sneakoscope 4.0.2 → 4.0.4

package/dist/core/commands/mad-sks-command.js

@@ -24,16 +24,19 @@ import { writeCodex0138CapabilityArtifacts } from '../codex-control/codex-0138-c
 import { writeCodex0139CapabilityArtifacts } from '../codex-control/codex-0139-capability.js';
 import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-invocation-router.js';
 import { repairZellijForSks } from '../zellij/zellij-self-heal.js';
+import { buildMadGlmLaunchArtifact, buildMadGlmLaunchProfileNoWrite, resolveMadGlmLaunchKey, writeMadGlmCodexWrapper } from '../providers/glm/glm-mad-launch.js';
+import { GLM_MAD_MODE } from '../providers/glm/glm-52-settings.js';
 export async function madHighCommand(args = [], deps = {}) {
     const subcommand = firstSubcommand(args);
     if (subcommand)
         return madSksSubcommand(subcommand, args.filter((arg) => String(arg) !== subcommand));
     const cleanArgs = stripMadLaunchOnlyArgs(args);
     const rawArgs = (args || []).map((arg) => String(arg));
+    const glmMadLaunch = isMadGlmLaunch(rawArgs, deps);
     const madDbGrant = resolveMadLaunchMadDbGrant(rawArgs);
     const dryRun = rawArgs.includes('--dry-run');
-    if (args.includes('--json') && !dryRun) {
-        const profile = buildMadHighLaunchProfileNoWrite();
+    if (rawArgs.includes('--json') && !dryRun) {
+        const profile = glmMadLaunch ? buildMadGlmLaunchProfileNoWrite() : buildMadHighLaunchProfileNoWrite();
         return console.log(JSON.stringify(profile, null, 2));
     }
     const update = { status: 'notice_only', non_blocking: true };
@@ -76,7 +79,7 @@ export async function madHighCommand(args = [], deps = {}) {
         }
         return report;
     }
-    const codexUpdate = deps.maybePromptCodexUpdateForLaunch ? await deps.maybePromptCodexUpdateForLaunch(args, { label: 'MAD launch' }) : { status: 'skipped' };
+    const codexUpdate = deps.maybePromptCodexUpdateForLaunch ? await deps.maybePromptCodexUpdateForLaunch(args, { label: glmMadLaunch ? 'GLM MAD launch' : 'MAD launch' }) : { status: 'skipped' };
     if (codexUpdate.status === 'failed' || codexUpdate.status === 'updated_not_reflected') {
         console.error(`Codex CLI update failed: ${codexUpdate.error || 'updated version was not visible on PATH'}`);
         process.exitCode = 1;
@@ -86,7 +89,7 @@ export async function madHighCommand(args = [], deps = {}) {
         ? { status: 'skipped', command: 'sks doctor --fix --yes' }
         : deps.maybePromptZellijUpdateForLaunch
             ? await deps.maybePromptZellijUpdateForLaunch(args, {
-                label: 'MAD launch',
+                label: glmMadLaunch ? 'GLM MAD launch' : 'MAD launch',
                 root: launchRoot,
                 selfHealOnMissing: true,
                 autoApprove: rawArgs.includes('--yes') || rawArgs.includes('-y'),
@@ -121,8 +124,10 @@ export async function madHighCommand(args = [], deps = {}) {
         process.exitCode = 1;
         return;
     }
-    const lb = deps.maybePromptCodexLbSetupForLaunch ? await deps.maybePromptCodexLbSetupForLaunch(args) : { status: 'skipped' };
-    if (lb.status === 'missing_api_key') {
