sneakoscope 4.8.7 → 5.1.2

package/dist/scripts/codex-native-read-repair-split-blackbox.js

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
-import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
-import { createCodexNativeRuntimeFixture, withFixtureEnv } from './codex-native-runtime-e2e-fixture.js';
-const fixture = await createCodexNativeRuntimeFixture({
-    hook: 'approved',
-    agentType: 'supported',
-    appHandoff: true,
-    imagePathExposure: true,
-    mcpCandidates: true,
-    codeModeWebSearch: true
-});
-const previous = process.env.CODEX_HOME;
-process.env.CODEX_HOME = path.join(fixture.root, 'codex-home');
-try {
-    await withFixtureEnv(fixture, async () => {
-        await buildCodexNativeFeatureMatrix({ root: fixture.root, mode: 'read-only' });
-        assertGate(!(await exists(path.join(fixture.root, 'codex-home', 'skills'))), 'read-only matrix created skills');
-        assertGate(!(await exists(path.join(fixture.root, 'codex-home', 'agents'))), 'read-only matrix created agent roles');
-        const repair = await repairCodexNativeManagedAssets({ root: fixture.root, requestedBy: 'manual', yes: true });
-        assertGate(repair.repaired.some((row) => row.asset === 'skills'), 'repair transaction did not include skills', repair);
-        assertGate(await exists(path.join(fixture.root, 'codex-home', 'skills')), 'repair transaction did not create managed skills');
-        assertGate(await exists(path.join(fixture.root, 'codex-home', 'agents')), 'repair transaction did not create managed agent roles');
-        const matrixAfter = await buildCodexNativeFeatureMatrix({ root: fixture.root, mode: 'read-only' });
-        assertGate(matrixAfter.features.skill_sync.ok === true || matrixAfter.features.agent_roles.ok === true, 'post-repair read-only matrix did not reflect managed assets', matrixAfter);
-    });
-}
-finally {
-    if (previous === undefined)
-        delete process.env.CODEX_HOME;
-    else
-        process.env.CODEX_HOME = previous;
-}
-emitGate('codex-native:read-repair-split-blackbox');
-async function exists(file) {
-    try {
-        await fs.stat(file);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function assertGate(condition, message, detail = {}) {
-    if (condition)
-        return;
-    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
-    process.exit(1);
-}
-function emitGate(gate) {
-    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
-}
-//# sourceMappingURL=codex-native-read-repair-split-blackbox.js.map

package/dist/scripts/codex-native-reference-cache-blackbox.js

@@ -1,41 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { runProcess } from '../core/fsx.js';
-import { ensureCodexNativeReferenceSnapshot } from '../core/codex-native/codex-native-reference-cache.js';
-import { analyzeCodexNativeReferenceSource } from '../core/codex-native/codex-native-reference-source.js';
-const missing = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-missing-'));
-const missingReport = await ensureCodexNativeReferenceSnapshot({ root: missing, offline: true });
-assertGate(missingReport.ok === false && missingReport.blockers.includes('source_snapshot_missing'), 'offline no-cache scenario must report source_snapshot_missing', missingReport);
-const missingEvidence = await analyzeCodexNativeReferenceSource({ root: missing, writeReport: false });
-assertGate(missingEvidence.blockers.includes('source_snapshot_missing') && missingEvidence.evidence.length === 0, 'missing cache must not hallucinate evidence', missingEvidence);
-const reused = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-reused-'));
-await fs.mkdir(path.join(reused, '.sneakoscope', 'cache', 'codex-native-reference'), { recursive: true });
-await fs.writeFile(path.join(reused, '.sneakoscope', 'cache', 'codex-native-reference', 'README.md'), 'npx plugin hook agent_type fallback AGENTS.md doctor MCP managed proof\n', 'utf8');
-const reusedReport = await ensureCodexNativeReferenceSnapshot({ root: reused, offline: true });
-assertGate(reusedReport.ok === true && reusedReport.refreshed === false, 'offline existing cache should be reused', reusedReport);
-const source = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-source-'));
-await fs.writeFile(path.join(source, 'README.md'), 'npx plugin hook agent_type fallback AGENTS.md doctor MCP managed proof\n', 'utf8');
-await runProcess('git', ['init'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
-await runProcess('git', ['add', 'README.md'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
-await runProcess('git', ['-c', 'user.email=sks@example.invalid', '-c', 'user.name=SKS', 'commit', '-m', 'fixture'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
-const refreshedRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-refresh-'));
-const refreshed = await ensureCodexNativeReferenceSnapshot({ root: refreshedRoot, sourceUrl: source, refresh: true });
-const serialized = JSON.stringify(refreshed);
-assertGate(refreshed.ok === true && refreshed.refreshed === true && typeof refreshed.source_sha === 'string', 'refresh from local git source should record source sha', refreshed);
-assertGate(!serialized.includes(source), 'cache report leaked raw source URL/path', refreshed);
-const evidence = await analyzeCodexNativeReferenceSource({ root: refreshedRoot, writeReport: true });
-const docs = await fs.readFile(path.join(refreshedRoot, 'docs', 'codex-native-patterns.md'), 'utf8');
-assertGate(!JSON.stringify(evidence).includes(source) && !docs.includes(source), 'reference evidence/docs leaked raw source URL/path', { evidence, docs });
-emitGate('codex-native:reference-cache-blackbox');
-function assertGate(condition, message, detail = {}) {
-    if (condition)
-        return;
-    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
-    process.exit(1);
-}
-function emitGate(gate) {
-    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
-}
-//# sourceMappingURL=codex-native-reference-cache-blackbox.js.map

