sneakoscope 6.0.3 → 6.1.2

package/dist/scripts/agent-role-config-repair-check.js

@@ -3,39 +3,58 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { parse } from 'smol-toml';
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/agents/agent-role-config.js');
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-role-repair-'));
 fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
 const plan = await mod.repairAgentRoleConfigs({ root, apply: false, codexHome: path.join(root, 'codex-home') });
 const repair = await mod.repairAgentRoleConfigs({ root, apply: true, codexHome: path.join(root, 'codex-home'), reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json') });
-const analysisScout = path.join(root, '.codex', 'agents', 'analysis-scout.toml');
+const workerFile = path.join(root, '.codex', 'agents', 'worker.toml');
+const expertFile = path.join(root, '.codex', 'agents', 'expert.toml');
 const staleRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-role-stale-'));
 fs.mkdirSync(path.join(staleRoot, '.codex', 'agents'), { recursive: true });
-fs.writeFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'model = "gpt-5-codex"\nsandbox_mode = "read-only"\n');
+const staleManagedText = [
+    '# SKS-MANAGED-ASSET',
+    '# sks_managed_schema = 1',
+    '# sks_managed_id = "sks-explorer"',
+    '# sks_managed_version = "4.8.1"',
+    'name = "analysis_scout"',
+    'description = "SKS stale managed role"',
+    'sandbox_mode = "workspace-write"',
+    'permission_profile = "sks-workspace-write"',
+    'legacy_sandbox_projection = "workspace-write"',
+    'developer_instructions = """',
+    'SKS stale role',
+    '"""',
+    ''
+].join('\n');
+fs.writeFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), staleManagedText);
 const stalePlan = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: false, codexHome: path.join(staleRoot, 'codex-home') });
 const staleRepair = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: true, codexHome: path.join(staleRoot, 'codex-home') });
-const repairedText = fs.readFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'utf8');
-const createdText = fs.readFileSync(analysisScout, 'utf8');
+const preservedText = fs.readFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'utf8');
+const createdText = fs.readFileSync(workerFile, 'utf8');
+const createdParsed = parse(createdText);
 const globalRole = path.join(root, 'codex-home', 'agents', 'analysis-scout.toml');
 fs.mkdirSync(path.dirname(globalRole), { recursive: true });
-fs.writeFileSync(globalRole, 'name = "analysis_scout"\ndescription = "SKS stale global role"\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "low"\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nSKS role\n"""\n');
+fs.writeFileSync(globalRole, 'name = "analysis_scout"\ndescription = "SKS stale global role"\nmodel = "gpt-5.6-terra"\nmodel_reasoning_effort = "low"\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nSKS role\n"""\n');
 const globalRepair = await mod.repairAgentRoleConfigs({ root, apply: true, codexHome: path.join(root, 'codex-home') });
-const globalRepairedText = fs.readFileSync(globalRole, 'utf8');
+const globalPreservedText = fs.readFileSync(globalRole, 'utf8');
 const report = {
     schema: 'sks.agent-role-config-repair-check.v1',
-    plan_ok: plan.ok === true && plan.missing.includes('analysis-scout.toml'),
+    plan_ok: plan.ok === true && plan.missing.includes('worker.toml') && plan.missing.includes('expert.toml') && !plan.missing.includes('analysis-scout.toml'),
     repair_ok: repair.ok === true,
-    analysis_scout_created: fs.existsSync(analysisScout),
-    created_inherits_model: !/^(?:model|model_reasoning_effort)\s*=/m.test(createdText),
-    created_write_capable: createdText.includes('sandbox_mode = "workspace-write"') && !createdText.includes('Do not edit files.'),
-    stale_detected: stalePlan.stale.includes('analysis-scout.toml'),
-    stale_repaired: staleRepair.repaired.includes('.codex/agents/analysis-scout.toml') && repairedText.includes('name = "analysis_scout"') && !/^(?:model|model_reasoning_effort)\s*=/m.test(repairedText) && repairedText.includes('sandbox_mode = "workspace-write"'),
-    global_stale_repaired_with_valid_project_copy: globalRepair.repaired.some((file) => file.endsWith('codex-home/agents/analysis-scout.toml')) && !/^(?:model|model_reasoning_effort)\s*=/m.test(globalRepairedText),
+    official_agents_created: fs.existsSync(workerFile) && fs.existsSync(expertFile),
+    managed_body_hash_present: createdText.includes('# SKS-MANAGED-OFFICIAL-SUBAGENT') && /sks_managed_body_sha256 = "[a-f0-9]{64}"/.test(createdText),
+    generated_toml_parses: createdParsed.name === 'worker' && createdParsed.model === 'gpt-5.6-luna' && createdParsed.model_reasoning_effort === 'max',
+    generated_toml_uses_supported_keys: !Object.hasOwn(createdParsed, 'permission_profile') && !Object.hasOwn(createdParsed, 'legacy_sandbox_projection'),
+    generated_inherits_parent_sandbox: !Object.hasOwn(createdParsed, 'sandbox_mode'),
+    legacy_preserved: !stalePlan.stale.includes('analysis-scout.toml') && !staleRepair.repaired.includes('.codex/agents/analysis-scout.toml') && preservedText === staleManagedText,
+    global_legacy_preserved: !globalRepair.repaired.some((file) => file.endsWith('codex-home/agents/analysis-scout.toml')) && globalPreservedText.includes('model = "gpt-5.6-terra"'),
     warnings_suppressed: repair.warnings_suppressed === true,
     artifact_written: fs.existsSync(path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json'))
 };
-const ok = report.plan_ok && report.repair_ok && report.analysis_scout_created && report.created_inherits_model && report.created_write_capable && report.stale_detected && report.stale_repaired && report.global_stale_repaired_with_valid_project_copy && report.warnings_suppressed && report.artifact_written;
-assertGate(ok, 'doctor --fix must repair missing SKS-owned agent role configs', report);
+const ok = report.plan_ok && report.repair_ok && report.official_agents_created && report.managed_body_hash_present && report.generated_toml_parses && report.generated_toml_uses_supported_keys && report.generated_inherits_parent_sandbox && report.legacy_preserved && report.global_legacy_preserved && report.warnings_suppressed && report.artifact_written;
+assertGate(ok, 'doctor --fix must create only official worker/expert configs and preserve legacy role TOMLs', report);
 emitGate('agent:role-config-repair', report);
 //# sourceMappingURL=agent-role-config-repair-check.js.map

