sneakoscope 6.0.2 → 6.1.0

package/dist/scripts/doctor-startup-config-repair-blackbox.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
 import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
 const root = await makeTempRoot('sks-startup-config-blackbox-');
-await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+await writeText(path.join(root, '.codex', 'config.toml'), '# SKS managed Codex config fixture\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
 const report = await repairCodexStartupConfig({ root, apply: true });
 const text = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
 assertGate(report.ok === true, 'startup config blackbox must pass postcheck', report);

package/dist/scripts/doctor-startup-config-repair-check.js

@@ -3,7 +3,7 @@ import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check
 import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
 import path from 'node:path';
 const root = await makeTempRoot('sks-startup-config-');
-await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/missing.toml"\nmessage_role_prefix = "legacy"\n');
+await writeText(path.join(root, '.codex', 'config.toml'), '# SKS managed Codex config fixture\n[agents.analysis_scout]\nconfig_file = ".codex/agents/missing.toml"\nmessage_role_prefix = "legacy"\n');
 const report = await repairCodexStartupConfig({ root, apply: true });
 assertGate(report.ok === true, 'startup config repair must repair stale config_file paths and unsupported fields', report);
 emitGate('doctor:startup-config-repair');

package/dist/scripts/gate-policy-audit-check.js

@@ -26,9 +26,9 @@ const directCodexConfigWrites = scanDirectCodexConfigWrites();
 const commandGateContract = scanCommandGateContract();
 const directMkdtempCalls = scanDirectMkdtempCalls();
 const rustTempdirCalls = scanRustTempdirCalls();
-if (releaseGates.length > 220)
+if (releaseGates.length > 200)
     blockers.push(`release_preset_gate_budget_exceeded:${releaseGates.length}`);
-if (gates.length > 220)
+if (gates.length > 200)
     blockers.push(`release_manifest_gate_budget_exceeded:${gates.length}`);
 if (Object.keys(pkg.scripts || {}).length > 100)
     blockers.push(`package_script_budget_exceeded:${Object.keys(pkg.scripts || {}).length}`);

package/dist/scripts/install-update-preserves-config-check.js

@@ -68,7 +68,7 @@ const results = [];
     const codexDir = path.join(dir, '.codex');
     await fs.mkdir(codexDir, { recursive: true });
     const cfg = path.join(codexDir, 'config.toml');
-    const broken = 'model = "gpt-5.5"\n[features\nhooks = true\n'; // malformed table header
+    const broken = 'model = "gpt-5.6-terra"\n[features\nhooks = true\n'; // malformed table header
     await fs.writeFile(cfg, broken);
     const res = await helpers.ensureGlobalCodexFastModeDuringInstall({ home: dir, configPath: cfg });
     const after = await fs.readFile(cfg, 'utf8');

package/dist/scripts/legacy-gate-inventory-check.js

@@ -1,7 +1,9 @@
 import { assertGate, emitGate, readJson, readText } from './sks-1-18-gate-lib.js';
 const gates = (readJson('release-gates.v2.json').gates || []);
 const migration = readText('docs/sks-4-migration.md');
-const allowlist = parseAllowlist(migration);
+const currentVersion = String(readJson('package.json').version || '');
+assertGate(/^\d+\.\d+\.\d+(?:[-+].*)?$/.test(currentVersion), 'package version must be valid before evaluating legacy allowlist expiry', { currentVersion });
+const allowlist = parseAllowlist(migration, currentVersion);
 const legacy = gates
     .filter((gate) => gate.preset?.includes('release'))
     .filter((gate) => removableLegacy(gate.id, gate.command))
@@ -19,7 +21,7 @@ function removableLegacy(id, command) {
         || /codex[:.-]?0139/.test(id)
         || /codex-0139/.test(command);
 }
-function parseAllowlist(text) {
+function parseAllowlist(text, currentVersion) {
     return [...text.matchAll(/<!--\s*sks-legacy-allowlist\s*([\s\S]*?)-->/g)].map((match) => {
         const body = match[1] || '';
         return {
@@ -28,7 +30,7 @@ function parseAllowlist(text) {
             owner: field(body, 'owner'),
             expires: field(body, 'expires')
         };
-    }).filter((row) => row.id && row.reason && row.owner && compareVersion(row.expires, '4.0.2') > 0);
+    }).filter((row) => row.id && row.reason && row.owner && compareVersion(row.expires, currentVersion) > 0);
 }
 function isAllowed(id, allowlist) {
     return allowlist.some((row) => row.id.endsWith('*') ? id.startsWith(row.id.slice(0, -1)) : row.id === id);
@@ -37,8 +39,8 @@ function field(body, name) {
     return body.match(new RegExp(`^${name}:\\s*(.+)$`, 'm'))?.[1]?.trim() || '';
 }
 function compareVersion(a, b) {
-    const left = a.split('.').map(Number);
-    const right = b.split('.').map(Number);
+    const left = (a.split(/[+-]/, 1)[0] || '').split('.').map(Number);
+    const right = (b.split(/[+-]/, 1)[0] || '').split('.').map(Number);
     for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
         const delta = (left[i] || 0) - (right[i] || 0);
         if (delta !== 0)

