sneakoscope 5.7.0 → 5.9.0

package/dist/core/doctor/doctor-idempotence.js

@@ -0,0 +1,93 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { runProcess, tmpdir, writeJsonAtomic } from '../fsx.js';
+export async function runDoctorIdempotence(root) {
+    const tmp = tmpdir('sks-doctor-idempotence-');
+    const home = path.join(tmp, 'home');
+    const codexHome = path.join(tmp, 'codex');
+    await Promise.all([home, codexHome].map((dir) => fs.mkdir(dir, { recursive: true })));
+    const first = await runDoctor(root, home, codexHome);
+    const second = await runDoctor(root, home, codexHome);
+    const rollbackManifestExists = await hasRollbackManifest(home, codexHome, root);
+    const changedFilesSecond = extractChangedFiles(second);
+    const blockers = [];
+    if (first.exit_code !== 0)
+        blockers.push(`first_doctor_exit_${first.exit_code}`);
+    if (second.exit_code !== 0)
+        blockers.push(`second_doctor_exit_${second.exit_code}`);
+    if (changedFilesSecond.length > 0)
+        blockers.push('second_doctor_not_noop');
+    const report = {
+        schema: 'sks.doctor-idempotence.v1',
+        ok: blockers.length === 0,
+        generated_at: new Date().toISOString(),
+        temp_dir: tmp,
+        first,
+        second,
+        rollback_manifest_exists: rollbackManifestExists,
+        changed_files_second: changedFilesSecond,
+        blockers: [...new Set(blockers)]
+    };
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'doctor-idempotence.json'), report);
+    return report;
+}
+async function runDoctor(root, home, codexHome) {
+    const started = Date.now();
+    const res = await runProcess(process.execPath, ['./dist/bin/sks.js', 'doctor', '--fix', '--yes', '--json'], {
+        cwd: root,
+        timeoutMs: 180_000,
+        maxOutputBytes: 1024 * 1024,
+        env: {
+            HOME: home,
+            CODEX_HOME: codexHome,
+            SKS_TEST_ISOLATION: '1',
+            SKS_DISABLE_NETWORK: '1',
+            SKS_DISABLE_UPDATE_CHECK: '1'
+        }
+    });
+    let parsed = null;
+    try {
+        parsed = JSON.parse(res.stdout);
+    }
+    catch { }
+    const blockers = Array.isArray(parsed?.blockers) ? parsed.blockers.map(String) : [];
+    return {
+        exit_code: res.code,
+        duration_ms: Date.now() - started,
+        stdout_json: parsed != null,
+        ok: res.code === 0 && parsed?.ok !== false,
+        blockers,
+        parsed
+    };
+}
+function extractChangedFiles(run) {
+    const repair = run.parsed?.repair || {};
+    const candidates = [
+        repair.doctor_transaction?.changed_files,
+        run.parsed?.doctor_fix_transaction?.changed_files,
+        run.parsed?.changed_files
+    ];
+    return [...new Set(candidates.flatMap((value) => Array.isArray(value) ? value.map(String) : []))];
+}
+async function hasRollbackManifest(...roots) {
+    for (const dir of roots) {
+        const found = await findFileContaining(dir, /rollback|transaction|manifest/i, 4);
+        if (found)
+            return true;
+    }
+    return false;
+}
+async function findFileContaining(dir, pattern, depth) {
+    if (depth < 0)
+        return false;
+    const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+        const child = path.join(dir, entry.name);
+        if (entry.isFile() && pattern.test(entry.name))
+            return true;
+        if (entry.isDirectory() && await findFileContaining(child, pattern, depth - 1))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=doctor-idempotence.js.map

package/dist/core/errors/blocker-humanizer.js

@@ -0,0 +1,13 @@
+import { diagnosticForBlocker } from './next-action-map.js';
+export function humanizeBlockers(blockers = [], evidencePaths = []) {
+    const uniqueBlockers = [...new Set(blockers.filter(Boolean))];
+    const diagnostics = uniqueBlockers.map((blocker) => diagnosticForBlocker(blocker));
+    return {
+        human_summary: diagnostics.length
+            ? diagnostics.map((diagnostic) => diagnostic.human_summary).join(' ')
+            : 'No blockers were recorded.',
+        next_actions: [...new Set(diagnostics.flatMap((diagnostic) => diagnostic.next_actions))],
+        evidence_paths: [...new Set(evidencePaths.filter(Boolean))]
+    };
+}
+//# sourceMappingURL=blocker-humanizer.js.map