package/dist/scripts/agent-wiki-context-proof-check.js

@@ -10,6 +10,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { assertGate, emitGate, importDist, readText, root } from './sks-1-18-gate-lib.js';
 const triwiki = await importDist('core/triwiki-runtime.js');
+const coordinates = await importDist('core/wiki-coordinate.js');
 const { loadTriWikiRuntimeContext, triWikiProofRecord, writeTriWikiContextArtifact } = triwiki;
 // 1) Absent pack -> graceful fallback (present:false, warning, not consulted).
 const emptyRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-triwiki-empty-'));
@@ -22,10 +23,23 @@ assertGate(triWikiProofRecord(emptyCtx).triwiki_context_consulted === false, 'ab
 const packRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-triwiki-pack-'));
 const packDir = path.join(packRoot, '.sneakoscope', 'wiki');
 fs.mkdirSync(packDir, { recursive: true });
+const wiki = coordinates.compactWikiCoordinateIndex(coordinates.buildWikiCoordinateIndex({
+    mission: { id: 'project-wiki', coord: { rgba: [48, 132, 212, 240] } },
+    claims: [
+        { id: 'claim-a', text: 'claim a', status: 'supported', freshness: 'fresh', risk: 'low', trust_score: 0.95 },
+        { id: 'claim-b', text: 'claim b', status: 'weak', freshness: 'unknown', risk: 'high', trust_score: 0.5 }
+    ],
+    maxAnchors: 2
+}));
+const anchorById = new Map(wiki.a.map((row) => [row[0], row]));
 const pack = {
     mission: 'project-wiki',
-    attention: { mode: 'aggressive_triwiki_active_recall', use_first: [['claim-a', [48, 132, 212, 240], 'h1']], hydrate_first: [['claim-b', 'risk:high']] },
-    wiki: { a: [['claim-a'], ['claim-b']] },
+    attention: {
+        mode: 'aggressive_triwiki_active_recall',
+        use_first: [['claim-a', anchorById.get('claim-a')?.[1], anchorById.get('claim-a')?.[7]]],
+        hydrate_first: [['claim-b', 'risk:high']]
+    },
+    wiki,
     claims: [{ id: 'claim-a' }, { id: 'claim-b' }],
     trust_summary: { avg: 0.71 }
 };