package/dist/scripts/legacy-strong-inventory-check.js

@@ -2,7 +2,9 @@ import { assertGate, emitGate, importDist, readJson, readText, root } from './sk
 const impactMod = await importDist('core/triwiki/triwiki-gate-impact-map.js');
 const map = impactMod.buildTriWikiGateImpactMap(root);
 const migration = readText('docs/sks-4-migration.md');
-const allowlist = parseAllowlist(migration);
+const currentVersion = String(readJson('package.json').version || '');
+assertGate(/^\d+\.\d+\.\d+(?:[-+].*)?$/.test(currentVersion), 'package version must be valid before evaluating legacy allowlist expiry', { currentVersion });
+const allowlist = parseAllowlist(migration, currentVersion);
 const gates = (readJson('release-gates.v2.json').gates || []);
 const legacyOrphans = map.impacts.filter((impact) => impact.orphan && removableLegacy(impact.gate_id, ''));
 const legacyPresent = gates.filter((gate) => gate.preset?.includes('release') && removableLegacy(gate.id, gate.command) && !isAllowed(gate.id, allowlist));
@@ -18,11 +20,11 @@ function removableLegacy(id, command) {
         || /codex[:.-]?0139/.test(id)
         || /codex-0139/.test(command);
 }
-function parseAllowlist(text) {
+function parseAllowlist(text, currentVersion) {
     return [...text.matchAll(/<!--\s*sks-legacy-allowlist\s*([\s\S]*?)-->/g)].map((match) => {
         const body = match[1] || '';
         return { id: field(body, 'id'), reason: field(body, 'reason'), owner: field(body, 'owner'), expires: field(body, 'expires') };
-    }).filter((row) => row.id && row.reason && row.owner && compareVersion(row.expires, '4.0.2') > 0);
+    }).filter((row) => row.id && row.reason && row.owner && compareVersion(row.expires, currentVersion) > 0);
 }
 function isAllowed(id, allowlist) {
     return allowlist.some((row) => row.id.endsWith('*') ? id.startsWith(row.id.slice(0, -1)) : row.id === id);
@@ -31,8 +33,8 @@ function field(body, name) {
     return body.match(new RegExp(`^${name}:\\s*(.+)$`, 'm'))?.[1]?.trim() || '';
 }
 function compareVersion(a, b) {
-    const left = a.split('.').map(Number);
-    const right = b.split('.').map(Number);
+    const left = (a.split(/[+-]/, 1)[0] || '').split('.').map(Number);
+    const right = (b.split(/[+-]/, 1)[0] || '').split('.').map(Number);
     for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
         const delta = (left[i] || 0) - (right[i] || 0);
         if (delta !== 0)

