sneakoscope 6.2.0 → 6.4.0

package/dist/scripts/side-effect-zero-gate-check.js

@@ -1,226 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// Gate: safety:side-effect-zero
-// Proves the requested-scope contract is deny-by-default: only project files are
-// mutable, every global/destructive mutation requires explicit confirmation, and
-// every applied mutation must be recorded in the mutation ledger with a backup or
-// no-op reason. Operates entirely on temp dirs; never touches the real ~/.codex.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { root, assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const scope = await importDist('core/safety/requested-scope-contract.js');
-const ledger = await importDist('core/safety/mutation-ledger.js');
-const guardMod = await importDist('core/safety/mutation-guard.js');
-const { createRequestedScopeContract, isMutationAllowed, isPathAllowed, REQUESTED_SCOPE_CONTRACT_SCHEMA, CONFIRMATION_REQUIRED } = scope;
-const { evaluateMutation, recordMutation, mutationLedgerPath, MUTATION_KINDS, MUTATION_LEDGER_SCHEMA } = ledger;
-const { guardedWriteFile, guardedRename, guardContextForRoute, MutationGuardViolationError } = guardMod;
-function mkTmp(prefix) {
-    return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-}
-function rmTmp(dir) {
-    try {
-        fs.rmSync(dir, { recursive: true, force: true });
-    }
-    catch {
-        // best-effort cleanup; never fail the gate on teardown
-    }
-}
-const tmpDirs = [];
-const summary = { checks: {}, generated_at: new Date().toISOString() };
-try {
-    // ---------------------------------------------------------------------------
-    // Schema + deny-by-default contract surface.
-    // ---------------------------------------------------------------------------
-    assertGate(REQUESTED_SCOPE_CONTRACT_SCHEMA === 'sks.requested-scope-contract.v1', 'schema: REQUESTED_SCOPE_CONTRACT_SCHEMA mismatch', { schema: REQUESTED_SCOPE_CONTRACT_SCHEMA });
-    assertGate(Array.isArray(CONFIRMATION_REQUIRED) && CONFIRMATION_REQUIRED.length > 0, 'schema: CONFIRMATION_REQUIRED is not a non-empty array', { confirmation_required: CONFIRMATION_REQUIRED });
-    const contract = createRequestedScopeContract({
-        route: 'MAD',
-        userRequest: 'repair project config',
-        projectRoot: '/tmp/proj'
-    });
-    assertGate(contract.schema === REQUESTED_SCOPE_CONTRACT_SCHEMA, 'contract: default contract carries the wrong schema', { contract });
-    // ---------------------------------------------------------------------------
-    // project_files allowed; global/destructive kinds denied by default.
-    // ---------------------------------------------------------------------------
-    const projectAllowed = isMutationAllowed(contract, 'project_files');
-    assertGate(projectAllowed.allowed === true, 'scope: project_files must be allowed', { decision: projectAllowed });
-    const globalDenied = isMutationAllowed(contract, 'global_codex_config');
-    assertGate(globalDenied.allowed === false && globalDenied.reason === 'mutation_not_in_scope:global_codex_config', 'scope: global_codex_config must be denied (not in scope) by default', { decision: globalDenied });
-    const pkgDenied = isMutationAllowed(contract, 'package_install');
-    assertGate(pkgDenied.allowed === false, 'scope: package_install must be denied by default', { decision: pkgDenied });
-    const lbAuthDenied = isMutationAllowed(contract, 'codex_lb_auth');
-    assertGate(lbAuthDenied.allowed === false, 'scope: codex_lb_auth must be denied by default', { decision: lbAuthDenied });
-    // process_kill maps to the codex_app_process scope, denied by default.
-    const appProcessDenied = isMutationAllowed(contract, 'codex_app_process');
-    assertGate(appProcessDenied.allowed === false, 'scope: codex_app_process (process_kill) must be denied by default', { decision: appProcessDenied });
-    summary.checks.deny_by_default = {
-        project_files: projectAllowed.allowed,
-        global_codex_config: globalDenied.allowed,
-        package_install: pkgDenied.allowed,
-        codex_lb_auth: lbAuthDenied.allowed,
-        codex_app_process: appProcessDenied.allowed
-    };
-    // ---------------------------------------------------------------------------
-    // Even with an override allowing the kind, confirmation is still required.
-    // ---------------------------------------------------------------------------
-    const overridden = createRequestedScopeContract({
-        route: 'MAD',
-        userRequest: 'repair project config',
-        projectRoot: '/tmp/proj',
-        overrides: { global_codex_config: true }
-    });
-    const overriddenNoConfirm = isMutationAllowed(overridden, 'global_codex_config');
-    assertGate(overriddenNoConfirm.allowed === false && overriddenNoConfirm.reason.startsWith('requires_explicit_confirmation'), 'confirmation: overridden global_codex_config must still require explicit confirmation', { decision: overriddenNoConfirm });
-    const overriddenConfirmed = isMutationAllowed(overridden, 'global_codex_config', { confirmed: true });
-    assertGate(overriddenConfirmed.allowed === true, 'confirmation: confirmed global_codex_config must be allowed', { decision: overriddenConfirmed });
-    summary.checks.explicit_confirmation = {
-        denied_without_confirm: overriddenNoConfirm.allowed,
-        allowed_with_confirm: overriddenConfirmed.allowed
-    };
-    // ---------------------------------------------------------------------------
-    // Path scoping: project paths allowed; the global Codex config is forbidden.
-    // ---------------------------------------------------------------------------
-    const projectPath = isPathAllowed(contract, '/tmp/proj/src/x.ts');
-    assertGate(projectPath.allowed === true, 'path: project source path must be allowed', { decision: projectPath });
-    const codexConfigPath = isPathAllowed(contract, '~/.codex/config.toml');
-    assertGate(codexConfigPath.allowed === false && codexConfigPath.reason.startsWith('forbidden_path'), 'path: ~/.codex/config.toml must be a forbidden path', { decision: codexConfigPath });
-    summary.checks.path_scope = {
-        project_path: projectPath.allowed,
-        forbidden_codex_config: codexConfigPath.allowed
-    };
-    // Guard wrappers must enforce path scope before applying mutations.
-    const guardRoot = mkTmp('sks-mutation-guard-path-');
-    tmpDirs.push(guardRoot);
-    const guardContract = createRequestedScopeContract({
-        route: 'guard-fixture',
-        userRequest: 'mutate project fixture',
-        projectRoot: guardRoot
-    });
-    guardContract.forbidden_paths.push(path.join(guardRoot, 'forbidden/**'));