package/dist/scripts/all-feature-deep-completion-check.js

@@ -1,19 +1,29 @@
 #!/usr/bin/env node
 // @ts-nocheck
-import { assertGate, emitGate, requireContains, requirePackageScripts, runSksJson } from './sks-1-12-real-execution-check-lib.js';
-const requiredScripts = [
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, requireContains, root, runSksJson } from './sks-1-12-real-execution-check-lib.js';
+const requiredGates = [
     'ux-review:run-wires-imagegen',
     'ux-review:extract-wires-real-extractor',
     'ux-review:patch-diff-recheck',
+    'ux-review:imagegen-blackbox',
     'ppt:real-export-adapter',
     'ppt:real-imagegen-wiring',
     'ppt:reexport-rereview',
+    'ppt:full-e2e-blackbox',
     'dfix:patch-handoff',
     'dfix:verification-recommendation',
+    'dfix:fixture',
+    'dfix:verification',
     'all-features:deep-completion',
-    'evidence:flagship-coverage'
+    'evidence:flagship-coverage',
+    'schema:check'
 ];
-requirePackageScripts('all-features:deep-completion', requiredScripts);
+const releaseManifest = JSON.parse(fs.readFileSync(path.join(root, 'release-gates.v2.json'), 'utf8'));
+const releaseGateIds = new Set((releaseManifest.gates || []).map((gate) => String(gate.id || '')));
+const missingGates = requiredGates.filter((id) => !releaseGateIds.has(id));
+assertGate(missingGates.length === 0, 'all-features:deep-completion release gates missing', { missing: missingGates });
 requireContains('all-features:deep-completion', 'src/core/feature-registry.ts', [
     'command_registry',
     'evidence_router',

package/dist/scripts/architecture-guard-check.js

@@ -21,7 +21,13 @@ function assertScript(name, expected) {
         issues.push(`package script ${name} must include ${expected}`);
 }
 const pkg = readJson('package.json');
+const releaseManifest = readJson('release-gates.v2.json');
+const releaseGateIds = new Set((Array.isArray(releaseManifest?.gates) ? releaseManifest.gates : [])
+    .filter((gate) => Array.isArray(gate?.preset) && gate.preset.includes('release'))
+    .map((gate) => String(gate.id || '')));
 assertScript('architecture:guard', 'node ./dist/scripts/architecture-guard-check.js');
+if (!releaseGateIds.has('architecture:guard'))
+    issues.push('release-gates.v2.json release preset missing architecture:guard');
 assertIncludes('src/core/safety/ssot-guard.ts', 'solid_principles');
 assertIncludes('src/core/safety/ssot-guard.ts', 'single_responsibility');
 assertIncludes('src/core/safety/ssot-guard.ts', 'open_closed');
@@ -34,7 +40,8 @@ assertIncludes('src/core/pipeline-internals/runtime-core.ts', 'ssotGuardPolicyTe
 assertIncludes('src/core/pipeline-internals/runtime-gates.ts', 'validateSsotGuardArtifact');
 assertIncludes('src/core/pipeline-internals/runtime-gates.ts', "'ssot_guard'");
 assertIncludes('src/core/commands/team-command.ts', 'SSOT_GUARD_ARTIFACT');
-assertIncludes('src/scripts/release-parallel-check.ts', "task('architecture:guard'");
+assertIncludes('src/scripts/release-parallel-check.ts', 'release-gate-dag-runner.js');
+assertIncludes('src/scripts/release-parallel-check.ts', "'--preset', 'release', '--full'");
 assertIncludes('src/core/release/gate-manifest.ts', "'architecture:guard'");
 assertIncludes('src/core/release/gate-manifest.ts', "'architecture:'");
 assertIncludes('docs/architecture-ts-rust-boundary.md', '`architecture:guard`');

