sneakoscope 6.0.2 → 6.1.0

package/dist/scripts/release-runtime-truth-matrix-check.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { buildRuntimeTruthMatrix, writeRuntimeTruthMatrix } from '../core/proof/runtime-truth-matrix.js';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+const matrix = await buildRuntimeTruthMatrix({
+    root,
+    releaseVersion: String(pkg.version || '')
+});
+await writeRuntimeTruthMatrix(root, matrix);
+assertGate(matrix.ok === true, 'runtime truth matrix contains blocking evidence', {
+    blockers: matrix.blockers,
+    required_rows: matrix.rows.filter((row) => row.required_mode)
+});
+emitGate('release:runtime-truth-matrix', {
+    report: `.sneakoscope/reports/runtime-truth-matrix-${pkg.version}.json`,
+    rows: matrix.rows.length,
+    priorities: matrix.priorities
+});
+//# sourceMappingURL=release-runtime-truth-matrix-check.js.map

package/dist/scripts/route-proof-artifact-structure-check.js

@@ -69,6 +69,7 @@ async function runNegativeFixture() {
         mission_id: mission,
         status: 'verified',
         route: '$Team',
+        execution_class: 'real',
         summary: { files_changed: 0, commands_run: 0, tests_passed: 0, tests_failed: 0, manual_review_required: false },
         evidence: {
             agents: {

package/dist/scripts/scheduler-batch-dispatch-check.js

@@ -12,6 +12,6 @@ const count = 6;
 const roster = { agent_count: count, roster: Array.from({ length: count }, (_, i) => ({ id: `a${i + 1}`, persona_id: `p${i + 1}`, role: 'verifier' })) };
 const partition = { slices: Array.from({ length: count }, (_, i) => ({ id: `w${i + 1}`, description: 'batch', write_paths: [], readonly_paths: [] })) };
 const result = await runAgentScheduler({ root: ledgerRoot, missionId, rootHash: 'fixture', roster, partition, targetActiveSlots: count, maxActiveSlots: count, launchSession: async ({ generation, agent, workItem }) => ({ schema: 'sks.agent-result.v1', mission_id: missionId, agent_id: agent.id, session_id: generation.session_id, persona_id: agent.persona_id, task_slice_id: workItem.id, status: 'done', backend: 'fake', summary: 'ok', findings: [], proposed_changes: [], changed_files: [], lease_compliance: { ok: true, violations: [] }, artifacts: [], blockers: [], confidence: 'high', handoff_notes: '', unverified: [], writes: [], recursion_guard: { ok: true, violations: [] }, verification: { status: 'passed', checks: [] } }) });
-assertGate(result.state.batch_dispatch_count >= 1 && result.state.largest_batch_size >= count, 'scheduler did not dispatch a full launch batch', result.state);
+assertGate(result.state.batch_dispatch_count >= 1 && result.state.largest_batch_size >= result.state.target_active_slots, 'scheduler did not dispatch a full effective launch batch', result.state);
 emitGate('scheduler:batch-dispatch', result.state);
 //# sourceMappingURL=scheduler-batch-dispatch-check.js.map

package/dist/scripts/search-visibility-gate-lib.js

@@ -36,7 +36,7 @@ export function makeSearchVisibilityFixture(name = 'search-visibility', options
 }
 export function runSks(args, options = {}) {
     const result = spawnSync(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), ...args], {
-        cwd: root,
+        cwd: options.cwd || root,
         encoding: 'utf8',
         stdio: 'pipe',
         env: {

