sneakoscope 5.1.2 → 5.3.0

package/dist/core/commands/basic-cli.js

@@ -1,12 +1,10 @@
 import path from 'node:path';
-import os from 'node:os';
-import fsp from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import { COMMANDS, LEGACY_COMMAND_ALIASES } from '../../cli/command-registry.js';
 import { flag } from '../../cli/args.js';
 import { printJson, sksTextLogo } from '../../cli/output.js';
 import { ui as cliUi } from '../../cli/cli-theme.js';
-import { PACKAGE_VERSION, ensureDir, exists, nowIso, projectRoot, readJson, sksRoot, writeJsonAtomic } from '../fsx.js';
+import { PACKAGE_VERSION, ensureDir, exists, nowIso, projectRoot, readJson, sksRoot, tmpdir, writeJsonAtomic } from '../fsx.js';
 import { COMMAND_CATALOG, DOLLAR_COMMAND_ALIASES, DOLLAR_COMMANDS, USAGE_TOPICS, routePrompt, routeReasoning, reasoningInstruction } from '../routes.js';
 import { initProject, normalizeInstallScope, sksCommandPrefix } from '../init.js';
 import { buildFeatureRegistry, validateFeatureRegistry } from '../feature-registry.js';
@@ -283,7 +281,7 @@ export async function postinstallCommand(args = []) {
 export async function selftestCommand(args = []) {
     process.env.CI = 'true';
     const root = await projectRoot();
-    const tmp = await fsp.mkdtemp(path.join(os.tmpdir(), 'sks-selftest-'));
+    const tmp = tmpdir('sks-selftest-');
     await ensureDir(tmp);
     const registry = await buildFeatureRegistry({ root });
     const coverage = validateFeatureRegistry(registry);

package/dist/core/commands/menubar-command.js

@@ -97,7 +97,8 @@ function printStatus(result) {
     console.log(`Running:   ${result.running ? 'yes' : 'no'}`);
     console.log(`Launchd:   ${result.launchd.ok ? result.launchd.state || 'present' : result.launchd.error || 'missing'}`);
     console.log(`Version:   ${result.build_stamp?.package_version || 'unknown'} (package ${result.package_version})`);
-    console.log(`Target:    ${result.action_target.sks_entry || 'missing'} ${result.action_target.sks_entry_exists ? '(ok)' : '(missing)'}`);
+    console.log(`Target:    ${result.action_target.sks_entry || 'runtime'} ${result.action_target.ok ? '(smoke ok)' : '(smoke failed)'}`);
+    console.log(`Codex sync:${result.codex_sync.bundle_id || 'disabled'} ${result.codex_sync.codex_running === null ? '' : result.codex_sync.codex_running ? '(running)' : '(not running)'}`);
     console.log(`Signature: ${result.signature.identifier || 'unknown'} ${result.signature.ok ? '(ok)' : '(check)'}`);
     if (result.warnings.length) {
         console.log('Warnings:');

