sneakoscope 4.8.7 → 5.1.2

package/dist/core/update-check.js

@@ -1,11 +1,14 @@
 import os from 'node:os';
 import path from 'node:path';
-import { PACKAGE_VERSION, packageRoot, readJson, runProcess, which } from './fsx.js';
+import { PACKAGE_VERSION, packageRoot, readJson, runProcess, throttleLines, which } from './fsx.js';
 import { createRequestedScopeContract } from './safety/requested-scope-contract.js';
 import { guardedPackageInstall, guardContextForRoute } from './safety/mutation-guard.js';
 import { isUpdateMigrationReceiptCurrent, resolveInstalledSksEntrypoint, runPackageLocalDoctor, writeProjectUpdateMigrationReceipt } from './update/update-migration-state.js';
 import { installSksMenuBar } from './codex-app/sks-menubar.js';
 import { reconcileSkills } from './init/skills.js';
+import { codexHookTrustDoctor } from './codex-hooks/codex-hook-trust-doctor.js';
+import { readCodexHookActualState } from './codex-hooks/codex-hook-actual-discovery.js';
+import { ui as cliUi, withHeartbeat } from '../cli/cli-theme.js';
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
 export async function runSksUpdateCheck(options = {}) {
     const packageName = options.packageName || 'sneakoscope';
@@ -102,8 +105,16 @@ export async function runSksUpdateNow(options = {}) {
     const globalRoot = npmBin ? await detectNpmGlobalRoot(npmBin, env, options).catch(() => null) : null;
     const projectReceiptRoot = path.resolve(options.projectRoot || env.SKS_MUTATION_LEDGER_ROOT || process.cwd());
     const stages = [];
+    const quiet = options.quiet === true || /^(1|true)$/i.test(String(env.SKS_UPDATE_QUIET || ''));
+    const machineOutput = quiet || options.json === true;
+    const stageStart = (id, status) => {
+        if (!machineOutput)
+            cliUi.step(`▸ ${id} - ${status}`);
+    };
     const stage = (id, ok, status, detail = {}) => {
         stages.push({ id, ok, status, detail });
+        if (!machineOutput)
+            cliUi.step(`${ok ? '✔' : '✖'} ${id} - ${status}`);
     };
     if (!npmBin) {
         return buildUpdateNowResult({
@@ -157,45 +168,6 @@ export async function runSksUpdateNow(options = {}) {
             error: check.error || 'latest version unavailable'
         });
     }
-    if (!requestedVersion && check.latest && !check.update_available) {
-        const receipt = await writeProjectUpdateMigrationReceipt({
-            root: projectReceiptRoot,
-            source: 'update-now-current',
-            blockers: [],
-            warnings: ['package_already_current']
-        }).catch(() => null);
-        const migrationCurrent = isUpdateMigrationReceiptCurrent(receipt);
-        stage('project_receipt', migrationCurrent, migrationCurrent ? 'current' : 'failed', { root: projectReceiptRoot });
-        const sksMenuBar = migrationCurrent
-            ? await installUpdateSksMenuBar({ root: projectReceiptRoot, env, stage })
-            : null;
-        await runUpdateGlobalSkillsReconcile(stage);
-        return buildUpdateNowResult({
-            packageName,
-            from: check.current,
-            latest: check.latest,
-            requestedVersion,
-            installVersion,
-            npmBin,
-            npmArgs,
-            command,
-            cwd,
-            registry,
-            globalRoot,
-            status: 'current',
-            ok: migrationCurrent,
-            installCode: null,
-            oldVersionDoctor: null,
-            newBinary: null,
-            newVersion: check.current,
-            newVersionDoctor: null,
-            projectReceipt: receipt,
-            migrationCurrent,
-            sksMenuBar,
-            stages,
-            error: null
-        });
-    }
     if (options.dryRun) {
         stage('old_version_doctor_preflight', true, 'skipped_dry_run', { reason: 'dry_run_does_not_run_doctor_fix' });
         stage('npm_install', true, 'dry_run', { command });
@@ -224,19 +196,20 @@ export async function runSksUpdateNow(options = {}) {
             error: null
         });
     }