package/dist/core/errors/next-action-map.js

@@ -0,0 +1,56 @@
+const NEXT_ACTIONS = {
+    source_acquisition_unavailable: {
+        human_summary: 'Super-Search has no live source acquisition path available for this request.',
+        next_actions: ['sks super-search doctor --json']
+    },
+    parallel_runtime_events_missing: {
+        human_summary: 'Parallel worker runtime events were not recorded.',
+        next_actions: ['sks naruto proof latest --json']
+    },
+    worker_timestamp_overlap_missing: {
+        human_summary: 'There is no evidence that workers actually overlapped in time.',
+        next_actions: ['cat .sneakoscope/missions/latest/parallel-runtime-proof.json']
+    },
+    production_proof_mock_only: {
+        human_summary: 'A production gate received mock-only proof.',
+        next_actions: ['Inspect whether a mock backend path is connected to production proof.']
+    },
+    direct_url_fetch_adapter_unavailable: {
+        human_summary: 'Direct URL fetch is unavailable in this Node runtime.',
+        next_actions: ['node -e "console.log(typeof fetch)"']
+    },
+    direct_url_fetch_failed: {
+        human_summary: 'Direct URL fetch failed before verified content could be captured.',
+        next_actions: ['sks super-search doctor --json']
+    },
+    direct_url_fetch_timeout: {
+        human_summary: 'Direct URL fetch timed out before verified content could be captured.',
+        next_actions: ['Retry the fetch or inspect local network access.']
+    },
+    direct_url_fetch_empty_content: {
+        human_summary: 'Direct URL fetch returned no readable content.',
+        next_actions: ['Open the URL manually and check whether it requires authentication or JavaScript rendering.']
+    }
+};
+export function diagnosticForBlocker(blocker) {
+    const exact = NEXT_ACTIONS[blocker];
+    if (exact)
+        return exact;
+    if (/^direct_url_fetch_http_\d+$/.test(blocker)) {
+        return {
+            human_summary: `Direct URL fetch returned HTTP ${blocker.replace('direct_url_fetch_http_', '')}.`,
+            next_actions: ['Open the URL manually and verify whether it is public and reachable.']
+        };
+    }
+    if (blocker.startsWith('super_search_mission_artifact_missing:')) {
+        return {
+            human_summary: 'A required Super-Search evidence artifact is missing.',
+            next_actions: [`cat ${blocker.slice('super_search_mission_artifact_missing:'.length)}`]
+        };
+    }
+    return {
+        human_summary: `Gate blocked on machine reason: ${blocker}.`,
+        next_actions: ['Inspect the gate JSON and referenced evidence paths.']
+    };
+}
+//# sourceMappingURL=next-action-map.js.map