package/dist/core/doctor/doctor-dirty-planner.js

@@ -1,8 +1,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js';
 import { PACKAGE_VERSION, packageRoot, sha256 } from '../fsx.js';
 import { hashJson } from '../triwiki/triwiki-cache-key.js';
+import { SKS_MENUBAR_LABEL, sksMenuBarPaths } from '../codex-app/sks-menubar.js';
 export const DOCTOR_DIRTY_PLAN_SCHEMA = 'sks.doctor-dirty-plan.v2';
 export function planDoctorDirtyRepair(root, phaseIds) {
     const phases = phaseIds.map((id) => {
@@ -10,25 +12,30 @@ export function planDoctorDirtyRepair(root, phaseIds) {
         const inputHash = phaseInputHash(root, id);
         const postcheckRequired = phaseRequiresPostcheck(id);
         const markerState = readMarker(marker);
+        const runtimeProbeFailed = runtimeProbeFailures(root, id);
         if (!markerState)
-            return { id, status: 'dirty', reason: 'no_clean_marker', input_hash: inputHash, last_clean_proof_id: null, postcheck_required: postcheckRequired, postcheck_pending: false };
+            return { id, status: 'dirty', reason: 'no_clean_marker', input_hash: inputHash, last_clean_proof_id: null, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
         if (markerState.input_hash !== inputHash) {
-            return { id, status: 'dirty', reason: 'input_hash_changed', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false };
+            return { id, status: 'dirty', reason: 'input_hash_changed', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
         }
         if (markerState.proof_id && !proofExists(root, markerState.proof_id)) {
-            return { id, status: 'dirty', reason: 'clean_proof_missing', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false };
+            return { id, status: 'dirty', reason: 'clean_proof_missing', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
         }
         if (!markerState.repair_applied) {
-            return { id, status: 'dirty', reason: 'repair_not_applied', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false };
+            return { id, status: 'dirty', reason: 'repair_not_applied', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
+        }
+        if (runtimeProbeFailed.length) {
+            return { id, status: 'dirty', reason: `runtime_probe_failed:${runtimeProbeFailed.join(',')}`, input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
         }
         return {
             id,
-            status: 'clean',
+            status: markerState.postcheck_pending ? 'dirty' : 'clean',
             reason: postcheckRequired && markerState.postcheck_pending ? 'matching_repair_marker_postcheck_pending' : 'matching_clean_proof',
             input_hash: inputHash,
             last_clean_proof_id: markerState.proof_id,
             postcheck_required: postcheckRequired,
-            postcheck_pending: postcheckRequired && markerState.postcheck_pending
+            postcheck_pending: postcheckRequired && markerState.postcheck_pending,
+            runtime_probe_failed: []
         };
     });
     const plan = {
@@ -37,6 +44,7 @@ export function planDoctorDirtyRepair(root, phaseIds) {
         phases,
         dirty_count: phases.filter((phase) => phase.status === 'dirty').length,
         clean_count: phases.filter((phase) => phase.status === 'clean').length,
+        runtime_probe_failed: phases.flatMap((phase) => phase.runtime_probe_failed.map((failure) => `${phase.id}:${failure}`)),
         semantic_dirty_plan_path: dirtyPlanPath(root)
     };
     writeDirtyPlan(root, plan);
@@ -236,7 +244,43 @@ function proofExists(root, proofId) {
     }
 }
 function phaseRequiresPostcheck(id) {
-    return /zellij|context7|startup|supabase|native|secret/i.test(id);
+    return /zellij|context7|startup|supabase|native|secret|menubar/i.test(id);
+}
+function runtimeProbeFailures(root, id) {
+    if (!id.includes('menubar') || process.platform !== 'darwin')
+        return [];
+    const failures = [];
+    const paths = sksMenuBarPaths(process.env.HOME, root);
+    if (!fs.existsSync(paths.executable_path))
+        failures.push('menubar_app_missing');
+    if (!fs.existsSync(paths.action_script_path))
+        failures.push('action_script_missing');
+    else {
+        try {
+            fs.accessSync(paths.action_script_path, fs.constants.X_OK);
+        }
+        catch {
+            failures.push('action_script_not_executable');
+        }
+    }
+    const launchctl = process.env.SKS_MENUBAR_LAUNCHCTL || '/bin/launchctl';
+    if (!fs.existsSync(launchctl)) {
+        failures.push('launchctl_missing');
+        return failures;
+    }
+    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    const service = `${uid === null ? 'gui' : `gui/${uid}`}/${SKS_MENUBAR_LABEL}`;
+    const result = spawnSync(launchctl, ['print', service], {
+        encoding: 'utf8',
+        timeout: 500,
+        maxBuffer: 32 * 1024
+    });
+    const text = `${result.stdout || ''}\n${result.stderr || ''}`;
+    if (result.error)
+        failures.push(`launchctl_probe_error:${result.error.message}`);
+    else if (result.status !== 0 || !(/\bstate = running\b|\bpid = \d+\b/.test(text)))
+        failures.push('launchd_not_running');
+    return failures;
 }
 function writeDirtyPlan(root, plan) {
     const file = dirtyPlanPath(root);

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '5.1.2';
+export const PACKAGE_VERSION = '5.3.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/naruto/naruto-real-worker-child.js

