sneakoscope 4.1.1 → 4.2.1

package/dist/core/mad-db/mad-db-executor.js

@@ -0,0 +1,156 @@
+import { performance } from 'node:perf_hooks';
+import { nowIso, sha256 } from '../fsx.js';
+export class MadDbMcpExecutor {
+    profile;
+    opts;
+    client = null;
+    transport = null;
+    constructor(profile, opts = {}) {
+        this.profile = profile;
+        this.opts = opts;
+    }
+    async connect() {
+        if (this.client)
+            return;
+        const { Client, StreamableHTTPClientTransport } = await loadMcpSdk();
+        this.client = new Client({ name: 'sneakoscope-mad-db', version: '4.2.0' });
+        const headers = authHeaders();
+        const options = headers ? { requestInit: { headers } } : {};
+        this.transport = new StreamableHTTPClientTransport(new URL(this.profile.server_url), options);
+        await this.client.connect(this.transport);
+    }
+    async inventory() {
+        const started = performance.now();
+        try {
+            await this.connect();
+            const result = await this.client.listTools({}, { timeout: this.opts.timeoutMs || 10_000 });
+            const names = (result.tools || []).map((tool) => String(tool?.name || '')).filter(Boolean).sort();
+            return {
+                schema: 'sks.mad-db-tool-inventory.v1',
+                checked_at: nowIso(),
+                ok: hasTool(names, 'execute_sql') && hasTool(names, 'apply_migration'),
+                tool_names: names,
+                execute_sql_available: hasTool(names, 'execute_sql'),
+                apply_migration_available: hasTool(names, 'apply_migration'),
+                duration_ms: Math.round(performance.now() - started),
+                error_digest: null
+            };
+        }
+        catch (err) {
+            return {
+                schema: 'sks.mad-db-tool-inventory.v1',
+                checked_at: nowIso(),
+                ok: false,
+                tool_names: [],
+                execute_sql_available: false,
+                apply_migration_available: false,
+                duration_ms: Math.round(performance.now() - started),
+                error_digest: sha256(redactError(err)).slice(0, 32)
+            };
+        }
+    }
+    async executeSql(sql) {
+        return this.callToolWithFallback(['execute_sql', 'supabase.execute_sql'], [{ query: sql }, { sql }]);
+    }
+    async applyMigration(name, sql) {
+        return this.callToolWithFallback(['apply_migration', 'supabase.apply_migration'], [{ name, query: sql }, { name, sql }]);
+    }
+    async close() {
+        await this.transport?.terminateSession().catch(() => undefined);
+        await this.client?.close().catch(() => undefined);
+        this.client = null;
+        this.transport = null;
+    }
+    async callToolWithFallback(toolNames, argsList) {
+        await this.connect();
+        const inventory = await this.inventory();
+        const tool = toolNames.find((name) => hasTool(inventory.tool_names, name)) || toolNames[0] || '';
+        let lastError = null;
+        for (const args of argsList) {
+            const started = performance.now();
+            try {
+                const result = await this.client.callTool({ name: tool, arguments: args }, undefined, { timeout: this.opts.timeoutMs || 60_000, resetTimeoutOnProgress: true, maxTotalTimeout: 10 * 60_000 });
+                return {
+                    schema: 'sks.mad-db-tool-result.v1',
+                    ok: result.isError !== true,
+                    tool_name: tool,
+                    result_digest: sha256(JSON.stringify(redactToolResult(result))).slice(0, 32),
+                    row_count: extractRowCount(result),
+                    is_error: result.isError === true,
+                    duration_ms: Math.round(performance.now() - started)
+                };
+            }
+            catch (err) {
+                lastError = err;
+            }
+        }
+        return {
+            schema: 'sks.mad-db-tool-result.v1',
+            ok: false,
+            tool_name: tool,
+            result_digest: sha256(redactError(lastError)).slice(0, 32),
+            row_count: null,
+            is_error: true,
+            duration_ms: 0
+        };
+    }
+}
+async function loadMcpSdk() {
+    const dynamicImport = new Function('specifier', 'return import(specifier)');
+    const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([
+        dynamicImport('@modelcontextprotocol/sdk/client/index.js'),
+        dynamicImport('@modelcontextprotocol/sdk/client/streamableHttp.js')
+    ]);
+    return { Client, StreamableHTTPClientTransport };
+}
+function hasTool(names, name) {
+    return names.some((candidate) => candidate === name || candidate.endsWith(`.${name}`) || candidate.endsWith(`__${name}`));
+}
+function authHeaders() {
+    const token = process.env.SUPABASE_ACCESS_TOKEN || process.env.SKS_MAD_DB_SUPABASE_ACCESS_TOKEN || '';
+    if (!token)
+        return undefined;
+    return { Authorization: `Bearer ${token}` };
+}
+function redactError(err) {
+    const text = err instanceof Error ? `${err.name}:${err.message}` : String(err);
+    return text.replace(/(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi, '$1<redacted>').replace(/(token|password|secret|apikey)=([^&\s]+)/gi, '$1=<redacted>');
+}
+function redactToolResult(value) {
+    if (value == null)
+        return value;
+    if (typeof value === 'string')
+        return value.replace(/(token|password|secret|apikey)["'=:\s]+[A-Za-z0-9._~+/=-]+/gi, '$1=<redacted>');
+    if (Array.isArray(value))
+        return value.map(redactToolResult);
+    if (typeof value === 'object') {
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (/token|password|secret|apikey|service_role/i.test(key))
+                out[key] = '<redacted>';
+            else if (/rows|data|records/i.test(key) && Array.isArray(entry))
+                out[key] = `<redacted:${entry.length}:rows>`;
+            else
+                out[key] = redactToolResult(entry);
+        }
+        return out;
+    }
+    return value;
+}
+function extractRowCount(value) {
+    const candidates = [
+        value?.row_count,
+        value?.rowCount,
+        value?.rows_affected,
+        value?.structuredContent?.row_count,
+        value?.structuredContent?.rowCount,
+        value?.structuredContent?.rows_affected
+    ];
+    for (const candidate of candidates) {
+        const n = Number(candidate);
+        if (Number.isFinite(n))
+            return n;
+    }
+    return null;
+}
+//# sourceMappingURL=mad-db-executor.js.map

