sneakoscope 7.1.0 → 7.3.0

package/dist/scripts/check-route-modularity.js

@@ -1,72 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-const root = process.cwd();
-const failures = [];
-const routeCli = path.join(root, 'src', 'core', 'commands', 'route-cli.mjs');
-if (fs.existsSync(routeCli))
-    failures.push('src/core/commands/route-cli.mjs must not exist in runtime source');
-const legacyCommandsDir = path.join(root, 'src', 'commands');
-if (fs.existsSync(legacyCommandsDir)) {
-    for (const file of listFiles(legacyCommandsDir, '.mjs')) {
-        const text = fs.readFileSync(file, 'utf8');
-        if (text.includes('route-cli.mjs'))
-            failures.push(`${rel(file)} imports route-cli.mjs`);
-    }
-}
-for (const relModule of registeredCommandModules()) {
-    if (!fs.existsSync(path.join(root, relModule)))
-        failures.push(`registered command module missing: ${relModule}`);
-}
-const disallowedImports = {
-    'qa-loop-command.ts': ['research-command', 'ppt-command', 'gx-command'],
-    'research-command.ts': ['qa-loop-command', 'ppt-command', 'gx-command'],
-    'wiki-command.ts': ['research-command', 'qa-loop-command', 'ppt-command']
-};
-for (const [name, needles] of Object.entries(disallowedImports)) {
-    const file = commandModulePath(name);
-    if (!fs.existsSync(file))
-        continue;
-    const text = fs.readFileSync(file, 'utf8');
-    for (const needle of needles) {
-        if (text.includes(needle))
-            failures.push(`${name} imports unrelated ${needle}`);
-    }
-}
-if (failures.length) {
-    console.error('Route modularity check failed:');
-    for (const failure of failures)
-        console.error(`- ${failure}`);
-    process.exit(1);
-}
-console.log('Route modularity check passed');
-function registeredCommandModules() {
-    const registry = fs.readFileSync(path.join(root, 'src', 'cli', 'command-registry.ts'), 'utf8');
-    const out = new Set();
-    for (const match of registry.matchAll(/['"]dist\/core\/commands\/([^'"]+)\.js['"]/g)) {
-        const stem = match[1];
-        if (stem)
-            out.add(`src/core/commands/${stem}.ts`);
-    }
-    return [...out].sort();
-}
-function listFiles(dir, ext) {
-    const out = [];
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-        const file = path.join(dir, entry.name);
-        if (entry.isDirectory())
-            out.push(...listFiles(file, ext));
-        else if (entry.name.endsWith(ext))
-            out.push(file);
-    }
-    return out;
-}
-function rel(file) {
-    return path.relative(root, file).split(path.sep).join('/');
-}
-function commandModulePath(name) {
-    const base = path.join(root, 'src', 'core', 'commands');
-    const mjs = path.join(base, name.replace(/\.ts$/, '.mjs'));
-    const ts = path.join(base, name.replace(/\.mjs$/, '.ts'));
-    return fs.existsSync(mjs) ? mjs : ts;
-}

package/dist/scripts/codex-0140-capability-check.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
-import { detectCodex0140Capability } from '../core/codex-control/codex-0140-capability.js';
-process.env.SKS_CODEX_0140_FAKE = '1';
-process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.140.0';
-delete process.env.SKS_CODEX_0140_PROBE;
-const cap = await detectCodex0140Capability({ codexBin: 'codex' });
-assertGate(cap.ok === true && cap.supports_0140 === true, 'Codex 0.140 capability fixture must pass', cap);
-assertGate(Object.values(cap.feature_states).every((state) => state.supported === true && state.certainty === 'assumed_by_version'), 'version-only mode must mark 0.140 features as assumed, not probed', cap);
-assertGate(cap.warnings.some((warning) => warning.endsWith('_assumed_by_version')), 'version-only mode must warn about assumed feature support', cap);
-process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.139.0';
-const old = await detectCodex0140Capability({ codexBin: 'codex' });
-assertGate(old.ok === false && old.blockers.includes('codex_0_140_required_for_0140_features'), 'Codex 0.139 must not satisfy 0.140 capability', old);
-emitGate('codex:0140-capability', { features: Object.keys(cap.features).length });