+    const lb = glmMadLaunch
+        ? { status: 'skipped_glm_openrouter', ok: false, reason: 'glm_mad_uses_openrouter_directly' }
+        : deps.maybePromptCodexLbSetupForLaunch ? await deps.maybePromptCodexLbSetupForLaunch(args) : { status: 'skipped' };
+    if (!glmMadLaunch && lb.status === 'missing_api_key') {
         process.exitCode = 1;
         return;
     }
@@ -171,6 +176,11 @@ export async function madHighCommand(args = [], deps = {}) {
         return launchPreflight;
     }
     const madLaunch = await activateMadZellijPermissionState(process.cwd(), args);
+    const glmRuntime = glmMadLaunch ? await prepareMadGlmLaunchRuntime(madLaunch, deps) : null;
+    if (glmMadLaunch && !glmRuntime?.ok) {
+        process.exitCode = 1;
+        return glmRuntime;
+    }
     const madDbCapability = madDbGrant.enabled
         ? await createMadDbCapability(madLaunch.root, { missionId: madLaunch.mission_id, ack: madDbGrant.ack, cwd: process.cwd() })
         : null;
@@ -221,7 +231,9 @@ export async function madHighCommand(args = [], deps = {}) {
         error: err?.message || String(err)
     }));
     await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_sks.update_notice_checked', non_blocking: true, update_available: updateNotice.update_available === true, source: updateNotice.source });
-    console.log(`SKS MAD ready: ${madHighProfileName()} | gate ${madLaunch.mission_id}`);
+    console.log(`SKS MAD ready: ${glmRuntime?.profile?.profile_name || madHighProfileName()} | gate ${madLaunch.mission_id}`);
+    if (glmRuntime?.profile)
+        console.log(`GLM MAD launch active: ${glmRuntime.profile.model} via OpenRouter; GPT fallback blocked.`);
     if (madDbCapability)
         console.log(`MAD-DB one-cycle capability active (${madDbGrant.source}); expires ${madDbCapability.expires_at}.`);
     if (updateNotice.update_available === true)
@@ -233,8 +245,18 @@ export async function madHighCommand(args = [], deps = {}) {
         SKS_MAD_SKS_TARGET_ROOT: madLaunch.gate.cwd,
         SKS_MAD_SKS_PROTECTED_CORE_DIGEST: madLaunch.gate.protected_core_digest
     };
-    const launchOpts = codexLbImmediateLaunchOpts(cleanArgs, launchLb, { codexArgs: profile.launch_args, conciseBlockers: true, madSksEnv, launchEnv: madSksEnv });
     const explicitWorkspace = readOption(cleanArgs, '--workspace', readOption(cleanArgs, '--session', null));
+    const launchProfile = glmRuntime?.profile || profile;
+    const launchOpts = glmRuntime
+        ? buildGlmMadLaunchOpts(cleanArgs, {
+            codexArgs: launchProfile.launch_args,
+            conciseBlockers: true,
+            madSksEnv,
+            launchEnv: madSksEnv,
+            codexBin: glmRuntime.wrapper.wrapper_path,
+            explicitWorkspace
+        })
+        : codexLbImmediateLaunchOpts(cleanArgs, launchLb, { codexArgs: launchProfile.launch_args, conciseBlockers: true, madSksEnv, launchEnv: madSksEnv });
     // Only the auto-derived stable `sks-mad-<cwd>` name accumulates panes across
     // runs; when the user names a session explicitly (or codex-lb already minted a
     // fresh unique session) respect it and skip the reset.