package/dist/core/mad-db/mad-db-ledger.js

@@ -23,7 +23,7 @@ export async function appendMadDbOperationLifecycle(root, missionId, input) {
         tool_name: input.toolName || null,
         sql_hash: input.sqlHash || null,
         destructive: input.destructive === true,
-        result_status: input.resultStatus || 'unknown_pending_tool_result',
+        result_status: input.resultStatus || 'pending_tool_result',
         row_count: input.rowCount ?? null,
         error: input.error || null
     });

package/dist/core/mad-db/mad-db-lock.js

@@ -0,0 +1,40 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { missionDir } from '../mission.js';
+export async function withMadDbLock(root, missionId, name, fn) {
+    const dir = path.join(missionDir(root, missionId), 'mad-db', 'runtime', 'locks');
+    await ensureDir(dir);
+    const lockDir = path.join(dir, `${safeName(name)}.lock`);
+    const deadline = Date.now() + 10_000;
+    while (true) {
+        try {
+            await fs.mkdir(lockDir);
+            await writeJsonAtomic(path.join(lockDir, 'owner.json'), {
+                schema: 'sks.mad-db-lock.v1',
+                pid: process.pid,
+                name,
+                acquired_at: nowIso()
+            });
+            break;
+        }
+        catch (err) {
+            if (Date.now() > deadline)
+                throw new Error(`mad_db_lock_timeout:${name}`);
+            await sleep(25 + Math.floor(Math.random() * 25));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await fs.rm(lockDir, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function safeName(value) {
+    return value.replace(/[^a-z0-9_.-]+/gi, '_').slice(0, 80) || 'lock';
+}
+//# sourceMappingURL=mad-db-lock.js.map