package/dist/scripts/legacy-upgrade-matrix-check.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // @ts-nocheck
-// Gate: legacy:upgrade-zero-break
+// Gate: migration:upgrade-safety
 // Proves a 1.18.x -> 1.19 upgrade never breaks user Codex config across legacy
 // states. Operates entirely on temp dirs (os.tmpdir + fs.mkdtemp); never touches
 // the real ~/.codex. Always restores process.env.CODEX_HOME / HOME in finally.
@@ -41,7 +41,7 @@ try {
         const dir = mkTmp('sks-legacy-corrupt-');
         tmpDirs.push(dir);
         const configPath = path.join(dir, 'config.toml');
-        const corrupted = 'model = "gpt-5.5"\nservice_tier = "fast"\n\n[mcp_servers.xai-grok.env]\nXAI_API_KEY = "x"\nmodel_provider = "codex-lb"\nnotify = ["a","b"]\n';
+        const corrupted = 'model = "gpt-5.6-terra"\nservice_tier = "fast"\n\n[mcp_servers.xai-grok.env]\nXAI_API_KEY = "x"\nmodel_provider = "codex-lb"\nnotify = ["a","b"]\n';
         fs.writeFileSync(configPath, corrupted, 'utf8');
         const result = await policy.repairCodexConfigStructure(configPath, { apply: true });
         const okStatuses = ['structure_repaired', 'structure_repair_available', 'structure_ok'];
@@ -121,7 +121,7 @@ try {
         const projectConfigPath = path.join(projectCodexDir, 'config.toml');
         // Machine-local keys/tables (model_provider, [profiles.*]) move out to CODEX_HOME;
         // project-scoped settings (sandbox_mode, [features]) must be PRESERVED in place.
-        fs.writeFileSync(projectConfigPath, 'model_provider = "codex-lb"\nsandbox_mode = "workspace-write"\n\n[features]\nhooks = true\n', 'utf8');
+        fs.writeFileSync(projectConfigPath, '# Sneakoscope managed fixture\nmodel_provider = "codex-lb"\nsandbox_mode = "workspace-write"\n\n[features]\nhooks = true\n', 'utf8');
         const result = await policy.splitCodexProjectConfigPolicy(projectRoot, {
             apply: true,
             codexHome: tmpHome2,
@@ -214,7 +214,7 @@ try {
         const dir = mkTmp('sks-legacy-noop-');
         tmpDirs.push(dir);
         const configPath = path.join(dir, 'config.toml');
-        const clean = 'model = "gpt-5.5"\nservice_tier = "fast"\n\n[features]\nhooks = true\n';
+        const clean = 'model = "gpt-5.6-terra"\nservice_tier = "fast"\n\n[features]\nhooks = true\n';
         fs.writeFileSync(configPath, clean, 'utf8');
         const before = fs.readFileSync(configPath, 'utf8');
         const result = await policy.repairCodexConfigStructure(configPath, { apply: true });
@@ -270,7 +270,7 @@ try {
     fs.mkdirSync(reportDir, { recursive: true });
     const reportPath = path.join(reportDir, 'legacy-upgrade-matrix.json');
     fs.writeFileSync(reportPath, `${JSON.stringify({ schema: 'sks.legacy-upgrade-matrix.v1', ok: true, ...summary }, null, 2)}\n`, 'utf8');
-    emitGate('legacy:upgrade-zero-break', {
+    emitGate('migration:upgrade-safety', {
         report_path: reportPath,
         states_checked: [
             'corrupted_config',