package/dist/core/feature-fixtures.js

@@ -12,7 +12,9 @@ const FIXTURES = Object.freeze({
     'cli-help': fixture('execute', 'sks help', [], 'pass'),
     'cli-version': fixture('execute', 'sks --version', [], 'pass'),
     'cli-root': fixture('execute', 'sks root --json', [], 'pass'),
-    'cli-doctor': fixture('real_optional', 'sks doctor --json', [], 'pass'),
+    'cli-doctor': fixture('execute', 'sks doctor --json', [], 'pass', {
+        reason: 'doctor without --fix is a read-only runtime readiness command, so the release fixture can execute it directly instead of counting it as optional integration evidence.'
+    }),
     'doctor:imagegen-repair': fixture('execute_and_validate_artifacts', 'sks doctor --json', [{ path: '.sneakoscope/reports/feature-fixtures/doctor-imagegen-repair.json', schema: 'sks.doctor-imagegen-repair.v1', optional: true }], 'pass', {
         quality: 'runtime_verified',
         validates_json_fields: ['imagegen_repair', 'repair.imagegen']
@@ -90,7 +92,7 @@ const FIXTURES = Object.freeze({
     'cli-codex-native': fixture('execute', 'sks codex-native status --json', [], 'pass'),
     'cli-zellij': fixture('execute', 'npm run zellij:capability --silent', [], 'pass'),
     'cli-tmux': fixture('not_available', null, [], 'not_required', {
-        quality: 'missing',
+        quality: 'static_contract',
         reason: 'tmux runtime was removed from SKS (see tmuxCommand in basic-cli.ts and `sks tmux` deprecation notice); the prior fixture command string was not a real invocable command ("removed runtime migration notice: sks tmux --json"), so it is reclassified as not_available instead of being mislabeled mock.',
         root_mode: 'source_checkout_required'
     }),
@@ -104,8 +106,7 @@ const FIXTURES = Object.freeze({
         reason: 'Same underlying simpleGitCommitCommand() as cli-commit plus a real `git push`; genuinely destructive (commits and pushes to the remote) with no real --dry-run support. Left as documented mock rather than execute a real commit+push or invent an unsupported --dry-run mode.'
     }),
     'cli-context7': fixture('real_optional', 'sks context7 check --json', [], 'pass'),
-    'cli-insane-search': fixture('execute', 'sks insane-search doctor --json', [], 'pass'),
-    'cli-ultra-search': fixture('execute', 'sks ultra-search doctor --json', [], 'pass'),
+    'cli-super-search': fixture('execute', 'sks super-search doctor --json', [], 'pass'),
     'cli-xai': fixture('real_optional', 'sks xai check --json', [], 'pass'),
     'cli-task': fixture('execute', 'sks task instant --plan --json', [], 'pass'),
     'cli-release': fixture('execute', 'sks release affected --json', [], 'blocked', { reason: '18차: the phantom requiredSections schema mismatch (five_lane_review/integration_evidence/session_cleanup, from commit d4526f84 with no producer ever wired up) has been fixed -- missing_sections is now honestly empty. The release-gate DAG still legitimately fails/blocks on other real gates (e.g. release:readiness) independent of this fix, so the command still exits non-zero and this fixture stays honestly blocked rather than claiming full green.' }),
@@ -142,9 +143,11 @@ const FIXTURES = Object.freeze({
     'route-plan': fixture('execute', 'sks plan "fixture" --json', [], 'pass'),
     'route-review': fixture('execute', 'sks review --diff HEAD --json', [], 'pass'),
     'route-shadowclone': fixture('static', '$ShadowClone alias of $Naruto shadow-clone swarm route', [], 'pass', {
+        quality: 'wiring_only',
         reason: 'Pure alias of $Naruto; no independent behavior to verify beyond route-naruto\'s own execute_and_validate_artifacts fixture.'
     }),
     'route-kagebunshin': fixture('static', '$Kagebunshin alias of $Naruto shadow-clone swarm route', [], 'pass', {
+        quality: 'wiring_only',
         reason: 'Pure alias of $Naruto; no independent behavior to verify beyond route-naruto\'s own execute_and_validate_artifacts fixture.'
     }),
     'route-qa-loop': fixture('execute_and_validate_artifacts', 'sks qa-loop run latest --mock --json', ['completion-proof.json', 'qa-gate.json'], 'blocked', { timeout_ms: 180000, reason: 'qaLoopRun() resolves "latest" via the same globally-unscoped findLatestMission used everywhere else and qa-loop is a two-step prepare-then-run workflow gated between steps by an active-route-not-closed check a single fixture command cannot express.' }),
@@ -157,15 +160,13 @@ const FIXTURES = Object.freeze({
     }),
     'route-dfix': fixture('execute_and_validate_artifacts', 'sks dfix fixture --json', ['completion-proof.json', 'dfix-gate.json', 'dfix-verification.json'], 'pass'),
     'route-answer': fixture('static', '$Answer answer-only route policy', [], 'pass', {
+        quality: 'wiring_only',
         reason: 'Policy-only route (answer-only conversational mode with no writes); nothing executable to run beyond static contract text.'
     }),
     'route-goal': fixture('mock', '$Goal bridge route', ['goal-workflow.json', 'completion-proof.json'], 'pass', {
