sneakoscope 6.2.0 → 6.5.1

package/dist/scripts/codex-app-launcher-check.js

@@ -1,17 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-import { writeTextAtomic } from '../core/fsx.js';
-process.env.SKS_CODEX_APP_LAUNCH_FAKE = '1';
-const mod = await importDist('core/codex-app/codex-app-launcher.js');
-const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-app-launcher-'));
-const prompt = path.join(root, 'prompt.md');
-await writeTextAtomic(prompt, 'fixture');
-const artifactOnly = await mod.attemptCodexAppLaunch({ cwd: root, promptArtifactPath: prompt, mode: 'artifact-only', codexBin: 'codex' });
-const launched = await mod.attemptCodexAppLaunch({ cwd: root, promptArtifactPath: prompt, mode: 'attempt-launch', codexBin: 'codex' });
-assertGate(artifactOnly.attempted === false && launched.attempted === true && launched.launched === true, 'Codex App launcher must keep artifact-only safe mode and support opt-in launch attempts', { artifactOnly, launched });
-emitGate('codex-app:launcher', { mode: launched.mode });
-//# sourceMappingURL=codex-app-launcher-check.js.map

package/dist/scripts/codex-app-provider-badge-check.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-import { buildCodexAppProviderBadgeStatus } from '../core/codex-app/codex-app-provider-badge.js';
-const providerContext = {
-    schema: 'sks.provider-context.v1',
-    generated_at: new Date().toISOString(),
-    provider: 'codex-lb',
-    auth_mode: 'codex_lb_key',
-    route: '$Agent',
-    service_tier: 'fast',
-    source: 'codex_lb',
-    confidence: 'high',
-    conflict: false,
-    warnings: [],
-    signals: {
-        openai_api_key_present: false,
-        codex_lb_key_present: true,
-        codex_lb_explicit: true,
-        codex_app_auth_present: false,
-        model_provider: 'codex-lb'
-    }
-};
-const unsupported = await buildCodexAppProviderBadgeStatus(process.cwd(), { providerContext, officialCapability: false });
-const supported = await buildCodexAppProviderBadgeStatus(process.cwd(), { providerContext, officialCapability: true });
-const ok = unsupported.ok
-    && supported.ok
-    && unsupported.native_app_badge_supported === false
-    && unsupported.private_app_mutation === false
-    && unsupported.fallback_surfaces.includes('doctor --json')
-    && supported.native_app_badge_status === 'available'
-    && unsupported.badge_text === 'Provider: codex-lb · Fast';
-emit({ schema: 'sks.codex-app-provider-badge-check.v1', ok, unsupported, supported, blockers: ok ? [] : ['codex_app_provider_badge_check_failed'] });
-function emit(report) {
-    console.log(JSON.stringify(report, null, 2));
-    if (!report.ok)
-        process.exitCode = 1;
-}
-//# sourceMappingURL=codex-app-provider-badge-check.js.map