package/dist/scripts/build-dist.js

@@ -4,6 +4,7 @@ import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { writeTextAtomic } from '../core/fsx.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const srcRoot = path.join(root, 'src');
 const distRoot = path.join(root, 'dist');
@@ -54,17 +55,20 @@ async function writeSkillsManifest() {
     const manifest = await generatePackagedSkillsManifest();
     const out = path.join(distRoot, 'config', 'skills-manifest.json');
     await fsp.mkdir(path.dirname(out), { recursive: true });
-    await fsp.writeFile(out, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+    await writeTextAtomic(out, `${JSON.stringify(manifest, null, 2)}\n`);
 }
 async function writeCommonJsBinScope() {
     const binDir = path.join(distRoot, 'bin');
     if (!fs.existsSync(binDir))
         return;
-    await fsp.writeFile(path.join(binDir, 'package.json'), '{"type":"commonjs"}\n', 'utf8');
+    await writeTextAtomic(path.join(binDir, 'package.json'), '{"type":"commonjs"}\n');
     await rewriteIfPresent(path.join(binDir, 'sks.js'), (text) => stripSourceMap(text)
         .replace(/^import \{ PACKAGE_VERSION \} from '\.\.\/core\/version\.js';$/m, "const { PACKAGE_VERSION } = require('../core/version.js');")
         .replace(/\nexport \{\};\n?/, '\n'));
-    await rewriteIfPresent(path.join(binDir, 'sks-dispatch.js'), (text) => `${stripSourceMap(text).replace(/^export async function runSks/m, 'async function runSks')}\nexports.runSks = runSks;\n`);
+    await rewriteIfPresent(path.join(binDir, 'sks-dispatch.js'), (text) => {
+        const next = stripGeneratedCommonJsExports(stripSourceMap(text).replace(/^export async function runSks/m, 'async function runSks'), ['runSks']);
+        return `${next}\n\nexports.runSks = runSks;\n`;
+    });
     await rewriteIfPresent(path.join(binDir, 'fast-inline.js'), (text) => {
         const names = [
             'rootJsonFastInline',
@@ -76,7 +80,8 @@ async function writeCommonJsBinScope() {
         for (const name of names) {
             next = next.replace(new RegExp(`^export (async )?function ${name}`, 'm'), '$1function ' + name);
         }
-        return `${next}\n${names.map((name) => `exports.${name} = ${name};`).join('\n')}\n`;
+        next = stripGeneratedCommonJsExports(next, names);
+        return `${next}\n\n${names.map((name) => `exports.${name} = ${name};`).join('\n')}\n`;
     });
     await rewriteIfPresent(path.join(binDir, 'install.js'), (text) => stripSourceMap(text).replace(/^import \{ spawnSync \} from 'node:child_process';/m, "const { spawnSync } = require('node:child_process');"));
 }
@@ -84,11 +89,18 @@ async function rewriteIfPresent(file, rewrite) {
     if (!fs.existsSync(file))
         return;
     const text = await fsp.readFile(file, 'utf8');
-    await fsp.writeFile(file, rewrite(text), 'utf8');
+    await writeTextAtomic(file, rewrite(text));
 }
 function stripSourceMap(text) {
     return text.replace(/\n\/\/# sourceMappingURL=.*\.map\s*$/s, '\n');
 }
+function stripGeneratedCommonJsExports(text, names) {
+    const escaped = names.map((name) => name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+    return text
+        .replace(new RegExp(`^exports\\.(${escaped}) = \\1;\\s*$`, 'gm'), '')
+        .replace(/\n{3,}/g, '\n\n')
+        .trimEnd();
+}
 async function copyDirIfPresent(from, to) {
     if (!fs.existsSync(from))
         return;