         reason: 'sks goal create "<prompt>" --json never calls maybeFinalizeRoute, so it does not write completion-proof.json even on success; live-testing it also surfaced a real defect (loop-worker-runtime.ts omitted an explicit `agents` value, so buildAgentRoster() fell back to DEFAULT_AGENT_COUNT=5 while maxAgentCount was capped to the loop\'s smaller worker budget, throwing "Agent count 5 exceeds max N" for any ordinary fixture prompt) which has been fixed in this change, but goal-workflow.json/completion-proof.json parity still requires either wiring maybeFinalizeRoute into goalCreate or relaxing this fixture\'s expected_artifacts, both out of scope here; left as documented mock.'
     }),
-    'route-insane-search': fixture('execute', 'sks run "$Insane-Search source intelligence fixture" --execute --json', [], 'pass'),
-    'route-insanesearch': fixture('execute', 'sks run "$InsaneSearch source intelligence fixture" --execute --json', [], 'pass'),
-    'route-ultra-search': fixture('execute', 'sks run "$Ultra-Search source intelligence fixture" --execute --json', [], 'pass'),
-    'route-ultrasearch': fixture('execute', 'sks run "$UltraSearch source intelligence fixture" --execute --json', [], 'pass'),
+    'route-super-search': fixture('execute', 'sks run "$Super-Search doctor" --execute --json', [], 'pass'),
     'route-seo-geo-optimizer': fixture('execute_and_validate_artifacts', 'sks seo-geo-optimizer fixture --mode geo --json', ['search-visibility/site-inventory.json', 'search-visibility/geo-findings.json', 'search-visibility/verification-report.json', 'geo-gate.json', 'completion-proof.json'], 'pass'),
     'route-autoresearch': fixture('mock', '$AutoResearch fixture route', ['research-gate.json', 'completion-proof.json'], 'pass', {
         reason: 'Producing research-gate.json + completion-proof.json requires the two-step `research prepare` then `research run latest --mock --autoresearch --json` sequence (same as route-research\'s safe-args setup step), which a single spawned command cannot express; the $AutoResearch pipeline-dispatch route (`sks run "$AutoResearch ..."`) instead writes autoresearch-gate.json, a different contract. Left as documented mock pending multi-step fixture setup support.'
@@ -184,23 +185,29 @@ const FIXTURES = Object.freeze({
     'route-wiki': fixture('execute_and_validate_artifacts', 'sks wiki image-ingest test/fixtures/images/one-by-one.png --json', [{ path: 'completion-proof.json', schema: 'sks.completion-proof.v1' }, { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }], 'pass'),
     'route-gx': fixture('execute_and_validate_artifacts', 'sks gx validate fixture --mock --json', ['completion-proof.json', { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }, 'gx-validation.json'], 'blocked', { reason: 'gxValidateFixture() intentionally exits non-zero (execution_class: mock_fixture) for an honest mock/blocked result; it does write all three declared artifacts.' }),
     'route-sks': fixture('static', '$SKS control-surface route', ['completion-proof.json'], 'pass', {
+        quality: 'wiring_only',
         reason: 'Pure control-surface alias route with no independent behavior beyond the underlying CLI command fixtures it dispatches to.'
     }),
     'route-fast-mode': fixture('execute', 'sks fast-mode status --json', [], 'pass'),
     'route-fast-on': fixture('static', '$Fast-On covered by hermetic fast-mode blackbox toggle test', [], 'pass', {
+        quality: 'wiring_only',
         reason: 'Toggle-only dollar-command alias; behavior is covered by the hermetic fast-mode blackbox toggle test suite, not a standalone CLI invocation.'
     }),
     'route-fast-off': fixture('static', '$Fast-Off covered by hermetic fast-mode blackbox toggle test', [], 'pass', {
+        quality: 'wiring_only',
         reason: 'Toggle-only dollar-command alias; behavior is covered by the hermetic fast-mode blackbox toggle test suite, not a standalone CLI invocation.'
     }),
     'route-local-model': fixture('execute', 'sks with-local-llm status --json', [], 'pass'),
     'route-with-local-llm-on': fixture('static', '$with-local-llm-on covered by hermetic local-model dollar-command blackbox toggle test', [], 'pass', {
+        quality: 'wiring_only',
         reason: 'Toggle-only dollar-command alias; behavior is covered by the hermetic local-model dollar-command blackbox toggle test suite, not a standalone CLI invocation.'
     }),
     'route-with-local-llm-off': fixture('static', '$with-local-llm-off covered by hermetic local-model dollar-command blackbox toggle test', [], 'pass', {
+        quality: 'wiring_only',
         reason: 'Toggle-only dollar-command alias; behavior is covered by the hermetic local-model dollar-command blackbox toggle test suite, not a standalone CLI invocation.'
     }),
     'route-help': fixture('static', '$Help lightweight route', [], 'pass', {
+        quality: 'wiring_only',
         reason: 'Pure alias of the cli-help command; no independent behavior to verify beyond cli-help\'s own execute fixture.'
     }),
     'route-commit': fixture('mock', '$Commit git route', ['completion-proof.json'], 'pass', {