package/dist/scripts/codex-0140-feature-probes-check.js

@@ -1,23 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
-import { detectCodex0140Capability } from '../core/codex-control/codex-0140-capability.js';
-process.env.SKS_CODEX_0140_FAKE = '1';
-process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.140.0';
-process.env.SKS_CODEX_0140_PROBE = '1';
-clearFailureEnv();
-const cap = await detectCodex0140Capability({ codexBin: 'codex' });
-assertGate(cap.ok === true && cap.probe_mode === 'feature-probe', 'Codex 0.140 feature probe fixture must pass', cap);
-for (const [name, status] of Object.entries(cap.feature_probe_results || {})) {
-    assertGate(status === 'passed', `Codex 0.140 feature probe must pass: ${name}`, cap.feature_probe_results);
-}
-process.env.SKS_CODEX_0140_FAKE_USAGE_VIEWS_FAIL = '1';
-const failed = await detectCodex0140Capability({ codexBin: 'codex' });
-assertGate(failed.ok === false && failed.blockers.includes('codex_0140_usage_views_probe_failed'), 'failed 0.140 feature probe must block capability', failed);
-clearFailureEnv();
-emitGate('codex:0140-feature-probes', { probe_count: Object.keys(cap.feature_probe_results || {}).length });
-function clearFailureEnv() {
-    for (const key of Object.keys(process.env)) {
-        if (/^SKS_CODEX_0140_FAKE_.*_FAIL$/.test(key))
-            delete process.env[key];
-    }
-}

package/dist/scripts/codex-permission-profiles-check.js

@@ -1,34 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'codex', 'codex-permission-profiles.js')).href);
-const report = await mod.inventoryCodexPermissionProfiles(root, { writeReport: true });
-const names = new Set(report.sks_profiles.map((profile) => profile.name));
-const deprecatedPolicy = `${'on'}-failure`;
-const deprecatedProfiles = report.sks_profiles.filter((profile) => profile.approval_policy === deprecatedPolicy).map((profile) => profile.name);
-const productionFiles = [
-    'src/core/codex/codex-permission-profiles.ts',
-    'src/core/permission-gates.ts',
-    'package.json'
-];
-const deprecatedMatches = [];
-for (const rel of productionFiles) {
-    const file = path.join(root, rel);
-    const text = await fs.readFile(file, 'utf8').catch(() => '');
-    if (text.includes(deprecatedPolicy))
-        deprecatedMatches.push(rel);
-}
-const ok = ['sks-safe', 'sks-fast', 'sks-mad', 'sks-mad-target-write', 'sks-mad-system'].every((name) => names.has(name))
-    && report.codex_config_profile_field === 'codex_config_profile'
-    && report.codex_permission_profile_field === 'codex_permission_profile'
-    && deprecatedProfiles.length === 0
-    && deprecatedMatches.length === 0;
-emit({ schema: 'sks.codex-permission-profiles-check.v1', ok, report, deprecated_profiles: deprecatedProfiles, deprecated_matches: deprecatedMatches });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.codex-permission-profiles-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }

package/dist/scripts/codex-project-config-policy-splitter-check.js

@@ -1,49 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root as repoRoot } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const fixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-config-splitter-'));
-const codexHome = path.join(fixture, 'home', '.codex');
-const deprecatedPolicy = `${'on'}-failure`;
-await fs.mkdir(path.join(fixture, '.codex'), { recursive: true });
-await fs.writeFile(path.join(fixture, '.codex', 'config.toml'), [
-    '# project comment',
-    'profile = "sks-mad-high"',
-    `approval_policy = "${deprecatedPolicy}"`,
-    'sandbox_mode = "workspace-write"',
-    'instructions = """',
-    '[not.a.table]',
-    'keep this text',
-    '"""',
-    'project_inline = { keep = true, value = "[literal]" }',
-    '',
-    '[profiles.sks-mad-high]',
-    'model_reasoning_effort = "high"',
-    '',
-    '[model_providers.codex-lb]',
-    'base_url = "https://lb.example.test"',
-    ''
-].join('\n'));
-const mod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'core', 'codex', 'codex-project-config-policy.js')).href);
-const report = await mod.splitCodexProjectConfigPolicy(fixture, { apply: true, codexHome });
-const project = await fs.readFile(path.join(fixture, '.codex', 'config.toml'), 'utf8');
-const user = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
-const ok = report.ok === true
-    && !/^profile\s*=/m.test(project)
-    && !project.includes(deprecatedPolicy)
-    && /approval_policy = "on-request"/.test(project)
-    && /project_inline = \{ keep = true/.test(project)
-    && /\[not\.a\.table\]/.test(project)
-    && /^\[model_providers\.codex-lb\]/m.test(user);
-console.log(JSON.stringify({ schema: 'sks.codex-project-config-policy-splitter-check.v1', ok, report }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-function fail(blocker, detail) {
-    console.log(JSON.stringify({ schema: 'sks.codex-project-config-policy-splitter-check.v1', ok: false, blocker, detail }, null, 2));
-    process.exit(1);
-}

package/dist/scripts/competitor-scorecard-check.js

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { generateCompetitorScorecard } from '../core/quality/competitor-scorecard.js';
-import { readJson, writeJsonAtomic } from '../core/fsx.js';
-const root = process.env.SKS_REPO_ROOT
-    ? path.resolve(process.env.SKS_REPO_ROOT)
-    : path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const baselinePath = process.env.SKS_COMPETITOR_SCORECARD_BASELINE
-    ? path.resolve(process.env.SKS_COMPETITOR_SCORECARD_BASELINE)
-    : path.join(root, 'config', 'competitor-scorecard-baseline.json');
-const reportPath = process.env.SKS_COMPETITOR_SCORECARD_REPORT
-    ? path.resolve(process.env.SKS_COMPETITOR_SCORECARD_REPORT)
-    : path.join(root, '.sneakoscope', 'reports', 'competitor-scorecard.json');
-const baseline = await readJson(baselinePath);
-const result = await generateCompetitorScorecard(root, baseline);
-await writeJsonAtomic(reportPath, {
-    ...result.scorecard,
-    evidence: result.evidence,
-    ok: result.ok
-});
-console.log(JSON.stringify(result.scorecard, null, 2));
-if (!result.ok)
-    process.exit(1);

package/dist/scripts/core-skill-no-drift-check.js

@@ -1,23 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
-import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
-import { buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
-import { sha256 } from '../core/fsx.js';
-const root = await makeTempRoot('sks-core-no-drift-');
-const skillsRoot = path.join(root, '.agents', 'skills');
-const manifest = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z');
-await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-for (const skill of manifest.skills) {
-    const text = await fs.readFile(path.join(skillsRoot, skill.canonical_name, 'SKILL.md'), 'utf8');
-    assertGate(sha256(text) === skill.content_sha256, `rendered core skill drifted: ${skill.canonical_name}`, skill);
-}
-await writeText(path.join(skillsRoot, 'sks-qa-loop', 'SKILL.md'), `${renderCoreSkillTemplate('qa-loop')}\n# drift\n`);
-const restored = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-assertGate(restored.restored.length === 1, 'managed drift must be restored', restored);
-const userRoot = path.join(root, 'user-skills');
-await writeUserSkill(root, 'user-skills', 'sks-loop', 'sks-loop');
-const user = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot: userRoot });
-assertGate(user.skipped_user_authored.length === 1, 'user-authored same-name core skill must be preserved', user);
-emitGate('core-skill:no-drift', { skills: manifest.skills.length });

