sneakoscope 4.8.6 → 5.1.2

package/dist/core/commands/mad-sks-command.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import { spawn } from 'node:child_process';
 import { PACKAGE_VERSION, appendJsonlBounded, exists, nowIso, packageRoot, readJson, sksRoot, writeJsonAtomic } from '../fsx.js';
 import { initProject } from '../init.js';
-import { createMission, setCurrent } from '../mission.js';
+import { createMission, findLatestMission, missionDir, setCurrent, stateFile } from '../mission.js';
 import { buildMadHighLaunchProfileNoWrite, madHighProfileName } from '../auto-review.js';
 import { permissionGateSummary } from '../permission-gates.js';
 import { attachZellijSessionInteractive, launchMadZellijUi, sanitizeZellijSessionName } from '../zellij/zellij-launcher.js';
@@ -26,6 +26,7 @@ import { repairZellijForSks } from '../zellij/zellij-self-heal.js';
 import { buildMadGlmLaunchArtifact, buildMadGlmLaunchProfileNoWrite, resolveMadGlmLaunchKey, writeMadGlmCodexWrapper } from '../providers/glm/glm-mad-launch.js';
 import { GLM_MAD_MODE } from '../providers/glm/glm-52-settings.js';
 import { assertNonGlmMadRoute } from '../routes/model-mode-router.js';
+const MAD_SKS_DEFAULT_TTL_MS = 10 * 60 * 1000;
 export async function madHighCommand(args = [], deps = {}) {
     const subcommand = firstSubcommand(args);
     if (subcommand)
@@ -65,6 +66,7 @@ export async function madHighCommand(args = [], deps = {}) {
     const launchRoot = process.cwd();
     if (!(await exists(path.join(launchRoot, '.sneakoscope'))))
         await initProject(launchRoot, {});
+    await cleanupExpiredMadSks(launchRoot);
     if (dryRun) {
         const zellijPlan = skipZellijRepair
             ? { schema: 'sks.zellij-self-heal.v1', ok: true, status: 'skipped', dry_run: true, planned_mutations: [], command: null, blockers: [], warnings: ['zellij_repair_skipped'] }
@@ -76,7 +78,8 @@ export async function madHighCommand(args = [], deps = {}) {
                 interactive: false,
                 installHomebrew: rawArgs.includes('--install-homebrew'),
                 allowHeadlessFallback: headlessZellij,
-                dryRun: true
+                dryRun: true,
+                quiet: rawArgs.includes('--json')
             });
         const report = {
             schema: 'sks.mad-sks-zellij-dry-run.v1',
@@ -123,7 +126,8 @@ export async function madHighCommand(args = [], deps = {}) {
                 autoApprove: rawArgs.includes('--yes') || rawArgs.includes('-y'),
                 interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY && process.env.SKS_NO_QUESTION !== '1'),
                 installHomebrew: rawArgs.includes('--install-homebrew'),
-                allowHeadlessFallback: headlessZellij
+                allowHeadlessFallback: headlessZellij,
+                quiet: rawArgs.includes('--json')
             });
     const zellijRepairBlocked = !headlessZellij && (zellijUpdate.status === 'manual_required'
         || zellijUpdate.strategy === 'manual-required'
@@ -240,15 +244,21 @@ export async function madHighCommand(args = [], deps = {}) {
     if (glmRuntime?.profile)
         console.log(`GLM MAD launch active: ${glmRuntime.profile.model} via OpenRouter; GPT fallback blocked.`);
     if (madDbGrant.requested)
-        console.log('MAD-DB flag observed; use the first-class route: sks mad-db run|exec|apply-migration.');
+        console.log('MAD-DB flag observed; deprecated route now redirects to MAD-SKS SQL-plane: sks mad-sks sql|apply-migration.');
     if (updateNotice.update_available === true)
         console.log(`SKS update notice: ${updateNotice.latest_version} available (non-blocking).`);
-    console.log('Scoped high-power maintenance authority active; add explicit --allow-* flags for packages, services, network, browser/Computer Use, generated assets, file permissions, or system/admin scopes. MAD-DB SQL-plane execution is not active in MAD-SKS; use the first-class MadDB route for DROP/TRUNCATE/all-row SQL-plane work.');