-    const guardCtx = guardContextForRoute(guardRoot, guardContract, 'side-effect-zero-fixture');
-    const insideTarget = path.join(guardRoot, 'ok.txt');
-    await guardedWriteFile(guardCtx, insideTarget, 'ok');
-    assertGate(fs.existsSync(insideTarget), 'guard path fixture: project file mutation should apply', { insideTarget });
-    const outsideTarget = path.join(os.tmpdir(), `sks-outside-${Date.now()}.txt`);
-    let outsideBlocked = false;
-    try {
-        await guardedWriteFile(guardCtx, outsideTarget, 'no');
-    }
-    catch (err) {
-        outsideBlocked = err instanceof MutationGuardViolationError || String(err?.message || err).includes('path_not_in_scope');
-    }
-    assertGate(outsideBlocked && !fs.existsSync(outsideTarget), 'guard path fixture: outside project write must fail before apply', { outsideTarget });
-    const forbiddenTarget = path.join(guardRoot, 'forbidden', 'no.txt');
-    let forbiddenBlocked = false;
-    try {
-        await guardedWriteFile(guardCtx, forbiddenTarget, 'no');
-    }
-    catch (err) {
-        forbiddenBlocked = err instanceof MutationGuardViolationError || String(err?.message || err).includes('forbidden_path');
-    }
-    assertGate(forbiddenBlocked && !fs.existsSync(forbiddenTarget), 'guard path fixture: forbidden path write must fail before apply', { forbiddenTarget });
-    const renameSource = path.join(guardRoot, 'rename-source.txt');
-    fs.writeFileSync(renameSource, 'keep');
-    let renameBlocked = false;
-    try {
-        await guardedRename(guardCtx, renameSource, path.join(guardRoot, 'forbidden', 'renamed.txt'));
-    }
-    catch (err) {
-        renameBlocked = err instanceof MutationGuardViolationError || String(err?.message || err).includes('forbidden_path');
-    }
-    assertGate(renameBlocked && fs.existsSync(renameSource), 'guard path fixture: forbidden rename target must fail before apply', { renameSource });
-    summary.checks.mutation_guard_path_scope = {
-        project_write_applied: true,
-        outside_project_blocked: outsideBlocked,
-        forbidden_path_blocked: forbiddenBlocked,
-        rename_target_forbidden_blocked: renameBlocked
-    };
-    // ---------------------------------------------------------------------------
-    // Mutation ledger violations.
-    // ---------------------------------------------------------------------------
-    assertGate(MUTATION_LEDGER_SCHEMA === 'sks.mutation-ledger.v1', 'ledger: MUTATION_LEDGER_SCHEMA mismatch', { schema: MUTATION_LEDGER_SCHEMA });
-    // Applied global_config_write with no scope permission -> violation.
-    const appliedOutOfScope = evaluateMutation(contract, 'global_config_write', {
-        target: '~/.codex/config.toml',
-        applied: true
-    });
-    assertGate(appliedOutOfScope.violation === true, 'ledger: global config write applied out of scope must be a violation', { entry: appliedOutOfScope });
-    // Allowed (overridden + confirmed) global config write applied WITHOUT a
-    // backup/no-op reason -> still a violation (config mutations need a backup).
-    const configContract = createRequestedScopeContract({
-        route: 'MAD',
-        userRequest: 'repair project config',
-        projectRoot: '/tmp/proj',
-        overrides: { global_codex_config: true }
-    });
-    const configNoBackup = evaluateMutation(configContract, 'global_config_write', {
-        target: 'x',
-        confirmed: true,
-        applied: true,
-        backupPath: null,
-        noOpReason: null
-    });
-    assertGate(configNoBackup.violation === true, 'ledger: in-scope config write applied without backup/no-op reason must be a violation', { entry: configNoBackup });
-    // Allowed project_files file_write applied -> no violation.
-    const projectWrite = evaluateMutation(contract, 'file_write', {
-        target: '/tmp/proj/src/x.ts',
-        applied: true,
-        backupPath: null,
-        noOpReason: null
-    });
-    assertGate(projectWrite.violation === false && projectWrite.requested_scope_allowed === true, 'ledger: allowed project file_write must not be a violation', { entry: projectWrite });
-    summary.checks.ledger_violations = {
-        applied_out_of_scope: appliedOutOfScope.violation,
-        config_without_backup: configNoBackup.violation,
-        project_write_ok: projectWrite.violation === false
-    };
-    // ---------------------------------------------------------------------------
-    // No-mutation-without-ledger: required kinds are recordable, and recordMutation
-    // produces the ledger file on disk.
-    // ---------------------------------------------------------------------------
-    const requiredKinds = [
-        'file_write',
-        'global_config_write',
-        'package_install',
-        'process_kill',
-        'codex_app_flag_change',
-        'codex_lb_auth_change',
-        'zellij_install',
-        'skill_snapshot_promotion'
-    ];
-    for (const kind of requiredKinds) {
-        assertGate(MUTATION_KINDS.includes(kind), `ledger: MUTATION_KINDS is missing required kind '${kind}'`, { mutation_kinds: MUTATION_KINDS });
-    }
-    const ledgerRoot = mkTmp('sks-side-effect-ledger-');
-    tmpDirs.push(ledgerRoot);
-    const recordedPath = await recordMutation(ledgerRoot, projectWrite);
-    assertGate(recordedPath === mutationLedgerPath(ledgerRoot) && fs.existsSync(recordedPath), 'ledger: recordMutation did not write the ledger file at mutationLedgerPath', { recorded_path: recordedPath, expected: mutationLedgerPath(ledgerRoot) });
-    summary.checks.no_mutation_without_ledger = {
-        required_kinds_present: true,
-        ledger_file_written: true
-    };
-    // ---------------------------------------------------------------------------
-    // Write the report and emit the gate.
-    // ---------------------------------------------------------------------------
-    const reportDir = path.join(root, '.sneakoscope', 'reports');
-    fs.mkdirSync(reportDir, { recursive: true });
-    const reportPath = path.join(reportDir, 'side-effect-zero.json');
-    fs.writeFileSync(reportPath, `${JSON.stringify({ schema: 'sks.side-effect-zero.v1', ok: true, ...summary }, null, 2)}\n`, 'utf8');
-    emitGate('safety:side-effect-zero', {
-        report_path: reportPath,
-        checks_performed: [
-            'deny_by_default',
-            'explicit_confirmation',
-            'path_scope',
-            'mutation_guard_path_scope',
-            'ledger_violations',
-            'no_mutation_without_ledger'
-        ]
-    });
-}
-finally {
-    for (const dir of tmpDirs)
-        rmTmp(dir);
-}
-//# sourceMappingURL=side-effect-zero-gate-check.js.map