package/dist/scripts/db-route-materialization-check.js

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-import fsp from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { prepareRoute } from '../core/pipeline-internals/runtime-core.js';
-const root = await fsp.mkdtemp(path.join(os.tmpdir(), 'sks-db-route-materialization-'));
-try {
-    await fsp.writeFile(path.join(root, 'package.json'), `${JSON.stringify({ name: 'sks-db-route-fixture', private: true }, null, 2)}\n`);
-    const prepared = await prepareRoute(root, '$DB inspect the local migration safely', {});
-    const missionId = String(prepared?.mission_id || '');
-    if (!missionId || prepared?.route?.id !== 'DB')
-        throw new Error('DB route did not materialize a mission');
-    const dir = path.join(root, '.sneakoscope', 'missions', missionId);
-    const scan = JSON.parse(await fsp.readFile(path.join(dir, 'db-safety-scan.json'), 'utf8'));
-    const review = JSON.parse(await fsp.readFile(path.join(dir, 'db-review.json'), 'utf8'));
-    if (typeof scan?.ok !== 'boolean')
-        throw new Error('db-safety-scan.json is missing an ok decision');
-    if (typeof review?.scan_ok !== 'boolean' || review?.destructive_operation_zero !== true) {
-        throw new Error('db-review.json is missing the fail-closed safety baseline');
-    }
-    console.log(JSON.stringify({
-        schema: 'sks.db-route-materialization-check.v1',
-        ok: true,
-        route: '$DB',
-        mission_id: missionId,
-        artifacts: ['db-safety-scan.json', 'db-review.json'],
-        legacy_cli_registered: false
-    }, null, 2));
-}
-finally {
-    await fsp.rm(root, { recursive: true, force: true });
-}

package/dist/scripts/doctor-context7-mcp-repair-blackbox.js

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
-const root = await makeTempRoot('sks-context7-blackbox-');
-const configPath = path.join(root, '.codex', 'config.toml');
-await writeText(configPath, '[mcp_servers.context7]\ncommand = "npx"\n');
-const repaired = await repairContext7Mcp({ root, apply: true });
-const text = await fs.readFile(configPath, 'utf8');
-assertGate(repaired.ok === true && text.includes('https://mcp.context7.com/mcp'), 'Context7 blackbox must write remote URL', { repaired, text });
-await writeText(configPath, '[mcp_servers.context7]\ndisabled = true\ncommand = "npx"\n');
-const disabled = await repairContext7Mcp({ root, apply: true });
-assertGate(disabled.after_transport === 'disabled' && disabled.repaired === false && disabled.disabled_preserved === true, 'Context7 blackbox must preserve explicitly disabled server', disabled);
-emitGate('doctor:context7-mcp-repair-blackbox');

package/dist/scripts/doctor-fastpath-check.js

@@ -1,25 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-const started = Date.now();
-const result = spawnSync(process.execPath, ['dist/bin/sks.js', 'doctor', '--json'], {
-    cwd: root,
-    encoding: 'utf8',
-    maxBuffer: 16 * 1024 * 1024
-});
-const elapsedMs = Date.now() - started;
-const parsed = JSON.parse(result.stdout || '{}');
-assertGate(result.status === 0, 'doctor --json must exit 0', { status: result.status, stderr: result.stderr.slice(-2000), stdout: result.stdout.slice(-2000) });
-assertGate(parsed.schema === 'sks.doctor-status.v3', 'doctor --json fast path must emit v3 doctor status schema', parsed);
-assertGate(parsed.ok === true, 'doctor --json fast path must report fast readonly success only', parsed);
-assertGate(parsed.status === 'fast_readonly_ok', 'doctor --json fast path must use fast_readonly_ok status', parsed);
-assertGate(parsed.diagnostic_depth === 'fast', 'doctor --json fast path must declare fast diagnostic depth', parsed);
-assertGate(parsed.deep_diagnostics_skipped === true, 'doctor --json fast path must explicitly skip deep diagnostics', parsed);
-assertGate(parsed.deep_ok === null, 'doctor --json fast path must not claim deep diagnostics passed', parsed);
-assertGate(parsed.not_counted_as_full_doctor === true, 'doctor --json fast path must not count as full doctor', parsed);
-assertGate(Array.isArray(parsed.next_actions) && parsed.next_actions.some((action) => String(action).includes('sks doctor --full --json')), 'doctor --json fast path must point to full diagnostics next action', parsed.next_actions);
-assertGate(parsed.doctor_fix_transaction === null, 'doctor --json no-fix must not run fix transaction', parsed.doctor_fix_transaction);
-assertGate(parsed.repair?.setup === null, 'doctor --json no-fix must not run setup repair', parsed.repair?.setup);
-assertGate(parsed.repair?.sks_temp_sweep?.skipped === true, 'doctor --json no-fix must not sweep runtime state', parsed.repair?.sks_temp_sweep);
-assertGate(elapsedMs <= 1200, 'doctor --json fast path must stay under 1200ms p95 target in this gate', { elapsed_ms: elapsedMs });
-emitGate('doctor:fastpath', { elapsed_ms: elapsedMs });