package/dist/scripts/canonical-test-runner.js

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { tmpdir } from '../core/fsx.js';
+const root = process.cwd();
+const compiled = discover(path.join(root, 'dist'), (file) => file.endsWith('.test.js') && file.includes(`${path.sep}__tests__${path.sep}`));
+const unit = discover(path.join(root, 'test', 'unit'), (file) => file.endsWith('.test.mjs'));
+const files = [...compiled, ...unit].sort();
+if (!compiled.length || !unit.length) {
+    console.error(JSON.stringify({
+        schema: 'sks.canonical-test-runner.v1',
+        ok: false,
+        compiled_tests: compiled.length,
+        unit_tests: unit.length,
+        blockers: ['canonical_test_surface_missing']
+    }));
+    process.exit(1);
+}
+const scratch = tmpdir('sks-canonical-test-');
+let cleaned = false;
+let finalized = false;
+const removeScratchSync = () => {
+    if (cleaned)
+        return null;
+    try {
+        fs.rmSync(scratch, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
+        if (!fs.existsSync(scratch)) {
+            cleaned = true;
+            return null;
+        }
+        return new Error(`canonical test scratch still exists after cleanup: ${scratch}`);
+    }
+    catch (error) {
+        return error instanceof Error ? error : new Error(String(error));
+    }
+};
+const cleanup = async () => {
+    if (cleaned)
+        return null;
+    const deadline = Date.now() + 2_000;
+    let lastError = null;
+    do {
+        lastError = removeScratchSync();
+        if (!lastError) {
+            // A just-terminated test descendant can recreate its temp directory a
+            // moment after the first rm. Require a short no-recreation window.
+            await delay(100);
+            if (!fs.existsSync(scratch))
+                return null;
+            cleaned = false;
+            lastError = new Error(`canonical test scratch was recreated during cleanup: ${scratch}`);
+        }
+        await delay(50);
+    } while (Date.now() < deadline);
+    return lastError ?? new Error(`canonical test scratch cleanup timed out: ${scratch}`);
+};
+process.once('exit', () => {
+    const error = removeScratchSync();
+    if (error)
+        console.error(`canonical test cleanup failed during exit: ${error.message}`);
+});
+const isolatedProcessGroup = process.platform !== 'win32';
+const child = spawn(process.execPath, ['--test', '--test-concurrency=1', ...files, ...process.argv.slice(2)], {
+    cwd: root,
+    detached: isolatedProcessGroup,
+    env: {
+        ...process.env,
+        TMPDIR: scratch,
+        TMP: scratch,
+        TEMP: scratch,
+        SKS_TMP_DIR: scratch
+    },
+    stdio: 'inherit'
+});
+child.on('error', (error) => {
+    void finalize(1, null, error);
+});
+child.on('close', (code, signal) => {
+    void finalize(code ?? 1, signal, null);
+});
+const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+const signalExitCodes = { SIGINT: 130, SIGTERM: 143, SIGHUP: 129 };
+let forwardedSignal = null;
+let signalTimer = null;
+const signalHandlers = new Map();
+for (const signal of signals) {
+    const handler = () => {
+        if (forwardedSignal)
+            return;
+        forwardedSignal = signal;
+        signalChildTree(signal);
+        signalTimer = setTimeout(() => {
+            signalChildTree('SIGKILL');
+            void finalize(signalExitCodes[signal], signal, null);
+        }, 5_000);
+    };
+    signalHandlers.set(signal, handler);
+    process.once(signal, handler);
+}
+function removeSignalHandlers() {
+    for (const [signal, handler] of signalHandlers)
+        process.removeListener(signal, handler);
+}
+async function finalize(code, signal, spawnError) {
+    if (finalized)
+        return;
+    finalized = true;
+    if (signalTimer)
+        clearTimeout(signalTimer);
+    await settleChildTree();
+    const cleanupError = await cleanup();
+    removeSignalHandlers();
+    if (spawnError)
+        console.error(`canonical test runner failed: ${spawnError.message}`);
+    if (cleanupError)
+        console.error(`canonical test cleanup failed: ${cleanupError.message}`);
+    if (forwardedSignal)
+        process.kill(process.pid, forwardedSignal);
+    else if (signal)
+        process.kill(process.pid, signal);
+    else
+        process.exitCode = spawnError || cleanupError ? 1 : code;
+}
+function signalChildTree(signal) {
+    if (!child.pid)
+        return;
+    if (isolatedProcessGroup) {
+        try {
+            process.kill(-child.pid, signal);
+            return;
+        }
+        catch { }
+    }
+    try {
+        child.kill(signal);
+    }
+    catch { }
+}
+function childTreeAlive() {
+    if (!isolatedProcessGroup || !child.pid)
+        return false;
+    try {
+        process.kill(-child.pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function settleChildTree() {
+    if (!childTreeAlive())
+        return;
+    signalChildTree('SIGTERM');
+    const termDeadline = Date.now() + 750;
+    while (childTreeAlive() && Date.now() < termDeadline)
+        await delay(25);
+    if (!childTreeAlive())
+        return;
+    signalChildTree('SIGKILL');
+    const killDeadline = Date.now() + 750;
+    while (childTreeAlive() && Date.now() < killDeadline)
+        await delay(25);
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function discover(dir, accept) {
+    const out = [];
+    if (!fs.existsSync(dir))
+        return out;
+    const stack = [dir];
+    while (stack.length) {
+        const current = stack.pop();
+        if (!current)
+            continue;
+        const entries = fs.readdirSync(current, { withFileTypes: true });
+        for (const entry of entries) {
+            const file = path.join(current, entry.name);
+            if (entry.isDirectory())
+                stack.push(file);
+            else if (entry.isFile() && accept(file))
+                out.push(file);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=canonical-test-runner.js.map

