sneakoscope 4.1.1 → 4.2.1

package/dist/core/mad-db/mad-db-recovery.js

@@ -0,0 +1,27 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { exists, nowIso, writeJsonAtomic } from '../fsx.js';
+export async function quarantineStaleMadDbRuntimeProfiles(root) {
+    const missionsDir = path.join(root, '.sneakoscope', 'missions');
+    const quarantined = [];
+    if (!(await exists(missionsDir)))
+        return { schema: 'sks.mad-db-recovery.v1', ok: true, quarantined, checked_at: nowIso() };
+    const missions = await fs.readdir(missionsDir, { withFileTypes: true }).catch(() => []);
+    for (const mission of missions) {
+        if (!mission.isDirectory())
+            continue;
+        const runtime = path.join(missionsDir, mission.name, 'mad-db', 'runtime');
+        const profile = path.join(runtime, 'codex-mad-db.config.toml');
+        if (!(await exists(profile)))
+            continue;
+        const dest = `${profile}.quarantined-${Date.now()}`;
+        await fs.rename(profile, dest).catch(async () => {
+            await fs.rm(profile, { force: true }).catch(() => undefined);
+        });
+        quarantined.push(path.relative(root, dest).split(path.sep).join('/'));
+    }
+    const report = { schema: 'sks.mad-db-recovery.v1', ok: true, quarantined, checked_at: nowIso() };
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'mad-db-recovery.json'), report).catch(() => undefined);
+    return report;
+}
+//# sourceMappingURL=mad-db-recovery.js.map