-    const oldDoctorTimeoutOverride = Number.parseInt(env.SKS_UPDATE_OLD_DOCTOR_TIMEOUT_MS || '', 10);
-    const oldDoctorTimeoutMs = Number.isFinite(oldDoctorTimeoutOverride) && oldDoctorTimeoutOverride > 0
-        ? oldDoctorTimeoutOverride
-        : 60_000;
-    const oldVersionDoctor = await runPackageLocalDoctor({
-        root: projectReceiptRoot,
-        args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', path.join(projectReceiptRoot, '.sneakoscope', 'update', 'old-version-doctor.json')],
-        env,
-        timeoutMs: oldDoctorTimeoutMs,
-        maxOutputBytes: 32 * 1024
-    });
-    stage('old_version_doctor_preflight', oldVersionDoctor.ok, oldVersionDoctor.status, { entrypoint: oldVersionDoctor.entrypoint, exit_code: oldVersionDoctor.exit_code, timeout_ms: oldDoctorTimeoutMs });
-    if (!oldVersionDoctor.ok && env.SKS_UPDATE_SKIP_OLD_DOCTOR_PREFLIGHT !== '1') {
+    if (!requestedVersion && check.latest && !check.update_available) {
+        const receipt = await writeProjectUpdateMigrationReceipt({
+            root: projectReceiptRoot,
+            source: 'update-now-current',
+            fromVersion: check.current,
+            blockers: [],
+            warnings: ['package_already_current']
+        }).catch(() => null);
+        const migrationCurrent = isUpdateMigrationReceiptCurrent(receipt);
+        stage('project_receipt', migrationCurrent, migrationCurrent ? 'current' : 'failed', { root: projectReceiptRoot });
+        const sksMenuBar = migrationCurrent
+            ? await installUpdateSksMenuBar({ root: projectReceiptRoot, env, stage, quiet: machineOutput })
+            : null;
+        await runUpdateGlobalSkillsReconcile(stage, { quiet: machineOutput });
         return buildUpdateNowResult({
             packageName,
             from: check.current,
@@ -249,17 +222,46 @@ export async function runSksUpdateNow(options = {}) {
             cwd,
             registry,
             globalRoot,
-            status: 'failed',
-            ok: false,
+            status: 'current',
+            ok: migrationCurrent,
             installCode: null,
-            oldVersionDoctor,
+            oldVersionDoctor: null,
             newBinary: null,
-            newVersion: null,
+            newVersion: check.current,
             newVersionDoctor: null,
-            projectReceipt: null,
-            migrationCurrent: false,
+            projectReceipt: receipt,
+            migrationCurrent,
+            sksMenuBar,
             stages,
-            error: oldVersionDoctor.error || 'old-version Doctor preflight failed'
+            error: null
+        });
+    }
+    const oldDoctorTimeoutOverride = Number.parseInt(env.SKS_UPDATE_OLD_DOCTOR_TIMEOUT_MS || '', 10);
+    const oldDoctorTimeoutMs = Number.isFinite(oldDoctorTimeoutOverride) && oldDoctorTimeoutOverride > 0
+        ? oldDoctorTimeoutOverride
+        : 60_000;
+    let oldVersionDoctor = null;
+    if (env.SKS_UPDATE_SKIP_OLD_DOCTOR_PREFLIGHT === '1') {
+        stage('old_version_doctor_preflight', true, 'skipped', { reason: 'SKS_UPDATE_SKIP_OLD_DOCTOR_PREFLIGHT=1' });
+    }
+    else {
+        stageStart('old_version_doctor_preflight', 'running migration doctor on current install');
+        oldVersionDoctor = await updateHeartbeat(machineOutput, 'old-version doctor', runPackageLocalDoctor({
+            root: projectReceiptRoot,
+            args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', path.join(projectReceiptRoot, '.sneakoscope', 'update', 'old-version-doctor.json')],
+            env: {
+                ...env,
+                ...(env.SKS_TEST_OLD_DOCTOR_FAIL === '1' ? { SKS_TEST_DOCTOR_FAIL: '1' } : {})
+            },
+            timeoutMs: oldDoctorTimeoutMs,
+            maxOutputBytes: 32 * 1024
+        }), 60_000);
+        stage('old_version_doctor_preflight', oldVersionDoctor.ok, oldVersionDoctor.ok ? oldVersionDoctor.status : 'failed_continuing', {
+            entrypoint: oldVersionDoctor.entrypoint,
+            exit_code: oldVersionDoctor.exit_code,
