sneakoscope 4.8.7 → 5.3.0

package/dist/scripts/blackbox-pack-install.js

@@ -1,174 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const json = process.argv.includes('--json');
-const dryRun = process.argv.includes('--dry-run');
-const keep = process.argv.includes('--keep');
-const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-const npxBin = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-blackbox-pack-install-'));
-const cache = path.join(tmp, 'npm-cache');
-const prefix = path.join(tmp, 'prefix');
-const consumer = path.join(tmp, 'consumer');
-fs.mkdirSync(consumer, { recursive: true });
-fs.writeFileSync(path.join(consumer, 'package.json'), `${JSON.stringify({ name: 'sks-blackbox-consumer', private: true, version: '0.0.0' }, null, 2)}\n`);
-const steps = [];
-function spawnStep(label, cmd, args, options = {}) {
-    const result = dryRun
-        ? { status: 0, signal: null, stdout: '', stderr: '' }
-        : spawnSync(cmd, args, {
-            cwd: options.cwd || root,
-            encoding: 'utf8',
-            timeout: options.timeout || 120_000,
-            env: childNpmEnv(options.env)
-        });
-    return {
-        label,
-        command: [cmd, ...args].join(' '),
-        cwd: options.cwd || root,
-        status: result.status,
-        ok: result.status === 0,
-        stdout_bytes: Buffer.byteLength(result.stdout || ''),
-        stderr_bytes: Buffer.byteLength(result.stderr || ''),
-        stdout_tail: String(result.stdout || '').slice(-800),
-        stderr_tail: String(result.stderr || '').slice(-800),
-        stdout: result.stdout || '',
-        stderr: result.stderr || ''
-    };
-}
-function childNpmEnv(extra = {}) {
-    const env = { ...process.env, npm_config_cache: cache, npm_config_prefix: prefix, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true', ...extra };
-    delete env.npm_config_dry_run;
-    delete env.NPM_CONFIG_DRY_RUN;
-    return env;
-}
-function run(label, cmd, args, options = {}) {
-    const row = spawnStep(label, cmd, args, options);
-    steps.push(recordStep(row));
-    return row;
-}
-function runWithRetry(label, cmd, args, options = {}) {
-    const attempts = Math.max(1, Number(options.attempts || 2));
-    const attemptRows = [];
-    for (let index = 0; index < attempts; index += 1) {
-        if (index > 0)
-            cleanupInstallAttempt(options.cwd || root);
-        const row = spawnStep(label, cmd, args, options);
-        attemptRows.push(row);
-        if (row.ok || dryRun) {
-            const final = { ...row, label, attempts: index + 1, retry_count: index, attempts_log: attemptRows.map(compactAttempt) };
-            steps.push(recordStep(final));
-            return final;
-        }
-    }
-    const last = attemptRows.at(-1);
-    const final = { ...last, label, attempts, retry_count: attempts - 1, attempts_log: attemptRows.map(compactAttempt) };
-    steps.push(recordStep(final));
-    return final;
-}
-function recordStep(row) {
-    const { stdout, stderr, ...recorded } = row;
-    return recorded;
-}
-function compactAttempt(row) {
-    return {
-        status: row.status,
-        ok: row.ok,
-        stdout_bytes: row.stdout_bytes,
-        stderr_bytes: row.stderr_bytes,
-        stdout_tail: row.stdout_tail,
-        stderr_tail: row.stderr_tail
-    };
-}
-function cleanupInstallAttempt(cwd) {
-    if (dryRun)
-        return;
-    for (const rel of ['node_modules', 'package-lock.json']) {
-        fs.rmSync(path.join(cwd, rel), { recursive: true, force: true });
-    }
-}
-let tarball = dryRun ? path.join(tmp, 'sneakoscope-0.0.0.tgz') : null;
-const pack = run('npm_pack', npmBin, ['pack', '--json', '--ignore-scripts', '--pack-destination', tmp, '--registry', 'https://registry.npmjs.org/']);