package/dist/core/mad-db/mad-db-result-lifecycle.js

@@ -1,92 +1,59 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { appendJsonlBounded, nowIso, readJson, readText, writeJsonAtomic } from '../fsx.js';
-import { missionDir } from '../mission.js';
-import { appendMadDbOperationLifecycle } from './mad-db-ledger.js';
-const PENDING_FILE = 'mad-db-lifecycle-pending.jsonl';
-const PENDING_LATEST_FILE = 'mad-db-lifecycle-pending.latest.json';
-export async function recordPendingMadDbLifecycleHook(root, missionId, hook) {
-    const dir = missionDir(root, missionId);
-    const row = {
-        schema: 'sks.mad-db-lifecycle-pending.v1',
-        ts: nowIso(),
-        mission_id: missionId,
+import { extractCanonicalToolCallId, transitionMadDbOperation } from './mad-db-operation-store.js';
+export async function recordPendingMadDbLifecycleHook(_root, _missionId, hook) {
+    return {
+        schema: 'sks.mad-db-lifecycle-pending.v2',
+        pending_latest_removed: true,
         hook
     };
-    await appendJsonlBounded(path.join(dir, PENDING_FILE), row);
-    await writeJsonAtomic(path.join(dir, PENDING_LATEST_FILE), row).catch(() => undefined);
-    return row;
 }
-export async function readLatestPendingMadDbLifecycleHook(root, missionId, payload = {}) {
-    const dir = missionDir(root, missionId);
-    const embedded = lifecycleHookFromUnknown(payload);
-    if (embedded)
-        return embedded;
-    const latest = await readJson(path.join(dir, PENDING_LATEST_FILE), null).catch(() => null);
-    const latestHook = lifecycleHookFromUnknown(latest?.hook);
-    if (latestHook && hookMatchesPayload(latestHook, payload))
-        return latestHook;
-    const text = await readText(path.join(dir, PENDING_FILE), '').catch(() => '');
-    const rows = String(text).split(/\r?\n/).map((line) => line.trim()).filter(Boolean).reverse();
-    for (const line of rows.slice(0, 50)) {
-        try {
-            const row = JSON.parse(line);
-            const hook = lifecycleHookFromUnknown(row?.hook);
-            if (hook && hookMatchesPayload(hook, payload))
-                return hook;
-        }
-        catch {
-            // Ignore malformed pending rows.
-        }
-    }
-    return null;
+export async function readLatestPendingMadDbLifecycleHook(_root, _missionId, payload = {}) {
+    return lifecycleHookFromUnknown(payload);
 }
 export async function recordMadDbToolResult(input) {
-    const terminalType = input.ok ? 'db_operation.succeeded' : 'db_operation.failed';
-    if (await hasTerminalLifecycleEvent(input.root, input.missionId, input.hook.operation_id)) {
+    if (!input.hook.tool_call_id) {
         return {
-            schema: 'sks.mad-db-tool-result-lifecycle.v1',
-            ok: true,
+            schema: 'sks.mad-db-tool-result-lifecycle.v2',
+            ok: false,
             skipped: true,
-            reason: 'mad_db_operation_terminal_event_already_recorded',
+            reason: 'tool_call_id_required_for_result_correlation',
             operation_id: input.hook.operation_id
         };
     }
-    const event = await appendMadDbOperationLifecycle(input.root, input.missionId, {
-        type: terminalType,
-        operationId: input.hook.operation_id,
-        cycleId: input.hook.cycle_id || null,
-        mcpServer: input.hook.mcp_server || null,
-        toolName: input.hook.tool_name || null,
-        sqlHash: input.hook.sql_hash || null,
-        destructive: input.hook.destructive === true,
-        resultStatus: input.ok ? 'succeeded' : 'failed',
-        rowCount: input.rowCount ?? null,
-        error: input.error || null
+    const operation = await transitionMadDbOperation({
+        root: input.root,
+        missionId: input.missionId,
+        toolCallId: input.hook.tool_call_id,
+        state: input.ok ? 'succeeded' : 'failed',
+        result: { ok: input.ok, row_count: input.rowCount ?? null },
+        errorCode: input.ok ? null : input.error || 'tool_failed'
     });
-    await markPendingHookResolved(input.root, input.missionId, input.hook, input.ok);
     return {
-        schema: 'sks.mad-db-tool-result-lifecycle.v1',
-        ok: true,
+        schema: 'sks.mad-db-tool-result-lifecycle.v2',
