sneakoscope 5.6.0 → 5.7.0

package/dist/core/update/update-migration-state.js

@@ -8,6 +8,7 @@ import { COMMANDS } from '../../cli/command-registry.js';
 import { reconcileSkills } from '../init/skills.js';
 import { codexHookTrustDoctor } from '../codex-hooks/codex-hook-trust-doctor.js';
 import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
+import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const UPDATE_MIGRATION_SCHEMA = 'sks.project-migration-receipt.v2';
 export const INSTALLATION_EPOCH_SCHEMA = 'sks.installation-epoch.v1';
 export function installationEpochPath() {
@@ -343,53 +344,71 @@ async function runMenubarRetargetStage(root) {
         return { ok: true, status: 'ok', actions: ['menubar_action_script_absent'], blockers: [], warnings: [] };
     const desired = path.join(packageRoot(), 'dist', 'bin', 'sks.js');
     const line = `SKS_ENTRY=${JSON.stringify(desired)}`;
+    const actions = [];
     const next = /^\s*SKS_ENTRY\s*=.*$/m.test(text)
         ? text.replace(/^\s*SKS_ENTRY\s*=.*$/m, line)
         : `${line}\n${text}`;
     if (next !== text) {
         await writeTextAtomic(actionScript, next);
-        return { ok: true, status: 'ok', actions: ['retargeted_menubar_action_script'], blockers: [], warnings: [], detail: { action_script: actionScript } };
+        actions.push('retargeted_menubar_action_script');
+    }
+    const stat = await fsp.stat(actionScript).catch(() => null);
+    if (!stat || (stat.mode & 0o111) === 0) {
+        await fsp.chmod(actionScript, 0o755);
+        actions.push('restored_menubar_action_executable_bit');
     }
-    return { ok: true, status: 'ok', actions: ['menubar_action_script_current'], blockers: [], warnings: [], detail: { action_script: actionScript } };
+    return {
+        ok: true,
+        status: 'ok',
+        actions: actions.length ? actions : ['menubar_action_script_current'],
+        blockers: [],
+        warnings: [],
+        detail: { action_script: actionScript }
+    };
 }
 async function runConfigFastModeNormalizeStage() {
     const configPath = path.join(os.homedir(), '.codex', 'config.toml');
     const text = await readText(configPath, null);
     if (typeof text !== 'string')
         return { ok: true, status: 'ok', actions: ['codex_config_absent'], blockers: [], warnings: [] };
-    const table = text.match(/(^|\n)\[user\.fast_mode\][\s\S]*?(?=\n\[|$)/);
-    const misplaced = table?.[0]?.match(/^\s*default_profile\s*=\s*"([^"]+)"\s*$/m)?.[1] || null;
-    const hasTopLevel = /^\s*default_profile\s*=\s*"[^"]+"\s*$/m.test(text.slice(0, Math.max(0, text.search(/^\s*\[/m))));
-    if (!misplaced)
-        return { ok: true, status: 'ok', actions: ['fastmode_default_profile_current'], blockers: [], warnings: [] };
-    let next = text.replace(/(^|\n)(\[user\.fast_mode\][\s\S]*?)(?=\n\[|$)/, (_match, prefix, block) => {
-        const cleaned = String(block).split(/\r?\n/).filter((line) => !/^\s*default_profile\s*=/.test(line)).join('\n').trimEnd();
-        return `${prefix}${cleaned}`;
-    });
-    if (!hasTopLevel)
-        next = insertTopLevelTomlKey(next, `default_profile = ${JSON.stringify(misplaced)}`);
+    const normalized = normalizeLegacyFastModeConfigForUpdate(text);
+    if (normalized.text === ensureTrailingNewline(text)) {
+        return {
+            ok: true,
+            status: 'ok',
+            actions: ['fastmode_config_current'],
+            blockers: [],
+            warnings: [],
+            detail: { config_path: configPath, default_profile: normalized.defaultProfile }
+        };
+    }
     let guardResult = null;
-    if (next !== text) {
-        guardResult = await writeCodexConfigGuarded({
-            configPath,
-            before: text,
-            mutate: () => `${next.trim()}\n`,
-            cause: 'project-update-fastmode-default-profile',
-            backupTag: 'project-update-fastmode-default-profile',
-            preserveFastUiKeys: true
-        });
