verifylisted

# Verifying the setup helper CLI The surface is `node skills/a1-yandex-kit-setup/scripts/setup.mjs <command>`. No build step — plain Node 20+, no dependencies. ## Recipes that work - **stdin protocol (no-EOF regression):** feed the token through a FIFO and keep the write end open; the helper must exit on its own: ```bash mkfifo "$TMP/pipe" node .../setup.mjs configure --client cursor --config "$TMP/mcp.json" --token-stdin --json < "$TMP/pipe" & exec 3>"$TMP/pipe"; printf 'token\n' >&3; wait $! # exits ~0.3s ``` Do not time `(printf ...; sleep N) | node ...` — the pipeline waits for the sleep, not the helper. - **Live smoke without a real token:** `printf 'bad\n' | node .../setup.mjs smoke-token --token-stdin --json` runs real npx + mcp-yandex-kit@latest + the real API and must return `SMOKE_AUTH` in ~3s. Read-only, safe. - **No-network sandbox (the Codex scenario, macOS):** ```bash printf 'bad\n' | sandbox-exec -p '(version 1)(allow default)(deny network*)' \ node .../setup.mjs smoke-token --token-stdin --json ``` Must return `NETWORK_UNAVAILABLE` in <1s. `sandbox-exec` is deprecated but works; the Claude Bash sandbox itself has network, so it can't provide this. - **Orphan check after any smoke:** `pgrep -fl mcp-yandex-kit` → empty. ## Gotchas - A verifiable happy path needs a valid `YANDEX_KIT_TOKEN`; without one the furthest observable live state is `SMOKE_AUTH` (which still proves probe, spawn, handshake, get_store and c