sneakoscope 4.2.0 → 4.3.0

package/dist/scripts/qa-loop-app-server-driver-check.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { runQaAppServerDriver } from '../core/qa-loop/qa-app-server-driver.js';
+import { selectQaSurface } from '../core/qa-loop/qa-surface-router.js';
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-qa-app-server-driver-'));
+const calls = [];
+const fakeClient = {
+    listeners: [],
+    async initialize() {
+        calls.push('initialize');
+    },
+    onEvent(listener) {
+        this.listeners.push(listener);
+        return () => {
+            this.listeners = this.listeners.filter((item) => item !== listener);
+        };
+    },
+    async startThread(params) {
+        calls.push(['thread/start', params]);
+        const event = { method: 'thread/started', params: { threadId: 'thread-qa-driver', thread: { id: 'thread-qa-driver' } } };
+        this.listeners.forEach((listener) => listener(event));
+        return { thread: { id: 'thread-qa-driver' }, cwd: params.cwd };
+    },
+    async startTurn(params) {
+        calls.push(['turn/start', params]);
+        this.listeners.forEach((listener) => listener({ method: 'turn/started', params: { threadId: params.threadId, turn: { id: 'turn-qa-driver' } } }));
+        this.listeners.forEach((listener) => listener({
+            method: 'item/tool/call',
+            params: {
+                threadId: params.threadId,
+                turnId: 'turn-qa-driver',
+                itemId: 'item-click-1',
+                tool: '@Browser',
+                action: 'click',
+                cookie: 'secret-cookie-value'
+            }
+        }));
+        return { turn: { id: 'turn-qa-driver' } };
+    },
+    async waitForTurnCompletion(threadId, turnId) {
+        calls.push(['wait', { threadId, turnId }]);
+        return { threadId, turnId, status: 'completed' };
+    }
+};
+const surface = selectQaSurface({ missionId: 'M-qa-driver', targetUrl: 'http://localhost:3000', prompt: 'local Browser QA' });
+const session = await runQaAppServerDriver({
+    missionDir: tmp,
+    missionId: 'M-qa-driver',
+    client: fakeClient,
+    cwd: process.cwd(),
+    prompt: '@Browser open http://localhost:3000 and click Save',
+    surfaceSelection: surface,
+    timeoutMs: 500
+});
+assertGate(session.status === 'completed', 'QA App Server driver fake session must complete', session);
+assertGate(session.thread_id === 'thread-qa-driver', 'thread id must be correlated', session);
+assertGate(session.turn_id === 'turn-qa-driver', 'turn id must be correlated', session);
+assertGate(session.action_event_count >= 1, 'action-like tool event must be counted', session);
+const runtimeEvents = await fs.readFile(path.join(tmp, 'qa-loop', 'runtime-events.jsonl'), 'utf8');
+const actionLedger = await fs.readFile(path.join(tmp, 'qa-loop', 'action-ledger.jsonl'), 'utf8');
+assertGate(runtimeEvents.includes('thread-qa-driver') && runtimeEvents.includes('turn-qa-driver'), 'runtime events must include thread/turn IDs', runtimeEvents);
+assertGate(actionLedger.includes('item-click-1'), 'action ledger must include item id', actionLedger);
+assertGate(!runtimeEvents.includes('secret-cookie-value') && !actionLedger.includes('secret-cookie-value'), 'driver must redact cookie/token-like fields from artifacts');
+emitGate('qa-loop:app-server-driver', {
+    calls: calls.map((call) => Array.isArray(call) ? call[0] : call),
+    action_event_count: session.action_event_count,
+    event_count: session.event_count,
+    redaction: true
+});
+//# sourceMappingURL=qa-loop-app-server-driver-check.js.map