-if (pack.ok && !dryRun) {
-    const info = JSON.parse(pack.stdout || '[]')[0];
-    tarball = path.join(tmp, info.filename);
-}
-if (pack.ok)
-    runWithRetry('npm_install_tarball', npmBin, ['install', '--no-audit', '--no-fund', tarball], { cwd: consumer, attempts: 2 });
-if (steps.at(-1)?.ok)
-    run('npx_sks_version', npxBin, ['sks', '--version'], { cwd: consumer });
-if (steps.at(-1)?.ok)
-    run('npx_sks_root_json', npxBin, ['sks', 'root', '--json'], { cwd: consumer });
-if (steps.at(-1)?.ok)
-    run('npx_sks_setup_local_only', npxBin, ['sks', 'setup', '--local-only', '--json'], { cwd: consumer });
-if (steps.at(-1)?.ok)
-    run('npx_sks_selftest_mock', npxBin, ['sks', 'selftest', '--mock'], { cwd: consumer, timeout: 180_000 });
-if (steps.at(-1)?.ok)
-    run('npx_sks_run_execute_mock', npxBin, ['sks', 'run', 'blackbox execute fixture', '--execute', '--mock', '--json'], { cwd: consumer, timeout: 180_000 });
-if (steps.at(-1)?.ok)
-    run('npx_sks_agent_mock', npxBin, ['sks', 'agent', 'run', 'blackbox native agent fixture', '--mock', '--json'], { cwd: consumer, timeout: 180_000 });
-let qaMissionId = null;
-if (steps.at(-1)?.ok) {
-    const qaPrepare = run('npx_sks_qa_loop_prepare', npxBin, ['sks', 'qa-loop', 'prepare', 'blackbox API QA', '--json'], { cwd: consumer, timeout: 180_000 });
-    try {
-        qaMissionId = JSON.parse(qaPrepare.stdout).mission_id || null;
-    }
-    catch { }
-}
-if (steps.at(-1)?.ok)
-    run('npx_sks_qa_loop_run_mock', npxBin, ['sks', 'qa-loop', 'run', qaMissionId || 'latest', '--mock', '--json'], { cwd: consumer, timeout: 180_000 });
-if (steps.at(-1)?.ok) {
-    const proofFile = dryRun ? '<dry-run>' : latestCompletionProof(consumer);
-    steps.push({
-        label: 'verify_completion_proof_exists',
-        command: 'fs.existsSync(.sneakoscope/missions/<latest>/completion-proof.json)',
-        cwd: consumer,
-        status: proofFile ? 0 : 1,
-        ok: Boolean(proofFile),
-        stdout_bytes: 0,
-        stderr_bytes: 0,
-        stderr_tail: proofFile || 'completion-proof.json missing'
-    });
-}
-const result = { schema: 'sks.blackbox-pack-install.v1', ok: steps.every((step) => step.ok), dry_run: dryRun, temp_root: keep ? tmp : null, steps };
-if (!result.ok)
-    result.temp_root = tmp;
-if (!keep && result.ok)
-    fs.rmSync(tmp, { recursive: true, force: true });
-if (json)
-    console.log(JSON.stringify(result, null, 2));
-else {
-    console.log(`Blackbox pack install: ${result.ok ? 'ok' : 'blocked'}${dryRun ? ' (dry-run)' : ''}`);
-    for (const step of steps) {
-        console.log(`- ${step.ok ? 'ok' : 'blocked'} ${step.label}${step.attempts ? ` attempts=${step.attempts}` : ''}`);
-        if (!step.ok && step.stderr_tail)
-            console.log(`  stderr_tail: ${step.stderr_tail.replace(/\n/g, '\\n')}`);
-        if (!step.ok && step.stdout_tail)
-            console.log(`  stdout_tail: ${step.stdout_tail.replace(/\n/g, '\\n')}`);
-    }
-    if (!result.ok)
-        console.log(`temp_root: ${tmp}`);
-}
-if (!result.ok)
-    process.exitCode = 1;
-function latestCompletionProof(rootDir) {
-    const missions = path.join(rootDir, '.sneakoscope', 'missions');
-    if (!fs.existsSync(missions))
-        return null;
-    const ids = fs.readdirSync(missions, { withFileTypes: true })
-        .filter((entry) => entry.isDirectory() && entry.name.startsWith('M-'))
-        .map((entry) => entry.name)
-        .sort();
-    for (const id of ids.reverse()) {
-        const proof = path.join(missions, id, 'completion-proof.json');
-        if (fs.existsSync(proof))
-            return proof;
-    }
-    return null;
-}
-//# sourceMappingURL=blackbox-pack-install.js.map