+    console.log('Scoped high-power maintenance authority active; add explicit --allow-* flags for packages, services, network, browser/Computer Use, generated assets, file permissions, or system/admin scopes. SQL-plane execution is available through MAD-SKS sql-plane and still requires control-plane denial, read-back proof, and read-only restoration.');
     const launchLb = lb.status === 'present' ? { ...lb, status: 'configured' } : lb;
+    const zellijVisiblePaneSetting = readOption(cleanArgs, '--zellij-visible-panes', process.env.SKS_ZELLIJ_VISIBLE_PANES || process.env.SKS_ZELLIJ_VISIBLE_PANE_CAP || '8');
+    const zellijViewportSetting = readOption(cleanArgs, '--zellij-viewports', process.env.SKS_ZELLIJ_VIEWPORTS || '4');
+    const zellijRefreshMsSetting = readOption(cleanArgs, '--zellij-refresh-ms', process.env.SKS_ZELLIJ_REFRESH_MS || '1000');
     const madSksEnv = {
         SKS_PROTECTED_CORE_POLICY: madLaunch.gate.protected_core_policy,
         SKS_MAD_SKS_TARGET_ROOT: madLaunch.gate.cwd,
-        SKS_MAD_SKS_PROTECTED_CORE_DIGEST: madLaunch.gate.protected_core_digest
+        SKS_MAD_SKS_PROTECTED_CORE_DIGEST: madLaunch.gate.protected_core_digest,
+        SKS_ZELLIJ_VISIBLE_PANES: String(zellijVisiblePaneSetting),
+        SKS_ZELLIJ_VIEWPORTS: String(Math.max(0, Math.min(Number(zellijViewportSetting || 4), 6))),
+        SKS_ZELLIJ_REFRESH_MS: String(zellijRefreshMsSetting),
     };
     const explicitWorkspace = readOption(cleanArgs, '--workspace', readOption(cleanArgs, '--session', null));
     const launchProfile = glmRuntime?.profile || profile;
@@ -290,10 +300,12 @@ export async function madHighCommand(args = [], deps = {}) {
         mission_id: madLaunch.mission_id,
         session_name: launch.session_name || null,
         live_panes: !headlessZellij,
-        initial_panes: 'main-only',
-        dashboard_created: false,
+        initial_panes: 'orchestrator-monitor-viewports',
+        dashboard_created: true,
         worker_panes_created: 0,
-        right_column_mode: 'spawn-on-first-worker'
+        viewport_panes_created: Number(madSksEnv.SKS_ZELLIJ_VIEWPORTS),
+        ui_architecture: 'monitor_plus_viewports',
+        right_column_mode: 'monitor-plus-viewports'
     });
     const madNativeSwarmPromise = startMadNativeSwarm(madLaunch.root, madLaunch, args, launchProfile, {
         env: {
@@ -303,7 +315,7 @@ export async function madHighCommand(args = [], deps = {}) {
         glmLaunch: glmRuntime ? { provider: glmRuntime.profile.provider, model: glmRuntime.profile.model } : null,
         zellijSessionName: launch.session_name || null,
         workerPlacement: headlessZellij ? 'process' : shouldAutoAttachZellij(args) ? 'zellij-pane' : 'process',
-        zellijVisiblePaneCap: Number(process.env.SKS_ZELLIJ_VISIBLE_PANE_CAP || 8)
+        zellijVisiblePaneCap: Number(process.env.SKS_ZELLIJ_VISIBLE_PANE_CAP || zellijVisiblePaneSetting || 8)
     }).catch((err) => appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_sks.native_swarm_background_failed', error: err?.message || String(err) }));
     void madNativeSwarmPromise;
     // The launcher only creates a detached background session. In an interactive
@@ -694,12 +706,20 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
         direct_execute_sql_allowed: dbWriteAllowed,
         normal_db_writes_allowed: dbWriteAllowed,
         migration_apply_allowed: dbWriteAllowed,
+        sql_plane: {
+            requested: false,
+            capability_id: null,
+            operation_classes: [],
+            read_back_passed: false,
+            profile_closed: false
+        },
         catastrophic_safety_guard_active: true,
         permission_profile: permissionGateSummary(),
         permission_model: permission,
         protected_core_policy: protectedCorePolicyPath,
         protected_core_before: protectedCoreBeforePath,
         protected_core_digest: protectedCoreBefore.digest,
+        expires_at: new Date(Date.now() + MAD_SKS_DEFAULT_TTL_MS).toISOString(),
         codex_native_invocation_plan: {
             selected_strategy: 'message-role-fallback',