+            timeout_ms: oldDoctorTimeoutMs,
+            timed_out: oldVersionDoctor.timedOut,
+            note: oldVersionDoctor.ok ? null : 'legacy doctor unreliable; new-version doctor will repair after install'
         });
     }
     const mutationLedgerRoot = env.SKS_MUTATION_LEDGER_ROOT || packageRoot();
@@ -269,7 +271,10 @@ export async function runSksUpdateNow(options = {}) {
         projectRoot: mutationLedgerRoot,
         overrides: { package_install: true }
     });
-    const install = await guardedPackageInstall(guardContextForRoute(mutationLedgerRoot, installContract, command || `npm global install ${packageName}`), `${packageName}@${installVersion}`, {
+    const npmStdout = machineOutput ? undefined : throttleLines((line) => process.stderr.write(`  npm | ${line}\n`), 500);
+    const npmStderr = machineOutput ? undefined : throttleLines((line) => process.stderr.write(`  npm ! ${line}\n`), 500);
+    stageStart('npm_global_install', command || `npm global install ${packageName}`);
+    const installOptions = {
         confirmed: true,
         command: npmBin,
         args: npmArgs,
@@ -277,21 +282,32 @@ export async function runSksUpdateNow(options = {}) {
         env,
         timeoutMs: options.timeoutMs ?? 10 * 60 * 1000,
         maxOutputBytes: options.maxOutputBytes ?? 128 * 1024
-    }).catch((err) => ({
-        code: 1,
-        stdout: '',
-        stderr: err instanceof Error ? err.message : String(err)
-    }));
+    };
+    if (npmStdout)
+        installOptions.onStdout = npmStdout;
+    if (npmStderr)
+        installOptions.onStderr = npmStderr;
+    const install = env.SKS_UPDATE_FAKE_INSTALL === '1'
+        ? { code: 0, stdout: 'fake install ok', stderr: '', timedOut: false }
+        : await updateHeartbeat(machineOutput, `npm install -g ${packageName}`, guardedPackageInstall(guardContextForRoute(mutationLedgerRoot, installContract, command || `npm global install ${packageName}`), `${packageName}@${installVersion}`, installOptions), 60_000).catch((err) => ({
+            code: 1,
+            stdout: '',
+            stderr: err instanceof Error ? err.message : String(err),
+            timedOut: false
+        }));
     const installOk = install.code === 0;
-    stage('npm_global_install', installOk, installOk ? 'installed' : 'failed', { command, code: install.code });
+    stage('npm_global_install', installOk, installOk ? env.SKS_UPDATE_FAKE_INSTALL === '1' ? 'fake_installed' : 'installed' : 'failed', { command, code: install.code });
     let newBinary = null;
     let newVersion = null;
     let newVersionDoctor = null;
     let projectReceipt = null;
     let migrationCurrent = false;
     let sksMenuBar = null;
+    let hookTrust = null;
     if (installOk) {
-        newBinary = await resolveInstalledSksEntrypoint({ packageName, globalRoot, env });
+        newBinary = env.SKS_UPDATE_FAKE_INSTALL === '1'
+            ? path.join(packageRoot(), 'dist', 'bin', 'sks.js')
+            : await resolveInstalledSksEntrypoint({ packageName, globalRoot, env });
         stage('resolve_new_package_local_binary', Boolean(newBinary), newBinary ? 'resolved' : 'missing', { new_binary: newBinary });
         if (newBinary) {
             const versionProbe = await runProcess(process.execPath, [newBinary, '--version'], {
@@ -302,33 +318,52 @@ export async function runSksUpdateNow(options = {}) {
             }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
             newVersion = parseVersionText(versionProbe.stdout || versionProbe.stderr || '') || null;
             stage('new_version_probe', Boolean(newVersion), newVersion ? 'version_detected' : 'failed', { new_version: newVersion, code: versionProbe.code });
-            newVersionDoctor = await runPackageLocalDoctor({
+            stageStart('new_version_global_doctor', 'running migration doctor on updated install');
+            newVersionDoctor = await updateHeartbeat(machineOutput, 'new-version doctor', runPackageLocalDoctor({
                 root: globalSksRootPath(),