package/dist/scripts/skill-registry-ledger-check.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeManagedCoreSkill, writeUserSkill } from './sks-3-1-8-check-lib.js';
-import { buildSkillRegistryLedger } from '../core/codex-native/skill-registry-ledger.js';
-const root = await makeTempRoot('sks-skill-ledger-');
-process.env.CODEX_HOME = path.join(root, 'codex-home');
-await writeManagedCoreSkill(root, '.agents/skills', 'loop');
-await writeUserSkill(root, '.agents/skills', 'custom-skill', 'Custom Skill');
-const ledger = await buildSkillRegistryLedger({ root });
-assertGate(ledger.entries.some((entry) => entry.canonical_name === 'loop' && entry.managed_by_sks), 'ledger must detect managed core skill', ledger);
-assertGate(ledger.entries.some((entry) => entry.canonical_name === 'custom-skill' && !entry.managed_by_sks), 'ledger must detect user skill', ledger);
-assertGate(Array.isArray(ledger.active_entries) && typeof ledger.active_unique_by_canonical_name === 'boolean' && Array.isArray(ledger.duplicate_active_canonical_names), 'ledger must expose active uniqueness proof fields', ledger);
-emitGate('skill:registry-ledger', { entries: ledger.entries.length });
-//# sourceMappingURL=skill-registry-ledger-check.js.map

