sneakoscope 7.1.0 → 7.3.0

package/dist/scripts/high-risk-contracts-check.js

@@ -1,183 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-import { evaluateHighRiskCliSmokeResult, evaluateHighRiskFixtures, HIGH_RISK_CONTRACT_REPORT_SCHEMA, highRiskCliNegativeSmokeSpecs, highRiskNegativeFixtures } from '../core/security/high-risk-contracts.js';
-const runtimeHelpers = fs.readFileSync(`${root}/src/core/super-search/runtime-helpers.ts`, 'utf8');
-assertGate(runtimeHelpers.includes('evaluateUrlFetchPolicy'), 'Super-Search fetch must use a URL fetch policy preflight');
-assertGate(runtimeHelpers.includes('direct_url_fetch_ssrf_blocked'), 'Super-Search fetch must report SSRF blocks');
-assertGate(runtimeHelpers.includes('127') && runtimeHelpers.includes('192') && runtimeHelpers.includes('169'), 'SSRF policy must cover local/private IPv4 ranges');
-assertGate(runtimeHelpers.includes("lower === '::1'") && runtimeHelpers.includes("lower.startsWith('fc')") && runtimeHelpers.includes("lower.startsWith('fe80:')"), 'SSRF policy must cover local/private IPv6 ranges');
-const { runSuperSearch } = await importDist('core/super-search/index.js');
-const missionDir = await fs.promises.mkdtemp('/tmp/sks-high-risk-super-search-');
-const blocked = await runSuperSearch({
-    missionDir,
-    query: 'http://127.0.0.1:1/docs',
-    mode: 'url_acquisition',
-    env: {}
-});
-assertGate(blocked.ok === false, 'Super-Search fetch must fail closed for private/local URLs by default', blocked);
-assertGate(blocked.blockers.some((entry) => String(entry).includes('direct_url_fetch_ssrf_blocked')), 'blocked fetch must include SSRF blocker', blocked.blockers);
-const negativeFixtures = highRiskNegativeFixtures();
-const negativeResults = evaluateHighRiskFixtures(negativeFixtures);
-for (const target of new Set(negativeFixtures.map((fixture) => fixture.target))) {
-    const targetResults = negativeResults.filter((result) => result.target === target);
-    assertGate(targetResults.some((result) => result.blocked === true), `missing high-risk negative fixture coverage: ${target}`, targetResults);
-}
-assertGate(negativeResults.every((result) => result.ok !== true && result.status === 'blocked_expected' && result.blocked === true), 'high-risk negative checks must block without ok:true', negativeResults);
-const cliSmokeSpecs = highRiskCliNegativeSmokeSpecs();
-const cliNegativeSmokes = [];
-for (const spec of cliSmokeSpecs) {
-    const run = await runCliNegativeSmoke(spec);
-    cliNegativeSmokes.push(evaluateHighRiskCliSmokeResult(spec, run));
-}
-const reportBlockers = [];
-for (const target of new Set(cliSmokeSpecs.map((spec) => spec.target))) {
-    const targetResults = cliNegativeSmokes.filter((result) => result.target === target);
-    if (!targetResults.some((result) => result.blocked === true))
-        reportBlockers.push(`missing_cli_negative_smoke:${target}`);
-}
-for (const result of cliNegativeSmokes) {
-    if (result.blocked !== true || result.blockers.length === 0)
-        reportBlockers.push(`cli_negative_smoke_not_blocked:${result.target}`);
-}
-const report = {
-    schema: HIGH_RISK_CONTRACT_REPORT_SCHEMA,
-    ok: reportBlockers.length === 0,
-    generated_at: new Date().toISOString(),
