sneakoscope 7.1.0 → 7.3.0

package/dist/scripts/sizecheck.js

@@ -1,148 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { DEFAULT_MAX_PACK_BYTES, DEFAULT_MAX_UNPACKED_BYTES } from '../core/release/package-size-budget.js';
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const limits = {
-    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || DEFAULT_MAX_PACK_BYTES),
-    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || DEFAULT_MAX_UNPACKED_BYTES),
-    packFiles: Number(process.env.SKS_MAX_PACK_FILES || 2100),
-    trackedFileBytes: Number(process.env.SKS_MAX_TRACKED_FILE_BYTES || 384 * 1024)
-};
-const trackedFileSizeAllowlist = new Set([
-    'docs/sks-local-llm-mode/exports/sks-local-llm-mode-deck.pdf',
-    'release-gates.v2.json',
-    'schemas/codex/app-server-0.145/codex_app_server_protocol.schemas.json',
-    'schemas/codex/app-server-0.145/codex_app_server_protocol.v2.schemas.json'
-]);
-const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-function fail(message, detail = '') {
-    console.error(`Size check failed: ${message}`);
-    if (detail)
-        console.error(detail.trim());
-    process.exit(2);
-}
-function fmt(bytes) {
-    if (bytes < 1024)
-        return `${bytes} B`;
-    if (bytes < 1024 * 1024)
-        return `${(bytes / 1024).toFixed(1)} KiB`;
-    return `${(bytes / 1024 / 1024).toFixed(2)} MiB`;
-}
-function run(cmd, args, options = {}) {
-    return spawnSync(cmd, args, {
-        cwd: root,
-        encoding: 'utf8',
-        ...options
-    });
-}
-function checkTrackedFiles() {
-    const result = run('git', ['ls-files', '-z'], { encoding: 'buffer' });
-    if (result.status !== 0)
-        fail('unable to list tracked files', result.stderr?.toString('utf8') || '');
-    const files = result.stdout.toString('utf8').split('\0').filter(Boolean);
-    const oversized = [];
-    for (const file of files) {
-        if (trackedFileSizeAllowlist.has(file))
-            continue;
-        let stat;
-        try {
-            stat = fs.statSync(path.join(root, file));
-        }
-        catch (err) {
-            if (err?.code === 'ENOENT')
-                continue;
-            throw err;
-        }
-        if (stat.size > limits.trackedFileBytes)
-            oversized.push(`${file} (${fmt(stat.size)})`);
-    }
-    if (oversized.length) {
-        fail(`tracked file exceeds ${fmt(limits.trackedFileBytes)}`, oversized.join('\n'));
-    }
-}
-function checkVersionSync() {
-    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
-    const lock = JSON.parse(fs.readFileSync(path.join(root, 'package-lock.json'), 'utf8'));
-    const source = fs.readFileSync(path.join(root, 'src', 'core', 'version.ts'), 'utf8');
-    const fsx = fs.readFileSync(path.join(root, 'src', 'core', 'fsx.ts'), 'utf8');
-    const tsBin = fs.readFileSync(path.join(root, 'src', 'bin', 'sks.ts'), 'utf8');
-    const cargoToml = fs.readFileSync(path.join(root, 'crates', 'sks-core', 'Cargo.toml'), 'utf8');
-    const cargoLock = fs.readFileSync(path.join(root, 'crates', 'sks-core', 'Cargo.lock'), 'utf8');
-    const cargoMain = fs.readFileSync(path.join(root, 'crates', 'sks-core', 'src', 'main.rs'), 'utf8');
-    const sourceVersion = source.match(/export const PACKAGE_VERSION = ['"]([^'"]+)['"];/)?.[1];
-    const fsxReExportsVersion = /PACKAGE_VERSION\s*}\s*from\s*['"]\.\/version(?:\.js)?['"]/.test(fsx);
-    const fsxVersion = fsxReExportsVersion ? sourceVersion : fsx.match(/export const PACKAGE_VERSION = ['"]([^'"]+)['"];/)?.[1];
-    const tsBinReExportsVersion = /PACKAGE_VERSION\s*}\s*from\s*['"]\.\.\/core\/version(?:\.js)?['"]/.test(tsBin);
-    const tsBinVersion = tsBinReExportsVersion ? sourceVersion : tsBin.match(/const FAST_PACKAGE_VERSION = ['"]([^'"]+)['"];/)?.[1];
-    const cargoTomlVersion = cargoToml.match(/^version = "([^"]+)"/m)?.[1];
-    const cargoLockVersion = cargoLock.match(/\[\[package\]\]\nname = "sks-core"\nversion = "([^"]+)"/)?.[1];
-    const cargoMainUsesCargoPkgVersion = /env!\(\s*"CARGO_PKG_VERSION"\s*\)/.test(cargoMain);
-    const cargoMainVersion = cargoMainUsesCargoPkgVersion ? cargoTomlVersion : cargoMain.match(/println!\("sks-rs ([^"]+)"\)/)?.[1];
-    const lockRootVersion = lock.packages?.['']?.version;
-    const mismatches = [
-        ['package-lock.json version', lock.version],
-        ['package-lock root package version', lockRootVersion],
