sneakoscope 7.0.2 → 7.0.3

package/dist/scripts/gate-policy-audit-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
@@ -21,6 +20,7 @@ const splitReviewFiles = [
 const policyCallsiteAllowlist = new Map([
     ['codex_config_write|src/cli/install-helpers-codex-lb-selftest-chain.ts|runCodexLbLaunchChainSelftest|writeTextAtomic', 'isolated launch-chain selftest config'],
     ['codex_config_write|src/cli/install-helpers-codex-lb-selftest.ts|selftestCodexLb|writeTextAtomic', 'isolated Codex LB selftest config'],
+    ['mkdtemp|src/core/codex-control/codex-sdk-env-policy.ts|prepareNativeCodexAuthBridge|mkdtemp', 'identity-checked 0700 OAuth bridge root with explicit cleanup proof'],
     ['mkdtemp|src/core/mcp-config/codex-cli-adapter.ts|CodexMcpCliAdapter|mkdtemp', 'isolated official CLI transform HOME'],
     ['mkdtemp|src/core/perf/release-latency-slo.ts|runReleaseLatencySlo|mkdtemp', 'run-local latency fixture root'],
     ['mkdtemp|src/core/release/npm-stage-tarball-verifier.ts|verifyNpmStageTarball|mkdtempSync', 'private stage-review transaction root'],

package/dist/scripts/geo-claim-evidence-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';

package/dist/scripts/geo-cli-blackbox-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, runSks, runSksJson } from './search-visibility-gate-lib.js';
 const commands = runSksJson(['commands', '--json']).json;
 assertGate(commands.commands.some((row) => row.name === 'seo-geo-optimizer' && /unified SEO\/GEO optimizer/i.test(row.description)), 'commands --json must expose seo-geo-optimizer');

package/dist/scripts/geo-crawler-policy-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
 const fixture = makeSearchVisibilityFixture('geo-crawlers');
 const audit = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'geo', '--root', fixture, '--target', 'package', '--offline', '--json']).json;

package/dist/scripts/git-worktree-diff-envelope-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const envelopeMod = await importDist('core/git/git-worktree-patch-envelope.js');
 const schemaMod = await importDist('core/agents/agent-patch-schema.js');

package/dist/scripts/git-worktree-dirty-lock-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/git-worktree-dirty-main-detection-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';

package/dist/scripts/git-worktree-integration-primary-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/git-worktree-manifest-append-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/git-worktree-untracked-diff-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/high-risk-contracts-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/hook-latency-budget-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import os from 'node:os';

package/dist/scripts/hook-latency-quantum-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/image-artifact-path-contract-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/imagegen-real-smoke-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';

package/dist/scripts/import-graph-budget-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const { writeImportGraphBudgetReport } = await importDist('core/perf/import-graph-budget.js');
 const report = await writeImportGraphBudgetReport(root);

package/dist/scripts/installed-package-smoke-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const { runInstalledPackageSmoke } = await importDist('core/install/installed-package-smoke.js');
 const report = await runInstalledPackageSmoke(root, {

package/dist/scripts/legacy-gate-purge-check.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 import fs from 'node:fs';
 import { assertGate, emitGate, readText, root } from './sks-1-18-gate-lib.js';
 const registry = readText('src/cli/command-registry.ts');

package/dist/scripts/lib/codex-sdk-gate-lib.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { tmpdir } from '../../core/fsx.js';
@@ -17,8 +16,6 @@ export async function runFakeCodexSdkTaskFixture(label = 'fixture', extra = {})
     const old = snapshotEnv();
     process.env.NODE_ENV = 'test';
     process.env.SKS_CODEX_SDK_FAKE = '1';
-    // Hermetic fixture runs must not inherit an operator's live codex-lb
-    // selection. The fake adapter exercises control-plane contracts only.
     process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
     try {
         const result = await mod.runCodexTask({

package/dist/scripts/lib/ensure-dist-fresh.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';

package/dist/scripts/lib/valid-png-fixture.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/local-collab-all-pipelines-final-gpt-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
 const finalizer = await importDist('core/pipeline/finalize-pipeline-result.js');
 const blocked = await finalizer.finalizePipelineResult({

package/dist/scripts/loop-directive-check-lib.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/loop-worker-fixture-child.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import path from 'node:path';
 const intakePath = process.argv[2];