package/dist/scripts/codex-app-provider-model-ui-check.js

@@ -1,163 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { codexProviderModelUiStatus, formatCodexAppStatus } from '../core/codex-app.js';
-import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from '../core/codex-app/glm-model-profile.js';
-import { GLM_52_OPENROUTER_MODEL } from '../core/providers/glm/glm-52-settings.js';
-const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-app-provider-ui-'));
-const home = path.join(tmp, 'home');
-const cwd = path.join(tmp, 'project');
-await fs.mkdir(path.join(home, '.codex'), { recursive: true });
-await fs.mkdir(path.join(cwd, '.codex'), { recursive: true });
-const missing = await codexProviderModelUiStatus({ home, cwd, env: { HOME: home } });
-const missingText = formatCodexAppStatus(statusFixture(missing));
-await fs.writeFile(path.join(home, '.codex', 'config.toml'), readyConfig(), 'utf8');
-await fs.writeFile(path.join(home, '.codex', 'sks-codex-lb.env'), "export CODEX_LB_BASE_URL='https://lb.example.test/backend-api/codex'\nexport CODEX_LB_API_KEY='sk-codex-lb-fixture'\n", 'utf8');
-const readyCatalog = {
-    schema: 'sks.codex-lb-model-catalog.v1',
-    ok: true,
-    status: 'ready',
-    models: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'],
-    model_efforts: {
-        'gpt-5.6-sol': ['xhigh', 'max', 'ultra'],
-        'gpt-5.6-terra': ['xhigh', 'max', 'ultra'],
-        'gpt-5.6-luna': ['xhigh', 'max']
-    },
-    blockers: []
-};
-const ready = await codexProviderModelUiStatus({
-    home,
-    cwd,
-    env: { HOME: home, OPENROUTER_API_KEY: 'sk-or-fixture' },
-    codexLbModelCatalog: readyCatalog
-});
-const readyText = formatCodexAppStatus(statusFixture(ready));
-await fs.writeFile(path.join(home, '.codex', 'config.toml'), codexLbOnlyConfig(), 'utf8');
-const selectedCodexLb = await codexProviderModelUiStatus({
-    home,
-    cwd,
-    env: { HOME: home },
-    codexLbModelCatalog: readyCatalog
-});
-const ok = missing.ok === true
-    && missing.status === 'ready'
-    && missing.selected_provider === 'oauth'
-    && missing.blockers.length === 0
-    && missing.optional_provider_status === 'setup_available'
-    && missing.optional_provider_blockers.includes('glm_openrouter_provider_missing')
-    && missing.optional_provider_blockers.includes('codex_lb_provider_missing')
-    && missing.glm.exposed === false
-    && missing.codex_lb.key_entry_visible === true
-    && missing.ui_actions.includes('sks codex-app set-openrouter-key --api-key-stdin')
-    && missing.ui_actions.includes('sks codex-lb setup --host <domain> --api-key-stdin --yes')
-    && /Provider UI:\s*oauth ready, optional providers can be configured/.test(missingText)
-    && /GLM Model:\s*setup/.test(missingText)
-    && /codex-lb Key:\s*missing \(input: sks codex-lb setup/.test(missingText)
-    && ready.ok === true
-    && ready.glm.exposed === true
-    && ready.glm.model === GLM_52_OPENROUTER_MODEL
-    && ready.glm.profiles_present.length === GLM_CODEX_CONFIG_REASONING_PROFILES.length
-    && ready.codex_lb.provider_present === true
-    && ready.codex_lb.key_present === true
-    && ready.codex_lb.model_catalog_ok === true
-    && ready.codex_lb.expected_models_present === true
-    && /Provider UI:\s*oauth ready/.test(readyText)
-    && ready.desktop_picker_verified === false
-    && readyText.includes(`GLM Model:  ok ${GLM_52_OPENROUTER_MODEL}`)
-    && /codex-lb Key:\s*configured/.test(readyText)
-    && selectedCodexLb.ok === true
-    && selectedCodexLb.status === 'ready'
-    && selectedCodexLb.selected_provider === 'codex-lb'
-    && selectedCodexLb.selected_provider_blockers.length === 0
-    && selectedCodexLb.blockers.length === 0
-    && selectedCodexLb.optional_provider_blockers.includes('glm_openrouter_provider_missing')
-    && !JSON.stringify({ missing, ready, selectedCodexLb, missingText, readyText }).includes('sk-codex-lb-fixture');
-emit({
-    schema: 'sks.codex-app-provider-model-ui-check.v1',
-    ok,
-    missing,
-    ready,
-    selected_codex_lb: selectedCodexLb,
-    secret_safe: !JSON.stringify({ missing, ready, selectedCodexLb, missingText, readyText }).includes('sk-codex-lb-fixture'),
-    blockers: ok ? [] : ['codex_app_provider_model_ui_check_failed']
-});
-function readyConfig() {
-    return [
-        `[model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}]`,
-        'name = "OpenRouter"',
-        'base_url = "https://openrouter.ai/api/v1"',
-        'wire_api = "responses"',
-        'env_key = "OPENROUTER_API_KEY"',
-        'requires_openai_auth = false',
-        '',
-        ...GLM_CODEX_CONFIG_REASONING_PROFILES.flatMap((profile) => [
-            `[profiles.${profile.id}]`,
-            `model_provider = "${GLM_CODEX_CONFIG_PROVIDER_ID}"`,
-            `model = "${GLM_52_OPENROUTER_MODEL}"`,
-            `model_reasoning_effort = "${profile.reasoning_effort}"`,
-            'service_tier = "default"',
-            'approval_policy = "on-request"',
-            ''
-        ]),
-        '[model_providers.codex-lb]',
-        'name = "openai"',
-        'base_url = "https://lb.example.test/backend-api/codex"',
-        'wire_api = "responses"',
-        'env_key = "CODEX_LB_API_KEY"',
-        'supports_websockets = true',
-        'requires_openai_auth = true',
-        ''
-    ].join('\n');
-}
-function codexLbOnlyConfig() {
-    return [
-        'model_provider = "codex-lb"',
-        '[model_providers.codex-lb]',
-        'name = "openai"',
-        'base_url = "https://lb.example.test/backend-api/codex"',
-        'wire_api = "responses"',
-        'env_key = "CODEX_LB_API_KEY"',
-        'supports_websockets = true',
-        'requires_openai_auth = true',
-        ''
-    ].join('\n');
-}
-function statusFixture(providerModelUi) {
-    return {
-        ok: providerModelUi.ok,
-        app: { installed: true, path: '/Applications/Codex.app' },
-        codex_cli: { ok: true, version: '0.144.1' },
-        remote_control: { ok: true, min_version: '0.130.0', codex_cli: { version_number: '0.144.1' } },
-        features: {
-            checked: true,
-            required_flags_ok: true,
-            required_flags: {},
-            fast_mode_config: { ok: true, blockers: [] },
-            provider_model_ui: providerModelUi,
-            git_actions: { ok: true, blockers: [] },
-            browser_tool_ready: true,
-            browser_tool_source: 'fixture',
-            image_generation: true
-        },
-        plugins: {
-            default_plugins: { ok: true },
-            design_product: { ok: true, id: 'product-design' },
-            picker: { ok: true }
-        },
-        chrome_extension: { ok: true, blockers: [] },
-        mcp: {
-            has_computer_use: true,
-            computer_use_source: 'mcp_list',
-            has_browser_use: true,
-            browser_use_source: 'mcp_list'
-        },
-        guidance: []
-    };
-}
-function emit(report) {
-    console.log(JSON.stringify(report, null, 2));
-    if (!report.ok)
-        process.exitCode = 1;
-}
-//# sourceMappingURL=codex-app-provider-model-ui-check.js.map