package/dist/scripts/qa-loop-surface-router-check.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildQaContractV2 } from '../core/qa-loop/qa-contract-v2.js';
+import { evaluateQaGateV2 } from '../core/qa-loop/qa-gate-v2.js';
+import { initializeQaRuntimeArtifacts } from '../core/qa-loop/qa-runtime-artifacts.js';
+import { selectQaSurface } from '../core/qa-loop/qa-surface-router.js';
+const cases = [
+    ['localhost no auth chooses Browser', selectQaSurface({ targetUrl: 'http://localhost:3000/settings', prompt: 'test local web settings' }).selected_surface, 'codex_in_app_browser'],
+    ['public no auth chooses Browser', selectQaSurface({ targetUrl: 'https://example.com', prompt: 'public marketing page QA' }).selected_surface, 'codex_in_app_browser'],
+    ['signed-in browser state chooses Chrome', selectQaSurface({ targetUrl: 'https://example.com/app', prompt: 'verify logged-in cookie profile flow' }).selected_surface, 'codex_chrome_extension'],
+    ['extension-dependent site chooses Chrome', selectQaSurface({ targetUrl: 'https://example.com', prompt: 'browser extension dependent QA' }).selected_surface, 'codex_chrome_extension'],
+    ['native macOS GUI chooses Computer Use', selectQaSurface({ prompt: 'native macOS Settings GUI bug' }).selected_surface, 'codex_computer_use'],
+    ['native Windows GUI chooses Computer Use', selectQaSurface({ prompt: 'Windows desktop app dialog bug' }).selected_surface, 'codex_computer_use'],
+    ['structured data without UI chooses MCP', selectQaSurface({ prompt: 'Gmail data sync check', uiRequired: false, targetKind: 'structured_data' }).selected_surface, 'structured_mcp']
+];
+for (const [label, actual, expected] of cases) {
+    assertGate(actual === expected, `${label}: expected ${expected}, got ${actual}`, { actual, expected });
+}
+const contract = buildQaContractV2({
+    prompt: 'QA local settings form at http://localhost:3000',
+    answers: {
+        QA_SCOPE: 'ui_e2e_only',
+        TARGET_BASE_URL: 'http://localhost:3000',
+        LOGIN_REQUIRED: 'no',
+        MAX_QA_CYCLES: ''
+    }
+}, { missionId: 'M-router-check' });
+assertGate(contract.runtime.max_cycles === 5, 'QA contract v2 default max cycles must be 5', contract.runtime);
+assertGate(contract.mutation.source_code_patch_policy === 'enabled', 'safe local source fixes must default on unless report-only', contract.mutation);
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-qa-router-'));
+await initializeQaRuntimeArtifacts(tmp, contract, { missionId: 'M-router-check' });
+let gate = await evaluateQaGateV2(tmp);
+assertGate(gate.passed === false, 'UI-required QA cannot pass with zero real actions', gate);
+assertGate(gate.blockers.includes('ui_required_but_real_action_count_zero'), 'zero-action blocker missing', gate);
+await fs.appendFile(path.join(tmp, 'qa-loop', 'action-ledger.jsonl'), `${JSON.stringify({ schema: 'sks.qa-loop-action.v2', status: 'completed', real: true, journey_fingerprint: 'J', kind: 'click' })}\n`);
+await fs.appendFile(path.join(tmp, 'qa-loop', 'observation-ledger.jsonl'), `${JSON.stringify({ schema: 'sks.qa-loop-observation.v2', status: 'observed', real: true, journey_fingerprint: 'J', kind: 'visual_delta' })}\n`);
+gate = await evaluateQaGateV2(tmp);
+assertGate(gate.real_action_count === 1 && gate.observation_count === 1, 'real action and observation ledgers must be counted', gate);
+emitGate('qa-loop:surface-router', {
+    matrix_cases: cases.length,
+    default_max_cycles: contract.runtime.max_cycles,
+    zero_action_blocked: true,
+    selected_surface: contract.target.kind
+});
+//# sourceMappingURL=qa-loop-surface-router-check.js.map

package/dist/scripts/release-check-dynamic-execute.js

@@ -60,7 +60,7 @@ for (const gate of plan.selected) {
         continue;
     }
     const command = `npm run ${gate.id}`;
-    if (FORBIDDEN_RECURSIVE_GATES.has(gate.id) || /npm\s+run\s+(release:check|release:real-check|release:publish|publish:npm|publish:dry|prepublishOnly)\b/.test(command)) {
+    if (FORBIDDEN_RECURSIVE_GATES.has(gate.id) || /npm\s+run\s+(release:check|release:real-check|release:publish|publish:ignore-scripts|publish:npm|publish:dry|prepublishOnly)\b/.test(command)) {
         failures.push({ id: gate.id, exit_code: null, stdout_tail: '', stderr_tail: 'forbidden_recursive_gate_spawn' });
         continue;
     }

package/dist/scripts/release-metadata-1-19-check.js

@@ -21,7 +21,7 @@ const requiredDocs = [
     'README.md',
     'CHANGELOG.md',
     'docs/source-intelligence-layer.md',
-    'docs/xai-context7-codex-web-policy.md',
+    'docs/ultra-search-source-intelligence-policy.md',
     'docs/main-no-scout-worker-scout-policy.md',
     'docs/agent-terminal-lanes.md',
     'docs/migration/tmux-to-zellij.md',
@@ -97,7 +97,7 @@ const requiredScripts = [
     'agent:janitor',
     'agent:multi-project-isolation',
     'verification:parallel-engine',
-    'xai-mcp:capability',
+    'ultra-search:provider-interface',
     'source-intelligence:policy',
     'source-intelligence:all-modes',
     'codex-web:adapter',