package/dist/scripts/doctor-fix-production-blackbox.js

@@ -1,35 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { parse } from 'smol-toml';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
-import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
-import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
-import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
-import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
-const root = await makeTempRoot('sks-doctor-production-');
-await writeText(path.join(root, '.codex', 'config.toml'), '# SKS-MANAGED-CODEX-CONFIG\n[mcp_servers.context7]\ncommand = "npx"\n\n[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nread_only = true\n\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
-const startup = await repairCodexStartupConfig({ root, apply: true, home: path.join(root, 'home'), codexHome: path.join(root, 'codex-home') });
-const startupText = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
-const startupConfig = parse(startupText);
-const startupAgents = startupConfig.agents || {};
-const startupAgentFiles = (await fs.readdir(path.join(root, '.codex', 'agents'))).sort();
-assertGate(startup.ok === true, 'doctor production startup repair must pass', startup);
-assertGate((startupAgents.max_concurrent_threads_per_session === 12 || startupAgents.max_threads === 12) && startupAgents.max_depth === 1 && startupAgents.interrupt_message === true && startupAgents.enabled === true, 'doctor production startup repair must write official config defaults', startupAgents);
-assertGate(startupAgentFiles.join(',') === 'expert.toml,worker.toml', 'doctor production startup repair must create only official worker/expert TOMLs', startupAgentFiles);
-assertGate(startupText.includes('[agents.analysis_scout]') && startupText.includes('config_file = ".codex/agents/stale.toml"'), 'doctor production startup repair must preserve legacy config tables', startupText);
-const context7 = await repairContext7Mcp({ root, apply: true });
-const supabase = await repairSupabaseMcp({ root, apply: true });
-const tx = await runDoctorFixTransaction({ root, phases: [
-        { id: 'preflight', run: async () => ({ id: 'preflight', ok: true }) },
-        { id: 'codex_startup_config_repair', run: async () => ({ id: 'codex_startup_config_repair', ok: startup.ok, repaired: true, blockers: startup.blockers, rollback_evidence: 'fixture_config_backup' }) },
-        { id: 'context7_mcp_repair', run: async () => ({ id: 'context7_mcp_repair', ok: context7.ok, repaired: context7.repaired, blockers: context7.blockers, rollback_evidence: 'fixture_context7_backup' }) },
-        { id: 'supabase_mcp_repair', required_for_ready: false, run: async () => ({ id: 'supabase_mcp_repair', ok: supabase.ok, manual_required: supabase.manual_required, required_for_ready: false, blockers: supabase.blockers, warnings: supabase.warnings, rollback_evidence: 'optional_supabase_fixture' }) },
-        { id: 'postcheck', run: async () => ({ id: 'postcheck', ok: true }) }
-    ] });
-const postcheck = doctorRepairPostcheck(tx);
-assertGate(tx.schema === 'sks.doctor-fix-transaction.v2' && tx.raw_secret_values_recorded === false, 'doctor transaction must write production schema without raw secrets', tx);
-assertGate(tx.phases.every((phase) => typeof phase.duration_ms === 'number' && phase.started_at && phase.completed_at), 'doctor transaction phases must include runtime evidence', tx);
-assertGate(postcheck.ok === true, 'doctor repair postcheck must pass when only manual-required optional phases remain', postcheck);
-emitGate('doctor:fix-production-blackbox', { phases: tx.phases.length });