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '5.7.0';
+export const PACKAGE_VERSION = '5.9.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/init/skills.js

@@ -66,8 +66,7 @@ async function installOfficialSkills(root) {
         'reasoning-router': `---\nname: reasoning-router\ndescription: Temporary SKS reasoning-effort routing for every command and pipeline route.\n---\n\nmedium: simple copy/color/discovery/setup/mechanical edits. high: logic, safety, architecture, DB, orchestration, refactor, multi-file work. xhigh: research, AutoResearch, falsification, benchmarks, SEO/GEO, open-ended discovery, and From-Chat-IMG image work-order analysis. Routing is temporary; return to default after the gate. Inspect with sks reasoning and sks pipeline status.\n`,
         'pipeline-runner': `---\nname: pipeline-runner\ndescription: Execute SKS dollar-command routes as stateful pipelines with mission artifacts, route gates, Context7 evidence, temporary reasoning routing, reflection, and Honest Mode.\n---\n\nEvery $ command is a route. Use current.json, mission artifacts, and pipeline-plan.json as the execution plan: it records the lane, skipped stages, kept stages, verification, lean_decision, and no-unrequested-fallback invariant. Use temporary reasoning, TriWiki before stages, source hydration, Context7 when required, Team cleanup before reflection, reflection for full routes, and completion summary plus Honest Mode before final. Surface guard/scopes, record evidence, refresh/pack/validate TriWiki, and check sks pipeline status/resume/plan. ${leanEngineeringCompactText()} ${speedLanePolicyText()} ${skillDreamPolicyText()}\n`,
         'context7-docs': `---\nname: context7-docs\ndescription: Enforce Context7 MCP documentation evidence for SKS routes that depend on external libraries, frameworks, APIs, MCPs, package managers, DB SDKs, or generated docs.\n---\n\nWhen required, resolve-library-id, then query-docs for the resolved id. Legacy get-library-docs evidence is accepted. Prefer sks context7 tools/resolve/docs/evidence and finish only after both evidence stages exist. Check setup with sks context7 check.\n`,
-        'insane-search': `---\nname: insane-search\ndescription: Dollar-command route for $Insane-Search/$InsaneSearch provider-independent source intelligence.\n---\n\nUse when the user invokes $Insane-Search, $InsaneSearch, legacy $Ultra-Search/$UltraSearch, or asks for InsaneSearch source intelligence, source acquisition, X-search-style collection, URL acquisition, source normalization, claim ledgers, or citation proof. Prefer \`sks insane-search doctor --json\` for readiness and \`sks insane-search run "<query>" --mode balanced --json\` for provider-independent source proof; use \`sks insane-search x "<query>" --json\` for X-search intent and \`sks insane-search fetch "<url>" --json\` for URL acquisition. Context7 is required only when the query depends on current package/API/framework/MCP/generated documentation behavior. xAI/Grok credentials are optional and must not be required for route readiness. Evidence/artifacts remain under \`.sneakoscope/missions/<ultra-* or route mission>/ultra-search/\`: intent.json, axes.json, query-variants.json, provider-plan.json, source-ledger.json, lead-ledger.json, claim-ledger.json, synthesis.md, ultra-search-proof.json, ultra-search-gate.json, and ultra-search-result.json. Do not turn weak discovery into supported claims; finish with an Honest Mode summary of verified sources, blockers, and unverified external coverage.\n`,
-        'ultra-search': `---\nname: ultra-search\ndescription: Compatibility alias for $Insane-Search/$InsaneSearch provider-independent source intelligence.\n---\n\nUse when the user invokes legacy $Ultra-Search/$UltraSearch or asks for InsaneSearch source intelligence, source acquisition, X-search-style collection, URL acquisition, source normalization, claim ledgers, or citation proof. Prefer \`sks ultra-search doctor --json\` for readiness and \`sks ultra-search run "<query>" --mode balanced --json\` for provider-independent source proof; use \`sks ultra-search x "<query>" --json\` for X-search intent and \`sks ultra-search fetch "<url>" --json\` for URL acquisition. Context7 is required only when the query depends on current package/API/framework/MCP/generated documentation behavior. xAI/Grok credentials are optional and must not be required for route readiness. Evidence/artifacts live under \`.sneakoscope/missions/<ultra-* or route mission>/ultra-search/\`: intent.json, axes.json, query-variants.json, provider-plan.json, source-ledger.json, lead-ledger.json, claim-ledger.json, synthesis.md, ultra-search-proof.json, ultra-search-gate.json, and ultra-search-result.json. Do not turn weak discovery into supported claims; finish with an Honest Mode summary of verified sources, blockers, and unverified external coverage.\n`,