             hook_evidence_policy: 'background-verification-do-not-count-until-refreshed',
@@ -767,6 +787,9 @@ function baseMadLaunchOnlyFlags() {
         '--skip-zellij-repair',
         '--install-homebrew',
         '--headless',
+        '--zellij-compact-slots',
+        '--zellij-dashboard',
+        '--zellij-full-debug',
         '--allow-system',
         '--allow-db-write',
         '--allow-package-install',
@@ -826,6 +849,8 @@ function madLaunchValueFlags(includeGlmFlags = false) {
         '--mad-swarm-work-items',
         '--mad-swarm-backend',
         '--mad-swarm-prompt',
+        '--zellij-visible-panes',
+        '--zellij-refresh-ms',
         '--ack'
     ]);
     if (includeGlmFlags)
@@ -884,7 +909,7 @@ function codexLbImmediateLaunchOpts(args = [], lb = {}, opts = {}) {
         const session = explicitSession || sanitizeZellijSessionName(`sks-openai-fallback-${Date.now().toString(36)}-${path.basename(root) || 'project'}`);
         console.log(`codex-lb bypass active for this launch: ${lb.chain_health?.status || lb.status}`);
         console.log(`Using fresh OpenAI fallback Zellij session: ${session}`);
-        return { ...opts, session, codexArgs: [...(opts.codexArgs || []), '-c', 'model_provider="openai"'], codexLbBypassed: true };
+        return { ...opts, session, codexArgs: [...(opts.codexArgs || []), '-c', 'model_provider="openai"'], 'codexLbBypassed': true };
     }
     if (!lb?.ok)
         return opts;
@@ -902,7 +927,17 @@ export async function madSksFixture(root) {
     const { id, dir } = await createMission(root, { mode: 'mad-sks', prompt: '$MAD-SKS fixture permission gate' });
     await writeCodex0138CapabilityArtifacts(root, { missionId: id }).catch(() => null);
     await writeCodex0139CapabilityArtifacts(root, { missionId: id }).catch(() => null);
-    const gate = { schema_version: 1, passed: true, mad_sks_permission_active: true, permissions_deactivated: true, catastrophic_safety_guard_active: true, permission_profile: permissionGateSummary(), fixture: true };
+    const gate = {
+        schema_version: 1,
+        passed: false,
+        execution_class: 'mock_fixture',
+        mad_sks_permission_active: false,
+        permissions_deactivated: false,
+        catastrophic_safety_guard_active: true,
+        permission_profile: permissionGateSummary(),
+        fixture: true,
+        blockers: ['mad_sks_fixture_mode_cannot_claim_real']
+    };
     await writeJsonAtomic(path.join(dir, 'mad-sks-gate.json'), gate);
     return { mission_id: id, dir, gate };
 }
@@ -910,8 +945,12 @@ const MAD_SKS_COMMAND_SURFACE = Object.freeze([
     'plan',
     'run',
     'apply',
+    'sql',
+    'apply-migration',
     'doctor',
     'status',
+    'close',
+    'revoke',
     'permissions',
     'proof',
     'repair-config',
@@ -924,9 +963,16 @@ async function madSksSubcommand(subcommand, args = []) {
     const json = args.includes('--json');
     const targetRoot = path.resolve(readOption(args, '--target-root', process.cwd()));
     const userIntent = readOption(args, '--intent', 'MAD-SKS user-authorized maintenance');
-    const flags = parseMadSksFlags(['--mad-sks', subcommand === 'plan' ? '--plan-only' : '', ...args].filter(Boolean));
+    const sqlPlaneSubcommand = subcommand === 'sql' || subcommand === 'apply-migration';
+    const flags = parseMadSksFlags([
+        '--mad-sks',
+        subcommand === 'plan' ? '--plan-only' : '',
+        ...(sqlPlaneSubcommand ? ['--allow-db-write', '--yes'] : []),
+        ...args
+    ].filter(Boolean));
     const permission = buildMadSksPermissionModel({ targetRoot, userIntent, flags });
     const root = await sksRoot();
+    await cleanupExpiredMadSks(root);
     if (subcommand === 'permissions') {
         const protectedCore = resolveProtectedCore({ packageRoot: packageRoot(), targetRoot });
         return emit({
@@ -958,7 +1004,7 @@ async function madSksSubcommand(subcommand, args = []) {
         return emit({
             schema: 'sks.mad-sks-explain.v1',
             ok: true,