package/dist/scripts/seo-geo-route-identity-check.js

@@ -1,12 +1,38 @@
 #!/usr/bin/env node
 // @ts-nocheck
-import { assertGate, emitGate, runSksJson } from './search-visibility-gate-lib.js';
-const seo = runSksJson(['run', '$SEO-GEO-OPTIMIZER SEO audit this fixture', '--execute', '--json']).json;
-const geo = runSksJson(['run', '$SEO-GEO-OPTIMIZER Generative Engine Optimization audit AI search visibility', '--execute', '--json']).json;
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('seo-geo-route-identity');
+fs.mkdirSync(path.join(fixture, '.sneakoscope'), { recursive: true });
+let seo;
+let geo;
+let seoMissionIsolated = false;
+let geoMissionIsolated = false;
+const cleanupFixture = () => fs.rmSync(fixture, { recursive: true, force: true });
+process.once('exit', cleanupFixture);
+try {
+    seo = runSksJson(['run', '$SEO-GEO-OPTIMIZER SEO audit this fixture', '--execute', '--json'], { cwd: fixture }).json;
+    seoMissionIsolated = fs.existsSync(path.join(fixture, '.sneakoscope', 'missions', seo.mission_id));
+    geo = runSksJson(['run', '$SEO-GEO-OPTIMIZER Generative Engine Optimization audit AI search visibility', '--execute', '--json'], { cwd: fixture }).json;
+    geoMissionIsolated = fs.existsSync(path.join(fixture, '.sneakoscope', 'missions', geo.mission_id));
+}
+finally {
+    cleanupFixture();
+    process.removeListener('exit', cleanupFixture);
+}
 const seoText = JSON.stringify(seo);
 const geoText = JSON.stringify(geo);
+assertGate(seoMissionIsolated && geoMissionIsolated, 'SEO/GEO route identity missions must stay inside the hermetic fixture', {
+    fixture,
+    seo_mission_id: seo.mission_id,
+    geo_mission_id: geo.mission_id,
+    seo_mission_isolated: seoMissionIsolated,
+    geo_mission_isolated: geoMissionIsolated
+});
 assertGate(/\$SEO-GEO-OPTIMIZER/.test(seoText) && /sks seo-geo-optimizer/.test(seoText) && /--mode seo/.test(seoText), 'sks run --execute must preserve unified optimizer route and execute seo mode path', seo);
 assertGate(/\$SEO-GEO-OPTIMIZER/.test(geoText) && /sks seo-geo-optimizer/.test(geoText) && /--mode geo/.test(geoText), 'sks run --execute must preserve unified optimizer route and execute geo mode path', geo);
 assertGate(!/\$AutoResearch/.test(seoText) && !/\$AutoResearch/.test(geoText), 'SEO/GEO route identity must not collapse into AutoResearch', { seo, geo });
-emitGate('seo-geo:route-identity', { seo_status: seo.status, geo_status: geo.status });
+assertGate(!fs.existsSync(fixture), 'SEO/GEO route identity fixture must be removed after the check', { fixture });
+emitGate('seo-geo:route-identity', { seo_status: seo.status, geo_status: geo.status, hermetic_fixture_removed: true });
 //# sourceMappingURL=seo-geo-route-identity-check.js.map

package/dist/scripts/sizecheck.js

@@ -5,9 +5,10 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { DEFAULT_MAX_PACK_BYTES } from '../core/release/package-size-budget.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const limits = {
-    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || 2410 * 1024),
+    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || DEFAULT_MAX_PACK_BYTES),
     unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || 10 * 1024 * 1024),
     packFiles: Number(process.env.SKS_MAX_PACK_FILES || 2100),
     trackedFileBytes: Number(process.env.SKS_MAX_TRACKED_FILE_BYTES || 384 * 1024)
@@ -16,7 +17,11 @@ const trackedFileSizeAllowlist = new Set([
     // Historical source documentation export; not included in the npm package payload.
     'docs/sks-local-llm-mode/exports/sks-local-llm-mode-deck.pdf',
     // Central release DAG manifest; package footprint limits still apply below.
-    'release-gates.v2.json'
+    'release-gates.v2.json',
+    // Generated Codex App Server protocol schemas; handwritten sources remain
+    // subject to the 384 KiB split-review limit.
+    'schemas/codex/app-server-0.144/codex_app_server_protocol.schemas.json',
+    'schemas/codex/app-server-0.144/codex_app_server_protocol.v2.schemas.json'
 ]);
 const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 function fail(message, detail = '') {

