# Verify

> How to verify changes to the a1-yandex-kit-setup helper CLI at its real surface (setup.mjs), including the no-network sandbox scenario.

- Skill: `ztemerbekov/verify` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ztemerbekov/verify`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ztemerbekov/verify/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: ztemerbekov (https://skillmd.com/u/ztemerbekov)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ztemerbekov/verify

---


# Verifying the setup helper CLI

The surface is `node skills/a1-yandex-kit-setup/scripts/setup.mjs <command>`.
No build step — plain Node 20+, no dependencies.

## Recipes that work

- **stdin protocol (no-EOF regression):** feed the token through a FIFO and
  keep the write end open; the helper must exit on its own:

  ```bash
  mkfifo "$TMP/pipe"
  node .../setup.mjs configure --client cursor --config "$TMP/mcp.json" --token-stdin --json < "$TMP/pipe" &
  exec 3>"$TMP/pipe"; printf 'token\n' >&3; wait $!   # exits ~0.3s
  ```

  Do not time `(printf ...; sleep N) | node ...` — the pipeline waits for the
  sleep, not the helper.

- **Live smoke without a real token:** `printf 'bad\n' | node .../setup.mjs
  smoke-token --token-stdin --json` runs real npx + mcp-yandex-kit@latest +
  the real API and must return `SMOKE_AUTH` in ~3s. Read-only, safe.

- **No-network sandbox (the Codex scenario, macOS):**

  ```bash
  printf 'bad\n' | sandbox-exec -p '(version 1)(allow default)(deny network*)' \
    node .../setup.mjs smoke-token --token-stdin --json
  ```

  Must return `NETWORK_UNAVAILABLE` in <1s. `sandbox-exec` is deprecated but
  works; the Claude Bash sandbox itself has network, so it can't provide this.

- **Orphan check after any smoke:** `pgrep -fl mcp-yandex-kit` → empty.

## Gotchas

- A verifiable happy path needs a valid `YANDEX_KIT_TOKEN`; without one the
  furthest observable live state is `SMOKE_AUTH` (which still proves probe,
  spawn, handshake, get_store and cleanup).
- `configure` needs no network at all — only `npx --version` locally.