sneakoscope 4.7.1 → 4.7.3

package/dist/core/codex-app.js

@@ -6,6 +6,10 @@ import { EMPTY_CODEX_INFO, getCodexInfo } from './codex-adapter.js';
 import { CODEX_CHROME_EXTENSION_DOC_URL, DEFAULT_CODEX_APP_PLUGINS as DEFAULT_CODEX_APP_PLUGIN_TUPLES, RESERVED_CODEX_PLUGIN_SKILL_NAMES } from './routes.js';
 import { PRODUCT_DESIGN_PLUGIN, normalizeProductDesignPluginEvidence } from './product-design-plugin.js';
 import { PRODUCT_DESIGN_AUTO_INSTALL_ENV, ensureProductDesignPluginInstalled, productDesignAutoInstallRequested } from './product-design-app-server.js';
+import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from './codex-app/glm-model-profile.js';
+import { GLM_52_OPENROUTER_MODEL } from './providers/glm/glm-52-settings.js';
+import { resolveOpenRouterApiKey } from './providers/openrouter/openrouter-secret-store.js';
+import { codexLbEnvPath, parseShellEnvValue } from './codex-lb/codex-lb-env.js';
 export const CODEX_APP_DOCS_URL = 'https://developers.openai.com/codex/app/features';
 export const CODEX_CHANGELOG_URL = 'https://developers.openai.com/codex/changelog';
 export const CODEX_ACCESS_TOKENS_DOCS_URL = 'https://developers.openai.com/codex/enterprise/access-tokens';
@@ -133,6 +137,8 @@ export async function codexAppIntegrationStatus(opts = {}) {
     const productDesignPlugin = await codexProductDesignPluginStatus(opts);
     const pluginSkillShadows = await codexPluginSkillShadowStatus(opts);
     const fastModeConfig = await codexFastModeConfigStatus(opts);
+    const providerModelUi = await codexProviderModelUiStatus(opts);
+    const nativeSksMenu = codexNativeSksMenuStatus();
     const computerUseMcpListed = /computer[-_ ]?use/i.test(mcpText);
     const browserUseMcpListed = /browser[-_ ]?use/i.test(mcpText);
     const imageGenerationReady = codexFeatureEnabled(featureText, 'image_generation');
@@ -161,7 +167,8 @@ export async function codexAppIntegrationStatus(opts = {}) {
         app: {
             installed: appInstalled,
             path: appPath,
-            docs_url: CODEX_APP_DOCS_URL
+            docs_url: CODEX_APP_DOCS_URL,
+            sks_menu: nativeSksMenu
         },
         codex_cli: {
             ok: Boolean(codex.bin),
@@ -186,6 +193,7 @@ export async function codexAppIntegrationStatus(opts = {}) {
             required_flags: requiredFeatureFlags,
             required_flags_ok: requiredFeatureFlagsOk,
             fast_mode_config: fastModeConfig,
+            provider_model_ui: providerModelUi,
             git_actions: gitActions,
             image_generation: imageGenerationReady,
             image_generation_source: imageGenerationReady ? 'codex_features_list' : 'missing',
@@ -223,7 +231,7 @@ export async function codexAppIntegrationStatus(opts = {}) {
             }
         },
         chrome_extension: chromeExtension,
-        guidance: codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags, requiredFeatureFlagsOk, defaultPlugins, productDesignPlugin, pluginSkillShadows, fastModeConfig, gitActions, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl })
+        guidance: codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags, requiredFeatureFlagsOk, defaultPlugins, productDesignPlugin, pluginSkillShadows, fastModeConfig, providerModelUi, nativeSksMenu, gitActions, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl })
     };
 }
 export async function codexChromeExtensionStatus(opts = {}) {
@@ -442,7 +450,25 @@ export function codexAccessTokenStatus(env = process.env) {
             : ['No CODEX_ACCESS_TOKEN detected in the current process environment. This is fine for interactive ChatGPT login or API-key auth.']
     };
 }
-export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags = {}, requiredFeatureFlagsOk = true, defaultPlugins = { ok: true, missing_enabled: [] }, productDesignPlugin = null, pluginSkillShadows = { ok: true, blocking: [] }, fastModeConfig = { ok: true, blockers: [] }, gitActions = { ok: true, blockers: [] }, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl }) {
+function codexNativeSksMenuStatus() {
+    return {
+        schema: 'sks.codex-app-native-menu.v1',
+        supported: false,
+        status: 'unsupported_official_api',
+        requested_label: 'SKS',
+        requested_position: 'between Window and Help',
+        alternatives: [
+            'sks codex-lb use-codex-lb',
+            'sks codex-lb use-oauth',
+            'sks codex-app set-openrouter-key --api-key-stdin',
+            'codex://settings'
+        ],
+        evidence: [
+            'Codex official docs expose settings deep links, slash commands, skills/plugins, and app-server/remote-control surfaces, not third-party native macOS menu insertion.'
+        ]
+    };
+}
+export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags = {}, requiredFeatureFlagsOk = true, defaultPlugins = { ok: true, missing_enabled: [] }, productDesignPlugin = null, pluginSkillShadows = { ok: true, blocking: [] }, fastModeConfig = { ok: true, blockers: [] }, providerModelUi = null, nativeSksMenu = null, gitActions = { ok: true, blockers: [] }, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl }) {