package/dist/scripts/core-skill-integrity-blackbox.js

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
-import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
-import { buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
-import { initProject } from '../core/init.js';
-const root = await makeTempRoot('sks-core-blackbox-');
-const skillsRoot = path.join(root, '.agents', 'skills');
-const expectedSkillCount = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills.length;
-const first = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-const second = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-await writeText(path.join(skillsRoot, 'research', 'SKILL.md'), `${renderCoreSkillTemplate('research')}\nmutated\n`);
-const third = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-const restoredText = await fs.readFile(path.join(skillsRoot, 'research', 'SKILL.md'), 'utf8');
-const userRoot = path.join(root, 'user-skills');
-await writeUserSkill(root, 'user-skills', 'research', 'research');
-const user = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot: userRoot });
-const setupRoot = await makeTempRoot('sks-core-setup-blackbox-');
-const setup = await initProject(setupRoot, { force: true, installScope: 'project', localOnly: true, globalCommand: 'sks' });
-const setupIntegrity = await syncCoreSkillsIntegrity({ root: setupRoot, apply: false, skillsRoot: path.join(setupRoot, '.agents', 'skills') });
-const setupRestore = await initProject(setupRoot, { force: true, installScope: 'project', localOnly: true, globalCommand: 'sks' });
-const setupLoopExists = await fs.stat(path.join(setupRoot, '.agents', 'skills', 'loop', 'SKILL.md')).then(() => true, () => false);
-assertGate(first.installed.length === expectedSkillCount, 'blackbox A: first sync installs missing core skills', first);
-assertGate(second.installed.length === 0 && second.restored.length === 0, 'blackbox B: second sync changes nothing', second);
-assertGate(third.restored.length === 1 && restoredText === renderCoreSkillTemplate('research'), 'blackbox C: managed drift restored exactly', third);
-assertGate(user.skipped_user_authored.length === 1, 'blackbox D: user skill is not overwritten', user);
-assertGate((setup.skill_install?.installed_skills || []).length === 0, 'blackbox E: project setup must not install official/core skills locally', setup.skill_install);
-assertGate(setupIntegrity.restored.length === 0 && setupIntegrity.skipped_user_authored.length === 0, 'blackbox F: setup-produced core skills are current', setupIntegrity);
-assertGate((setupRestore.skill_install?.installed_skills || []).length === 0 && !setupLoopExists, 'blackbox G: project setup remains official-skill-free on repeat init', setupRestore.skill_install);
-emitGate('core-skill:integrity-blackbox');
-//# sourceMappingURL=core-skill-integrity-blackbox.js.map

