 'supabase.execute_sql', tool_call_id: 'bounded-call-1', sql: 'update users set flag = true where id = 1' };
+const first = await checkDbOperation(root, { mission_id: mission.id }, payload);
+const afterFirst = await readMadDbCapability(root, mission.id);
+assertGate(first.allowed === true && afterFirst.counters.reserved === 1 && afterFirst.status === 'active', 'capability must reserve one operation and remain active before final close', { first, afterFirst });
+const second = await checkDbOperation(root, { mission_id: mission.id }, payload);
+const afterSecond = await readMadDbCapability(root, mission.id);
+assertGate(second.allowed === true && second.mad_db?.idempotent_reservation_reused === true && afterSecond.counters.reserved === 1, 'same canonical tool_call_id must be idempotent and not double-counted', { second, afterSecond });
+const closed = await closeMadDbCycle(root, mission.id, cap.cycle_id);
+assertGate(closed?.status === 'closed' && isMadDbCapabilityActive(closed) === false, 'explicit cycle close must deactivate active capability', closed);
+emitGate('mad-db:one-cycle-bounded', { cycle_id: cap.cycle_id, reserved: afterSecond.counters.reserved, close_cycle: closed?.status === 'closed' });
 //# sourceMappingURL=mad-db-one-cycle-bounded-check.js.map

package/dist/scripts/mad-db-one-cycle-consumption-check.js

@@ -7,10 +7,10 @@ const missionMod = await importDist('core/mission.js');
 const capMod = await importDist('core/mad-db/mad-db-capability.js');
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-consume-'));
 const mission = await missionMod.createMission(root, { mode: 'mad-db', prompt: 'fixture' });
-const cap = await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root });
+const cap = await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
 await capMod.consumeMadDbCapability(root, mission.id, { consumedBy: 'fixture' });
 const consumed = await capMod.readMadDbCapability(root, mission.id);
-assertGate(capMod.isMadDbCapabilityActive(consumed) === false && consumed.consumed === true, 'Mad-DB capability must be inactive after consumption', consumed);
-assertGate(fs.existsSync(path.join(root, '.sneakoscope', 'missions', mission.id, 'mad-db-capability.consumed.json')), 'consumed proof artifact missing');
+assertGate(capMod.isMadDbCapabilityActive(consumed) === false && consumed.status === 'closed' && Boolean(consumed.closed_at), 'Mad-DB capability must be inactive after close/consumption compatibility call', consumed);
+assertGate(fs.existsSync(path.join(root, '.sneakoscope', 'missions', mission.id, 'mad-db-capability.closed.json')), 'closed proof artifact missing');
 emitGate('mad-db:one-cycle-consumption', { cycle_id: cap.cycle_id });
 //# sourceMappingURL=mad-db-one-cycle-consumption-check.js.map

package/dist/scripts/mad-db-operation-lifecycle-blackbox.js

@@ -6,21 +6,21 @@ import path from 'node:path';
 import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
 import { recordMadDbToolResult } from '../core/mad-db/mad-db-result-lifecycle.js';
-import { missionDir } from '../core/mission.js';
+import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-lifecycle-blackbox-'));
-const missionId = 'M-mad-db-lifecycle-blackbox';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const success = await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'lifecycle blackbox fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const success = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'blackbox-success-call', sql: 'insert into audit_log(id) values (1)' });
 const successHook = madDbLifecycleHookFromDecision(success);
 assertGate(Boolean(successHook), 'success hook missing', success);
-await recordMadDbToolResult({ root, missionId, hook: successHook, ok: true, rowCount: 1 });
-const failure = await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'update users set flag = true where id = 1' });
+await recordMadDbToolResult({ root, missionId: mission.id, hook: successHook, ok: true, rowCount: 1 });
+const failure = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'blackbox-failure-call', sql: 'update users set flag = true where id = 1' });
 const failureHook = madDbLifecycleHookFromDecision(failure);
 assertGate(Boolean(failureHook), 'failure hook missing', failure);
-await recordMadDbToolResult({ root, missionId, hook: failureHook, ok: false, error: 'fixture failure' });
-const ledger = await fs.readFile(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), 'utf8');
-for (const token of ['db_operation.started', 'db_operation.allowed', 'db_operation.succeeded', 'db_operation.failed']) {
+await recordMadDbToolResult({ root, missionId: mission.id, hook: failureHook, ok: false, error: 'fixture failure' });
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
+for (const token of ['db_operation.started', 'db_mutation.allowed', 'db_operation.succeeded', 'db_operation.failed']) {
     assertGate(ledger.includes(token), `Mad-DB ledger missing ${token}`, { ledger });
 }
 assertGate((ledger.match(/db_operation\.succeeded/g) || []).length === 1, 'success terminal event must be recorded exactly once', { ledger });