package/dist/scripts/check-command-module-budget.js

@@ -5,15 +5,16 @@ import { spawnSync } from 'node:child_process';
 const root = process.cwd();
 const dir = path.join(root, 'src', 'core', 'commands');
 const failures = [];
-const changedFiles = changedFileSet();
+const changeStats = changedFileStats();
 for (const file of fs.readdirSync(dir).filter((name) => name.endsWith('-command.ts'))) {
     const absolute = path.join(dir, file);
     const relPath = rel(absolute);
     const text = fs.readFileSync(absolute, 'utf8');
     const lines = text.split(/\r?\n/).length;
     const imports = [...text.matchAll(/^\s*import\s+/gm)].length;
-    const changed = changedFiles.has(relPath);
-    const baselineLines = baseLineCount(relPath);
+    const change = changeStats.get(relPath);
+    const changed = change !== undefined;
+    const baselineLines = change?.baselineLines ?? (changed ? null : lines);
     if (lines > 1800)
         failures.push(`${file}: line count ${lines} > 1800 hard ceiling`);
     if (baselineLines === null && lines > 400)
@@ -33,21 +34,42 @@ if (failures.length) {
     process.exit(1);
 }
 console.log('Command module budget check passed');
-function changedFileSet() {
-    const out = new Set();
-    for (const line of gitLines(['diff', '--name-only', 'HEAD', '--']))
-        out.add(normalize(line));
-    for (const line of gitLines(['ls-files', '--others', '--exclude-standard']))
-        out.add(normalize(line));
+function changedFileStats() {
+    const out = new Map();
+    const headFiles = new Set(gitLines(['ls-tree', '-r', '--name-only', 'HEAD', '--', 'src/core/commands']));
+    // One numstat process gives us enough information to reconstruct the
+    // baseline line count for every tracked command module. The old per-file
+    // `git show` loop spawned roughly sixty processes and could exceed the
+    // 15-second gate timeout when the canonical test runner was saturated.
+    // Disable rename collapsing so the current destination remains an exact
+    // path. A destination absent from HEAD is conservatively treated as new,
+    // matching the old `git show HEAD:<path>` behavior.
+    for (const line of gitLines(['diff', '--no-renames', '--numstat', 'HEAD', '--', 'src/core/commands'])) {
+        const [addedRaw, deletedRaw, ...pathParts] = line.split('\t');
+        const relPath = normalize(pathParts.join('\t'));
+        if (!relPath)
+            continue;
+        if (!headFiles.has(relPath)) {
+            out.set(relPath, { baselineLines: null });
+            continue;
+        }
+        const added = Number(addedRaw);
+        const deleted = Number(deletedRaw);
+        if (!Number.isFinite(added) || !Number.isFinite(deleted)) {
+            out.set(relPath, { baselineLines: null });
+            continue;
+        }
+        const absolute = path.join(root, relPath);
+        const currentLines = fs.existsSync(absolute)
+            ? fs.readFileSync(absolute, 'utf8').split(/\r?\n/).length
+            : 0;
+        out.set(relPath, { baselineLines: Math.max(0, currentLines - added + deleted) });
+    }
+    for (const line of gitLines(['ls-files', '--others', '--exclude-standard', '--', 'src/core/commands'])) {
+        out.set(normalize(line), { baselineLines: null });
+    }
     return out;
 }
-function baseLineCount(relPath) {
-    const result = spawnSync('git', ['show', `HEAD:${relPath}`], { cwd: root, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
-    if (result.status !== 0)
-        return null;
-    const text = String(result.stdout || '');
-    return text ? text.split(/\r?\n/).length : 0;
-}
 function gitLines(args) {
     const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' });
     if (result.status !== 0)

package/dist/scripts/check-legacy-free.js

@@ -28,7 +28,7 @@ for (const file of await listFiles(path.join(root, 'src'))) {
 const bin = await read('src/bin/sks.ts');
 const main = await read('src/cli/main.ts');
 const router = await read('src/cli/router.ts');
-if (!bin.includes('../cli/main.js'))
+if (!bin.includes('./sks-dispatch.js'))
     issues.push('bin_entrypoint');
 if (!main.includes('./router.js'))
     issues.push('main_router');

package/dist/scripts/check-route-modularity.js

@@ -21,7 +21,6 @@ for (const relModule of registeredCommandModules()) {
 const disallowedImports = {
     'qa-loop-command.ts': ['research-command', 'ppt-command', 'team-command', 'gx-command'],
     'research-command.ts': ['qa-loop-command', 'ppt-command', 'team-command', 'gx-command'],
-    'db-command.ts': ['image-ux-review-command', 'ppt-command', 'computer-use-command'],
     'wiki-command.ts': ['team-command', 'research-command', 'qa-loop-command', 'ppt-command']
 };
 for (const [name, needles] of Object.entries(disallowedImports)) {