package/dist/scripts/brand-neutrality-zero-leakage-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
-await runDirective316Gate('brand-neutrality:zero-leakage-blackbox');
-//# sourceMappingURL=brand-neutrality-zero-leakage-blackbox.js.map

package/dist/scripts/build-once-runner-blackbox.js

@@ -1,34 +0,0 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { importDist } from './sks-1-18-gate-lib.js';
-const tmp = await makeTempRoot('sks-build-once-');
-await writeText(path.join(tmp, 'package.json'), JSON.stringify({
-    version: '4.0.2',
-    scripts: {
-        'build:clean': 'node build.mjs',
-        'build:incremental': 'node build.mjs'
-    }
-}, null, 2));
-await writeText(path.join(tmp, 'package-lock.json'), JSON.stringify({ name: 'fixture', version: '4.0.2', lockfileVersion: 3, packages: { '': { version: '4.0.2' } } }, null, 2));
-await writeText(path.join(tmp, 'tsconfig.json'), JSON.stringify({ compilerOptions: { outDir: 'dist' } }, null, 2));
-await writeText(path.join(tmp, 'src/index.ts'), 'export const value = 1;\n');
-await writeText(path.join(tmp, 'build.mjs'), "import fs from 'node:fs'; fs.mkdirSync('dist/bin',{recursive:true}); fs.writeFileSync('dist/bin/sks.js','#!/usr/bin/env node\\n');\n");
-const mod = await importDist('core/build/build-once-runner.js');
-const first = mod.runBuildOnce({ root: tmp, mode: 'clean', force: true });
-const second = mod.runBuildOnce({ root: tmp, mode: 'incremental' });
-await writeText(path.join(tmp, 'src/index.ts'), 'export const value = 2;\n');
-const third = mod.runBuildOnce({ root: tmp, mode: 'incremental' });
-await writeText(path.join(tmp, 'build.mjs'), "import fs from 'node:fs'; fs.mkdirSync('dist/bin',{recursive:true});\n");
-await fs.rm(path.join(tmp, 'dist', 'bin', 'sks.js'), { force: true });
-const broken = mod.runBuildOnce({ root: tmp, mode: 'incremental', force: true });
-await writeText(path.join(tmp, 'build.mjs'), "import fs from 'node:fs'; fs.mkdirSync('dist/bin',{recursive:true}); fs.writeFileSync('dist/bin/sks.js','#!/usr/bin/env node\\n');\n");
-await writeText(path.join(tmp, 'package-lock.json'), JSON.stringify({ name: 'fixture', version: '4.0.2', lockfileVersion: 3, packages: { '': { version: '4.0.2' } }, changed: true }, null, 2));
-const lockChanged = mod.runBuildOnce({ root: tmp, mode: 'incremental' });
-assertGate(first.ok === true && first.reused === false, 'clean build must write an initial proof', first);
-assertGate(second.ok === true && second.reused === true, 'second unchanged incremental run must reuse proof', second);
-assertGate(third.ok === true && third.reused === false && third.source_hash !== first.source_hash, 'source edit must invalidate proof', { first, third });
-assertGate(broken.ok === false && broken.blockers.some((item) => item.includes('dist_target_missing:dist/bin/sks.js')), 'missing dist/bin/sks.js must fail proof', broken);
-assertGate(lockChanged.ok === true && lockChanged.package_lock_hash !== third.package_lock_hash, 'package-lock change must invalidate proof', { third, lockChanged });
-emitGate('build-once:runner-blackbox', { first: first.ok, reused: second.reused, broken: broken.ok });
-//# sourceMappingURL=build-once-runner-blackbox.js.map

package/dist/scripts/codex-0140-integration-blackbox.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
-import { detectCodex0140Capability } from '../core/codex-control/codex-0140-capability.js';
-process.env.SKS_CODEX_0140_FAKE = '1';
-process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.140.0';
-process.env.SKS_CODEX_0140_PROBE = '1';
-const report = await detectCodex0140Capability({ codexBin: 'codex' });
-assertGate(report.ok === true && Object.values(report.features).every(Boolean), 'Codex 0.140 integration blackbox requires every fixture feature', report);
-assertGate(Object.values(report.feature_states).every((state) => state.supported === true && state.certainty === 'fixture'), 'Codex 0.140 integration blackbox requires explicit fixture feature states', report);
-assertGate(Object.keys(report.feature_certainty).length === Object.keys(report.features).length, 'Codex 0.140 integration blackbox requires per-feature certainty coverage', report);
-assertGate(JSON.stringify(report).includes('SUPABASE_ACCESS_TOKEN') === false, 'Codex 0.140 blackbox must not serialize secret env values', report);
-emitGate('codex:0140-integration-blackbox', { feature_count: Object.keys(report.features).length });
-//# sourceMappingURL=codex-0140-integration-blackbox.js.map

package/dist/scripts/codex-agent-type-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
-await runDirective315Gate('codex-app:agent-type-blackbox');
-//# sourceMappingURL=codex-agent-type-blackbox.js.map