package/dist/scripts/lib/native-cli-session-swarm-check-lib.js

@@ -1,8 +1,15 @@
 // @ts-nocheck
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { assertGate, root } from '../sks-1-18-gate-lib.js';
+const MAX_EMPTY_OUTPUT_ATTEMPTS = 2;
+const CLI_COMPLETION_TIMEOUT_MS = 180_000;
+const CLI_STABILITY_WAIT_MS = 500;
+const CLI_STABILITY_SAMPLE_MS = 25;
+const stabilityWaitCell = new Int32Array(new SharedArrayBuffer(4));
 export function runNativeCliSwarmCheck({ agents, workItems = agents, reportName, backend = 'fake', extraArgs = [], expectedFastMode = null }) {
     const distCli = path.join(root, 'dist', 'bin', 'sks.js');
     assertGate(fs.existsSync(distCli), 'dist CLI missing for native CLI swarm check', { distCli });
@@ -25,18 +32,37 @@ export function runNativeCliSwarmCheck({ agents, workItems = agents, reportName,
         '--json',
         ...extraArgs
     ];
-    const stdout = execFileSync(process.execPath, args, {
-        cwd: root,
-        encoding: 'utf8',
-        env: {
-            ...process.env,
-            SKS_TEST_ISOLATION: '1',
-            SKS_RELEASE_FIXTURE_ACTIVE_ROUTE_BYPASS: '1',
-            ...(backend === 'codex-sdk' ? { SKS_CODEX_SDK_FAKE: '1', NODE_ENV: 'test' } : {})
-        },
-        maxBuffer: 96 * 1024 * 1024
+    const attempts = [];
+    let inspected = null;
+    while (attempts.length < MAX_EMPTY_OUTPUT_ATTEMPTS) {
+        const attempt = runCliAttempt({ distCli, args, backend, attemptNumber: attempts.length + 1 });
+        attempts.push(attempt);
+        inspected = inspectNativeCliSwarmOutput(attempt.stdout);
+        if (inspected.ok || inspected.reason !== 'empty_stdout')
+            break;
+        if (attempts.length >= MAX_EMPTY_OUTPUT_ATTEMPTS)
+            break;
+        const stable = waitForStableNonemptyCli(distCli);
+        assertGate(stable.ok, 'native CLI session swarm emitted empty JSON and the CLI did not settle for a bounded retry', {
+            dist_cli: distCli,
+            attempt_count: attempts.length,
+            completion_timeout_ms: CLI_COMPLETION_TIMEOUT_MS,
+            stability_wait_ms: CLI_STABILITY_WAIT_MS,
+            before: attempt.cli_before,
+            after: attempt.cli_after,
+            stable
+        });
+    }
+    assertGate(inspected?.ok === true, inspected?.reason === 'empty_stdout'
+        ? 'native CLI session swarm completed without JSON output after one bounded retry'
+        : 'native CLI session swarm emitted incomplete or invalid JSON', {
+        dist_cli: distCli,
+        attempt_count: attempts.length,
+        completion_timeout_ms: CLI_COMPLETION_TIMEOUT_MS,
+        attempts: attempts.map(attemptDiagnostic),
+        output: inspected
     });
-    const result = JSON.parse(stdout);
+    const result = inspected.value;
     const proof = result.native_cli_session_proof || {};
     const noSubagent = result.no_subagent_scaling_policy || {};
     const officialHelper = result.official_subagent_helper_policy || {};
@@ -55,7 +81,16 @@ export function runNativeCliSwarmCheck({ agents, workItems = agents, reportName,
         no_subagent_scaling_policy: noSubagent,
         official_subagent_helper_policy: officialHelper,
         fast_mode_propagation: fast,
-        proof_status: result.proof?.status || null
+        proof_status: result.proof?.status || null,
+        completion_protocol: {
+            schema: 'sks.native-cli-check-completion.v1',
+            attempt_count: attempts.length,
+            max_attempts: MAX_EMPTY_OUTPUT_ATTEMPTS,
+            bounded_timeout_ms: CLI_COMPLETION_TIMEOUT_MS,
+            atomic_output_read: true,
+            transient_empty_output_recovered: attempts.length > 1,