package/dist/scripts/release-parallel-check.js

@@ -34,10 +34,25 @@ const tasks = [
     task('agent:janitor', 'npm run agent:janitor --silent', { dependencies: ['build'] }),
     task('agent:multi-project-isolation', 'npm run agent:multi-project-isolation --silent', { dependencies: ['build'] }),
     task('verification:parallel-engine', 'npm run verification:parallel-engine --silent', { dependencies: ['build'] }),
-    task('xai-mcp:capability', 'npm run xai-mcp:capability --silent', { dependencies: ['build'] }),
+    task('ultra-search:provider-interface', 'npm run ultra-search:provider-interface --silent', { dependencies: ['build'] }),
     task('source-intelligence:policy', 'npm run source-intelligence:policy --silent', { dependencies: ['build'] }),
-    task('source-intelligence:all-modes', 'npm run source-intelligence:all-modes --silent', { dependencies: ['build', 'source-intelligence:policy', 'xai-mcp:capability', 'codex-web:adapter'] }),
+    task('source-intelligence:all-modes', 'npm run source-intelligence:all-modes --silent', { dependencies: ['build', 'source-intelligence:policy', 'ultra-search:provider-interface', 'codex-web:adapter'] }),
     task('codex-web:adapter', 'npm run codex-web:adapter --silent', { dependencies: ['build'] }),
+    task('seo:cli-blackbox', 'npm run seo:cli-blackbox --silent', { dependencies: ['build'] }),
+    task('seo:audit-fixture', 'npm run seo:audit-fixture --silent', { dependencies: ['build'] }),
+    task('seo:no-mutation-by-default', 'npm run seo:no-mutation-by-default --silent', { dependencies: ['build'] }),
+    task('seo:mutation-rollback', 'npm run seo:mutation-rollback --silent', { dependencies: ['build'] }),
+    task('seo:canonical-sitemap-locale', 'npm run seo:canonical-sitemap-locale --silent', { dependencies: ['build'] }),
+    task('seo:structured-data-visible-content', 'npm run seo:structured-data-visible-content --silent', { dependencies: ['build'] }),
+    task('geo:cli-blackbox', 'npm run geo:cli-blackbox --silent', { dependencies: ['build'] }),
+    task('geo:claim-evidence', 'npm run geo:claim-evidence --silent', { dependencies: ['build'] }),
+    task('geo:crawler-purpose-policy', 'npm run geo:crawler-purpose-policy --silent', { dependencies: ['build'] }),
+    task('geo:llms-txt-optional', 'npm run geo:llms-txt-optional --silent', { dependencies: ['build'] }),
+    task('seo-geo:route-identity', 'npm run seo-geo:route-identity --silent', { dependencies: ['build'] }),
+    task('seo-geo:geo-disambiguation', 'npm run seo-geo:geo-disambiguation --silent', { dependencies: ['build'] }),
+    task('seo-geo:skill-rich-content', 'npm run seo-geo:skill-rich-content --silent', { dependencies: ['build'] }),
+    task('seo-geo:no-unsupported-ranking-claims', 'npm run seo-geo:no-unsupported-ranking-claims --silent', { dependencies: ['build'] }),
+    task('seo-geo:feature-fixture-quality', 'npm run seo-geo:feature-fixture-quality --silent', { dependencies: ['build'] }),
     task('doctor:codex-doctor-parity', 'npm run doctor:codex-doctor-parity --silent', { dependencies: ['build'] }),
     task('codex:permission-profiles', 'npm run codex:permission-profiles --silent', { dependencies: ['build'] }),
     task('codex:legacy-profile-consumers-removed', 'npm run codex:legacy-profile-consumers-removed --silent', { dependencies: ['build'] }),

package/dist/scripts/release-parallel-full-coverage-check.js

@@ -6,7 +6,7 @@ import { assertGate, emitGate, importDist, packageScripts, root } from './sks-1-
 const mod = await importDist('core/release-parallel-full-coverage.js');
 const pkgScripts = packageScripts();
 const parallelSource = fs.readFileSync(path.join(root, 'src/scripts/release-parallel-check.ts'), 'utf8');
-const current = [...new Set(Object.keys(pkgScripts).filter((name) => parallelSource.includes(name)).concat(Object.keys(pkgScripts).filter((name) => /^xai-mcp|^source-intelligence|^codex-web|^goal-mode|^agent:main-no-scout|^agent:worker-scout-limited|^agent:background-terminals|^agent:zellij-runtime|^agent:visual-consistency|^release:parallel-full-coverage|^priority:full-closure/.test(name))))];
+const current = [...new Set(Object.keys(pkgScripts).filter((name) => parallelSource.includes(name)).concat(Object.keys(pkgScripts).filter((name) => /^ultra-search|^source-intelligence|^codex-web|^goal-mode|^agent:main-no-scout|^agent:worker-scout-limited|^agent:background-terminals|^agent:zellij-runtime|^agent:visual-consistency|^release:parallel-full-coverage|^priority:full-closure/.test(name))))];
 const report = mod.evaluateReleaseParallelFullCoverage(current);
 assertGate(report.ok === true, 'release parallel DAG must preserve previous gates and include 1.18 gates', report);
 emitGate('release:parallel-full-coverage', { previous_gate_count: report.previous_gate_count, current_gate_count: report.current_gate_count });

