sneakoscope 7.0.2 → 7.0.5

package/dist/scripts/loop-worker-fixture-child.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import path from 'node:path';
 const intakePath = process.argv[2];

package/dist/scripts/mad-preflight-blocks-unreadable-config-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -12,8 +11,6 @@ const preflightMod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'cor
 const readabilityMod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'core', 'codex', 'codex-config-readability.js')).href);
 const initMod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'core', 'init.js')).href);
 const fakeCodex = path.join(repoRoot, 'dist', 'scripts', 'fixtures', 'fake-codex-config-loader.js');
-// Case 1: an EXISTING but unreadable (EPERM) config MUST still block the launch — the
-// fresh-project bootstrap must never mask a genuine permission/EPERM problem.
 const epermFixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-preflight-eperm-'));
 await fs.mkdir(path.join(epermFixture, '.codex'), { recursive: true });
 await fs.mkdir(path.join(epermFixture, '.sneakoscope', 'reports'), { recursive: true });
@@ -30,19 +27,12 @@ if (oldEperm === undefined)
 else
     process.env.SKS_FAKE_CODEX_CONFIG_EPERM = oldEperm;
 const epermOk = epermReport.ok === false && epermReport.blockers.includes('codex_cli_config_eperm');
-// Case 2 (de-noise): a MISSING config must report only the honest missing_config /
-// missing_codex_dir blockers, NOT a cascade of macos_acl_ls_le_failed /
-// macos_flags_ls_lO_failed / spawned_child_read_failed from running file checks on a
-// nonexistent path.
 const missingFixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-preflight-missing-'));
 const missingReport = await readabilityMod.inspectCodexConfigReadability(missingFixture, { writeReport: false });
 const noiseBlockers = ['macos_acl_ls_le_failed', 'macos_flags_ls_lO_failed', 'spawned_child_read_failed', 'config_lstat_failed', 'config_stat_failed'];
 const denoiseOk = missingReport.ok === false
     && missingReport.blockers.includes('missing_config')
     && noiseBlockers.every((b) => !missingReport.blockers.includes(b));
-// Case 3 (bootstrap recovers): after regenerating the managed config in the same fresh
-// project (what `sks --mad` now does automatically), readability must pass with no
-// missing/cascade config blocker.
 await initMod.initProject(missingFixture, { installScope: 'global', globalCommand: 'sks' });
 const afterReport = await readabilityMod.inspectCodexConfigReadability(missingFixture, { writeReport: false });
 const bootstrapOk = afterReport.ok === true

package/dist/scripts/mad-sks-sql-plane-lifecycle-hook-decision-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/mad-sks-sql-plane-result-lifecycle-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/mcp-plugin-inventory-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 process.env.SKS_CODEX_0138_FAKE = '1';
 process.env.SKS_CODEX_PLUGIN_JSON_FAKE = '1';

package/dist/scripts/mcp-tool-naming-parity-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';

package/dist/scripts/model-call-concurrency-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/mutation-callsite-coverage-check.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// Repo-wide risky mutation callsite gate. Every raw mutation must be either a
-// guarded call or an external allowlist entry with a concrete function/symbol and
-// reason. The allowlist is intentionally data, not code, so unused/stale entries
-// fail the release gate.
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';

package/dist/scripts/naruto-codex-e2e-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/naruto-worktree-coding-blackbox.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/official-subagent-workflow-check.js

@@ -16,7 +16,7 @@ assertGate(implicitCount.requestedSubagents === 2, 'implicit Naruto must default
 assertGate(counts[0]?.requestedSubagents === 4, 'requested 4 must remain 4', counts);
 assertGate(counts[1]?.requestedSubagents === 8, 'requested 8 must remain 8', counts);
 assertGate(counts[2]?.requestedSubagents === 12, 'requested 12 must remain 12', counts);
-assertGate(counts[3]?.requestedSubagents === 20 && counts[3]?.firstWave === 10 && counts[3]?.waveCount === 2, 'requested 20/maxThreads 12 must reserve parent/reviewer capacity and plan two waves', counts);
+assertGate(counts[3]?.requestedSubagents === 20 && counts[3]?.firstWave === 11 && counts[3]?.waveCount === 2, 'requested 20/maxThreads 12 must reserve parent capacity and plan two waves', counts);
 assertGate(counts[4]?.requestedSubagents === 32, 'requested 100 must use the official hard safety cap 32', counts);
 const prompt = buildOfficialSubagentPrompt({
     goal: 'Review independent packages and report one parent summary.',
@@ -110,9 +110,11 @@ try {
     });
     assertGate(failedResultText.ok === false && failedResultText.failed_thread_ids.includes('a2'), 'unambiguous failed result text must override a contradictory completed claim', failedResultText);
     let nestedLaunch = false;
+    const appPreparationPrompt = 'Review repository code and report findings.';
     const appResult = await runOfficialSubagentWorkflow({
         root,
-        prompt,
+        goal: appPreparationPrompt,
+        prompt: appPreparationPrompt,
         requestedSubagents: 3,
         maxThreads: 12,
         appSession: true,