     const lines = [];
     if (!appInstalled) {
         lines.push('Install and open Codex App for first-party MCP/plugin tools. SKS Zellij launch can still run with Codex CLI alone, but Codex Computer Use and imagegen/gpt-image-2 evidence will be unavailable until Codex App is ready.');
@@ -503,6 +529,28 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
         lines.push(`Codex App speed selector can be hidden or locked by config: ${fastModeConfig.blockers.join(', ')}.`);
         lines.push('Run: sks doctor --fix');
     }
+    if (providerModelUi?.glm?.exposed && providerModelUi.glm.openrouter_key_present) {
+        lines.push(`GLM model selector profile is exposed: ${providerModelUi.glm.model} via profiles ${providerModelUi.glm.profiles_present.join(', ')}.`);
+    }
+    else if (providerModelUi?.glm?.exposed) {
+        lines.push(`GLM model selector profile is exposed for ${providerModelUi.glm.model}, but the OpenRouter key is missing.`);
+        lines.push(`Run: ${providerModelUi.glm.key_command}; restart Codex App if the model picker was already open.`);
+    }
+    else if (providerModelUi?.glm) {
+        lines.push(`GLM model selector profile is not exposed yet: ${providerModelUi.glm.blockers.join(', ') || 'profile setup required'}.`);
+        lines.push(`Run: ${providerModelUi.glm.key_command}; then ${providerModelUi.glm.install_command}; restart Codex App if the model picker was already open.`);
+    }
+    if (providerModelUi?.codex_lb?.key_entry_visible && providerModelUi.codex_lb.key_present && providerModelUi.codex_lb.provider_present && providerModelUi.codex_lb.provider_contract_ok && providerModelUi.codex_lb.base_url_present) {
+        lines.push(`codex-lb key entry path is visible and configured; update command ${providerModelUi.codex_lb.set_key_command}.`);
+    }
+    else if (providerModelUi?.codex_lb?.key_entry_visible) {
+        lines.push(`codex-lb key entry path is visible, but setup is incomplete: ${providerModelUi.codex_lb.blockers.join(', ') || 'setup required'}.`);
+        lines.push(`Run: ${providerModelUi.codex_lb.setup_command} or ${providerModelUi.codex_lb.set_key_command}.`);
+    }
+    else if (providerModelUi?.codex_lb) {
+        lines.push(`codex-lb key entry path is not exposed yet: ${providerModelUi.codex_lb.blockers.join(', ') || 'setup required'}.`);
+        lines.push(`Run: ${providerModelUi.codex_lb.setup_command} or ${providerModelUi.codex_lb.set_key_command}.`);
+    }
     if (!gitActions?.ok) {
         lines.push(`Codex App git commit/push actions are blocked: ${gitActions?.blockers?.join(', ') || 'git action readiness'}. The app Commit, Push, Commit and Push, and PR flows need codex_git_commit, hooks, and Codex CLI remote-control support.`);
         lines.push(`Run: sks doctor --fix; if remote-control is still blocked, update Codex CLI to ${CODEX_REMOTE_CONTROL_MIN_VERSION}+ and restart older app-server/TUI sessions.`);
@@ -510,6 +558,9 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
     else {
         lines.push('Codex App git actions are enabled for Commit, Push, Commit and Push, and PR flows; SKS hooks treat those app metadata actions as lightweight git UI actions.');
     }
+    if (nativeSksMenu?.supported === false) {
+        lines.push('Native macOS SKS menu is not installed because Codex App does not expose a documented third-party native menu extension API; use `sks codex-lb use-codex-lb`, `sks codex-lb use-oauth`, and `sks codex-app set-openrouter-key --api-key-stdin` instead.');
+    }
     if (appInstalled && (!computerUseReady || !browserToolReady)) {
         lines.push('Open Codex App settings and enable recommended MCP/plugin tools. Codex CLI 0.130.0+ remote-control/app-server sessions can pick up config changes live; restart older CLI/TUI sessions.');
         lines.push(`Required for SKS web QA/UX/browser evidence: Codex Chrome Extension first (${CODEX_CHROME_EXTENSION_SETUP_DOCS_URL}). Computer Use is reserved for native Mac/non-web surfaces.`);
@@ -551,6 +602,10 @@ export function formatCodexAppStatus(status, { includeRaw = false } = {}) {
         `Remote Ctrl: ${status.remote_control?.ok ? 'ok' : 'missing'}${status.remote_control?.codex_cli?.version_number ? ` min ${status.remote_control.min_version}` : ''}`,
         `App Flags:  ${status.features?.required_flags_ok ? 'ok' : `missing ${missingRequiredFeatureFlags(status.features?.required_flags).join(', ') || 'required flags'}`}`,
         `Fast UI:    ${status.features?.fast_mode_config?.ok ? 'ok' : `locked ${(status.features?.fast_mode_config?.blockers || []).join(', ') || 'config'}`}`,
+        `SKS Menu:   ${sksNativeMenuSummary(status.app?.sks_menu)}`,
+        `Provider UI:${providerModelUiSummary(status.features?.provider_model_ui)}`,
+        `GLM Model:  ${glmModelUiSummary(status.features?.provider_model_ui?.glm)}`,