-        ['src/core/version.ts PACKAGE_VERSION', sourceVersion],
-        ['src/core/fsx.ts PACKAGE_VERSION', fsxVersion],
-        ['src/bin/sks.ts FAST_PACKAGE_VERSION', tsBinVersion],
-        ['crates/sks-core/Cargo.toml version', cargoTomlVersion],
-        ['crates/sks-core/Cargo.lock sks-core version', cargoLockVersion],
-        ['crates/sks-core/src/main.rs sks-rs version', cargoMainVersion]
-    ].filter(([, version]) => version !== pkg.version);
-    if (mismatches.length) {
-        fail('package version metadata is not synchronized', [
-            `package.json version: ${pkg.version}`,
-            ...mismatches.map(([label, version]) => `${label}: ${version || 'missing'}`)
-        ].join('\n'));
-    }
-}
-function checkPackageFootprint() {
-    const env = {
-        ...process.env,
-        npm_config_cache: process.env.SKS_SIZECHECK_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache')
-    };
-    const result = run(npmBin, ['pack', '--dry-run', '--json', '--ignore-scripts'], { env });
-    if (result.status !== 0)
-        fail('npm pack dry-run failed', `${result.stdout || ''}\n${result.stderr || ''}`);
-    let info;
-    try {
-        info = JSON.parse(result.stdout)[0];
-    }
-    catch {
-        fail('npm pack dry-run returned non-json output', result.stdout || '');
-    }
-    if (!info)
-        fail('npm pack dry-run returned no package metadata');
-    const forbiddenPatterns = [
-        /^\.agents\//,
-        /^\.codex\//,
-        /^\.dcodex\//,
-        /^\.omx\//,
-        /^\.sneakoscope\//,
-        /^native\//,
-        /^node_modules\//,
-        /^scripts\//,
-        /^tmp\//,
-        /^logs\//,
-        /\.(tgz|zip|tar|tar\.gz|log)$/i
-    ];
-    const forbidden = (info.files || [])
-        .map((file) => file.path)
-        .filter((file) => forbiddenPatterns.some((pattern) => pattern.test(file)));
-    if (forbidden.length)
-        fail('npm package includes forbidden files', forbidden.join('\n'));
-    if (info.size > limits.packedBytes)
-        fail(`npm tarball exceeds ${fmt(limits.packedBytes)}`, `${info.filename}: ${fmt(info.size)}`);
-    if (info.unpackedSize > limits.unpackedBytes)
-        fail(`npm unpacked size exceeds ${fmt(limits.unpackedBytes)}`, `${info.filename}: ${fmt(info.unpackedSize)}`);
-    if (info.entryCount > limits.packFiles)
-        fail(`npm package file count exceeds ${limits.packFiles}`, `${info.entryCount} files`);
-    console.log(`Size check passed: ${fmt(info.size)} packed, ${fmt(info.unpackedSize)} unpacked, ${info.entryCount} files.`);
-}
-checkTrackedFiles();
-checkVersionSync();
-checkPackageFootprint();

package/dist/scripts/sks-menubar-install-check.js

@@ -1,333 +0,0 @@
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { PACKAGE_VERSION, runProcess, sha256, which } from '../core/fsx.js';
-import { aggregateFileHashes, installSksMenuBar, NATIVE_RESOURCE_FILES, NATIVE_SOURCE_FILES, rollbackSksMenuBar } from '../core/codex-app/sks-menubar.js';
-const temp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-menubar-check-'));
-const fakeRoot = path.join(temp, 'project-root');
-await fs.mkdir(fakeRoot, { recursive: true });
-const firstEntry = await writeProbeEntry(path.join(fakeRoot, 'first', 'dist', 'bin', 'sks.js'));
-const replacementEntry = await writeProbeEntry(path.join(fakeRoot, 'replacement', 'dist', 'bin', 'sks.js'));
-const env = { ...process.env, SKS_SKIP_SKS_MENUBAR_LAUNCH: '1' };
-const initialResult = await installSksMenuBar({
-    apply: true, launch: false, home: temp, root: fakeRoot, sksEntry: firstEntry, env, quiet: true
-});
-if (process.platform !== 'darwin') {
-    const ok = initialResult.ok && initialResult.status === 'unsupported_platform';
-    console.log(JSON.stringify({
-        schema: 'sks.sks-menubar-install-check.v2', ok, temp, result: initialResult,
-        is_idempotent: false, previous_app_rollback_verified: false, actual_rollback_verified: false,
-        resource_sha256: null, resources_sha256: null,
-        blockers: ok ? [] : ['sks_menubar_install_check_failed']
-    }, null, 2));
-    if (!ok)
-        process.exit(1);
-    process.exit(0);
-}
-const initialAppPath = required(initialResult.app_path, 'initial app path');
-const initialExecutable = required(initialResult.executable_path, 'initial executable path');
-const initialStamp = required(initialResult.build_stamp, 'initial build stamp');