-    super_search_ssrf_default_block: true,
-    static_preflight: true,
-    static_fixtures: negativeResults,
-    cli_negative_smokes: cliNegativeSmokes,
-    blockers: reportBlockers
-};
-const out = path.join(root, '.sneakoscope', 'reports', 'high-risk-contracts.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(report.ok, 'high-risk CLI negative smokes must reach a real blocking/no-mutation condition', { blockers: reportBlockers, cli_negative_smokes: cliNegativeSmokes, report: '.sneakoscope/reports/high-risk-contracts.json' });
-emitGate('security:high-risk-contracts', {
-    super_search_ssrf_default_block: true,
-    static_preflight: true,
-    static_fixture_count: negativeResults.length,
-    cli_negative_smoke_count: cliNegativeSmokes.length,
-    report: '.sneakoscope/reports/high-risk-contracts.json'
-});
-async function runCliNegativeSmoke(spec) {
-    assertGate(fs.existsSync(path.join(root, 'dist', 'bin', 'sks.js')), 'dist/bin/sks.js missing for high-risk CLI negative smokes', { hint: 'run npm run build first' });
-    const tempRoot = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'sks-high-risk-cli-'));
-    const cwd = path.join(tempRoot, 'workspace');
-    const home = path.join(tempRoot, 'home');
-    await fs.promises.mkdir(cwd, { recursive: true });
-    await fs.promises.mkdir(home, { recursive: true });
-    await fs.promises.mkdir(path.join(cwd, '.sneakoscope'), { recursive: true });
-    await prepareSmokeWorkspace(spec, cwd, home);
-    const before = await smokeBefore(spec, cwd, home);
-    const result = await runNodeSks(spec.argv.slice(1), {
-        cwd,
-        env: {
-            ...process.env,
-            HOME: home,
-            CODEX_HOME: path.join(home, '.codex'),
-            SKS_GLOBAL_ROOT: path.join(tempRoot, 'global-sks'),
-            SKS_UPDATE_MIGRATION_GATE_DISABLED: '1',
-            SKS_DISABLE_UPDATE_CHECK: '1',
-            SKS_UPDATE_QUIET: '1',
-            SKS_SIMPLE_GIT_LOCAL_LLM: '0',
-            SNEAKOSCOPE_VERSION_OVERRIDE: '5.11.0'
-        }
-    });
-    const after = await smokeAfter(spec, cwd, home);
-    if (spec.target === 'doctor --fix' && before.userConfigText === after.userConfigText) {
-        result.diagnostics = { doctor_config: doctorConfigCompare(before.userConfigText, after.userConfigText) };
-        result.stdout = `${result.stdout}\nuser_owned_file_without_sks_marker user_config_unchanged ${doctorConfigCompareLine(before.userConfigText, after.userConfigText)}`;
-    }
-    else if (spec.target === 'doctor --fix') {
-        result.diagnostics = { doctor_config: doctorConfigCompare(before.userConfigText, after.userConfigText) };
-        result.stdout = `${result.stdout}\ndoctor_touched_user_owned_file_without_sks_marker ${doctorConfigCompareLine(before.userConfigText, after.userConfigText)} after_excerpt=${JSON.stringify(String(after.userConfigText || '').slice(0, 200))}`;
-    }
-    return result;
-}
-async function prepareSmokeWorkspace(spec, cwd, home) {
-    if (spec.target === 'commit-and-push') {
-        await runProcess('git', ['init', '-q'], { cwd });
-        await runProcess('git', ['config', 'user.email', 'smoke@example.invalid'], { cwd });
-        await runProcess('git', ['config', 'user.name', 'SKS Smoke'], { cwd });