package/dist/scripts/skill-sync-atomic-check.js

@@ -1,35 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import fs from 'node:fs/promises';
-import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
-import { syncCodexSksSkills, withSkillSyncLock } from '../core/codex-app/codex-skill-sync.js';
-import { buildSkillRegistryLedger } from '../core/codex-native/skill-registry-ledger.js';
-const root = await makeTempRoot('sks-skill-atomic-');
-process.env.CODEX_HOME = path.join(root, 'codex-home');
-const skillsRoot = path.join(process.env.CODEX_HOME, 'skills');
-const lockPath = path.join(root, '.sneakoscope', 'locks', 'skill-sync.lock');
-await fs.mkdir(lockPath, { recursive: true });
-await fs.writeFile(path.join(lockPath, 'owner.json'), JSON.stringify({ schema: 'sks.skill-sync-lock.v1', pid: 999999, acquired_at: '1970-01-01T00:00:00.000Z', stale_after_ms: 1 }), 'utf8');
-await withSkillSyncLock(root, async () => undefined);
-await fs.mkdir(lockPath, { recursive: true });
-await fs.writeFile(path.join(lockPath, 'owner.json'), 'not-json', 'utf8');
-const staleTime = new Date(Date.now() - 60_000);
-await fs.utimes(lockPath, staleTime, staleTime);
-await withSkillSyncLock(root, async () => undefined);
-const releaseProbe = { released: false };
-try {
-    await withSkillSyncLock(root, async () => {
-        throw new Error('fixture lock body failure');
-    });
-}
-catch {
-    await withSkillSyncLock(root, async () => {
-        releaseProbe.released = true;
-    });
-}
-await Promise.all(Array.from({ length: 20 }, () => syncCodexSksSkills({ root, apply: true, skillsRoot })));
-const ledger = await buildSkillRegistryLedger({ root });
-assertGate(releaseProbe.released === true, 'lock must be released after callback throws');
-assertGate(ledger.active_unique_by_canonical_name === true, 'concurrent sync must not create duplicate active skill names', ledger);
-emitGate('skill:sync-atomic', { entries: ledger.entries.length });
-//# sourceMappingURL=skill-sync-atomic-check.js.map