package/dist/scripts/ops-diagnostics-bundle-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 import { buildOpsDiagnosticsBundle, writeOpsDiagnosticsBundle } from '../core/ops/diagnostics-bundle.js';
 const report = await buildOpsDiagnosticsBundle(root);

package/dist/scripts/packlist-performance-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -9,13 +8,12 @@ import { npmPackAtomicTempPaths, writeNpmPackProof } from '../core/release/npm-p
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const MAX_FILES = Number(process.env.SKS_MAX_PACK_FILES || 2100);
 const MAX_UNPACKED = Number(process.env.SKS_MAX_UNPACKED_BYTES || DEFAULT_MAX_UNPACKED_BYTES);
-// Shared measured budgets stay centralized and intentionally narrow.
 const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || DEFAULT_MAX_PACK_BYTES);
 const SURFACE_MAX_PACKED = Number(process.env.SKS_PACKAGE_SURFACE_MAX_PACK_BYTES || 25_000_000);
 const SURFACE_MAX_FILES = Number(process.env.SKS_PACKAGE_SURFACE_MAX_FILES || 2500);
 const MAX_ATOMIC_TEMP_PACK_ATTEMPTS = 4;
 function runNpmPack() {
-    const npmCli = process.env.npm_execpath; // set when invoked via `npm run`
+    const npmCli = process.env.npm_execpath;
     const npmCache = process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache');
     fs.mkdirSync(npmCache, { recursive: true });
     const argv = ['pack', '--dry-run', '--ignore-scripts', '--json'];

package/dist/scripts/perf-budget-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';

package/dist/scripts/ppt-full-e2e-blackbox-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/ppt-real-export-adapter-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('ppt:real-export-adapter', 'src/core/ppt-review/slide-exporter.ts', [
     'soffice',

package/dist/scripts/ppt-real-imagegen-smoke-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { spawnSync } from 'node:child_process';
 import { osTempPngFixtureArg } from './lib/valid-png-fixture.js';
 const enabled = process.env.SKS_TEST_REAL_IMAGEGEN === '1' || process.env.SKS_REAL_IMAGEGEN === '1';

package/dist/scripts/ppt-real-imagegen-wiring-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('ppt:real-imagegen-wiring', 'src/core/ppt-review/slide-imagegen-review.ts', [
     'generateGptImage2CalloutReview',

package/dist/scripts/ppt-reexport-rereview-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('ppt:reexport-rereview', 'src/core/commands/ppt-command.ts', [
     'attach-fixed-deck',