+        ok: Boolean(operation),
         skipped: false,
         operation_id: input.hook.operation_id,
+        tool_call_id: input.hook.tool_call_id,
         result_status: input.ok ? 'succeeded' : 'failed',
-        event
+        operation
     };
 }
 export async function maybeRecordMadDbToolResultFromToolUse(input) {
     const payload = input.toolResult ?? input.toolCallPayload ?? {};
     const hook = lifecycleHookFromUnknown(input.decision)
         || lifecycleHookFromUnknown(input.toolCallPayload)
-        || lifecycleHookFromUnknown(input.toolResult)
-        || await readLatestPendingMadDbLifecycleHook(input.root, input.missionId, input.toolCallPayload || payload);
-    if (!hook)
+        || lifecycleHookFromUnknown(input.toolResult);
+    const toolCallId = extractCanonicalToolCallId(payload) || hook?.tool_call_id || null;
+    if (!toolCallId && !hook)
         return null;
     const ok = !madDbToolUseFailed(payload);
     return recordMadDbToolResult({
         root: input.root,
         missionId: input.missionId,
-        hook,
+        hook: hook || {
+            mission_id: input.missionId,
+            operation_id: `unknown-${toolCallId}`,
+            tool_call_id: toolCallId
+        },
         ok,
         rowCount: extractRowCount(payload),
         error: ok ? null : extractToolError(payload)
@@ -101,6 +68,7 @@ export function lifecycleHookFromUnknown(value) {
     return {
         mission_id: missionId,
         operation_id: operationId,
+        tool_call_id: stringOrNull(candidate?.tool_call_id || candidate?.toolCallId),
         cycle_id: stringOrNull(candidate?.cycle_id || candidate?.cycleId),
         tool_name: stringOrNull(candidate?.tool_name || candidate?.toolName),
         sql_hash: stringOrNull(candidate?.sql_hash || candidate?.sqlHash),
@@ -108,23 +76,6 @@ export function lifecycleHookFromUnknown(value) {
         destructive: candidate?.destructive === true
     };
 }
-function hookMatchesPayload(hook, payload) {
-    if (!hook.tool_name)
-        return true;
-    const toolText = [
-        payload.tool_name,
-        payload.toolName,
-        payload.name,
-        payload.tool?.name,
-        payload.server,
-        payload.mcp_tool,
-        payload.tool,
-        payload.type
-    ].filter(Boolean).join(' ').toLowerCase();
-    if (!toolText)
-        return true;
-    return toolText.includes(String(hook.tool_name).toLowerCase()) || String(hook.tool_name).toLowerCase().includes(toolText);
-}
 function madDbToolUseFailed(payload = {}) {
     if (payload?.isError === true || payload?.tool_response?.isError === true || payload?.toolResponse?.isError === true || payload?.result?.isError === true)
         return true;
@@ -178,28 +129,6 @@ function extractToolError(payload = {}) {
     }
     return String(payload.error || payload.message || payload.stderr || payload.tool_response?.stderr || payload.toolResponse?.stderr || payload.result?.stderr || payload.result?.error || 'tool_failed');
 }
-async function hasTerminalLifecycleEvent(root, missionId, operationId) {
-    const ledger = path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl');
-    const text = await readText(ledger, '').catch(() => '');
-    return String(text).split(/\r?\n/).some((line) => {
-        if (!line.includes(operationId))
-            return false;
-        return line.includes('db_operation.succeeded') || line.includes('db_operation.failed');
-    });
-}
-async function markPendingHookResolved(root, missionId, hook, ok) {
-    const dir = missionDir(root, missionId);
-    const row = {
-        schema: 'sks.mad-db-lifecycle-pending-resolution.v1',
-        ts: nowIso(),
-        mission_id: missionId,
-        operation_id: hook.operation_id,
-        cycle_id: hook.cycle_id || null,
-        result_status: ok ? 'succeeded' : 'failed'
-    };
-    await appendJsonlBounded(path.join(dir, 'mad-db-lifecycle-resolved.jsonl'), row).catch(() => undefined);
-    await fs.rm(path.join(dir, PENDING_LATEST_FILE), { force: true }).catch(() => undefined);
-}
 function stringOrNull(value) {
     const text = String(value || '').trim();
     return text ? text : null;