package/dist/core/mad-db/mad-db-operation-store.js

@@ -0,0 +1,140 @@
+import path from 'node:path';
+import { ensureDir, nowIso, readJson, sha256, writeJsonAtomic } from '../fsx.js';
+import { missionDir } from '../mission.js';
+import { appendMadDbLedgerEvent } from './mad-db-ledger.js';
+import { withMadDbLock } from './mad-db-lock.js';
+import { updateMadDbCapabilityCounters } from './mad-db-capability.js';
+export async function reserveMadDbOperation(input) {
+    return withMadDbLock(input.root, input.missionId, `operation-${safeKey(input.toolCallId)}`, async () => {
+        const file = operationFile(input.root, input.missionId, input.toolCallId);
+        const existing = await readJson(file, null);
+        if (existing?.schema === 'sks.mad-db-operation.v2') {
+            return { operation: existing, reused: true, capability: input.capability };
+        }
+        const operationId = `mad-db-op-${sha256(`${input.missionId}:${input.capability.cycle_id}:${input.toolCallId}`).slice(0, 16)}`;
+        const operation = {
+            schema: 'sks.mad-db-operation.v2',
+            operation_id: operationId,
+            tool_call_id: input.toolCallId,
+            mission_id: input.missionId,
+            cycle_id: input.capability.cycle_id,
+            project_ref_hash: sha256(input.capability.project_ref).slice(0, 16),
+            tool_name: input.toolName,
+            sql_sha256: input.sql ? sha256(input.sql) : null,
+            migration_name: input.migrationName || null,
+            operation_classes: input.operationClasses,
+            state: 'reserved',
+            attempt: 1,
+            started_at: null,
+            finished_at: null,
+            result_digest: null,
+            verification_artifact: null,
+            error_code: null
+        };
+        await ensureDir(path.dirname(file));
+        await writeJsonAtomic(file, operation);
+        const capability = await updateMadDbCapabilityCounters(input.root, input.missionId, {
+            attemptsDelta: 1,
+            reservedDelta: 1
+        });
+        await appendMadDbLedgerEvent(input.root, input.missionId, {
+            type: 'db_operation.reserved',
+            operation_id: operation.operation_id,
+            tool_call_id: operation.tool_call_id,
+            cycle_id: operation.cycle_id,
+            tool_name: operation.tool_name,
+            sql_sha256: operation.sql_sha256,
+            operation_classes: operation.operation_classes
+        });
+        return { operation, reused: false, capability: capability || input.capability };
+    });
+}
+export async function transitionMadDbOperation(input) {
+    return withMadDbLock(input.root, input.missionId, `operation-${safeKey(input.toolCallId)}`, async () => {
+        const file = operationFile(input.root, input.missionId, input.toolCallId);
+        const existing = await readJson(file, null);
+        if (!existing)
+            return null;
+        const terminalSuccess = input.state === 'succeeded' || input.state === 'verified';
+        const terminalFailure = input.state === 'failed' || input.state === 'verification_failed' || input.state === 'unknown';
+        const updated = {
+            ...existing,
+            state: input.state,
+            started_at: existing.started_at || (input.state === 'started' ? nowIso() : existing.started_at),
+            finished_at: terminalSuccess || terminalFailure ? nowIso() : existing.finished_at,
+            result_digest: input.result === undefined ? existing.result_digest : sha256(safeResultDigestInput(input.result)).slice(0, 32),
+            verification_artifact: input.verificationArtifact || existing.verification_artifact,
+            error_code: input.errorCode || existing.error_code
+        };
+        await writeJsonAtomic(file, updated);
+        if (input.state === 'succeeded')
+            await updateMadDbCapabilityCounters(input.root, input.missionId, { succeededDelta: 1 });
+        if (input.state === 'failed')
+            await updateMadDbCapabilityCounters(input.root, input.missionId, { failedDelta: 1 });
+        await appendMadDbLedgerEvent(input.root, input.missionId, {
+            type: `db_operation.${input.state}`,
+            operation_id: updated.operation_id,
+            tool_call_id: updated.tool_call_id,
+            cycle_id: updated.cycle_id,
+            tool_name: updated.tool_name,
+            result_digest: updated.result_digest,
+            verification_artifact: updated.verification_artifact,
+            error_code: updated.error_code
+        });
+        return updated;
+    });
+}
+export function extractCanonicalToolCallId(payload = {}) {
+    const candidates = [
+        payload.tool_call_id,
+        payload.toolCallId,
+        payload.call_id,
+        payload.callId,
+        payload.id,
+        payload.request_id,
+        payload.requestId,
+        payload.tool?.id,
+        payload.tool?.call_id,
+        payload.metadata?.tool_call_id,
+        payload.context?.tool_call_id
+    ];
+    const found = candidates.find((value) => typeof value === 'string' && value.trim());
+    return found ? String(found).trim() : null;
+}
+export function operationFile(root, missionId, toolCallId) {
+    return path.join(missionDir(root, missionId), 'mad-db', 'runtime', 'operations', `${safeKey(toolCallId)}.json`);
+}
+function safeKey(value) {
+    return sha256(value).slice(0, 24);
+}
+function safeResultDigestInput(value) {
+    try {
+        return JSON.stringify(redactSensitive(value));
+    }
+    catch {
+        return String(value);
+    }
+}
+function redactSensitive(value, depth = 0) {
+    if (depth > 8 || value == null)
+        return value;
+    if (typeof value === 'string') {
+        return value.replace(/(access_token|refresh_token|password|apikey|service_role|secret)["'=:\s]+[A-Za-z0-9._~+/=-]+/gi, '$1=<redacted>');
+    }
+    if (Array.isArray(value))
+        return value.map((entry) => redactSensitive(entry, depth + 1));
+    if (typeof value === 'object') {
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (/token|password|secret|apikey|service_role/i.test(key))
+                out[key] = '<redacted>';
+            else if (/rows|data|records/i.test(key) && Array.isArray(entry))
+                out[key] = `<redacted:${entry.length}:rows>`;
+            else
+                out[key] = redactSensitive(entry, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=mad-db-operation-store.js.map