package/dist/scripts/dfix-fast-blackbox-check.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { emitGate } from './sks-1-12-real-execution-check-lib.js';
-const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-dfix-fast-blackbox-'));
-fs.mkdirSync(path.join(root, '.sneakoscope'), { recursive: true });
-fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({
-    private: true,
-    type: 'module',
-    scripts: {
-        test: 'node test.mjs',
-        'test:unit': 'node test.mjs',
-        'dfix:fixture': 'node test.mjs',
-        'dfix:verification': 'node test.mjs'
-    }
-}, null, 2));
-fs.writeFileSync(path.join(root, 'value.js'), 'export const value = "bad";\n');
-fs.writeFileSync(path.join(root, 'test.mjs'), 'import { value } from "./value.js"; if (value !== "good") throw new Error("expected good");\n');
-const sks = path.join(process.cwd(), 'dist', 'bin', 'sks.js');
-const env = { ...process.env, SKS_DISABLE_UPDATE_CHECK: '1' };
-const diagnose = run(root, sks, ['dfix', 'diagnose', 'fix value', '--file', 'value.js', '--error', 'AssertionError: expected good at value.js:1', '--json'], env);
-const mission = JSON.parse(diagnose.stdout).mission_id;
-const patch = run(root, sks, ['dfix', 'patch', mission, '--file', 'value.js', '--find', 'bad', '--replace', 'good', '--apply', '--json'], env);
-const verify = run(root, sks, ['dfix', 'verify', mission, '--command', 'node test.mjs', '--verify-auto', '--json'], env);
-const ok = diagnose.status === 0 && patch.status === 0 && verify.status === 0 && fs.readFileSync(path.join(root, 'value.js'), 'utf8').includes('"good"');
-console.log(JSON.stringify({ schema: 'sks.dfix-fast-blackbox-check.v1', ok, mission_id: mission, root }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-else
-    emitGate('dfix:blackbox-fast', { mission_id: mission });
-function run(cwd, bin, args, env) {
-    return spawnSync(process.execPath, [bin, ...args], { cwd, env, encoding: 'utf8', timeout: 30_000 });
-}
-//# sourceMappingURL=dfix-fast-blackbox-check.js.map

package/dist/scripts/dfix-parallel-write-blackbox.js

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const applyMod = await importDist('core/agents/agent-patch-apply-worker.js');
-const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-dfix-patch-'));
-fs.writeFileSync(path.join(tmp, 'copy.txt'), 'old label\n');
-const envelope = {
-    schema: 'sks.agent-patch-envelope.v1',
-    agent_id: 'dfix-fast-lane',
-    session_id: 'dfix-session',
-    slot_id: 'dfix-slot',
-    generation_index: 1,
-    lease_id: 'lease:dfix-fast-lane:copy.txt',
-    operations: [{ op: 'replace', path: 'copy.txt', search: 'old label', replace: 'new label' }]
-};
-const applied = await applyMod.applyAgentPatchEnvelope(tmp, envelope);
-const dfixFile = path.join(tmp, 'dfix-route.txt');
-fs.writeFileSync(dfixFile, 'old label\n');
-const diagnose = spawnSync(process.execPath, ['dist/bin/sks.js', 'dfix', 'diagnose', 'dfix parallel write route fixture', '--file', dfixFile, '--json'], { cwd: root, encoding: 'utf8', maxBuffer: 1024 * 1024 });
-const diagnoseJson = parseJson(diagnose.stdout);
-const plan = diagnoseJson?.mission_id
-    ? spawnSync(process.execPath, ['dist/bin/sks.js', 'dfix', 'plan', diagnoseJson.mission_id, '--file', dfixFile, '--write-mode', 'parallel', '--apply-patches', '--dry-run-patches', '--max-write-agents', '1', '--json'], { cwd: root, encoding: 'utf8', maxBuffer: 1024 * 1024 })
-    : { status: 1, stdout: '', stderr: 'diagnose mission missing' };
-const planJson = parseJson(plan.stdout);
-const routePolicy = planJson?.patch_plan?.route_parallel_write || null;
-const report = { schema: 'sks.dfix-parallel-write-blackbox.v1', ok: applied.ok && diagnose.status === 0 && plan.status === 0 && routePolicy?.route_level_flags_wired === true, applied, route_command: { diagnose_status: diagnose.status, plan_status: plan.status, mission_id: diagnoseJson?.mission_id || null, route_policy: routePolicy, stderr_tail: `${diagnose.stderr || ''}${plan.stderr || ''}`.slice(-2000) } };
-const out = path.join(root, '.sneakoscope', 'reports', 'dfix-parallel-write-blackbox.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(applied.ok === true, 'DFix parallel write blackbox patch failed', report);
-assertGate(fs.readFileSync(path.join(tmp, 'copy.txt'), 'utf8') === 'new label\n', 'DFix parallel write blackbox content mismatch', report);
-assertGate(routePolicy?.write_mode === 'parallel', 'DFix route must record --write-mode parallel', report);
-assertGate(routePolicy?.apply_patches === true, 'DFix route must record --apply-patches', report);
-assertGate(routePolicy?.dry_run_patches === true, 'DFix route must record --dry-run-patches', report);
-emitGate('dfix:parallel-write-blackbox', { changed_files: applied.changed_files.length });
-function parseJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=dfix-parallel-write-blackbox.js.map

package/dist/scripts/dfix-patch-swarm-route-blackbox.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runPatchSwarmRouteBlackbox } from './agent-patch-swarm-gate-lib.js';
-await runPatchSwarmRouteBlackbox({
-    gate: 'dfix:patch-swarm-route-blackbox',
-    route: '$DFix',
-    routeCommand: 'sks dfix',
-    reportName: 'dfix-patch-swarm-route-blackbox'
-});
-//# sourceMappingURL=dfix-patch-swarm-route-blackbox.js.map