package/dist/scripts/codex-app-type-safety-check.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
-await runDirective315Gate('codex-app:type-safety');
-//# sourceMappingURL=codex-app-type-safety-check.js.map

package/dist/scripts/codex-app-ui-clobber-guard-check.js

@@ -1,22 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { codexAppUiMutationAllowed, evaluateCodexAppUiClobberGuard } from '../core/codex-app/codex-app-ui-clobber-guard.js';
-const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-ui-clobber-guard-'));
-await fs.mkdir(path.join(root, '.codex'), { recursive: true });
-await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'sandbox_mode = "workspace-write"\n');
-await fs.writeFile(path.join(root, 'package.json'), '{"scripts":{"postinstall":"node ./dist/bin/sks.js postinstall"}}\n');
-const clean = await evaluateCodexAppUiClobberGuard(root);
-await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model_provider = "codex-lb"\n');
-const badProject = await evaluateCodexAppUiClobberGuard(root);
-const defaultDenied = !codexAppUiMutationAllowed({ kind: 'codex_app_ui_state', scope: 'default' });
-const repairAllowed = codexAppUiMutationAllowed({ kind: 'codex_app_ui_state', scope: 'codex-app-ui-repair', backupPath: path.join(root, 'backup.bak') });
-const ok = clean.ok && !badProject.ok && defaultDenied && repairAllowed;
-emit({ schema: 'sks.codex-app-ui-clobber-guard-check.v1', ok, clean, bad_project: badProject, default_denied: defaultDenied, repair_allowed: repairAllowed, blockers: ok ? [] : ['codex_app_ui_clobber_guard_check_failed'] });
-function emit(report) {
-    console.log(JSON.stringify(report, null, 2));
-    if (!report.ok)
-        process.exitCode = 1;
-}
-//# sourceMappingURL=codex-app-ui-clobber-guard-check.js.map