package/dist/scripts/sks-1-11-fixture-check.js

@@ -1,130 +0,0 @@
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const mode = process.argv[2] || '';
-function runSks(args) {
-    const entry = path.join(root, 'dist', 'bin', 'sks.js');
-    const result = spawnSync(process.execPath, [entry, ...args], {
-        cwd: root,
-        encoding: 'utf8',
-        env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1' },
-        timeout: 120_000
-    });
-    if (result.status !== 0) {
-        throw new Error(`sks ${args.join(' ')} failed\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`);
-    }
-    return parseJson(result.stdout);
-}
-function parseJson(text) {
-    const trimmed = String(text || '').trim();
-    try {
-        return JSON.parse(trimmed);
-    }
-    catch { }
-    const start = trimmed.indexOf('{');
-    const end = trimmed.lastIndexOf('}');
-    if (start >= 0 && end > start)
-        return JSON.parse(trimmed.slice(start, end + 1));
-    throw new Error(`Expected JSON output, got: ${trimmed.slice(0, 400)}`);
-}
-function assert(condition, message) {
-    if (!condition)
-        throw new Error(message);
-}
-async function jsonSchemaRecursiveCheck() {
-    const { validateJsonSchemaRecursive } = await import('../core/json-schema-validator.js');
-    const schema = {
-        type: 'object',
-        required: ['items'],
-        properties: {
-            items: {
-                type: 'array',
-                minItems: 1,
-                items: {
-                    type: 'object',
-                    required: ['id', 'bbox'],
-                    additionalProperties: false,
-                    properties: {
-                        id: { type: 'string', minLength: 1 },
-                        bbox: {
-                            type: 'array',
-                            prefixItems: [
-                                { type: 'number', minimum: 0 },
-                                { type: 'number', minimum: 0 },
-                                { type: 'number', exclusiveMinimum: 0 },
-                                { type: 'number', exclusiveMinimum: 0 }
-                            ],
-                            minItems: 4,
-                            maxItems: 4
-                        }
-                    }
-                }
-            }
-        },
-        additionalProperties: false
-    };
-    assert(validateJsonSchemaRecursive({ items: [{ id: 'a', bbox: [0, 0, 1, 1] }] }, schema).ok, 'valid recursive schema fixture failed');
-    assert(!validateJsonSchemaRecursive({ items: [{ id: '', bbox: [0, 0, 0, 1], extra: true }] }, schema).ok, 'invalid recursive schema fixture passed');
-}
-function uxFixture() {
-    const result = runSks(['image-ux-review', 'fixture', '--mock', '--json']);
-    assert(result.ok === true, 'UX fixture did not pass');
-    assert(result.artifacts?.generated_review_ledger?.mock_fixture !== false, 'UX fixture should remain mock/partial');
-}
-function uxNoFakeCallouts() {
-    const source = fs.readFileSync(path.join(root, 'src', 'core', 'commands', 'image-ux-review-command.ts'), 'utf8');
-    assert(!source.includes('Generated visual callout'), 'generic fake Generated visual callout string is present');
-    assert(/callouts:\s*opts\.mock\s*\?/.test(source), 'attach-generated mock gating is missing');
-}
-function pptFixture() {
-    const result = runSks(['ppt', 'fixture', '--mock', '--json']);
-    assert(result.ok === true, 'PPT fixture did not pass');
-    assert(result.artifacts?.gate?.mock_fixture === true, 'PPT fixture did not record mock fixture');
-    assert(result.artifacts?.slide_callout_ledger?.generated_slide_callout_images_count >= 1, 'PPT generated slide callout missing');
-    assert(result.artifacts?.slide_issue_ledger?.issues?.length >= 1, 'PPT slide issue extraction missing');
-}
-function pptNoTextFallback() {
-    const source = fs.readFileSync(path.join(root, 'src', 'core', 'ppt-review', 'slide-imagegen-review.ts'), 'utf8');
-    assert(source.includes('text_only_fallback_allowed: false'), 'PPT text-only fallback gate missing');
-}
-function pptNoMockAsReal() {
-    const result = runSks(['ppt', 'fixture', '--mock', '--json']);
-    assert(result.artifacts?.gate?.verified_level === 'verified_partial', 'PPT mock fixture was not capped at verified_partial');
-}
-function dfixFixture() {
-    const result = runSks(['dfix', 'fixture', '--json']);
-    assert(result.ok === true, 'DFix fixture did not pass');
-    assert(result.artifacts?.gate?.diagnosis_present === true, 'DFix diagnosis missing');
-    assert(result.artifacts?.gate?.verification_present === true, 'DFix verification missing');
-}
-function allFeaturesCompletion() {
-    const result = runSks(['all-features', 'complete', '--json']);
-    assert(result.schema === 'sks.all-feature-completion.v1', 'all-feature completion schema missing');
-    assert(Array.isArray(result.features), 'all-feature completion rows missing');
-}
-const runners = {
-    'ux-generate': uxFixture,
-    'ux-extract': uxFixture,
-    'ux-patch': uxFixture,
-    'ux-recapture': uxFixture,
-    'ux-no-fake': uxNoFakeCallouts,
-    'ppt-review': pptFixture,
-    'ppt-export': pptFixture,
-    'ppt-no-text': pptNoTextFallback,
-    'ppt-no-mock-real': pptNoMockAsReal,
-    'ppt-extract': pptFixture,
-    'ppt-voxel': pptFixture,
-    'ppt-proof': pptFixture,
-    'dfix-fixture': dfixFixture,
-    'dfix-verification': dfixFixture,
-    'all-features': allFeaturesCompletion,
-    'json-schema': jsonSchemaRecursiveCheck
-};
-if (!runners[mode])
-    throw new Error(`Unknown SKS 1.11 fixture mode: ${mode}`);
-await runners[mode]();
-console.log(JSON.stringify({ ok: true, mode }, null, 2));
-//# sourceMappingURL=sks-1-11-fixture-check.js.map