package/dist/scripts/sks-1-11-gate-lib.js

@@ -4,7 +4,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { tmpdir } from '../core/fsx.js';
 export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const fixtureMissionRoots = new Map();
+const fixtureRoots = new Set();
+let fixtureCleanupRegistered = false;
 export function assertGate(condition, message, detail = {}) {
     if (condition)
         return;
@@ -14,14 +18,15 @@ export function assertGate(condition, message, detail = {}) {
 export function emitGate(name, detail = {}) {
     console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate: name, ...detail }, null, 2));
 }
-export function runSksJson(args) {
+export function runSksJson(args, options = {}) {
     const entrypoint = path.join(root, 'dist', 'bin', 'sks.js');
     assertGate(fs.existsSync(entrypoint), 'dist entrypoint missing; run npm run build first', { entrypoint });
+    const mappedMissionRoot = args.map((arg) => fixtureMissionRoots.get(String(arg))).find(Boolean);
     const result = spawnSync(process.execPath, [entrypoint, ...args], {
-        cwd: root,
+        cwd: options.cwd || mappedMissionRoot || root,
         encoding: 'utf8',
         timeout: Number(process.env.SKS_GATE_TIMEOUT_MS || 120_000),
-        env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' }
+        env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true', ...(options.env || {}) }
     });
     let parsed = null;
     try {
@@ -36,7 +41,10 @@ export function runSksJson(args) {
     return { ...parsed, _process_status: result.status, _stderr_tail: String(result.stderr || '').slice(-600) };
 }
 export function runPptReview(action = 'review') {
-    const json = runSksJson(['ppt', 'fixture', '--mock', '--json']);
+    const json = runHermeticRouteFixture('ppt', ['ppt', 'fixture', '--mock', '--json'], {
+        SKS_TEST_FAKE_IMAGEGEN: '1',
+        SKS_TEST_FAKE_EXTRACTOR: '1'
+    });
     const proof = readMissionJson(json.mission_id, 'completion-proof.json');
     const review = json.artifacts || json.imagegen_review || {};
     json.proof_evidence = proof.evidence?.ppt_review || json.artifacts?.proof_evidence || {};
@@ -54,7 +62,7 @@ export function runPptReview(action = 'review') {
     return json;
 }
 export function runDfixFixture() {
-    const json = runSksJson(['dfix', 'fixture', '--json']);
+    const json = runHermeticRouteFixture('dfix', ['dfix', 'fixture', '--json']);
     json.gate = json.gate || json.artifacts?.gate;
     assertGate(json.ok === true, 'dfix fixture blocked', json);
     assertGate(json.gate?.passed === true, 'dfix gate did not pass', json.gate);
@@ -66,7 +74,8 @@ export function runUxFixture() {
     return json;
 }
 export function missionFile(missionId, file) {
-    return path.join(root, '.sneakoscope', 'missions', missionId, file);
+    const missionRoot = fixtureMissionRoots.get(missionId) || root;
+    return path.join(missionRoot, '.sneakoscope', 'missions', missionId, file);
 }
 export function readMissionJson(missionId, file) {
     const absolute = missionFile(missionId, file);
@@ -77,4 +86,42 @@ export function hasRelationType(missionId, type) {
     const ledger = readMissionJson(missionId, 'image-voxel-ledger.json');
     return (ledger.relations || []).some((relation) => relation.type === type);
 }
+function createHermeticRouteFixtureRoot(label) {
+    const fixtureRoot = tmpdir(`${label}-release-fixture-`);
+    fs.writeFileSync(path.join(fixtureRoot, 'package.json'), `${JSON.stringify({ name: `sks-${label}-release-fixture`, private: true })}\n`);
+    fixtureRoots.add(fixtureRoot);
+    if (!fixtureCleanupRegistered) {
+        fixtureCleanupRegistered = true;
+        process.once('exit', () => {
+            for (const candidate of fixtureRoots)
+                fs.rmSync(candidate, { recursive: true, force: true });
+        });
+    }
+    return fixtureRoot;
+}
+function runHermeticRouteFixture(label, args, env = {}) {
+    const fixtureRoot = createHermeticRouteFixtureRoot(label);
+    const fixtureHome = path.join(fixtureRoot, 'home');
+    const json = runSksJson(args, {
+        cwd: fixtureRoot,
+        env: {
+            HOME: fixtureHome,
+            CODEX_HOME: path.join(fixtureHome, '.codex'),
+            SKS_GLOBAL_ROOT: path.join(fixtureHome, '.sneakoscope-global'),
+            TMPDIR: fixtureRoot,
+            TMP: fixtureRoot,
+            TEMP: fixtureRoot,
+            PWD: fixtureRoot,
+            SKS_TEST_ISOLATION: '1',
+            SKS_UPDATE_MIGRATION_GATE_DISABLED: '1',
+            NODE_ENV: 'test',
+            CI: 'true',
+            ...env
+        }
+    });
+    if (json.mission_id)
+        fixtureMissionRoots.set(json.mission_id, fixtureRoot);
+    json.fixture_root = fixtureRoot;
+    return json;
+}
 //# sourceMappingURL=sks-1-11-gate-lib.js.map