+        `codex-lb Key:${codexLbKeyUiSummary(status.features?.provider_model_ui?.codex_lb)}`,
         `Default Plugins:${status.plugins?.default_plugins?.ok ? ' ok' : ` missing ${defaultPluginMissingSummary(status.plugins?.default_plugins) || 'plugin install/config'}`}`,
         `Product Design:${productDesignStatusSummary(status.plugins?.design_product)}`,
         `Plugin Picker:${status.plugins?.picker?.ok ? ' ok' : ` blocked ${pluginPickerBlockers(status).join(', ') || 'config'}`}`,
@@ -817,6 +872,134 @@ async function codexFastModeConfigStatus(opts = {}) {
         blockers
     };
 }
+export async function codexProviderModelUiStatus(opts = {}) {
+    const inputEnv = opts.env || process.env;
+    const home = opts.home || inputEnv.HOME || os.homedir();
+    const cwd = opts.cwd || process.cwd();
+    const env = { ...inputEnv, HOME: String(opts.home || inputEnv.HOME || home) };
+    const globalConfigPath = opts.configPath || path.join(home || '', '.codex', 'config.toml');
+    const projectConfigPath = path.join(cwd || '', '.codex', 'config.toml');
+    const globalConfig = await readTextIfExists(globalConfigPath);
+    const projectConfig = path.resolve(projectConfigPath) === path.resolve(globalConfigPath)
+        ? ''
+        : await readTextIfExists(projectConfigPath);
+    const configText = `${globalConfig}\n${projectConfig}`;
+    const openRouterKey = await resolveOpenRouterApiKey({ env }).catch((err) => ({
+        key: null,
+        source: null,
+        key_preview: null,
+        blockers: ['openrouter_key_lookup_failed'],
+        warnings: [err?.message || 'openrouter key lookup failed']
+    }));
+    const codexLbEnvFilePath = opts.codexLbEnvPath || codexLbEnvPath(home);
+    const codexLbEnvText = await readTextIfExists(codexLbEnvFilePath);
+    const codexLbApiKeySource = String(env.CODEX_LB_API_KEY || '').trim()
+        ? 'process.env'
+        : parseShellEnvValue(codexLbEnvText, 'CODEX_LB_API_KEY')
+            ? 'env-file'
+            : 'missing';
+    const codexLbBaseUrlSource = String(env.CODEX_LB_BASE_URL || '').trim()
+        ? 'process.env'
+        : parseShellEnvValue(codexLbEnvText, 'CODEX_LB_BASE_URL')
+            ? 'env-file'
+            : 'missing';
+    const openrouterProvider = tomlTableAny(configText, [
+        `model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}`,
+        `model_providers."${GLM_CODEX_CONFIG_PROVIDER_ID}"`
+    ]);
+    const glmProviderPresent = Boolean(openrouterProvider);
+    const profilesPresent = [];
+    const profilesMissing = [];
+    const glmProfileBlockers = [];
+    for (const profile of GLM_CODEX_CONFIG_REASONING_PROFILES) {
+        const body = tomlTableAny(configText, [`profiles.${profile.id}`, `profiles."${profile.id}"`]);
+        if (!body) {
+            profilesMissing.push(profile.id);
+            glmProfileBlockers.push(`glm_profile_missing:${profile.id}`);
+            continue;
+        }
+        profilesPresent.push(profile.id);
+        if (!hasTomlString(body, 'model_provider', GLM_CODEX_CONFIG_PROVIDER_ID))
+            glmProfileBlockers.push(`glm_profile_provider_invalid:${profile.id}`);
+        if (!hasTomlString(body, 'model', GLM_52_OPENROUTER_MODEL))
+            glmProfileBlockers.push(`glm_profile_model_invalid:${profile.id}`);
+        if (!hasTomlString(body, 'model_reasoning_effort', profile.reasoning_effort))
+            glmProfileBlockers.push(`glm_profile_reasoning_invalid:${profile.id}`);
+    }
+    const codexLbProvider = tomlTableAny(configText, ['model_providers.codex-lb', 'model_providers."codex-lb"']);
+    const codexLbProviderPresent = Boolean(codexLbProvider);
+    const codexLbProviderContractOk = codexLbProviderPresent
+        && hasTomlString(codexLbProvider, 'name', 'openai')
+        && hasTomlString(codexLbProvider, 'wire_api', 'responses')
+        && hasTomlString(codexLbProvider, 'env_key', 'CODEX_LB_API_KEY')
+        && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
+        && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', true);
+    const codexLbSelectedDefault = /(?:^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(topLevelToml(globalConfig));
+    const glmBlockers = [
+        ...(glmProviderPresent ? [] : ['glm_openrouter_provider_missing']),
+        ...glmProfileBlockers,
+        ...(openRouterKey.key ? [] : ['openrouter_key_missing'])
+    ];
+    const codexLbBlockers = [
+        ...(codexLbProviderPresent ? [] : ['codex_lb_provider_missing']),
+        ...(codexLbProviderPresent && !codexLbProviderContractOk ? ['codex_lb_provider_contract_drift'] : []),
+        ...(codexLbApiKeySource !== 'missing' ? [] : ['codex_lb_api_key_missing']),
+        ...(codexLbBaseUrlSource !== 'missing' ? [] : ['codex_lb_base_url_missing'])
+    ];
+    const blockers = [...glmBlockers, ...codexLbBlockers];
+    const keyCommand = 'sks codex-app set-openrouter-key --api-key-stdin';
+    const installCommand = 'sks codex-app glm-profile install';