package/dist/core/mad-db/mad-db-runtime-profile.js

@@ -0,0 +1,121 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { exists, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { missionDir } from '../mission.js';
+export async function createMadDbRuntimeProfile(input) {
+    const dir = path.join(missionDir(input.root, input.missionId), 'mad-db', 'runtime');
+    await fs.mkdir(dir, { recursive: true });
+    const url = madDbMcpUrl(input.projectRef);
+    const text = [
+        '[mcp_servers.supabase_mad_db]',
+        `url = "${url}"`,
+        'enabled = true',
+        ''
+    ].join('\n');
+    const profilePath = path.join(dir, 'codex-mad-db.config.toml');
+    await writeTextAtomic(profilePath, text);
+    const profileHash = sha256(text);
+    const normalHash = await normalCodexConfigHash(input.root);
+    const profile = {
+        schema: 'sks.mad-db-runtime-profile.v1',
+        mission_id: input.missionId,
+        cycle_id: input.cycleId,
+        runtime_session_id: input.runtimeSessionId,
+        project_ref_hash: sha256(input.projectRef).slice(0, 16),
+        profile_path: path.relative(input.root, profilePath).split(path.sep).join('/'),
+        profile_sha256: profileHash,
+        server_url_redacted: redactSupabaseUrl(url),
+        server_url: url,
+        features: ['database'],
+        write_capable: true,
+        normal_config_hash_before: normalHash,
+        created_at: nowIso()
+    };
+    await writeJsonAtomic(path.join(dir, 'runtime-profile-manifest.json'), redactedRuntimeProfile(profile));
+    return profile;
+}
+export async function closeMadDbRuntimeProfile(input) {
+    const profilePath = input.profile?.profile_path ? path.join(input.root, input.profile.profile_path) : path.join(missionDir(input.root, input.missionId), 'mad-db', 'runtime', 'codex-mad-db.config.toml');
+    if (await exists(profilePath)) {
+        const quarantine = `${profilePath}.closed`;
+        await fs.rename(profilePath, quarantine).catch(async () => {
+            await fs.rm(profilePath, { force: true }).catch(() => undefined);
+        });
+    }
+    const proof = await verifyReadOnlyRestored(input.root, input.profile?.normal_config_hash_before || null, profilePath);
+    await writeJsonAtomic(path.join(missionDir(input.root, input.missionId), 'mad-db', 'runtime', 'read-only-restoration.json'), {
+        ...proof,
+        close_reason: input.reason || 'cycle_finally'
+    });
+    return proof;
+}
+export async function verifyReadOnlyRestored(root, normalConfigHashBefore, profilePath) {
+    const after = await normalCodexConfigHash(root);
+    const text = await readText(path.join(root, '.codex', 'config.toml'), '');
+    const persistentSupabaseReadOnly = persistentSupabaseConfigReadOnly(text);
+    const runtimeExists = profilePath ? await exists(profilePath) : false;
+    const blockers = [
+        ...(normalConfigHashBefore && after && normalConfigHashBefore !== after ? ['normal_codex_config_hash_changed'] : []),
+        ...(persistentSupabaseReadOnly ? [] : ['persistent_supabase_mcp_not_read_only']),
+        ...(runtimeExists ? ['runtime_write_profile_still_exists'] : [])
+    ];
+    return {
+        schema: 'sks.mad-db-read-only-restoration.v1',
+        checked_at: nowIso(),
+        ok: blockers.length === 0,
+        normal_config_hash_before: normalConfigHashBefore,
+        normal_config_hash_after: after,
+        persistent_supabase_read_only: persistentSupabaseReadOnly,
+        runtime_profile_exists: runtimeExists,
+        blockers
+    };
+}
+export function redactedRuntimeProfile(profile) {
+    const { server_url: _serverUrl, ...rest } = profile;
+    return rest;
+}
+export function madDbMcpUrl(projectRef) {
+    const params = new URLSearchParams();
+    params.set('project_ref', projectRef);
+    params.set('features', 'database');
+    return `https://mcp.supabase.com/mcp?${params.toString()}`;
+}
+export function redactSupabaseUrl(url) {
+    try {
+        const parsed = new URL(url);
+        const ref = parsed.searchParams.get('project_ref') || '';
+        if (ref)
+            parsed.searchParams.set('project_ref', `<hash:${sha256(ref).slice(0, 12)}>`);
+        for (const key of ['access_token', 'token', 'apikey', 'key', 'password']) {
+            if (parsed.searchParams.has(key))
+                parsed.searchParams.set(key, '<redacted>');
+        }
+        return parsed.toString();
+    }
+    catch {
+        return '<redacted-invalid-url>';
+    }
+}
+async function normalCodexConfigHash(root) {
+    const file = path.join(root, '.codex', 'config.toml');
+    if (!(await exists(file)))
+        return null;
+    return sha256(await readText(file, ''));
+}
+function persistentSupabaseConfigReadOnly(text) {
+    if (!/supabase|mcp\.supabase\.com/i.test(text))
+        return true;
+    const urls = [...String(text).matchAll(/https:\/\/mcp\.supabase\.com\/mcp[^"'\s)>,]*/gi)].map((match) => match[0] || '');
+    if (!urls.length)
+        return /read[_-]?only\s*=\s*true|access_mode\s*=\s*"read-only"|--read-only/.test(text);
+    return urls.every((url) => {
+        try {
+            const parsed = new URL(url);
+            return parsed.searchParams.get('read_only') === 'true';
+        }
+        catch {
+            return false;
+        }
+    });
+}
+//# sourceMappingURL=mad-db-runtime-profile.js.map