-            summary: 'MAD-SKS is a user-authorized general permission widening mode, not a DB-only unlock. Target project work can be widened by explicit flags, while SKS harness/package/dist/scripts/schemas/release metadata remain immutable protected core.',
+            summary: 'MAD-SKS is a user-authorized general permission widening mode and the merged SQL-plane execution route. Target project work can be widened by explicit flags, while SQL-plane work runs through the sql-plane executor with MadDB capability/profile/read-back safeguards and SKS harness/package/dist/scripts/schemas/release metadata remain immutable protected core.',
             command_surface: [...MAD_SKS_COMMAND_SURFACE],
             catastrophic_safeguards: permission.forbidden_scopes,
             immutable_harness_guard: 'installed_harness_only_with_engine_source_exception'
@@ -979,6 +1025,9 @@ async function madSksSubcommand(subcommand, args = []) {
             permission_active: false
         }, json);
     }
+    if (subcommand === 'close' || subcommand === 'revoke') {
+        return closeMadSks(root, args, json, subcommand);
+    }
     if (subcommand === 'repair-config') {
         const apply = args.includes('--apply') || args.includes('--yes');
         const dryRun = args.includes('--dry-run') || !apply;
@@ -1049,6 +1098,34 @@ async function madSksSubcommand(subcommand, args = []) {
     if (subcommand === 'run') {
         return materializeMadSksRun(root, targetRoot, permission, userIntent, json, { action: 'run', args });
     }
+    if (subcommand === 'sql') {
+        const sql = readOption(args, '--sql', null) || positionalText(args);
+        return materializeMadSksRun(root, targetRoot, permission, sql || userIntent, json, {
+            action: 'apply',
+            resultSchema: 'sks.mad-sks-sql.v1',
+            args,
+            executor: 'sql-plane',
+            sql,
+            verifySql: readOption(args, '--verify-sql', null),
+            rollbackSql: readOption(args, '--rollback-sql', null),
+            acceptNotRollbackable: args.includes('--accept-not-rollbackable')
+        });
+    }
+    if (subcommand === 'apply-migration') {
+        const migrationFile = readOption(args, '--file', null) || args.find((arg) => !String(arg).startsWith('--')) || null;
+        return materializeMadSksRun(root, targetRoot, permission, userIntent, json, {
+            action: 'apply',
+            resultSchema: 'sks.mad-sks-apply-migration.v1',
+            args,
+            executor: 'sql-plane',
+            sqlAction: 'apply-migration',
+            migrationFile,
+            migrationName: readOption(args, '--name', null),
+            verifySql: readOption(args, '--verify-sql', null),
+            rollbackSql: readOption(args, '--rollback-sql', null),
+            acceptNotRollbackable: args.includes('--accept-not-rollbackable')
+        });
+    }
     if (subcommand === 'rollback-apply') {
         const rollbackPlanPath = readOption(args, '--rollback-plan', readOption(args, '--plan', null));
         const result = await applyMadSksRollbackPlan({
@@ -1084,7 +1161,7 @@ async function materializeMadSksRun(root, targetRoot, permission, userIntent, js
     if (!opts.authorizationManifestPath)
         await writeJsonAtomic(authorizationPath, authorization);
     const args = Array.isArray(opts.args) ? opts.args : [];
-    const executorId = readOption(args, '--executor', inferMadSksExecutor(args));
+    const executorId = opts.executor || readOption(args, '--executor', inferMadSksExecutor(args));
     const targetFile = readOption(args, '--write-file', readOption(args, '--path', path.join('.sneakoscope', 'mad-sks-target-file.txt')));
     const executorInput = {
         executor: executorId,
@@ -1098,13 +1175,20 @@ async function materializeMadSksRun(root, targetRoot, permission, userIntent, js
         authorization_manifest: authorization,
         authorization_manifest_path: authorizationPath,
         permission_model: permission,
-        yes: args.includes('--yes')