package/dist/scripts/codex-app-ui-preservation-check.js

@@ -1,137 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// SKS must never remove/block/hide the Codex App UI. normalizeCodexFastModeUiConfig now:
-//   - sets current Codex App feature flags / suppress-warning ONLY IF ABSENT
-//     (never re-enables a feature the user disabled in the App),
-//   - strips legacy [user.fast_mode] and [profiles.sks-fast-high] tables,
-//   - never auto-enables marketplace plugins by default (opt-in SKS_MANAGE_CODEX_APP_PLUGINS=1),
-//   - still seeds defaults on a fresh/empty config (fresh-install enablement preserved).
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const helpers = await importDist('cli/install-helpers.js');
-const normalize = helpers.normalizeCodexFastModeUiConfig;
-function featureValue(text, key) {
-    const lines = String(text).split('\n');
-    const start = lines.findIndex((l) => l.trim() === '[features]');
-    if (start === -1)
-        return undefined;
-    for (let i = start + 1; i < lines.length; i += 1) {
-        if (/^\s*\[.+\]\s*$/.test(lines[i]))
-            break;
-        const m = lines[i].match(new RegExp(`^\\s*${key}\\s*=\\s*(\\S+)`));
-        if (m)
-            return m[1];
-    }
-    return undefined;
-}
-const hasPluginTables = (text) => /\[plugins\."[^"]+"\]/.test(String(text));
-const results = [];
-const prevEnv = process.env.SKS_MANAGE_CODEX_APP_PLUGINS;
-delete process.env.SKS_MANAGE_CODEX_APP_PLUGINS;
-// 1) A current feature the user disabled in the App must stay disabled (no override).
-{
-    const user = '[features]\nhooks = false\nmulti_agent = false\n';
-    const out = normalize(user);
-    const ok = featureValue(out, 'hooks') === 'false' && featureValue(out, 'multi_agent') === 'false';
-    results.push({ case: 'preserves_disabled_features', ok, hooks: featureValue(out, 'hooks') });
-}
-// 1b) Stable host capabilities preserve an explicit user false; only a
-// genuinely removed SKS stamp is stripped.
-{
-    const out = normalize('[features]\nguardian_approval = false\nbrowser_use_external = false\nfast_mode_ui = true\n');
-    const ok = featureValue(out, 'guardian_approval') === 'false'
-        && featureValue(out, 'browser_use_external') === 'false'
-        && featureValue(out, 'fast_mode_ui') === undefined;
-    results.push({ case: 'preserves_stable_and_strips_removed_flags', ok });
-}
-// 2) Default install must NOT auto-enable any marketplace plugins.
-{
-    const out = normalize('model = "future-codex-model"\n');
-    results.push({ case: 'no_plugins_by_default', ok: !hasPluginTables(out) && /model = "future-codex-model"/.test(out) });
-}
-// 3) A user's disabled plugin must be left untouched (not reverted to enabled).
-{
-    const user = '[plugins."chrome@openai-bundled"]\nenabled = false\n';
-    const out = normalize(user);
-    const ok = /\[plugins\."chrome@openai-bundled"\][\s\S]*enabled = false/.test(out);
-    results.push({ case: 'preserves_user_disabled_plugin', ok });
-}
-// 4) suppress_unstable_features_warning is not forced over a user's explicit false.
-{
-    const out = normalize('suppress_unstable_features_warning = false\n');
-    results.push({ case: 'preserves_user_suppress_choice', ok: /suppress_unstable_features_warning = false/.test(out) });
-}
-// 5) Fresh/empty config still gets [features] + hooks and no legacy fast-mode tables.
-{
-    const out = normalize('');
-    const ok = /\[features\]/.test(out)
-        && featureValue(out, 'hooks') === 'true'
-        && featureValue(out, 'multi_agent') === 'true'
-        && featureValue(out, 'fast_mode') === 'true'
-        && featureValue(out, 'computer_use') === 'true'
-        && featureValue(out, 'browser_use') === 'true'
-        && featureValue(out, 'browser_use_external') === 'true'
-        && featureValue(out, 'image_generation') === 'true'
-        && featureValue(out, 'in_app_browser') === 'true'
-        && featureValue(out, 'tool_suggest') === 'true'
-        && featureValue(out, 'plugins') === 'true'
-        && !/\[user\.fast_mode\]/.test(out)
-        && !/\[profiles\.sks-fast-high\]/.test(out)
-        && !/^model\s*=/m.test(out);
-    results.push({ case: 'fresh_config_seeds_defaults', ok });
-}
-// 7) A blank-separated SKS migration block must release only its own native
-// model/reasoning locks. The documented service tier and an unrelated user
-// model selection remain untouched.
-{
-    const migrated = normalize([
-        '# SKS moved machine-local Codex config from .codex/config.toml at 2026-07-11T00:00:00Z',
-        '',
-        'service_tier = "fast"',
-        'model = "gpt-5.6-sol"',
-        'model_reasoning_effort = "ultra"',
-        '',
-        '[features]',
-        'fast_mode = true',
-        ''
-    ].join('\n'));
-    const user = normalize('model = "user-selected-model"\nmodel_reasoning_effort = "low"\nservice_tier = "fast"\n');
-    const ok = !/^model\s*=/m.test(migrated.split(/\n\s*\[/)[0] || '')
-        && !/^model_reasoning_effort\s*=/m.test(migrated.split(/\n\s*\[/)[0] || '')
-        && /^service_tier\s*=\s*"fast"/m.test(migrated)
-        && /^model\s*=\s*"user-selected-model"/m.test(user)
-        && /^model_reasoning_effort\s*=\s*"low"/m.test(user);
-    results.push({ case: 'bounded_sks_mode_lock_provenance', ok });
-}
-// 6) Opt-in enables plugins on a fresh config, but still preserves a user-disabled one.
-{
-    process.env.SKS_MANAGE_CODEX_APP_PLUGINS = '1';
-    const fresh = normalize('model = "future-codex-model"\n');
-    const userDisabled = normalize('[plugins."chrome@openai-bundled"]\nenabled = false\n');
-    delete process.env.SKS_MANAGE_CODEX_APP_PLUGINS;
-    const ok = hasPluginTables(fresh) && /model = "future-codex-model"/.test(fresh) && /\[plugins\."chrome@openai-bundled"\][\s\S]*enabled = false/.test(userDisabled);
-    results.push({ case: 'optin_enables_but_preserves_user', ok });
-}
-if (prevEnv === undefined)
-    delete process.env.SKS_MANAGE_CODEX_APP_PLUGINS;
-else
-    process.env.SKS_MANAGE_CODEX_APP_PLUGINS = prevEnv;
-const ok = results.every((r) => r.ok);
-if (!ok) {
-    console.error(JSON.stringify({ ok: false, message: 'Codex App UI preservation regression failed', results }, null, 2));
-    process.exit(1);
-}
-emitGate('codex-app:ui-preservation', { cases: results.map((r) => r.case) });
-function tableBody(text, table) {
-    const lines = String(text || '').split('\n');
-    const start = lines.findIndex((line) => line.trim() === `[${table}]`);
-    if (start < 0)
-        return '';
-    const body = [];
-    for (let i = start + 1; i < lines.length; i += 1) {
-        if (/^\s*\[.+\]\s*$/.test(lines[i]))
-            break;
-        body.push(lines[i]);
-    }
-    return body.join('\n');
-}
-//# sourceMappingURL=codex-app-ui-preservation-check.js.map