+            output_bytes: attempts.at(-1)?.output_bytes || 0
+        }
     };
     const out = path.join(root, '.sneakoscope', 'reports', reportName);
     fs.mkdirSync(path.dirname(out), { recursive: true });
@@ -63,7 +98,8 @@ export function runNativeCliSwarmCheck({ agents, workItems = agents, reportName,
     assertGate(result.ok === true, 'native CLI session swarm run must pass', report);
     assertGate(proof.spawned_worker_process_count >= agents, 'spawned native worker process count below requested agents', report);
     assertGate(proof.unique_worker_session_count >= agents, 'unique worker session count below requested agents', report);
-    assertGate(proof.unique_slot_count >= agents, 'unique slot count below requested agents', report);
+    const expectedSlots = Math.min(agents, Number(proof.target_active_slots || agents));
+    assertGate(proof.unique_slot_count >= expectedSlots, 'unique slot count below effective concurrency target', report);
     assertGate(Array.isArray(proof.process_ids) && proof.process_ids.length >= agents, 'process ids missing from native CLI proof', report);
     assertGate(proof.close_report_count >= agents, 'worker close report count below requested agents', report);
     assertGate(noSubagent.ok === true && noSubagent.subagent_events_counted_as_worker_sessions === false, 'no-subagent scaling policy must pass', report);
@@ -72,10 +108,135 @@ export function runNativeCliSwarmCheck({ agents, workItems = agents, reportName,
     assertGate(noSubagent.official_codex_subagent_helper_lane_allowed === true && noSubagent.official_helper_lane_worker_capacity_credit === 0, 'no-subagent policy must allow helper lane with zero capacity credit', report);
     assertGate(fast.ok === true, 'fast mode propagation proof must pass', report);
     assertGate(fast.fast_mode === expectedFast && fast.service_tier === expectedTier, 'worker service tier must match the selected fast-mode policy', { ...report, expected_fast_mode: expectedFast, expected_service_tier: expectedTier });
-    if (expectedFast) {
+    if (expectedFast && expectedFastMode === true) {
         assertGate(policy.explicit_fast === true || policy.preference_mode === 'fast' || policy.explicit_service_tier === 'fast', 'fast-mode propagation gate must use explicit fast opt-in', report);
     }
     assertGate((proof.worker_command_lines || []).every((line) => line.includes('--agent') && line.includes('worker')), 'worker command lines must use --agent worker', report);
     return report;
 }
+export function inspectNativeCliSwarmOutput(stdout) {
+    const text = typeof stdout === 'string' ? stdout : String(stdout || '');
+    if (text.trim().length === 0)
+        return { ok: false, reason: 'empty_stdout', output_bytes: Buffer.byteLength(text) };
+    try {
+        const value = JSON.parse(text);
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+            return { ok: false, reason: 'non_object_json', output_bytes: Buffer.byteLength(text) };
+        }
+        return { ok: true, value, output_bytes: Buffer.byteLength(text) };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: 'invalid_json',
+            output_bytes: Buffer.byteLength(text),
+            parse_error: error instanceof Error ? error.message : String(error),
+            output_sha256: crypto.createHash('sha256').update(text).digest('hex')
+        };
+    }
+}
+function runCliAttempt({ distCli, args, backend, attemptNumber }) {
+    const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-native-cli-swarm-fixture-'));
+    const fixtureHome = path.join(fixtureRoot, 'home');
+    const outputDraft = path.join(fixtureRoot, `.native-cli-result-${attemptNumber}.json.partial`);