+        yes: args.includes('--yes') || opts.acceptNotRollbackable === true,
+        mission_id: id,
+        user_intent: userIntent,
+        args
     };
     const operation = readOption(args, '--operation', null);
     const command = readOption(args, '--command', null);
     const argv = readRepeatedOption(args, '--argv');
-    const sql = readOption(args, '--sql', null);
-    const rollbackSql = readOption(args, '--rollback-sql', null);
+    const sql = opts.sql || readOption(args, '--sql', null);
+    const rollbackSql = opts.rollbackSql || readOption(args, '--rollback-sql', null);
+    const verifySql = opts.verifySql || readOption(args, '--verify-sql', null);
+    const migrationFile = opts.migrationFile || readOption(args, '--migration-file', null) || readOption(args, '--file', null);
+    const migrationName = opts.migrationName || readOption(args, '--name', null);
+    const sqlAction = opts.sqlAction || null;
     if (operation)
         executorInput.operation = operation;
     if (command)
@@ -1115,6 +1199,16 @@ async function materializeMadSksRun(root, targetRoot, permission, userIntent, js
         executorInput.sql = sql;
     if (rollbackSql)
         executorInput.rollback_sql = rollbackSql;
+    if (verifySql)
+        executorInput.verify_sql = verifySql;
+    if (migrationFile)
+        executorInput.migration_file = migrationFile;
+    if (migrationName)
+        executorInput.migration_name = migrationName;
+    if (sqlAction)
+        executorInput.action = sqlAction;
+    if (opts.acceptNotRollbackable === true)
+        executorInput.accept_not_rollbackable = true;
     const executorResult = await runMadSksExecutor(executorInput);
     const protectedProbe = await evaluateMadSksWrite({ packageRoot: packageRoot(), targetRoot, operation: 'file_write', path: path.join(packageRoot(), 'src', 'core', 'version.ts') });
     const audit = createMadSksAuditLedger({
@@ -1169,19 +1263,6 @@ async function materializeMadSksRun(root, targetRoot, permission, userIntent, js
         ]
     });
     await writeMadSksProofEvidence(proofPath, proof);
-    const gate = {
-        schema_version: 1,
-        passed: proof.ok === true && executorResult.ok === true,
-        mad_sks_permission_active: true,
-        permissions_deactivated: true,
-        full_system_authority: permission.mode === 'full_system_authority',
-        immutable_harness_guard_passed: comparison.ok === true,
-        audit_ledger: auditPath,
-        rollback_plan: rollbackPath,
-        proof_evidence: proofPath,
-        permission_profile: permissionGateSummary()
-    };
-    await writeJsonAtomic(path.join(dir, 'mad-sks-gate.json'), gate);
     await setCurrent(root, {
         mission_id: id,
         route: 'MadSKS',
@@ -1193,9 +1274,37 @@ async function materializeMadSksRun(root, targetRoot, permission, userIntent, js
         mad_sks_gate_file: 'mad-sks-gate.json',
         prompt: userIntent
     });
+    const restore = await verifyMadSksPermissionRestored(root, id);
+    const sqlPlane = executorResult.sql_plane && typeof executorResult.sql_plane === 'object'
+        ? executorResult.sql_plane
+        : { requested: false, capability_id: null, operation_classes: [], read_back_passed: false, profile_closed: false };
+    const sqlPlaneRequested = sqlPlane.requested === true;
+    const sqlPlanePassed = !sqlPlaneRequested || (sqlPlane.read_back_passed === true && sqlPlane.profile_closed === true);
+    const gateBlockers = [
+        ...(restore.permissions_deactivated === true ? [] : ['permission_restore_failed']),
+        ...(comparison.ok === true ? [] : ['protected_core_changed']),
+        ...(executorResult.ok === true ? [] : (executorResult.blockers || ['mad_sks_executor_failed'])),
+        ...(sqlPlanePassed ? [] : ['mad_sks_sql_plane_read_back_or_profile_close_failed'])
+    ];
+    const gate = {
+        schema_version: 1,
+        passed: proof.ok === true && executorResult.ok === true && restore.permissions_deactivated === true && comparison.ok === true && sqlPlanePassed,