package/dist/scripts/codex-config-eperm-fixture.js

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-const root = process.cwd();
-const fixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-eperm-fixture-'));
-await fs.mkdir(path.join(fixture, '.codex'), { recursive: true });
-await fs.writeFile(path.join(fixture, '.codex', 'config.toml'), 'sandbox_mode = "workspace-write"\n');
-const result = spawnSync(process.execPath, [
-    path.join(root, 'dist', 'scripts', 'codex-config-load-probe.js'),
-    '--root',
-    fixture,
-    '--config',
-    path.join(fixture, '.codex', 'config.toml'),
-    '--codex-bin',
-    path.join(root, 'dist', 'scripts', 'fixtures', 'fake-codex-config-loader.js'),
-    '--json'
-], {
-    cwd: root,
-    env: { ...process.env, SKS_FAKE_CODEX_CONFIG_EPERM: '1' },
-    encoding: 'utf8'
-});
-const report = JSON.parse(result.stdout || '{}');
-const ok = result.status !== 0
-    && report.checks?.find((row) => row.name === 'node_read')?.ok === true
-    && report.blockers?.includes('codex_cli_config_eperm');
-console.log(JSON.stringify({ schema: 'sks.codex-config-eperm-fixture.v1', ok, report }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-//# sourceMappingURL=codex-config-eperm-fixture.js.map

package/dist/scripts/codex-control-capability-check.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-sdk-capability.js');
-const capability = await mod.detectCodexSdkCapability();
-assertGate(capability.ok, 'Codex Control Plane requires Codex SDK capability', capability);
-assertGate(capability.package_name === '@openai/codex-sdk', 'Codex SDK package name mismatch', capability);
-assertGate(capability.dynamic_import_ok === true, 'Codex SDK dynamic import failed', capability);
-emitGate('codex-control:capability', { package_version: capability.package_version, node_version: capability.node_version });
-//# sourceMappingURL=codex-control-capability-check.js.map