package/dist/scripts/codex-app-harness-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('codex-app:harness-blackbox');
-//# sourceMappingURL=codex-app-harness-blackbox.js.map

package/dist/scripts/codex-app-skill-agent-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('codex-app:skill-agent-blackbox');
-//# sourceMappingURL=codex-app-skill-agent-blackbox.js.map

package/dist/scripts/codex-hook-approval-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
-await runDirective315Gate('codex-app:hook-approval-blackbox');
-//# sourceMappingURL=codex-hook-approval-blackbox.js.map

package/dist/scripts/codex-init-deep-directory-local-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
-await runDirective315Gate('codex-app:init-deep-directory-local-blackbox');
-//# sourceMappingURL=codex-init-deep-directory-local-blackbox.js.map

package/dist/scripts/codex-native-feature-broker-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
-await runDirective316Gate('codex-native:feature-broker-blackbox');
-//# sourceMappingURL=codex-native-feature-broker-blackbox.js.map

package/dist/scripts/codex-native-pattern-analysis-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
-await runDirective316Gate('codex-native:pattern-analysis-blackbox');
-//# sourceMappingURL=codex-native-pattern-analysis-blackbox.js.map

package/dist/scripts/codex-native-read-repair-split-blackbox.js

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
-import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
-import { createCodexNativeRuntimeFixture, withFixtureEnv } from './codex-native-runtime-e2e-fixture.js';
-const fixture = await createCodexNativeRuntimeFixture({
-    hook: 'approved',
-    agentType: 'supported',
-    appHandoff: true,
-    imagePathExposure: true,
-    mcpCandidates: true,
-    codeModeWebSearch: true
-});
-const previous = process.env.CODEX_HOME;
-process.env.CODEX_HOME = path.join(fixture.root, 'codex-home');
-try {
-    await withFixtureEnv(fixture, async () => {
-        await buildCodexNativeFeatureMatrix({ root: fixture.root, mode: 'read-only' });
-        assertGate(!(await exists(path.join(fixture.root, 'codex-home', 'skills'))), 'read-only matrix created skills');
-        assertGate(!(await exists(path.join(fixture.root, 'codex-home', 'agents'))), 'read-only matrix created agent roles');
-        const repair = await repairCodexNativeManagedAssets({ root: fixture.root, requestedBy: 'manual', yes: true });
-        assertGate(repair.repaired.some((row) => row.asset === 'skills'), 'repair transaction did not include skills', repair);
-        assertGate(await exists(path.join(fixture.root, 'codex-home', 'skills')), 'repair transaction did not create managed skills');
-        assertGate(await exists(path.join(fixture.root, 'codex-home', 'agents')), 'repair transaction did not create managed agent roles');
-        const matrixAfter = await buildCodexNativeFeatureMatrix({ root: fixture.root, mode: 'read-only' });
-        assertGate(matrixAfter.features.skill_sync.ok === true || matrixAfter.features.agent_roles.ok === true, 'post-repair read-only matrix did not reflect managed assets', matrixAfter);
-    });
-}
-finally {
-    if (previous === undefined)
-        delete process.env.CODEX_HOME;
-    else
-        process.env.CODEX_HOME = previous;
-}
-emitGate('codex-native:read-repair-split-blackbox');
-async function exists(file) {
-    try {
-        await fs.stat(file);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function assertGate(condition, message, detail = {}) {
-    if (condition)
-        return;
-    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
-    process.exit(1);
-}
-function emitGate(gate) {
-    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
-}
-//# sourceMappingURL=codex-native-read-repair-split-blackbox.js.map