-        if (!guardResult.ok) {
-            return {
-                ok: false,
-                status: 'failed',
-                actions: ['normalize_fastmode_default_profile_blocked'],
-                blockers: [`codex_config_guard:${guardResult.status}`],
-                warnings: [],
-                detail: { config_path: configPath, default_profile: misplaced, guard: guardResult }
-            };
-        }
+    guardResult = await writeCodexConfigGuarded({
+        configPath,
+        before: text,
+        mutate: () => normalized.text,
+        cause: 'project-update-fastmode-normalize',
+        backupTag: 'project-update-fastmode-normalize',
+        preserveFastUiKeys: true
+    });
+    if (!guardResult.ok) {
+        return {
+            ok: false,
+            status: 'failed',
+            actions: ['normalize_fastmode_config_blocked'],
+            blockers: [`codex_config_guard:${guardResult.status}`],
+            warnings: [],
+            detail: { config_path: configPath, default_profile: normalized.defaultProfile, guard: guardResult }
+        };
     }
-    return { ok: true, status: 'ok', actions: ['normalized_fastmode_default_profile'], blockers: [], warnings: [], detail: { config_path: configPath, default_profile: misplaced, guard: guardResult } };
+    return {
+        ok: true,
+        status: 'ok',
+        actions: normalized.actions.length ? normalized.actions : ['fastmode_config_current'],
+        blockers: [],
+        warnings: [],
+        detail: { config_path: configPath, default_profile: normalized.defaultProfile, guard: guardResult }
+    };
 }
 async function runHookTrustRefreshStage(root) {
     const result = await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true });
@@ -456,6 +475,132 @@ function insertTopLevelTomlKey(text, line) {
         return `${line}\n${raw}`.trim() + '\n';
     return `${raw.slice(0, firstTable).trimEnd()}\n${line}\n\n${raw.slice(firstTable).trimStart()}`.trim() + '\n';
 }
+function normalizeLegacyFastModeConfigForUpdate(text) {
+    let next = String(text || '');
+    const actions = [];
+    const misplaced = tomlTableString(next, 'user.fast_mode', 'default_profile');
+    const topLevel = topLevelTomlString(next, 'default_profile');
+    if (misplaced) {
+        next = removeTomlTableKeyLocal(next, 'user.fast_mode', 'default_profile');
+        actions.push('normalized_fastmode_default_profile_location');
+    }
+    if (topLevel && topLevel !== 'sks-fast-high' && !tomlTableBlock(next, `profiles.${topLevel}`)) {
+        next = upsertTopLevelTomlStringLocal(next, 'default_profile', 'sks-fast-high');
+        actions.push('retargeted_missing_fastmode_default_profile_target');
+    }
+    else if (!topLevel && misplaced === 'sks-fast-high') {
+        next = insertTopLevelTomlKey(next, `default_profile = ${JSON.stringify(misplaced)}`);
+        actions.push('restored_fastmode_top_level_default_profile');
+    }
+    const beforeUi = next;
+    next = upsertTomlTableKeyIfAbsentLocal(next, 'user.fast_mode', 'visible = true');
+    next = upsertTomlTableKeyIfAbsentLocal(next, 'user.fast_mode', 'enabled = true');
+    if (next !== beforeUi)
+        actions.push('ensured_fastmode_ui_visibility');
+    const beforeProfile = next;
+    next = upsertTomlTableKeyLocal(next, 'profiles.sks-fast-high', `model = "${REQUIRED_CODEX_MODEL}"`);
+    next = upsertTomlTableKeyLocal(next, 'profiles.sks-fast-high', 'service_tier = "fast"');
+    if (next !== beforeProfile)
+        actions.push('normalized_sks_fast_high_profile');
+    return { text: ensureTrailingNewline(next), actions, defaultProfile: misplaced || topLevel };
+}
+function tomlTableString(text, table, key) {
+    const block = tomlTableBlock(text, table);
+    const match = block?.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*$`, 'm'));
+    return match?.[1] || null;
+}
+function topLevelTomlString(text, key) {