package/dist/scripts/sks-3-1-7-directive-check-lib.js

@@ -1,58 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const RELEASE_HELPERS = [
-    'src/scripts/release-dag-full-coverage-check.ts',
-    'src/scripts/sks-3-1-5-directive-check-lib.ts',
-    'src/scripts/sks-3-1-6-directive-check-lib.ts',
-    'src/scripts/sks-3-1-7-directive-check-lib.ts',
-    'src/scripts/release-script-type-safety-check.ts',
-    'src/scripts/no-ts-nocheck-release-scripts-check.ts'
-];
-export async function runDirective317Gate(id) {
-    if (id === 'release-scripts:type-safe')
-        return releaseScriptsTypeSafe(id);
-    if (id === 'lint:no-ts-nocheck-release-scripts')
-        return noTsNoCheckReleaseScripts(id);
-    throw new Error(`unknown_3_1_7_gate:${id}`);
-}
-function releaseScriptsTypeSafe(id) {
-    checkNoTsNoCheckReleaseScripts();
-    const dag = readText('src/scripts/release-dag-full-coverage-check.ts');
-    for (const token of [
-        'interface PackageJsonShape',
-        'interface ReleaseGate',
-        'interface ReleaseGateManifest',
-        'function readPackageJson',
-        'function readReleaseGateManifest',
-        'function isReleaseGate',
-        'function normalizeStringList',
-        'const parsed: unknown'
-    ]) {
-        assertGate(dag.includes(token), `release DAG helper missing typed token:${token}`);
-    }
-    emitGate(id, { checked_files: RELEASE_HELPERS });
-}
-function noTsNoCheckReleaseScripts(id) {
-    checkNoTsNoCheckReleaseScripts();
-    emitGate(id, { checked_files: RELEASE_HELPERS });
-}
-function checkNoTsNoCheckReleaseScripts() {
-    const offenders = RELEASE_HELPERS.filter((rel) => /^\s*\/\/\s*@ts-nocheck\b/m.test(readText(rel)));
-    assertGate(offenders.length === 0, 'release script ts-nocheck offenders found', { offenders, checked_files: RELEASE_HELPERS });
-}
-function readText(rel) {
-    return fs.readFileSync(path.join(root, rel), 'utf8');
-}
-function assertGate(condition, message, detail = {}) {
-    if (condition)
-        return;
-    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
-    process.exit(1);
-}
-function emitGate(gate, detail = {}) {
-    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate, ...detail }, null, 2));
-}
-//# sourceMappingURL=sks-3-1-7-directive-check-lib.js.map