package/dist/scripts/codex-native-reference-cache-blackbox.js

@@ -1,41 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { runProcess } from '../core/fsx.js';
-import { ensureCodexNativeReferenceSnapshot } from '../core/codex-native/codex-native-reference-cache.js';
-import { analyzeCodexNativeReferenceSource } from '../core/codex-native/codex-native-reference-source.js';
-const missing = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-missing-'));
-const missingReport = await ensureCodexNativeReferenceSnapshot({ root: missing, offline: true });
-assertGate(missingReport.ok === false && missingReport.blockers.includes('source_snapshot_missing'), 'offline no-cache scenario must report source_snapshot_missing', missingReport);
-const missingEvidence = await analyzeCodexNativeReferenceSource({ root: missing, writeReport: false });
-assertGate(missingEvidence.blockers.includes('source_snapshot_missing') && missingEvidence.evidence.length === 0, 'missing cache must not hallucinate evidence', missingEvidence);
-const reused = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-reused-'));
-await fs.mkdir(path.join(reused, '.sneakoscope', 'cache', 'codex-native-reference'), { recursive: true });
-await fs.writeFile(path.join(reused, '.sneakoscope', 'cache', 'codex-native-reference', 'README.md'), 'npx plugin hook agent_type fallback AGENTS.md doctor MCP managed proof\n', 'utf8');
-const reusedReport = await ensureCodexNativeReferenceSnapshot({ root: reused, offline: true });
-assertGate(reusedReport.ok === true && reusedReport.refreshed === false, 'offline existing cache should be reused', reusedReport);
-const source = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-source-'));
-await fs.writeFile(path.join(source, 'README.md'), 'npx plugin hook agent_type fallback AGENTS.md doctor MCP managed proof\n', 'utf8');
-await runProcess('git', ['init'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
-await runProcess('git', ['add', 'README.md'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
-await runProcess('git', ['-c', 'user.email=sks@example.invalid', '-c', 'user.name=SKS', 'commit', '-m', 'fixture'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
-const refreshedRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-refresh-'));
-const refreshed = await ensureCodexNativeReferenceSnapshot({ root: refreshedRoot, sourceUrl: source, refresh: true });
-const serialized = JSON.stringify(refreshed);
-assertGate(refreshed.ok === true && refreshed.refreshed === true && typeof refreshed.source_sha === 'string', 'refresh from local git source should record source sha', refreshed);
-assertGate(!serialized.includes(source), 'cache report leaked raw source URL/path', refreshed);
-const evidence = await analyzeCodexNativeReferenceSource({ root: refreshedRoot, writeReport: true });
-const docs = await fs.readFile(path.join(refreshedRoot, 'docs', 'codex-native-patterns.md'), 'utf8');
-assertGate(!JSON.stringify(evidence).includes(source) && !docs.includes(source), 'reference evidence/docs leaked raw source URL/path', { evidence, docs });
-emitGate('codex-native:reference-cache-blackbox');
-function assertGate(condition, message, detail = {}) {
-    if (condition)
-        return;
-    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
-    process.exit(1);
-}
-function emitGate(gate) {
-    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
-}
-//# sourceMappingURL=codex-native-reference-cache-blackbox.js.map

package/dist/scripts/core-skill-integrity-blackbox.js

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
-import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
-import { buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
-import { initProject } from '../core/init.js';
-const root = await makeTempRoot('sks-core-blackbox-');
-const skillsRoot = path.join(root, '.agents', 'skills');
-const expectedSkillCount = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills.length;
-const first = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-const second = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-await writeText(path.join(skillsRoot, 'research', 'SKILL.md'), `${renderCoreSkillTemplate('research')}\nmutated\n`);
-const third = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-const restoredText = await fs.readFile(path.join(skillsRoot, 'research', 'SKILL.md'), 'utf8');
-const userRoot = path.join(root, 'user-skills');
-await writeUserSkill(root, 'user-skills', 'research', 'research');
-const user = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot: userRoot });
-const setupRoot = await makeTempRoot('sks-core-setup-blackbox-');
-const setup = await initProject(setupRoot, { force: true, installScope: 'project', localOnly: true, globalCommand: 'sks' });
-const setupIntegrity = await syncCoreSkillsIntegrity({ root: setupRoot, apply: false, skillsRoot: path.join(setupRoot, '.agents', 'skills') });
-const setupRestore = await initProject(setupRoot, { force: true, installScope: 'project', localOnly: true, globalCommand: 'sks' });
-const setupLoopExists = await fs.stat(path.join(setupRoot, '.agents', 'skills', 'loop', 'SKILL.md')).then(() => true, () => false);
-assertGate(first.installed.length === expectedSkillCount, 'blackbox A: first sync installs missing core skills', first);
-assertGate(second.installed.length === 0 && second.restored.length === 0, 'blackbox B: second sync changes nothing', second);
-assertGate(third.restored.length === 1 && restoredText === renderCoreSkillTemplate('research'), 'blackbox C: managed drift restored exactly', third);
-assertGate(user.skipped_user_authored.length === 1, 'blackbox D: user skill is not overwritten', user);
-assertGate((setup.skill_install?.installed_skills || []).length === 0, 'blackbox E: project setup must not install official/core skills locally', setup.skill_install);
-assertGate(setupIntegrity.restored.length === 0 && setupIntegrity.skipped_user_authored.length === 0, 'blackbox F: setup-produced core skills are current', setupIntegrity);
-assertGate((setupRestore.skill_install?.installed_skills || []).length === 0 && !setupLoopExists, 'blackbox G: project setup remains official-skill-free on repeat init', setupRestore.skill_install);
-emitGate('core-skill:integrity-blackbox');
-//# sourceMappingURL=core-skill-integrity-blackbox.js.map