-const installDir = path.dirname(initialAppPath);
-const initialExecutableSha256 = sha256(await fs.readFile(initialExecutable));
-const initialInfoPlistSha256 = sha256(await fs.readFile(path.join(initialAppPath, 'Contents', 'Info.plist')));
-const initialActionScript = await fs.readFile(required(initialResult.action_script_path, 'initial action script path'), 'utf8');
-const initialLaunchAgent = await fs.readFile(required(initialResult.launch_agent_path, 'initial launch agent path'), 'utf8');
-const secondResult = await installSksMenuBar({
-    apply: true, launch: false, home: temp, root: fakeRoot, sksEntry: firstEntry, env, quiet: true
-});
-const secondExecutableSha256 = sha256(await fs.readFile(required(secondResult.executable_path, 'second executable path')));
-const isIdempotent = secondResult.ok
-    && secondResult.actions.includes('menubar_up_to_date')
-    && secondExecutableSha256 === initialExecutableSha256
-    && secondResult.build_stamp?.source_sha256 === initialStamp.source_sha256
-    && secondResult.build_stamp?.resources_sha256 === initialStamp.resources_sha256;
-const result = await installSksMenuBar({
-    apply: true, launch: false, home: temp, root: fakeRoot, sksEntry: replacementEntry, env, quiet: true
-});
-const appPath = required(result.app_path, 'final app path');
-const executablePath = required(result.executable_path, 'final executable path');
-const buildStamp = required(result.build_stamp, 'final build stamp');
-const resourcesDir = path.join(appPath, 'Contents', 'Resources');
-const sourcesDir = path.join(installDir, 'Sources');
-const previousAppPath = `${appPath}.previous`;
-const previousExecutablePath = path.join(previousAppPath, 'Contents', 'MacOS', 'SKSMenuBar');
-const previousBuildStampPath = path.join(installDir, 'build-stamp.json.previous');
-const previousActionScriptPath = path.join(installDir, 'sks-menubar-action.sh.previous');
-const previousLaunchAgentPath = path.join(installDir, 'com.sneakoscope.sks-menubar.plist.previous');
-const installedSourceNames = (await fs.readdir(sourcesDir)).sort();
-const installedResourceNames = (await fs.readdir(resourcesDir)).sort();
-const sourceHashes = await hashNamedFiles(sourcesDir, [...NATIVE_SOURCE_FILES]);
-const resourceHashes = await hashNamedFiles(resourcesDir, [...NATIVE_RESOURCE_FILES]);
-const sourceSha256 = aggregateFileHashes(sourceHashes);
-const resourcesSha256 = aggregateFileHashes(resourceHashes);
-const sourceBindingVerified = sourceSha256 === buildStamp.source_sha256
-    && recordsEqual(sourceHashes, buildStamp.source_files_sha256);
-const resourceBindingVerified = resourcesSha256 === buildStamp.resources_sha256
-    && recordsEqual(resourceHashes, buildStamp.resource_files_sha256);
-const infoPlistPath = path.join(appPath, 'Contents', 'Info.plist');
-const infoPlist = await fs.readFile(infoPlistPath, 'utf8');
-const infoPlistIconVerified = /<key>CFBundleIconFile<\/key>\s*<string>AppIcon<\/string>/.test(infoPlist)
-    && /<key>CFBundleDisplayName<\/key>\s*<string>SKS<\/string>/.test(infoPlist)
-    && /<key>LSUIElement<\/key>\s*<true\/>/.test(infoPlist)
-    && sha256(infoPlist) === buildStamp.info_plist_sha256;
-const appIconPath = path.join(resourcesDir, 'AppIcon.icns');
-const iconLoadSmoke = await imageLoadSmoke(appIconPath);
-const signature = await strictCodesign(appPath);
-const previousSignature = await strictCodesign(previousAppPath);
-const swiftCompile = result.actions.includes(`compiled ${NATIVE_SOURCE_FILES.length} Swift sources`);
-const swiftParse = await swiftParseSmoke(sourcesDir);
-const actionScriptExecutable = await isExecutable(required(result.action_script_path, 'final action script path'));
-const launchAgent = await fs.readFile(required(result.launch_agent_path, 'launch agent path'), 'utf8');
-const launchAgentSafe = !launchAgent.includes('<key>KeepAlive</key>')
-    && !launchAgent.includes('EnvironmentVariables')
-    && launchAgent.includes('<key>ProcessType</key>')
-    && launchAgent.includes('<string>Interactive</string>');
-const nativeSources = await Promise.all(NATIVE_SOURCE_FILES.map((name) => fs.readFile(path.join(sourcesDir, name), 'utf8')));
-const nativeSource = nativeSources.join('\n');
-const notificationContract = ['SKS_OPERATION_RESULT', 'SKS_UPDATE_AVAILABLE', 'SKS_ACTION_REQUIRED',
-    'OPEN_CONTROL_CENTER', 'OPEN_LOG', 'RETRY_OPERATION']
-    .every((token) => nativeSource.includes(token))