package/dist/core/mad-db/mad-db-target.js

@@ -0,0 +1,64 @@
+import path from 'node:path';
+import { exists, readText, sha256 } from '../fsx.js';
+export async function resolveMadDbTarget(root, input = {}) {
+    const args = input.args || [];
+    const explicit = input.projectRef || readOption(args, '--project-ref', '') || process.env.SKS_MAD_DB_PROJECT_REF || process.env.SKS_MAD_DB_E2E_PROJECT_REF || '';
+    const candidates = explicit ? [explicit] : await projectRefCandidates(root);
+    const projectRef = explicit || (candidates.length === 1 ? candidates[0] || '' : '');
+    const target = normalizeTarget(input.target || readOption(args, '--target', '') || process.env.SKS_MAD_DB_TARGET || process.env.SKS_MAD_DB_E2E_TARGET || 'production');
+    const allowedSchemas = input.allowedSchemas?.length
+        ? input.allowedSchemas
+        : splitCsv(readOption(args, '--schema', readOption(args, '--schemas', process.env.SKS_MAD_DB_SCHEMAS || 'public')));
+    const blockers = [];
+    if (!projectRef)
+        blockers.push(candidates.length > 1 ? 'mad_db_project_ref_ambiguous' : 'mad_db_project_ref_missing');
+    return {
+        schema: 'sks.mad-db-target.v1',
+        project_ref: projectRef || null,
+        project_ref_hash: projectRef ? sha256(projectRef).slice(0, 16) : null,
+        target_environment: target,
+        allowed_schemas: allowedSchemas.length ? allowedSchemas : ['public'],
+        source: explicit ? 'explicit_or_environment' : candidates.length === 1 ? 'managed_config_single_candidate' : 'unresolved',
+        blockers,
+        candidates: candidates.map((candidate) => `${sha256(candidate).slice(0, 8)}:${candidate.slice(0, 2)}...`)
+    };
+}
+export async function projectRootHash(root) {
+    return sha256(path.resolve(root)).slice(0, 24);
+}
+async function projectRefCandidates(root) {
+    const files = ['.codex/config.toml', '.mcp.json', 'mcp.json', '.cursor/mcp.json', '.vscode/mcp.json'];
+    const out = new Set();
+    for (const rel of files) {
+        const file = path.join(root, rel);
+        if (!(await exists(file)))
+            continue;
+        const text = await readText(file, '');
+        for (const match of String(text).matchAll(/project_ref=([a-z0-9_-]+)/gi))
+            out.add(match[1] || '');
+        for (const match of String(text).matchAll(/project_ref["']?\s*[:=]\s*["']([a-z0-9_-]+)["']/gi))
+            out.add(match[1] || '');
+    }
+    return [...out].filter(Boolean);
+}
+function normalizeTarget(value) {
+    const text = String(value || '').toLowerCase();
+    if (text === 'local')
+        return 'local';
+    if (text === 'branch')
+        return 'branch';
+    if (text === 'preview')
+        return 'preview';
+    return 'production';
+}
+function splitCsv(value) {
+    return String(value || '').split(',').map((entry) => entry.trim()).filter(Boolean);
+}
+function readOption(args, name, fallback) {
+    const index = args.indexOf(name);
+    if (index >= 0 && args[index + 1] && !String(args[index + 1]).startsWith('--'))
+        return String(args[index + 1]);
+    const prefixed = args.find((arg) => String(arg).startsWith(`${name}=`));
+    return prefixed ? prefixed.slice(name.length + 1) : fallback;
+}
+//# sourceMappingURL=mad-db-target.js.map

package/dist/core/managed-assets/managed-assets-manifest.js

@@ -1,6 +1,6 @@
 import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const MANAGED_ASSET_SCHEMA_VERSION = 1;
-export const MANAGED_ASSET_VERSION = '4.1.1';
+export const MANAGED_ASSET_VERSION = '4.2.0';
 export const MANAGED_ASSET_MARKER = 'SKS-MANAGED-ASSET';
 export const MANAGED_AGENT_ROLES = Object.freeze([
     role('sks-explorer', 'analysis-scout.toml', 'analysis_scout', 'Read-only SKS analysis scout retained for stale Codex agent-role config repair.', 'read-only', ['analysis-scout', 'analysis_scout', 'native_agent']),