+    const top = String(text || '').slice(0, Math.max(0, String(text || '').search(/^\s*\[/m)));
+    const match = top.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*$`, 'm'));
+    return match?.[1] || null;
+}
+function tomlTableBlock(text, table) {
+    const lines = String(text || '').split(/\r?\n/);
+    const start = lines.findIndex((line) => tableHeaderMatches(line, table));
+    if (start < 0)
+        return null;
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[[^\]]+\]\s*$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
+    }
+    return lines.slice(start, end).join('\n');
+}
+function removeTomlTableKeyLocal(text, table, key) {
+    const lines = String(text || '').split(/\r?\n/);
+    let inTable = false;
+    const out = [];
+    for (const line of lines) {
+        if (/^\s*\[[^\]]+\]\s*$/.test(line))
+            inTable = tableHeaderMatches(line, table);
+        if (inTable && new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(line))
+            continue;
+        out.push(line);
+    }
+    return out.join('\n');
+}
+function upsertTomlTableKeyIfAbsentLocal(text, table, line) {
+    const key = tomlLineKey(line);
+    return tomlTableHasKey(text, table, key) ? text : upsertTomlTableKeyLocal(text, table, line);
+}
+function upsertTomlTableKeyLocal(text, table, line) {
+    const raw = String(text || '').trimEnd();
+    const key = tomlLineKey(line);
+    const lines = raw ? raw.split(/\r?\n/) : [];
+    const start = lines.findIndex((candidate) => tableHeaderMatches(candidate, table));
+    if (start < 0) {
+        return `${raw}${raw ? '\n\n' : ''}[${table}]\n${line}\n`;
+    }
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[[^\]]+\]\s*$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
+    }
+    for (let index = start + 1; index < end; index += 1) {
+        if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[index] || '')) {
+            if (lines[index] === line)
+                return `${lines.join('\n')}\n`;
+            lines[index] = line;
+            return `${lines.join('\n')}\n`;
+        }
+    }
+    lines.splice(end, 0, line);
+    return `${lines.join('\n')}\n`;
+}
+function upsertTopLevelTomlStringLocal(text, key, value) {
+    const raw = String(text || '').trimEnd();
+    const line = `${key} = ${JSON.stringify(value)}`;
+    const lines = raw ? raw.split(/\r?\n/) : [];
+    const firstTable = lines.findIndex((candidate) => /^\s*\[[^\]]+\]\s*$/.test(candidate || ''));
+    const end = firstTable < 0 ? lines.length : firstTable;
+    for (let index = 0; index < end; index += 1) {
+        if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[index] || '')) {
+            lines[index] = line;
+            return `${lines.join('\n')}\n`;
+        }
+    }
+    return insertTopLevelTomlKey(raw, line);
+}
+function tomlTableHasKey(text, table, key) {
+    const block = tomlTableBlock(text, table);
+    return Boolean(block && new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`, 'm').test(block));
+}
+function tableHeaderMatches(line, table) {
+    return new RegExp(`^\\s*\\[${escapeRegExp(table)}\\]\\s*$`).test(line || '');
+}
+function tomlLineKey(line) {
+    return String(line || '').split('=')[0]?.trim() || '';
+}
+function ensureTrailingNewline(text) {
+    return `${String(text || '').trim()}\n`;
+}
+function escapeRegExp(value) {
+    return String(value || '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 export async function ensureCurrentMigrationBeforeCommand(input) {
     const env = input.env || process.env;
     const command = input.command;

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '5.6.0';
+export const PACKAGE_VERSION = '5.7.0';
 //# sourceMappingURL=version.js.map

package/dist/scripts/codex-lb-gpt55-fast-profile-check.js

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { codexFastModeDesktopStatus, codexLbConfigPath, configureCodexLb, ensureGlobalCodexFastModeDuringInstall, releaseCodexLbAuthHold, repairCodexLbAuth } from '../cli/install-helpers.js';