@@ -136,7 +136,7 @@ function startDeadmanHeartbeat(input) {
                 schema: 'sks.naruto-actual-worker-heartbeat.v1',
                 ts: nowIso(),
                 item_id: input.intake.item.id,
-                status: 'blocked',
+                status: 'timed_out',
                 elapsed_ms: elapsedMs,
                 progress: null
             }, 2 * 1024 * 1024).catch(() => undefined);

package/dist/core/update/update-migration-state.js

@@ -7,6 +7,7 @@ import { enforceRetention } from '../retention.js';
 import { COMMANDS } from '../../cli/command-registry.js';
 import { reconcileSkills } from '../init/skills.js';
 import { codexHookTrustDoctor } from '../codex-hooks/codex-hook-trust-doctor.js';
+import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
 export const UPDATE_MIGRATION_SCHEMA = 'sks.project-migration-receipt.v2';
 export const INSTALLATION_EPOCH_SCHEMA = 'sks.installation-epoch.v1';
 export function installationEpochPath() {
@@ -367,9 +368,28 @@ async function runConfigFastModeNormalizeStage() {
     });
     if (!hasTopLevel)
         next = insertTopLevelTomlKey(next, `default_profile = ${JSON.stringify(misplaced)}`);
-    if (next !== text)
-        await writeTextAtomic(configPath, `${next.trim()}\n`);
-    return { ok: true, status: 'ok', actions: ['normalized_fastmode_default_profile'], blockers: [], warnings: [], detail: { config_path: configPath, default_profile: misplaced } };
+    let guardResult = null;
+    if (next !== text) {
+        guardResult = await writeCodexConfigGuarded({
+            configPath,
+            before: text,
+            mutate: () => `${next.trim()}\n`,
+            cause: 'project-update-fastmode-default-profile',
+            backupTag: 'project-update-fastmode-default-profile',
+            preserveFastUiKeys: true
+        });
+        if (!guardResult.ok) {
+            return {
+                ok: false,
+                status: 'failed',
+                actions: ['normalize_fastmode_default_profile_blocked'],
+                blockers: [`codex_config_guard:${guardResult.status}`],
+                warnings: [],
+                detail: { config_path: configPath, default_profile: misplaced, guard: guardResult }
+            };
+        }
+    }
+    return { ok: true, status: 'ok', actions: ['normalized_fastmode_default_profile'], blockers: [], warnings: [], detail: { config_path: configPath, default_profile: misplaced, guard: guardResult } };
 }
 async function runHookTrustRefreshStage(root) {
     const result = await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true });

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '5.1.2';
+export const PACKAGE_VERSION = '5.3.0';
 //# sourceMappingURL=version.js.map

package/dist/core/zellij/zellij-slot-telemetry.js

@@ -272,7 +272,7 @@ function normalizeStatus(value) {
     const text = String(value || '').toLowerCase();
     if (text === 'closed' || text === 'done' || text === 'passed')
         return 'completed';
-    if (text === 'blocked' || text === 'error')
+    if (text === 'blocked' || text === 'error' || text === 'timed_out')
         return 'failed';
     if (text === 'coding')
         return 'running';

package/dist/scripts/doctor-context7-mcp-repair-blackbox.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+const root = await makeTempRoot('sks-context7-blackbox-');
+const configPath = path.join(root, '.codex', 'config.toml');
+await writeText(configPath, '[mcp_servers.context7]\ncommand = "npx"\n');
+const repaired = await repairContext7Mcp({ root, apply: true });
+const text = await fs.readFile(configPath, 'utf8');
+assertGate(repaired.ok === true && text.includes('https://mcp.context7.com/mcp'), 'Context7 blackbox must write remote URL', { repaired, text });
+await writeText(configPath, '[mcp_servers.context7]\ndisabled = true\ncommand = "npx"\n');
+const disabled = await repairContext7Mcp({ root, apply: true });
+assertGate(disabled.after_transport === 'disabled' && disabled.repaired === false && disabled.disabled_preserved === true, 'Context7 blackbox must preserve explicitly disabled server', disabled);
+emitGate('doctor:context7-mcp-repair-blackbox');
+//# sourceMappingURL=doctor-context7-mcp-repair-blackbox.js.map