+        mad_sks_permission_active: false,
+        permissions_deactivated: restore.permissions_deactivated === true,
+        full_system_authority: permission.mode === 'full_system_authority',
+        immutable_harness_guard_passed: comparison.ok === true,
+        audit_ledger: auditPath,
+        rollback_plan: rollbackPath,
+        proof_evidence: proofPath,
+        permission_restore_read_back: restore,
+        permission_profile: permissionGateSummary(),
+        sql_plane: sqlPlane,
+        blockers: [...new Set(gateBlockers)]
+    };
+    await writeJsonAtomic(path.join(dir, 'mad-sks-gate.json'), gate);
     return emit({
-        schema: opts.action === 'apply' ? 'sks.mad-sks-apply.v1' : 'sks.mad-sks-run.v1',
-        ok: proof.ok === true && executorResult.ok === true,
+        schema: opts.resultSchema || (opts.action === 'apply' ? 'sks.mad-sks-apply.v1' : 'sks.mad-sks-run.v1'),
+        ok: gate.passed === true,
         status: executorResult.status,
         mission_id: id,
         target_root: targetRoot,
@@ -1211,9 +1320,86 @@ async function materializeMadSksRun(root, targetRoot, permission, userIntent, js
         blocked_actions: [protectedProbe, ...(executorResult.blocked_actions || [])]
     }, json);
 }
+async function closeMadSks(root, args = [], json = false, action = 'close') {
+    const missionId = readOption(args, '--mission', null) || args.find((arg) => !String(arg).startsWith('--')) || await findLatestMission(root);
+    if (!missionId) {
+        const result = { schema: 'sks.mad-sks-close.v1', ok: false, action, mission_id: null, blockers: ['mad_sks_mission_missing'] };
+        process.exitCode = 1;
+        return emit(result, json);
+    }
+    await setCurrent(root, {
+        mission_id: missionId,
+        route: 'MadSKS',
+        route_command: '$MAD-SKS',
+        mode: 'MADSKS',
+        phase: action === 'revoke' ? 'MADSKS_PERMISSION_REVOKED' : 'MADSKS_PERMISSION_CLOSED',
+        mad_sks_active: false,
+        mad_sks_modifier: false,
+        mad_sks_gate_file: 'mad-sks-gate.json',
+        mad_sks_closed_at: nowIso()
+    });
+    const restore = await verifyMadSksPermissionRestored(root, missionId);
+    const result = await writeMadSksCloseGate(root, missionId, action, restore);
+    if (!result.ok)
+        process.exitCode = 1;
+    return emit(result, json);
+}
+async function cleanupExpiredMadSks(root) {
+    const missionId = await findLatestMission(root);
+    if (!missionId)
+        return null;
+    const gate = await readJson(path.join(missionDir(root, missionId), 'mad-sks-gate.json'), null);
+    const expires = Date.parse(String(gate?.expires_at || ''));
+    if (gate?.mad_sks_permission_active !== true || !Number.isFinite(expires) || expires > Date.now())
+        return gate;
+    await setCurrent(root, {
+        mission_id: missionId,
+        route: 'MadSKS',
+        route_command: '$MAD-SKS',
+        mode: 'MADSKS',
+        phase: 'MADSKS_PERMISSION_EXPIRED_CLOSED',
+        mad_sks_active: false,
+        mad_sks_modifier: false,
+        mad_sks_gate_file: 'mad-sks-gate.json'
+    });
+    const restore = await verifyMadSksPermissionRestored(root, missionId);
+    return writeMadSksCloseGate(root, missionId, 'ttl_expired_lazy_cleanup', restore);
+}
+async function writeMadSksCloseGate(root, missionId, action, restore) {
+    const file = path.join(missionDir(root, missionId), 'mad-sks-gate.json');
+    const previous = await readJson(file, {});
+    const gate = {
+        ...previous,
+        schema_version: previous.schema_version || 1,
+        passed: restore.permissions_deactivated === true,
+        mad_sks_permission_active: false,
+        permissions_deactivated: restore.permissions_deactivated === true,
+        permission_restore_read_back: restore,
+        closed_at: nowIso(),
+        close_reason: action,
+        blockers: restore.permissions_deactivated === true ? [] : ['permission_restore_failed']
+    };
+    await writeJsonAtomic(file, gate);
+    return { schema: 'sks.mad-sks-close.v1', ok: gate.passed === true, action, mission_id: missionId, gate };