package/dist/scripts/release-readiness-report.js

@@ -103,7 +103,7 @@ const checks = {
     computer_use_live_evidence: scriptContains('release:check', 'computer-use:live-evidence'),
     docs_truthfulness: scriptContains('release:check', 'docs:truthfulness'),
     release_readiness: scriptContains('release:check:parallel', 'release:readiness'),
-    xai_mcp_capability: scriptContains('release:check:parallel', 'xai-mcp:capability'),
+    ultra_search_provider_interface: scriptContains('release:check:parallel', 'ultra-search:provider-interface'),
     source_intelligence_policy: scriptContains('release:check:parallel', 'source-intelligence:policy'),
     source_intelligence_all_modes: scriptContains('release:check:parallel', 'source-intelligence:all-modes'),
     codex_web_adapter: scriptContains('release:check:parallel', 'codex-web:adapter'),
@@ -318,7 +318,7 @@ for (const [name, ok] of Object.entries({
     verification_parallel_engine: checks.verification_parallel_engine,
     release_metadata: checks.release_metadata,
     release_readiness: checks.release_readiness,
-    xai_mcp_capability: checks.xai_mcp_capability,
+    ultra_search_provider_interface: checks.ultra_search_provider_interface,
     source_intelligence_policy: checks.source_intelligence_policy,
     source_intelligence_all_modes: checks.source_intelligence_all_modes,
     codex_web_adapter: checks.codex_web_adapter,
@@ -809,13 +809,13 @@ const report = {
         flagship_proof_graph_v4_report_ok: runtimeChecks.flagship_proof_graph_v4
     },
     source_intelligence_1_18: {
-        status: checks.xai_mcp_capability
+        status: checks.ultra_search_provider_interface
             && checks.source_intelligence_policy
             && checks.source_intelligence_all_modes
             && checks.codex_web_adapter ? 'present' : 'missing',
-        mode_default: 'context7_codex_web',
-        xai_when_available: checks.xai_mcp_capability,
-        xai_missing_fallback: checks.source_intelligence_all_modes,
+        mode_default: 'ultra_balanced',
+        x_search_public_discovery: checks.ultra_search_provider_interface,
+        no_xai_runtime_dependency: checks.source_intelligence_all_modes,
         codex_web_adapter: checks.codex_web_adapter
     },
     agent_terminal_zellij_1_18: {