package/dist/scripts/mad-preflight-blocks-unreadable-config-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -12,8 +11,6 @@ const preflightMod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'cor
 const readabilityMod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'core', 'codex', 'codex-config-readability.js')).href);
 const initMod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'core', 'init.js')).href);
 const fakeCodex = path.join(repoRoot, 'dist', 'scripts', 'fixtures', 'fake-codex-config-loader.js');
-// Case 1: an EXISTING but unreadable (EPERM) config MUST still block the launch — the
-// fresh-project bootstrap must never mask a genuine permission/EPERM problem.
 const epermFixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-preflight-eperm-'));
 await fs.mkdir(path.join(epermFixture, '.codex'), { recursive: true });
 await fs.mkdir(path.join(epermFixture, '.sneakoscope', 'reports'), { recursive: true });
@@ -30,19 +27,12 @@ if (oldEperm === undefined)
 else
     process.env.SKS_FAKE_CODEX_CONFIG_EPERM = oldEperm;
 const epermOk = epermReport.ok === false && epermReport.blockers.includes('codex_cli_config_eperm');
-// Case 2 (de-noise): a MISSING config must report only the honest missing_config /
-// missing_codex_dir blockers, NOT a cascade of macos_acl_ls_le_failed /
-// macos_flags_ls_lO_failed / spawned_child_read_failed from running file checks on a
-// nonexistent path.
 const missingFixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-preflight-missing-'));
 const missingReport = await readabilityMod.inspectCodexConfigReadability(missingFixture, { writeReport: false });
 const noiseBlockers = ['macos_acl_ls_le_failed', 'macos_flags_ls_lO_failed', 'spawned_child_read_failed', 'config_lstat_failed', 'config_stat_failed'];
 const denoiseOk = missingReport.ok === false
     && missingReport.blockers.includes('missing_config')
     && noiseBlockers.every((b) => !missingReport.blockers.includes(b));
-// Case 3 (bootstrap recovers): after regenerating the managed config in the same fresh
-// project (what `sks --mad` now does automatically), readability must pass with no
-// missing/cascade config blocker.
 await initMod.initProject(missingFixture, { installScope: 'global', globalCommand: 'sks' });
 const afterReport = await readabilityMod.inspectCodexConfigReadability(missingFixture, { writeReport: false });
 const bootstrapOk = afterReport.ok === true

package/dist/scripts/mad-sks-sql-plane-lifecycle-hook-decision-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/mad-sks-sql-plane-result-lifecycle-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/mcp-plugin-inventory-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 process.env.SKS_CODEX_0138_FAKE = '1';
 process.env.SKS_CODEX_PLUGIN_JSON_FAKE = '1';

package/dist/scripts/mcp-tool-naming-parity-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';

package/dist/scripts/model-call-concurrency-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/mutation-callsite-coverage-check.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// Repo-wide risky mutation callsite gate. Every raw mutation must be either a
-// guarded call or an external allowlist entry with a concrete function/symbol and
-// reason. The allowlist is intentionally data, not code, so unused/stale entries
-// fail the release gate.
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';

package/dist/scripts/naruto-codex-e2e-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/naruto-worktree-coding-blackbox.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/official-subagent-workflow-check.js

@@ -110,9 +110,11 @@ try {
     });
     assertGate(failedResultText.ok === false && failedResultText.failed_thread_ids.includes('a2'), 'unambiguous failed result text must override a contradictory completed claim', failedResultText);
     let nestedLaunch = false;
+    const appPreparationPrompt = 'Review repository code and report findings.';
     const appResult = await runOfficialSubagentWorkflow({
         root,
-        prompt,
+        goal: appPreparationPrompt,
+        prompt: appPreparationPrompt,
         requestedSubagents: 3,
         maxThreads: 12,
         appSession: true,

package/dist/scripts/ops-diagnostics-bundle-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 import { buildOpsDiagnosticsBundle, writeOpsDiagnosticsBundle } from '../core/ops/diagnostics-bundle.js';
 const report = await buildOpsDiagnosticsBundle(root);