-        await fs.promises.writeFile(path.join(cwd, 'smoke.txt'), 'smoke\n');
-    }
-    if (spec.target === 'doctor --fix') {
-        await fs.promises.mkdir(path.join(cwd, '.codex'), { recursive: true });
-        await fs.promises.writeFile(path.join(cwd, '.codex', 'config.toml'), 'user_config = true\n');
-        await fs.promises.mkdir(path.join(home, '.codex'), { recursive: true });
-        await fs.promises.writeFile(path.join(home, '.codex', 'config.toml'), 'user_home_config = true\n');
-    }
-}
-async function smokeBefore(spec, cwd, _home) {
-    if (spec.target !== 'doctor --fix')
-        return {};
-    return { userConfigText: await fs.promises.readFile(path.join(cwd, '.codex', 'config.toml'), 'utf8') };
-}
-async function smokeAfter(spec, cwd, _home) {
-    if (spec.target !== 'doctor --fix')
-        return {};
-    return { userConfigText: await fs.promises.readFile(path.join(cwd, '.codex', 'config.toml'), 'utf8').catch(() => '') };
-}
-function runNodeSks(args, opts) {
-    return runProcess(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), ...args], opts);
-}
-function runProcess(command, args, opts = {}) {
-    return new Promise((resolve) => {
-        const child = spawn(command, args, {
-            cwd: opts.cwd,
-            env: opts.env || process.env,
-            stdio: ['ignore', 'pipe', 'pipe']
-        });
-        let stdout = '';
-        let stderr = '';
-        let timedOut = false;
-        const maxBytes = 128 * 1024;
-        const timer = setTimeout(() => {
-            timedOut = true;
-            child.kill('SIGTERM');
-        }, opts.timeoutMs || 45_000);
-        child.stdout.on('data', (chunk) => {
-            stdout = boundedAppend(stdout, chunk, maxBytes);
-        });
-        child.stderr.on('data', (chunk) => {
-            stderr = boundedAppend(stderr, chunk, maxBytes);
-        });
-        child.on('close', (code) => {
-            clearTimeout(timer);
-            resolve({ exit_code: code, stdout, stderr, timed_out: timedOut });
-        });
-        child.on('error', (err) => {
-            clearTimeout(timer);
-            resolve({ exit_code: 1, stdout, stderr: `${stderr}\n${err.message}`, timed_out: timedOut });
-        });
-    });
-}
-function boundedAppend(current, chunk, maxBytes) {
-    const next = current + chunk.toString('utf8');
-    return Buffer.byteLength(next) > maxBytes ? next.slice(-maxBytes) : next;
-}
-function doctorConfigCompareLine(before, after) {
-    const compare = doctorConfigCompare(before, after);
-    return `before_len=${compare.before_len} after_len=${compare.after_len} before_sha=${compare.before_sha} after_sha=${compare.after_sha}`;
-}
-function doctorConfigCompare(before, after) {
-    const beforeText = String(before || '');
-    const afterText = String(after || '');
-    return {
-        unchanged: beforeText === afterText,
-        before_len: Buffer.byteLength(beforeText),
-        after_len: Buffer.byteLength(afterText),
-        before_sha: sha(beforeText),
-        after_sha: sha(afterText),
-        after_excerpt: afterText.slice(0, 200)
-    };
-}
-function sha(value) {
-    return crypto.createHash('sha256').update(value).digest('hex').slice(0, 16);
-}