package/dist/scripts/mad-db-operation-lifecycle-ledger-check.js

@@ -5,13 +5,13 @@ import os from 'node:os';
 import path from 'node:path';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
 import { checkDbOperation } from '../core/db-safety.js';
-import { missionDir } from '../core/mission.js';
+import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-ledger-'));
-const missionId = 'M-mad-db-ledger';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' });
-const ledger = await fs.readFile(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), 'utf8');
-assertGate(ledger.includes('db_operation.started') && ledger.includes('db_operation.allowed') && ledger.includes('unknown_pending_tool_result'), 'Mad-DB lifecycle ledger events missing', { ledger });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'ledger fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'ledger-call-1', sql: 'insert into audit_log(id) values (1)' });
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
+assertGate(ledger.includes('db_operation.reserved') && ledger.includes('db_operation.started') && ledger.includes('db_mutation.allowed') && !ledger.includes('unknown_pending_tool_result'), 'Mad-DB lifecycle ledger events missing or pending-latest fallback still present', { ledger });
 emitGate('mad-db:operation-lifecycle-ledger');
 //# sourceMappingURL=mad-db-operation-lifecycle-ledger-check.js.map

package/dist/scripts/mad-db-parallel-lifecycle-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission } from '../core/mission.js';
+import { createMadDbCapability, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { reserveMadDbOperation, transitionMadDbOperation } from '../core/mad-db/mad-db-operation-store.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-parallel-lifecycle-'));
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'parallel lifecycle fixture' });
+const cap = await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const [first, second] = await Promise.all([
+    reserveMadDbOperation({ root, missionId: mission.id, capability: cap, toolCallId: 'parallel-call-a', toolName: 'supabase.execute_sql', sql: 'insert into fixture values (1)', operationClasses: ['insert'] }),
+    reserveMadDbOperation({ root, missionId: mission.id, capability: cap, toolCallId: 'parallel-call-b', toolName: 'supabase.execute_sql', sql: 'update fixture set id = 2', operationClasses: ['all_row_update'] })
+]);
+await Promise.all([
+    transitionMadDbOperation({ root, missionId: mission.id, toolCallId: 'parallel-call-b', state: 'failed', errorCode: 'fixture_parallel_failure' }),
+    transitionMadDbOperation({ root, missionId: mission.id, toolCallId: 'parallel-call-a', state: 'succeeded', result: { ok: true } })
+]);
+const capAfter = await readMadDbCapability(root, mission.id);
+assertGate(first.operation.operation_id !== second.operation.operation_id, 'parallel calls must not collide by tool name', { first, second });
+assertGate(Boolean(capAfter) && capAfter.counters.reserved === 2 && capAfter.counters.succeeded === 1 && capAfter.counters.failed === 1, 'parallel lifecycle counters must track exact call ids', capAfter || {});
+emitGate('mad-db:parallel-lifecycle', { first: first.operation.operation_id, second: second.operation.operation_id, counters: capAfter.counters });
+//# sourceMappingURL=mad-db-parallel-lifecycle-check.js.map

package/dist/scripts/mad-db-policy-v2-check.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { MAD_DB_POLICY, isMadDbControlPlaneDeniedTool, isMadDbSqlPlaneToolName, madDbOperationClassesFromClassification } from '../core/mad-db/mad-db-policy.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+for (const operation of ['drop', 'all_row_delete', 'truncate', 'migration_apply', 'direct_execute_sql']) {
+    assertGate(MAD_DB_POLICY.sql_plane_allowed.includes(operation), `policy missing ${operation}`, MAD_DB_POLICY);
+}
+assertGate(isMadDbSqlPlaneToolName('mcp__supabase_mad_db__execute_sql') === true, 'execute_sql variants must be SQL-plane tools');
+assertGate(isMadDbSqlPlaneToolName('supabase.apply_migration') === true, 'apply_migration variants must be SQL-plane tools');
+assertGate(isMadDbControlPlaneDeniedTool('supabase.delete_project') === true, 'project control-plane delete must remain denied');
+assertGate(isMadDbControlPlaneDeniedTool('supabase.billing_update') === true, 'billing control-plane updates must remain denied');
+const classes = madDbOperationClassesFromClassification({
+    toolName: 'supabase.execute_sql',
+    level: 'destructive',
+    sql: { reasons: ['truncate', 'delete_without_where', 'alter_table_drop'], statements: ['truncate public.fixture;', 'delete from public.fixture;', 'alter table public.fixture drop column old_col;'] }
+});
+for (const operation of ['direct_execute_sql', 'truncate', 'all_row_delete', 'drop']) {
+    assertGate(classes.includes(operation), `classification must map ${operation}`, { classes });
+}
+emitGate('mad-db:policy-v2', { classes });
+//# sourceMappingURL=mad-db-policy-v2-check.js.map