package/dist/scripts/doctor-context7-mcp-repair-blackbox.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
-const root = await makeTempRoot('sks-context7-blackbox-');
-const configPath = path.join(root, '.codex', 'config.toml');
-await writeText(configPath, '[mcp_servers.context7]\ncommand = "npx"\n');
-const repaired = await repairContext7Mcp({ root, apply: true });
-const text = await fs.readFile(configPath, 'utf8');
-assertGate(repaired.ok === true && text.includes('https://mcp.context7.com/mcp'), 'Context7 blackbox must write remote URL', { repaired, text });
-await writeText(configPath, '[mcp_servers.context7]\ndisabled = true\ncommand = "npx"\n');
-const disabled = await repairContext7Mcp({ root, apply: true });
-assertGate(disabled.after_transport === 'disabled' && disabled.repaired === false && disabled.disabled_preserved === true, 'Context7 blackbox must preserve explicitly disabled server', disabled);
-emitGate('doctor:context7-mcp-repair-blackbox');
-//# sourceMappingURL=doctor-context7-mcp-repair-blackbox.js.map

package/dist/scripts/doctor-dirty-repair-blackbox.js

@@ -1,22 +0,0 @@
-// @ts-nocheck
-import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
-import { importDist } from './sks-1-18-gate-lib.js';
-const tmp = await makeTempRoot('doctor-dirty-repair-');
-const planner = await importDist('core/doctor/doctor-dirty-planner.js');
-const tx = await importDist('core/doctor/doctor-transaction.js');
-const proofId = planner.markDoctorPhaseClean(tmp, 'setup');
-await tx.writeDoctorFixTransaction({
-    root: tmp,
-    phases: [],
-    proofIdsUsed: [proofId]
-});
-let ran = false;
-const report = await tx.runDoctorFixTransaction({
-    root: tmp,
-    reportPath: null,
-    dirtyPlan: planner.planDoctorDirtyRepair(tmp, ['setup']),
-    phases: [{ id: 'setup', run: async () => { ran = true; return { id: 'setup', ok: true }; } }]
-});
-assertGate(ran === false && report.ok === true && report.phases[0].warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase')), 'dirty repair must skip clean phase', { ran, report });
-emitGate('doctor:dirty-repair-blackbox', { skipped: true });
-//# sourceMappingURL=doctor-dirty-repair-blackbox.js.map

package/dist/scripts/doctor-dirty-semantic-blackbox.js

@@ -1,8 +0,0 @@
-import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
-const source = readText('src/core/doctor/doctor-dirty-planner.ts');
-assertGate(!source.includes('stat.isDirectory() ? `dir:${stat.mtimeMs}`'), 'doctor dirty planner must not hash directory mtimes');
-assertGate(!source.includes('mtimeMs, text'), 'doctor dirty planner must not mix file mtime into semantic hashes');
-assertGate(source.includes('phaseSemanticState'), 'doctor dirty planner must include phase-specific semantic state');
-assertGate(source.includes('clean_proof_missing'), 'doctor dirty planner must reject markers with missing proof evidence');
-emitGate('doctor:dirty-semantic-blackbox');
-//# sourceMappingURL=doctor-dirty-semantic-blackbox.js.map

package/dist/scripts/doctor-fix-production-blackbox.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
-import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
-import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
-import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
-import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
-const root = await makeTempRoot('sks-doctor-production-');
-await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.context7]\ncommand = "npx"\n\n[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nread_only = true\n\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
-const startup = await repairCodexStartupConfig({ root, apply: true });
-const context7 = await repairContext7Mcp({ root, apply: true });
-const supabase = await repairSupabaseMcp({ root, apply: true });
-const tx = await runDoctorFixTransaction({ root, phases: [
-        { id: 'preflight', run: async () => ({ id: 'preflight', ok: true }) },
-        { id: 'codex_startup_config_repair', run: async () => ({ id: 'codex_startup_config_repair', ok: startup.ok, repaired: true, blockers: startup.blockers, rollback_evidence: 'fixture_config_backup' }) },
-        { id: 'context7_mcp_repair', run: async () => ({ id: 'context7_mcp_repair', ok: context7.ok, repaired: context7.repaired, blockers: context7.blockers, rollback_evidence: 'fixture_context7_backup' }) },
-        { id: 'supabase_mcp_repair', required_for_ready: false, run: async () => ({ id: 'supabase_mcp_repair', ok: supabase.ok, manual_required: supabase.manual_required, required_for_ready: false, blockers: supabase.blockers, warnings: supabase.warnings, rollback_evidence: 'optional_supabase_fixture' }) },
-        { id: 'postcheck', run: async () => ({ id: 'postcheck', ok: true }) }
-    ] });
-const postcheck = doctorRepairPostcheck(tx);
-assertGate(tx.schema === 'sks.doctor-fix-transaction.v2' && tx.raw_secret_values_recorded === false, 'doctor transaction must write production schema without raw secrets', tx);
-assertGate(tx.phases.every((phase) => typeof phase.duration_ms === 'number' && phase.started_at && phase.completed_at), 'doctor transaction phases must include runtime evidence', tx);
-assertGate(postcheck.ok === true, 'doctor repair postcheck must pass when only manual-required optional phases remain', postcheck);
-emitGate('doctor:fix-production-blackbox', { phases: tx.phases.length });
-//# sourceMappingURL=doctor-fix-production-blackbox.js.map