package/dist/scripts/doctor-fix-production-blackbox.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
+const root = await makeTempRoot('sks-doctor-production-');
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.context7]\ncommand = "npx"\n\n[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nread_only = true\n\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+const startup = await repairCodexStartupConfig({ root, apply: true });
+const context7 = await repairContext7Mcp({ root, apply: true });
+const supabase = await repairSupabaseMcp({ root, apply: true });
+const tx = await runDoctorFixTransaction({ root, phases: [
+        { id: 'preflight', run: async () => ({ id: 'preflight', ok: true }) },
+        { id: 'codex_startup_config_repair', run: async () => ({ id: 'codex_startup_config_repair', ok: startup.ok, repaired: true, blockers: startup.blockers, rollback_evidence: 'fixture_config_backup' }) },
+        { id: 'context7_mcp_repair', run: async () => ({ id: 'context7_mcp_repair', ok: context7.ok, repaired: context7.repaired, blockers: context7.blockers, rollback_evidence: 'fixture_context7_backup' }) },
+        { id: 'supabase_mcp_repair', required_for_ready: false, run: async () => ({ id: 'supabase_mcp_repair', ok: supabase.ok, manual_required: supabase.manual_required, required_for_ready: false, blockers: supabase.blockers, warnings: supabase.warnings, rollback_evidence: 'optional_supabase_fixture' }) },
+        { id: 'postcheck', run: async () => ({ id: 'postcheck', ok: true }) }
+    ] });
+const postcheck = doctorRepairPostcheck(tx);
+assertGate(tx.schema === 'sks.doctor-fix-transaction.v2' && tx.raw_secret_values_recorded === false, 'doctor transaction must write production schema without raw secrets', tx);
+assertGate(tx.phases.every((phase) => typeof phase.duration_ms === 'number' && phase.started_at && phase.completed_at), 'doctor transaction phases must include runtime evidence', tx);
+assertGate(postcheck.ok === true, 'doctor repair postcheck must pass when only manual-required optional phases remain', postcheck);
+emitGate('doctor:fix-production-blackbox', { phases: tx.phases.length });
+//# sourceMappingURL=doctor-fix-production-blackbox.js.map

package/dist/scripts/doctor-startup-config-repair-blackbox.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+const root = await makeTempRoot('sks-startup-config-blackbox-');
+await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+const report = await repairCodexStartupConfig({ root, apply: true });
+const text = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
+assertGate(report.ok === true, 'startup config blackbox must pass postcheck', report);
+assertGate(!text.includes('message_role_prefix') && /config_file = "\//.test(text), 'startup config blackbox must rewrite to absolute config paths and remove unsupported fields', { text });
+emitGate('doctor:startup-config-repair-blackbox');
+//# sourceMappingURL=doctor-startup-config-repair-blackbox.js.map

package/dist/scripts/doctor-supabase-mcp-repair-blackbox.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+const root = await makeTempRoot('sks-supabase-mcp-blackbox-');
+delete process.env.SUPABASE_ACCESS_TOKEN;
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nSUPABASE_ACCESS_TOKEN = "env:SUPABASE_ACCESS_TOKEN"\n');
+const unsafe = await repairSupabaseMcp({ root, apply: true });
+assertGate(unsafe.ok === true && unsafe.manual_required === true && unsafe.read_only_migrated === true && unsafe.ready_blocking === false, 'Supabase unsafe write access must be migrated to read-only without passing silently as write-ready', unsafe);
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase_sauron]\ndisabled = true\n');
+const optional = await repairSupabaseMcp({ root, apply: true });
+assertGate(optional.ok === true && optional.disabled === true && optional.disabled_preserved === true, 'optional disabled Supabase config must be preserved', optional);
+emitGate('doctor:supabase-mcp-repair-blackbox');
+//# sourceMappingURL=doctor-supabase-mcp-repair-blackbox.js.map