-    && !nativeSource.includes('OPEN_DASHBOARD')
-    && !nativeSource.includes('onOpenDashboard')
-    && nativeSource.includes('UNUserNotificationCenterDelegate')
-    && nativeSource.includes('didReceive response: UNNotificationResponse')
-    && !nativeSource.includes('display notification')
-    && !nativeSource.includes('runModal(');
-const notificationRuntime = await notificationRuntimeSmoke(sourcesDir);
-const notificationActionTest = notificationContract && notificationRuntime.ok;
-const accessibilitySmoke = nativeSource.includes('setAccessibilityLabel("Control Center sections")')
-    && nativeSource.includes('setAccessibilityLabel("Effective MCP servers")')
-    && nativeSource.includes('button.setAccessibilityLabel(title)');
-const reducedMotionSmoke = nativeSource.includes('accessibilityDisplayShouldReduceMotion')
-    && !nativeSource.includes('NSAnimationContext')
-    && !nativeSource.includes('animator()');
-const upgradedActionScriptSha256 = sha256(await fs.readFile(required(result.action_script_path, 'final action script path')));
-const previousBuildStamp = await readJson(previousBuildStampPath);
-const previousActionScript = await fs.readFile(previousActionScriptPath, 'utf8').catch(() => '');
-const previousLaunchAgent = await fs.readFile(previousLaunchAgentPath, 'utf8').catch(() => '');
-const previousResources = await hashNamedFiles(path.join(previousAppPath, 'Contents', 'Resources'), [...NATIVE_RESOURCE_FILES]).catch(() => ({}));
-const committedInstallGeneration = result.transaction?.status === 'committed'
-    && result.transaction.pairs.length === 4
-    && result.transaction.pairs.every((pair) => pair.active_exists
-        && pair.backup_exists
-        && !pair.staged_exists
-        && !pair.temporary_exists
-        && !pair.displaced_exists);
-const previousAppRollbackVerified = await exists(previousExecutablePath)
-    && sha256(await fs.readFile(previousExecutablePath)) === initialExecutableSha256
-    && previousSignature.ok
-    && previousBuildStamp?.source_sha256 === initialStamp.source_sha256
-    && previousBuildStamp?.resources_sha256 === initialStamp.resources_sha256
-    && recordsEqual(previousResources, initialStamp.resource_files_sha256)
-    && sha256(await fs.readFile(path.join(previousAppPath, 'Contents', 'Info.plist'))) === initialInfoPlistSha256
-    && previousActionScript === initialActionScript
-    && previousLaunchAgent === initialLaunchAgent
-    && committedInstallGeneration
-    && result.actions.includes(`preserved complete previous generation at ${previousAppPath}`);
-const rollbackResult = previousAppRollbackVerified
-    ? await rollbackSksMenuBar({ home: temp, root: fakeRoot, env, launch: false })
-    : null;
-const restoredStamp = await readJson(path.join(installDir, 'build-stamp.json'));
-const restoredResources = await hashNamedFiles(path.join(appPath, 'Contents', 'Resources'), [...NATIVE_RESOURCE_FILES]).catch(() => ({}));
-const committedRollbackGeneration = rollbackResult?.transaction?.status === 'committed'
-    && rollbackResult.transaction.pairs.length === 4
-    && rollbackResult.transaction.pairs.every((pair) => pair.active_exists
-        && pair.backup_exists
-        && !pair.temporary_exists
-        && !pair.displaced_exists);
-const actualRollbackVerified = rollbackResult?.ok === true
-    && rollbackResult.status === 'rolled_back_launch_skipped'
-    && rollbackResult.verification_before?.ok === true
-    && rollbackResult.verification_after?.ok === true
-    && sha256(await fs.readFile(executablePath)) === initialExecutableSha256
-    && restoredStamp?.source_sha256 === initialStamp.source_sha256
-    && restoredStamp?.resources_sha256 === initialStamp.resources_sha256
-    && recordsEqual(restoredResources, initialStamp.resource_files_sha256)
-    && await fs.readFile(required(result.action_script_path, 'final action script path'), 'utf8') === initialActionScript
-    && await fs.readFile(required(result.launch_agent_path, 'final launch agent path'), 'utf8') === initialLaunchAgent
-    && committedRollbackGeneration;
-const expectedResourcesPresent = [
-    'AppIcon.icns', 'SKSStatusTemplate.pdf', 'SKSStatusUpdateTemplate.pdf',
-    'SKSStatusWarningTemplate.pdf', 'SKSStatusAttentionTemplate.pdf'
-].every((name) => installedResourceNames.includes(name));
-const buildStampVersionSourceBinding = buildStamp.package_version === PACKAGE_VERSION