@@ -268,11 +290,12 @@ export async function madHighCommand(args = [], deps = {}) {
         worker_panes_created: 0,
         right_column_mode: 'spawn-on-first-worker'
     });
-    const madNativeSwarm = await startMadNativeSwarm(madLaunch.root, madLaunch, args, profile, {
+    const madNativeSwarm = await startMadNativeSwarm(madLaunch.root, madLaunch, args, launchProfile, {
         env: {
             ...madSksEnv,
             ...(launch.session_name ? { SKS_ZELLIJ_SESSION_NAME: launch.session_name } : {})
         },
+        glmLaunch: glmRuntime ? { provider: glmRuntime.profile.provider, model: glmRuntime.profile.model } : null,
         zellijSessionName: launch.session_name || null,
         workerPlacement: headlessZellij ? 'process' : shouldAutoAttachZellij(args) ? 'zellij-pane' : 'process',
         zellijVisiblePaneCap: Number(process.env.SKS_ZELLIJ_VISIBLE_PANE_CAP || 8)
@@ -296,6 +319,67 @@ export async function madHighCommand(args = [], deps = {}) {
         console.log('MAD launch running headless: live_panes=false.');
     return launch;
 }
+function isMadGlmLaunch(args = [], deps = {}) {
+    const list = (args || []).map((arg) => String(arg));
+    return list.includes('--glm') || deps?.glmReadiness?.mode === GLM_MAD_MODE;
+}
+async function prepareMadGlmLaunchRuntime(madLaunch, deps = {}) {
+    const keyResolution = await resolveMadGlmLaunchKey(process.env);
+    const profile = buildMadGlmLaunchProfileNoWrite();
+    if (!keyResolution.key) {
+        const blocked = {
+            schema: 'sks.glm-mad-launch.v1',
+            ok: false,
+            status: 'blocked',
+            mission_id: madLaunch.mission_id,
+            provider: profile.provider,
+            model: profile.model,
+            gpt_fallback_allowed: false,
+            blockers: keyResolution.blockers,
+            warnings: keyResolution.warnings
+        };
+        await writeJsonAtomic(path.join(madLaunch.dir, 'mad-glm-launch.json'), blocked);
+        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), {
+            ts: nowIso(),
+            type: 'mad_sks.glm_launch_blocked',
+            blockers: keyResolution.blockers
+        });
+        console.error('SKS GLM MAD launch blocked: OpenRouter API key is missing.');
+        console.error('Run: sks --mad --glm --repair');
+        return blocked;
+    }
+    const wrapper = await writeMadGlmCodexWrapper({
+        missionDir: madLaunch.dir,
+        realCodexBin: process.env.SKS_CODEX_BIN || null
+    });
+    const report = {
+        ...buildMadGlmLaunchArtifact({
+            missionId: madLaunch.mission_id,
+            keyResolution,
+            wrapper,
+            profile
+        }),
+        readiness_status: deps?.glmReadiness?.status || null
+    };
+    await writeJsonAtomic(path.join(madLaunch.dir, 'mad-glm-launch.json'), report);
+    await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), {
+        ts: nowIso(),
+        type: 'mad_sks.glm_launch_profile_ready',
+        provider: profile.provider,
+        model: profile.model,
+        key_source: keyResolution.source || null,
+        gpt_fallback_allowed: false
+    });
+    return { ok: true, profile, wrapper, report };
+}
+function buildGlmMadLaunchOpts(cleanArgs = [], opts = {}) {
+    if (opts.explicitWorkspace)
+        return opts;
+    const root = readOption(cleanArgs, '--root', process.cwd());
+    const session = sanitizeZellijSessionName(`sks-glm-${Date.now().toString(36)}-${path.basename(root) || 'project'}`);
+    console.log(`Using fresh GLM Zellij session: ${session}`);
+    return { ...opts, session, glmMadLaunch: true };
+}
 export function resolveMadLaunchMadDbGrant(args = []) {