package/dist/core/mad-db/mad-db-policy-resolver.js

@@ -1,30 +1,56 @@
-import { readMadDbCapability, isMadDbCapabilityActive } from './mad-db-capability.js';
-export const MAD_DB_POLICY_DECISION_SCHEMA = 'sks.mad-db-policy-decision.v1';
-export async function resolveMadDbMutationPolicy(root, state = {}, classification = {}) {
-    const missionId = state?.mission_id ? String(state.mission_id) : null;
+import { isMadDbCapabilityActive, readMadDbCapability } from './mad-db-capability.js';
+import { activeMadDbAllowsSqlPlane, isMadDbControlPlaneDeniedTool, madDbOperationClassesFromClassification } from './mad-db-policy.js';
+import { sha256 } from '../fsx.js';
+export const MAD_DB_POLICY_DECISION_SCHEMA = 'sks.mad-db-policy-decision.v2';
+export async function resolveMadDbMutationPolicy(root, state = {}, classification = {}, explicitCapability) {
+    const missionId = explicitCapability?.mission_id || state?.mad_db_capability_mission_id || state?.mission_id;
     if (!missionId)
         return inactive('mission_id_missing');
-    const capability = await readMadDbCapability(root, missionId);
-    if (!isMadDbCapabilityActive(capability))
-        return inactive(capability?.consumed ? 'mad_db_capability_consumed' : 'mad_db_capability_inactive');
-    if (!isDbMutationOrDbTool(classification))
-        return inactive('not_a_database_mutation');
+    const capability = explicitCapability || await readMadDbCapability(root, String(missionId));
+    const validation = validateCapabilityBinding(capability, state, classification);
+    if (!validation.ok)
+        return inactive(validation.reason);
+    if (isMadDbControlPlaneDeniedTool(classification.toolName || classification.tool_name))
+        return inactive('mad_db_control_plane_tool_denied');
+    if (!activeMadDbAllowsSqlPlane(classification))
+        return inactive('not_a_database_sql_plane_mutation');
     return {
         schema: MAD_DB_POLICY_DECISION_SCHEMA,
         allowed: true,
         action: 'allow',
-        mode: 'mad-db-break-glass',
+        mode: 'mad-db-sql-plane-active',
         priority: 0,
         priority_order: ['mad-db', 'mad-sks', 'sealed-contract', 'default-db-safety'],
-        reasons: ['mad_db_one_cycle_break_glass_capability_active'],
+        reasons: ['mad_db_capability_v2_bound_sql_plane_authorized'],
         audit_required: true,
-        mission_id: missionId,
+        mission_id: capability.mission_id,
         cycle_id: capability.cycle_id,
-        operation_count: capability.operation_count || 0,
-        max_operations: capability.max_operations || 20,
+        runtime_session_id: capability.runtime_session_id,
+        project_ref_hash: hashRef(capability.project_ref),
+        operation_classes: madDbOperationClassesFromClassification(classification),
+        counters: capability.counters,
         capability
     };
 }
+export function validateCapabilityBinding(capability, state = {}, classification = {}) {
+    if (!capability)
+        return { ok: false, reason: 'mad_db_capability_missing' };
+    if (!isMadDbCapabilityActive(capability))
+        return { ok: false, reason: `mad_db_capability_${capability.status || 'inactive'}` };
+    if (!capability.project_ref)
+        return { ok: false, reason: 'mad_db_project_ref_missing' };
+    if (state?.mission_id && String(state.mission_id) !== capability.mission_id)
+        return { ok: false, reason: 'mad_db_mission_binding_mismatch' };
+    if (state?.mad_db_cycle_id && String(state.mad_db_cycle_id) !== capability.cycle_id)
+        return { ok: false, reason: 'mad_db_cycle_binding_mismatch' };
+    if (state?.mad_db_runtime_session_id && String(state.mad_db_runtime_session_id) !== capability.runtime_session_id)
+        return { ok: false, reason: 'mad_db_runtime_session_binding_mismatch' };
+    if (state?.mad_db_profile_sha256 && String(state.mad_db_profile_sha256) !== capability.transport.profile_sha256)
+        return { ok: false, reason: 'mad_db_profile_hash_mismatch' };
+    if (classification.toolReasons?.includes?.('dangerous_supabase_management_tool'))
+        return { ok: false, reason: 'mad_db_control_plane_tool_denied' };
+    return { ok: true, reason: 'ok' };
+}
 function inactive(reason) {
     return {
         schema: MAD_DB_POLICY_DECISION_SCHEMA,
@@ -36,13 +62,7 @@ function inactive(reason) {
         audit_required: false
     };
 }
-function isDbMutationOrDbTool(classification = {}) {
-    if (classification.level === 'write' || classification.level === 'destructive')
-        return true;
-    if (classification.toolReasons?.includes?.('database_tool'))
-        return true;
-    if (classification.toolReasons?.includes?.('migration_apply_tool'))
-        return true;
-    return false;
+function hashRef(projectRef) {
+    return sha256(projectRef).slice(0, 16);
 }
 //# sourceMappingURL=mad-db-policy-resolver.js.map