+    const setupCommand = 'sks codex-lb setup --host <domain> --api-key-stdin --yes';
+    const setKeyCommand = 'sks codex-lb set-key --api-key-stdin';
+    return {
+        schema: 'sks.codex-app-provider-model-ui.v1',
+        ok: blockers.length === 0,
+        checked: true,
+        status: blockers.length === 0 ? 'ready' : 'setup_required',
+        config_paths: {
+            codex_config: globalConfigPath,
+            project_config: projectConfig ? projectConfigPath : null,
+            codex_lb_env: codexLbEnvFilePath
+        },
+        glm: {
+            exposed: glmProviderPresent && profilesMissing.length === 0 && glmProfileBlockers.length === 0,
+            provider_present: glmProviderPresent,
+            provider: GLM_CODEX_CONFIG_PROVIDER_ID,
+            model: GLM_52_OPENROUTER_MODEL,
+            profiles_present: profilesPresent,
+            profiles_missing: profilesMissing,
+            openrouter_key_present: Boolean(openRouterKey.key),
+            openrouter_key_source: openRouterKey.source || null,
+            openrouter_key_preview: openRouterKey.key_preview || null,
+            key_command: keyCommand,
+            install_command: installCommand,
+            doctor_command: 'sks codex-app glm-profile doctor',
+            blockers: glmBlockers
+        },
+        codex_lb: {
+            key_entry_visible: true,
+            provider_present: codexLbProviderPresent,
+            provider_contract_ok: codexLbProviderContractOk,
+            selected_default: codexLbSelectedDefault,
+            key_present: codexLbApiKeySource !== 'missing',
+            api_key_source: codexLbApiKeySource,
+            base_url_present: codexLbBaseUrlSource !== 'missing',
+            base_url_source: codexLbBaseUrlSource,
+            setup_command: setupCommand,
+            set_key_command: setKeyCommand,
+            status_command: 'sks codex-lb status',
+            blockers: codexLbBlockers
+        },
+        ui_actions: [
+            keyCommand,
+            installCommand,
+            setupCommand,
+            setKeyCommand,
+            'sks codex-app status'
+        ],
+        blockers
+    };
+}
 async function readTextIfExists(file) {
     try {
         return await fsp.readFile(file, 'utf8');
@@ -876,6 +1059,38 @@ function productDesignStatusSummary(status = {}) {
         return ' app-server unverified';
     return ' not checked';
 }
+function providerModelUiSummary(status = {}) {
+    if (!status?.checked)
+        return ' not checked';
+    if (status.ok)
+        return ' ok (GLM + codex-lb)';
+    return ` setup ${(status.blockers || []).join(', ') || 'required'}`;
+}
+function sksNativeMenuSummary(status = {}) {
+    if (!status)
+        return 'not checked';
+    if (status.supported)
+        return 'ok';
+    return `${status.status || 'unsupported'} (use CLI/settings)`;
+}
+function glmModelUiSummary(status = {}) {
+    if (!status)
+        return 'not checked';
+    if (status.exposed) {
+        const key = status.openrouter_key_present ? `key ${status.openrouter_key_source || 'present'}` : 'key missing';
+        return `ok ${status.model} (${status.profiles_present?.length || 0} profiles, ${key})`;
+    }
+    return `setup ${(status.blockers || []).join(', ') || 'profile missing'}; run ${status.key_command || 'sks codex-app set-openrouter-key --api-key-stdin'}`;
+}
+function codexLbKeyUiSummary(status = {}) {
+    if (!status)
+        return ' not checked';
+    if (status.key_present && status.provider_contract_ok !== false)
+        return ` configured (${status.api_key_source || 'present'})`;
+    if (status.key_present)
+        return ` setup provider drift; run ${status.setup_command || 'sks codex-lb setup --host <domain> --api-key-stdin --yes'}`;
+    return ` missing (input: ${status.setup_command || 'sks codex-lb setup --host <domain> --api-key-stdin --yes'})`;
+}
 function defaultPluginMissingSummary(defaultPlugins = {}) {
     return [
         ...(defaultPlugins?.missing_installed || []),
@@ -891,6 +1106,23 @@ function tomlTable(text = '', table = '') {
     const re = new RegExp(`(?:^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`);
     return String(text || '').match(re)?.[1] || '';
 }
+function tomlTableAny(text = '', tables = []) {
+    for (const table of tables) {
+        const body = tomlTable(text, table);
+        if (body)
+            return body;
+    }
+    return '';
+}
+function hasTomlString(text = '', key = '', value = '') {
+    const re = new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"${escapeRegExp(value)}"\\s*(?:#.*)?(?=\\n|$)`);
+    return re.test(String(text || ''));
+}
+function hasTomlBoolean(text = '', key = '', value) {
+    const expected = value ? 'true' : 'false';
+    const re = new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*${expected}\\s*(?:#.*)?(?=\\n|$)`);
+    return re.test(String(text || ''));
+}
 function escapeRegExp(text = '') {
     return String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }

package/dist/core/codex-control/codex-sdk-config-policy.js

@@ -19,12 +19,12 @@ export function buildCodexSdkConfig(input) {
         config.model_provider = 'codex-lb';
         config.model_providers = {
             'codex-lb': {
-                name: 'OpenAI',
+                name: 'openai',
                 base_url: codexLbBaseUrl,
                 wire_api: 'responses',
                 env_key: 'CODEX_LB_API_KEY',
                 supports_websockets: true,
-                requires_openai_auth: false
+                requires_openai_auth: true
             }
         };
     }

package/dist/core/codex-control/codex-task-runner.js

@@ -464,12 +464,12 @@ async function ensurePythonCodexLbConfig(env, config) {
         'approval_policy = "never"',
         '',
         '[model_providers.codex-lb]',
-        'name = "OpenAI"',
+        'name = "openai"',
         `base_url = ${tomlQuote(lbBaseUrl)}`,
         'wire_api = "responses"',
         'env_key = "CODEX_LB_API_KEY"',
         'supports_websockets = true',
-        'requires_openai_auth = false',
+        'requires_openai_auth = true',
         ''
     ].join('\n');
     await writeTextAtomic(path.join(codexHome, 'config.toml'), text);

package/dist/core/codex-lb/codex-lb-setup.js

@@ -14,7 +14,7 @@ export function buildCodexLbSetupPlan(answers, opts = {}) {
     if (answers.install_shell_profile !== 'skip' && !answers.write_env_file)
         blockers.push('shell_profile_snippet_requires_env_file');
     const actions = [
-        { type: 'write_config_provider', target: configPath, effect: 'write or update [model_providers.codex-lb] with the normalized base URL, CODEX_LB_API_KEY env_key, and requires_openai_auth=false' }
+        { type: 'write_config_provider', target: configPath, effect: 'write or update [model_providers.codex-lb] with name="openai", the normalized base URL, CODEX_LB_API_KEY env_key, WebSocket support, and requires_openai_auth=true for Codex App routing' }
     ];
     if (answers.use_as_default_provider) {
         actions.push({ type: 'select_default_provider', target: configPath, effect: 'set top-level model_provider = "codex-lb"' });

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.7.0';
+export const PACKAGE_VERSION = '4.7.3';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/imagegen/imagegen-capability.js