+}
+async function verifyMadSksPermissionRestored(root, missionId) {
+    const state = await readJson(stateFile(root), {});
+    const gate = await readJson(path.join(missionDir(root, missionId), 'mad-sks-gate.json'), {});
+    const permissionsDeactivated = state.mission_id === missionId
+        && state.mad_sks_active !== true
+        && gate.mad_sks_permission_active !== true;
+    return {
+        schema: 'sks.mad-sks-permission-restore-readback.v1',
+        checked_at: nowIso(),
+        mission_id: missionId,
+        permissions_deactivated: permissionsDeactivated,
+        state_mad_sks_active: state.mad_sks_active === true,
+        gate_mad_sks_permission_active: gate.mad_sks_permission_active === true
+    };
+}
 function inferMadSksExecutor(args = []) {
     if (readOption(args, '--sql', null))
-        return 'db-write';
+        return 'sql-plane';
     if (readOption(args, '--command', null) || args.includes('--argv'))
         return 'shell-command';
     if (readOption(args, '--package', null) || args.includes('--allow-package-install'))
@@ -1228,6 +1414,34 @@ function inferMadSksExecutor(args = []) {
         return 'generated-asset';
     return 'file-write';
 }
+function positionalText(args = []) {
+    const valueFlags = new Set([
+        '--sql',
+        '--verify-sql',
+        '--rollback-sql',
+        '--target-root',
+        '--intent',
+        '--executor',
+        '--cwd',
+        '--name',
+        '--file',
+        '--migration-file'
+    ]);
+    const out = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = String(args[index] || '');
+        if (!arg || arg === '--json' || arg === '--yes' || arg === '-y' || arg === '--accept-not-rollbackable')
+            continue;
+        if (valueFlags.has(arg)) {
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('--'))
+            continue;
+        out.push(arg);
+    }
+    return out.join(' ').trim();
+}
 function readRepeatedOption(args = [], name) {
     const values = [];
     for (let i = 0; i < args.length; i += 1) {

package/dist/core/commands/menubar-command.js

@@ -0,0 +1,146 @@
+import path from 'node:path';
+import { ui as cliUi } from '../../cli/cli-theme.js';
+import { projectRoot } from '../fsx.js';
+import { inspectSksMenuBarStatus, installSksMenuBar, restartSksMenuBar, uninstallSksMenuBar } from '../codex-app/sks-menubar.js';
+export async function menubarCommand(subcommand = 'status', args = []) {
+    const action = normalizeAction(subcommand);
+    const root = path.resolve(String(readOption(args, '--root', '') || await projectRoot()));
+    const home = stringOption(args, '--home');
+    if (action === 'status') {
+        const result = await inspectSksMenuBarStatus({ root, ...(home ? { home } : {}) });
+        if (flag(args, '--json'))
+            return printJson(result);
+        cliUi.banner('menubar status');
+        if (result.ok)
+            cliUi.ok(result.running ? 'running' : 'installed status checked');
+        else
+            cliUi.warn('needs attention');
+        printStatus(result);
+        if (!result.ok)
+            process.exitCode = 1;
+        return result;
+    }
+    if (action === 'install') {
+        const result = await installSksMenuBar({ root, ...(home ? { home } : {}), apply: true, launch: !flag(args, '--no-launch'), quiet: flag(args, '--json') });
+        if (flag(args, '--json'))
+            return printJson(result);
+        cliUi.banner('menubar install');
+        if (result.ok)
+            cliUi.ok(result.status);
+        else
+            cliUi.fail(result.status);
+        console.log(`SKS menu bar install: ${result.status}`);
+        for (const actionLine of result.actions)
+            console.log(`- ${actionLine}`);
+        for (const warning of result.warnings)
+            console.log(`warning: ${warning}`);
+        for (const blocker of result.blockers)
+            console.log(`blocker: ${blocker}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return result;
+    }