-    && buildStamp.codesign_identifier === 'com.sneakoscope.sks-menubar'
-    && buildStamp.action_script_sha256 === upgradedActionScriptSha256
-    && sourceBindingVerified
-    && resourceBindingVerified;
-const checks = {
-    install_ok: result.ok && result.status === 'installed_launch_skipped',
-    app_bundle_exists: await exists(appPath) && await exists(executablePath),
-    swift_compile: swiftCompile,
-    swift_parse: swiftParse.ok,
-    source_inventory: recordsEqual(Object.fromEntries(installedSourceNames.map((name) => [name, 'present'])), Object.fromEntries([...NATIVE_SOURCE_FILES].sort().map((name) => [name, 'present']))),
-    resources_inventory: recordsEqual(Object.fromEntries(installedResourceNames.map((name) => [name, 'present'])), Object.fromEntries([...NATIVE_RESOURCE_FILES].sort().map((name) => [name, 'present']))),
-    expected_resources_present: expectedResourcesPresent,
-    info_plist_icon_verified: infoPlistIconVerified,
-    app_icon_load_smoke: iconLoadSmoke.ok,
-    codesign_strict_verified: signature.ok,
-    codesign_identifier_verified: signature.identifier === 'com.sneakoscope.sks-menubar',
-    action_script_executable: actionScriptExecutable,
-    launch_agent_safe: launchAgentSafe,
-    notification_action_test: notificationActionTest,
-    accessibility_smoke: accessibilitySmoke,
-    reduced_motion_smoke: reducedMotionSmoke,
-    build_stamp_version_source_binding: buildStampVersionSourceBinding,
-    is_idempotent: isIdempotent,
-    previous_app_rollback_verified: previousAppRollbackVerified,
-    actual_rollback_verified: actualRollbackVerified
-};
-const failedChecks = Object.entries(checks).filter(([, value]) => !value).map(([name]) => name);
-const ok = failedChecks.length === 0;
-const report = {
-    schema: 'sks.sks-menubar-install-check.v2',
-    ok,
-    temp,
-    result,
-    initial_result: initialResult,
-    second_result: secondResult,
-    checks,
-    is_idempotent: isIdempotent,
-    previous_app_path: previousAppPath,
-    previous_app_rollback_verified: previousAppRollbackVerified,
-    actual_rollback_verified: actualRollbackVerified,
-    rollback_result: rollbackResult,
-    resource_sha256: resourcesSha256,
-    resources_sha256: resourcesSha256,
-    resource_files_sha256: resourceHashes,
-    source_sha256: sourceSha256,
-    source_files_sha256: sourceHashes,
-    build_stamp_version_source_binding: buildStampVersionSourceBinding,
-    signature,
-    previous_signature: previousSignature,
-    icon_load_smoke: iconLoadSmoke,
-    notification_runtime: notificationRuntime,
-    swift_parse: swiftParse,
-    installed_source_names: installedSourceNames,
-    installed_resource_names: installedResourceNames,
-    failed_checks: failedChecks,
-    blockers: ok ? [] : ['sks_menubar_install_check_failed']
-};
-console.log(JSON.stringify(report, null, 2));
-if (!ok)
-    process.exit(1);
-async function writeProbeEntry(file) {
-    await fs.mkdir(path.dirname(file), { recursive: true });
-    await fs.writeFile(file, [
-        '#!/usr/bin/env node',
-        `console.log('sks ${PACKAGE_VERSION}');`,
-        ''
-    ].join('\n'), { mode: 0o755 });
-    return file;
-}
-async function hashNamedFiles(directory, names) {
-    const output = {};
-    for (const name of names)
-        output[name] = sha256(await fs.readFile(path.join(directory, name)));
-    return output;
-}
-function recordsEqual(left, right) {
-    return JSON.stringify(Object.entries(left).sort()) === JSON.stringify(Object.entries(right).sort());
-}
-async function strictCodesign(appPath) {
-    const codesign = await which('codesign').catch(() => null) || '/usr/bin/codesign';
-    const verify = await runProcess(codesign, ['--verify', '--deep', '--strict', appPath], { timeoutMs: 20_000, maxOutputBytes: 32 * 1024 })
-        .catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
-    const detail = await runProcess(codesign, ['-dv', '--verbose=4', appPath], { timeoutMs: 10_000, maxOutputBytes: 32 * 1024 })
-        .catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
-    const detailText = `${detail.stdout || ''}\n${detail.stderr || ''}`;
-    const identifier = detailText.match(/\bIdentifier=([^\n]+)/)?.[1]?.trim() || null;
-    return {
-        ok: verify.code === 0 && detail.code === 0,
-        identifier,
-        verify_code: verify.code,
-        detail_code: detail.code,