                 entrypoint: newBinary,
                 args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', path.join(globalSksRootPath(), 'update', 'new-version-doctor.json')],
                 env,
-                timeoutMs: 15_000,
+                timeoutMs: updateDoctorTimeoutMs(env),
                 maxOutputBytes: 32 * 1024
-            });
-            stage('new_version_global_doctor', newVersionDoctor.ok, newVersionDoctor.status, { entrypoint: newBinary, exit_code: newVersionDoctor.exit_code });
+            }), 60_000);
+            stage('new_version_global_doctor', newVersionDoctor.ok, newVersionDoctor.status, { entrypoint: newBinary, exit_code: newVersionDoctor.exit_code, timeout_ms: updateDoctorTimeoutMs(env), timed_out: newVersionDoctor.timedOut });
         }
         if (newVersionDoctor?.ok) {
+            hookTrust = await codexHookTrustDoctor(projectReceiptRoot, { fix: true, managed: true, actual: true })
+                .catch((err) => ({ ok: false, blockers: [`hook_trust_repair_failed:${err?.message || err}`] }));
+            stage('hook_trust_repair', hookTrust?.ok !== false, hookTrust?.ok !== false ? 'repaired' : 'failed', {
+                entries: hookTrust?.current_hash_count ?? null,
+                blockers: hookTrust?.blockers || []
+            });
+        }
+        if (newVersionDoctor?.ok && hookTrust?.ok !== false) {
             projectReceipt = await writeProjectUpdateMigrationReceipt({
                 root: projectReceiptRoot,
                 source: 'update-now',
                 doctor: newVersionDoctor,
                 updateStages: stages,
+                fromVersion: check.current,
                 blockers: [],
                 warnings: []
             }).catch(() => null);
             migrationCurrent = isUpdateMigrationReceiptCurrent(projectReceipt);
             stage('project_receipt', migrationCurrent, migrationCurrent ? 'current' : 'failed', { root: projectReceiptRoot });
             if (migrationCurrent)
-                sksMenuBar = await installUpdateSksMenuBar({ root: projectReceiptRoot, env, stage });
-            await runUpdateGlobalSkillsReconcile(stage);
+                sksMenuBar = await installUpdateSksMenuBar({ root: projectReceiptRoot, env, stage, quiet: machineOutput });
+            await runUpdateGlobalSkillsReconcile(stage, { quiet: machineOutput });
         }
     }
-    const ok = installOk && Boolean(newBinary) && newVersionDoctor?.ok === true && migrationCurrent;
+    const verification = await runFinalUpdateVerification({ installOk, newBinary, installVersion, env, projectReceiptRoot });
+    const verifyOk = verification.length > 0 && verification.every((item) => item.ok);
+    if (verification.length) {
+        stage('final_self_verification', verifyOk, verifyOk ? 'verified' : 'issues', {
+            failed: verification.filter((item) => !item.ok).map((item) => item.id)
+        });
+    }
+    const baseOk = installOk && Boolean(newBinary) && newVersionDoctor?.ok === true && hookTrust?.ok !== false && migrationCurrent;
+    const ok = baseOk && verifyOk;
+    const status = ok ? 'updated' : baseOk ? 'updated_with_issues' : 'failed';
     return buildUpdateNowResult({
         packageName,
         from: check.current,
@@ -341,7 +376,7 @@ export async function runSksUpdateNow(options = {}) {
         cwd,
         registry,
         globalRoot,
-        status: ok ? 'updated' : 'failed',
+        status,
         ok,
         installCode: install.code,
         oldVersionDoctor,
@@ -352,15 +387,17 @@ export async function runSksUpdateNow(options = {}) {
         migrationCurrent,
         sksMenuBar,
         stages,
-        error: ok ? null : updateNowError(install, newBinary, newVersionDoctor, migrationCurrent)
+        verification,
+        error: ok ? null : status === 'updated_with_issues' ? verificationError(verification) : updateNowError(install, newBinary, newVersionDoctor, migrationCurrent)
     });
 }
-async function runUpdateGlobalSkillsReconcile(stage) {