package/dist/scripts/hook-latency-quantum-check.js

@@ -1,120 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { performance } from 'node:perf_hooks';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { runProcess } = await importDist('core/fsx.js');
-const scenarios = [
-    { name: 'no-state', prompt: 'hello', budget_p95_ms: 230 },
-    { name: 'active-route', prompt: 'continue current route', budget_p95_ms: 230, state: { mission_id: 'M-active', mode: 'NARUTO', route: 'Naruto', route_command: '$Naruto', phase: 'EXECUTE', implementation_allowed: true } },
-    { name: 'stale-code-pack-note', prompt: 'status?', budget_p95_ms: 230, files: { '.sneakoscope/wiki/code-pack.json': JSON.stringify({ generated_at: '2000-01-01T00:00:00.000Z' }) } },
-    { name: 'no-question-queue', prompt: 'can I interrupt?', budget_p95_ms: 230, state: { mission_id: 'M-noq', mode: 'RESEARCH', phase: 'RESEARCH_RUNNING_NO_QUESTIONS' } },
-    { name: 'clarification-awaiting', prompt: 'here is the answer', budget_p95_ms: 230, state: { mission_id: 'M-clarify', mode: 'NARUTO', phase: 'CLARIFICATION_AWAITING_ANSWERS', stop_gate: 'clarification-gate', ambiguity_gate_required: true, clarification_required: true, implementation_allowed: false } },
-    { name: 'super-search-prompt', prompt: '$Super-Search run "npm release notes"', budget_p95_ms: 420 },
-    { name: 'question-shaped-work-request', prompt: 'Can you fix the failing tests?', budget_p95_ms: 420 }
-];
-const warmups = Number(process.env.SKS_HOOK_LATENCY_WARMUPS || 2);
-const runs = Number(process.env.SKS_HOOK_LATENCY_RUNS || 15);
-const report = await runHookScenarios();
-const out = path.join(root, '.sneakoscope', 'reports', 'hook-latency-quantum.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(report.ok, 'hook_latency_quantum_failed', report);
-emitGate('hook:latency-quantum', { scenarios: report.scenarios.length, report: '.sneakoscope/reports/hook-latency-quantum.json' });
-async function runHookScenarios() {
-    const scenarioResults = [];
-    const blockers = [];
-    for (const scenario of scenarios) {
-        const result = await runOne(scenario);
-        scenarioResults.push(result);
-        if (result.failures.length)
-            blockers.push(`${scenario.name}:process_failed`);
-        if (result.p95_ms > result.budget_p95_ms)
-            blockers.push(`${scenario.name}:p95_budget_exceeded`);
-    }
-    return {
-        schema: 'sks.hook-latency-quantum.v1',
-        ok: blockers.length === 0,
-        generated_at: new Date().toISOString(),
-        warmup_runs: warmups,
-        measure_runs: runs,
-        scenarios: scenarioResults,
-        blockers
-    };
-}
-async function runOne(scenario) {
-    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), `sks-hook-${scenario.name}-`));
-    try {
-        seedRoot(tmp, scenario);
-        const durations = [];
-        const failures = [];
-        for (let i = 0; i < warmups + runs; i++) {
-            const phase = i < warmups ? 'warmup' : 'measure';
-            const measured = await timed(tmp, scenario, phase === 'measure' ? i - warmups + 1 : i + 1, phase);
-            if (phase === 'measure')
-                durations.push(measured.duration_ms);
-            if (measured.code !== 0)
-                failures.push(measured);
-        }
-        durations.sort((a, b) => a - b);
-        const p95 = percentile(durations, 0.95);
-        const p50 = percentile(durations, 0.5);
-        return {
-            name: scenario.name,
-            runs,
-            p50_ms: p50,
-            p95_ms: p95,
-            budget_p95_ms: scenario.budget_p95_ms,
-            ok: failures.length === 0 && p95 <= scenario.budget_p95_ms,
-            failures
-        };
-    }
-    finally {
-        fs.rmSync(tmp, { recursive: true, force: true });
-    }
-}
-async function timed(tmp, scenario, run, phase) {
-    const started = performance.now();
-    const payload = JSON.stringify({ prompt: scenario.prompt, cwd: tmp, conversation_id: `quantum-${scenario.name}` });
-    const res = await runProcess(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), 'hook', 'user-prompt-submit'], {
-        cwd: tmp,
-        input: payload,
-        timeoutMs: 10000,
-        maxOutputBytes: 64 * 1024,
-        env: { SKS_DISABLE_NETWORK: '1', SKS_PERF_MEASURE: '1', SKS_DISABLE_UPDATE_CHECK: '1' }
-    });
-    return {
-        run,
-        phase,
-        code: res.code,
-        duration_ms: Math.round(performance.now() - started),
-        stderr_tail: String(res.stderr || '').slice(-4000)
-    };
-}
-function seedRoot(tmp, scenario) {
-    fs.mkdirSync(path.join(tmp, '.sneakoscope', 'state', 'sessions'), { recursive: true });
-    fs.mkdirSync(path.join(tmp, '.sneakoscope', 'missions'), { recursive: true });
-    fs.writeFileSync(path.join(tmp, 'package.json'), '{"name":"hook-latency-fixture","type":"module"}\n');
-    if (scenario.state) {
-        const state = { ...scenario.state, _session_key: 'quantum', updated_at: new Date().toISOString() };
-        fs.writeFileSync(path.join(tmp, '.sneakoscope', 'state', 'current.json'), `${JSON.stringify(state, null, 2)}\n`);
-        const missionId = String(scenario.state.mission_id || '');
-        if (missionId) {
-            const dir = path.join(tmp, '.sneakoscope', 'missions', missionId);
-            fs.mkdirSync(dir, { recursive: true });
-            fs.writeFileSync(path.join(dir, 'mission.json'), `${JSON.stringify({ id: missionId, mode: scenario.state.mode || 'NARUTO', created_at: new Date().toISOString() }, null, 2)}\n`);
-        }
-    }
-    for (const [rel, text] of Object.entries(scenario.files || {})) {
-        const file = path.join(tmp, rel);
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, `${text}\n`);
-    }
-}
-function percentile(values, pct) {
-    if (!values.length)
-        return 0;
-    const index = Math.min(values.length - 1, Math.max(0, Math.ceil(values.length * pct) - 1));
-    return values[index] || 0;
-}