     const list = (args || []).map((arg) => String(arg));
     return {
@@ -319,6 +403,9 @@ export async function startMadNativeSwarm(root, madLaunch, args = [], profile =
             status: 'disabled',
             reason: swarm.disabled_reason,
             mission_id: madLaunch.mission_id,
+            model_provider: opts.glmLaunch?.provider || null,
+            model: opts.glmLaunch?.model || null,
+            gpt_fallback_allowed: opts.glmLaunch ? false : null,
             lane_count: 1,
             ledger_root: path.relative(root, ledgerRoot)
         };
@@ -381,6 +468,9 @@ export async function startMadNativeSwarm(root, madLaunch, args = [], profile =
         zellij_session_name: opts.zellijSessionName || null,
         worker_placement: opts.workerPlacement || (swarm.backend === 'zellij' ? 'zellij-pane' : 'process'),
         zellij_visible_pane_cap: opts.zellijVisiblePaneCap || null,
+        model_provider: opts.glmLaunch?.provider || null,
+        model: opts.glmLaunch?.model || null,
+        gpt_fallback_allowed: opts.glmLaunch ? false : null,
         readonly: true,
         command,
         stdout_log: path.relative(root, stdoutLog),
@@ -430,13 +520,18 @@ export async function startMadNativeSwarm(root, madLaunch, args = [], profile =
 }
 export function resolveMadNativeSwarmOptions(args = [], profile = {}, opts = {}) {
     const list = (args || []).map((arg) => String(arg));
-    const disabled = list.includes('--no-swarm') || list.includes('--no-mad-swarm') || process.env.SKS_MAD_NATIVE_SWARM === '0';
+    const operatorDisabled = list.includes('--no-swarm') || list.includes('--no-mad-swarm') || process.env.SKS_MAD_NATIVE_SWARM === '0';
+    const glmRequested = list.includes('--glm') || opts.glmLaunch?.provider === 'openrouter';
+    const glmNativeSwarmDisabled = glmRequested && process.env.SKS_GLM_MAD_ALLOW_GPT_SWARM !== '1';
+    const disabled = operatorDisabled || glmNativeSwarmDisabled;
     const agents = clampInt(readOption(list, '--mad-agents', readOption(list, '--mad-swarm-agents', process.env.SKS_MAD_SWARM_AGENTS || opts.agents || 5)), 1, 20);
     const workItems = clampInt(readOption(list, '--mad-swarm-work-items', process.env.SKS_MAD_SWARM_WORK_ITEMS || opts.workItems || agents), agents, 100);
     const backend = defaultMadSwarmBackend(list, opts);
     return {
         enabled: !disabled,
-        disabled_reason: disabled ? 'operator_disabled_mad_native_swarm' : null,
+        disabled_reason: operatorDisabled
+            ? 'operator_disabled_mad_native_swarm'
+            : glmNativeSwarmDisabled ? 'glm_mad_native_swarm_disabled_to_block_gpt_fallback' : null,
         agents,
         workItems,
         backend,
@@ -516,12 +611,14 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
     const root = await sksRoot();
     if (!(await exists(path.join(root, '.sneakoscope'))))
         await initProject(root, {});
+    const rawArgs = (args || []).map((arg) => String(arg));
+    const activatedBy = rawArgs.includes('--glm') ? 'sks --mad --glm' : 'sks --mad';
     const flags = parseMadSksFlags(['--mad-sks', ...args].filter(Boolean));
-    const permission = buildMadSksPermissionModel({ targetRoot: cwd, userIntent: 'sks --mad Zellij scoped high-power maintenance session', flags });
+    const permission = buildMadSksPermissionModel({ targetRoot: cwd, userIntent: `${activatedBy} Zellij scoped high-power maintenance session`, flags });
     const allowedScopes = new Set(permission.allowed_scopes || []);
     const has = (scope) => allowedScopes.has(scope);
     const dbWriteAllowed = has('db_write');