-    const result = await reconcileSkills({
+async function runUpdateGlobalSkillsReconcile(stage, opts = {}) {
+    const work = reconcileSkills({
         targetDir: path.join(os.homedir(), '.agents', 'skills'),
         scope: 'global',
         fix: true
     }).catch((err) => ({ schema: 'sks.skill-reconcile.v1', ok: false, error: err?.message || String(err) }));
+    const result = opts.quiet ? await work : await withHeartbeat('skills reconcile', work, { warnAfterMs: 30_000 });
     const ok = result.ok !== false && !result.error;
     stage('global_skills_reconcile', ok, ok ? 'reconciled' : 'failed', {
         installed: Array.isArray(result.installed) ? result.installed.length : null,
@@ -534,6 +571,7 @@ function buildUpdateNowResult(input) {
         migration_current: input.migrationCurrent,
         sks_menubar: input.sksMenuBar || null,
         stages: input.stages,
+        verification: input.verification || [],
         error: input.error
     };
 }
@@ -542,11 +580,12 @@ async function installUpdateSksMenuBar(input) {
         input.stage('sks_menubar', true, 'skipped', { reason: 'SKS_UPDATE_SKIP_SKS_MENUBAR=1' });
         return null;
     }
-    const result = await installSksMenuBar({
+    const work = installSksMenuBar({
         root: input.root,
         apply: true,
         launch: true,
-        env: input.env
+        env: input.env,
+        quiet: input.quiet === true
     }).catch((err) => ({
         schema: 'sks.codex-app-sks-menubar.v1',
         ok: false,
@@ -572,6 +611,7 @@ async function installUpdateSksMenuBar(input) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    const result = input.quiet ? await work : await withHeartbeat('SKS menu bar install', work, { warnAfterMs: 30_000 });
     input.stage('sks_menubar', result.ok !== false, result.status, {
         app_path: result.app_path,
         launch_agent_path: result.launch_agent_path,
@@ -597,6 +637,63 @@ function parseVersionText(text) {
 function globalSksRootPath() {
     return path.join(process.env.HOME || os.homedir(), '.sneakoscope-global');
 }
+function updateDoctorTimeoutMs(env) {
+    const override = Number.parseInt(env.SKS_UPDATE_NEW_DOCTOR_TIMEOUT_MS || env.SKS_MIGRATION_DOCTOR_TIMEOUT_MS || '', 10);
+    return Number.isFinite(override) && override > 0 ? override : 180_000;
+}
+async function updateHeartbeat(quiet, label, work, warnAfterMs = 60_000) {
+    return quiet ? work : withHeartbeat(label, work, { warnAfterMs });
+}
+async function runFinalUpdateVerification(input) {
+    if (!input.installOk || !input.newBinary || !input.installVersion)
+        return [];
+    const verification = [];
+    const versionProbe = await runProcess(process.execPath, [input.newBinary, '--version'], {
+        timeoutMs: 5000,
+        maxOutputBytes: 4096,
+        env: { ...input.env, SKS_UPDATE_MIGRATION_GATE_DISABLED: '1', SKS_DISABLE_UPDATE_CHECK: '1' }
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const got = parseVersionText(`${versionProbe.stdout || ''}\n${versionProbe.stderr || ''}`);
+    verification.push({
+        id: 'version_match',
+        ok: got === input.installVersion,
+        detail: `expected ${input.installVersion}, got ${got || 'missing'}`,
+        remediation: 'Run: sks update now --version <expected>'
+    });
+    const hookState = await readCodexHookActualState(input.projectReceiptRoot).catch(() => null);
+    const managedEntries = (hookState?.entries || []).filter((entry) => entry.managed === true);
+    const untrusted = managedEntries.filter((entry) => entry.trust_status !== 'Trusted' && entry.trust_status !== 'Managed');
+    verification.push({
+        id: 'hooks_trusted',
+        ok: Boolean(hookState && hookState.ok !== false && managedEntries.length > 0 && untrusted.length === 0),
+        detail: untrusted.length ? untrusted.map((entry) => entry.key).slice(0, 3).join(', ') : `managed ${managedEntries.length}`,
+        remediation: 'Run: sks codex trust-doctor --fix --managed --actual'
+    });