 import { repairCodexConfigStructure, splitCodexProjectConfigPolicy } from '../core/codex/codex-project-config-policy.js';
 import { parseCodexConfigToml, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
+import { REQUIRED_CODEX_MODEL } from '../core/codex-model-guard.js';
 const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-gpt55-fast-'));
 const home = path.join(tmp, 'home');
 const root = path.join(tmp, 'project');
@@ -44,7 +45,7 @@ await fs.writeFile(projectConfig, [
     'enabled = true',
     '',
     '[profiles.sks-fast-high]',
-    'model = "gpt-5.5"',
+    `model = "${REQUIRED_CODEX_MODEL}"`,
     'service_tier = "fast"',
     ''
 ].join('\n'));
@@ -85,7 +86,7 @@ function assertFastProfile(text, label) {
         ...validation.blockers,
         ...(parsed.default_profile === 'sks-fast-high' ? [] : ['default_profile_not_sks_fast_high']),
         ...(parsed.user?.fast_mode?.default_profile === undefined ? [] : ['default_profile_inside_user_fast_mode']),
-        ...(profile.model === 'gpt-5.5' ? [] : ['sks_fast_high_model_not_gpt55']),
+        ...(profile.model === REQUIRED_CODEX_MODEL ? [] : ['sks_fast_high_model_not_required_codex_model']),
         ...(profile.service_tier === 'fast' ? [] : ['sks_fast_high_service_tier_not_fast']),
         ...(provider.requires_openai_auth === true ? [] : ['codex_lb_requires_openai_auth_not_true']),
         ...(provider.wire_api === 'responses' ? [] : ['codex_lb_wire_api_not_responses']),

package/dist/scripts/packlist-performance-check.js

@@ -12,8 +12,10 @@ const MAX_UNPACKED = Number(process.env.SKS_MAX_UNPACKED_BYTES || 10 * 1024 * 10
 // (route-success-helpers.ts, seo-command.ts, ppt-command.ts, qa-loop-command.ts,
 // research-command.ts, image-ux-review-command.ts, mad-sks-command.ts,
 // sks-menubar.ts) with genuine new production logic, pushing the packed size
-// to ~2306 KiB. Kept modest headroom rather than a large jump.
-const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2340 * 1024);
+// to ~2306 KiB. 5.7.0 adds doctor/update migration repair coverage and publish
+// contract checks, pushing the packed tarball to ~2345 KiB. Keep a narrow cap
+// rather than giving the package a broad size budget.
+const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2350 * 1024);
 function runNpmPack() {
     const npmCli = process.env.npm_execpath; // set when invoked via `npm run`
     const npmCache = process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache');

package/dist/scripts/release-metadata-1-19-check.js

@@ -393,7 +393,18 @@ for (const gate of allManifestGates)
 assertGate(pkg.bin?.sks === 'dist/bin/sks.js', 'package runtime must use dist/bin/sks.js');
 assertGate(pkg.bin?.sneakoscope === 'dist/bin/sks.js', 'sneakoscope runtime must use dist/bin/sks.js');
 assertGate(!pkg.files?.includes('src'), 'package files must not include src runtime shadows');
-assertGate(pkg.scripts?.['publish:prep-ignore-scripts'] === 'npm run prepublishOnly', 'publish:prep-ignore-scripts must run the prepublishOnly release gate before lifecycle-disabled publish', { script: pkg.scripts?.['publish:prep-ignore-scripts'] || null });
+const publishPrepIgnoreScripts = String(pkg.scripts?.['publish:prep-ignore-scripts'] || '');
+assertGate(!/\bprepublishOnly\b/.test(publishPrepIgnoreScripts), 'publish:prep-ignore-scripts must not depend on npm lifecycle hooks that --ignore-scripts disables', { script: publishPrepIgnoreScripts || null });
+for (const required of [
+    'build:incremental',
+    'release:version-truth',
+    'publish:packlist-performance',
+    'package-published-contract-check.js',
+    'release-registry-check.js --require-unpublished --require-publish-auth',
+    'publish-tag:check'
+]) {
+    assertGate(publishPrepIgnoreScripts.includes(required), `publish:prep-ignore-scripts missing lifecycle-disabled publish preflight: ${required}`, { script: publishPrepIgnoreScripts || null });