-        error: verify.code === 0 && detail.code === 0 ? null : String(verify.stderr || detail.stderr || detail.stdout).trim()
-    };
-}
-async function imageLoadSmoke(iconPath) {
-    const sips = await which('sips').catch(() => null) || '/usr/bin/sips';
-    const result = await runProcess(sips, ['-g', 'pixelWidth', '-g', 'pixelHeight', iconPath], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 })
-        .catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
-    const text = `${result.stdout || ''}\n${result.stderr || ''}`;
-    const width = Number(text.match(/pixelWidth:\s*(\d+)/)?.[1] || '') || null;
-    const height = Number(text.match(/pixelHeight:\s*(\d+)/)?.[1] || '') || null;
-    return { ok: result.code === 0 && Boolean(width && height), width, height, code: result.code, error: result.code === 0 ? null : text.trim() };
-}
-async function swiftParseSmoke(sourcesDir) {
-    const swiftc = await which('swiftc').catch(() => null) || '/usr/bin/swiftc';
-    const files = NATIVE_SOURCE_FILES.map((name) => path.join(sourcesDir, name));
-    const result = await runProcess(swiftc, ['-parse', ...files], { timeoutMs: 30_000, maxOutputBytes: 64 * 1024 })
-        .catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
-    return { ok: result.code === 0, code: result.code, error: result.code === 0 ? null : String(result.stderr || result.stdout).trim() };
-}
-async function notificationRuntimeSmoke(sourcesDir) {
-    const swiftc = await which('swiftc').catch(() => null) || '/usr/bin/swiftc';
-    const harness = path.join(temp, 'NotificationHarness.swift');
-    const binary = path.join(temp, 'notification-runtime');
-    await fs.writeFile(harness, `
-import Foundation
-import UserNotifications
-
-@main
-struct NotificationHarness {
-    static func main() {
-        let coordinator = NotificationCoordinator()
-        var calls: [String] = []
-        coordinator.onOpenControlCenter = { calls.append("center") }
-        coordinator.onOpenLog = { calls.append("log") }
-        coordinator.onRetryOperation = { calls.append("retry") }
-        let routes = [
-            coordinator.dispatchActionIdentifier("OPEN_LOG"),
-            coordinator.dispatchActionIdentifier("RETRY_OPERATION"),
-            coordinator.dispatchActionIdentifier("OPEN_CONTROL_CENTER"),
-            coordinator.dispatchActionIdentifier(UNNotificationDismissActionIdentifier)
-        ]
-        precondition(routes == ["open_log", "retry_operation", "open_control_center", "dismissed"])
-        precondition(calls == ["log", "retry", "center"])
-        precondition(NotificationCoordinator.authorizationIsDenied(.denied))
-        precondition(!NotificationCoordinator.authorizationIsDenied(.authorized))
-        precondition(!NotificationCoordinator.authorizationIsDenied(.notDetermined))
-        precondition(NotificationCoordinator.categoryIdentifier() == "SKS_OPERATION_RESULT")
-        precondition(NotificationCoordinator.categoryIdentifier(failed: true) == "SKS_ACTION_REQUIRED")
-        let available = #"{"schema":"sks.update-status.v3","update_count":1}"#
-        precondition(NotificationCoordinator.updateIsAvailable(in: available))
-        precondition(NotificationCoordinator.categoryIdentifier(updateStatusOutput: available) == "SKS_UPDATE_AVAILABLE")
-    }
-}
-`);
-    const compiled = await runProcess(swiftc, [path.join(sourcesDir, 'NotificationCoordinator.swift'), harness, '-o', binary], {
-        timeoutMs: 30_000,
-        maxOutputBytes: 64 * 1024
-    }).catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
-    if (compiled.code !== 0) {
-        return { ok: false, compile_code: compiled.code, run_code: null, error: String(compiled.stderr || compiled.stdout).trim() };
-    }
-    const executed = await runProcess(binary, [], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 })
-        .catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
-    return {
-        ok: executed.code === 0,
-        compile_code: compiled.code,
-        run_code: executed.code,
-        error: executed.code === 0 ? null : String(executed.stderr || executed.stdout).trim()
-    };
-}
-async function readJson(file) {
-    try {
-        return JSON.parse(await fs.readFile(file, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-async function isExecutable(file) {
-    return fs.access(file, fs.constants.X_OK).then(() => true).catch(() => false);