package/dist/core/pipeline-internals/runtime-core.js

@@ -22,6 +22,7 @@ import { SPEED_LANE_POLICY } from '../proof-field.js';
 import { validateRouteCompletionProof } from '../proof/route-proof-gate.js';
 import { routeFromState, routeRequiresCompletionProof } from '../proof/route-proof-policy.js';
 import { permissionGateSummary } from '../permission-gates.js';
+import { prepareMadDbMission } from '../mad-db/mad-db-coordinator.js';
 import { AGENT_INTAKE_STAGE_ID, AGENT_COUNT } from '../agents/agent-schema.js';
 import { normalizeAgentPolicy, routeRequiresAgentIntake, agentPipelineStage } from '../agents/agent-plan.js';
 import { readAgentGateStatus } from '../agents/agent-gate.js';
@@ -458,6 +459,8 @@ export function promptPipelineContext(prompt, route = null) {
         lines.push('AutoResearch route: load autoresearch-loop plus seo-geo-optimizer when SEO/GEO, discoverability, README, npm, GitHub stars, ranking, or AI-search visibility is relevant.');
     if (route?.id === 'DB')
         lines.push('DB route: scan/check database risk first; destructive DB operations remain forbidden.');
+    if (route?.id === 'MadDB')
+        lines.push('MadDB route: explicit invocation is the SQL-plane approval boundary. Use the mission-local write-capable Supabase MCP profile only for the bound cycle, verify execute_sql/apply_migration inventory before claiming ready, execute requested SQL-plane mutations, read back postconditions, then close the capability/profile and prove normal read-only restoration. Supabase project/account/billing/credential control-plane actions remain denied.');
     if (route?.id === 'GX')
         lines.push('GX route: use deterministic vgraph/beta render, validate, drift, and snapshot artifacts.');
     return lines.join('\n');
@@ -517,6 +520,8 @@ export async function prepareRoute(root, prompt, state = {}) {
         return withSkillDreamContext(await prepareGoal(root, route, task, routeNeedsContext7(route, cleanPrompt)), dreamContext);
     if (route.id === 'ImageUXReview')
         return withSkillDreamContext(await prepareImageUxReview(root, route, task, routeNeedsContext7(route, cleanPrompt)), dreamContext);
+    if (route.id === 'MadDB')
+        return withSkillDreamContext(await prepareMadDb(root, route, task, routeNeedsContext7(route, cleanPrompt)), dreamContext);
     const required = routeNeedsContext7(route, cleanPrompt);
     const reasoning = routeReasoning(route, cleanPrompt);
     const nativeSessionsRequired = routeRequiresSubagents(route, cleanPrompt);
@@ -1111,6 +1116,41 @@ async function prepareDb(root, route, task, required) {
     await setCurrent(root, routeState(id, route, 'DB_REVIEW_REQUIRED', required, { prompt: task, pipeline_plan_ready: validatePipelinePlan(pipelinePlan).ok, pipeline_plan_path: PIPELINE_PLAN_ARTIFACT }));
     return routeContext(route, id, task, required, 'Run sks db policy/scan/check as needed, keep DB operations read-only, record safe MCP policy, and pass db-review.json.');
 }
+async function prepareMadDb(root, route, task, required) {
+    const prepared = await prepareMadDbMission({ root, task, verifyTools: false });
+    const dir = missionDir(root, prepared.mission_id);
+    const pipelinePlan = await writePipelinePlan(dir, {
+        missionId: prepared.mission_id,
+        route,
+        task,
+        required,
+        ambiguity: { required: true, slots: 0, auto_sealed: true, passed: true, contract_hash: prepared.capability.operator_intent_hash }
+    });
+    await appendJsonl(path.join(dir, 'events.jsonl'), {
+        ts: nowIso(),
+        type: 'mad_db.route_prepared',
+        mission_id: prepared.mission_id,
+        cycle_id: prepared.cycle_id,
+        blockers: prepared.blockers
+    });
+    await setCurrent(root, routeState(prepared.mission_id, route, prepared.ok ? 'MADDB_SQL_PLANE_CAPABILITY_ACTIVE' : 'MADDB_BLOCKED', required, {
+        prompt: task,
+        questions_allowed: false,
+        implementation_allowed: prepared.ok,
+        ambiguity_gate_required: true,
+        ambiguity_gate_passed: true,
+        mad_db_active: prepared.ok,
+        mad_db_cycle_id: prepared.cycle_id,
+        mad_db_runtime_session_id: prepared.capability.runtime_session_id,
+        mad_db_profile_sha256: prepared.capability.transport.profile_sha256,
+        mad_db_capability_mission_id: prepared.mission_id,
+        mad_db_capability_file: 'mad-db-capability.json',
+        stop_gate: 'mad-db-gate.json',
+        pipeline_plan_ready: validatePipelinePlan(pipelinePlan).ok,
+        pipeline_plan_path: PIPELINE_PLAN_ARTIFACT
+    }));
+    return routeContext(route, prepared.mission_id, task, required, `MadDB mission/capability/profile were created atomically for cycle ${prepared.cycle_id}. Verify Supabase MCP tool inventory exposes execute_sql and apply_migration before claiming ready; after execution require read-back proof, finally close the profile/capability and prove read-only restoration.`);
+}
 async function prepareGx(root, route, task, required) {
     const { id, dir } = await createMission(root, { mode: 'gx', prompt: task });
     await writeJsonAtomic(path.join(dir, 'gx-gate.json'), { passed: false, vgraph_beta_render: false, validation: false, drift_snapshot: false, context7_evidence: false });