package/dist/scripts/doctor-idempotence-check.js

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { runDoctorIdempotence } = await importDist('core/doctor/doctor-idempotence.js');
-const report = await runDoctorIdempotence(root);
-assertGate(report.ok, 'doctor_idempotence_failed', report);
-emitGate('doctor:idempotence', { rollback_manifest_exists: report.rollback_manifest_exists });

package/dist/scripts/doctor-ops-semantics-check.js

@@ -1,83 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-ops-semantics-'));
-const projectRoot = path.join(tmp, 'project');
-const codexHome = path.join(tmp, 'codex-home');
-try {
-    await fs.mkdir(projectRoot, { recursive: true });
-    await fs.mkdir(codexHome, { recursive: true });
-    await fs.writeFile(path.join(projectRoot, 'package.json'), '{"name":"doctor-ops-semantics-fixture","private":true}\n');
-    const fast = runDoctor(['doctor', '--json']);
-    const full = runDoctor(['doctor', '--full', '--json']);
-    const fix1 = runDoctor(['doctor', '--fix', '--yes', '--json']);
-    const fix2 = runDoctor(['doctor', '--fix', '--yes', '--json']);
-    const blockers = [
-        ...shapeBlockers('fast', fast, (json) => json.schema === 'sks.doctor-status.v3' && json.diagnostic_depth === 'fast' && json.not_counted_as_full_doctor === true && json.deep_ok === null),
-        ...shapeBlockers('full', full, (json) => json.schema === 'sks.doctor-status.v3' && json.diagnostic_depth === 'full' && json.not_counted_as_full_doctor === false && typeof json.deep_ok === 'boolean'),
-        ...shapeBlockers('fix', fix1, (json) => json.schema === 'sks.doctor-fix-result.v2' || json.doctor_fix_transaction?.schema === 'sks.doctor-fix-transaction.v2'),
-        ...(fix1.json?.ok === true && Array.isArray(fix1.json?.blockers) && fix1.json.blockers.length ? ['fix_ok_true_with_blockers'] : []),
-        ...(fix2.json?.ok === true && Array.isArray(fix2.json?.blockers) && fix2.json.blockers.length ? ['second_fix_ok_true_with_blockers'] : [])
-    ];
-    const report = {
-        schema: 'sks.doctor-ops-semantics.v1',
-        ok: blockers.length === 0,
-        generated_at: new Date().toISOString(),
-        fixture_root: projectRoot,
-        fast: summarize(fast),
-        full: summarize(full),
-        fix: summarize(fix1),
-        second_fix: summarize(fix2),
-        blockers
-    };
-    const reportPath = path.join(root, '.sneakoscope', 'reports', 'doctor-ops-semantics.json');
-    await fs.mkdir(path.dirname(reportPath), { recursive: true });
-    await fs.writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`);
-    assertGate(report.ok, 'doctor ops semantics failed', report);
-    emitGate('doctor:ops-semantics', { report: reportPath.replace(`${root}/`, '') });
-}
-finally {
-    await fs.rm(tmp, { recursive: true, force: true }).catch(() => undefined);
-}
-function runDoctor(args) {
-    const result = spawnSync(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), ...args], {
-        cwd: projectRoot,
-        encoding: 'utf8',
-        maxBuffer: 16 * 1024 * 1024,
-        env: { ...process.env, CODEX_HOME: codexHome, SKS_DISABLE_NETWORK: '1', SKS_DISABLE_UPDATE_CHECK: '1', SKS_NO_QUESTION: '1' }
-    });
-    return { status: result.status, stdout: result.stdout, stderr: result.stderr, json: parseJson(result.stdout) };
-}
-function shapeBlockers(label, result, predicate) {
-    if (!result.json)
-        return [`${label}_json_missing`];
-    if (result.status !== 0 && result.json.status !== 'blocked')
-        return [`${label}_unexpected_exit:${result.status}`];
-    if (result.json.ok === true && Array.isArray(result.json.blockers) && result.json.blockers.length)
-        return [`${label}_ok_true_with_blockers`];
-    if (!predicate(result.json))
-        return [`${label}_schema_mismatch`];
-    return [];
-}
-function summarize(result) {
-    return {
-        exit_code: result.status,
-        schema: result.json?.schema || result.json?.doctor_fix_transaction?.schema || null,
-        ok: result.json?.ok ?? null,
-        status: result.json?.status || null,
-        diagnostic_depth: result.json?.diagnostic_depth || null,
-        blockers: Array.isArray(result.json?.blockers) ? result.json.blockers : [],
-        stderr_tail: result.stderr.slice(-1000)
-    };
-}
-function parseJson(value) {
-    try {
-        return JSON.parse(value || '{}');
-    }
-    catch {
-        return null;
-    }
-}