-}
-async function exists(file) {
-    return fs.access(file).then(() => true).catch(() => false);
-}
-function required(value, label) {
-    if (value === null || value === undefined)
-        throw new Error(`missing ${label}`);
-    return value;
-}

package/dist/scripts/supabase-secret-preservation-blackbox.js

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
-import { captureSecretPreservationSnapshot, withSecretPreservationGuard } from '../core/config/secret-preservation.js';
-const root = await makeTempRoot('sks-supabase-blackbox-');
-const envFile = path.join(root, '.env.local');
-await writeText(envFile, 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=super-secret-anon\n');
-const before = await captureSecretPreservationSnapshot({ root });
-await withSecretPreservationGuard(root, 'blackbox-preserve', async () => {
-    await fs.appendFile(envFile, 'SKS_MANAGED=true\n', 'utf8');
-});
-const after = await captureSecretPreservationSnapshot({ root });
-assertGate(JSON.stringify(before.fingerprints.map((fp) => fp.value_sha256).sort()) === JSON.stringify(after.fingerprints.map((fp) => fp.value_sha256).sort()), 'Supabase secret fingerprints must remain stable across guarded update', { before, after });
-assertGate(!JSON.stringify(after).includes('super-secret-anon'), 'reports must not include raw Supabase values', after);
-let blocked = false;
-try {
-    await withSecretPreservationGuard(root, 'blackbox-change', async () => {
-        await fs.writeFile(envFile, 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=mutated-secret\n', 'utf8');
-    });
-}
-catch {
-    blocked = true;
-}
-const restored = await fs.readFile(envFile, 'utf8');
-assertGate(blocked, 'Supabase value mutation must be blocked after rollback');
-assertGate(restored.includes('super-secret-anon') && !restored.includes('mutated-secret'), 'Supabase value mutation must be rolled back');
-emitGate('secret:supabase-preservation-blackbox');

package/dist/scripts/super-search-live-smoke-check.js

@@ -1,115 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-const bin = path.join(root, 'dist', 'bin', 'sks.js');
-assertGate(fs.existsSync(bin), 'dist bin missing for live smoke', { bin, hint: 'run npm run build first' });
-const targetGroups = [
-    {
-        id: 'repo_metadata',
-        urls: [
-            'https://raw.githubusercontent.com/mandarange/Sneakoscope-Codex/main/package.json',
-            'https://github.com/mandarange/Sneakoscope-Codex',
-            'https://api.github.com/repos/mandarange/Sneakoscope-Codex'
-        ]
-    },
-    {
-        id: 'npm_package',
-        urls: [
-            'https://registry.npmjs.org/sneakoscope',
-            'https://www.npmjs.com/package/sneakoscope'
-        ]
-    }
-];
-const fetchResults = targetGroups.map((group) => fetchWithFallback(group));
-const doctor = runJson(['super-search', 'doctor', '--json']);
-for (const row of fetchResults) {
-    assertGate(row.status === 0, 'super-search live fetch command failed', row);
-    const result = row.json;
-    const directSources = result.sources.filter((source) => source.provider_id === 'direct_url');
-    assertGate(directSources.some((source) => source.acquisition_verdict === 'verified_content'), 'direct_url source must have verified_content', { target: row.target, sources: result.sources });
-    assertGate(directSources.some((source) => source.content_artifact), 'direct_url source must have content artifact', { target: row.target, sources: result.sources });
-    assertGate(directSources.some((source) => source.content_sha256), 'direct_url source must have content sha256', { target: row.target, sources: result.sources });
-    assertGate(result.proof.source_count > 0, 'live smoke must record source count > 0', result.proof);
-    assertGate(result.proof.verified_source_count > 0, 'live smoke must record verified source count > 0', result.proof);
-    assertGate(!result.blockers.includes('source_acquisition_unavailable'), 'live smoke must not report source_acquisition_unavailable', result);
-    assertGate(result.claims.every((claim) => claim.status !== 'supported' || claim.source_ids?.length > 0), 'supported claims must be source-backed', result.claims);
-}
-assertGate(doctor.status === 0, 'super-search doctor command failed', doctor);
-assertGate(['sks.super-search-doctor.v2', 'sks.super-search-doctor.v3'].includes(doctor.json.schema), 'doctor must emit a supported schema', doctor.json);