package/dist/scripts/doctor-native-capability-repair-blackbox.js

@@ -1,39 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
-import path from 'node:path';
-const repairableRoot = await makeTempRoot('sks-doctor-native-repairable-');
-process.env.SKS_CHROME_EXTENSION_READY = '1';
-process.env.SKS_COMPUTER_USE_CAPABILITY = 'verified';
-const repairable = await repairNativeCapabilities({ root: repairableRoot, fix: true, yes: true, fixture: 'all-repairable' });
-delete process.env.SKS_CHROME_EXTENSION_READY;
-delete process.env.SKS_COMPUTER_USE_CAPABILITY;
-const manualRoot = await makeTempRoot('sks-doctor-native-manual-');
-const manual = await repairNativeCapabilities({ root: manualRoot, fix: true, yes: true, fixture: 'manual-required' });
-const screenshotBlockedRoot = await makeTempRoot('sks-doctor-native-screenshot-blocked-');
-await writeText(path.join(screenshotBlockedRoot, '.sneakoscope', 'app-screenshots'), 'not-a-directory');
-const screenshotBlocked = await repairNativeCapabilities({
-    root: screenshotBlockedRoot,
-    fix: false,
-    yes: true,
-    fixture: 'all-repairable',
-    capabilities: ['codex_app_screenshot']
-});
-const corruptContractRoot = await makeTempRoot('sks-doctor-native-contract-repair-');
-await writeText(path.join(corruptContractRoot, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json'), '{"schema":"broken"}\n');
-const corruptContract = await repairNativeCapabilities({
-    root: corruptContractRoot,
-    fix: true,
-    yes: true,
-    fixture: 'manual-required',
-    capabilities: ['saved_artifact_path_contract']
-});
-assertGate(repairable.ok === true, 'repairable fixture must verify after doctor native repair', repairable);
-assertGate(manual.capabilities.some((state) => state.repairability === 'manual-required' && state.after !== 'verified'), 'manual-only fixture must not fake verified success', manual);
-assertGate(manual.capabilities.find((state) => state.id === 'image_generation')?.after !== 'verified', 'image generation auth missing must not verify', manual);
-assertGate(manual.capabilities.find((state) => state.id === 'chrome_web_review')?.after !== 'verified', 'Chrome/web review missing extension must not verify', manual);
-assertGate(manual.capabilities.find((state) => state.id === 'image_path_exposure')?.after === 'degraded', 'saved artifact path fallback must be degraded rather than verified', manual);
-assertGate(screenshotBlocked.capabilities.find((state) => state.id === 'codex_app_screenshot')?.after === 'blocked', 'unwritable screenshot artifact root must block postcheck', screenshotBlocked);
-assertGate(corruptContract.capabilities.find((state) => state.id === 'saved_artifact_path_contract')?.after === 'verified', 'doctor fix must repair corrupt saved artifact path contract', corruptContract);
-emitGate('doctor:native-capability-repair-blackbox');
-//# sourceMappingURL=doctor-native-capability-repair-blackbox.js.map

package/dist/scripts/doctor-startup-config-repair-blackbox.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
-const root = await makeTempRoot('sks-startup-config-blackbox-');
-await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
-const report = await repairCodexStartupConfig({ root, apply: true });
-const text = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
-assertGate(report.ok === true, 'startup config blackbox must pass postcheck', report);
-assertGate(!text.includes('message_role_prefix') && /config_file = "\//.test(text), 'startup config blackbox must rewrite to absolute config paths and remove unsupported fields', { text });
-emitGate('doctor:startup-config-repair-blackbox');
-//# sourceMappingURL=doctor-startup-config-repair-blackbox.js.map