package/dist/scripts/dfix-fast-blackbox-check.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { emitGate } from './sks-1-12-real-execution-check-lib.js';
-const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-dfix-fast-blackbox-'));
-fs.mkdirSync(path.join(root, '.sneakoscope'), { recursive: true });
-fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({
-    private: true,
-    type: 'module',
-    scripts: {
-        test: 'node test.mjs',
-        'test:unit': 'node test.mjs',
-        'dfix:fixture': 'node test.mjs',
-        'dfix:verification': 'node test.mjs'
-    }
-}, null, 2));
-fs.writeFileSync(path.join(root, 'value.js'), 'export const value = "bad";\n');
-fs.writeFileSync(path.join(root, 'test.mjs'), 'import { value } from "./value.js"; if (value !== "good") throw new Error("expected good");\n');
-const sks = path.join(process.cwd(), 'dist', 'bin', 'sks.js');
-const env = { ...process.env, SKS_DISABLE_UPDATE_CHECK: '1' };
-const diagnose = run(root, sks, ['dfix', 'diagnose', 'fix value', '--file', 'value.js', '--error', 'AssertionError: expected good at value.js:1', '--json'], env);
-const mission = JSON.parse(diagnose.stdout).mission_id;
-const patch = run(root, sks, ['dfix', 'patch', mission, '--file', 'value.js', '--find', 'bad', '--replace', 'good', '--apply', '--json'], env);
-const verify = run(root, sks, ['dfix', 'verify', mission, '--command', 'node test.mjs', '--verify-auto', '--json'], env);
-const ok = diagnose.status === 0 && patch.status === 0 && verify.status === 0 && fs.readFileSync(path.join(root, 'value.js'), 'utf8').includes('"good"');
-console.log(JSON.stringify({ schema: 'sks.dfix-fast-blackbox-check.v1', ok, mission_id: mission, root }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-else
-    emitGate('dfix:blackbox-fast', { mission_id: mission });
-function run(cwd, bin, args, env) {
-    return spawnSync(process.execPath, [bin, ...args], { cwd, env, encoding: 'utf8', timeout: 30_000 });
-}
-//# sourceMappingURL=dfix-fast-blackbox-check.js.map

package/dist/scripts/dfix-parallel-write-blackbox.js

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const applyMod = await importDist('core/agents/agent-patch-apply-worker.js');
-const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-dfix-patch-'));
-fs.writeFileSync(path.join(tmp, 'copy.txt'), 'old label\n');
-const envelope = {
-    schema: 'sks.agent-patch-envelope.v1',
-    agent_id: 'dfix-fast-lane',
-    session_id: 'dfix-session',
-    slot_id: 'dfix-slot',
-    generation_index: 1,
-    lease_id: 'lease:dfix-fast-lane:copy.txt',
-    operations: [{ op: 'replace', path: 'copy.txt', search: 'old label', replace: 'new label' }]
-};
-const applied = await applyMod.applyAgentPatchEnvelope(tmp, envelope);
-const dfixFile = path.join(tmp, 'dfix-route.txt');
-fs.writeFileSync(dfixFile, 'old label\n');
-const diagnose = spawnSync(process.execPath, ['dist/bin/sks.js', 'dfix', 'diagnose', 'dfix parallel write route fixture', '--file', dfixFile, '--json'], { cwd: root, encoding: 'utf8', maxBuffer: 1024 * 1024 });
-const diagnoseJson = parseJson(diagnose.stdout);
-const plan = diagnoseJson?.mission_id
-    ? spawnSync(process.execPath, ['dist/bin/sks.js', 'dfix', 'plan', diagnoseJson.mission_id, '--file', dfixFile, '--write-mode', 'parallel', '--apply-patches', '--dry-run-patches', '--max-write-agents', '1', '--json'], { cwd: root, encoding: 'utf8', maxBuffer: 1024 * 1024 })
-    : { status: 1, stdout: '', stderr: 'diagnose mission missing' };
-const planJson = parseJson(plan.stdout);
-const routePolicy = planJson?.patch_plan?.route_parallel_write || null;
-const report = { schema: 'sks.dfix-parallel-write-blackbox.v1', ok: applied.ok && diagnose.status === 0 && plan.status === 0 && routePolicy?.route_level_flags_wired === true, applied, route_command: { diagnose_status: diagnose.status, plan_status: plan.status, mission_id: diagnoseJson?.mission_id || null, route_policy: routePolicy, stderr_tail: `${diagnose.stderr || ''}${plan.stderr || ''}`.slice(-2000) } };
-const out = path.join(root, '.sneakoscope', 'reports', 'dfix-parallel-write-blackbox.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(applied.ok === true, 'DFix parallel write blackbox patch failed', report);
-assertGate(fs.readFileSync(path.join(tmp, 'copy.txt'), 'utf8') === 'new label\n', 'DFix parallel write blackbox content mismatch', report);
-assertGate(routePolicy?.write_mode === 'parallel', 'DFix route must record --write-mode parallel', report);
-assertGate(routePolicy?.apply_patches === true, 'DFix route must record --apply-patches', report);
-assertGate(routePolicy?.dry_run_patches === true, 'DFix route must record --dry-run-patches', report);
-emitGate('dfix:parallel-write-blackbox', { changed_files: applied.changed_files.length });
-function parseJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=dfix-parallel-write-blackbox.js.map