package/dist/scripts/sks-menubar-install-check.js

@@ -126,6 +126,11 @@ const hasActionFallbacks = actionScript.includes('command -v sks')
     && actionScript.includes('/bin/zsh -lc')
     && actionScript.includes('exit 127')
     && actionScript.includes('display notification');
+const pinnedEntryIndex = actionScript.indexOf('run_node_entry "$SKS_ENTRY" "$@"');
+const hasPinnedEntryPriority = pinnedEntryIndex >= 0
+    && pinnedEntryIndex < actionScript.indexOf('command -v sks')
+    && pinnedEntryIndex < actionScript.indexOf('npm root -g')
+    && actionScript.lastIndexOf('run_node_entry "$SKS_ENTRY" "$@"') === pinnedEntryIndex;
 const hasEntryWarning = result.warnings.includes('sks_entry_project_local');
 const hasBuildStamp = buildStampExists
     && result.build_stamp?.package_version === PACKAGE_VERSION
@@ -203,6 +208,7 @@ const darwinOk = cltMissing
         && hasInteractiveProcessType
         && hasPackagePlistVersion
         && hasActionFallbacks
+        && hasPinnedEntryPriority
         && hasEntryWarning
         && hasBuildStamp
         && swiftParse.ok === true
@@ -249,6 +255,7 @@ const report = {
     has_interactive_process_type: hasInteractiveProcessType,
     has_package_plist_version: hasPackagePlistVersion,
     has_action_fallbacks: hasActionFallbacks,
+    has_pinned_entry_priority: hasPinnedEntryPriority,
     has_entry_warning: hasEntryWarning,
     has_build_stamp: hasBuildStamp,
     swift_parse: swiftParse,

package/dist/scripts/sks-uninstall-regression-check.js

@@ -17,7 +17,7 @@ await writeText(path.join(home, '.codex', 'config.toml'), [
     'default_profile = "sks-fast-high"',
     'service_tier = "fast"',
     '[profiles.sks-fast-high]',
-    'model = "gpt-5.5"',
+    'model = "gpt-5.6-terra"',
     '[user.fast_mode]',
     'enabled = true',
     '[mcp_servers.user]',

package/dist/scripts/sksd-daemon-check.js

@@ -1,9 +1,19 @@
 // @ts-nocheck
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/daemon/sksd-client.js');
-const state = mod.runSksdClient(root, 'status');
-const start = mod.runSksdClient(root, 'start');
-assertGate(state.schema === 'sks.sksd-state.v1', 'sksd status schema mismatch', state);
-assertGate(start.protocol_ok === true && start.status === 'running', 'sksd start must record protocol-ready state', start);
-emitGate('sksd:daemon', { status: start.status });
+const fixtureRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-sksd-daemon-check-'));
+try {
+    const state = mod.runSksdClient(fixtureRoot, 'status');
+    const start = mod.runSksdClient(fixtureRoot, 'start');
+    assertGate(state.schema === 'sks.sksd-state.v1', 'sksd status schema mismatch', state);
+    assertGate(start.protocol_ok === true && start.status === 'running', 'sksd start must record protocol-ready state', start);
+    assertGate(start.build_proof_ready === false, 'hermetic sksd protocol fixture must not build or mutate the source checkout', start);
+    emitGate('sksd:daemon', { status: start.status, hermetic_fixture: true, build_started: false });
+}
+finally {
+    await fs.rm(fixtureRoot, { recursive: true, force: true });
+}
 //# sourceMappingURL=sksd-daemon-check.js.map

