sneakoscope 4.6.0 → 4.6.1

package/README.md

@@ -11,7 +11,7 @@
 
 `npm i -g sneakoscope` → `sks --mad` → watch up to **100 shadow-clone workers** code in parallel,<br/>each in a live Zellij pane, every claim backed by Completion Proof.
 
-Current package release: **4.6.0**.
+Current package release: **4.6.1**.
 
 </div>
 
@@ -37,7 +37,7 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.6.0** adds the proof-backed `seo-geo-optimizer` command and route on one shared search-visibility kernel, plus Lean Engineering Policy evidence in pipeline plans, worker prompts, code-structure reports, GPT final review, and Completion Proof.
+SKS **4.6.1** keeps the 4.6 search-visibility release surface and fixes the MadDB safety hook so direct Supabase MCP `apply_migration` calls use the active persisted MadDB capability when Codex hook payload state drifts.
 
 - **`sks seo-geo-optimizer` / `$SEO-GEO-OPTIMIZER`.** Run read-only audit, mutation plan, explicit apply, verification, rollback, and Completion Proof for both Search Engine Optimization and Generative Engine Optimization.
 - **Mode-specific evidence.** Use `--mode seo` for package/docs/website search visibility, including metadata, canonical, robots, sitemap, locale, structured data, and internal links. Use `--mode geo` for entity facts, claim evidence, answerability, AI crawler purpose policy, and optional `llms.txt` planning. GEO means Generative Engine Optimization, not geolocation.

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.6.0"
+version = "4.6.1"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.6.0"
+version = "4.6.1"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.6.0"),
+        Some("--version") => println!("sks-rs 4.6.1"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.6.0';
+const FAST_PACKAGE_VERSION = '4.6.1';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/core/db-safety.js

@@ -510,15 +510,16 @@ export async function checkDbOperation(root, state, payload, { duringNoQuestion
     const contract = await loadMissionContract(root, state);
     const classification = classifyToolPayload(payload);
     const madDb = await resolveMadDbMutationPolicy(root, state, classification);
-    if (madDb.allowed === true && state?.mission_id) {
+    if (madDb.allowed === true && madDb.mission_id) {
         const madDbDecision = madDb;
+        const madDbMissionId = String(madDbDecision.mission_id);
         const sqlText = classification.sql?.statements?.length ? String(classification.sql.statements.join('\n')) : null;
         const sqlHash = sqlText ? sha256(sqlText) : null;
         const toolCallId = extractCanonicalToolCallId(payload) || `payload-${sha256(JSON.stringify({ tool: classification.toolName || '', sqlHash, level: classification.level })).slice(0, 16)}`;
         const operationClasses = madDbDecision.operation_classes?.length ? madDbDecision.operation_classes : madDbOperationClassesFromClassification(classification);
         const reservation = await reserveMadDbOperation({
             root,
-            missionId: String(state.mission_id),
+            missionId: madDbMissionId,
             capability: madDbDecision.capability,
             toolCallId,
             toolName: classification.toolName || 'unknown_database_tool',
@@ -527,12 +528,12 @@ export async function checkDbOperation(root, state, payload, { duringNoQuestion
         });
         await transitionMadDbOperation({
             root,
-            missionId: String(state.mission_id),
+            missionId: madDbMissionId,
             toolCallId,
             state: 'started'
         });
         const lifecycleHook = {
-            mission_id: String(state.mission_id),
+            mission_id: madDbMissionId,
             operation_id: reservation.operation.operation_id,
             tool_call_id: toolCallId,
             cycle_id: madDbDecision.cycle_id || null,
@@ -560,12 +561,13 @@ export async function checkDbOperation(root, state, payload, { duringNoQuestion
                 lifecycle_result_pending: true,
                 ledger_result_hook: lifecycleHook,
                 operation_classes: operationClasses,
+                state_source: madDbDecision.state_source || 'hook_state',
                 counters: reservation.capability.counters,
                 idempotent_reservation_reused: reservation.reused
             }
         };
-        await appendMadDbLedgerEvent(root, state.mission_id, { type: 'db_mutation.allowed', cycle_id: madDbDecision.cycle_id, mode: madDbDecision.mode, classification, operation_id: reservation.operation.operation_id, tool_call_id: toolCallId });
-        await appendJsonlBounded(path.join(missionDir(root, state.mission_id), 'db-safety.jsonl'), { ts: nowIso(), decision });
+        await appendMadDbLedgerEvent(root, madDbMissionId, { type: 'db_mutation.allowed', cycle_id: madDbDecision.cycle_id, mode: madDbDecision.mode, classification, operation_id: reservation.operation.operation_id, tool_call_id: toolCallId });
+        await appendJsonlBounded(path.join(missionDir(root, madDbMissionId), 'db-safety.jsonl'), { ts: nowIso(), decision });
         return decision;
     }
     const madSks = await madSksOverrideState(root, state);