package/dist/scripts/dfix-patch-swarm-route-blackbox.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runPatchSwarmRouteBlackbox } from './agent-patch-swarm-gate-lib.js';
-await runPatchSwarmRouteBlackbox({
-    gate: 'dfix:patch-swarm-route-blackbox',
-    route: '$DFix',
-    routeCommand: 'sks dfix',
-    reportName: 'dfix-patch-swarm-route-blackbox'
-});
-//# sourceMappingURL=dfix-patch-swarm-route-blackbox.js.map

package/dist/scripts/doctor-dirty-repair-blackbox.js

@@ -1,22 +0,0 @@
-// @ts-nocheck
-import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
-import { importDist } from './sks-1-18-gate-lib.js';
-const tmp = await makeTempRoot('doctor-dirty-repair-');
-const planner = await importDist('core/doctor/doctor-dirty-planner.js');
-const tx = await importDist('core/doctor/doctor-transaction.js');
-const proofId = planner.markDoctorPhaseClean(tmp, 'setup');
-await tx.writeDoctorFixTransaction({
-    root: tmp,
-    phases: [],
-    proofIdsUsed: [proofId]
-});
-let ran = false;
-const report = await tx.runDoctorFixTransaction({
-    root: tmp,
-    reportPath: null,
-    dirtyPlan: planner.planDoctorDirtyRepair(tmp, ['setup']),
-    phases: [{ id: 'setup', run: async () => { ran = true; return { id: 'setup', ok: true }; } }]
-});
-assertGate(ran === false && report.ok === true && report.phases[0].warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase')), 'dirty repair must skip clean phase', { ran, report });
-emitGate('doctor:dirty-repair-blackbox', { skipped: true });
-//# sourceMappingURL=doctor-dirty-repair-blackbox.js.map

package/dist/scripts/doctor-dirty-semantic-blackbox.js

@@ -1,8 +0,0 @@
-import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
-const source = readText('src/core/doctor/doctor-dirty-planner.ts');
-assertGate(!source.includes('stat.isDirectory() ? `dir:${stat.mtimeMs}`'), 'doctor dirty planner must not hash directory mtimes');
-assertGate(!source.includes('mtimeMs, text'), 'doctor dirty planner must not mix file mtime into semantic hashes');
-assertGate(source.includes('phaseSemanticState'), 'doctor dirty planner must include phase-specific semantic state');
-assertGate(source.includes('clean_proof_missing'), 'doctor dirty planner must reject markers with missing proof evidence');
-emitGate('doctor:dirty-semantic-blackbox');
-//# sourceMappingURL=doctor-dirty-semantic-blackbox.js.map