@@ -137,8 +137,8 @@ function codexLbAuthBlocker(state) {
         return 'codex_lb_not_selected';
     if (!state.providerConfigured)
         return 'codex_lb_provider_missing';
-    if (state.requiresOpenAiAuth !== false) {
-        return state.requiresOpenAiAuth === true ? 'codex_lb_requires_openai_auth' : 'codex_lb_requires_openai_auth_not_disabled';
+    if (state.requiresOpenAiAuth !== true) {
+        return state.requiresOpenAiAuth === false ? 'codex_lb_legacy_openai_auth_disabled' : 'codex_lb_requires_openai_auth_missing';
     }
     if (state.envKey !== 'CODEX_LB_API_KEY')
         return 'codex_lb_env_key_missing_or_unsupported';

package/dist/core/init.js

@@ -643,7 +643,7 @@ export async function initProject(root, opts = {}) {
         next = shouldSelectCodexLb
             ? upsertTopLevelTomlString(next, 'model_provider', 'codex-lb')
             : removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
-        next = upsertTomlTable(next, 'model_providers.codex-lb', `[model_providers.codex-lb]\nname = "OpenAI"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = false`);
+        next = upsertTomlTable(next, 'model_providers.codex-lb', `[model_providers.codex-lb]\nname = "openai"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true`);
         return `${next.trim()}\n`;
     }
     function parseCodexLbEnvKey(text = '') {

package/dist/core/managed-assets/managed-assets-manifest.js

@@ -1,6 +1,6 @@
 import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const MANAGED_ASSET_SCHEMA_VERSION = 1;
-export const MANAGED_ASSET_VERSION = '4.7.0';
+export const MANAGED_ASSET_VERSION = '4.7.3';
 export const MANAGED_ASSET_MARKER = 'SKS-MANAGED-ASSET';
 export const MANAGED_AGENT_ROLES = Object.freeze([
     role('sks-explorer', 'analysis-scout.toml', 'analysis_scout', 'SKS analysis scout for bounded read/write slices retained for stale Codex agent-role config repair.', 'workspace-write', ['analysis-scout', 'analysis_scout']),

package/dist/core/provider/provider-context.js

@@ -10,7 +10,7 @@ export async function resolveProviderContext(input = {}) {
     const codexLbProviderBlockPresent = hasCodexLbProviderBlock(configText);
     const codexLbEnvKey = codexLbProviderEnvKey(configText) || (codexLbProviderBlockPresent ? 'CODEX_LB_API_KEY' : null);
     const codexLbRequiresOpenAiAuth = codexLbProviderRequiresOpenAiAuth(configText);
-    const codexLbProviderValid = codexLbProviderBlockPresent && (codexLbRequiresOpenAiAuth === false || codexLbRequiresOpenAiAuth == null);
+    const codexLbProviderValid = codexLbProviderBlockPresent && codexLbRequiresOpenAiAuth === true;
     const openaiKey = Boolean(String(env.OPENAI_API_KEY || '').trim());
     const lbKey = Boolean(String((codexLbEnvKey ? env[codexLbEnvKey] : env.CODEX_LB_API_KEY) || env.CODEX_LB_API_KEY || '').trim());
     const envProvider = String(env.SKS_MODEL_PROVIDER || env.CODEX_MODEL_PROVIDER || env.OPENAI_MODEL_PROVIDER || '').trim();

package/dist/core/routes.js

@@ -702,7 +702,7 @@ export const COMMAND_CATALOG = [
     { name: 'update', usage: 'sks update check|now [--version <version>] [--json] [--dry-run]', description: 'Check for SKS updates or install the requested package version through npm global mode.' },
     { name: 'deps', usage: 'sks deps check [--json] [--yes]', description: 'Check Node/npm, Codex CLI, and Zellij readiness; pass --yes to repair missing Codex CLI/Zellij tooling when supported.' },
     { name: 'codex', usage: 'sks codex compatibility|version|doctor|schema|0.142 [--json]', description: 'Check Codex CLI rust-v0.142.0 compatibility, installed version, 0.142 manifest/capability evidence, inherited legacy baselines, and vendored hook schema snapshot freshness.' },
-    { name: 'codex-app', usage: 'sks codex-app [check|product-design|product-design --check-only|ensure-product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App install, Product Design plugin auto-install readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, and Codex CLI 0.130.0+ remote-control availability.' },
+    { name: 'codex-app', usage: 'sks codex-app [check|glm-profile install|set-openrouter-key --api-key-stdin|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App install, GLM/OpenRouter model profile visibility, codex-lb key-entry guidance, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, and Codex CLI 0.130.0+ remote-control availability.' },
     { name: 'codex-native', usage: 'sks codex-native status|feature-broker|invocation-plan|init-deep [--json]', description: 'Inspect Codex Native feature broker readiness, invocation routing, pattern evidence, and managed memory setup.' },
     { name: 'hooks', usage: 'sks hooks explain|status|trust-report|replay|codex-validate|warning-check ... [--json]', description: 'Explain Codex hook events, validate vendored latest 10-event output schemas, replay fixtures, and enforce warning-zero SKS hook policies under the 0.134 compatibility matrix.' },
     { name: 'codex-lb', usage: 'sks codex-lb status|health|metrics|doctor|circuit|repair|setup ...', description: 'Configure, health-check, repair, and record circuit evidence for codex-lb provider auth without confusing ChatGPT OAuth and proxy keys.' },