package/dist/scripts/naruto-real-active-pool-runtime-check.js

@@ -49,7 +49,32 @@ const artifactEvidence = report.worker_lifecycle.every((row) => row.worker_artif
     && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-heartbeat.jsonl'))
     && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-result.json'))
     && fs.existsSync(path.join(row.worker_artifact_dir, 'codex-control', 'codex-control-proof.json')));
+const timeoutReport = await runNarutoRealActivePool({
+    graph: buildNarutoWorkGraph({ requestedClones: 1, totalWorkItems: 1, writeCapable: false, maxActiveWorkers: 1 }),
+    governor: { ...target, safe_active_workers: 1, safe_zellij_visible_panes: 0 },
+    hardTimeoutMs: 1,
+    spawnWorker: async (item, placement) => ({
+        id: item.id,
+        item,
+        placement,
+        started_at: Date.now() - 1000,
+        pid: null,
+        worker_artifact_dir: path.join(tempRoot, 'timeout-worker'),
+        heartbeat_path: path.join(tempRoot, 'timeout-worker', 'worker-heartbeat.jsonl'),
+        exit: new Promise(() => undefined)
+    }),
+    collectWorker: async () => {
+        throw new Error('timed out worker should be force-collected before collectWorker');
+    },
+    enqueueVerification: async () => undefined,
+    updateDashboard: async () => undefined
+});
+const timeoutEvidence = timeoutReport.completed_count === 1
+    && timeoutReport.failed_count === 1
+    && timeoutReport.blockers.includes('naruto_worker_hard_timeout')
+    && timeoutReport.worker_lifecycle.some((row) => row.ok === false && row.completed_at !== null);
 const ok = report.ok && spawned === graph.total_work_items && collected === graph.total_work_items && report.max_observed_active_workers >= target.safe_active_workers && report.active_pool_utilization >= 0.8 && processEvidence && artifactEvidence;
 assertGate(ok, 'Naruto real active pool runtime must include actual child process, heartbeat, and result evidence', { report, spawned, collected, processEvidence, artifactEvidence, tempRoot });
-emitGate('naruto:real-active-pool-runtime', report);
+assertGate(timeoutEvidence, 'Naruto real active pool must force-collect hung workers as timed-out results', { timeoutReport });
+emitGate('naruto:real-active-pool-runtime', { ...report, timeout_force_collect_checked: true });
 //# sourceMappingURL=naruto-real-active-pool-runtime-check.js.map

package/dist/scripts/project-skill-dedupe-blackbox.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { assertGate, emitGate, makeTempRoot, writeManagedCoreSkill, writeUserSkill } from './sks-3-1-8-check-lib.js';
+import { dedupeProjectSkills } from '../core/codex-native/project-skill-dedupe.js';
+import { syncCodexSksSkills, withSkillSyncLock } from '../core/codex-app/codex-skill-sync.js';
+import { buildSkillRegistryLedger } from '../core/codex-native/skill-registry-ledger.js';
+const root = await makeTempRoot('sks-skill-dedupe-blackbox-');
+process.env.CODEX_HOME = path.join(root, 'codex-home');
+await writeManagedCoreSkill(root, '.agents/skills', 'loop');
+await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const scenarioA = await dedupeProjectSkills({ root, fix: true, yes: true });
+await writeUserSkill(root, '.agents/skills', 'user-loop', 'loop');
+await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const scenarioB = await dedupeProjectSkills({ root, fix: true, yes: true });
+await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Loop');
+await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'loop');
+const scenarioC = await dedupeProjectSkills({ root, fix: true, yes: false });
+const scenarioD = await dedupeProjectSkills({ root, fix: true, yes: true, quarantineUserDuplicates: true });
+const staleRoot = await makeTempRoot('sks-skill-stale-lock-');
+const lockPath = path.join(staleRoot, '.sneakoscope', 'locks', 'skill-sync.lock');
+await fs.mkdir(lockPath, { recursive: true });
+await fs.writeFile(path.join(lockPath, 'owner.json'), JSON.stringify({ schema: 'sks.skill-sync-lock.v1', pid: 999999, acquired_at: '1970-01-01T00:00:00.000Z', stale_after_ms: 1 }), 'utf8');
+await withSkillSyncLock(staleRoot, async () => undefined);
+const concurrentRoot = await makeTempRoot('sks-skill-concurrent-');
+process.env.CODEX_HOME = path.join(concurrentRoot, 'codex-home');
+const skillsRoot = path.join(process.env.CODEX_HOME, 'skills');
+await Promise.all(Array.from({ length: 20 }, () => syncCodexSksSkills({ root: concurrentRoot, apply: true, skillsRoot })));
+const concurrentLedger = await buildSkillRegistryLedger({ root: concurrentRoot });
+assertGate(scenarioA.actions.some((action) => action.action === 'quarantined'), 'scenario A must quarantine SKS-managed duplicate', scenarioA);
+assertGate(scenarioB.actions.some((action) => action.reason.includes('user-authored skill preserved')), 'scenario B must preserve user-authored skill', scenarioB);
+assertGate(scenarioC.blockers.some((blocker) => blocker.includes('user_duplicate_requires_confirmation')), 'scenario C must not auto-delete user-authored duplicates', scenarioC);
+assertGate(scenarioD.active_unique_by_canonical_name === true, 'scenario D must quarantine confirmed user-authored duplicate', scenarioD);
+assertGate(concurrentLedger.active_unique_by_canonical_name === true, 'scenario F must keep exactly one active canonical name after concurrent sync', concurrentLedger);
+emitGate('skill:dedupe-blackbox');
+//# sourceMappingURL=project-skill-dedupe-blackbox.js.map