package/dist/scripts/prepublish-fast-check.js

@@ -1,13 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// Fast prepublish eligibility check. Self-contained: reads the existing release
-// stamp written by dist/scripts/release-check-stamp.js and decides whether the cheap
-// fast-path (no full release:check rebuild) is eligible by comparing only the
-// lightweight comparators it can recompute without a build.
-//
-// Output: a single JSON line on stdout (schema sks.prepublish-fast-check.v1).
-// Exit 0 when the fast path is eligible; exit 1 otherwise (incl. no stamp).
-// Tolerant of missing stamp fields; only compares fields present in the stamp.
 import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
@@ -24,7 +15,6 @@ function safeGitCommit() {
             return String(result.stdout || '').trim() || null;
     }
     catch {
-        // git unavailable; commit comparison is informational only.
     }
     return null;
 }
@@ -37,7 +27,6 @@ function packageFilesListHash(pkg) {
     return sha256(JSON.stringify(files));
 }
 function main() {
-    // No stamp -> not eligible; print and exit 1.
     if (!fs.existsSync(stampPath)) {
         console.log(JSON.stringify({ ok: false, reason: 'no_release_stamp', hint: 'run npm run release:check:full' }));
         process.exit(1);
@@ -65,7 +54,6 @@ function main() {
     const gitCommit = safeGitCommit();
     const mismatched = [];
     const reasons = [];
-    // Always-compared comparator: package version.
     if (Object.prototype.hasOwnProperty.call(stamp, 'package_version')) {
         if (stamp.package_version !== currentVersion) {
             mismatched.push('package_version');
@@ -76,14 +64,12 @@ function main() {
         mismatched.push('package_version');
         reasons.push('package_version: absent from stamp');
     }
-    // Compared only if the stamp carries it.
     if (Object.prototype.hasOwnProperty.call(stamp, 'package_json_sha256')) {
         if (stamp.package_json_sha256 !== currentPkgSha) {
             mismatched.push('package_json_sha256');
             reasons.push(`package_json_sha256: stamp=${stamp.package_json_sha256 ?? 'missing'} current=${currentPkgSha}`);
         }
     }
-    // package.files list hash: informational unless the stamp recorded one.
     if (Object.prototype.hasOwnProperty.call(stamp, 'package_files_list_sha256')) {
         if (stamp.package_files_list_sha256 !== currentFilesHash) {
             mismatched.push('package_files_list_sha256');
@@ -91,9 +77,6 @@ function main() {
         }
     }
     if (Object.prototype.hasOwnProperty.call(stamp, 'package_files_sha256')) {
-        // Full package file hashing is owned by release-check-stamp.js; this check
-        // confirms the fast stamp carries the comparator and leaves exact matching to
-        // `release-check-stamp verify`.
         if (!stamp.package_files_sha256) {
             mismatched.push('package_files_sha256');
             reasons.push('package_files_sha256: absent from stamp');
@@ -103,12 +86,6 @@ function main() {
         mismatched.push('release_gate_sha256');
         reasons.push('release_gate_sha256: absent from stamp');
     }
-    // git_commit is provenance, not a freshness comparator. A valid release flow often
-    // runs release:check, commits the exact checked tree, then publishes from that new
-    // commit. In that case the tree/package/dist hashes still prove freshness, while
-    // comparing HEAD to the pre-commit stamp would block a good publish. The stricter
-    // `release-check-stamp verify` that follows this fast check owns the content
-    // comparators; keep the current commit visible in this report for audit only.
     const stampedGitCommit = Object.prototype.hasOwnProperty.call(stamp, 'git_commit') ? stamp.git_commit || null : null;
     const eligible = mismatched.length === 0;
     console.log(JSON.stringify({

package/dist/scripts/prepublish-release-check-or-fast.js

@@ -1,11 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// Publish-time release stamp verifier and prepack build bridge.
-//
-// `npm publish` verifies the authoritative release stamp before prepack, rebuilds
-// dist through the normal prepack lifecycle, then verifies the same stamp again
-// before npm creates the publish tarball. Ordinary `npm pack` keeps build-only
-// behavior and does not require release authorization.
 import { spawnSync } from 'node:child_process';
 import process from 'node:process';
 const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';

package/dist/scripts/probe-memoization-check.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
 import { importDist } from './sks-1-18-gate-lib.js';
 const tmp = await makeTempRoot('probe-memo-');

package/dist/scripts/product-design-plugin-routing-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { PRODUCT_DESIGN_PIPELINE_STAGES, PRODUCT_DESIGN_PLUGIN, PRODUCT_DESIGN_REQUIRED_SKILLS, normalizeProductDesignPluginEvidence, productDesignPluginVisibilityFromCodexPluginList } from '../core/product-design-plugin.js';
 import { assertGate, emitGate, readText, releaseGateIds } from './lib/codex-sdk-gate-lib.js';
 const routesSource = readText('src/core/routes.ts');