+    if (action === 'restart') {
+        const result = await restartSksMenuBar({ root, ...(home ? { home } : {}) });
+        if (flag(args, '--json'))
+            return printJson(result);
+        cliUi.banner('menubar restart');
+        if (result.ok)
+            cliUi.ok('restart requested');
+        else
+            cliUi.fail('restart failed');
+        console.log(`SKS menu bar restart: ${result.ok ? 'ok' : 'failed'}`);
+        if ('error' in result && result.error)
+            console.log(`error: ${result.error}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return result;
+    }
+    if (action === 'uninstall') {
+        const result = await uninstallSksMenuBar({ root, ...(home ? { home } : {}) });
+        if (flag(args, '--json'))
+            return printJson(result);
+        cliUi.banner('menubar uninstall');
+        if (result.ok)
+            cliUi.ok('uninstall complete');
+        else
+            cliUi.fail('uninstall failed');
+        console.log(`SKS menu bar uninstall: ${result.ok ? 'ok' : 'failed'}`);
+        for (const actionLine of result.actions)
+            console.log(`- ${actionLine}`);
+        for (const warning of result.warnings)
+            console.log(`warning: ${warning}`);
+        for (const blocker of result.blockers)
+            console.log(`blocker: ${blocker}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return result;
+    }
+    printUsage();
+    process.exitCode = 2;
+}
+function normalizeAction(value) {
+    const text = String(value || 'status').toLowerCase();
+    if (['status', 'inspect', 'doctor'].includes(text))
+        return 'status';
+    if (['install', 'fix', 'repair'].includes(text))
+        return 'install';
+    if (['restart', 'reload'].includes(text))
+        return 'restart';
+    if (['uninstall', 'remove', 'disable'].includes(text))
+        return 'uninstall';
+    return 'help';
+}
+function printStatus(result) {
+    console.log('SKS menu bar');
+    console.log(`Installed: ${result.installed ? 'yes' : 'no'}`);
+    console.log(`Running:   ${result.running ? 'yes' : 'no'}`);
+    console.log(`Launchd:   ${result.launchd.ok ? result.launchd.state || 'present' : result.launchd.error || 'missing'}`);
+    console.log(`Version:   ${result.build_stamp?.package_version || 'unknown'} (package ${result.package_version})`);
+    console.log(`Target:    ${result.action_target.sks_entry || 'missing'} ${result.action_target.sks_entry_exists ? '(ok)' : '(missing)'}`);
+    console.log(`Signature: ${result.signature.identifier || 'unknown'} ${result.signature.ok ? '(ok)' : '(check)'}`);
+    if (result.warnings.length) {
+        console.log('Warnings:');
+        for (const warning of result.warnings)
+            console.log(`- ${warning}`);
+    }
+    if (result.blockers.length) {
+        console.log('Blockers:');
+        for (const blocker of result.blockers)
+            console.log(`- ${blocker}`);
+    }
+    if (result.next_actions.length) {
+        console.log('Next actions:');
+        for (const action of result.next_actions)
+            console.log(`- ${action}`);
+    }
+}
+function printUsage() {
+    console.log(`SKS Menu Bar
+
+Usage:
+  sks menubar status [--json]
+  sks menubar install [--no-launch] [--json]
+  sks menubar restart [--json]
+  sks menubar uninstall [--json]
+`);
+}
+function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+function flag(args = [], name) {
+    return args.includes(name);
+}
+function readOption(args = [], name, fallback = null) {
+    const index = args.indexOf(name);
+    if (index >= 0 && args[index + 1] && !String(args[index + 1]).startsWith('--'))
+        return args[index + 1];
+    const prefixed = args.find((arg) => String(arg).startsWith(name + '='));
+    return prefixed ? prefixed.slice(name.length + 1) : fallback;
+}
+function stringOption(args = [], name) {
+    const value = readOption(args, name, null);
+    const text = value == null ? '' : String(value).trim();
+    return text || null;
+}
+//# sourceMappingURL=menubar-command.js.map