package/dist/scripts/check-ts-contracts.js

@@ -50,7 +50,7 @@ for (const rel of requiredFiles) {
 const runtimeRegistry = await import(pathToFileURL(path.join(root, 'dist', 'cli', 'command-registry.js')));
 const runtimeCommands = Object.keys(runtimeRegistry.COMMANDS || {}).sort();
 const typedText = fs.readFileSync(path.join(root, 'src', 'cli', 'command-registry.ts'), 'utf8');
-for (const name of ['help', 'version', 'commands', 'run', 'team', 'agent', 'trust', 'proof', 'db', 'git', 'wiki', 'bench', 'features']) {
+for (const name of ['help', 'version', 'commands', 'run', 'team', 'agent', 'trust', 'proof', 'git', 'wiki', 'bench', 'features']) {
     if (!runtimeCommands.includes(name))
         issues.push(`typed_registry_runtime_missing:${name}`);
     if (!new RegExp(`\\b${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*:`).test(typedText))

package/dist/scripts/codex-0139-interrupt-agent-check.js

@@ -5,10 +5,14 @@ const mod = await importDist('core/codex-control/codex-multi-agent-event-normali
 const interrupt = mod.normalizeCodexMultiAgentEventName('interrupt_agent');
 const close = mod.normalizeCodexMultiAgentEventName('close_agent');
 const start = mod.normalizeCodexMultiAgentEventName('spawn_agent');
+const currentClose = mod.normalizeCodexMultiAgentEventName('closeAgent');
+const currentStart = mod.normalizeCodexMultiAgentEventName('spawnAgent');
 assertGate(interrupt.canonical === 'interrupt_agent' && interrupt.stage === 'result', 'interrupt_agent must map to result stage', interrupt);
 assertGate(close.canonical === 'close_agent' && close.stage === 'result', 'close_agent must remain result stage', close);
 assertGate(start.canonical === 'start_agent' && start.stage === 'start', 'spawn_agent must map to start stage', start);
+assertGate(currentClose.canonical === 'close_agent' && currentClose.stage === 'result', '0.144.1 closeAgent must map to result stage', currentClose);
+assertGate(currentStart.canonical === 'start_agent' && currentStart.stage === 'start', '0.144.1 spawnAgent must map to start stage', currentStart);
 const runtimeCore = readText('src/core/pipeline-internals/runtime-core.ts');
 assertGate(runtimeCore.includes('normalizeCodexMultiAgentEventName'), 'runtime-core subagent evidence must use the 0.139 normalizer');
-emitGate('codex:0139-interrupt-agent', { canonical_events: [interrupt.canonical, close.canonical, start.canonical] });
+emitGate('codex:0139-interrupt-agent', { canonical_events: [interrupt.canonical, close.canonical, start.canonical, currentClose.canonical, currentStart.canonical] });
 //# sourceMappingURL=codex-0139-interrupt-agent-check.js.map

package/dist/scripts/{codex-0142-app-server-v2-check.js → codex-0144-app-server-v2-check.js}