package/dist/scripts/project-skill-dedupe-blackbox.js

@@ -1,20 +1,25 @@
 #!/usr/bin/env node
 import path from 'node:path';
 import fs from 'node:fs/promises';
-import { assertGate, emitGate, makeTempRoot, writeManagedCoreSkill, writeUserSkill } from './sks-3-1-8-check-lib.js';
+import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
 import { dedupeProjectSkills } from '../core/codex-native/project-skill-dedupe.js';
 import { syncCodexSksSkills, withSkillSyncLock } from '../core/codex-app/codex-skill-sync.js';
 import { buildSkillRegistryLedger } from '../core/codex-native/skill-registry-ledger.js';
+const removeFixture = fs.rm.bind(fs);
 const root = await makeTempRoot('sks-skill-dedupe-blackbox-');
-process.env.CODEX_HOME = path.join(root, 'codex-home');
-await writeManagedCoreSkill(root, '.agents/skills', 'loop');
-await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const home = await makeTempRoot('sks-skill-dedupe-home-');
+process.env.HOME = home;
+process.env.CODEX_HOME = path.join(home, '.codex');
+await writeManagedFixture(home, '.agents/skills', 'managed-loop');
+await writeManagedFixture(root, '.agents/skills', 'managed-loop');
+await writeManagedFixture(root, '.codex/skills', 'managed-loop');
 const scenarioA = await dedupeProjectSkills({ root, fix: true, yes: true });
-await writeUserSkill(root, '.agents/skills', 'user-loop', 'loop');
-await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+await writeUserSkill(root, '.agents/skills', 'user-loop', 'fixture-loop');
+await writeManagedFixture(root, '.codex/skills', 'managed-loop');
 const scenarioB = await dedupeProjectSkills({ root, fix: true, yes: true });
-await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Loop');
-await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'loop');
+await guardedRm(path.join(home, '.agents', 'skills', 'managed-loop'), path.join(home, '.agents', 'skills'));
+await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Fixture Loop');
+await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'fixture_loop');
 const scenarioC = await dedupeProjectSkills({ root, fix: true, yes: false });
 const scenarioD = await dedupeProjectSkills({ root, fix: true, yes: true, quarantineUserDuplicates: true });
 const staleRoot = await makeTempRoot('sks-skill-stale-lock-');
@@ -23,7 +28,9 @@ await fs.mkdir(lockPath, { recursive: true });
 await fs.writeFile(path.join(lockPath, 'owner.json'), JSON.stringify({ schema: 'sks.skill-sync-lock.v1', pid: 999999, acquired_at: '1970-01-01T00:00:00.000Z', stale_after_ms: 1 }), 'utf8');
 await withSkillSyncLock(staleRoot, async () => undefined);
 const concurrentRoot = await makeTempRoot('sks-skill-concurrent-');
-process.env.CODEX_HOME = path.join(concurrentRoot, 'codex-home');
+const concurrentHome = await makeTempRoot('sks-skill-concurrent-home-');
+process.env.HOME = concurrentHome;
+process.env.CODEX_HOME = path.join(concurrentHome, '.codex');
 const skillsRoot = path.join(process.env.CODEX_HOME, 'skills');
 await Promise.all(Array.from({ length: 20 }, () => syncCodexSksSkills({ root: concurrentRoot, apply: true, skillsRoot })));
 const concurrentLedger = await buildSkillRegistryLedger({ root: concurrentRoot });
@@ -33,3 +40,23 @@ assertGate(scenarioC.blockers.some((blocker) => blocker.includes('user_duplicate
 assertGate(scenarioD.active_unique_by_canonical_name === true, 'scenario D must quarantine confirmed user-authored duplicate', scenarioD);
 assertGate(concurrentLedger.active_unique_by_canonical_name === true, 'scenario F must keep exactly one active canonical name after concurrent sync', concurrentLedger);
 emitGate('skill:dedupe-blackbox');
+async function writeManagedFixture(root, relRoot, dirName) {
+    await writeText(path.join(root, relRoot, dirName, 'SKILL.md'), [
+        '---',
+        'name: fixture-loop',
+        'description: managed fixture',
+        '---',
+        '',
+        '<!-- BEGIN SKS MANAGED SKILL v-test name=fixture-loop -->',
+        ''
+    ].join('\n'));
+}
+async function guardedRm(target, allowedRoot) {
+    const root = path.resolve(allowedRoot);
+    const resolved = path.resolve(target);
+    const relative = path.relative(root, resolved);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error('refusing_to_remove_unscoped_skill_fixture');
+    }
+    await removeFixture(resolved, { recursive: true, force: true });
+}

package/dist/scripts/prompt-placeholder-guard-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const guardMod = await importDist('core/prompt/prompt-placeholder-guard.js');
 const blocked = guardMod.checkPromptPlaceholders({

package/dist/scripts/python-codex-sdk-all-pipelines-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -15,8 +14,6 @@ const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-python-codex-sdk-pipeli
 const oldFake = process.env.SKS_PYTHON_CODEX_SDK_FAKE;
 const oldCodexLbAutobypass = process.env.SKS_CODEX_LB_AUTOBYPASS;
 process.env.SKS_PYTHON_CODEX_SDK_FAKE = '1';
-// Keep the hermetic fake backend independent from an operator's live
-// codex-lb configuration. This fixture validates the Python SDK pipeline only.
 process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
 try {
     const result = await mod.runCodexTask({