+        'super-search': `---\nname: super-search\ndescription: Dollar-command route for $Super-Search provider-independent source intelligence.\n---\n\nUse when the user invokes $Super-Search or asks for Super-Search source intelligence, source acquisition, X-search-style collection, URL acquisition, source normalization, claim ledgers, or citation proof. Prefer \`sks super-search doctor --json\` for readiness and \`sks super-search run "<query>" --mode balanced --json\` for provider-independent source proof; use \`sks super-search x "<query>" --json\` for X-search intent and \`sks super-search fetch "<url>" --json\` for URL acquisition. Context7 is required only when the query depends on current package/API/framework/MCP/generated documentation behavior. xAI/Grok credentials are optional and must not be required for route readiness. Evidence/artifacts remain under \`.sneakoscope/missions/<super-search-* or route mission>/super-search/\`: intent.json, axes.json, query-variants.json, provider-plan.json, source-ledger.json, lead-ledger.json, claim-ledger.json, attempt-ledger.json, synthesis.md, super-search-proof.json, super-search-gate.json, and super-search-result.json. Do not turn weak discovery into supported claims; finish with an Honest Mode summary of verified sources, blockers, and unverified external coverage.\n`,
         'search-visibility-core': `---\nname: search-visibility-core\ndescription: Shared kernel for seo-geo-optimizer audit, plan, explicit apply, rollback, verification, gates, and Completion Proof.\n---\n\nPurpose: keep Search Engine Optimization and Generative Engine Optimization on one typed search-visibility kernel instead of duplicate implementations. Use when $SEO-GEO-OPTIMIZER or \`sks seo-geo-optimizer\` is selected. Workflow: doctor detects package/static/Next evidence; audit writes source-backed inventory and findings; plan compiles safe mutation operations; apply requires explicit \`--apply\`; verify separates source, build, HTTP, browser, production, and measured outcome; rollback only reverses mission-owned operations. Safety: default read-only, never overwrite unmanaged robots.txt, sitemap, llms.txt, metadata, or structured data; do not hard-code customer routes; do not invent prices, reviews, availability, rankings, traffic, or AI citation outcomes. Evidence/artifacts: search-visibility/intake.json, adapter-detection.json, site-inventory.json, route-graph.json, robots-policy.json, structured-data-ledger.json, mutation-plan.json, mutation-journal.jsonl, rollback-manifest.json, verification-report.json, route gate, and completion-proof.json. Failure/recovery: unsupported frameworks stay audit/plan-only; missing production/browser/Search Console evidence remains unverified, not fabricated. CLI entrypoint: \`sks seo-geo-optimizer ... --mode seo|geo\`.\n`,
         'seo-geo-optimizer': `---\nname: seo-geo-optimizer\ndescription: Unified $SEO-GEO-OPTIMIZER route for Search Engine Optimization and Generative Engine Optimization.\n---\n\nPurpose: use one route name for SEO and GEO work while keeping the internal search-visibility mode explicit. Use when: the user asks for SEO audit/fix/verification, package/npm/GitHub search visibility, canonical, sitemap, robots.txt, hreflang, metadata, structured data, AI answer visibility, LLM citation readiness, answerability, entity/claim provenance, crawler policy, OAI-SearchBot/GPTBot/ChatGPT-User, Claude-SearchBot/ClaudeBot/Claude-User, or optional llms.txt planning. GEO means Generative Engine Optimization, not geolocation, GeoIP, maps, CDN geography, location permission, or regional redirect bugs. Workflow: run \`sks seo-geo-optimizer doctor --mode seo|geo\`, then audit, plan, explicit apply, verify, status, and rollback. Use \`--mode seo\` for technical/package search optimization and \`--mode geo\` for entity facts, claim evidence, answerability, crawler policy, and optional llms.txt. Safety: audit and plan must not mutate source; apply checks base hashes, ownership, scope, protected paths, rollback manifest, and post-verify. AI crawler policy must split search, training, user-directed retrieval, and ads/other; never use one allow_ai toggle and never auto-allow training crawlers. Evidence/artifacts: site-inventory.json, route-graph.json, seo-findings.json or geo-findings.json, entity-facts.json, claim-evidence-ledger.json, answerability-report.json, ai-crawler-policy.json, llms-txt-plan.json, mutation-plan.json, verification-report.json, seo-gate.json or geo-gate.json, completion-proof.json. Failure/recovery: unsupported frameworks stay plan-only; browser/production/Search Console/analytics outcomes are marked unverified when not actually run. Forbidden claims: no ranking, indexing, traffic lift, rich-result, answer inclusion, or AI citation guarantee; no keyword stuffing, doorway pages, fake reviews, fake prices, fake availability, fake shipping, fake awards, hidden AI-only text, or scaled spam. CLI entrypoint: \`sks seo-geo-optimizer doctor|audit|plan|apply|verify|status|rollback|fixture --mode seo|geo\`.\n`,
         'reflection': `---\nname: reflection\ndescription: Post-route self-review for full SKS routes that records real misses, gaps, and corrective lessons into TriWiki memory.\n---\n\nUse after full route work/tests and before final. DFix, Answer, Help, Wiki, SKS discovery are exempt. Do not invent faults. Write reflection.md; append real lessons to ${REFLECTION_MEMORY_PATH}; refresh/pack, validate context-pack.json, pass reflection-gate.json.\n\n${reflectionInstructionText()}\n`,