+}
 assertGate(String(pkg.scripts?.['publish:ignore-scripts'] || '').includes('npm run publish:prep-ignore-scripts'), 'publish:ignore-scripts must run publish:prep-ignore-scripts before npm publish --ignore-scripts', { script: pkg.scripts?.['publish:ignore-scripts'] || null });
 assertGate(String(pkg.scripts?.['publish:ignore-scripts'] || '').includes('--ignore-scripts'), 'publish:ignore-scripts must keep npm lifecycle scripts disabled for the final publish', { script: pkg.scripts?.['publish:ignore-scripts'] || null });
 for (const file of requiredDocs) {

package/dist/scripts/sks-menubar-install-check.js

@@ -27,6 +27,46 @@ const secondResult = await installSksMenuBar({
     sksEntry: localEntry,
     env: launchGuardEnv
 });
+if (secondResult.action_script_path)
+    await fs.rm(secondResult.action_script_path, { force: true });
+const restoredScriptResult = await installSksMenuBar({
+    apply: true,
+    launch: true,
+    home: temp,
+    root: fakeRoot,
+    sksEntry: localEntry,
+    env: launchGuardEnv
+});
+if (restoredScriptResult.action_script_path) {
+    await fs.writeFile(restoredScriptResult.action_script_path, '#!/bin/zsh\necho stale-sks-menubar-action\n', 'utf8');
+}
+const staleScriptMissingEntryResult = await installSksMenuBar({
+    apply: true,
+    launch: true,
+    home: temp,
+    root: fakeRoot,
+    sksEntry: path.join(fakeRoot, 'dist', 'bin', 'missing-sks.js'),
+    env: launchGuardEnv
+});
+const recoveredStaleScriptResult = await installSksMenuBar({
+    apply: true,
+    launch: true,
+    home: temp,
+    root: fakeRoot,
+    sksEntry: localEntry,
+    env: launchGuardEnv
+});
+if (recoveredStaleScriptResult.action_script_path) {
+    await fs.chmod(recoveredStaleScriptResult.action_script_path, 0o644);
+}
+const restoredExecutableBitResult = await installSksMenuBar({
+    apply: true,
+    launch: true,
+    home: temp,
+    root: fakeRoot,
+    sksEntry: localEntry,
+    env: launchGuardEnv
+});
 const envHomeResult = await installSksMenuBar({
     apply: true,
     launch: true,
@@ -55,6 +95,9 @@ const hasVisibleStatusSource = generatedSource.includes('NSStatusItem.variableLe
     && generatedSource.includes('SKS ⋯')
     && generatedSource.includes('Timer.scheduledTimer(withTimeInterval: 30.0');
 const hasBackgroundReadonlyActions = generatedSource.includes('runSksBackground(["codex-lb", "fast-check"]')
+    && generatedSource.includes('runSksBackground(["fast-mode", "on", "--json"]')
+    && generatedSource.includes('runSksBackground(["fast-mode", "off", "--json"]')
+    && generatedSource.includes('runSksSilent(["fast-mode", "status", "--json"]')
     && generatedSource.includes('runSksBackground(["update", "check"]')
     && generatedSource.includes('display notification')
     && !generatedSource.includes('runSksInTerminal')
@@ -89,6 +132,21 @@ const hasBuildStamp = buildStampExists
     && result.build_stamp?.codesign_identifier === 'com.sneakoscope.sks-menubar';
 const isIdempotent = secondResult.actions.includes('menubar_up_to_date')
     && secondResult.build_stamp?.action_script_sha256 === result.build_stamp?.action_script_sha256;
+const restoresMissingActionScript = restoredScriptResult.actions.includes(`wrote ${secondResult.action_script_path}`)
+    && actionScriptExists
+    && restoredScriptResult.build_stamp?.action_script_sha256 === result.build_stamp?.action_script_sha256;
+const blocksStaleActionScriptReuse = staleScriptMissingEntryResult.ok === false
+    && staleScriptMissingEntryResult.blockers.includes('sks_entry_unresolved')
+    && staleScriptMissingEntryResult.warnings.includes('sks_entry_unresolved_stale_action_script_not_reused')
+    && staleScriptMissingEntryResult.target_check?.used_previous_script === false;
+const recoversStaleActionScriptWhenEntryExists = recoveredStaleScriptResult.ok === true
+    && recoveredStaleScriptResult.actions.includes(`wrote ${restoredScriptResult.action_script_path}`)