package/dist/scripts/import-graph-budget-check.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { writeImportGraphBudgetReport } = await importDist('core/perf/import-graph-budget.js');
-const report = await writeImportGraphBudgetReport(root);
-assertGate(report.ok, 'import_graph_budget_failed', report);
-emitGate('runtime:import-budget', {
-    checked_files: report.checked_files.length,
-    report_path: '.sneakoscope/reports/import-graph-budget.json'
-});

package/dist/scripts/mcp-tool-naming-parity-check.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'mcp', 'mcp-tool-name-normalizer.js')).href);
-const report = mod.normalizeMcpToolInventory([{ server: 'github', name: 'search issues' }, { server: 'github', name: 'search_issues' }]);
-const ok = report.ok && report.collision_count === 1 && report.normalized.every((row) => row.normalized_name.includes('github'));
-emit({ schema: 'sks.mcp-tool-naming-parity-check.v1', ok, report });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.mcp-tool-naming-parity-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }

package/dist/scripts/naruto-codex-e2e-check.js

@@ -1,105 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-import { runProcess } from '../core/fsx.js';
-const mode = readOption(process.argv.slice(2), '--mode', 'hermetic');
-const realMode = mode === 'real-codex';
-const requireReal = process.env.SKS_REQUIRE_CODEX_E2E === '1';
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), `sks-naruto-${mode}-`));
-fs.mkdirSync(path.join(tempRoot, '.sneakoscope'), { recursive: true });
-fs.writeFileSync(path.join(tempRoot, 'package.json'), '{"name":"sks-naruto-e2e-fixture","type":"module"}\n');
-if (realMode) {
-    const codexProbe = await runProcess(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), 'codex', 'version', '--json'], {
-        cwd: root,
-        timeoutMs: 30_000,
-        maxOutputBytes: 128 * 1024
-    });
-    assertGate(codexProbe.code === 0 || !requireReal, 'real Codex E2E requires a runnable Codex CLI before publish', {
-        code: codexProbe.code,
-        stderr_tail: tail(codexProbe.stderr),
-        stdout_tail: tail(codexProbe.stdout)
-    });
-}
-const args = [
-    path.join(root, 'dist', 'bin', 'sks.js'),
-    'naruto',
-    'run',
-    realMode ? 'real Codex E2E readonly smoke' : 'hermetic Naruto E2E readonly smoke',
-    '--json',
-    '--readonly',
-    '--agents',
-    realMode ? '2' : '3',
-    '--max-threads',
-    realMode ? '2' : '3'
-];
-const run = await runProcess(process.execPath, args, {
-    cwd: tempRoot,
-    timeoutMs: realMode ? readPositiveIntEnv('SKS_NARUTO_REAL_E2E_TIMEOUT_MS', 300_000) : 90_000,
-    maxOutputBytes: 1024 * 1024,
-    env: {
-        ...process.env,
-        SKS_CODEX_ALLOW_NON_GIT: realMode ? '1' : process.env.SKS_CODEX_ALLOW_NON_GIT || '',
-        SKS_DISABLE_NETWORK: realMode ? process.env.SKS_DISABLE_NETWORK || '' : '1',
-        SKS_DISABLE_UPDATE_CHECK: '1',
-        SKS_NARUTO_STANDALONE_CLI: realMode ? '1' : '0',
-        SKS_NARUTO_APP_SESSION: realMode ? '0' : '1',
-        CODEX_THREAD_ID: realMode ? process.env.CODEX_THREAD_ID || '' : `naruto-e2e-${path.basename(tempRoot)}`
-    }
-});
-const parsed = parseJsonObjectFromStdout(run.stdout);
-const ok = realMode
-    ? run.code === 0 && parsed?.ok === true && parsed?.route === '$sks-naruto' && parsed?.status === 'completed'
-    : run.code === 0
-        && parsed?.ok === false
-        && parsed?.route === '$sks-naruto'
-        && parsed?.status === 'delegation_context_ready'
-        && parsed?.app_session === true;
-assertGate(ok || (realMode && !requireReal), `${mode} Naruto E2E failed`, {
-    code: run.code,
-    parsed,
-    stdout_tail: tail(run.stdout),
-    stderr_tail: tail(run.stderr),
-    tempRoot
-});
-emitGate(realMode ? 'naruto:e2e-real-codex' : 'naruto:e2e-hermetic', {
-    mode,
-    temp_root: tempRoot,
-    mission_id: parsed?.mission_id || null,
-    readonly: true,
-    preparation_only: !realMode,
-    real_required: requireReal
-});
-function readOption(args, name, fallback = null) {
-    const index = args.indexOf(name);
-    return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
-}
-function readPositiveIntEnv(name, fallback) {
-    const parsed = Number(process.env[name]);
-    return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
-}
-function tail(value, limit = 4000) {
-    const text = String(value || '');
-    return text.length > limit ? text.slice(-limit) : text;
-}
-function parseJsonObjectFromStdout(stdout) {
-    const text = String(stdout || '').trim();
-    const first = text.indexOf('{');
-    const last = text.lastIndexOf('}');
-    if (first >= 0 && last > first) {
-        try {
-            return JSON.parse(text.slice(first, last + 1));
-        }
-        catch { }
-    }
-    for (const line of text.split(/\r?\n/).reverse()) {
-        try {
-            const parsed = JSON.parse(line);
-            if (parsed && typeof parsed === 'object')
-                return parsed;
-        }
-        catch { }
-    }
-    return null;
-}