package/dist/scripts/qa-loop-app-handoff-capability-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 const handoff = readText('src/core/codex-app/codex-app-handoff.ts');

package/dist/scripts/qa-loop-app-handoff-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 const core = readText('src/core/qa-loop.ts');

package/dist/scripts/qa-loop-app-handoff-cli-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('[--app-handoff] [--app-handoff-required]') && command.includes('status <mission-id|latest> [--desktop]'), 'QA-LOOP help must expose app handoff run/status flags');

package/dist/scripts/qa-loop-app-handoff-confirmation-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/qa-loop-app-handoff-gate-lifecycle-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/qa-loop-app-handoff-launch-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('--app-handoff-launch') && command.includes('--app-handoff-artifact-only') && command.includes('launch_mode'), 'QA-LOOP must expose launch/artifact-only handoff flags and pass launch_mode');

package/dist/scripts/qa-loop-app-handoff-status-lifecycle-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('desktop_app_confirmation') && command.includes('desktop_review_complete') && command.includes('launch:'), 'QA status --desktop must include handoff launch, confirmation, and complete lifecycle');

package/dist/scripts/qa-loop-budget-policy-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/qa-loop/qa-loop-budget-policy.js');
 const policy = mod.buildQaLoopBudgetPolicy({ usage: { source: 'fake', token_usage: { total_tokens: 95 }, usage_limit_tokens: 100 } });

package/dist/scripts/qa-loop-effort-escalation-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/qa-loop/qa-loop-budget-policy.js');
 const one = mod.selectQaLoopEscalatedEffort({ failureCount: 1, currentEffort: 'medium' });

package/dist/scripts/qa-loop-image-path-exposure-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 const core = readText('src/core/qa-loop.ts');

package/dist/scripts/qa-loop-image-path-prompt-injection-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const qa = await importDist('core/qa-loop.js');
 const prompt = qa.buildQaLoopPrompt({ id: 'M', mission: { prompt: 'fixture' }, contract: {}, cycle: 1, previous: '', reportFile: '2026-06-09-v2.0.19-qa-report.md', imagePathContract: { images: [{ id: 'img', model_visible_path: '/tmp/a.png', mime_type: 'image/png', width: 1, height: 1, followup_edit_hint: 'use /tmp/a.png' }], blockers: [] } });

package/dist/scripts/release-cache-glob-hashing-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/release-cache-input-classifier-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { classifyReleaseCacheInputChange } from '../core/release/release-cache-key.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const pkgA = JSON.stringify({ name: 'sneakoscope', version: '3.0.0', scripts: { test: 'node a.js' }, dependencies: { left: '1.0.0' }, files: ['dist'] }, null, 2);

package/dist/scripts/release-cache-neutralization-report-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { spawnSync } from 'node:child_process';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const result = spawnSync(process.execPath, ['dist/scripts/release-speed-summary.js'], { cwd: root, encoding: 'utf8', timeout: 30000 });

package/dist/scripts/release-cache-version-neutral-fixture-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/release-check-stamp.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
@@ -470,9 +469,6 @@ function inspectFullReleaseGateProof(proof, currentPayload) {
                 const identicalAuthorizedBuild = distFreshness.ok === true && sameReleaseAuthorizationSnapshot(summary.release_authorization_snapshot, currentPayload);
                 if (!Number.isFinite(summaryMtimeMs) || !Number.isFinite(buildStampMtimeMs))
                     blockers.push('proof_mtime_missing');
-                // npm publish performs a deterministic clean rebuild after the full
-                // release run. Permit only that content-identical case; any source,
-                // package, dist, or gate identity drift still fails the checks above.
                 if (Number.isFinite(summaryMtimeMs) && Number.isFinite(buildStampMtimeMs) && summaryMtimeMs < buildStampMtimeMs && !identicalAuthorizedBuild)
                     blockers.push('summary_predates_current_build');
                 if (!Number.isFinite(summaryMtimeMs) || !Number.isFinite(canonicalProofMtimeMs) || summaryMtimeMs < canonicalProofMtimeMs)