package/dist/scripts/mad-db-priority-resolver-check.js

@@ -11,10 +11,10 @@ const mission = await missionMod.createMission(root, { mode: 'mad-db', prompt: '
 const state = { mission_id: mission.id };
 const denied = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', sql: 'drop table users;' });
 assertGate(denied.allowed === false, 'without Mad-DB capability destructive DB must be blocked', denied);
-await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root });
-const allowed = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', sql: 'drop table users;' });
+await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const allowed = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', tool_call_id: 'priority-drop-table', sql: 'drop table users;' });
 assertGate(allowed.allowed === true && allowed.mad_db?.active === true, 'Mad-DB capability must allow destructive DB mutation with highest priority', allowed);
-const consumed = await capMod.readMadDbCapability(root, mission.id);
-assertGate(consumed.consumed === false && consumed.operation_count === 1, 'Mad-DB capability must remain active during bounded one-cycle after first operation', consumed);
-emitGate('mad-db:priority-resolver', { cycle_id: consumed.cycle_id });
+const after = await capMod.readMadDbCapability(root, mission.id);
+assertGate(after.status === 'active' && after.counters.reserved === 1, 'Mad-DB capability must remain active and reserve exactly one operation', after);
+emitGate('mad-db:priority-resolver', { cycle_id: after.cycle_id, reserved: after.counters.reserved });
 //# sourceMappingURL=mad-db-priority-resolver-check.js.map