package/dist/scripts/update-default-command-check.js

@@ -12,7 +12,9 @@ const routes = fs.readFileSync('src/core/routes.ts', 'utf8');
 assertGate(registry.includes("subcommand(() => import(basicModule), 'updateCommand', 'dist/core/commands/basic-cli.js', 'now')"), 'bare sks update must default to update now');
 assertGate(basicCli.includes("export async function updateCommand(sub: any = 'now'"), 'updateCommand default must be now');
 assertGate(basicCli.includes("action.startsWith('-')") && basicCli.includes('effectiveArgs = [String(sub), ...args]'), 'sks update --json/--dry-run must be treated as update now with flags');
-assertGate(update.includes('installSksMenuBar') && update.includes('sks_menubar'), 'update now must refresh the SKS menu bar companion stage');
+assertGate(update.includes("[entrypoint, 'menubar', 'install', '--json']")
+    && update.includes('entrypoint: newBinary')
+    && update.includes('sks_menubar'), 'update now must refresh the SKS menu bar through the updated package-local entrypoint');
 assertGate(routes.includes('sks update [check|now]'), 'command catalog must document bare sks update as the default update path');
 console.log(JSON.stringify({
     schema: 'sks.update-default-command-check.v1',
@@ -21,7 +23,7 @@ console.log(JSON.stringify({
         'registry_default_now',
         'basic_cli_default_now',
         'flag_first_default_now',
-        'update_menubar_stage',
+        'updated_package_local_menubar_stage',
         'command_catalog_usage'
     ]
 }, null, 2));

package/dist/scripts/write-build-manifest.js

@@ -5,6 +5,7 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { writeTextAtomic } from '../core/fsx.js';
 import { writeDistFreshStamp, sourceSnapshot } from './lib/ensure-dist-fresh.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
@@ -22,7 +23,7 @@ const compiledDtsCount = sorted.filter((f) => f.endsWith('.d.ts')).length;
 const source = sourceSnapshot();
 const distStamp = writeDistFreshStamp();
 const srcMjsRuntimeFiles = await collectSrcMjsRuntimeFiles();
-await fsp.writeFile(path.join(distRoot, 'build-manifest.json'), `${JSON.stringify({
+await writeTextAtomic(path.join(distRoot, 'build-manifest.json'), `${JSON.stringify({
     schema: 'sks.dist-build.v2',
     version: pkg.version,
     package_version: pkg.version,

package/dist/scripts/zellij-layout-valid-check.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // @ts-nocheck
 import fs from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -55,19 +56,27 @@ const layoutPath = path.join(tmp, 'layout.kdl');
 await fs.writeFile(layoutPath, built.layout_kdl, 'utf8');
 const requireReal = process.env.SKS_REQUIRE_ZELLIJ === '1' || process.argv.includes('--require-real');
 const capability = await capabilityMod.checkZellijCapability({ root, require: requireReal, writeReport: true });
-const sessionName = 'sks-layout-check';
-if (capability.status === 'ok')
-    await commandMod.runZellij(['kill-session', sessionName], { cwd: root, timeoutMs: 2500, optional: true });
+const runId = `${process.pid}-${Date.now().toString(36)}-${randomBytes(3).toString('hex')}`;
+const sessionName = `sks-layout-check-${runId}`;
+const socketDir = path.join('/tmp', `sks-zj-layout-${runId}`);
+const zellijEnv = { ZELLIJ_SOCKET_DIR: socketDir };
 const realRun = capability.status === 'ok'
     ? {
-        create_background: await commandMod.runZellij(['attach', '--create-background', sessionName, 'options', '--default-layout', layoutPath], { cwd: root, timeoutMs: 5000, optional: !requireReal }),
+        create_background: await commandMod.runZellij(['attach', '--create-background', sessionName, 'options', '--default-layout', layoutPath], { cwd: root, env: zellijEnv, timeoutMs: 5000, optional: !requireReal }),
         cleanup: null,
+        session_removed: false,
+        socket_dir_removed: false,
         ok: false
     }
     : null;
 if (realRun) {
-    realRun.cleanup = await commandMod.runZellij(['kill-session', sessionName], { cwd: root, timeoutMs: 5000, optional: true });
-    realRun.ok = realRun.create_background.ok === true;
+    realRun.cleanup = await commandMod.runZellij(['kill-session', sessionName], { cwd: root, env: zellijEnv, timeoutMs: 5000, optional: true });
+    const remaining = await waitForSocketEntriesToClear(socketDir, 2000);
+    realRun.session_removed = !remaining.includes(sessionName);
+    if (remaining.length === 0)
+        await fs.rm(socketDir, { recursive: true, force: true });
+    realRun.socket_dir_removed = !(await exists(socketDir));
+    realRun.ok = realRun.create_background.ok === true && realRun.session_removed && realRun.socket_dir_removed;
 }
 const ok = staticValidation.ok
     && viewportLayoutOk
@@ -77,6 +86,7 @@ const ok = staticValidation.ok
     && invalidValidation.ok === false
     && capability.ok
     && (requireReal ? realRun?.ok === true : true);
+await fs.rm(tmp, { recursive: true, force: true });
 emit({
     schema: 'sks.zellij-layout-valid-check.v1',
     ok,
@@ -88,10 +98,25 @@ emit({
     invalid_fixture: invalidValidation,
     capability,
     real_run: realRun,
+    isolated_session: true,
+    socket_dir: socketDir,
+    temporary_layout_removed: !(await exists(tmp)),
     integration_optional: !requireReal,
     blockers: ok ? [] : ['zellij_layout_valid_check_failed']
 });
 function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
     process.exitCode = 1; }
 function fail(blocker, detail) { emit({ schema: 'sks.zellij-layout-valid-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
+async function waitForSocketEntriesToClear(socketDir, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const entries = await fs.readdir(path.join(socketDir, 'contract_version_1')).catch(() => []);
+        if (entries.length === 0 || Date.now() >= deadline)
+            return entries;
+        await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+}
+async function exists(value) {
+    return fs.access(value).then(() => true).catch(() => false);
+}
 //# sourceMappingURL=zellij-layout-valid-check.js.map