+    const outputComplete = path.join(fixtureRoot, `.native-cli-result-${attemptNumber}.json`);
+    let outputFd = fs.openSync(outputDraft, 'wx', 0o600);
+    const cleanupFixture = () => fs.rmSync(fixtureRoot, { recursive: true, force: true });
+    process.once('exit', cleanupFixture);
+    const cliBefore = cliSnapshot(distCli);
+    try {
+        execFileSync(process.execPath, args, {
+            cwd: fixtureRoot,
+            env: {
+                ...process.env,
+                HOME: fixtureHome,
+                CODEX_HOME: path.join(fixtureHome, '.codex'),
+                SKS_GLOBAL_ROOT: path.join(fixtureHome, '.sneakoscope-global'),
+                TMPDIR: fixtureRoot,
+                TMP: fixtureRoot,
+                TEMP: fixtureRoot,
+                PWD: fixtureRoot,
+                SKS_TEST_ISOLATION: '1',
+                SKS_UPDATE_MIGRATION_GATE_DISABLED: '1',
+                NODE_ENV: 'test',
+                CI: 'true',
+                ...(backend === 'codex-sdk' ? { SKS_CODEX_SDK_FAKE: '1' } : {})
+            },
+            timeout: CLI_COMPLETION_TIMEOUT_MS,
+            killSignal: 'SIGTERM',
+            stdio: ['ignore', outputFd, 'pipe'],
+            maxBuffer: 96 * 1024 * 1024
+        });
+        fs.fsyncSync(outputFd);
+        fs.closeSync(outputFd);
+        outputFd = null;
+        fs.renameSync(outputDraft, outputComplete);
+        const stdout = fs.readFileSync(outputComplete, 'utf8');
+        const cliAfter = cliSnapshot(distCli);
+        return {
+            attempt: attemptNumber,
+            stdout,
+            output_bytes: Buffer.byteLength(stdout),
+            cli_before: cliBefore,
+            cli_after: cliAfter
+        };
+    }
+    finally {
+        if (outputFd !== null) {
+            try {
+                fs.closeSync(outputFd);
+            }
+            catch { }
+        }
+        process.removeListener('exit', cleanupFixture);
+        cleanupFixture();
+    }
+}
+function waitForStableNonemptyCli(distCli) {
+    const startedAt = Date.now();
+    let previous = cliSnapshot(distCli);
+    while (Date.now() - startedAt < CLI_STABILITY_WAIT_MS) {
+        Atomics.wait(stabilityWaitCell, 0, 0, CLI_STABILITY_SAMPLE_MS);
+        const current = cliSnapshot(distCli);
+        if (current.ok && current.size > 0 && sameCliSnapshot(previous, current)) {
+            return { ok: true, waited_ms: Date.now() - startedAt, snapshot: current };
+        }
+        previous = current;
+    }
+    return { ok: false, waited_ms: Date.now() - startedAt, snapshot: previous };
+}
+function cliSnapshot(file) {
+    try {
+        const stat = fs.statSync(file);
+        const bytes = fs.readFileSync(file);
+        return {
+            ok: stat.isFile(),
+            size: stat.size,
+            mtime_ms: stat.mtimeMs,
+            dev: String(stat.dev),
+            ino: String(stat.ino),
+            sha256: crypto.createHash('sha256').update(bytes).digest('hex')
+        };
+    }
+    catch (error) {
+        return { ok: false, size: 0, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+function sameCliSnapshot(left, right) {
+    return left?.ok === true
+        && right?.ok === true
+        && left.size === right.size
+        && left.mtime_ms === right.mtime_ms
+        && left.dev === right.dev
+        && left.ino === right.ino
+        && left.sha256 === right.sha256;
+}
+function attemptDiagnostic(attempt) {
+    return {
+        attempt: attempt.attempt,
+        output_bytes: attempt.output_bytes,
+        cli_before: attempt.cli_before,
+        cli_after: attempt.cli_after
+    };
+}
 //# sourceMappingURL=native-cli-session-swarm-check-lib.js.map