package/dist/scripts/source-intelligence-all-modes-check.js

@@ -1,22 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/source-intelligence/source-intelligence-runner.js');
-const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-source-intelligence-'));
-const common = {
-    missionDir: dir,
-    route: '$Research',
-    context7: async () => [{ title: 'docs', url: 'https://docs.example.com' }],
-    codexWebSearch: async () => [{ title: 'web', url: 'https://example.com' }],
-    env: { SKS_CODEX_WEB_SEARCH_AVAILABLE: '1' }
-};
-const balanced = await mod.runSourceIntelligence({ ...common, query: 'npm package docs' });
-const xSearch = await mod.runSourceIntelligence({ ...common, query: 'site:x.com product launch', xaiDetection: { configured: true, search_capable: true } });
-assertGate(balanced.ok === true && balanced.mode === 'super_balanced', 'balanced Super-Search mode must pass with provider-independent proof', balanced);
-assertGate(xSearch.ok === false && xSearch.mode === 'x_search' && xSearch.blockers.includes('x_search_parity_not_proven'), 'X mode must not treat discovery-only public X evidence as parity', xSearch);
-assertGate(xSearch.parallel.providers_requested.includes('x_public'), 'X public provider must be capability-selected', xSearch.parallel);
-emitGate('source-intelligence:all-modes', { modes: [balanced.mode, xSearch.mode], x_parity_claim: 'not_proven_without_real_corpus' });
-//# sourceMappingURL=source-intelligence-all-modes-check.js.map

package/dist/scripts/source-intelligence-policy-check.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertFiles, assertGate, emitGate, importDist, SOURCE_INTELLIGENCE_FILES } from './sks-1-18-gate-lib.js';
-assertFiles(SOURCE_INTELLIGENCE_FILES);
-const mod = await importDist('core/source-intelligence/source-intelligence-policy.js');
-const base = mod.buildSourceIntelligencePolicy({ query: 'current release notes', context7Available: true, codexWebCapability: { available: true, status: 'available', reason: 'fixture' } });
-const xSearch = mod.buildSourceIntelligencePolicy({ query: 'site:x.com product launch', context7Available: true, codexWebCapability: { available: true, status: 'available', reason: 'fixture' }, xaiDetection: { configured: true, search_capable: true } });
-const blocked = mod.buildSourceIntelligencePolicy({ query: 'npm package docs', context7Available: false });
-assertGate(base.mode === 'super_balanced', 'default mode must be super_balanced', base);
-assertGate(xSearch.mode === 'x_search' && xSearch.selected_providers.includes('x_public') && !Object.hasOwn(xSearch, ['xai', 'mcp'].join('_')), 'X-search mode must be provider-independent and ignore xAI detection', xSearch);
-assertGate(blocked.mode === 'blocked' && blocked.blockers.includes('docs_context_missing'), 'Context7 missing must block docs context');
-emitGate('source-intelligence:policy', { modes: [base.mode, xSearch.mode, blocked.mode] });
-//# sourceMappingURL=source-intelligence-policy-check.js.map