package/dist/scripts/zellij-pane-proof-check.js

@@ -42,13 +42,44 @@ const codexLbOnlyMain = mod.evaluateZellijPaneProofRows(mod.normalizeZellijPaneR
     { pane_id: '1', name: 'orchestrator', command: 'sh -lc model_provider="codex-lb"', cwd: root, exited: false },
     { pane_id: '2', name: 'slot-001', command: 'sks zellij-lane --mission M --slot slot-001', cwd: root, exited: false }
 ]), { expectedLaneCount: 1, expectedCwd: root, expectedMainCommandIncludes: 'codex' });
+const zellij044Rows = [
+    ...Array.from({ length: 120 }, (_, index) => ({
+        id: index + 10,
+        is_plugin: true,
+        title: `zellij:fixture-${String(index).padStart(3, '0')}`,
+        terminal_command: null,
+        plugin_url: 'zellij:fixture',
+        tab_name: 'SKS fixture'
+    })),
+    {
+        id: 0,
+        is_plugin: false,
+        title: 'orchestrator',
+        exited: false,
+        exit_status: null,
+        pane_x: 0,
+        pane_y: 1,
+        pane_columns: 80,
+        pane_rows: 24,
+        terminal_command: "sh -lc exec 'codex' '--no-alt-screen'",
+        pane_command: `${path.join(root, 'node_modules', '.bin', 'codex')} --no-alt-screen`,
+        pane_cwd: root,
+        tab_name: 'SKS fixture'
+    }
+];
+const zellij044Json = JSON.stringify(zellij044Rows);
+const zellij044Parsed = mod.parseZellijPaneRows(zellij044Json);
+const zellij044Evaluation = mod.evaluateZellijPaneProofRows(mod.normalizeZellijPaneRows(zellij044Parsed), { expectedLaneCount: 0, expectedCwd: root, expectedMainCommandIncludes: 'codex' });
 const fixtureOk = positive.blockers.length === 0
     && missingLane.blockers.includes('zellij_lane_pane_missing')
     && exitedLane.blockers.some((blocker) => blocker.startsWith('zellij_lane_pane_exited'))
     && madCodexMain.blockers.length === 0
     && madShellMain.blockers.includes('zellij_main_pane_unexpected_command:codex')
-    && codexLbOnlyMain.blockers.includes('zellij_main_pane_unexpected_command:codex');
-emit({ ...report, fixture_ok: fixtureOk, fixture_results: { positive, missingLane, exitedLane, madCodexMain, madShellMain, codexLbOnlyMain }, ok: report.ok && fixtureOk });
+    && codexLbOnlyMain.blockers.includes('zellij_main_pane_unexpected_command:codex')
+    && zellij044Json.length > 8192
+    && zellij044Parsed.length === zellij044Rows.length
+    && zellij044Evaluation.blockers.length === 0;
+emit({ ...report, fixture_ok: fixtureOk, fixture_results: { positive, missingLane, exitedLane, madCodexMain, madShellMain, codexLbOnlyMain, zellij044: { json_bytes: Buffer.byteLength(zellij044Json), parsed_rows: zellij044Parsed.length, evaluation: zellij044Evaluation } }, ok: report.ok && fixtureOk });
 function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
     process.exitCode = 1; }
 function fail(blocker, detail) { emit({ schema: 'sks.zellij-pane-proof-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }

