verify

Verifying the setup helper CLI

The surface is node skills/a1-yandex-kit-setup/scripts/setup.mjs <command>. No build step — plain Node 20+, no dependencies.

Recipes that work

stdin protocol (no-EOF regression): feed the token through a FIFO and keep the write end open; the helper must exit on its own:
```
mkfifo "$TMP/pipe"
node .../setup.mjs configure --client cursor --config "$TMP/mcp.json" --token-stdin --json < "$TMP/pipe" &
exec 3>"$TMP/pipe"; printf 'token\n' >&3; wait $!   # exits ~0.3s
```
Do not time (printf ...; sleep N) | node ... — the pipeline waits for the sleep, not the helper.

Live smoke without a real token: printf 'bad\n' | node .../setup.mjs smoke-token --token-stdin --json runs real npx + mcp-yandex-kit@latest + the real API and must return SMOKE_AUTH in ~3s. Read-only, safe.
No-network sandbox (the Codex scenario, macOS):
```
printf 'bad\n' | sandbox-exec -p '(version 1)(allow default)(deny network*)' \
  node .../setup.mjs smoke-token --token-stdin --json
```
Must return NETWORK_UNAVAILABLE in <1s. sandbox-exec is deprecated but works; the Claude Bash sandbox itself has network, so it can't provide this.
Orphan check after any smoke: pgrep -fl mcp-yandex-kit → empty.

A verifiable happy path needs a valid YANDEX_KIT_TOKEN; without one the furthest observable live state is SMOKE_AUTH (which still proves probe, spawn, handshake, get_store and cleanup).
configure needs no network at all — only npx --version locally.