-    const { id, dir } = await createMission(root, { mode: 'mad-sks', prompt: 'sks --mad Zellij scoped high-power maintenance session' });
+    const { id, dir } = await createMission(root, { mode: 'mad-sks', prompt: `${activatedBy} Zellij scoped high-power maintenance session` });
     await writeCodex0138CapabilityArtifacts(root, { missionId: id }).catch(() => null);
     await writeCodex0139CapabilityArtifacts(root, { missionId: id }).catch(() => null);
     const codexNativeInvocation = await resolveCodexNativeInvocationPlan({
@@ -582,7 +679,7 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
             warnings: codexNativeInvocation.warnings,
             artifact_path: 'mad-codex-native-invocation.json'
         } : null,
-        activated_by: 'sks --mad',
+        activated_by: activatedBy,
         cwd: path.resolve(cwd || process.cwd())
     };
     await writeJsonAtomic(path.join(dir, 'mad-sks-gate.json'), gate);
@@ -621,6 +718,7 @@ function madLaunchOnlyFlags() {
         '--mad',
         '--MAD',
         '--mad-sks',
+        '--glm',
         '--high',
         '--attach',
         '--no-attach',

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.0.2';
+export const PACKAGE_VERSION = '4.0.4';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/providers/glm/glm-52-profile.js

@@ -0,0 +1,30 @@
+import { GLM_52_DEFAULT_REQUEST_SETTINGS, GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE } from './glm-52-settings.js';
+export const GLM_CODEX_APP_PROFILE_ID = 'sks/glm-5.2-mad';
+export const GLM_CODEX_APP_PROFILE_LABEL = 'GLM 5.2 (MAD / OpenRouter)';
+export function buildGlmCodexAppModelProfile() {
+    return {
+        schema: 'sks.codex-app-model-profile.v1',
+        id: GLM_CODEX_APP_PROFILE_ID,
+        label: GLM_CODEX_APP_PROFILE_LABEL,
+        provider: 'openrouter',
+        model: GLM_52_OPENROUTER_MODEL,
+        mode: GLM_MAD_MODE,
+        strictModelLock: true,
+        gptFallbackAllowed: false,
+        requiresSecret: 'openrouter-api-key',
+        defaultSettings: {
+            temperature: GLM_52_DEFAULT_REQUEST_SETTINGS.temperature,
+            top_p: GLM_52_DEFAULT_REQUEST_SETTINGS.top_p,
+            reasoning_effort: 'high',
+            tool_choice: 'auto',
+            parallel_tool_calls: false
+        },
+        codexCompatibility: {
+            target: 'rust-v0.141.0',
+            selectedExecutorPluginMcp: 'defer-to-codex-native',
+            duplicateAppMcpDeclarations: 'dedupe-by-codex',
+            cwdShellPathSemantics: 'preserve-codex-native'
+        }
+    };
+}
+//# sourceMappingURL=glm-52-profile.js.map

package/dist/core/providers/glm/glm-52-request.js

@@ -0,0 +1,34 @@
+import { GLM_52_DEFAULT_REQUEST_SETTINGS, GLM_52_OPENROUTER_MODEL, clampGlm52MaxTokens } from './glm-52-settings.js';
+export function buildGlm52Request(input) {
+    const request = {
+        model: GLM_52_OPENROUTER_MODEL,
+        messages: input.messages,
+        stream: input.stream ?? GLM_52_DEFAULT_REQUEST_SETTINGS.stream,
+        temperature: GLM_52_DEFAULT_REQUEST_SETTINGS.temperature,
+        top_p: GLM_52_DEFAULT_REQUEST_SETTINGS.top_p,
+        reasoning: { effort: input.reasoningEffort ?? 'high' },
+        max_tokens: clampGlm52MaxTokens(input.maxTokens),
+        tool_choice: input.toolChoice ?? 'auto',
+        parallel_tool_calls: input.parallelToolCalls ?? false,
+        provider: {
+            allow_fallbacks: false,
+            require_parameters: true,
+            sort: input.providerSort ?? 'throughput'
+        }
+    };
+    return {
+        ...request,
+        ...(input.tools ? { tools: input.tools } : {}),
+        ...(input.responseFormat ? { response_format: input.responseFormat } : {})