+    && recoveredStaleScriptResult.build_stamp?.action_script_sha256 === result.build_stamp?.action_script_sha256;
+const restoresExecutableBit = restoredExecutableBitResult.ok === true
+    && restoredExecutableBitResult.actions.includes('menubar_up_to_date')
+    && restoredExecutableBitResult.actions.includes('restored action script executable bit')
+    && actionScriptExists
+    && await isExecutable(result.action_script_path);
 const hasCommandRegistry = commandRegistry.includes('menubar:')
     && commandRegistry.includes('menubarCommand')
     && commandRegistry.includes('dist/core/commands/menubar-command.js');
@@ -102,6 +160,8 @@ const expectedMenuItems = [
     'Use ChatGPT OAuth',
     'Set codex-lb Domain and Key',
     'Set OpenRouter Key and GLM Profiles',
+    'Fast Mode On',
+    'Fast Mode Off',
     'Fast Check',
     'SKS Version Check',
     'Update SKS Now',
@@ -147,6 +207,10 @@ const darwinOk = cltMissing
         && hasBuildStamp
         && swiftParse.ok === true
         && isIdempotent
+        && restoresMissingActionScript
+        && blocksStaleActionScriptReuse
+        && recoversStaleActionScriptWhenEntryExists
+        && restoresExecutableBit
         && hasCommandRegistry
         && noLaunchctlSecretSetenv
         && hasLaunchctlUnsetenv
@@ -164,6 +228,10 @@ const report = {
     env_home_temp: envHomeTemp,
     result,
     second_result: secondResult,
+    restored_script_result: restoredScriptResult,
+    stale_script_missing_entry_result: staleScriptMissingEntryResult,
+    recovered_stale_script_result: recoveredStaleScriptResult,
+    restored_executable_bit_result: restoredExecutableBitResult,
     env_home_result: envHomeResult,
     executable_exists: executableExists,
     launch_agent_exists: launchAgentExists,
@@ -185,6 +253,10 @@ const report = {
     has_build_stamp: hasBuildStamp,
     swift_parse: swiftParse,
     is_idempotent: isIdempotent,
+    restores_missing_action_script: restoresMissingActionScript,
+    blocks_stale_action_script_reuse: blocksStaleActionScriptReuse,
+    recovers_stale_action_script_when_entry_exists: recoversStaleActionScriptWhenEntryExists,
+    restores_executable_bit: restoresExecutableBit,
     has_command_registry: hasCommandRegistry,
     no_launchctl_secret_setenv: noLaunchctlSecretSetenv,
     has_launchctl_unsetenv: hasLaunchctlUnsetenv,
@@ -209,6 +281,17 @@ async function exists(file) {
         return false;
     }
 }
+async function isExecutable(file) {
+    if (!file)
+        return false;
+    try {
+        await fs.access(file, fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function swiftParseSmoke(sourcePath) {
     if (process.platform !== 'darwin')
         return { ok: true, status: 'skipped', reason: 'not_macos' };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "5.6.0",
+  "version": "5.7.0",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -61,19 +61,23 @@
   },
   "scripts": {
     "build": "npm run build:clean",
+    "prepack": "npm run build",
     "build:clean": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true}); fs.rmSync('.sneakoscope/cache/tsbuildinfo',{recursive:true,force:true})\" && tsc -p tsconfig.json && node ./dist/scripts/ensure-bin-executable.js && node ./dist/scripts/build-dist.js",
     "build:incremental": "tsc -p tsconfig.json && node ./dist/scripts/ensure-bin-executable.js && node ./dist/scripts/build-dist.js",
     "test": "node --test --test-concurrency=1 dist/core/__tests__/*.test.js dist/core/proof/__tests__/*.test.js dist/core/stop-gate/__tests__/*.test.js dist/core/commands/__tests__/*.test.js dist/core/dfix/__tests__/*.test.js dist/core/ppt/__tests__/*.test.js dist/core/mad-sks/__tests__/*.test.js dist/core/codex-app/__tests__/*.test.js dist/core/doctor/__tests__/*.test.js dist/cli/__tests__/*.test.js dist/core/triwiki/__tests__/*.test.js dist/core/naruto/__tests__/*.test.js dist/core/agent-bridge/__tests__/*.test.js",
     "selftest:real": "node ./dist/bin/sks.js selftest --real --json",