package/dist/scripts/packlist-performance-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -9,13 +8,12 @@ import { npmPackAtomicTempPaths, writeNpmPackProof } from '../core/release/npm-p
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const MAX_FILES = Number(process.env.SKS_MAX_PACK_FILES || 2100);
 const MAX_UNPACKED = Number(process.env.SKS_MAX_UNPACKED_BYTES || DEFAULT_MAX_UNPACKED_BYTES);
-// Shared measured budgets stay centralized and intentionally narrow.
 const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || DEFAULT_MAX_PACK_BYTES);
 const SURFACE_MAX_PACKED = Number(process.env.SKS_PACKAGE_SURFACE_MAX_PACK_BYTES || 25_000_000);
 const SURFACE_MAX_FILES = Number(process.env.SKS_PACKAGE_SURFACE_MAX_FILES || 2500);
 const MAX_ATOMIC_TEMP_PACK_ATTEMPTS = 4;
 function runNpmPack() {
-    const npmCli = process.env.npm_execpath; // set when invoked via `npm run`
+    const npmCli = process.env.npm_execpath;
     const npmCache = process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache');
     fs.mkdirSync(npmCache, { recursive: true });
     const argv = ['pack', '--dry-run', '--ignore-scripts', '--json'];

package/dist/scripts/perf-budget-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';

package/dist/scripts/ppt-full-e2e-blackbox-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/ppt-real-export-adapter-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('ppt:real-export-adapter', 'src/core/ppt-review/slide-exporter.ts', [
     'soffice',

package/dist/scripts/ppt-real-imagegen-smoke-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { spawnSync } from 'node:child_process';
 import { osTempPngFixtureArg } from './lib/valid-png-fixture.js';
 const enabled = process.env.SKS_TEST_REAL_IMAGEGEN === '1' || process.env.SKS_REAL_IMAGEGEN === '1';

package/dist/scripts/ppt-real-imagegen-wiring-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('ppt:real-imagegen-wiring', 'src/core/ppt-review/slide-imagegen-review.ts', [
     'generateGptImage2CalloutReview',

package/dist/scripts/ppt-reexport-rereview-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('ppt:reexport-rereview', 'src/core/commands/ppt-command.ts', [
     'attach-fixed-deck',

package/dist/scripts/prepublish-fast-check.js

@@ -1,13 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// Fast prepublish eligibility check. Self-contained: reads the existing release
-// stamp written by dist/scripts/release-check-stamp.js and decides whether the cheap
-// fast-path (no full release:check rebuild) is eligible by comparing only the
-// lightweight comparators it can recompute without a build.
-//
-// Output: a single JSON line on stdout (schema sks.prepublish-fast-check.v1).
-// Exit 0 when the fast path is eligible; exit 1 otherwise (incl. no stamp).
-// Tolerant of missing stamp fields; only compares fields present in the stamp.
 import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
@@ -24,7 +15,6 @@ function safeGitCommit() {
             return String(result.stdout || '').trim() || null;
     }
     catch {
-        // git unavailable; commit comparison is informational only.
     }
     return null;
 }
@@ -37,7 +27,6 @@ function packageFilesListHash(pkg) {
     return sha256(JSON.stringify(files));
 }
 function main() {
-    // No stamp -> not eligible; print and exit 1.
     if (!fs.existsSync(stampPath)) {
         console.log(JSON.stringify({ ok: false, reason: 'no_release_stamp', hint: 'run npm run release:check:full' }));
         process.exit(1);
@@ -65,7 +54,6 @@ function main() {
     const gitCommit = safeGitCommit();
     const mismatched = [];
     const reasons = [];
-    // Always-compared comparator: package version.
     if (Object.prototype.hasOwnProperty.call(stamp, 'package_version')) {
         if (stamp.package_version !== currentVersion) {
             mismatched.push('package_version');
@@ -76,14 +64,12 @@ function main() {
         mismatched.push('package_version');
         reasons.push('package_version: absent from stamp');
     }
-    // Compared only if the stamp carries it.
     if (Object.prototype.hasOwnProperty.call(stamp, 'package_json_sha256')) {
         if (stamp.package_json_sha256 !== currentPkgSha) {
             mismatched.push('package_json_sha256');
             reasons.push(`package_json_sha256: stamp=${stamp.package_json_sha256 ?? 'missing'} current=${currentPkgSha}`);
         }
     }
-    // package.files list hash: informational unless the stamp recorded one.
     if (Object.prototype.hasOwnProperty.call(stamp, 'package_files_list_sha256')) {
         if (stamp.package_files_list_sha256 !== currentFilesHash) {
             mismatched.push('package_files_list_sha256');
@@ -91,9 +77,6 @@ function main() {
         }
     }
     if (Object.prototype.hasOwnProperty.call(stamp, 'package_files_sha256')) {
-        // Full package file hashing is owned by release-check-stamp.js; this check
-        // confirms the fast stamp carries the comparator and leaves exact matching to
-        // `release-check-stamp verify`.
         if (!stamp.package_files_sha256) {
             mismatched.push('package_files_sha256');
             reasons.push('package_files_sha256: absent from stamp');
@@ -103,12 +86,6 @@ function main() {
         mismatched.push('release_gate_sha256');
         reasons.push('release_gate_sha256: absent from stamp');
     }
-    // git_commit is provenance, not a freshness comparator. A valid release flow often
-    // runs release:check, commits the exact checked tree, then publishes from that new
-    // commit. In that case the tree/package/dist hashes still prove freshness, while
-    // comparing HEAD to the pre-commit stamp would block a good publish. The stricter
-    // `release-check-stamp verify` that follows this fast check owns the content
-    // comparators; keep the current commit visible in this report for audit only.
     const stampedGitCommit = Object.prototype.hasOwnProperty.call(stamp, 'git_commit') ? stamp.git_commit || null : null;
     const eligible = mismatched.length === 0;
     console.log(JSON.stringify({