package/dist/scripts/naruto-write-e2e-check.js

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-import { runNarutoWriteE2e } from '../core/naruto/naruto-write-e2e.js';
-import fs from 'node:fs/promises';
-import path from 'node:path';
-const mode = readMode(process.argv.slice(2));
-const report = await runNarutoWriteE2e(mode);
-await writeReport(mode, report);
-console.log(JSON.stringify(report, null, 2));
-if (!report.ok)
-    process.exit(1);
-async function writeReport(mode, report) {
-    const root = process.cwd();
-    const dir = path.join(root, '.sneakoscope', 'reports');
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(path.join(dir, 'naruto-write-e2e.json'), `${JSON.stringify(report, null, 2)}\n`);
-    if (mode === 'real-codex') {
-        await fs.writeFile(path.join(dir, 'naruto-real-write-e2e.json'), `${JSON.stringify(report, null, 2)}\n`);
-    }
-}
-function readMode(args) {
-    const index = args.indexOf('--mode');
-    const value = index >= 0 ? args[index + 1] : 'hermetic';
-    if (value === 'hermetic' || value === 'real-codex')
-        return value;
-    console.error(JSON.stringify({
-        ok: false,
-        status: 'blocked',
-        blockers: [`invalid_mode:${String(value || '')}`]
-    }, null, 2));
-    process.exit(1);
-}