-    "check": "npm run release:check:affected",
+    "check": "npm run release:check:confidence",
     "dev:sks": "npm run build:incremental --silent && node ./dist/bin/sks.js",
-    "prepublishOnly": "npm run release:check:affected",
+    "prepublishOnly": "node ./dist/scripts/prepublish-release-check-or-fast.js && node ./dist/scripts/release-check-stamp.js verify && node ./dist/scripts/package-published-contract-check.js && node ./dist/scripts/release-registry-check.js --require-unpublished --require-publish-auth",
     "runtime:no-src-mjs": "node ./dist/scripts/runtime-no-src-mjs-check.js",
     "runtime:ts-source-of-truth": "node ./dist/scripts/runtime-ts-source-of-truth-check.js",
     "architecture:guard": "node ./dist/scripts/architecture-guard-check.js",
     "runtime:dist-parity": "node ./dist/scripts/runtime-dist-parity-check.js",
-    "release:check": "npm run release:check:affected --silent",
+    "release:check": "npm run release:check:affected",
     "release:metadata": "node ./dist/scripts/release-metadata-check.js",
+    "release:version-truth": "node ./dist/scripts/release-version-truth-check.js",
+    "release:dist-freshness": "node ./dist/scripts/release-dist-freshness-check.js",
+    "release:provenance": "node ./dist/scripts/release-provenance-check.js",
     "release:gate-script-parity": "node ./dist/scripts/release-gate-script-parity-check.js",
     "ppt:real-imagegen-wiring": "node ./dist/scripts/ppt-real-imagegen-wiring-check.js",
     "ux-review:run-wires-imagegen": "node ./dist/scripts/ux-review-run-wires-imagegen-check.js",
@@ -111,6 +115,7 @@
     "zellij:layout-valid": "node ./dist/scripts/zellij-layout-valid-check.js",
     "zellij:doctor-readiness": "node ./dist/scripts/zellij-doctor-readiness-check.js",
     "codex:project-config-policy-splitter": "node ./dist/scripts/codex-project-config-policy-splitter-check.js",
+    "legacy:upgrade-zero-break": "node ./dist/scripts/legacy-upgrade-matrix-check.js",
     "packcheck": "for d in bin test; do [ -d \"$d\" ] && find \"$d\" -name '*.mjs' -print0; done | xargs -0 -n1 node --check && npm run runtime:no-src-mjs",
     "changelog:check": "node ./dist/scripts/changelog-check.js",
     "cli-entrypoint:check": "node ./dist/scripts/check-cli-entrypoint.js",
@@ -133,8 +138,12 @@
     "release:check:fast": "npm run build:incremental --silent && node ./dist/scripts/release-gate-dag-runner.js --preset fast --changed-since auto --sla 5m && node ./dist/scripts/release-check-stamp.js write",
     "release:check:confidence": "npm run build:incremental --silent && node ./dist/scripts/release-gate-dag-runner.js --preset confidence --changed-since auto --sla 5m && node ./dist/scripts/release-check-stamp.js write",
     "release:check:full": "npm run build:clean --silent && node ./dist/scripts/release-gate-dag-runner.js --preset release --full && node ./dist/scripts/release-gate-dag-runner.js --preset bench --full && node ./dist/scripts/release-check-stamp.js write",
-    "publish:prep-ignore-scripts": "npm run prepublishOnly",
+    "publish:packlist-performance": "node ./dist/scripts/packlist-performance-check.js",
+    "publish:dry": "npm run publish:prep-ignore-scripts && npm publish --dry-run --ignore-scripts --json",
+    "publish:prep-ignore-scripts": "npm run build:incremental --silent && npm run release:version-truth --silent && npm run publish:packlist-performance --silent && node ./dist/scripts/package-published-contract-check.js && node ./dist/scripts/release-registry-check.js --require-unpublished --require-publish-auth && npm run publish-tag:check --silent",
     "publish:ignore-scripts": "npm run publish:prep-ignore-scripts && npm publish --ignore-scripts",
+    "publish:npm": "npm run publish:ignore-scripts",
+    "release:publish": "npm run publish:ignore-scripts",
     "gates:run": "node ./dist/scripts/release-gate-dag-runner.js",
     "policy:gate-audit": "node ./dist/scripts/gate-policy-audit-check.js"
   },