package/dist/scripts/doctor-supabase-mcp-repair-blackbox.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
-const root = await makeTempRoot('sks-supabase-mcp-blackbox-');
-delete process.env.SUPABASE_ACCESS_TOKEN;
-await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nSUPABASE_ACCESS_TOKEN = "env:SUPABASE_ACCESS_TOKEN"\n');
-const unsafe = await repairSupabaseMcp({ root, apply: true });
-assertGate(unsafe.ok === true && unsafe.manual_required === true && unsafe.read_only_migrated === true && unsafe.ready_blocking === false, 'Supabase unsafe write access must be migrated to read-only without passing silently as write-ready', unsafe);
-await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase_sauron]\ndisabled = true\n');
-const optional = await repairSupabaseMcp({ root, apply: true });
-assertGate(optional.ok === true && optional.disabled === true && optional.disabled_preserved === true, 'optional disabled Supabase config must be preserved', optional);
-emitGate('doctor:supabase-mcp-repair-blackbox');
-//# sourceMappingURL=doctor-supabase-mcp-repair-blackbox.js.map

package/dist/scripts/doctor-transaction-engine-blackbox.js

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
-import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
-import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
-const root = await makeTempRoot('sks-doctor-tx-blackbox-');
-const tx = await runDoctorFixTransaction({
-    root,
-    phases: [
-        { id: 'preflight', run: async () => ({ id: 'preflight', ok: true, artifact_path: `${root}/preflight.json` }) },
-        {
-            id: 'postchecked',
-            run: async () => ({ id: 'postchecked', ok: true }),
-            postcheck: async () => ({ ok: true, warnings: ['postcheck_executed'] })
-        },
-        {
-            id: 'optional_operator',
-            required_for_ready: false,
-            run: async () => ({ id: 'optional_operator', ok: false, manual_required: true, required_for_ready: false, blockers: ['operator_action_required'] })
-        }
-    ],
-    reportPath: null
-});
-const postcheck = doctorRepairPostcheck(tx);
-assertGate(tx.ok === true && postcheck.ok === true, 'doctor transaction blackbox must allow optional manual follow-up without blocking readiness', { tx, postcheck });
-assertGate(tx.phases.some((phase) => phase.warnings.includes('postcheck_executed')), 'doctor transaction blackbox must run phase postchecks', tx);
-assertGate(tx.raw_secret_values_recorded === false, 'doctor transaction blackbox must not record raw secrets', tx);
-emitGate('doctor:transaction-engine-blackbox', { phases: tx.phases.length });
-//# sourceMappingURL=doctor-transaction-engine-blackbox.js.map

package/dist/scripts/doctor-zellij-fix-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('doctor:zellij-fix-blackbox');
-//# sourceMappingURL=doctor-zellij-fix-blackbox.js.map

package/dist/scripts/doctor-zellij-no-homebrew-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('doctor:zellij-no-homebrew-blackbox');
-//# sourceMappingURL=doctor-zellij-no-homebrew-blackbox.js.map

package/dist/scripts/doctor-zellij-upgrade-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('doctor:zellij-upgrade-blackbox');
-//# sourceMappingURL=doctor-zellij-upgrade-blackbox.js.map

package/dist/scripts/gate-pack-runner-blackbox.js

@@ -1,27 +0,0 @@
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
-import { importDist } from './sks-1-18-gate-lib.js';
-const tmp = await makeTempRoot('sks-gate-pack-');
-await fs.writeFile(path.join(tmp, 'package.json'), JSON.stringify({ version: '4.0.0', scripts: { 'triwiki:proof-card': 'node -e "process.exit(0)"' } }, null, 2));
-await fs.writeFile(path.join(tmp, 'package-lock.json'), JSON.stringify({ lockfileVersion: 3 }));
-await fs.writeFile(path.join(tmp, 'release-gates.v2.json'), JSON.stringify({
-    schema: 'sks.release-gates.v2',
-    gates: [{
-            id: 'triwiki:proof-card',
-            command: 'npm run triwiki:proof-card --silent',
-            deps: [],
-            resource: ['cpu-light'],
-            side_effect: 'hermetic',
-            timeout_ms: 1000,
-            cache: { enabled: true, inputs: ['package.json'] },
-            isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
-            preset: ['release']
-        }]
-}, null, 2));
-const runner = await importDist('core/release/gate-pack-runner.js');
-const report = await runner.executeGatePack({ root: tmp, packId: 'triwiki', mode: 'execute' });
-assertGate(report.ok === true && report.executed === 1 && report.proof_paths.length >= 2, 'gate pack blackbox must execute and write gate plus pack proof', report);
-emitGate('gate-pack:runner-blackbox', { executed: report.executed, proofs: report.proof_paths.length });
-//# sourceMappingURL=gate-pack-runner-blackbox.js.map