package/dist/core/providers/glm/bench/glm-benchmark-types.js

@@ -1,2 +1,2 @@
-export const GLM_BENCHMARK_VERSION = '4.1.1';
+export const GLM_BENCHMARK_VERSION = '4.2.0';
 //# sourceMappingURL=glm-benchmark-types.js.map

package/dist/core/qa-loop/qa-app-server-driver.js

@@ -0,0 +1,134 @@
+import path from 'node:path';
+import { appendJsonlBounded, nowIso, writeJsonAtomic } from '../fsx.js';
+import { QA_ACTION_LEDGER_ARTIFACT, QA_LIVE_SESSION_ARTIFACT, QA_RUNTIME_EVENT_LEDGER_ARTIFACT } from './qa-types.js';
+export async function runQaAppServerDriver(input) {
+    const events = [];
+    const dispose = input.client.onEvent?.((event) => {
+        events.push(event);
+    });
+    const startedAt = nowIso();
+    const blockers = [];
+    let threadId = null;
+    let turnId = null;
+    try {
+        await input.client.initialize?.();
+        const thread = await input.client.startThread({
+            cwd: input.cwd,
+            ...input.threadStartParams
+        });
+        threadId = extractThreadId(thread);
+        if (!threadId)
+            blockers.push('app_server_thread_id_missing');
+        if (threadId) {
+            const turn = await input.client.startTurn({
+                threadId,
+                cwd: input.cwd,
+                input: [{ type: 'text', text: input.prompt }],
+                ...input.turnStartParams
+            });
+            turnId = extractTurnId(turn);
+            if (!turnId)
+                blockers.push('app_server_turn_id_missing');
+            if (input.client.waitForTurnCompletion) {
+                const completed = await input.client.waitForTurnCompletion(threadId, turnId, input.timeoutMs);
+                events.push({ method: 'turn/completed', params: completed, received_at: nowIso() });
+            }
+        }
+    }
+    catch (err) {
+        blockers.push(`app_server_driver_failed:${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        dispose?.();
+    }
+    await writeAppServerEventLedgers(input.missionDir, input.missionId, input.surfaceSelection.selected_surface, threadId, turnId, events);
+    const session = {
+        schema: 'sks.qa-loop-live-session.v2',
+        started_at: startedAt,
+        completed_at: nowIso(),
+        mission_id: input.missionId,
+        status: blockers.length ? 'blocked' : 'completed',
+        selected_surface: input.surfaceSelection.selected_surface,
+        thread_id: threadId,
+        turn_id: turnId,
+        event_count: events.length,
+        item_event_count: events.filter(isItemEvent).length,
+        action_event_count: events.filter(isActionLikeEvent).length,
+        observation_event_count: events.filter(isObservationLikeEvent).length,
+        blockers,
+        unverified: events.some(isActionLikeEvent) ? [] : ['app_server_action_event_unverified'],
+        artifacts: {
+            runtime_events: QA_RUNTIME_EVENT_LEDGER_ARTIFACT,
+            action_ledger: QA_ACTION_LEDGER_ARTIFACT
+        }
+    };
+    await writeJsonAtomic(path.join(input.missionDir, QA_LIVE_SESSION_ARTIFACT), session);
+    return session;
+}