package/dist/core/mad-db/mad-db-policy.js

@@ -0,0 +1,195 @@
+export const MAD_DB_POLICY_SCHEMA = 'sks.mad-db-policy.v2';
+export const MAD_DB_OPERATION_CLASSES = [
+    'create',
+    'alter',
+    'drop',
+    'drop_database_sql',
+    'insert',
+    'update',
+    'delete',
+    'all_row_update',
+    'all_row_delete',
+    'truncate',
+    'migration_apply',
+    'direct_execute_sql',
+    'rls_policy_change',
+    'function_or_trigger_change',
+    'index_change',
+    'unknown_sql_mutation'
+];
+export const MAD_DB_SQL_PLANE_TOOL_NAMES = Object.freeze([
+    'execute_sql',
+    'apply_migration',
+    'supabase.execute_sql',
+    'supabase.apply_migration',
+    'mcp__supabase__execute_sql',
+    'mcp__supabase__apply_migration',
+    'supabase_mad_db.execute_sql',
+    'supabase_mad_db.apply_migration',
+    'mcp__supabase_mad_db__execute_sql',
+    'mcp__supabase_mad_db__apply_migration'
+]);
+export const MAD_DB_CONTROL_PLANE_DENIED_TOOL_PATTERNS = Object.freeze([
+    'delete_project',
+    'pause_project',
+    'restore_project',
+    'create_project',
+    'list_organizations',
+    'get_organization',
+    'billing',
+    'organization',
+    'credential',
+    'access_token',
+    'service_role',
+    'delete_branch',
+    'reset_branch',
+    'merge_branch'
+]);
+export const MAD_DB_POLICY = Object.freeze({
+    schema: MAD_DB_POLICY_SCHEMA,
+    default_mode: 'deny_mutations',
+    active_mode: {
+        sql_plane: 'allow_all_mutations',
+        control_plane: 'deny',
+        requires: [
+            'capability_v2',
+            'project_binding',
+            'session_binding',
+            'write_transport_ready',
+            'not_expired'
+        ]
+    },
+    sql_plane_allowed: MAD_DB_OPERATION_CLASSES,
+    sql_plane_tools: MAD_DB_SQL_PLANE_TOOL_NAMES,
+    control_plane_denied: MAD_DB_CONTROL_PLANE_DENIED_TOOL_PATTERNS,
+    normal_supabase_mcp: {
+        read_only_required: true,
+        project_ref_required: true
+    },
+    runtime_profile: {
+        mission_local_only: true,
+        read_only_omitted_only_for_active_capability: true,
+        features: ['database']
+    },
+    ttl: {
+        default_ms: 15 * 60 * 1000,
+        hard_max_ms: 30 * 60 * 1000
+    }
+});
+export function madDbPolicySnapshot() {
+    return MAD_DB_POLICY;
+}
+export function isMadDbSqlPlaneToolName(toolName) {
+    const normalized = normalizeToolName(toolName);
+    if (!normalized)
+        return false;
+    return MAD_DB_SQL_PLANE_TOOL_NAMES.some((name) => normalized.endsWith(normalizeToolName(name)) || normalized.includes(normalizeToolName(name)));
+}
+export function isMadDbControlPlaneDeniedTool(toolName) {
+    const normalized = normalizeToolName(toolName);
+    if (!normalized)
+        return false;
+    return MAD_DB_CONTROL_PLANE_DENIED_TOOL_PATTERNS.some((pattern) => normalized.includes(normalizeToolName(pattern)));
+}
+export function normalizeToolName(toolName) {
+    return String(toolName || '')
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9_.-]+/g, '_');
+}
+export function madDbOperationClassesFromClassification(classification = {}) {
+    const reasons = new Set([
+        ...stringArray(classification.reasons),
+        ...stringArray(classification.sql?.reasons),
+        ...stringArray(classification.command?.reasons),
+        ...stringArray(classification.toolReasons)
+    ]);
+    const out = new Set();
+    const toolName = classification.toolName || classification.tool_name || '';
+    if (isMadDbSqlPlaneToolName(toolName))
+        out.add('direct_execute_sql');
+    if (reasons.has('migration_apply_tool') || reasons.has('supabase_migration_apply'))
+        out.add('migration_apply');
+    if (hasAny(reasons, ['drop_database']))
+        out.add('drop_database_sql');
+    if (hasAny(reasons, ['drop_schema', 'drop_table', 'drop_view', 'drop_materialized_view', 'drop_extension', 'drop_policy', 'drop_statement', 'alter_table_drop']))
+        out.add('drop');
+    if (hasAny(reasons, ['truncate']))
+        out.add('truncate');
+    if (hasAny(reasons, ['insert_or_upsert']))
+        out.add('insert');
+    if (hasAny(reasons, ['update_with_where']))
+        out.add('update');
+    if (hasAny(reasons, ['update_without_where']))
+        out.add('all_row_update');
+    if (hasAny(reasons, ['delete_with_where']))
+        out.add('delete');