package/dist/scripts/codex-control-empty-result-retry-check.js

@@ -1,43 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-reliability-shield.js');
-let attempts = 0;
-const result = await mod.runWithCodexReliabilityShield(baseTask(), async () => {
-    attempts += 1;
-    if (attempts === 1)
-        return { ok: false, events: [], finalResponse: '', structuredOutput: null, blockers: [] };
-    return {
-        ok: true,
-        sdkThreadId: 'sdk-thread-empty-retry',
-        sdkRunId: 'sdk-run-empty-retry',
-        events: [
-            { type: 'thread.started', thread_id: 'sdk-thread-empty-retry' },
-            { type: 'item.completed', item: { type: 'agent_message', text: '{"status":"done"}' } },
-            { type: 'turn.completed' }
-        ],
-        finalResponse: '{"status":"done"}',
-        structuredOutput: { status: 'done' },
-        blockers: []
-    };
-});
-assertGate(attempts === 2, 'empty SDK result must retry once before meaningful output', { attempts, result });
-assertGate(result.reliabilityShield.retry_count === 1, 'retry count mismatch', result.reliabilityShield);
-assertGate(result.reliabilityShield.no_duplicate_streamed_output === true, 'empty retry must not duplicate meaningful output', result.reliabilityShield);
-emitGate('codex-control:empty-result-retry', { attempts, retry_count: result.reliabilityShield.retry_count });
-function baseTask() {
-    return {
-        route: '$Agent',
-        tier: 'worker',
-        missionId: 'M-empty-result-retry',
-        cwd: process.cwd(),
-        prompt: 'empty retry fixture',
-        outputSchemaId: 'sks.agent-worker-result.v1',
-        outputSchema: {},
-        sandboxPolicy: 'read-only',
-        requestedScopeContract: { read_only: true },
-        reliabilityPolicy: { maxEmptyResultRetries: 1, idleTimeoutMs: 5000, timeoutClass: 'short' },
-        mutationLedgerRoot: process.cwd()
-    };
-}
-//# sourceMappingURL=codex-control-empty-result-retry-check.js.map

package/dist/scripts/codex-control-keepalive-no-cot-leak-check.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const shield = await importDist('core/codex-control/codex-reliability-shield.js');
-const translator = await importDist('core/codex-control/codex-event-translator.js');
-const reasoningEvent = { type: 'reasoning.delta', item: { type: 'reasoning', text: 'private reasoning fixture that must not leak' } };
-const heartbeats = shield.buildKeepaliveHeartbeats([reasoningEvent]);
-const translated = translator.translateCodexSdkEvent(reasoningEvent);
-assertGate(heartbeats.length === 1, 'reasoning events must produce keepalive heartbeats', heartbeats);
-assertGate(heartbeats[0].content_redacted === true, 'heartbeat must redact reasoning content', heartbeats);
-assertGate(translated.message_tail === '[thinking]', 'translated reasoning event must show status only', translated);
-assertGate(!JSON.stringify(heartbeats).includes('private reasoning fixture'), 'heartbeat leaked reasoning content', heartbeats);
-emitGate('codex-control:keepalive-no-cot-leak', { heartbeat_count: heartbeats.length, content_redacted: true });
-//# sourceMappingURL=codex-control-keepalive-no-cot-leak-check.js.map