+    const stampPath = path.join(path.dirname(input.newBinary), '..', '.sks-build-stamp.json');
+    const stamp = await readJson(stampPath, null).catch(() => null);
+    const stampVersion = stamp?.package_version || stamp?.version || null;
+    verification.push({
+        id: 'dist_stamp',
+        ok: stampVersion === input.installVersion,
+        detail: `expected ${input.installVersion}, got ${stampVersion || 'missing'}`,
+        remediation: 'Run: npm run build:incremental'
+    });
+    const home = input.env.HOME || os.homedir();
+    const skillsManifest = await readJson(path.join(home, '.agents', 'skills', '.sks-generated.json'), null).catch(() => null);
+    verification.push({
+        id: 'skills_manifest',
+        ok: skillsManifest?.version === input.installVersion,
+        detail: `expected ${input.installVersion}, got ${skillsManifest?.version || 'missing'}`,
+        remediation: 'Run: sks doctor --fix --yes'
+    });
+    return verification;
+}
+function verificationError(verification) {
+    const failed = verification.filter((item) => !item.ok);
+    return failed.length
+        ? `update self-verification failed: ${failed.map((item) => item.id).join(', ')}`
+        : 'update self-verification did not run';
+}
 function updateNowError(install, newBinary, newVersionDoctor, migrationCurrent) {
     if (install.code !== 0)
         return `${install.stderr || install.stdout || 'npm global install failed'}`.trim();

package/dist/core/verification/diff-quality.js

@@ -0,0 +1,100 @@
+import path from 'node:path';
+import { findReferences, pickScanTool } from './impact-scan.js';
+const ADDED_EXPORT_RE = /^\+\s*export\s+(?:async\s+)?(?:function|const|class|interface|type)\s+([A-Za-z_$][\w$]*)\b/;
+export async function analyzeDiffQuality(input) {
+    const planFiles = new Set((input.plannedFiles || []).map(normalizePath).filter(Boolean));
+    const touchedFiles = new Set(input.changedFiles.map(normalizePath).filter(Boolean));
+    const ratio = touchedFiles.size / Math.max(1, planFiles.size || touchedFiles.size || 1);
+    const deadAdditions = await detectDeadAdditions(input.root, input.patchText, input.changedFiles);
+    const commentNoise = detectCommentNoise(input.patchText);
+    const guardBloat = detectGuardBloat(input.patchText);
+    const warnings = [
+        ...(ratio > 2 ? [`minimality_ratio:${ratio.toFixed(2)}`] : []),
+        ...(commentNoise > 0 ? [`comment_noise:${commentNoise}`] : []),
+        ...(guardBloat > 0 ? [`guard_bloat:${guardBloat}`] : [])
+    ];
+    const errors = deadAdditions.map((name) => `dead_addition:${name}`);
+    return {
+        schema: 'sks.diff-quality.v1',
+        minimality: {
+            plan_files: planFiles.size,
+            touched_files: touchedFiles.size,
+            ratio: Number(ratio.toFixed(3))
+        },
+        dead_additions: deadAdditions,
+        comment_noise: commentNoise,
+        guard_bloat: guardBloat,
+        warnings,
+        errors
+    };
+}
+function addedExports(patchText, changedFiles) {
+    const out = [];
+    let currentFile = normalizePath(changedFiles[0] || '');
+    for (const line of String(patchText || '').split(/\r?\n/)) {
+        if (line.startsWith('+++ b/')) {
+            currentFile = normalizePath(line.slice('+++ b/'.length));
+            continue;
+        }
+        const match = line.match(ADDED_EXPORT_RE);
+        if (match?.[1])
+            out.push({ name: match[1], file: currentFile });
+    }
+    const seen = new Set();
+    return out.filter((row) => {
+        const key = `${row.file}:${row.name}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+async function detectDeadAdditions(root, patchText, changedFiles) {
+    const additions = addedExports(patchText, changedFiles);
+    if (!additions.length)
+        return [];
+    const tool = await pickScanTool();
+    const dead = [];
+    for (const addition of additions) {
+        const refs = await findReferences(root, addition.name, tool, { excludeFile: addition.file });
+        if (!refs.length)