package/dist/scripts/zellij-real-session-cleanup-check.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 // @ts-nocheck
+import fs from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
@@ -7,10 +9,96 @@ const freshness = ensureDistFresh({ rebuild: false });
 if (!freshness.ok)
     fail('dist_not_fresh', { freshness });
 const args = process.argv.slice(2);
+const missionId = readArg(args, '--mission');
 const sessionName = readArg(args, '--session') || 'sks-real';
+const socketDir = readArg(args, '--owned-socket-dir');
+const ownerToken = String(process.env.SKS_ZELLIJ_CHECK_OWNER_TOKEN || '');
 const command = await import(pathToFileURL(path.join(root, 'dist', 'core', 'zellij', 'zellij-command.js')).href);
-const result = await command.runZellij(['kill-session', sessionName], { cwd: root, timeoutMs: 5000, optional: true });
-emit({ schema: 'sks.zellij-real-session-cleanup-check.v1', ok: result.ok === true || result.exit_code !== 0, session_name: sessionName, result });
+const ownershipPath = missionId ? path.join(root, '.sneakoscope', 'missions', missionId, 'zellij-real-session-ownership.json') : null;
+const expectedLayoutPath = missionId ? path.join(root, '.sneakoscope', 'layouts', `mad-${missionId}.kdl`) : null;
+const ownership = ownershipPath ? await readJson(ownershipPath) : null;
+const ownershipBlockers = [
+    ...(!missionId ? ['zellij_cleanup_mission_missing'] : []),
+    ...(!isSafeOwnedSocketDir(socketDir) ? ['zellij_cleanup_owned_socket_dir_invalid'] : []),
+    ...(ownerToken.length < 32 ? ['zellij_cleanup_owner_token_missing'] : []),
+    ...(!ownership ? ['zellij_cleanup_ownership_marker_missing'] : []),
+    ...(ownership && ownership.schema !== 'sks.zellij-real-session-ownership.v1' ? ['zellij_cleanup_ownership_schema_invalid'] : []),
+    ...(ownership && ownership.mission_id !== missionId ? ['zellij_cleanup_mission_mismatch'] : []),
+    ...(ownership && ownership.session_name !== sessionName ? ['zellij_cleanup_session_mismatch'] : []),
+    ...(ownership && path.resolve(String(ownership.socket_dir || '')) !== path.resolve(String(socketDir || '')) ? ['zellij_cleanup_socket_dir_mismatch'] : []),
+    ...(ownership && ownership.owner_token_sha256 !== hashOwnerToken(ownerToken) ? ['zellij_cleanup_owner_token_mismatch'] : []),
+    ...(ownership && ownership.cleanup_authorized !== true ? ['zellij_cleanup_not_authorized'] : []),
+    ...(ownership && ownership.layout_cleanup_authorized !== true ? ['zellij_cleanup_layout_not_authorized'] : []),
+    ...(ownership && path.resolve(String(ownership.layout_path || '')) !== path.resolve(String(expectedLayoutPath || '')) ? ['zellij_cleanup_layout_path_mismatch'] : [])
+];
+if (ownershipBlockers.length > 0) {
+    emit({
+        schema: 'sks.zellij-real-session-cleanup-check.v1',
+        ok: false,
+        mutation_attempted: false,
+        mission_id: missionId,
+        session_name: sessionName,
+        socket_dir: socketDir,
+        ownership_path: ownershipPath,
+        blockers: ownershipBlockers
+    });
+}
+else {
+    const beforeEntries = await socketEntries(socketDir);
+    const result = await command.runZellij(['kill-session', sessionName], {
+        cwd: root,
+        env: { ZELLIJ_SOCKET_DIR: socketDir },
+        timeoutMs: 5000,
+        optional: true
+    });
+    const remainingEntries = await waitForSocketEntriesToClear(socketDir, 2000);
+    const sessionRemoved = !remainingEntries.includes(sessionName);
+    const socketExclusive = remainingEntries.length === 0;
+    const layoutPresentBefore = await exists(expectedLayoutPath);
+    const layoutSha256Before = layoutPresentBefore ? await sha256File(expectedLayoutPath) : null;