package/dist/scripts/release-gate-script-parity-check.js

@@ -4,10 +4,6 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { assertGate, emitGate, readJson, root } from './sks-1-18-gate-lib.js';
 import { writeJsonAtomic } from '../core/fsx.js';
-import { REQUIRED_3112_REAL_CHECK_IDS, REQUIRED_3112_RELEASE_IDS } from './release-3112-required-gates.js';
-import { REQUIRED_3113_REAL_CHECK_IDS, REQUIRED_3113_RELEASE_IDS } from './release-3113-required-gates.js';
-import { REQUIRED_4000_REAL_CHECK_IDS, REQUIRED_4000_RELEASE_IDS } from './release-4000-required-gates.js';
-import { REQUIRED_4002_REAL_CHECK_IDS, REQUIRED_4002_RELEASE_IDS } from './release-4002-required-gates.js';
 export const REQUIRED_3110_RELEASE_IDS = [
     'core-skill:manifest',
     'core-skill:immutable-sync',
@@ -63,36 +59,52 @@ export function buildReleaseGateScriptParityReport() {
     const gates = Array.isArray(manifest.gates) ? manifest.gates : [];
     const gateById = new Map(gates.map((gate) => [gate.id, gate]));
     const releaseGateIds = gates.filter((gate) => gate.preset?.includes('release')).map((gate) => gate.id);
-    const requiredReleaseIds = [...new Set([...REQUIRED_3110_RELEASE_IDS, ...REQUIRED_3112_RELEASE_IDS, ...REQUIRED_3113_RELEASE_IDS, ...REQUIRED_4000_RELEASE_IDS, ...REQUIRED_4002_RELEASE_IDS, 'codex:0140-real-probes'])];
-    const requiredRealCheckIds = [...new Set([...REQUIRED_3112_REAL_CHECK_IDS, ...REQUIRED_3113_REAL_CHECK_IDS, ...REQUIRED_4000_REAL_CHECK_IDS, ...REQUIRED_4002_REAL_CHECK_IDS])];
+    const requiredReleaseIds = releaseGateIds;
+    const requiredRealCheckIds = gates.filter((gate) => gate.preset?.includes('real-check')).map((gate) => gate.id);
     const requiredAllIds = [...new Set([...requiredReleaseIds, ...requiredRealCheckIds])];
-    const missingScripts = [...new Set([
-            ...releaseGateIds.filter((id) => !scripts[id]),
-            ...requiredAllIds.filter((id) => !scripts[id])
-        ])].sort();
+    const requiredEntryScripts = [
+        'build',
+        'build:incremental',
+        'typecheck',
+        'release:check',
+        'release:metadata',
+        'release:check:affected',
+        'release:check:fast',
+        'release:check:confidence',
+        'release:check:full',
+        'prepublishOnly',
+        'publish:prep-ignore-scripts',
+        'publish:ignore-scripts',
+        'gates:run',
+        'policy:gate-audit'
+    ];
+    const missingEntryScripts = requiredEntryScripts.filter((id) => !scripts[id]).sort();
     const missingGates = requiredAllIds.filter((id) => !gateById.has(id)).sort();
     const missingReleasePreset = requiredReleaseIds.filter((id) => !gateById.get(id)?.preset?.includes('release')).sort();
     const missingRealCheckPreset = requiredRealCheckIds.filter((id) => !gateById.get(id)?.preset?.includes('real-check')).sort();
     const wrongCommands = requiredAllIds
-        .map((id) => ({ id, expected: `npm run ${id} --silent`, actual: gateById.get(id)?.command || '' }))
-        .filter((row) => row.actual !== row.expected);
+        .map((id) => {
+        const actual = gateById.get(id)?.command || '';
+        return { id, actual, reason: directManifestCommandIssue(actual) };
+    })
+        .filter((row) => row.reason);
     const missingSourceTargets = requiredAllIds
-        .map((id) => ({ id, source: sourceTargetForScript(scripts[id]) }))
+        .map((id) => ({ id, source: sourceTargetForScript(gateById.get(id)?.command) }))