+            dead.push(addition.name);
+    }
+    return dead;
+}
+function detectCommentNoise(patchText) {
+    const added = String(patchText || '').split(/\r?\n/).filter((line) => line.startsWith('+') && !line.startsWith('+++'));
+    let count = 0;
+    for (let i = 0; i < added.length - 1; i += 1) {
+        const comment = added[i]?.replace(/^\+\s*/, '') || '';
+        const code = added[i + 1]?.replace(/^\+\s*/, '') || '';
+        if (!/^(\/\/|\/\*|\*)/.test(comment.trim()))
+            continue;
+        if (tokenOverlap(comment, code) >= 0.7)
+            count += 1;
+    }
+    return count;
+}
+function detectGuardBloat(patchText) {
+    const text = String(patchText || '').split(/\r?\n/).filter((line) => line.startsWith('+') && !line.startsWith('+++')).map((line) => line.slice(1)).join('\n');
+    const matches = text.match(/catch\s*\([^)]*\)\s*\{\s*(?:console\.(?:log|warn|error)\([^)]*\);?\s*)?\}/g);
+    return matches?.length || 0;
+}
+function tokenOverlap(a, b) {
+    const left = tokens(a);
+    const right = tokens(b);
+    if (!left.size || !right.size)
+        return 0;
+    let overlap = 0;
+    for (const token of left)
+        if (right.has(token))
+            overlap += 1;
+    return overlap / Math.max(1, Math.min(left.size, right.size));
+}
+function tokens(value) {
+    return new Set(String(value || '').toLowerCase().match(/[a-z0-9_]{3,}/g) || []);
+}
+function normalizePath(value) {
+    return String(value || '').replace(/\\/g, '/').replace(/^\.\/+/, '');
+}
+//# sourceMappingURL=diff-quality.js.map

package/dist/core/verification/impact-scan.js

@@ -0,0 +1,164 @@
+import path from 'node:path';
+import { listFilesRecursive, readText, runProcess, which } from '../fsx.js';
+const DECL_RE = /^\s*export\s+(?:async\s+)?(?:function|const|class|interface|type)\s+([A-Za-z_$][\w$]*)\b/;
+const TEXT_EXT_RE = /\.(?:[cm]?[jt]sx?|json|md|css|scss|html|yml|yaml|toml)$/i;
+export async function scanImpact(root, changedFiles, patchText) {
+    const symbols = extractChangedExportedSymbols(patchText, changedFiles);
+    const tool = await pickScanTool();
+    const references = [];
+    for (const sym of symbols) {
+        references.push(...await findReferences(root, sym.name, tool, { excludeFile: sym.file }));
+    }
+    const patchFiles = new Set(changedFiles.map(normalizePath));
+    const cochange = [...new Set(references.map((ref) => ref.file))]
+        .filter((file) => !patchFiles.has(normalizePath(file)));
+    return {
+        schema: 'sks.impact-scan.v1',
+        changed_symbols: symbols,
+        references,
+        cochange_required: cochange,
+        tool
+    };
+}
+export function extractChangedExportedSymbols(patchText, changedFiles) {
+    const symbols = [];
+    let currentFile = normalizePath(changedFiles[0] || '');
+    for (const rawLine of String(patchText || '').split(/\r?\n/)) {
+        if (rawLine.startsWith('+++ b/')) {
+            currentFile = normalizePath(rawLine.slice('+++ b/'.length));
+            continue;
+        }
+        if (rawLine.startsWith('--- ') || !rawLine.startsWith('-'))
+            continue;
+        const line = rawLine.slice(1);
+        const match = line.match(DECL_RE);
+        if (!match?.[1])
+            continue;
+        symbols.push({ name: match[1], file: currentFile, kind: 'export' });
+    }
+    return dedupeSymbols(symbols);
+}
+export async function pickScanTool() {
+    if (await which('ast-grep'))
+        return 'ast-grep';
+    if (await which('rg'))
+        return 'ripgrep';
+    return 'builtin';
+}
+export async function findReferences(root, symbol, tool, opts = {}) {
+    const normalizedExclude = normalizePath(opts.excludeFile || '');
+    if (!symbol || !/^[A-Za-z_$][\w$]*$/.test(symbol))
+        return [];
+    if (tool === 'ast-grep') {
+        const refs = await astGrepReferences(root, symbol, normalizedExclude);
+        if (refs.length)
+            return refs;
+    }
+    if (tool === 'ast-grep' || tool === 'ripgrep') {
+        const refs = await ripgrepReferences(root, symbol, normalizedExclude);