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.6.0';
+export const PACKAGE_VERSION = '4.6.1';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/mad-db/mad-db-policy-resolver.js

@@ -1,8 +1,26 @@
 import { isMadDbCapabilityActive, readMadDbCapability } from './mad-db-capability.js';
 import { activeMadDbAllowsSqlPlane, isMadDbControlPlaneDeniedTool, madDbOperationClassesFromClassification } from './mad-db-policy.js';
-import { sha256 } from '../fsx.js';
+import { readJson, sha256 } from '../fsx.js';
+import { stateFile } from '../mission.js';
 export const MAD_DB_POLICY_DECISION_SCHEMA = 'sks.mad-db-policy-decision.v2';
 export async function resolveMadDbMutationPolicy(root, state = {}, classification = {}, explicitCapability) {
+    const primary = await resolveMadDbMutationPolicyForState(root, state, classification, explicitCapability);
+    if (primary.allowed === true || explicitCapability)
+        return primary;
+    const persistedState = await readJson(stateFile(root), null).catch(() => null);
+    if (persistedState && persistedState !== state) {
+        const fallback = await resolveMadDbMutationPolicyForState(root, persistedState, classification, null);
+        if (fallback.allowed === true) {
+            return {
+                ...fallback,
+                state_source: 'persisted_sks_state',
+                reasons: [...fallback.reasons, 'mad_db_persisted_state_binding_used']
+            };
+        }
+    }
+    return primary;
+}
+async function resolveMadDbMutationPolicyForState(root, state = {}, classification = {}, explicitCapability) {
     const missionId = explicitCapability?.mission_id || state?.mad_db_capability_mission_id || state?.mission_id;
     if (!missionId)
         return inactive('mission_id_missing');
@@ -39,7 +57,10 @@ export function validateCapabilityBinding(capability, state = {}, classification
         return { ok: false, reason: `mad_db_capability_${capability.status || 'inactive'}` };
     if (!capability.project_ref)
         return { ok: false, reason: 'mad_db_project_ref_missing' };
-    if (state?.mission_id && String(state.mission_id) !== capability.mission_id)
+    const boundMadDbMissionId = state?.mad_db_capability_mission_id ? String(state.mad_db_capability_mission_id) : null;
+    if (boundMadDbMissionId === capability.mission_id && state?.mad_db_active === false)
+        return { ok: false, reason: 'mad_db_state_inactive' };
+    if (state?.mission_id && String(state.mission_id) !== capability.mission_id && boundMadDbMissionId !== capability.mission_id)
         return { ok: false, reason: 'mad_db_mission_binding_mismatch' };
     if (state?.mad_db_cycle_id && String(state.mad_db_cycle_id) !== capability.cycle_id)
         return { ok: false, reason: 'mad_db_cycle_binding_mismatch' };

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.6.0';
+export const PACKAGE_VERSION = '4.6.1';
 //# sourceMappingURL=version.js.map

package/dist/scripts/mad-db-direct-apply-migration-hook-check.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission, setCurrent, missionDir } from '../core/mission.js';
+import { checkDbOperation } from '../core/db-safety.js';
+import { createMadDbCapability, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-direct-apply-'));
+const mission = await createMission(root, { mode: 'mad-db', prompt: '$MAD-DB direct apply_migration fixture' });
+const capability = await createMadDbCapability(root, {
+    missionId: mission.id,
+    ack: MAD_DB_ACK,
+    cwd: root,
+    ttlMs: 60000,
+    projectRef: 'fixture-project-ref',
+    status: 'active'
+});
+await setCurrent(root, {
+    mission_id: mission.id,
+    mode: 'MADDB',
+    route: 'MadDB',
+    route_command: '$MAD-DB',
+    phase: 'MADDB_SQL_PLANE_CAPABILITY_ACTIVE',
+    implementation_allowed: true,
+    mad_db_active: true,
+    mad_db_capability_mission_id: mission.id,
+    mad_db_cycle_id: capability.cycle_id,
+    mad_db_runtime_session_id: capability.runtime_session_id,
+    mad_db_profile_sha256: capability.transport.profile_sha256,
+    mad_db_capability_file: 'mad-db-capability.json'
+});
+const payloadStateFromCodex = { mission_id: 'codex-payload-state', mode: 'AGENT', phase: 'TOOL_CALL' };
+const decision = await checkDbOperation(root, payloadStateFromCodex, {
+    tool_name: 'mcp__supabase__apply_migration',
+    tool_call_id: 'direct-apply-migration-call',
+    tool_input: {
+        name: 'direct_apply_fixture',
+        query: 'alter table public.fixture add column if not exists direct_apply_fixture text;'
+    }
+});
+const updated = await readMadDbCapability(root, mission.id);
+const wrongMissionDirExists = fs.existsSync(missionDir(root, payloadStateFromCodex.mission_id));
+assertGate(decision.allowed === true && decision.mad_db?.active === true, 'direct Supabase MCP apply_migration must be allowed by persisted active MadDB capability', decision);
+assertGate(decision.mad_db.operation_classes.includes('migration_apply'), 'direct apply_migration must reserve a migration_apply operation class', decision);
+assertGate(decision.mad_db.state_source === 'persisted_sks_state', 'drifted hook payload state must fall back to persisted SKS MadDB state', decision);
+assertGate(updated?.counters.reserved === 1, 'direct apply_migration reservation must land on the real MadDB mission capability', updated || {});
+assertGate(wrongMissionDirExists === false, 'direct apply_migration must not create or write under the drifted payload mission id');
+emitGate('mad-db:direct-apply-migration-hook', { mission_id: mission.id, operation_id: decision.mad_db.operation_id, counters: updated?.counters });
+//# sourceMappingURL=mad-db-direct-apply-migration-hook-check.js.map