package/dist/scripts/prepublish-release-check-or-fast.js

@@ -1,11 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// Publish-time release stamp verifier and prepack build bridge.
-//
-// `npm publish` verifies the authoritative release stamp before prepack, rebuilds
-// dist through the normal prepack lifecycle, then verifies the same stamp again
-// before npm creates the publish tarball. Ordinary `npm pack` keeps build-only
-// behavior and does not require release authorization.
 import { spawnSync } from 'node:child_process';
 import process from 'node:process';
 const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';

package/dist/scripts/probe-memoization-check.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
 import { importDist } from './sks-1-18-gate-lib.js';
 const tmp = await makeTempRoot('probe-memo-');

package/dist/scripts/product-design-plugin-routing-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { PRODUCT_DESIGN_PIPELINE_STAGES, PRODUCT_DESIGN_PLUGIN, PRODUCT_DESIGN_REQUIRED_SKILLS, normalizeProductDesignPluginEvidence, productDesignPluginVisibilityFromCodexPluginList } from '../core/product-design-plugin.js';
 import { assertGate, emitGate, readText, releaseGateIds } from './lib/codex-sdk-gate-lib.js';
 const routesSource = readText('src/core/routes.ts');

package/dist/scripts/project-skill-dedupe-blackbox.js

@@ -1,20 +1,25 @@
 #!/usr/bin/env node
 import path from 'node:path';
 import fs from 'node:fs/promises';
-import { assertGate, emitGate, makeTempRoot, writeManagedCoreSkill, writeUserSkill } from './sks-3-1-8-check-lib.js';
+import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
 import { dedupeProjectSkills } from '../core/codex-native/project-skill-dedupe.js';
 import { syncCodexSksSkills, withSkillSyncLock } from '../core/codex-app/codex-skill-sync.js';
 import { buildSkillRegistryLedger } from '../core/codex-native/skill-registry-ledger.js';
+const removeFixture = fs.rm.bind(fs);
 const root = await makeTempRoot('sks-skill-dedupe-blackbox-');
-process.env.CODEX_HOME = path.join(root, 'codex-home');
-await writeManagedCoreSkill(root, '.agents/skills', 'loop');
-await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const home = await makeTempRoot('sks-skill-dedupe-home-');
+process.env.HOME = home;
+process.env.CODEX_HOME = path.join(home, '.codex');
+await writeManagedFixture(home, '.agents/skills', 'managed-loop');
+await writeManagedFixture(root, '.agents/skills', 'managed-loop');
+await writeManagedFixture(root, '.codex/skills', 'managed-loop');
 const scenarioA = await dedupeProjectSkills({ root, fix: true, yes: true });
-await writeUserSkill(root, '.agents/skills', 'user-loop', 'loop');
-await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+await writeUserSkill(root, '.agents/skills', 'user-loop', 'fixture-loop');
+await writeManagedFixture(root, '.codex/skills', 'managed-loop');
 const scenarioB = await dedupeProjectSkills({ root, fix: true, yes: true });
-await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Loop');
-await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'loop');
+await guardedRm(path.join(home, '.agents', 'skills', 'managed-loop'), path.join(home, '.agents', 'skills'));
+await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Fixture Loop');
+await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'fixture_loop');
 const scenarioC = await dedupeProjectSkills({ root, fix: true, yes: false });
 const scenarioD = await dedupeProjectSkills({ root, fix: true, yes: true, quarantineUserDuplicates: true });
 const staleRoot = await makeTempRoot('sks-skill-stale-lock-');
@@ -23,7 +28,9 @@ await fs.mkdir(lockPath, { recursive: true });
 await fs.writeFile(path.join(lockPath, 'owner.json'), JSON.stringify({ schema: 'sks.skill-sync-lock.v1', pid: 999999, acquired_at: '1970-01-01T00:00:00.000Z', stale_after_ms: 1 }), 'utf8');
 await withSkillSyncLock(staleRoot, async () => undefined);