         .filter((row) => row.source && !fs.existsSync(path.join(root, row.source)))
         .map((row) => row.source)
         .sort();
     const missingDistTargets = requiredAllIds
-        .map((id) => ({ id, dist: distTargetForScript(scripts[id]) }))
+        .map((id) => ({ id, dist: distTargetForScript(gateById.get(id)?.command) }))
         .filter((row) => row.dist && fs.existsSync(path.join(root, 'dist')) && !fs.existsSync(path.join(root, row.dist)))
         .map((row) => row.dist)
         .sort();
     return {
         schema: 'sks.release-gate-script-parity.v1',
-        ok: missingScripts.length === 0 && missingGates.length === 0 && missingReleasePreset.length === 0 && missingRealCheckPreset.length === 0 && wrongCommands.length === 0 && missingSourceTargets.length === 0 && missingDistTargets.length === 0,
+        ok: missingEntryScripts.length === 0 && missingGates.length === 0 && missingReleasePreset.length === 0 && missingRealCheckPreset.length === 0 && wrongCommands.length === 0 && missingSourceTargets.length === 0 && missingDistTargets.length === 0,
         release_gate_count: releaseGateIds.length,
         package_script_count: Object.keys(scripts).length,
         checked_required_ids: requiredAllIds.length,
-        missing_scripts: missingScripts,
+        missing_entry_scripts: missingEntryScripts,
         missing_gates: missingGates,
         missing_release_preset: missingReleasePreset,
         missing_real_check_preset: missingRealCheckPreset,
@@ -101,6 +113,22 @@ export function buildReleaseGateScriptParityReport() {
         missing_dist_targets: missingDistTargets
     };
 }
+function directManifestCommandIssue(command) {
+    const text = String(command || '');
+    if (!text)
+        return 'missing_command';
+    if (/\bnpm\s+run\b/.test(text))
+        return 'gate_command_must_not_require_package_script_alias';
+    const segments = text.split(/\s+(?:&&|\|\|)\s+/).map((part) => part.trim()).filter(Boolean);
+    const invalid = segments.find((part) => !(/^node\s+\.\/dist\/scripts\/[^\s]+\.js\b/.test(part)
+        || /^node\s+\.\/dist\/bin\/sks\.js\b/.test(part)
+        || /^node\s+--test\b/.test(part)
+        || /^tsc\s+-p\s+tsconfig\.json\s+--noEmit$/.test(part)));
+    if (invalid) {
+        return 'gate_command_must_execute_dist_script_or_typecheck_directly';
+    }
+    return '';
+}
 function distTargetForScript(script) {
     const match = String(script || '').match(/node\s+\.\/dist\/scripts\/([^\s]+\.js)/);
     return match ? `dist/scripts/${match[1]}` : null;

package/dist/scripts/release-metadata-1-19-check.js

@@ -372,7 +372,7 @@ assertGate(releaseManifest?.schema === 'sks.release-gates.v2', 'release gate man
 assertGate(harnessManifest?.schema === 'sks.infra-harness-gates.v1', 'infra harness manifest schema mismatch', { schema: harnessManifest?.schema || null });
 assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release v2 manifest must include 1..200 release gates', { release_gates: releaseGates.length });
 assertGate(harnessGates.length > 0, 'infra harness manifest must include harness gates', { harness_gates: harnessGates.length });
-const PACKAGE_SCRIPT_BUDGET = 150;
+const PACKAGE_SCRIPT_BUDGET = 100;
 assertGate(Object.keys(pkg.scripts || {}).length <= PACKAGE_SCRIPT_BUDGET, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: PACKAGE_SCRIPT_BUDGET });
 for (const script of requiredPackageScripts)
     assertGate(Boolean(pkg.scripts?.[script]), `missing package script: ${script}`);