package/dist/scripts/release-dag-full-coverage-check.js

@@ -115,6 +115,7 @@ const requiredReleasePresetIds = [
     'mad-db:operation-lifecycle-ledger',
     'mad-db:route-identity',
     'mad-db:hook-idempotency',
+    'mad-db:direct-apply-migration-hook',
     'mad-db:parallel-lifecycle',
     'mad-db:runtime-profile',
     'mad-db:skill-policy',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.6.0",
+  "version": "4.6.1",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -739,6 +739,7 @@
     "mad-db:operation-lifecycle-ledger": "node ./dist/scripts/mad-db-operation-lifecycle-ledger-check.js",
     "mad-db:route-identity": "node ./dist/scripts/mad-db-route-identity-check.js",
     "mad-db:hook-idempotency": "node ./dist/scripts/mad-db-hook-idempotency-check.js",
+    "mad-db:direct-apply-migration-hook": "node ./dist/scripts/mad-db-direct-apply-migration-hook-check.js",
     "mad-db:parallel-lifecycle": "node ./dist/scripts/mad-db-parallel-lifecycle-check.js",
     "mad-db:runtime-profile": "node ./dist/scripts/mad-db-runtime-profile-lifecycle-check.js",
     "mad-db:skill-policy": "node ./dist/scripts/mad-db-skill-policy-snapshot-check.js",
@@ -776,7 +777,7 @@
     "mad-db:lifecycle-hook-decision": "node ./dist/scripts/mad-db-lifecycle-hook-decision-check.js",
     "mad-db:mcp-result-lifecycle": "node ./dist/scripts/mad-db-mcp-result-lifecycle-check.js",
     "mad-db:operation-lifecycle-blackbox": "node ./dist/scripts/mad-db-operation-lifecycle-blackbox.js",
-    "mad-db:unit": "npm run mad-db:capability && npm run mad-db:command && npm run mad-db:mad-command && npm run mad-db:priority-resolver && npm run mad-db:ledger && npm run mad-db:one-cycle-consumption && npm run mad-db:safety-conflict-matrix && npm run mad-db:one-cycle-bounded && npm run mad-db:operation-lifecycle-ledger && npm run mad-db:route-identity && npm run mad-db:hook-idempotency && npm run mad-db:parallel-lifecycle && npm run mad-db:runtime-profile && npm run mad-db:skill-policy && npm run mad-db:policy-v2 && npm run mad-db:lifecycle-hook-decision && npm run mad-db:mcp-result-lifecycle && npm run mad-db:operation-lifecycle-blackbox",
+    "mad-db:unit": "npm run mad-db:capability && npm run mad-db:command && npm run mad-db:mad-command && npm run mad-db:priority-resolver && npm run mad-db:ledger && npm run mad-db:one-cycle-consumption && npm run mad-db:safety-conflict-matrix && npm run mad-db:one-cycle-bounded && npm run mad-db:operation-lifecycle-ledger && npm run mad-db:route-identity && npm run mad-db:hook-idempotency && npm run mad-db:direct-apply-migration-hook && npm run mad-db:parallel-lifecycle && npm run mad-db:runtime-profile && npm run mad-db:skill-policy && npm run mad-db:policy-v2 && npm run mad-db:lifecycle-hook-decision && npm run mad-db:mcp-result-lifecycle && npm run mad-db:operation-lifecycle-blackbox",
     "mad-db:real-e2e": "node ./dist/scripts/mad-db-real-supabase-e2e.js --require-real",
     "mad-db:all": "npm run build && npm run mad-db:unit",
     "mad-db:release": "npm run mad-db:all && npm run mad-db:real-e2e",