package/dist/scripts/codex-control-model-capacity-fallback-check.js

@@ -1,53 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist, readText } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-reliability-shield.js');
-let attempts = 0;
-const seenAttempts = [];
-const result = await mod.runWithCodexReliabilityShield(baseTask(), async (attempt) => {
-    attempts += 1;
-    seenAttempts.push(attempt);
-    return {
-        ok: false,
-        sdkThreadId: '',
-        sdkRunId: null,
-        events: [{ type: 'turn.failed', message: 'Selected model is at capacity. Please try a different model.' }],
-        finalResponse: '',
-        structuredOutput: null,
-        blockers: ['Selected model is at capacity. Please try a different model.']
-    };
-});
-assertGate(attempts === 1, 'model capacity must not retry with downgraded pressure', { attempts, seenAttempts, result });
-assertGate(result.reliabilityShield.ok === false, 'terminal model capacity must remain visible as a blocker', result.reliabilityShield);
-assertGate(result.reliabilityShield.retry_count === 0, 'capacity retry count must stay zero', result.reliabilityShield);
-assertGate(result.reliabilityShield.model_capacity_retry_count === 0, 'model capacity retry must not be counted', result.reliabilityShield);
-assertGate(result.reliabilityShield.selected_model_capacity_fallback === false, 'capacity fallback flag must not be selected', result.reliabilityShield);
-assertGate(result.reliabilityShield.attempts[0].retryable === false, 'capacity attempt must be terminal', result.reliabilityShield.attempts[0]);
-assertGate(result.reliabilityShield.attempts[0].retry_reason === null, 'capacity retry reason must stay null', result.reliabilityShield.attempts[0]);
-assertGate(result.reliabilityShield.attempts[0].blockers.includes('codex_model_capacity_unavailable'), 'capacity blocker must be explicit', result.reliabilityShield.attempts[0]);
-assertGate(mod.isCodexModelCapacityError({ blockers: ['Selected model is at capacity. Please try a different model.'] }, []) === true, 'capacity classifier must recognize common Codex error text');
-const runnerSource = readText('src/core/codex-control/codex-task-runner.ts');
-assertGate(!runnerSource.includes("capacity_fallback_service_tier: 'standard'"), 'capacity fallback must not force standard service tier');
-assertGate(!runnerSource.includes("capacity_fallback_reasoning_effort: 'low'"), 'capacity fallback must not force low reasoning');
-assertGate(!runnerSource.includes('SKS_CODEX_CAPACITY_FALLBACK_MODEL'), 'capacity fallback model override must be removed');
-emitGate('codex-control:model-capacity-fallback', {
-    attempts,
-    retry_count: result.reliabilityShield.retry_count,
-    model_capacity_retry_count: result.reliabilityShield.model_capacity_retry_count
-});
-function baseTask() {
-    return {
-        route: '$Agent',
-        tier: 'worker',
-        missionId: 'M-model-capacity-fallback',
-        cwd: process.cwd(),
-        prompt: 'model capacity fallback fixture',
-        outputSchemaId: 'sks.agent-worker-result.v1',
-        outputSchema: {},
-        sandboxPolicy: 'read-only',
-        requestedScopeContract: { read_only: true },
-        reliabilityPolicy: { maxEmptyResultRetries: 1, idleTimeoutMs: 5000, timeoutClass: 'short' },
-        mutationLedgerRoot: process.cwd()
-    };
-}
-//# sourceMappingURL=codex-control-model-capacity-fallback-check.js.map

package/dist/scripts/codex-control-no-legacy-fallback-check.js

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, readText, root } from './sks-1-18-gate-lib.js';
-const runtimeFiles = [
-    'src/core/agents/agent-orchestrator.ts',
-    'src/core/agents/native-worker-backend-router.ts',
-    'src/core/commands/team-command.ts',
-    'src/core/commands/qa-loop-command.ts',
-    'src/core/commands/research-command.ts',
-    'src/core/commands/naruto-command.ts',
-    'src/core/commands/mad-sks-command.ts'
-];
-const violations = [];
-for (const file of runtimeFiles) {
-    const text = readText(file);
-    if (text.includes("runCodexExecAgent"))
-        violations.push(`${file}:runCodexExecAgent`);
-    if (text.includes("mock ? 'fake' : 'codex-exec'"))
-        violations.push(`${file}:legacy-default`);
-    if (text.includes('codex-exec|fake'))
-        violations.push(`${file}:legacy-help`);
-}
-const controlFiles = fs.readdirSync(path.join(root, 'src', 'core', 'codex-control'));
-assertGate(controlFiles.includes('codex-control-plane.ts'), 'Codex Control Plane source missing');
-assertGate(controlFiles.includes('codex-reliability-shield.ts'), 'Codex Reliability Shield source missing');
-assertGate(readText('src/core/agents/native-worker-backend-router.ts').includes("legacy_codex_exec_runtime_removed"), 'explicit codex-exec request must block');
-assertGate(violations.length === 0, 'legacy Codex exec fallback still reachable', { violations });
-emitGate('codex-control:no-legacy-fallback', { checked_files: runtimeFiles.length });
-//# sourceMappingURL=codex-control-no-legacy-fallback-check.js.map