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.7.0';
+export const PACKAGE_VERSION = '4.7.3';
 //# sourceMappingURL=version.js.map

package/dist/scripts/codex-app-provider-model-ui-check.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { codexProviderModelUiStatus, formatCodexAppStatus } from '../core/codex-app.js';
+import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from '../core/codex-app/glm-model-profile.js';
+import { GLM_52_OPENROUTER_MODEL } from '../core/providers/glm/glm-52-settings.js';
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-app-provider-ui-'));
+const home = path.join(tmp, 'home');
+const cwd = path.join(tmp, 'project');
+await fs.mkdir(path.join(home, '.codex'), { recursive: true });
+await fs.mkdir(path.join(cwd, '.codex'), { recursive: true });
+const missing = await codexProviderModelUiStatus({ home, cwd, env: { HOME: home } });
+const missingText = formatCodexAppStatus(statusFixture(missing));
+await fs.writeFile(path.join(home, '.codex', 'config.toml'), readyConfig(), 'utf8');
+await fs.writeFile(path.join(home, '.codex', 'sks-codex-lb.env'), "export CODEX_LB_BASE_URL='https://lb.example.test/backend-api/codex'\nexport CODEX_LB_API_KEY='sk-codex-lb-fixture'\n", 'utf8');
+const ready = await codexProviderModelUiStatus({
+    home,
+    cwd,
+    env: { HOME: home, OPENROUTER_API_KEY: 'sk-or-fixture' }
+});
+const readyText = formatCodexAppStatus(statusFixture(ready));
+const ok = missing.ok === false
+    && missing.glm.exposed === false
+    && missing.codex_lb.key_entry_visible === true
+    && missing.ui_actions.includes('sks codex-app set-openrouter-key --api-key-stdin')
+    && missing.ui_actions.includes('sks codex-lb setup --host <domain> --api-key-stdin --yes')
+    && /Provider UI:\s*setup/.test(missingText)
+    && /GLM Model:\s*setup/.test(missingText)
+    && /codex-lb Key:\s*missing \(input: sks codex-lb setup/.test(missingText)
+    && ready.ok === true
+    && ready.glm.exposed === true
+    && ready.glm.model === GLM_52_OPENROUTER_MODEL
+    && ready.glm.profiles_present.length === GLM_CODEX_CONFIG_REASONING_PROFILES.length
+    && ready.codex_lb.provider_present === true
+    && ready.codex_lb.key_present === true
+    && /Provider UI:\s*ok/.test(readyText)
+    && readyText.includes(`GLM Model:  ok ${GLM_52_OPENROUTER_MODEL}`)
+    && /codex-lb Key:\s*configured/.test(readyText)
+    && !JSON.stringify({ missing, ready, missingText, readyText }).includes('sk-codex-lb-fixture');
+emit({
+    schema: 'sks.codex-app-provider-model-ui-check.v1',
+    ok,
+    missing,
+    ready,
+    secret_safe: !JSON.stringify({ missing, ready, missingText, readyText }).includes('sk-codex-lb-fixture'),
+    blockers: ok ? [] : ['codex_app_provider_model_ui_check_failed']
+});
+function readyConfig() {
+    return [
+        `[model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}]`,
+        'name = "OpenRouter"',
+        'base_url = "https://openrouter.ai/api/v1"',
+        'wire_api = "responses"',
+        'env_key = "OPENROUTER_API_KEY"',
+        'requires_openai_auth = false',
+        '',
+        ...GLM_CODEX_CONFIG_REASONING_PROFILES.flatMap((profile) => [
+            `[profiles.${profile.id}]`,
+            `model_provider = "${GLM_CODEX_CONFIG_PROVIDER_ID}"`,
+            `model = "${GLM_52_OPENROUTER_MODEL}"`,
+            `model_reasoning_effort = "${profile.reasoning_effort}"`,
+            'service_tier = "default"',
+            'approval_policy = "on-request"',
+            ''
+        ]),
+        '[model_providers.codex-lb]',
+        'name = "openai"',
+        'base_url = "https://lb.example.test/backend-api/codex"',
+        'wire_api = "responses"',
+        'env_key = "CODEX_LB_API_KEY"',
+        'supports_websockets = true',
+        'requires_openai_auth = true',
+        ''
+    ].join('\n');
+}
+function statusFixture(providerModelUi) {
+    return {
+        ok: providerModelUi.ok,
+        app: { installed: true, path: '/Applications/Codex.app' },
+        codex_cli: { ok: true, version: '0.142.0' },
+        remote_control: { ok: true, min_version: '0.130.0', codex_cli: { version_number: '0.142.0' } },
+        features: {
+            checked: true,
+            required_flags_ok: true,
+            required_flags: {},
+            fast_mode_config: { ok: true, blockers: [] },
+            provider_model_ui: providerModelUi,
+            git_actions: { ok: true, blockers: [] },
+            browser_tool_ready: true,
+            browser_tool_source: 'fixture',
+            image_generation: true
+        },
+        plugins: {
+            default_plugins: { ok: true },
+            design_product: { ok: true, id: 'product-design' },
+            picker: { ok: true }
+        },
+        chrome_extension: { ok: true, blockers: [] },
+        mcp: {
+            has_computer_use: true,
+            computer_use_source: 'mcp_list',
+            has_browser_use: true,
+            browser_use_source: 'mcp_list'
+        },
+        guidance: []
+    };
+}
+function emit(report) {
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=codex-app-provider-model-ui-check.js.map