package/dist/scripts/native-capability-postcheck-check.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
-import { buildNativeCapabilityRepairMatrix } from '../core/codex-native/native-capability-repair-matrix.js';
-import { postcheckNativeCapabilities } from '../core/codex-native/native-capability-postcheck.js';
-import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
-const root = await makeTempRoot('sks-native-postcheck-');
-const matrix = await buildNativeCapabilityRepairMatrix({ root, fixture: 'manual-required', reportPath: null });
-const postcheck = await postcheckNativeCapabilities({ root, matrix, fixture: 'manual-required' });
-const chrome = postcheck.capabilities.find((state) => state.id === 'chrome_web_review');
-const repairedManual = await repairNativeCapabilities({ root, fix: true, yes: true, fixture: 'manual-required' });
-const imagePath = repairedManual.capabilities.find((state) => state.id === 'image_path_exposure');
-assertGate(chrome?.after !== 'verified', 'postcheck must not verify Chrome/web review without extension readiness', postcheck);
-assertGate(postcheck.ok === true && postcheck.blockers.length === 0 && Array.isArray(postcheck.route_blockers['route-chrome-web-review']), 'postcheck must keep Chrome manual readiness as route blocker only', postcheck);
-assertGate(imagePath?.after === 'degraded', 'saved artifact path fallback must be degraded, not verified native image path exposure', repairedManual);
-assertGate(postcheck.capabilities.every((state) => state.after !== null), 'postcheck must set after state for each capability', postcheck);
-emitGate('native-capability:postcheck');

package/dist/scripts/ops-diagnostics-bundle-check.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-import { buildOpsDiagnosticsBundle, writeOpsDiagnosticsBundle } from '../core/ops/diagnostics-bundle.js';
-const report = await buildOpsDiagnosticsBundle(root);
-const reportPath = await writeOpsDiagnosticsBundle(root);
-assertGate(report.ok === true, 'ops diagnostics bundle must pass without blockers', report);
-assertGate(report.secret_scan?.raw_values_recorded === false, 'ops diagnostics bundle must not record raw secret values', report.secret_scan);
-assertGate(Array.isArray(report.redacted_env_keys), 'ops diagnostics bundle must list env keys only', report.redacted_env_keys);
-assertGate(typeof report.node_version === 'string' && report.node_version.startsWith('v'), 'ops diagnostics bundle must include node version', report.node_version);
-assertGate(typeof report.platform === 'string' && report.platform.length > 0, 'ops diagnostics bundle must include platform', report.platform);
-emitGate('ops:diagnostics-bundle', { report: reportPath.replace(`${root}/`, '') });

package/dist/scripts/parallel-production-smoke-check.js

@@ -1,20 +0,0 @@
-#!/usr/bin/env node
-import fsp from 'node:fs/promises';
-import path from 'node:path';
-import { runParallelProductionSmoke } from '../core/agents/parallel-write-fixture.js';
-const report = await runParallelProductionSmoke({ injectFailure: true });
-const reportPath = path.join(process.cwd(), '.sneakoscope', 'reports', 'parallel-production-smoke.json');
-await fsp.mkdir(path.dirname(reportPath), { recursive: true });
-await fsp.writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`);
-if (!report.ok) {
-    console.error(JSON.stringify({ ok: false, blockers: report.blockers, reportPath }, null, 2));
-    process.exit(1);
-}
-console.log(JSON.stringify({
-    ok: true,
-    reportPath,
-    worker_count: report.worker_count,
-    changed_files: report.changed_files,
-    patch_envelope_count: report.patch_envelope_count,
-    failure_injection: report.failure_injection
-}, null, 2));

package/dist/scripts/perf-budget-check.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const config = JSON.parse(fs.readFileSync(path.join(root, 'config/perf-budgets.v1.json'), 'utf8'));
-const { writePerfBudgetReport } = await importDist('core/perf/perf-budget.js');
-const report = await writePerfBudgetReport(root, config.commands || []);
-assertGate(report.ok, 'perf_budget_failed', report);
-emitGate('perf:budgets', {
-    commands: report.commands.length,
-    slowest_p95_ms: Math.max(...report.commands.map((row) => row.p95_ms), 0)
-});