package/dist/scripts/release-dist-freshness-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { ensureDistFresh } from './lib/ensure-dist-fresh.js';
 const report = ensureDistFresh({ rebuild: process.env.SKS_RELEASE_DIST_FRESHNESS_NO_REBUILD !== '1' });
 console.log(JSON.stringify(report, null, 2));

package/dist/scripts/release-full-parallelism-blackbox.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { performance } from 'node:perf_hooks';
 import { runReleaseGateBatch } from '../core/release/release-gate-batch-runner.js';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const reportRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-release-full-'));
 const gates = Array.from({ length: 80 }, (_, i) => ({ id: `synthetic:${i + 1}`, command: `${process.execPath} -e \"setTimeout(()=>process.exit(0),1000)\"`, deps: [], resource: ['cpu-light', 'fs-read'], side_effect: 'hermetic', timeout_ms: 15000, cache: { enabled: false, inputs: [] }, isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' }, preset: ['release'] }));
-const started = Date.now();
+const started = performance.now();
 const result = await runReleaseGateBatch(root, gates, { concurrency: 40, reportRoot });
-const wallMs = Date.now() - started;
+const wallMs = Math.max(1, Math.round(performance.now() - started));
 const completedDurations = result.results
     .map((row) => Number(row.duration_ms || 0))
     .filter((duration) => Number.isFinite(duration) && duration > 0);

package/dist/scripts/release-gate-batch-runner-check.js

@@ -39,4 +39,26 @@ assertGate(result.results.some((row) => row.id === 'batch:pass' && row.ok === tr
 const timeoutResult = await batch.runReleaseGateBatch(root, [timeoutGate], { concurrency: 1, reportRoot });
 assertGate(timeoutResult.results.some((row) => row.id === 'batch:timeout' && row.ok === false && row.exit_code === 124 && row.timed_out === true), 'batch runner must report timed-out child process trees explicitly', timeoutResult);
 assertGate(timeoutResult.results.some((row) => row.id === 'batch:timeout' && row.duration_ms >= 1400), 'batch runner must wait for timed-out process tree hard-kill cleanup before resolving', timeoutResult);
+const dateNowDescriptor = Object.getOwnPropertyDescriptor(Date, 'now');
+let regressingWallClock = Date.now();
+Object.defineProperty(Date, 'now', {
+    configurable: true,
+    value: () => {
+        regressingWallClock -= 1000;
+        return regressingWallClock;
+    }
+});
+try {
+    const clockRollbackGate = {
+        ...base,
+        id: 'batch:clock-rollback',
+        command: `${process.execPath} -e "setTimeout(() => process.exit(0), 50)"`
+    };
+    const clockRollbackResult = await batch.runReleaseGateBatch(root, [clockRollbackGate], { concurrency: 1, reportRoot });
+    assertGate(clockRollbackResult.results.some((row) => row.id === 'batch:clock-rollback' && row.ok === true && row.duration_ms > 0), 'batch runner duration evidence must remain positive across wall-clock rollback', clockRollbackResult);
+}
+finally {
+    if (dateNowDescriptor)
+        Object.defineProperty(Date, 'now', dateNowDescriptor);
+}
 emitGate('release:gate-batch-runner', { batch_size: result.batch_size, failed_child: 'batch:fail' });

package/dist/scripts/release-gate-budget-check.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// Gate: release:gate-budget
-// Reports the slowest gates and any gate exceeding its time budget, from the gate
-// result cache. Tolerant of missing timing data (informational on a cold cache).
-// Only a gate exceeding the HARD ceiling is a blocker.
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
@@ -30,6 +25,5 @@ const report = {
 const reportDir = path.join(root, '.sneakoscope', 'reports');
 fs.mkdirSync(reportDir, { recursive: true });
 fs.writeFileSync(path.join(reportDir, 'release-gate-budget.json'), `${JSON.stringify(report, null, 2)}\n`);
-// Only a gate over the HARD ceiling fails the gate; soft-budget gates are warnings.
 assertGate(overCeiling.length === 0, 'a gate exceeded the hard time ceiling', { overCeiling, hard_ceiling_ms: HARD_CEILING_MS });
 emitGate('release:gate-budget', { slowest: slowest.length, over_budget: overBudget.length, timing_data: records.length > 0 });

package/dist/scripts/release-gate-dag-runner-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/release-latency-slo-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist, readJson, root } from './sks-1-18-gate-lib.js';
 const config = readJson('config/perf-budgets.v1.json');
 const budgets = Array.isArray(config.release_latency_slos) ? config.release_latency_slos : [];