package/dist/core/install/installed-package-smoke.js

@@ -0,0 +1,121 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runProcess, writeJsonAtomic } from '../fsx.js';
+export async function runInstalledPackageSmoke(root) {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-installed-smoke-'));
+    const home = path.join(tmp, 'home');
+    const codexHome = path.join(tmp, 'codex-home');
+    const npmCache = path.join(tmp, 'npm-cache');
+    await Promise.all([home, codexHome, npmCache].map((dir) => fs.mkdir(dir, { recursive: true })));
+    const blockers = [];
+    const commands = [];
+    let tarball = null;
+    let installedVersion = null;
+    let packedVersion = null;
+    const pack = await runJsonCommand(root, ['npm', 'pack', '--json', '--ignore-scripts'], { npmCache });
+    commands.push(pack.command);
+    if (pack.exit_code !== 0)
+        blockers.push('npm_pack_failed');
+    const packInfo = packJsonObject(pack.json);
+    if (packInfo?.filename)
+        tarball = path.join(root, String(packInfo.filename));
+    if (packInfo?.version)
+        packedVersion = String(packInfo.version);
+    if (!tarball)
+        blockers.push('npm_pack_tarball_missing');
+    await fs.writeFile(path.join(tmp, 'package.json'), JSON.stringify({ private: true, type: 'module' }, null, 2));
+    if (tarball) {
+        const install = await runJsonCommand(tmp, ['npm', 'install', tarball, '--ignore-scripts'], { home, codexHome, npmCache });
+        commands.push(install.command);
+        if (install.exit_code !== 0)
+            blockers.push('npm_install_tarball_failed');
+    }
+    const bin = path.join(tmp, 'node_modules', '.bin', 'sks');
+    const smokeCommands = [
+        [bin, '--version'],
+        [bin, 'commands', '--json'],
+        [bin, 'bootstrap', '--json'],
+        [bin, 'doctor', '--json'],
+        [bin, 'super-search', 'doctor', '--json'],
+        [bin, 'selftest', '--mock']
+    ];
+    for (const argv of smokeCommands) {
+        const result = await runJsonCommand(tmp, argv, { home, codexHome, npmCache });
+        commands.push(result.command);
+        if (result.exit_code !== 0)
+            blockers.push(`installed_command_failed:${argv.slice(1).join('_') || 'version'}`);
+        if (argv.includes('--version')) {
+            const match = String(result.stdout || '').match(/([0-9]+\.[0-9]+\.[0-9]+)/);
+            if (match)
+                installedVersion = match[1] || null;
+        }
+    }
+    const forbiddenFindings = [];
+    if (process.env.HOME && home === process.env.HOME)
+        forbiddenFindings.push('host_home_reused');
+    if (process.env.CODEX_HOME && codexHome === process.env.CODEX_HOME)
+        forbiddenFindings.push('host_codex_home_reused');
+    if (packedVersion && installedVersion && packedVersion !== installedVersion)
+        blockers.push(`installed_version_mismatch:${installedVersion}:expected_${packedVersion}`);
+    blockers.push(...forbiddenFindings.map((item) => `forbidden:${item}`));
+    const report = {
+        schema: 'sks.installed-package-smoke.v1',
+        ok: blockers.length === 0,
+        generated_at: new Date().toISOString(),
+        tarball,
+        installed_version: installedVersion,
+        temp_dir: tmp,
+        commands,
+        forbidden_findings: forbiddenFindings,
+        blockers: [...new Set(blockers)]
+    };
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'installed-package-smoke.json'), report);
+    return report;
+}
+async function runJsonCommand(cwd, argv, opts) {
+    const started = Date.now();
+    const [command, ...args] = argv;
+    const env = {
+        SKS_TEST_ISOLATION: '1',
+        SKS_DISABLE_NETWORK: '1',
+        SKS_DISABLE_UPDATE_CHECK: '1'
+    };
+    if (opts.home !== undefined)
+        env.HOME = opts.home;
+    if (opts.codexHome !== undefined)
+        env.CODEX_HOME = opts.codexHome;
+    if (opts.npmCache !== undefined) {
+        env.npm_config_cache = opts.npmCache;
+        env.NPM_CONFIG_CACHE = opts.npmCache;
+    }
+    const res = await runProcess(command || 'node', args, {
+        cwd,
+        timeoutMs: 120_000,
+        maxOutputBytes: 1024 * 1024,
+        env
+    });
+    let parsed = null;
+    try {
+        parsed = JSON.parse(res.stdout);
+    }
+    catch { }
+    return {
+        exit_code: res.code,
+        stdout: res.stdout,
+        json: parsed,
+        command: {
+            argv,
+            exit_code: res.code,
+            stdout_json: parsed != null,
+            duration_ms: Date.now() - started,
+            stdout_tail: res.stdout.slice(-1200),
+            stderr_tail: res.stderr.slice(-1200)
+        }
+    };
+}
+function packJsonObject(value) {
+    const row = Array.isArray(value) ? value[0] : value;
+    return row && typeof row === 'object' ? row : null;
+}
+//# sourceMappingURL=installed-package-smoke.js.map