package/dist/scripts/codex-lb-fast-mode-truth-check.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { run } from '../commands/codex-lb.js';
+const calls = [];
+const home = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-fast-truth-'));
+await fs.mkdir(path.join(home, '.codex'), { recursive: true });
+await fs.writeFile(path.join(home, '.codex', 'config.toml'), [
+    'model_provider = "codex-lb"',
+    'service_tier = "fast"',
+    '',
+    '[model_providers.codex-lb]',
+    'name = "openai"',
+    'base_url = "https://lb.example.test/backend-api/codex"',
+    'wire_api = "responses"',
+    'env_key = "CODEX_LB_API_KEY"',
+    'supports_websockets = true',
+    'requires_openai_auth = true',
+    ''
+].join('\n'));
+await fs.writeFile(path.join(home, '.codex', 'auth.json'), `${JSON.stringify({ auth_mode: 'apikey', OPENAI_API_KEY: 'sk-fixture' })}\n`);
+await fs.writeFile(path.join(home, '.codex', 'sks-codex-lb.env'), "export CODEX_LB_BASE_URL='https://lb.example.test/backend-api/codex'\nexport CODEX_LB_API_KEY='sk-fixture'\n");
+const chain = await runFastCheck({
+    HOME: home,
+    CODEX_LB_API_KEY: 'sk-fixture',
+    CODEX_LB_BASE_URL: 'https://lb.example.test/backend-api/codex'
+});
+const requestedOnly = await runFastCheck({
+    HOME: home,
+    CODEX_LB_API_KEY: 'sk-fixture',
+    CODEX_LB_BASE_URL: 'https://lb.example.test/backend-api/codex',
+    SKS_TEST_FAST_ACTUAL_DEFAULT: '1'
+});
+const ok = chain.ok === true
+    && chain.status === 'fast_verified'
+    && calls[0]?.body?.service_tier === 'priority'
+    && requestedOnly.ok === false
+    && requestedOnly.status === 'fast_requested_but_actual_unverified'
+    && requestedOnly.blockers.includes('codex_lb_actual_fast_service_tier_unverified');
+console.log(JSON.stringify({
+    schema: 'sks.codex-lb-fast-mode-truth-check.v1',
+    ok,
+    priority_request_sent: calls[0]?.body?.service_tier === 'priority',
+    verified_case: chain,
+    requested_only_case: requestedOnly,
+    blockers: ok ? [] : ['codex_lb_fast_mode_truth_check_failed']
+}, null, 2));
+if (!ok)
+    process.exitCode = 1;
+async function runFastCheck(env) {
+    const originalFetch = globalThis.fetch;
+    const originalEnv = { ...process.env };
+    const outputs = [];
+    const originalWrite = process.stdout.write.bind(process.stdout);
+    const originalExitCode = process.exitCode;
+    try {
+        Object.assign(process.env, env);
+        process.exitCode = 0;
+        globalThis.fetch = async (_url, init) => {
+            const body = JSON.parse(String(init.body || '{}'));
+            calls.push({ body });
+            const id = calls.length % 2 === 1 ? 'resp_fast_1' : 'resp_fast_2';
+            const actual = env.SKS_TEST_FAST_ACTUAL_DEFAULT === '1' ? 'default' : 'priority';
+            return new Response(JSON.stringify({
+                id,
+                requestedServiceTier: 'priority',
+                actualServiceTier: actual,
+                serviceTier: actual
+            }), { status: 200, headers: { 'content-type': 'application/json' } });
+        };
+        process.stdout.write = (chunk) => {
+            outputs.push(String(chunk));
+            return true;
+        };
+        await run(null, ['fast-check', '--json']);
+        return JSON.parse(outputs.join('') || '{}');
+    }
+    finally {
+        globalThis.fetch = originalFetch;
+        process.stdout.write = originalWrite;
+        process.exitCode = originalExitCode;
+        for (const key of Object.keys(process.env)) {
+            if (!(key in originalEnv))
+                delete process.env[key];
+        }
+        Object.assign(process.env, originalEnv);
+    }
+}
+//# sourceMappingURL=codex-lb-fast-mode-truth-check.js.map