+async function writeAppServerEventLedgers(missionDir, missionId, surface, threadId, turnId, events) {
+    for (const event of events) {
+        const method = String(event.method || event.type || event.params?.method || 'app_server_event');
+        await appendJsonlBounded(path.join(missionDir, QA_RUNTIME_EVENT_LEDGER_ARTIFACT), {
+            schema: 'sks.qa-loop-app-server-event.v2',
+            ts: nowIso(),
+            mission_id: missionId,
+            thread_id: event.params?.threadId || event.threadId || threadId,
+            turn_id: event.params?.turnId || event.params?.turn?.id || event.turnId || turnId,
+            item_id: event.params?.itemId || event.params?.item?.id || event.itemId || null,
+            surface,
+            kind: method,
+            status: 'observed',
+            data: redactEvent(event)
+        });
+        if (isActionLikeEvent(event)) {
+            await appendJsonlBounded(path.join(missionDir, QA_ACTION_LEDGER_ARTIFACT), {
+                schema: 'sks.qa-loop-action.v2',
+                ts: nowIso(),
+                mission_id: missionId,
+                thread_id: event.params?.threadId || event.threadId || threadId,
+                turn_id: event.params?.turnId || event.params?.turn?.id || event.turnId || turnId,
+                item_id: event.params?.itemId || event.params?.item?.id || event.itemId || null,
+                surface,
+                kind: method,
+                status: 'observed',
+                real: true,
+                data: redactEvent(event)
+            });
+        }
+    }
+}
+function extractThreadId(value) {
+    const obj = value;
+    return stringOrNull(obj?.thread?.id || obj?.threadId || obj?.id);
+}
+function extractTurnId(value) {
+    const obj = value;
+    return stringOrNull(obj?.turn?.id || obj?.turnId || obj?.id);
+}
+function stringOrNull(value) {
+    const text = String(value || '').trim();
+    return text || null;
+}
+function isItemEvent(event) {
+    return /^item\//.test(String(event.method || event.type || ''));
+}
+function isActionLikeEvent(event) {
+    const method = String(event.method || event.type || '');
+    return /^item\/.*(?:tool|action|commandExecution|computer|browser|chrome)/i.test(method)
+        || /(?:tool|action|click|type|scroll|navigate|screenshot|observation)/i.test(JSON.stringify(event.params || event));
+}
+function isObservationLikeEvent(event) {
+    const method = String(event.method || event.type || '');
+    return /observation|completed|screenshot|browser|chrome|computer/i.test(method)
+        || /observation|screenshot|visual|page|window/i.test(JSON.stringify(event.params || event));
+}
+function redactEvent(event) {
+    return JSON.parse(JSON.stringify(event, (key, value) => {
+        if (/(password|passwd|token|secret|cookie|authorization|credential)/i.test(String(key)))
+            return '[REDACTED]';
+        if (typeof value === 'string' && /(Bearer\s+[A-Za-z0-9._-]+|sk-[A-Za-z0-9_-]+)/.test(value))
+            return '[REDACTED]';
+        return value;
+    }));
+}
+//# sourceMappingURL=qa-app-server-driver.js.map