+    const layoutHashMatches = !layoutPresentBefore || !ownership.layout_sha256 || layoutSha256Before === ownership.layout_sha256;
+    let socketDirRemoved = false;
+    let layoutRemoved = false;
+    if (sessionRemoved && socketExclusive) {
+        await fs.rm(socketDir, { recursive: true, force: true });
+        socketDirRemoved = !(await exists(socketDir));
+        if (socketDirRemoved && layoutHashMatches) {
+            await fs.rm(expectedLayoutPath, { force: true });
+            layoutRemoved = !(await exists(expectedLayoutPath));
+        }
+    }
+    const blockers = [
+        ...(!sessionRemoved ? ['zellij_cleanup_session_still_present'] : []),
+        ...(!socketExclusive ? ['zellij_cleanup_owned_socket_dir_not_empty'] : []),
+        ...(!socketDirRemoved ? ['zellij_cleanup_socket_dir_not_removed'] : []),
+        ...(!layoutHashMatches ? ['zellij_cleanup_layout_hash_mismatch'] : []),
+        ...(!layoutRemoved ? ['zellij_cleanup_layout_not_removed'] : [])
+    ];
+    const report = {
+        schema: 'sks.zellij-real-session-cleanup-check.v1',
+        ok: blockers.length === 0,
+        mutation_attempted: true,
+        mission_id: missionId,
+        session_name: sessionName,
+        socket_dir: socketDir,
+        ownership_path: ownershipPath,
+        session_present_before: beforeEntries.includes(sessionName),
+        session_removed: sessionRemoved,
+        socket_dir_exclusive: socketExclusive,
+        socket_dir_removed: socketDirRemoved,
+        layout_path: expectedLayoutPath,
+        layout_sha256: ownership.layout_sha256 || null,
+        layout_sha256_before_cleanup: layoutSha256Before,
+        layout_hash_matches: layoutHashMatches,
+        layout_removed: layoutRemoved,
+        remaining_socket_entries: remainingEntries,
+        result,
+        blockers,
+        warnings: result.ok ? [] : ['zellij_kill_session_nonzero_but_absence_verified']
+    };
+    await fs.writeFile(path.join(root, '.sneakoscope', 'missions', missionId, 'zellij-real-session-cleanup.json'), `${JSON.stringify(report, null, 2)}\n`);
+    emit(report);
+}
 function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
     process.exitCode = 1; }
 function fail(blocker, detail) { emit({ schema: 'sks.zellij-real-session-cleanup-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
@@ -18,4 +106,36 @@ function readArg(args, name) {
     const index = args.indexOf(name);
     return index >= 0 ? args[index + 1] || null : null;
 }
+function hashOwnerToken(value) {
+    return createHash('sha256').update(String(value)).digest('hex');
+}
+async function sha256File(file) {
+    return fs.readFile(file).then((data) => createHash('sha256').update(data).digest('hex')).catch(() => null);
+}
+function isSafeOwnedSocketDir(value) {
+    if (!value)
+        return false;
+    const resolved = path.resolve(String(value));
+    return path.dirname(resolved) === '/tmp' && /^sks-zj-rr-[A-Za-z0-9-]+$/.test(path.basename(resolved));
+}
+async function readJson(file) {
+    return fs.readFile(file, 'utf8').then((text) => JSON.parse(text)).catch(() => null);
+}
+async function socketEntries(socketDir) {
+    if (!socketDir)
+        return [];
+    return fs.readdir(path.join(socketDir, 'contract_version_1')).catch(() => []);
+}
+async function waitForSocketEntriesToClear(socketDir, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const entries = await socketEntries(socketDir);
+        if (entries.length === 0 || Date.now() >= deadline)
+            return entries;
+        await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+}
+async function exists(value) {
+    return fs.access(value).then(() => true).catch(() => false);
+}
 //# sourceMappingURL=zellij-real-session-cleanup-check.js.map