package/dist/scripts/doctor-startup-config-repair-blackbox.js

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
-import { parse } from 'smol-toml';
-const root = await makeTempRoot('sks-startup-config-blackbox-');
-await writeText(path.join(root, '.codex', 'config.toml'), '# SKS managed Codex config fixture\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
-const report = await repairCodexStartupConfig({ root, apply: true, home: path.join(root, 'home'), codexHome: path.join(root, 'codex-home') });
-const text = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
-const parsed = parse(text);
-const agents = parsed.agents || {};
-const files = (await fs.readdir(path.join(root, '.codex', 'agents'))).sort();
-assertGate(report.ok === true, 'startup config blackbox must pass postcheck', report);
-assertGate((agents.max_concurrent_threads_per_session === 12 || agents.max_threads === 12) && agents.max_depth === 1 && agents.interrupt_message === true && agents.enabled === true, 'startup config blackbox must persist official settings', agents);
-assertGate(files.join(',') === 'expert.toml,worker.toml', 'startup config blackbox must create only official worker/expert TOMLs', files);
-assertGate(text.includes('config_file = ".codex/agents/stale.toml"') && text.includes('message_role_prefix = "legacy"'), 'startup config blackbox must preserve legacy compatibility tables', { text });
-emitGate('doctor:startup-config-repair-blackbox');

package/dist/scripts/doctor-supabase-mcp-repair-blackbox.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
-const root = await makeTempRoot('sks-supabase-mcp-blackbox-');
-delete process.env.SUPABASE_ACCESS_TOKEN;
-await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nSUPABASE_ACCESS_TOKEN = "env:SUPABASE_ACCESS_TOKEN"\n');
-const unsafe = await repairSupabaseMcp({ root, apply: true });
-assertGate(unsafe.ok === true && unsafe.manual_required === true && unsafe.read_only_migrated === true && unsafe.ready_blocking === false, 'Supabase unsafe write access must be migrated to read-only without passing silently as write-ready', unsafe);
-await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase_sauron]\ndisabled = true\n');
-const optional = await repairSupabaseMcp({ root, apply: true });
-assertGate(optional.ok === true && optional.disabled === true && optional.disabled_preserved === true, 'optional disabled Supabase config must be preserved', optional);
-emitGate('doctor:supabase-mcp-repair-blackbox');

package/dist/scripts/ensure-bin-executable.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-import fsp from 'node:fs/promises';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const bins = [
-    path.join(root, 'dist', 'bin', 'sks.js'),
-    path.join(root, 'dist', 'bin', 'install.js')
-];
-for (const bin of bins) {
-    await fsp.chmod(bin, 0o755).catch((err) => {
-        if (err?.code !== 'ENOENT')
-            throw err;
-    });
-    console.log(`bin executable: ${path.relative(root, bin)}`);
-}

package/dist/scripts/fsx-hotpath-check.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { writeFsxHotpathReport } = await importDist('core/perf/fsx-hotpath.js');
-const report = await writeFsxHotpathReport(root);
-assertGate(report.ok, 'fsx_hotpath_failed', report);
-emitGate('fsx:hotpath', {
-    checked_files: report.checked_files.length,
-    report_path: '.sneakoscope/reports/fsx-hotpath.json'
-});