package/dist/scripts/project-skill-dedupe-blackbox.js

@@ -1,62 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import fs from 'node:fs/promises';
-import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
-import { dedupeProjectSkills } from '../core/codex-native/project-skill-dedupe.js';
-import { syncCodexSksSkills, withSkillSyncLock } from '../core/codex-app/codex-skill-sync.js';
-import { buildSkillRegistryLedger } from '../core/codex-native/skill-registry-ledger.js';
-const removeFixture = fs.rm.bind(fs);
-const root = await makeTempRoot('sks-skill-dedupe-blackbox-');
-const home = await makeTempRoot('sks-skill-dedupe-home-');
-process.env.HOME = home;
-process.env.CODEX_HOME = path.join(home, '.codex');
-await writeManagedFixture(home, '.agents/skills', 'managed-loop');
-await writeManagedFixture(root, '.agents/skills', 'managed-loop');
-await writeManagedFixture(root, '.codex/skills', 'managed-loop');
-const scenarioA = await dedupeProjectSkills({ root, fix: true, yes: true });
-await writeUserSkill(root, '.agents/skills', 'user-loop', 'fixture-loop');
-await writeManagedFixture(root, '.codex/skills', 'managed-loop');
-const scenarioB = await dedupeProjectSkills({ root, fix: true, yes: true });
-await guardedRm(path.join(home, '.agents', 'skills', 'managed-loop'), path.join(home, '.agents', 'skills'));
-await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Fixture Loop');
-await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'fixture_loop');
-const scenarioC = await dedupeProjectSkills({ root, fix: true, yes: false });
-const scenarioD = await dedupeProjectSkills({ root, fix: true, yes: true, quarantineUserDuplicates: true });
-const staleRoot = await makeTempRoot('sks-skill-stale-lock-');
-const lockPath = path.join(staleRoot, '.sneakoscope', 'locks', 'skill-sync.lock');
-await fs.mkdir(lockPath, { recursive: true });
-await fs.writeFile(path.join(lockPath, 'owner.json'), JSON.stringify({ schema: 'sks.skill-sync-lock.v1', pid: 999999, acquired_at: '1970-01-01T00:00:00.000Z', stale_after_ms: 1 }), 'utf8');
-await withSkillSyncLock(staleRoot, async () => undefined);
-const concurrentRoot = await makeTempRoot('sks-skill-concurrent-');
-const concurrentHome = await makeTempRoot('sks-skill-concurrent-home-');
-process.env.HOME = concurrentHome;
-process.env.CODEX_HOME = path.join(concurrentHome, '.codex');
-const skillsRoot = path.join(process.env.CODEX_HOME, 'skills');
-await Promise.all(Array.from({ length: 20 }, () => syncCodexSksSkills({ root: concurrentRoot, apply: true, skillsRoot })));
-const concurrentLedger = await buildSkillRegistryLedger({ root: concurrentRoot });
-assertGate(scenarioA.actions.some((action) => action.action === 'quarantined'), 'scenario A must quarantine SKS-managed duplicate', scenarioA);
-assertGate(scenarioB.actions.some((action) => action.reason.includes('user-authored skill preserved')), 'scenario B must preserve user-authored skill', scenarioB);
-assertGate(scenarioC.blockers.some((blocker) => blocker.includes('user_duplicate_requires_confirmation')), 'scenario C must not auto-delete user-authored duplicates', scenarioC);
-assertGate(scenarioD.active_unique_by_canonical_name === true, 'scenario D must quarantine confirmed user-authored duplicate', scenarioD);
-assertGate(concurrentLedger.active_unique_by_canonical_name === true, 'scenario F must keep exactly one active canonical name after concurrent sync', concurrentLedger);
-emitGate('skill:dedupe-blackbox');
-async function writeManagedFixture(root, relRoot, dirName) {
-    await writeText(path.join(root, relRoot, dirName, 'SKILL.md'), [
-        '---',
-        'name: fixture-loop',
-        'description: managed fixture',
-        '---',
-        '',
-        '<!-- BEGIN SKS MANAGED SKILL v-test name=fixture-loop -->',
-        ''
-    ].join('\n'));
-}
-async function guardedRm(target, allowedRoot) {
-    const root = path.resolve(allowedRoot);
-    const resolved = path.resolve(target);
-    const relative = path.relative(root, resolved);
-    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
-        throw new Error('refusing_to_remove_unscoped_skill_fixture');
-    }
-    await removeFixture(resolved, { recursive: true, force: true });
-}