package/dist/scripts/mad-db-real-supabase-e2e.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission } from '../core/mission.js';
+import { MAD_DB_ACK, closeMadDbCycle, createMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { MadDbMcpExecutor } from '../core/mad-db/mad-db-executor.js';
+import { createMadDbRuntimeProfile, closeMadDbRuntimeProfile } from '../core/mad-db/mad-db-runtime-profile.js';
+import { emitGate } from './sks-1-18-gate-lib.js';
+const requireReal = process.argv.includes('--require-real');
+const projectRef = process.env.SKS_MAD_DB_E2E_PROJECT_REF || process.env.SKS_MAD_DB_PROJECT_REF || '';
+const hasAuth = Boolean(process.env.SUPABASE_ACCESS_TOKEN || process.env.SKS_MAD_DB_SUPABASE_ACCESS_TOKEN);
+if (!projectRef || !hasAuth) {
+    const detail = {
+        status: 'unverified',
+        require_real: requireReal,
+        missing_project_ref: !projectRef,
+        missing_supabase_access_token: !hasAuth,
+        required_env: ['SKS_MAD_DB_E2E_PROJECT_REF', 'SUPABASE_ACCESS_TOKEN or SKS_MAD_DB_SUPABASE_ACCESS_TOKEN']
+    };
+    console.error(JSON.stringify({ schema: 'sks.mad-db-real-e2e.v1', ok: false, ...detail }, null, 2));
+    process.exit(requireReal ? 2 : 0);
+}
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-real-e2e-'));
+await fs.mkdir(path.join(root, '.codex'), { recursive: true });
+await fs.writeFile(path.join(root, '.codex', 'config.toml'), `[mcp_servers.supabase]\nurl = "https://mcp.supabase.com/mcp?project_ref=${projectRef}&read_only=true"\n`);
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'real disposable Supabase MadDB E2E' });
+const cycleId = `real-e2e-${Date.now().toString(36)}`;
+const profile = await createMadDbRuntimeProfile({ root, missionId: mission.id, cycleId, projectRef, runtimeSessionId: 'real-e2e-session' });
+await createMadDbCapability(root, {
+    missionId: mission.id,
+    ack: MAD_DB_ACK,
+    cwd: root,
+    cycleId,
+    projectRef,
+    runtimeSessionId: 'real-e2e-session',
+    profilePath: profile.profile_path,
+    profileSha256: profile.profile_sha256,
+    serverUrlRedacted: profile.server_url_redacted,
+    status: 'active'
+});
+const executor = new MadDbMcpExecutor(profile, { timeoutMs: Number(process.env.SKS_MAD_DB_E2E_TIMEOUT_MS || 120000) });
+const suffix = Date.now().toString(36).replace(/[^a-z0-9]/g, '');
+const table = `sks_mad_db_e2e_${suffix}`;
+const migrationName = `sks_mad_db_e2e_migration_${suffix}`;
+const steps = [
+    {
+        name: 'create_table',
+        tool: 'execute_sql',
+        sql: `create table public.${table} (id integer primary key, label text not null);`,
+        verify: `select case when to_regclass('public.${table}') is not null then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'add_column',
+        tool: 'execute_sql',
+        sql: `alter table public.${table} add column note text;`,
+        verify: `select case when exists (select 1 from information_schema.columns where table_schema='public' and table_name='${table}' and column_name='note') then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'insert',
+        tool: 'execute_sql',
+        sql: `insert into public.${table} (id, label, note) values (1, 'alpha', 'inserted');`,
+        verify: `select case when (select count(*) from public.${table}) = 1 then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'update',
+        tool: 'execute_sql',
+        sql: `update public.${table} set label = 'beta' where id = 1;`,
+        verify: `select case when exists (select 1 from public.${table} where id=1 and label='beta') then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'targeted_delete',
+        tool: 'execute_sql',
+        sql: `delete from public.${table} where id = 1;`,
+        verify: `select case when (select count(*) from public.${table}) = 0 then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'all_row_delete',
+        tool: 'execute_sql',
+        sql: `insert into public.${table} (id, label) values (2, 'two'), (3, 'three'); delete from public.${table};`,
+        verify: `select case when (select count(*) from public.${table}) = 0 then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'truncate',
+        tool: 'execute_sql',
+        sql: `insert into public.${table} (id, label) values (4, 'four'), (5, 'five'); truncate table public.${table};`,
+        verify: `select case when (select count(*) from public.${table}) = 0 then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'drop_column',
+        tool: 'execute_sql',
+        sql: `alter table public.${table} add column drop_me text; alter table public.${table} drop column drop_me;`,
+        verify: `select case when not exists (select 1 from information_schema.columns where table_schema='public' and table_name='${table}' and column_name='drop_me') then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'migration_apply',
+        tool: 'apply_migration',
+        sql: `alter table public.${table} add column migrated_flag boolean default false;`,
+        verify: `select case when exists (select 1 from information_schema.columns where table_schema='public' and table_name='${table}' and column_name='migrated_flag') then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'drop_table',
+        tool: 'execute_sql',
+        sql: `drop table public.${table};`,
+        verify: `select case when to_regclass('public.${table}') is null then 1 else 1/0 end as ok;`
+    }
+];
+const timings = [];
+const matrix = [];
+let inventory = null;
+let restoration = null;
+let failure = null;
+try {
+    inventory = await executor.inventory();
+    if (inventory.ok !== true)
+        throw failureDetail('real Supabase MCP inventory must expose execute_sql and apply_migration', inventory);
+    for (const step of steps) {
+        const started = Date.now();
+        const result = step.tool === 'apply_migration'
+            ? await executor.applyMigration(`${migrationName}_${step.name}`, step.sql)
+            : await executor.executeSql(step.sql);
+        const verify = await executor.executeSql(step.verify);
+        const elapsed = Date.now() - started;
+        timings.push(elapsed);
+        matrix.push({ name: step.name, tool: step.tool, execute_ok: result.ok, verify_ok: verify.ok, duration_ms: elapsed, result_digest: result.result_digest, verify_digest: verify.result_digest });
+        if (result.ok !== true || verify.ok !== true)
+            throw failureDetail(`real MadDB E2E step failed: ${step.name}`, matrix[matrix.length - 1]);
+    }
+}
+catch (err) {
+    failure = err?.detail || { message: err?.message || String(err) };
+}
+finally {
+    await executor.close();
+    restoration = await closeMadDbRuntimeProfile({ root, missionId: mission.id, profile, reason: 'real_e2e_finally' });
+    await closeMadDbCycle(root, mission.id, cycleId, 'real_e2e_finally');
+}
+if (failure) {
+    console.error(JSON.stringify({
+        schema: 'sks.mad-db-real-e2e.v1',
+        ok: false,
+        status: 'failed_real_supabase',
+        project_ref_hash: profile.project_ref_hash,
+        failure,
+        destructive_operation_matrix: matrix,
+        read_only_restoration: restoration
+    }, null, 2));
+    process.exit(1);
+}
+timings.sort((a, b) => a - b);
+const percentile = (p) => timings.length ? timings[Math.min(timings.length - 1, Math.floor((timings.length - 1) * p))] : 0;
+emitGate('mad-db:real-e2e', {
+    status: 'passed_real_supabase',
+    project_ref_hash: profile.project_ref_hash,
+    table_hash: table.slice(-10),
+    inventory: { execute_sql_available: inventory?.execute_sql_available === true, apply_migration_available: inventory?.apply_migration_available === true, tool_count: inventory?.tool_names?.length || 0 },
+    destructive_operation_matrix: matrix,
+    timings_ms: { p50: percentile(0.5), p95: percentile(0.95), max: timings[timings.length - 1] || 0 },
+    read_only_restoration: restoration
+});
+function failureDetail(message, detail) {
+    const err = new Error(message);
+    err.detail = { message, detail };
+    return err;
+}
+//# sourceMappingURL=mad-db-real-supabase-e2e.js.map