@@ -1,25 +1,26 @@
 #!/usr/bin/env node
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 import { createCodexAppServerV2Client, currentTimeResponse } from '../core/codex-control/codex-app-server-v2-client.js';
-const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_CODEX_0142_APP_SERVER === '1';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
+const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_CODEX_0144_APP_SERVER === '1';
 const clientSource = readText('src/core/codex-control/codex-app-server-v2-client.ts');
-const schema = readText('schemas/codex/app-server-0.142/codex_app_server_protocol.v2.schemas.json');
+const schema = readText('schemas/codex/app-server-0.144/codex_app_server_protocol.v2.schemas.json');
 assertGate(clientSource.includes('resolveCodexRuntime'), 'app-server-v2 client must use the shared Codex runtime resolver');
 assertGate(clientSource.includes('currentTime/read'), 'app-server-v2 client must implement currentTime/read server request handling');
 assertGate(clientSource.includes("request('thread/list'"), 'app-server-v2 client must wrap native thread/list');
 assertGate(clientSource.includes("request('thread/read'"), 'app-server-v2 client must wrap native thread/read');
 assertGate(clientSource.includes('searchThreads'), 'app-server-v2 client must expose search over native thread list searchTerm');
-assertGate(schema.includes('"thread/list"'), 'generated 0.142 schema must contain thread/list');
-assertGate(schema.includes('"thread/read"'), 'generated 0.142 schema must contain thread/read');
-assertGate(schema.includes('"searchTerm"'), 'generated 0.142 schema must contain ThreadListParams.searchTerm');
-assertGate(schema.includes('"ThreadSearchResult"'), 'generated 0.142 schema must contain ThreadSearchResult');
+assertGate(schema.includes('"thread/list"'), 'generated 0.144.1 schema must contain thread/list');
+assertGate(schema.includes('"thread/read"'), 'generated 0.144.1 schema must contain thread/read');
+assertGate(schema.includes('"searchTerm"'), 'generated 0.144.1 schema must contain ThreadListParams.searchTerm');
+assertGate(schema.includes('"ThreadSearchResult"'), 'generated 0.144.1 schema must contain ThreadSearchResult');
 const deterministic = currentTimeResponse(new Date('2026-06-23T00:00:00.000Z'));
 assertGate(deterministic.utcIso === '2026-06-23T00:00:00.000Z', 'currentTime/read UTC ISO must be deterministic');
 assertGate(deterministic.unixTimeSeconds === 1782172800, 'currentTime/read seconds must be Unix UTC seconds');
 assertGate(deterministic.timezone === 'UTC', 'currentTime/read canonical timezone must be UTC');
 let realProbe = null;
 if (requireReal) {
-    const { client, runtimeIdentity } = await createCodexAppServerV2Client({ requestedBy: 'codex-0142-app-server-v2-check' });
+    const { client, runtimeIdentity } = await createCodexAppServerV2Client({ requestedBy: 'codex-0144-app-server-v2-check' });
     try {
         await client.initialize();
         const list = await client.listThreads({ limit: 1, useStateDbOnly: true });
@@ -28,14 +29,14 @@ if (requireReal) {
             runtime_sha256: runtimeIdentity.sha256,
             list_returned_object: Boolean(list && typeof list === 'object')
         };
-        assertGate(runtimeIdentity.version === '0.142.0', 'app-server-v2 require-real must resolve Codex 0.142.0', realProbe);
+        assertGate(runtimeIdentity.version === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion, `app-server-v2 require-real must resolve Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion}`, realProbe);
         assertGate(realProbe.list_returned_object === true, 'app-server-v2 require-real thread/list must return an object', realProbe);
     }
     finally {
         await client.close();
     }
 }
-emitGate('codex:0142:app-server-v2', {
+emitGate('codex:0144:app-server-v2', {
     current_time_handler: true,
     thread_list: true,
     thread_read: true,
@@ -43,4 +44,4 @@ emitGate('codex:0142:app-server-v2', {
     thread_search_via_list_search_term: true,
     real_probe: realProbe
 });
-//# sourceMappingURL=codex-0142-app-server-v2-check.js.map
+//# sourceMappingURL=codex-0144-app-server-v2-check.js.map

package/dist/scripts/{codex-0142-binary-identity-check.js → codex-0144-binary-identity-check.js}

@@ -3,15 +3,15 @@ import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 import { compareSemverLike } from '../core/codex-compat/codex-version-policy.js';
 import { resolveCodexRuntime } from '../core/codex-runtime/resolve-codex-runtime.js';
-const resolved = await resolveCodexRuntime({ requestedBy: 'codex-0142-binary-identity-check' });
+const resolved = await resolveCodexRuntime({ requestedBy: 'codex-0144-binary-identity-check' });
 assertGate(resolved.ok && resolved.identity !== null, 'Codex runtime identity must resolve', resolved);
 const identity = resolved.identity;
-assertGate(compareSemverLike(identity.version, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion) >= 0, 'Codex runtime must satisfy 0.142.0', identity);
+assertGate(compareSemverLike(identity.version, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion) >= 0, `Codex runtime must satisfy ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion}`, identity);
 assertGate(identity.sha256.length === 64, 'Codex runtime identity must include SHA-256', identity);
-emitGate('codex:0142:binary-identity', {
+emitGate('codex:0144:binary-identity', {
     realpath: identity.realpath,
     version: identity.version,
     sha256: identity.sha256,
     source: identity.source
 });
-//# sourceMappingURL=codex-0142-binary-identity-check.js.map
+//# sourceMappingURL=codex-0144-binary-identity-check.js.map