package/dist/scripts/release-registry-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -27,7 +26,7 @@ function readJson(file) {
         return JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
     }
     catch (err) {
-        fail(`unable to read ${file}`, err.message);
+        fail(`unable to read ${file}`, err instanceof Error ? err.message : String(err));
     }
 }
 function run(cmd, args, options = {}) {
@@ -58,17 +57,23 @@ function checkPackagePublishConfig(pkg) {
     if (isPrerelease && pkg.publishConfig?.tag !== 'rc') {
         fail('package.json publishConfig.tag must be rc for prerelease versions', `found: ${pkg.publishConfig?.tag || 'missing'}\nversion: ${pkg.version}`);
     }
-    if (!isPrerelease && pkg.publishConfig?.tag && pkg.publishConfig.tag !== 'latest') {
-        fail('package.json publishConfig.tag must be latest or omitted for stable versions', `found: ${pkg.publishConfig.tag}\nversion: ${pkg.version}`);
+    if (!isPrerelease && pkg.publishConfig?.tag && pkg.publishConfig.tag !== 'latest' && !isBackfillTag(pkg.publishConfig.tag)) {
+        fail('package.json publishConfig.tag must be latest, omitted, or explicit backfill-* for stable backfill versions', `found: ${pkg.publishConfig.tag}\nversion: ${pkg.version}`);
     }
 }
 function checkRootNpmrc(pkg) {
     const npmrcPath = path.join(root, '.npmrc');
-    if (!fs.existsSync(npmrcPath))
+    const publishConfigTag = String(pkg.publishConfig?.tag || '');
+    if (!fs.existsSync(npmrcPath)) {
+        if (isBackfillTag(publishConfigTag)) {
+            fail('root .npmrc must pin the backfill publish tag for npm publish --ignore-scripts', `expected: tag=${publishConfigTag}`);
+        }
         return;
+    }
     const text = fs.readFileSync(npmrcPath, 'utf8');
     const unsafe = [];
     const isPrerelease = /-/.test(String(pkg.version || ''));
+    let npmrcTag = '';
     for (const [index, line] of text.split(/\r?\n/).entries()) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';'))
@@ -78,16 +83,23 @@ function checkRootNpmrc(pkg) {
             unsafe.push(`${index + 1}: ${trimmed}`);
         const tagMatch = trimmed.match(/^tag\s*=\s*(.+)$/);
         if (tagMatch) {
-            const tag = tagMatch[1].trim();
+            const tag = String(tagMatch[1] || '').trim();
+            npmrcTag = tag;
             if (isPrerelease && tag !== 'rc')
                 unsafe.push(`${index + 1}: ${trimmed}`);
-            if (!isPrerelease && tag !== 'latest')
+            if (!isPrerelease && tag !== 'latest' && !isBackfillTag(tag))
                 unsafe.push(`${index + 1}: ${trimmed}`);
         }
     }
     if (unsafe.length) {
         fail('root .npmrc contains publish config incompatible with this release', unsafe.join('\n'));
     }
+    if (publishConfigTag && npmrcTag && publishConfigTag !== npmrcTag) {
+        fail('root .npmrc tag disagrees with package.json publishConfig.tag', `.npmrc tag: ${npmrcTag}\npublishConfig.tag: ${publishConfigTag}`);
+    }
+    if (isBackfillTag(publishConfigTag) && npmrcTag !== publishConfigTag) {
+        fail('root .npmrc must pin the backfill publish tag for npm publish --ignore-scripts', `.npmrc tag: ${npmrcTag || 'missing'}\nexpected: ${publishConfigTag}`);
+    }
 }
 function checkLockfile(pkg) {
     const lock = readJson('package-lock.json');
@@ -147,8 +159,10 @@ function compareVersions(a, b) {
     const pb = String(b || '').split(/[.-]/).map((part) => Number.parseInt(part, 10));
     const len = Math.max(pa.length, pb.length);
     for (let i = 0; i < len; i += 1) {
-        const da = Number.isFinite(pa[i]) ? pa[i] : 0;
-        const db = Number.isFinite(pb[i]) ? pb[i] : 0;
+        const paValue = pa[i];
+        const pbValue = pb[i];
+        const da = Number.isFinite(paValue) ? paValue || 0 : 0;
+        const db = Number.isFinite(pbValue) ? pbValue || 0 : 0;
         if (da !== db)
             return da > db ? 1 : -1;
     }
@@ -193,14 +207,17 @@ function checkPublishedVersion(pkg) {
         fail('package version is already published on npm', `${pkg.name}@${pkg.version}`);
     }
     const cmp = compareVersions(pkg.version, latest);
-    if (requireUnpublished && cmp <= 0) {
+    if (requireUnpublished && cmp <= 0 && !isBackfillTag(pkg.publishConfig?.tag || '')) {
         fail('package version is not newer than the npm latest dist-tag', `package.json: ${pkg.version}\nnpm latest: ${latest}`);
     }
     const note = exactPublished
         ? `exact version already exists; current npm latest is ${latest}`
-        : (cmp > 0 ? `ready for new publish over npm latest ${latest}` : `current npm latest is ${latest}`);
+        : (cmp > 0 ? `ready for new publish over npm latest ${latest}` : `ready as backfill over current npm latest ${latest} with tag ${pkg.publishConfig?.tag || 'missing'}`);
     console.log(`Registry metadata check passed: ${pkg.name}@${pkg.version}; ${note}.`);
 }
+function isBackfillTag(value) {
+    return /^backfill(?:[-_][a-z0-9.-]+)?$/i.test(String(value || ''));
+}
 function checkPublishAuth(pkg) {
     if (skipNetwork) {
         fail('publish auth check cannot run when SKS_SKIP_REGISTRY_NETWORK_CHECK=1 is set');
@@ -324,8 +341,10 @@ function packageMaintainers(pkg, env) {
 function normalizeNpmUser(value) {
     if (!value)
         return '';
-    if (typeof value === 'object')
-        return normalizeNpmUser(value.name || value.username || '');
+    if (typeof value === 'object') {
+        const record = value;
+        return normalizeNpmUser(record.name || record.username || '');
+    }
     const text = String(value).trim();
     if (/^["[{]/.test(text)) {
         try {
@@ -335,7 +354,7 @@ function normalizeNpmUser(value) {
             // Fall through for legacy plain-text npm output.
         }
     }
-    return text.replace(/^@/, '').split(/\s+/)[0].toLowerCase();
+    return String(text.replace(/^@/, '').split(/\s+/)[0] || '').toLowerCase();
 }
 function tail(value, limit = 1200) {
     const text = String(value || '').trim();

package/dist/scripts/runtime-ts-rust-boundary-check.js

@@ -13,7 +13,7 @@ import { root, assertGate, emitGate, importDist, readText, readJson } from './sk
 assertGate(!/cargo|rustc/.test(readText('src/scripts/build-dist.ts')), 'build-dist must not invoke cargo/rustc');
 assertGate(!/cargo|rustc/.test(readText('src/scripts/clean-dist.ts')), 'clean-dist must not invoke cargo/rustc');
 const pkg = readJson('package.json');
-for (const s of ['prepack', 'prepublishOnly', 'publish:dry', 'publish:npm']) {
+for (const s of ['prepack', 'prepublishOnly', 'publish:dry', 'publish:ignore-scripts', 'publish:npm']) {
     assertGate(!String(pkg.scripts?.[s] || '').includes('cargo'), `publish_script_compiles_rust:${s}`);
 }
 // 2) The published binary is JS; no prebuilt native artifact is shipped or required.