-assertGate(doctor.json.ok === (doctor.json.status === 'usable' || doctor.json.status === 'offline_usable'), 'doctor ok must match usable status', doctor.json);
-const report = {
-    schema: 'sks.super-search-live-smoke.v1',
-    ok: true,
-    generated_at: new Date().toISOString(),
-    checked_urls: fetchResults.map((row) => row.url),
-    attempts: fetchResults.map((row) => ({
-        group_id: row.group_id,
-        selected_url: row.url,
-        attempts: row.attempts.map((attempt) => ({
-            url: attempt.url,
-            status: attempt.status,
-            verified_source_count: Number(attempt.json?.proof?.verified_source_count || 0),
-            blockers: attempt.json?.blockers || []
-        }))
-    })),
-    doctor_status: doctor.json.status,
-    verified_sources: fetchResults.reduce((sum, row) => sum + Number(row.json?.proof?.verified_source_count || 0), 0),
-    blockers: [],
-    evidence_paths: fetchResults.map((row) => row.json?.artifact_dir).filter(Boolean)
-};
-fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'super-search-live-smoke.json'), `${JSON.stringify(report, null, 2)}\n`);
-emitGate('super-search:live-smoke', {
-    checked_urls: fetchResults.length,
-    doctor_status: doctor.json.status,
-    verified_sources: fetchResults.reduce((sum, row) => sum + Number(row.json?.proof?.verified_source_count || 0), 0)
-});
-function fetchWithFallback(group) {
-    const attempts = [];
-    for (const url of group.urls) {
-        const row = runJson(['super-search', 'fetch', url, '--json']);
-        attempts.push({ ...row, url });
-        if (isVerifiedFetch(row)) {
-            return { ...row, group_id: group.id, url, attempts };
-        }
-    }
-    return { ...attempts[attempts.length - 1], group_id: group.id, url: attempts[attempts.length - 1]?.url || null, attempts };
-}
-function isVerifiedFetch(row) {
-    if (row.status !== 0 || !row.json)
-        return false;
-    const result = row.json;
-    const directSources = Array.isArray(result.sources) ? result.sources.filter((source) => source.provider_id === 'direct_url') : [];
-    const hasNoSourceAcquisitionBlocker = !Array.isArray(result.blockers) || !result.blockers.includes('source_acquisition_unavailable');
-    return directSources.some((source) => source.acquisition_verdict === 'verified_content') &&
-        directSources.some((source) => source.content_artifact) &&
-        directSources.some((source) => source.content_sha256) &&
-        Number(result.proof?.source_count || 0) > 0 &&
-        Number(result.proof?.verified_source_count || 0) > 0 &&
-        hasNoSourceAcquisitionBlocker;
-}
-function runJson(args) {
-    const proc = spawnSync(process.execPath, [bin, ...args], {
-        cwd: root,
-        encoding: 'utf8',
-        env: { ...process.env, SKS_RELEASE_LIVE: '1' },
-        timeout: 30000
-    });
-    let json = null;
-    try {
-        json = JSON.parse(proc.stdout || proc.stderr || '{}');
-    }
-    catch {
-        json = null;
-    }
-    return {
-        target: args.join(' '),
-        status: proc.status,
-        signal: proc.signal,
-        stdout: proc.stdout,
-        stderr: proc.stderr,
-        json
-    };
-}

package/dist/scripts/super-search-local-http-smoke-check.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { runSuperSearchLocalHttpSmoke } = await importDist('core/super-search/local-http-smoke.js');
-const report = await runSuperSearchLocalHttpSmoke({ root });
-assertGate(report.ok === true, 'Super-Search local HTTP smoke must pass', report);
-assertGate(report.verified_content === true, 'local smoke must produce verified_content', report);
-assertGate(Boolean(report.content_artifact), 'local smoke must write a content artifact', report);
-assertGate(Boolean(report.content_sha256), 'local smoke must record content_sha256', report);
-assertGate(report.content_length > 0, 'local smoke content_length must be positive', report);
-assertGate(report.source_backed_claim === true, 'local smoke must produce a source-backed claim', report);
-assertGate(report.server_closed === true, 'local smoke server must close', report);
-emitGate('super-search:local-http-smoke', {
-    content_length: report.content_length,
-    content_sha256: report.content_sha256,
-    report: '.sneakoscope/reports/super-search-local-http-smoke.json'
-});