package/dist/scripts/gate-pack-v2-blackbox.js

@@ -1,18 +0,0 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { importDist } from './sks-1-18-gate-lib.js';
-const tmp = await makeTempRoot('sks-gate-pack-v2-');
-await writeText(path.join(tmp, 'package.json'), JSON.stringify({ version: '4.0.2', scripts: { 'triwiki:proof-card': 'node -e "if(!process.env.SKS_GATE_PACK_ARTIFACT) process.exit(2)"' } }, null, 2));
-await writeText(path.join(tmp, 'package-lock.json'), JSON.stringify({ lockfileVersion: 3 }, null, 2));
-await writeText(path.join(tmp, 'release-gates.v2.json'), JSON.stringify({ schema: 'sks.release-gates.v2', gates: [gate('triwiki:proof-card')] }, null, 2));
-await fs.mkdir(path.join(tmp, 'src/core/triwiki'), { recursive: true });
-const runner = await importDist('core/release/gate-pack-runner.js');
-const report = await runner.executeGatePack({ root: tmp, packId: 'triwiki', mode: 'execute' });
-assertGate(report.ok === true && report.executed === 1, 'gate pack v2 must execute through async runner', report);
-assertGate(report.proof_paths.length >= 2, 'gate pack v2 must write gate and pack proofs', report);
-emitGate('gate-pack:v2-blackbox', { executed: report.executed, proofs: report.proof_paths.length });
-function gate(id) {
-    return { id, command: `npm run ${id} --silent`, deps: [], resource: ['cpu-light'], side_effect: 'hermetic', timeout_ms: 5000, cache: { enabled: false, inputs: ['package.json'] }, isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' }, preset: ['release'] };
-}
-//# sourceMappingURL=gate-pack-v2-blackbox.js.map

package/dist/scripts/geo-cli-blackbox-check.js

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, runSks, runSksJson } from './search-visibility-gate-lib.js';
-const commands = runSksJson(['commands', '--json']).json;
-assertGate(commands.commands.some((row) => row.name === 'seo-geo-optimizer' && /unified SEO\/GEO optimizer/i.test(row.description)), 'commands --json must expose seo-geo-optimizer');
-assertGate(!commands.commands.some((row) => row.name === 'seo' || row.name === 'geo'), 'commands --json must not expose split seo/geo command surfaces');
-const optimizerUsage = runSks(['usage', 'seo-geo-optimizer']);
-assertGate(/sks seo-geo-optimizer \[seo\|geo\] doctor\|audit\|plan\|apply\|verify\|status\|rollback\|fixture/.test(optimizerUsage.stdout), 'usage seo-geo-optimizer must expose unified lifecycle');
-const doctor = runSksJson(['seo-geo-optimizer', 'doctor', '--mode', 'geo', '--json']).json;
-assertGate(doctor.route === '$SEO-GEO-OPTIMIZER' && doctor.schema === 'sks.search-visibility.doctor-command.v1', 'optimizer geo doctor must preserve unified route identity', doctor);
-const invalid = runSks(['seo-geo-optimizer', 'nonsense-subcommand', '--mode', 'geo'], { allowFailure: true });
-assertGate(invalid.status === 2 && /Usage: sks seo-geo-optimizer/.test(invalid.stderr), 'invalid optimizer subcommand must exit 2 with usage', {
-    status: invalid.status,
-    stdout: invalid.stdout,
-    stderr: invalid.stderr,
-});
-emitGate('geo:cli-blackbox', { adapter: doctor.adapter, confidence: doctor.confidence });
-//# sourceMappingURL=geo-cli-blackbox-check.js.map

package/dist/scripts/loop-collision-blackbox.js

@@ -1,3 +0,0 @@
-import { runLoopDirectiveCheck } from './loop-directive-check-lib.js';
-await runLoopDirectiveCheck('loop:collision-blackbox');
-//# sourceMappingURL=loop-collision-blackbox.js.map

package/dist/scripts/loop-concurrency-oversubscription-blackbox.js

@@ -1,3 +0,0 @@
-import { runLoopHardeningCheck } from './loop-hardening-check-lib.js';
-await runLoopHardeningCheck('loop:concurrency-oversubscription-blackbox');
-//# sourceMappingURL=loop-concurrency-oversubscription-blackbox.js.map