package/dist/scripts/mad-sks-app-ui-no-mutation-check.js

@@ -1,16 +1,19 @@
 #!/usr/bin/env node
 import assert from 'node:assert/strict';
+import { randomBytes } from 'node:crypto';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { madHighCommand } from '../core/commands/mad-sks-command.js';
-import { sha256 } from '../core/fsx.js';
+import { runProcess, sha256 } from '../core/fsx.js';
+import { runZellij } from '../core/zellij/zellij-command.js';
 const original = {
     cwd: process.cwd(),
     home: process.env.HOME,
     codexHome: process.env.CODEX_HOME,
     noAttach: process.env.SKS_NO_ZELLIJ_ATTACH,
     requireZellij: process.env.SKS_REQUIRE_ZELLIJ,
+    zellijSocketDir: process.env.ZELLIJ_SOCKET_DIR,
     madSwarm: process.env.SKS_MAD_NATIVE_SWARM,
     skipNpm: process.env.SKS_SKIP_NPM_FRESHNESS_CHECK
 };
@@ -18,6 +21,12 @@ const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-ui-no-mutation-'));
 const home = path.join(tmp, 'home');
 const codexHome = path.join(home, '.codex');
 const configPath = path.join(codexHome, 'config.toml');
+const runId = `${process.pid}-${Date.now().toString(36)}-${randomBytes(3).toString('hex')}`;
+const sessionName = `sks-mad-ui-check-${runId}`;
+const socketDir = path.join('/tmp', `sks-zj-madui-${runId}`);
+let report;
+let cleanup = { ok: false, blockers: ['cleanup_not_run'] };
+let fixtureRemoval = { ok: false, blockers: ['fixture_removal_not_run'] };
 try {
     await fs.mkdir(codexHome, { recursive: true });
     await fs.mkdir(path.join(tmp, '.sneakoscope'), { recursive: true });
@@ -35,10 +44,11 @@ try {
     process.env.CODEX_HOME = codexHome;
     process.env.SKS_NO_ZELLIJ_ATTACH = '1';
     process.env.SKS_REQUIRE_ZELLIJ = '0';
+    process.env.ZELLIJ_SOCKET_DIR = socketDir;
     process.env.SKS_MAD_NATIVE_SWARM = '0';
     process.env.SKS_SKIP_NPM_FRESHNESS_CHECK = '1';
     process.exitCode = 0;
-    await madHighCommand(['--no-attach', '--no-swarm'], {
+    const launch = await madHighCommand(['--no-attach', '--no-swarm', '--session', sessionName], {
         maybePromptSksUpdateForLaunch: async () => ({ status: 'skipped' }),
         maybePromptCodexUpdateForLaunch: async () => ({ status: 'skipped' }),
         ensureMadLaunchDependencies: async () => ({ ready: true, actions: [] }),
@@ -51,33 +61,54 @@ try {
     assert.equal(/\[profiles\.sks-mad-high\]/.test(after), false);
     assert.equal(/enabled\s*=\s*false/.test(after), true);
     process.exitCode = 0;
-    emit({
+    report = {
         schema: 'sks.mad-sks-app-ui-no-mutation-check.v1',
         ok: true,
         before_hash: sha256(before),
         after_hash: sha256(after),
         profile_files_written: entries.filter((entry) => /sks-mad-high/.test(entry)),
         plugin_disabled_preserved: true,
+        session_name: launch?.session_name || null,
+        isolated_socket_dir: socketDir,
         blockers: []
-    });
+    };
 }
 catch (err) {
-    emit({
+    report = {
         schema: 'sks.mad-sks-app-ui-no-mutation-check.v1',
         ok: false,
         error: err?.message || String(err),
         blockers: ['mad_sks_app_ui_no_mutation_failed']
-    });
+    };
 }
 finally {
     process.chdir(original.cwd);
+    cleanup = await cleanupOwnedSession(sessionName, socketDir, original.cwd);
+    if (!cleanup.ok) {
+        report.ok = false;
+        report.blockers = [...new Set([...(report.blockers || []), ...cleanup.blockers])];
+    }
     restoreEnv('HOME', original.home);
     restoreEnv('CODEX_HOME', original.codexHome);
     restoreEnv('SKS_NO_ZELLIJ_ATTACH', original.noAttach);
     restoreEnv('SKS_REQUIRE_ZELLIJ', original.requireZellij);
+    restoreEnv('ZELLIJ_SOCKET_DIR', original.zellijSocketDir);
     restoreEnv('SKS_MAD_NATIVE_SWARM', original.madSwarm);
     restoreEnv('SKS_SKIP_NPM_FRESHNESS_CHECK', original.skipNpm);
+    if (cleanup.ok) {
+        fixtureRemoval = await removeFixtureRootAfterQuiescence(tmp);
+        if (!fixtureRemoval.ok) {
+            cleanup.ok = false;
+            cleanup.blockers = [...new Set([...(cleanup.blockers || []), ...fixtureRemoval.blockers])];
+            report.ok = false;
+            report.blockers = [...new Set([...(report.blockers || []), ...fixtureRemoval.blockers])];
+        }
+    }
 }
+report.cleanup = cleanup;
+report.fixture_removal = fixtureRemoval;
+report.temporary_root_removed = fixtureRemoval.ok && !(await exists(tmp));
+emit(report);
 function restoreEnv(key, value) {
     if (value == null)
         delete process.env[key];
@@ -89,4 +120,133 @@ function emit(report) {
     if (!report.ok)
         process.exitCode = 1;
 }
+async function cleanupOwnedSession(sessionName, socketDir, cwd) {
+    const ownedProcessTree = await readOwnedZellijProcessTree(sessionName, socketDir, cwd);
+    let kill = null;
+    let remaining = [];
+    for (let attempt = 1; attempt <= 2; attempt += 1) {
+        kill = await runZellij(['kill-session', sessionName], {
+            cwd,
+            env: { ZELLIJ_SOCKET_DIR: socketDir },
+            timeoutMs: 5000,
+            optional: true
+        });
+        remaining = await waitForSocketEntriesToClear(socketDir, 1500);
+        if (!remaining.includes(sessionName))
+            break;
+    }
+    const processExit = await waitForOwnedProcessesToExit(ownedProcessTree.processes, 5000);