+    };
+}
+export function buildGlm52KeyValidationRequest() {
+    return buildGlm52Request({
+        messages: [{ role: 'user', content: 'Reply with OK.' }],
+        stream: false,
+        maxTokens: 1,
+        toolChoice: 'none',
+        parallelToolCalls: false
+    });
+}
+//# sourceMappingURL=glm-52-request.js.map

package/dist/core/providers/glm/glm-52-response-guard.js

@@ -0,0 +1,34 @@
+import { GLM_52_OPENROUTER_MODEL } from './glm-52-settings.js';
+export function assertGlm52ActualModel(responseModel) {
+    if (!responseModel) {
+        return {
+            ok: false,
+            code: 'glm_model_missing',
+            requestedModel: GLM_52_OPENROUTER_MODEL,
+            strictModelLock: true,
+            gptFallbackAllowed: false
+        };
+    }
+    const normalized = responseModel.toLowerCase();
+    if (normalized === GLM_52_OPENROUTER_MODEL ||
+        normalized.startsWith(`${GLM_52_OPENROUTER_MODEL}-`) ||
+        normalized.includes('glm-5.2')) {
+        return {
+            ok: true,
+            code: 'ok',
+            actualModel: responseModel,
+            requestedModel: GLM_52_OPENROUTER_MODEL,
+            strictModelLock: true,
+            gptFallbackAllowed: false
+        };
+    }
+    return {
+        ok: false,
+        code: 'glm_model_mismatch',
+        actualModel: responseModel,
+        requestedModel: GLM_52_OPENROUTER_MODEL,
+        strictModelLock: true,
+        gptFallbackAllowed: false
+    };
+}
+//# sourceMappingURL=glm-52-response-guard.js.map

package/dist/core/providers/glm/glm-52-settings.js

@@ -0,0 +1,26 @@
+export { OPENROUTER_CHAT_COMPLETIONS_URL } from '../openrouter/openrouter-types.js';
+export const GLM_52_OPENROUTER_MODEL = 'z-ai/glm-5.2';
+export const GLM_MAD_MODE = 'mad-glm';
+export const GLM_52_MAX_TOKENS_DEFAULT = 32768;
+export const GLM_52_MAX_TOKENS_LONG = 65536;
+export const GLM_52_MAX_TOKENS_XLONG = 131072;
+export const GLM_52_TOP_PROVIDER_MAX_COMPLETION_TOKENS = 262144;
+export const GLM_52_DEFAULT_REQUEST_SETTINGS = {
+    model: GLM_52_OPENROUTER_MODEL,
+    temperature: 1,
+    top_p: 0.95,
+    reasoning_effort: 'high',
+    stream: true,
+    provider: {
+        allow_fallbacks: false,
+        require_parameters: true
+    },
+    tool_choice: 'auto',
+    parallel_tool_calls: false,
+    max_tokens: GLM_52_MAX_TOKENS_DEFAULT
+};
+export function clampGlm52MaxTokens(value) {
+    const numeric = Number.isFinite(value) ? Math.floor(Number(value)) : GLM_52_MAX_TOKENS_DEFAULT;
+    return Math.max(1, Math.min(numeric, GLM_52_TOP_PROVIDER_MAX_COMPLETION_TOKENS));
+}
+//# sourceMappingURL=glm-52-settings.js.map

package/dist/core/providers/glm/glm-mad-launch.js

@@ -0,0 +1,113 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, writeTextAtomic } from '../../fsx.js';
+import { resolveOpenRouterApiKey, openRouterSecretPaths } from '../openrouter/openrouter-secret-store.js';
+import { GLM_52_OPENROUTER_MODEL } from './glm-52-settings.js';
+export const GLM_MAD_PROFILE_ID = 'sks/glm-5.2-mad';
+export const OPENROUTER_CODEX_PROVIDER = 'openrouter';
+export function buildMadGlmLaunchProfileNoWrite() {
+    return {
+        schema: 'sks.glm-mad-launch-profile.v1',
+        profile_name: GLM_MAD_PROFILE_ID,
+        provider: OPENROUTER_CODEX_PROVIDER,
+        model: GLM_52_OPENROUTER_MODEL,
+        launch_args: [
+            '--sandbox',
+            'danger-full-access',
+            '--ask-for-approval',
+            'never',
+            '-c',
+            'service_tier=fast',
+            '-c',
+            'model_reasoning_effort=high',
+            '-c',
+            'model_provider="openrouter"',