 const concurrentRoot = await makeTempRoot('sks-skill-concurrent-');
-process.env.CODEX_HOME = path.join(concurrentRoot, 'codex-home');
+const concurrentHome = await makeTempRoot('sks-skill-concurrent-home-');
+process.env.HOME = concurrentHome;
+process.env.CODEX_HOME = path.join(concurrentHome, '.codex');
 const skillsRoot = path.join(process.env.CODEX_HOME, 'skills');
 await Promise.all(Array.from({ length: 20 }, () => syncCodexSksSkills({ root: concurrentRoot, apply: true, skillsRoot })));
 const concurrentLedger = await buildSkillRegistryLedger({ root: concurrentRoot });
@@ -33,3 +40,23 @@ assertGate(scenarioC.blockers.some((blocker) => blocker.includes('user_duplicate
 assertGate(scenarioD.active_unique_by_canonical_name === true, 'scenario D must quarantine confirmed user-authored duplicate', scenarioD);
 assertGate(concurrentLedger.active_unique_by_canonical_name === true, 'scenario F must keep exactly one active canonical name after concurrent sync', concurrentLedger);
 emitGate('skill:dedupe-blackbox');
+async function writeManagedFixture(root, relRoot, dirName) {
+    await writeText(path.join(root, relRoot, dirName, 'SKILL.md'), [
+        '---',
+        'name: fixture-loop',
+        'description: managed fixture',
+        '---',
+        '',
+        '<!-- BEGIN SKS MANAGED SKILL v-test name=fixture-loop -->',
+        ''
+    ].join('\n'));
+}
+async function guardedRm(target, allowedRoot) {
+    const root = path.resolve(allowedRoot);
+    const resolved = path.resolve(target);
+    const relative = path.relative(root, resolved);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error('refusing_to_remove_unscoped_skill_fixture');
+    }
+    await removeFixture(resolved, { recursive: true, force: true });
+}

package/dist/scripts/prompt-placeholder-guard-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const guardMod = await importDist('core/prompt/prompt-placeholder-guard.js');
 const blocked = guardMod.checkPromptPlaceholders({

package/dist/scripts/python-codex-sdk-all-pipelines-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -15,8 +14,6 @@ const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-python-codex-sdk-pipeli
 const oldFake = process.env.SKS_PYTHON_CODEX_SDK_FAKE;
 const oldCodexLbAutobypass = process.env.SKS_CODEX_LB_AUTOBYPASS;
 process.env.SKS_PYTHON_CODEX_SDK_FAKE = '1';
-// Keep the hermetic fake backend independent from an operator's live
-// codex-lb configuration. This fixture validates the Python SDK pipeline only.
 process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
 try {
     const result = await mod.runCodexTask({

package/dist/scripts/qa-loop-app-handoff-capability-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 const handoff = readText('src/core/codex-app/codex-app-handoff.ts');

package/dist/scripts/qa-loop-app-handoff-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 const core = readText('src/core/qa-loop.ts');

package/dist/scripts/qa-loop-app-handoff-cli-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('[--app-handoff] [--app-handoff-required]') && command.includes('status <mission-id|latest> [--desktop]'), 'QA-LOOP help must expose app handoff run/status flags');

package/dist/scripts/qa-loop-app-handoff-confirmation-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/qa-loop-app-handoff-gate-lifecycle-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/qa-loop-app-handoff-launch-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('--app-handoff-launch') && command.includes('--app-handoff-artifact-only') && command.includes('launch_mode'), 'QA-LOOP must expose launch/artifact-only handoff flags and pass launch_mode');

package/dist/scripts/qa-loop-app-handoff-status-lifecycle-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('desktop_app_confirmation') && command.includes('desktop_review_complete') && command.includes('launch:'), 'QA status --desktop must include handoff launch, confirmation, and complete lifecycle');