+    const sessionRemoved = !remaining.includes(sessionName);
+    const socketExclusive = remaining.length === 0;
+    if (sessionRemoved && socketExclusive && processExit.ok)
+        await fs.rm(socketDir, { recursive: true, force: true });
+    const socketDirRemoved = !(await exists(socketDir));
+    const blockers = [
+        ...(!sessionRemoved ? ['mad_ui_check_zellij_session_still_present'] : []),
+        ...(!socketExclusive ? ['mad_ui_check_zellij_socket_not_exclusive'] : []),
+        ...(!ownedProcessTree.server_found ? ['mad_ui_check_zellij_server_not_observed'] : []),
+        ...(!processExit.ok ? ['mad_ui_check_owned_processes_still_alive'] : []),
+        ...(!socketDirRemoved ? ['mad_ui_check_zellij_socket_dir_not_removed'] : [])
+    ];
+    return {
+        ok: blockers.length === 0,
+        session_removed: sessionRemoved,
+        socket_dir_removed: socketDirRemoved,
+        remaining_socket_entries: remaining,
+        owned_process_tree: ownedProcessTree,
+        owned_process_exit: processExit,
+        kill,
+        blockers
+    };
+}
+async function readOwnedZellijProcessTree(sessionName, socketDir, cwd) {
+    const serverSocket = path.join(socketDir, 'contract_version_1', sessionName);
+    const deadline = Date.now() + 1500;
+    let rows = [];
+    let server = null;
+    do {
+        const result = await runProcess('ps', ['-axo', 'pid=,ppid=,command='], {
+            cwd,
+            timeoutMs: 3000,
+            maxOutputBytes: 1024 * 1024
+        });
+        rows = parseProcessRows(result.stdout);
+        server = rows.find((row) => {
+            const executable = row.command.trim().split(/\s+/, 1)[0] || '';
+            return path.basename(executable) === 'zellij' && row.command.includes(` --server ${serverSocket}`);
+        }) || null;
+        if (!server && Date.now() < deadline)
+            await delay(50);
+    } while (!server && Date.now() < deadline);
+    if (!server)
+        return { server_found: false, server_socket: serverSocket, processes: [] };
+    const byParent = new Map();
+    for (const row of rows)
+        byParent.set(row.ppid, [...(byParent.get(row.ppid) || []), row]);
+    const processes = [];
+    const visit = (pid) => {
+        const row = rows.find((candidate) => candidate.pid === pid);
+        if (row)
+            processes.push(row);
+        for (const child of byParent.get(pid) || [])
+            visit(child.pid);
+    };
+    visit(server.pid);
+    return { server_found: true, server_socket: serverSocket, processes };
+}
+function parseProcessRows(text) {
+    return text.split(/\r?\n/).map((line) => {
+        const match = line.match(/^\s*(\d+)\s+(\d+)\s+(.+)$/);
+        return match ? { pid: Number(match[1]), ppid: Number(match[2]), command: match[3] || '' } : null;
+    }).filter(Boolean);
+}
+async function waitForOwnedProcessesToExit(processes, timeoutMs) {
+    const pids = [...new Set(processes.map((row) => row.pid))];
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline && pids.some(processAlive))
+        await delay(50);
+    const alive = pids.filter(processAlive);
+    return { ok: alive.length === 0, observed_pids: pids, verified_exited_pids: pids.filter((pid) => !alive.includes(pid)), alive_pids: alive };
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function removeFixtureRootAfterQuiescence(root) {
+    try {
+        await fs.rm(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 50 });
+    }
+    catch (err) {
+        return { ok: false, removed: false, recreated: false, quiet_period_ms: 300, error: err?.message || String(err), blockers: ['mad_ui_check_fixture_removal_failed'] };
+    }
+    await delay(300);
+    const recreated = await exists(root);
+    return {
+        ok: !recreated,
+        removed: !recreated,
+        recreated,
+        quiet_period_ms: 300,
+        blockers: recreated ? ['mad_ui_check_fixture_recreated_after_return'] : []
+    };
+}
+async function waitForSocketEntriesToClear(socketDir, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const entries = await fs.readdir(path.join(socketDir, 'contract_version_1')).catch(() => []);
+        if (entries.length === 0 || Date.now() >= deadline)
+            return entries;
+        await delay(50);
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function exists(value) {
+    return fs.access(value).then(() => true).catch(() => false);
+}
 //# sourceMappingURL=mad-sks-app-ui-no-mutation-check.js.map

package/dist/scripts/mutation-callsite-coverage-check.js

@@ -117,20 +117,9 @@ function listScanFiles() {
         const relative = rel(file);
         if (isTestSource(relative))
             return;
-        if (relative.startsWith('src/scripts/'))
-            return;
         if (file.endsWith('.ts'))
             files.push(relative);
     });
-    walk(path.join(root, 'src', 'scripts'), (file) => {
-        if (!file.endsWith('.ts'))
-            return;
-        if (isTestSource(rel(file)))
-            return;
-        const base = path.basename(file);
-        if (/(install|publish|release|doctor|codex|zellij|migration)/i.test(base))
-            files.push(rel(file));
-    });
     return files.sort();
 }
 function isTestSource(relative) {