package/dist/scripts/search-visibility-gate-lib.js

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+export { assertGate, emitGate, root };
+export function makeSearchVisibilityFixture(name = 'search-visibility', options = {}) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), `sks-${name}-`));
+    fs.mkdirSync(path.join(dir, 'public'), { recursive: true });
+    fs.mkdirSync(path.join(dir, 'bin'), { recursive: true });
+    const packageJson = {
+        name: `sks-${name}-fixture`,
+        version: '0.0.0',
+        description: options.description || 'Source-backed search visibility fixture for Sneakoscope gates.',
+        keywords: ['sneakoscope', 'search-visibility'],
+        repository: { type: 'git', url: 'https://example.test/repo.git' },
+        homepage: 'https://example.test/',
+        bugs: { url: 'https://example.test/issues' },
+        bin: { [`${name}-fixture`]: 'bin/fixture.js' },
+        scripts: { build: 'node -e "console.log(1)"' },
+    };
+    fs.writeFileSync(path.join(dir, 'package.json'), `${JSON.stringify(packageJson, null, 2)}\n`);
+    fs.writeFileSync(path.join(dir, 'bin', 'fixture.js'), '#!/usr/bin/env node\nconsole.log("fixture")\n');
+    fs.writeFileSync(path.join(dir, 'README.md'), `# ${options.title || 'Search Visibility Fixture'}\n\nInstall with \`npm i\` and run \`${name}-fixture\`.\n`);
+    fs.writeFileSync(path.join(dir, 'public', 'index.html'), options.html || [
+        '<!doctype html>',
+        '<html lang="en">',
+        '<head><meta charset="utf-8"><title>Search Visibility Fixture</title><meta name="description" content="A source-backed fixture."></head>',
+        '<body><main><h1>Search Visibility Fixture</h1><p>Official source-backed content.</p><a href="/docs">Docs</a></main></body>',
+        '</html>',
+        '',
+    ].join('\n'));
+    return dir;
+}
+export function runSks(args, options = {}) {
+    const result = spawnSync(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), ...args], {
+        cwd: root,
+        encoding: 'utf8',
+        stdio: 'pipe',
+        env: {
+            ...process.env,
+            SKS_REQUIRE_ZELLIJ: '0',
+            SKS_TEST_REAL_IMAGEGEN: '0',
+            SKS_REAL_IMAGEGEN: '0',
+            SKS_REQUIRE_REAL_COMPUTER_USE: '0',
+            ...(options.env || {}),
+        },
+        timeout: options.timeoutMs || 120000,
+    });
+    if (!options.allowFailure) {
+        assertGate(result.status === 0, `sks command failed: ${args.join(' ')}`, {
+            status: result.status,
+            stdout: result.stdout,
+            stderr: result.stderr,
+        });
+    }
+    return result;
+}
+export function runSksJson(args, options = {}) {
+    const result = runSks(args, options);
+    const parsed = parseJsonOutput(result.stdout);
+    assertGate(parsed && typeof parsed === 'object', `sks command did not emit JSON: ${args.join(' ')}`, {
+        status: result.status,
+        stdout: result.stdout,
+        stderr: result.stderr,
+    });
+    return { result, json: parsed };
+}
+export function parseJsonOutput(stdout) {
+    const text = String(stdout || '').trim();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch { }
+    const start = text.indexOf('{');
+    const end = text.lastIndexOf('}');
+    if (start >= 0 && end > start) {
+        try {
+            return JSON.parse(text.slice(start, end + 1));
+        }
+        catch { }
+    }
+    return null;
+}
+export function missionDir(missionId, baseRoot = root) {
+    return path.join(baseRoot, '.sneakoscope', 'missions', missionId);
+}
+export function artifactPath(missionId, rel, baseRoot = root) {
+    return path.join(missionDir(missionId, baseRoot), rel.startsWith('search-visibility/') ? rel : path.join('search-visibility', rel));
+}
+export function readJsonFile(file) {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+export function assertMissionArtifact(missionId, rel, baseRoot = root) {
+    const file = rel === 'completion-proof.json' || rel.endsWith('-gate.json')
+        ? path.join(missionDir(missionId, baseRoot), rel)
+        : artifactPath(missionId, rel, baseRoot);
+    assertGate(fs.existsSync(file), `missing mission artifact: ${rel}`, { missionId, file });
+    return readJsonFile(file);
+}
+export function listSourceFiles(dir) {
+    const out = [];
+    walk(dir, out);
+    return out
+        .map((file) => path.relative(dir, file).split(path.sep).join('/'))
+        .filter((rel) => !rel.startsWith('.sneakoscope/'))
+        .sort();
+}
+function walk(dir, out) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name === '.sneakoscope' || entry.name === 'node_modules' || entry.name === '.git')
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            walk(full, out);
+        else if (entry.isFile())
+            out.push(full);
+    }
+}
+//# sourceMappingURL=search-visibility-gate-lib.js.map