+    if (hasAny(reasons, ['delete_without_where']))
+        out.add('all_row_delete');
+    if (hasAny(reasons, ['schema_change', 'alter_table_rename']))
+        out.add('alter');
+    if (hasAny(reasons, ['create_or_replace']))
+        out.add('function_or_trigger_change');
+    const statements = stringArray(classification.sql?.statements);
+    for (const statement of statements) {
+        const normalized = statement.trim().toLowerCase();
+        if (/^create\s+(table|schema|view|materialized\s+view)/.test(normalized))
+            out.add('create');
+        if (/^create\s+(index|unique\s+index)/.test(normalized))
+            out.add('index_change');
+        if (/^drop\s+index/.test(normalized))
+            out.add('index_change');
+        if (/policy|row\s+level\s+security|rls/.test(normalized))
+            out.add('rls_policy_change');
+        if (/function|trigger|procedure/.test(normalized))
+            out.add('function_or_trigger_change');
+    }
+    if (!out.size && ['write', 'destructive', 'possible_db'].includes(String(classification.level || '')))
+        out.add('unknown_sql_mutation');
+    return [...out];
+}
+export function activeMadDbAllowsSqlPlane(classification = {}) {
+    const toolName = classification.toolName || classification.tool_name || '';
+    if (isMadDbControlPlaneDeniedTool(toolName))
+        return false;
+    if (classification.toolReasons?.includes?.('dangerous_supabase_management_tool'))
+        return false;
+    if (isMadDbSqlPlaneToolName(toolName))
+        return true;
+    return ['write', 'destructive', 'possible_db'].includes(String(classification.level || ''));
+}
+export function madDbSkillText(commandPrefix = 'sks') {
+    return `---
+name: mad-db
+description: First-class MadDB SQL-plane execution route for explicit $MAD-DB and ${commandPrefix} mad-db run|exec|apply-migration.
+---
+
+Use only when the operator explicitly invokes $MAD-DB/$mad-db or ${commandPrefix} mad-db run|exec|apply-migration. This is the single approval boundary for the active MadDB cycle: execute SQL-plane mutations that the operator requested, including CREATE, ALTER, table/schema DROP, column add/drop/rename, INSERT, UPDATE, DELETE including all-row mutations, TRUNCATE, execute_sql, and apply_migration. Do not ask again for each DROP/TRUNCATE/all-row DELETE inside the same bound cycle.
+
+Keep normal Supabase MCP configuration read-only. MadDB must create a mission-local ephemeral write-capable Supabase MCP profile bound to capability v2, project_ref, root, mission, thread/session, intent, runtime profile hash, TTL, and SQL-plane operation classes. Verify execute_sql and apply_migration availability before claiming readiness. Require actual tool results plus independent read-back verification before claiming success. Close/revoke the capability and runtime profile in finally and prove read-only restoration.
+
+Still deny Supabase account/project/billing/credential control-plane actions, credential exfiltration, unrelated storage/edge-function/admin changes, persistent security weakening, and unrequested fallback implementation. Pair with db-safety-guard, Context7 evidence for MCP/API docs, route-local reflection, and Honest Mode.`;
+}
+export function dbSafetyGuardSkillText() {
+    return `---
+name: db-safety-guard
+description: Enforce Sneakoscope Codex database safety before using SQL, Supabase MCP, Postgres, Prisma, Drizzle, Knex, or migration commands.
+---
+
+Rules:
+- Default mode is read-only: do not run DROP, TRUNCATE, mass DELETE/UPDATE, db reset, db push, project deletion, branch reset/merge/delete, or RLS-disabling operations.
+- Supabase MCP must be read-only and project-scoped by default.
+- Live execute_sql writes are blocked unless a bound active MadDB capability v2 is present.
+- Active MadDB is the explicit exception: SQL-plane mutations requested by $MAD-DB or sks mad-db run|exec|apply-migration are allowed and must be executed with read-back verification.
+- Supabase project/account/billing/credential control-plane actions remain denied even in MadDB.
+- If no active bound MadDB cycle exists, fall back to read-only only.`;
+}
+function stringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.map((entry) => String(entry || '')).filter(Boolean);
+}
+function hasAny(values, keys) {
+    return keys.some((key) => values.has(key));
+}
+//# sourceMappingURL=mad-db-policy.js.map