+        if (refs.length || tool === 'ripgrep')
+            return refs;
+    }
+    return builtinReferences(root, symbol, normalizedExclude);
+}
+async function astGrepReferences(root, symbol, excludeFile) {
+    const result = await runProcess('ast-grep', ['run', '-p', symbol, '--json', root], {
+        cwd: root,
+        timeoutMs: 15_000,
+        maxOutputBytes: 512 * 1024
+    }).catch(() => null);
+    if (!result || result.code !== 0 || !result.stdout.trim())
+        return [];
+    const refs = [];
+    try {
+        const rows = JSON.parse(result.stdout);
+        for (const row of Array.isArray(rows) ? rows : []) {
+            const file = normalizePath(path.relative(root, String(row.file || row.path || '')));
+            if (!file || file === excludeFile || shouldIgnorePath(file))
+                continue;
+            refs.push({
+                symbol,
+                file,
+                line: Number(row.range?.start?.line || row.line || 1),
+                text: String(row.text || row.lines || '').trim().slice(0, 240)
+            });
+        }
+    }
+    catch {
+        return [];
+    }
+    return capReferences(refs);
+}
+async function ripgrepReferences(root, symbol, excludeFile) {
+    const result = await runProcess('rg', ['-n', '--glob', '!node_modules', '--glob', '!.git', '--glob', '!dist', `\\b${escapeRegex(symbol)}\\b`, '.'], {
+        cwd: root,
+        timeoutMs: 15_000,
+        maxOutputBytes: 512 * 1024
+    }).catch(() => null);
+    if (!result || (result.code !== 0 && !result.stdout))
+        return [];
+    return capReferences(String(result.stdout || '').split(/\r?\n/).flatMap((line) => {
+        const match = line.match(/^(.+?):(\d+):(.*)$/);
+        if (!match)
+            return [];
+        const file = normalizePath(match[1] || '');
+        if (!file || file === excludeFile || shouldIgnorePath(file))
+            return [];
+        return [{ symbol, file, line: Number(match[2] || 1), text: String(match[3] || '').trim().slice(0, 240) }];
+    }));
+}
+async function builtinReferences(root, symbol, excludeFile) {
+    const files = await listFilesRecursive(root, { ignore: ['.git', 'node_modules', 'dist', '.sneakoscope/tmp', '.sneakoscope/arenas'], maxFiles: 30_000 });
+    const word = new RegExp(`\\b${escapeRegex(symbol)}\\b`);
+    const refs = [];
+    for (const abs of files) {
+        const file = normalizePath(path.relative(root, abs));
+        if (!TEXT_EXT_RE.test(file) || file === excludeFile || shouldIgnorePath(file))
+            continue;
+        const text = await readText(abs, '').catch(() => '');
+        if (!word.test(String(text)))
+            continue;
+        const lines = String(text).split(/\r?\n/);
+        let perFile = 0;
+        for (let index = 0; index < lines.length && perFile < 50; index += 1) {
+            if (!word.test(lines[index] || ''))
+                continue;
+            refs.push({ symbol, file, line: index + 1, text: String(lines[index] || '').trim().slice(0, 240) });
+            perFile += 1;
+        }
+    }
+    return capReferences(refs);
+}
+function capReferences(refs) {
+    const perFile = new Map();
+    const out = [];
+    for (const ref of refs) {
+        const key = `${ref.symbol}:${ref.file}`;
+        const count = perFile.get(key) || 0;
+        if (count >= 50)
+            continue;
+        perFile.set(key, count + 1);
+        out.push(ref);
+    }
+    return out.slice(0, 500);
+}
+function dedupeSymbols(symbols) {
+    const seen = new Set();
+    return symbols.filter((sym) => {
+        const key = `${sym.file}:${sym.name}:${sym.kind}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function shouldIgnorePath(file) {
+    return file.startsWith('node_modules/') || file.startsWith('.git/') || file.startsWith('dist/');
+}
+function normalizePath(value) {
+    return String(value || '').replace(/\\/g, '/').replace(/^\.\/+/, '');
+}
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=impact-scan.js.map