+            '-c',
+            `model="${GLM_52_OPENROUTER_MODEL}"`,
+            '-c',
+            'model_providers.openrouter.name="OpenRouter"',
+            '-c',
+            'model_providers.openrouter.base_url="https://openrouter.ai/api/v1"',
+            '-c',
+            'model_providers.openrouter.env_key="OPENROUTER_API_KEY"',
+            '-c',
+            'model_providers.openrouter.wire_api="responses"',
+            '-c',
+            'model_providers.openrouter.requires_openai_auth=false'
+        ],
+        sandbox_mode: 'danger-full-access',
+        approval_policy: 'never',
+        model_reasoning_effort: 'high',
+        service_tier: 'fast',
+        gpt_fallback_allowed: false,
+        writes_user_codex_config: false
+    };
+}
+export async function resolveMadGlmLaunchKey(env = process.env) {
+    return resolveOpenRouterApiKey({ env });
+}
+export async function writeMadGlmCodexWrapper(input) {
+    const env = input.env || process.env;
+    const paths = openRouterSecretPaths(env);
+    const realCodexBin = String(input.realCodexBin || env.SKS_CODEX_BIN || 'codex');
+    const wrapperPath = path.join(input.missionDir, 'sks-glm-codex-wrapper.sh');
+    await writeTextAtomic(wrapperPath, buildMadGlmCodexWrapperScript({
+        realCodexBin,
+        secretKeyPath: paths.keyPath
+    }));
+    await fs.chmod(wrapperPath, 0o700).catch(() => undefined);
+    return {
+        wrapper_path: wrapperPath,
+        real_codex_bin: realCodexBin,
+        secret_key_path: paths.keyPath,
+        raw_key_written_to_wrapper: false
+    };
+}
+export function buildMadGlmCodexWrapperScript(input) {
+    return [
+        '#!/bin/sh',
+        'set -eu',
+        '# Generated by SKS GLM MAD launch. This wrapper reads the key at runtime',
+        '# so Zellij layout artifacts never contain the raw OpenRouter secret.',
+        'if [ -z "${OPENROUTER_API_KEY:-}" ] && [ -n "${SKS_OPENROUTER_API_KEY:-}" ]; then',
+        '  OPENROUTER_API_KEY="$SKS_OPENROUTER_API_KEY"',
+        '  export OPENROUTER_API_KEY',
+        'fi',
+        `if [ -z "\${OPENROUTER_API_KEY:-}" ] && [ -r ${shellQuote(input.secretKeyPath)} ]; then`,
+        `  OPENROUTER_API_KEY="$(cat ${shellQuote(input.secretKeyPath)})"`,
+        '  export OPENROUTER_API_KEY',
+        'fi',
+        'if [ -z "${OPENROUTER_API_KEY:-}" ]; then',
+        '  echo "SKS GLM MAD blocked: OPENROUTER_API_KEY is missing. Run sks --mad --glm --repair or export OPENROUTER_API_KEY." >&2',
+        '  exit 66',
+        'fi',
+        `exec ${shellQuote(input.realCodexBin)} "$@"`,
+        ''
+    ].join('\n');
+}
+export function buildMadGlmLaunchArtifact(input) {
+    const profile = input.profile || buildMadGlmLaunchProfileNoWrite();
+    return {
+        schema: 'sks.glm-mad-launch.v1',
+        generated_at: nowIso(),
+        ok: Boolean(input.keyResolution.key),
+        mission_id: input.missionId,
+        provider: profile.provider,
+        model: profile.model,
+        profile_name: profile.profile_name,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false,
+        openrouter_key_source: input.keyResolution.source || null,
+        key_preview: input.keyResolution.key_preview || null,
+        wrapper_path: input.wrapper.wrapper_path,
+        real_codex_bin: input.wrapper.real_codex_bin,
+        raw_key_written_to_wrapper: false,
+        codex_args: profile.launch_args,
+        blockers: input.keyResolution.key ? [] : input.keyResolution.blockers,
+        warnings: input.keyResolution.warnings || []
+    };
+}
+function shellQuote(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=glm-mad-launch.js.map