package/dist/scripts/strategy-adhd-orchestrating-gate-check.js

@@ -1,22 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/strategy/adhd-orchestrating-gate.js');
-const gate = mod.runAdhdOrchestratingGate({
-    prompt: 'Implement strategy-first parallel write gates in `src/core/strategy/strategy-gate.ts` with Appshots evidence.',
-    agentCount: 5,
-    visualRequired: true
-});
-const artifacts = mod.buildDopamineOrchestrationArtifacts(gate);
-const report = { schema: 'sks.strategy-adhd-orchestrating-gate-check.v1', ok: gate.ok, gate, artifacts };
-const out = path.join(root, '.sneakoscope', 'reports', 'strategy-adhd-orchestrating-gate.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(gate.ok === true, 'ADHD orchestration gate must pass a concrete prompt', report);
-assertGate(gate.scheduler_requires_gate === true, 'strategy scheduler gate must be explicit', report);
-assertGate(gate.micro_wins.length >= 4, 'micro-win board must contain executable slices', report);
-assertGate(artifacts.microWinBoard.dashboard_visible === true, 'micro-win board must be dashboard visible', report);
-emitGate('strategy:adhd-orchestrating-gate', { micro_wins: gate.micro_wins.length });
-//# sourceMappingURL=strategy-adhd-orchestrating-gate-check.js.map

package/dist/scripts/strategy-file-ownership-plan-check.js

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/strategy/strategy-compiler.js');
-const compiled = mod.compileStrategy({
-    prompt: 'Patch separate source and docs files.',
-    writeTargets: ['src/core/strategy/strategy-gate.ts', 'docs/strategy-first-parallel-write.md']
-});
-const report = { schema: 'sks.strategy-file-ownership-plan-check.v1', ok: compiled.file_ownership_plan.no_overlap, ownership: compiled.file_ownership_plan };
-const out = path.join(root, '.sneakoscope', 'reports', 'strategy-file-ownership-plan.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(compiled.file_ownership_plan.no_overlap === true, 'file ownership plan must prove no overlapping writes', report);
-assertGate(compiled.file_ownership_plan.protected_write_paths.length === 0, 'file ownership plan must block protected paths', report);
-emitGate('strategy:file-ownership-plan', { owners: compiled.file_ownership_plan.owners.length });
-//# sourceMappingURL=strategy-file-ownership-plan-check.js.map

package/dist/scripts/strategy-parallel-modification-plan-check.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/strategy/strategy-compiler.js');
-const compiled = mod.compileStrategy({
-    prompt: 'Update independent release files.',
-    writeTargets: ['src/core/version.ts', 'README.md', 'CHANGELOG.md'],
-    agentCount: 5
-});
-const report = { schema: 'sks.strategy-parallel-modification-plan-check.v1', ok: compiled.parallel_modification_plan.can_parallelize_writes, plan: compiled.parallel_modification_plan };
-const out = path.join(root, '.sneakoscope', 'reports', 'strategy-parallel-modification-plan.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(compiled.parallel_modification_plan.batches.length >= 1, 'parallel modification plan must include a batch', report);
-assertGate(compiled.parallel_modification_plan.serial_conflicts.length === 0, 'independent write targets must not serialize', report);
-emitGate('strategy:parallel-modification-plan', { batches: compiled.parallel_modification_plan.batches.length });
-//# sourceMappingURL=strategy-parallel-modification-plan-check.js.map

package/dist/scripts/strategy-verification-rollback-dag-check.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/strategy/strategy-compiler.js');
-const compiled = mod.compileStrategy({
-    prompt: 'Patch with rollback proof.',
-    writeTargets: ['src/core/agents/agent-patch-proof.ts']
-});
-const dag = compiled.verification_rollback_dag;
-const report = { schema: 'sks.strategy-verification-rollback-dag-check.v1', ok: dag.rollback_ready, dag };
-const out = path.join(root, '.sneakoscope', 'reports', 'strategy-verification-rollback-dag.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(dag.rollback_ready === true, 'verification rollback DAG must include rollback node', report);
-assertGate(dag.nodes.some((node) => node.kind === 'verification'), 'verification rollback DAG must include verification node', report);
-emitGate('strategy:verification-rollback-dag', { nodes: dag.nodes.length });
-//# sourceMappingURL=strategy-verification-rollback-dag-check.js.map