package/dist/scripts/seo-audit-fixture-check.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('seo-audit');
+const { json } = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'seo', '--root', fixture, '--target', 'website', '--framework', 'static', '--url', 'https://example.test', '--offline', '--json']);
+assertGate(json.route === '$SEO-GEO-OPTIMIZER' && json.mission_id, 'seo audit must create a unified optimizer mission', json);
+const inventory = assertMissionArtifact(json.mission_id, 'site-inventory.json', fixture);
+const findings = assertMissionArtifact(json.mission_id, 'seo-findings.json', fixture);
+const gate = assertMissionArtifact(json.mission_id, 'seo-gate.json', fixture);
+const proof = assertMissionArtifact(json.mission_id, 'completion-proof.json', fixture);
+assertGate(inventory.detected_adapter.adapterId === 'static-site', 'fixture should detect static-site adapter', inventory.detected_adapter);
+assertGate(Array.isArray(findings.findings) && findings.findings.every((finding) => finding.evidence?.length > 0), 'SEO findings must be atomic and evidence-backed', findings);
+assertGate(gate.route === '$SEO-GEO-OPTIMIZER' && gate.completion_proof.endsWith('/completion-proof.json'), 'seo gate must link completion proof', gate);
+assertGate(proof.schema === 'sks.completion-proof.v1' && proof.route === '$SEO-GEO-OPTIMIZER', 'completion proof must retain unified route identity', proof);
+emitGate('seo:audit-fixture', { mission_id: json.mission_id, findings: findings.findings.length });
+//# sourceMappingURL=seo-audit-fixture-check.js.map

package/dist/scripts/seo-canonical-locale-check.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('seo-locale');
+fs.mkdirSync(path.join(fixture, 'public', 'fr'), { recursive: true });
+fs.writeFileSync(path.join(fixture, 'public', 'fr', 'index.html'), '<!doctype html><html lang="fr"><head><title>FR</title><link rel="canonical" href="/fr"></head><body><h1>FR</h1></body></html>\n');
+const audit = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'seo', '--root', fixture, '--target', 'website', '--framework', 'static', '--url', 'https://example.test', '--offline', '--json']).json;
+const canonical = assertMissionArtifact(audit.mission_id, 'canonical-map.json', fixture);
+const locale = assertMissionArtifact(audit.mission_id, 'locale-graph.json', fixture);
+const sitemap = assertMissionArtifact(audit.mission_id, 'sitemap-audit.json', fixture);
+const findings = assertMissionArtifact(audit.mission_id, 'seo-findings.json', fixture);
+assertGate(/not guaranteed/i.test(canonical.warning), 'canonical report must avoid search-engine selection guarantees', canonical);
+assertGate(locale.checks.self_hreflang_verified === false && Array.isArray(locale.unverified), 'locale report must separate unverified hreflang checks', locale);
+assertGate(sitemap.indexing_guarantee === false, 'sitemap report must not claim indexing guarantee', sitemap);
+assertGate(findings.findings.some((finding) => finding.ruleId.includes('canonical') || finding.category === 'locale'), 'fixture should produce canonical or locale findings', findings);
+emitGate('seo:canonical-sitemap-locale', { mission_id: audit.mission_id });
+//# sourceMappingURL=seo-canonical-locale-check.js.map

package/dist/scripts/seo-cli-blackbox-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, runSks, runSksJson } from './search-visibility-gate-lib.js';
+const commands = runSksJson(['commands', '--json']).json;
+assertGate(commands.commands.some((row) => row.name === 'seo-geo-optimizer' && /unified SEO\/GEO optimizer/i.test(row.description)), 'commands --json must expose seo-geo-optimizer');
+assertGate(!commands.commands.some((row) => row.name === 'seo' || row.name === 'geo'), 'commands --json must not expose split seo/geo command surfaces');
+const optimizerUsage = runSks(['usage', 'seo-geo-optimizer']);
+assertGate(/sks seo-geo-optimizer \[seo\|geo\] doctor\|audit\|plan\|apply\|verify\|status\|rollback\|fixture/.test(optimizerUsage.stdout), 'usage seo-geo-optimizer must expose unified lifecycle');
+const doctor = runSksJson(['seo-geo-optimizer', 'doctor', '--mode', 'seo', '--json']).json;
+assertGate(doctor.route === '$SEO-GEO-OPTIMIZER' && doctor.schema === 'sks.search-visibility.doctor-command.v1', 'optimizer seo doctor must preserve unified route identity', doctor);
+const invalid = runSks(['seo-geo-optimizer', 'nonsense-subcommand'], { allowFailure: true });
+assertGate(invalid.status === 2 && /Usage: sks seo-geo-optimizer/.test(invalid.stderr), 'invalid optimizer subcommand must exit 2 with usage', {
+    status: invalid.status,
+    stdout: invalid.stdout,
+    stderr: invalid.stderr,
+});
+emitGate('seo:cli-blackbox', { adapter: doctor.adapter, confidence: doctor.confidence });
+//# sourceMappingURL=seo-cli-blackbox-check.js.map