package/dist/core/mission.js

@@ -116,21 +116,7 @@ export async function closeRouteState(root, input = {}) {
         if (input.missionId && current.mission_id && String(current.mission_id) !== String(input.missionId)) {
             return { ok: false, status: 'mission_mismatch', mission_id: missionId, current_mission_id: current.mission_id };
         }
-        const next = {
-            ...current,
-            mission_id: missionId || current.mission_id || null,
-            route_closed: true,
-            route_closed_at: nowIso(),
-            route_close_reason: input.reason || 'route_close_command',
-            implementation_allowed: false,
-            questions_allowed: true,
-            mad_sks_active: false,
-            permission_gate_active: false,
-            gate_owner_mission_id: null,
-            phase: current.phase ? `${current.phase}_CLOSED` : 'ROUTE_CLOSED',
-            updated_at: nowIso(),
-            ...(sessionKey ? { _session_key: sessionKey } : {})
-        };
+        const next = closedRouteState(current, missionId, input.reason, sessionKey);
         if (sessionKey) {
             await ensureDir(stateSessionsDir(root));
             await writeJsonAtomic(targetFile, next);
@@ -138,6 +124,9 @@ export async function closeRouteState(root, input = {}) {
         }
         else {
             await writeJsonAtomic(stateFile(root), next);
+            for (const row of await matchingSessionStates(root, missionId, current._session_key)) {
+                await writeJsonAtomic(row.path, closedRouteState(row.state, missionId, input.reason, row.session_key));
+            }
         }
         if (missionId) {
             await appendJsonl(path.join(missionDir(root, missionId), 'events.jsonl'), {
@@ -150,6 +139,43 @@ export async function closeRouteState(root, input = {}) {
         return { ok: true, status: 'closed', mission_id: missionId || null, state_file: targetFile };
     });
 }
+function closedRouteState(current, missionId, reason, sessionKey) {
+    const phase = String(current.phase || '');
+    return {
+        ...current,
+        mission_id: missionId || current.mission_id || null,
+        route_closed: true,
+        route_closed_at: nowIso(),
+        route_close_reason: reason || 'route_close_command',
+        implementation_allowed: false,
+        questions_allowed: true,
+        mad_sks_active: false,
+        permission_gate_active: false,
+        gate_owner_mission_id: null,
+        phase: phase ? (/_CLOSED$/i.test(phase) ? phase : `${phase}_CLOSED`) : 'ROUTE_CLOSED',
+        updated_at: nowIso(),
+        ...(sessionKey ? { _session_key: sessionKey } : {})
+    };
+}
+async function matchingSessionStates(root, missionId, preferredSessionKey) {
+    const dir = stateSessionsDir(root);
+    const rows = [];
+    if (!(await exists(dir)))
+        return rows;
+    const fs = await import('node:fs/promises');
+    const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+        if (!entry.isFile() || !entry.name.endsWith('.json'))
+            continue;
+        const file = path.join(dir, entry.name);
+        const state = await readJson(file, {}).catch(() => ({}));
+        const key = String(state._session_key || entry.name.replace(/\.json$/, ''));
+        if (String(state.mission_id || '') === missionId || (preferredSessionKey && key === String(preferredSessionKey))) {
+            rows.push({ session_key: key, path: file, state });
+        }
+    }
+    return rows;
+}
 function withStateLock(root, fn) {
     return withFileLock({ lockPath: stateLockPath(root), timeoutMs: 20_000, staleMs: 120_000 }, fn);
 }

package/dist/core/naruto/naruto-active-pool.js

@@ -51,8 +51,12 @@ export async function runNarutoRealActivePool(input) {
         maxObserved = Math.max(maxObserved, active.size);
         timeline.push({ tick, active: active.size, pending: pending.length, completed: completed.size, event: launched ? 'refill' : 'wait' });
         const done = await nextCollectableWorkers(active, input.hardTimeoutMs);
-        if (!done.length)
-            break;
+        if (!done.length) {
+            tick += 1;
+            if (tick > input.graph.work_items.length * 4 + 20)
+                break;
+            continue;
+        }
         for (const handle of done) {
             active.delete(handle.id);
             if (handle.placement.placement === 'zellij-pane')