package/dist/core/mad-db/mad-db-postconditions.js

@@ -0,0 +1,30 @@
+import path from 'node:path';
+import { nowIso, sha256, writeJsonAtomic } from '../fsx.js';
+import { missionDir } from '../mission.js';
+export async function runReadBackChecks(input) {
+    const rows = [];
+    for (const check of input.checks) {
+        const result = await input.executor.executeSql(check.query);
+        rows.push({
+            id: check.id,
+            query_sha256: sha256(check.query),
+            ok: result.ok === (check.expectOk ?? true),
+            result_digest: result.result_digest,
+            row_count: result.row_count
+        });
+    }
+    const proof = {
+        schema: 'sks.mad-db-read-back-proof.v1',
+        generated_at: nowIso(),
+        ok: rows.every((row) => row.ok),
+        checks: rows,
+        raw_rows_recorded: false
+    };
+    const proofPath = path.join(missionDir(input.root, input.missionId), 'mad-db', 'read-back-proof.json');
+    await writeJsonAtomic(proofPath, proof);
+    return { ...proof, proof_path: path.relative(input.root, proofPath).split(path.sep).join('/') };
+}
+export function readBackCheck(id, query) {
+    return { id, query, expectOk: true };
+}
+//# sourceMappingURL=mad-db-postconditions.js.map