package/dist/scripts/loop-fixture-production-misuse-blackbox.js

@@ -1,3 +0,0 @@
-import { runLoopHardeningCheck } from './loop-hardening-check-lib.js';
-await runLoopHardeningCheck('loop:fixture-production-misuse-blackbox');
-//# sourceMappingURL=loop-fixture-production-misuse-blackbox.js.map

package/dist/scripts/loop-kill-interrupt-real-blackbox.js

@@ -1,3 +0,0 @@
-import { runLoopHardeningCheck } from './loop-hardening-check-lib.js';
-await runLoopHardeningCheck('loop:kill-interrupt-real-blackbox');
-//# sourceMappingURL=loop-kill-interrupt-real-blackbox.js.map

package/dist/scripts/loop-merge-strategy-blackbox.js

@@ -1,3 +0,0 @@
-import { runLoopHardeningCheck } from './loop-hardening-check-lib.js';
-await runLoopHardeningCheck('loop:merge-strategy-blackbox');
-//# sourceMappingURL=loop-merge-strategy-blackbox.js.map

package/dist/scripts/loop-mesh-production-e2e-blackbox.js

@@ -1,3 +0,0 @@
-import { runLoopHardeningCheck } from './loop-hardening-check-lib.js';
-await runLoopHardeningCheck('loop:mesh-production-e2e-blackbox');
-//# sourceMappingURL=loop-mesh-production-e2e-blackbox.js.map

package/dist/scripts/loop-side-effect-blackbox.js

@@ -1,3 +0,0 @@
-import { runLoopHardeningCheck } from './loop-hardening-check-lib.js';
-await runLoopHardeningCheck('loop:side-effect-blackbox');
-//# sourceMappingURL=loop-side-effect-blackbox.js.map

package/dist/scripts/mad-db-operation-lifecycle-blackbox.js

@@ -1,29 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
-import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
-import { recordMadDbToolResult } from '../core/mad-db/mad-db-result-lifecycle.js';
-import { createMission, missionDir } from '../core/mission.js';
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
-const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-lifecycle-blackbox-'));
-const mission = await createMission(root, { mode: 'mad-db', prompt: 'lifecycle blackbox fixture' });
-await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
-const success = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'blackbox-success-call', sql: 'insert into audit_log(id) values (1)' });
-const successHook = madDbLifecycleHookFromDecision(success);
-assertGate(Boolean(successHook), 'success hook missing', success);
-await recordMadDbToolResult({ root, missionId: mission.id, hook: successHook, ok: true, rowCount: 1 });
-const failure = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'blackbox-failure-call', sql: 'update users set flag = true where id = 1' });
-const failureHook = madDbLifecycleHookFromDecision(failure);
-assertGate(Boolean(failureHook), 'failure hook missing', failure);
-await recordMadDbToolResult({ root, missionId: mission.id, hook: failureHook, ok: false, error: 'fixture failure' });
-const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
-for (const token of ['db_operation.started', 'db_mutation.allowed', 'db_operation.succeeded', 'db_operation.failed']) {
-    assertGate(ledger.includes(token), `Mad-DB ledger missing ${token}`, { ledger });
-}
-assertGate((ledger.match(/db_operation\.succeeded/g) || []).length === 1, 'success terminal event must be recorded exactly once', { ledger });
-assertGate((ledger.match(/db_operation\.failed/g) || []).length === 1, 'failure terminal event must be recorded exactly once', { ledger });
-emitGate('mad-db:operation-lifecycle-blackbox', { succeeded: successHook.operation_id, failed: failureHook.operation_id });
-//# sourceMappingURL=mad-db-operation-lifecycle-blackbox.js.map

package/dist/scripts/mad-sks-actual-executor-blackbox.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runMadSksExecutorCheck } from './lib/mad-sks-actual-executor-check-lib.js';
-await runMadSksExecutorCheck('actual-executor-blackbox');
-//# sourceMappingURL=mad-sks-actual-executor-blackbox.js.map

package/dist/scripts/mad-zellij-headless-fallback-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('mad:zellij-headless-fallback-blackbox');
-//# sourceMappingURL=mad-zellij-headless-fallback-blackbox.js.map

package/dist/scripts/mad-zellij-self-heal-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('mad:zellij-self-heal-blackbox');
-//# sourceMappingURL=mad-zellij-self-heal-blackbox.js.map

package/dist/scripts/naruto-loop-mesh-blackbox.js

@@ -1,3 +0,0 @@
-import { runLoopDirectiveCheck } from './loop-directive-check-lib.js';
-await runLoopDirectiveCheck('naruto:loop-mesh-blackbox');
-//# sourceMappingURL=naruto-loop-mesh-blackbox.js.map