package/dist/scripts/doctor-native-capability-repair-blackbox.js

@@ -1,39 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
-import path from 'node:path';
-const repairableRoot = await makeTempRoot('sks-doctor-native-repairable-');
-process.env.SKS_CHROME_EXTENSION_READY = '1';
-process.env.SKS_COMPUTER_USE_CAPABILITY = 'verified';
-const repairable = await repairNativeCapabilities({ root: repairableRoot, fix: true, yes: true, fixture: 'all-repairable' });
-delete process.env.SKS_CHROME_EXTENSION_READY;
-delete process.env.SKS_COMPUTER_USE_CAPABILITY;
-const manualRoot = await makeTempRoot('sks-doctor-native-manual-');
-const manual = await repairNativeCapabilities({ root: manualRoot, fix: true, yes: true, fixture: 'manual-required' });
-const screenshotBlockedRoot = await makeTempRoot('sks-doctor-native-screenshot-blocked-');
-await writeText(path.join(screenshotBlockedRoot, '.sneakoscope', 'app-screenshots'), 'not-a-directory');
-const screenshotBlocked = await repairNativeCapabilities({
-    root: screenshotBlockedRoot,
-    fix: false,
-    yes: true,
-    fixture: 'all-repairable',
-    capabilities: ['codex_app_screenshot']
-});
-const corruptContractRoot = await makeTempRoot('sks-doctor-native-contract-repair-');
-await writeText(path.join(corruptContractRoot, '.sneakoscope', 'reports', 'saved-artifact-path-contract.json'), '{"schema":"broken"}\n');
-const corruptContract = await repairNativeCapabilities({
-    root: corruptContractRoot,
-    fix: true,
-    yes: true,
-    fixture: 'manual-required',
-    capabilities: ['saved_artifact_path_contract']
-});
-assertGate(repairable.ok === true, 'repairable fixture must verify after doctor native repair', repairable);
-assertGate(manual.capabilities.some((state) => state.repairability === 'manual-required' && state.after !== 'verified'), 'manual-only fixture must not fake verified success', manual);
-assertGate(manual.capabilities.find((state) => state.id === 'image_generation')?.after !== 'verified', 'image generation auth missing must not verify', manual);
-assertGate(manual.capabilities.find((state) => state.id === 'chrome_web_review')?.after !== 'verified', 'Chrome/web review missing extension must not verify', manual);
-assertGate(manual.capabilities.find((state) => state.id === 'image_path_exposure')?.after === 'degraded', 'saved artifact path fallback must be degraded rather than verified', manual);
-assertGate(screenshotBlocked.capabilities.find((state) => state.id === 'codex_app_screenshot')?.after === 'blocked', 'unwritable screenshot artifact root must block postcheck', screenshotBlocked);
-assertGate(corruptContract.capabilities.find((state) => state.id === 'saved_artifact_path_contract')?.after === 'verified', 'doctor fix must repair corrupt saved artifact path contract', corruptContract);
-emitGate('doctor:native-capability-repair-blackbox');
-//# sourceMappingURL=doctor-native-capability-repair-blackbox.js.map

package/dist/scripts/doctor-transaction-engine-blackbox.js

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
-import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
-import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
-const root = await makeTempRoot('sks-doctor-tx-blackbox-');
-const tx = await runDoctorFixTransaction({
-    root,
-    phases: [
-        { id: 'preflight', run: async () => ({ id: 'preflight', ok: true, artifact_path: `${root}/preflight.json` }) },
-        {
-            id: 'postchecked',
-            run: async () => ({ id: 'postchecked', ok: true }),
-            postcheck: async () => ({ ok: true, warnings: ['postcheck_executed'] })
-        },
-        {
-            id: 'optional_operator',
-            required_for_ready: false,
-            run: async () => ({ id: 'optional_operator', ok: false, manual_required: true, required_for_ready: false, blockers: ['operator_action_required'] })
-        }
-    ],
-    reportPath: null
-});
-const postcheck = doctorRepairPostcheck(tx);
-assertGate(tx.ok === true && postcheck.ok === true, 'doctor transaction blackbox must allow optional manual follow-up without blocking readiness', { tx, postcheck });
-assertGate(tx.phases.some((phase) => phase.warnings.includes('postcheck_executed')), 'doctor transaction blackbox must run phase postchecks', tx);
-assertGate(tx.raw_secret_values_recorded === false, 'doctor transaction blackbox must not record raw secrets', tx);
-emitGate('doctor:transaction-engine-blackbox', { phases: tx.phases.length });
-//# sourceMappingURL=doctor-transaction-engine-blackbox.js.map

package/dist/scripts/doctor-zellij-fix-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('doctor:zellij-fix-blackbox');
-//# sourceMappingURL=doctor-zellij-fix-blackbox.js.map

package/dist/scripts/doctor-zellij-no-homebrew-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('doctor:zellij-no-homebrew-blackbox');
-//# sourceMappingURL=doctor-zellij-no-homebrew-blackbox.js.map

package/dist/scripts/doctor-zellij-upgrade-blackbox.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
-await runDirective314Gate('doctor:zellij-upgrade-blackbox');
-//# sourceMappingURL=doctor-zellij-upgrade-blackbox.js.map