package/dist/scripts/codex-control-side-effect-scope-check.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-sdk-sandbox-policy.js');
-const base = {
-    route: '$Agent',
-    tier: 'worker',
-    missionId: 'M-control-side-effect',
-    cwd: process.cwd(),
-    prompt: 'side-effect scope fixture',
-    outputSchemaId: 'sks.agent-worker-result.v1',
-    outputSchema: {},
-    mutationLedgerRoot: process.cwd()
-};
-const readOnly = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'read-only', requestedScopeContract: { read_only: true } });
-const emptyWriteScope = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'workspace-write', requestedScopeContract: { read_only: false, allowed_paths: [], write_paths: [] } });
-const workspaceScoped = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'workspace-write', requestedScopeContract: { read_only: false, allowed_paths: ['src/core'], write_paths: ['src/core'] } });
-const fullBlocked = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'full-access', requestedScopeContract: { read_only: false, user_confirmed_full_access: true, mad_sks_authorized: false } });
-const fullMad = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'full-access', requestedScopeContract: { read_only: false, user_confirmed_full_access: true, mad_sks_authorized: true } });
-assertGate(readOnly.ok && readOnly.sandboxMode === 'read-only', 'read-only sandbox mapping failed', readOnly);
-assertGate(emptyWriteScope.ok && emptyWriteScope.sandboxMode === 'read-only', 'workspace-write without scoped paths must downgrade to read-only', emptyWriteScope);
-assertGate(workspaceScoped.ok && workspaceScoped.sandboxMode === 'workspace-write', 'workspace-write scoped mapping failed', workspaceScoped);
-assertGate(!fullBlocked.ok && fullBlocked.blockers.includes('codex_sdk_full_access_requires_explicit_mad_scope'), 'full-access must require explicit MAD scope', fullBlocked);
-assertGate(fullMad.ok && fullMad.sandboxMode === 'danger-full-access', 'MAD-scoped full access must map to danger-full-access', fullMad);
-emitGate('codex-control:side-effect-scope', { read_only: true, workspace_scope_required: true, mad_full_access_required: true });
-//# sourceMappingURL=codex-control-side-effect-scope-check.js.map

package/dist/scripts/codex-control-stream-idle-watchdog-check.js

@@ -1,34 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-reliability-shield.js');
-const policy = { maxEmptyResultRetries: 1, idleTimeoutMs: 1000, timeoutClass: 'short' };
-const idleBeforeOutput = mod.evaluateCodexReliabilityAttempt({ ok: false, finalResponse: '', structuredOutput: null, blockers: [] }, [
-    { type: 'thread.started', ts: '2026-06-03T00:00:00.000Z' },
-    { type: 'turn.started', ts: '2026-06-03T00:00:02.500Z' }
-], policy, 1);
-const idleAfterPartial = mod.evaluateCodexReliabilityAttempt({ ok: false, finalResponse: 'partial', structuredOutput: null, blockers: [] }, [
-    { type: 'thread.started', ts: '2026-06-03T00:00:00.000Z' },
-    { type: 'item.completed', ts: '2026-06-03T00:00:00.100Z', item: { type: 'agent_message', text: 'partial' } },
-    { type: 'turn.started', ts: '2026-06-03T00:00:02.500Z' }
-], policy, 1);
-const gitStatusTextInStructuredOutput = mod.evaluateCodexReliabilityAttempt({
-    ok: true,
-    finalResponse: '{"status":"done","findings":["git status reported fatal: not a git repository"],"blockers":[]}',
-    structuredOutput: { status: 'done', findings: ['git status reported fatal: not a git repository'], blockers: [] },
-    blockers: []
-}, [
-    { type: 'thread.started', ts: '2026-06-03T00:00:00.000Z' },
-    { type: 'item.completed', ts: '2026-06-03T00:00:00.100Z', item: { type: 'agent_message', text: '{"status":"done","findings":["git status reported fatal: not a git repository"],"blockers":[]}' } },
-    { type: 'turn.completed', ts: '2026-06-03T00:00:00.200Z' }
-], policy, 1);
-const realSdkFatalEvent = mod.evaluateCodexReliabilityAttempt({ ok: false, finalResponse: '', structuredOutput: null, blockers: [] }, [
-    { type: 'thread.started', ts: '2026-06-03T00:00:00.000Z' },
-    { type: 'turn.failed', ts: '2026-06-03T00:00:00.200Z', error: { message: 'fatal sdk transport failure' } }
-], policy, 1);
-assertGate(idleBeforeOutput.retryable === true && idleBeforeOutput.retry_reason === 'stream_idle_before_meaningful_event', 'idle before output must be retryable', idleBeforeOutput);
-assertGate(idleAfterPartial.retryable === false && idleAfterPartial.blockers.includes('codex_reliability_idle_after_partial_output'), 'idle after partial output must block', idleAfterPartial);
-assertGate(gitStatusTextInStructuredOutput.fatal_error === false && gitStatusTextInStructuredOutput.blockers.length === 0, 'structured output text must not be treated as SDK fatal error', gitStatusTextInStructuredOutput);
-assertGate(realSdkFatalEvent.fatal_error === true && realSdkFatalEvent.blockers.includes('codex_reliability_fatal_error_no_retry'), 'real SDK fatal event must still block', realSdkFatalEvent);
-emitGate('codex-control:stream-idle-watchdog', { retryable_before_output: true, blocks_after_partial: true, ignores_structured_text_fatal: true, blocks_real_sdk_fatal: true });
-//# sourceMappingURL=codex-control-stream-idle-watchdog-check.js.map