package/dist/scripts/seo-geo-feature-fixture-quality-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const registryMod = await importDist('core/feature-registry.js');
+const registry = await registryMod.buildFeatureRegistry({ root });
+const byId = new Map(registry.features.map((feature) => [feature.id, feature]));
+for (const id of ['cli-seo-geo-optimizer', 'route-seo-geo-optimizer']) {
+    const feature = byId.get(id);
+    assertGate(feature, `feature missing: ${id}`);
+    assertGate(feature.fixture?.status === 'pass', `feature fixture must pass: ${id}`, feature);
+    assertGate(feature.fixture?.quality !== 'static_contract', `SEO/GEO feature must not rely on static contract: ${id}`, feature.fixture);
+    assertGate(['runtime_verified', 'runtime_mock_verified'].includes(feature.fixture?.quality), `SEO/GEO fixture quality must be runtime-backed: ${id}`, feature.fixture);
+}
+const selftest = registryMod.buildAllFeaturesSelftest(registry, {});
+const runtimeCheck = selftest.checks.find((check) => check.id === 'runtime_routes_not_static_contract');
+assertGate(runtimeCheck?.ok === true, 'runtime route static-contract guard must pass', runtimeCheck);
+emitGate('seo-geo:feature-fixture-quality', { features: 2 });
+//# sourceMappingURL=seo-geo-feature-fixture-quality-check.js.map

package/dist/scripts/seo-geo-geo-disambiguation-check.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const routes = await importDist('core/routes.js');
+const commandFor = (prompt) => routes.routePrompt(prompt)?.command;
+assertGate(commandFor('$SEO-GEO-OPTIMIZER improve AI answer visibility') === '$SEO-GEO-OPTIMIZER', 'explicit optimizer should route to unified route');
+assertGate(commandFor('Generative Engine Optimization crawler policy audit') === '$SEO-GEO-OPTIMIZER', 'generative engine optimization should route to unified optimizer');
+assertGate(commandFor('SEO audit canonical sitemap metadata') === '$SEO-GEO-OPTIMIZER', 'SEO intent should route to unified optimizer');
+assertGate(commandFor('fix GeoIP regional redirect bug') !== '$SEO-GEO-OPTIMIZER', 'GeoIP/geolocation request must not route to optimizer');
+assertGate(commandFor('map coordinates and location permission issue') !== '$SEO-GEO-OPTIMIZER', 'location permission request must not route to optimizer');
+emitGate('seo-geo:geo-disambiguation');
+//# sourceMappingURL=seo-geo-geo-disambiguation-check.js.map

package/dist/scripts/seo-geo-no-unsupported-ranking-claims-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('unsupported-claims', {
+    description: 'Guarantees top rank and AI citation for every site.',
+});
+fs.appendFileSync(path.join(fixture, 'README.md'), '\nWe guarantee rank #1, traffic lift, and AI answer citation.\n');
+const seo = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'seo', '--root', fixture, '--target', 'package', '--offline', '--json'], { allowFailure: true }).json;
+const geo = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'geo', '--root', fixture, '--target', 'package', '--offline', '--json'], { allowFailure: true }).json;
+const seoGate = assertMissionArtifact(seo.mission_id, 'seo-gate.json', fixture);
+const geoGate = assertMissionArtifact(geo.mission_id, 'geo-gate.json', fixture);
+const claims = assertMissionArtifact(geo.mission_id, 'claim-evidence-ledger.json', fixture);
+assertGate(seoGate.ok === false && seoGate.unsupported_claims.length > 0, 'SEO gate must reject unsupported ranking/traffic/citation guarantees', seoGate);
+assertGate(geoGate.ok === false && claims.claims.some((claim) => claim.safe_to_publish === false), 'GEO gate must reject unsupported AI citation claims', { geoGate, claims });
+emitGate('seo-geo:no-unsupported-ranking-claims', { seo_mission: seo.mission_id, geo_mission: geo.mission_id });
+//# sourceMappingURL=seo-geo-no-unsupported-ranking-claims-check.js.map

package/dist/scripts/seo-geo-route-identity-check.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, runSksJson } from './search-visibility-gate-lib.js';
+const seo = runSksJson(['run', '$SEO-GEO-OPTIMIZER SEO audit this fixture', '--execute', '--json']).json;
+const geo = runSksJson(['run', '$SEO-GEO-OPTIMIZER Generative Engine Optimization audit AI search visibility', '--execute', '--json']).json;
+const seoText = JSON.stringify(seo);
+const geoText = JSON.stringify(geo);
+assertGate(/\$SEO-GEO-OPTIMIZER/.test(seoText) && /sks seo-geo-optimizer/.test(seoText) && /--mode seo/.test(seoText), 'sks run --execute must preserve unified optimizer route and execute seo mode path', seo);
+assertGate(/\$SEO-GEO-OPTIMIZER/.test(geoText) && /sks seo-geo-optimizer/.test(geoText) && /--mode geo/.test(geoText), 'sks run --execute must preserve unified optimizer route and execute geo mode path', geo);
+assertGate(!/\$AutoResearch/.test(seoText) && !/\$AutoResearch/.test(geoText), 'SEO/GEO route identity must not collapse into AutoResearch', { seo, geo });
+emitGate('seo-geo:route-identity', { seo_status: seo.status, geo_status: geo.status });
+//# sourceMappingURL=seo-geo-route-identity-check.js.map