sneakoscope 4.7.1 → 4.7.4

package/dist/core/codex-app.js

@@ -6,6 +6,10 @@ import { EMPTY_CODEX_INFO, getCodexInfo } from './codex-adapter.js';
 import { CODEX_CHROME_EXTENSION_DOC_URL, DEFAULT_CODEX_APP_PLUGINS as DEFAULT_CODEX_APP_PLUGIN_TUPLES, RESERVED_CODEX_PLUGIN_SKILL_NAMES } from './routes.js';
 import { PRODUCT_DESIGN_PLUGIN, normalizeProductDesignPluginEvidence } from './product-design-plugin.js';
 import { PRODUCT_DESIGN_AUTO_INSTALL_ENV, ensureProductDesignPluginInstalled, productDesignAutoInstallRequested } from './product-design-app-server.js';
+import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from './codex-app/glm-model-profile.js';
+import { GLM_52_OPENROUTER_MODEL } from './providers/glm/glm-52-settings.js';
+import { resolveOpenRouterApiKey } from './providers/openrouter/openrouter-secret-store.js';
+import { codexLbEnvPath, parseShellEnvValue } from './codex-lb/codex-lb-env.js';
 export const CODEX_APP_DOCS_URL = 'https://developers.openai.com/codex/app/features';
 export const CODEX_CHANGELOG_URL = 'https://developers.openai.com/codex/changelog';
 export const CODEX_ACCESS_TOKENS_DOCS_URL = 'https://developers.openai.com/codex/enterprise/access-tokens';
@@ -133,6 +137,8 @@ export async function codexAppIntegrationStatus(opts = {}) {
     const productDesignPlugin = await codexProductDesignPluginStatus(opts);
     const pluginSkillShadows = await codexPluginSkillShadowStatus(opts);
     const fastModeConfig = await codexFastModeConfigStatus(opts);
+    const providerModelUi = await codexProviderModelUiStatus(opts);
+    const nativeSksMenu = codexNativeSksMenuStatus();
     const computerUseMcpListed = /computer[-_ ]?use/i.test(mcpText);
     const browserUseMcpListed = /browser[-_ ]?use/i.test(mcpText);
     const imageGenerationReady = codexFeatureEnabled(featureText, 'image_generation');
@@ -161,7 +167,8 @@ export async function codexAppIntegrationStatus(opts = {}) {
         app: {
             installed: appInstalled,
             path: appPath,
-            docs_url: CODEX_APP_DOCS_URL
+            docs_url: CODEX_APP_DOCS_URL,
+            sks_menu: nativeSksMenu
         },
         codex_cli: {
             ok: Boolean(codex.bin),
@@ -186,6 +193,7 @@ export async function codexAppIntegrationStatus(opts = {}) {
             required_flags: requiredFeatureFlags,
             required_flags_ok: requiredFeatureFlagsOk,
             fast_mode_config: fastModeConfig,
+            provider_model_ui: providerModelUi,
             git_actions: gitActions,
             image_generation: imageGenerationReady,
             image_generation_source: imageGenerationReady ? 'codex_features_list' : 'missing',
@@ -223,7 +231,7 @@ export async function codexAppIntegrationStatus(opts = {}) {
             }
         },
         chrome_extension: chromeExtension,
-        guidance: codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags, requiredFeatureFlagsOk, defaultPlugins, productDesignPlugin, pluginSkillShadows, fastModeConfig, gitActions, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl })
+        guidance: codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags, requiredFeatureFlagsOk, defaultPlugins, productDesignPlugin, pluginSkillShadows, fastModeConfig, providerModelUi, nativeSksMenu, gitActions, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl })
     };
 }
 export async function codexChromeExtensionStatus(opts = {}) {
@@ -442,7 +450,29 @@ export function codexAccessTokenStatus(env = process.env) {
             : ['No CODEX_ACCESS_TOKEN detected in the current process environment. This is fine for interactive ChatGPT login or API-key auth.']
     };
 }
-export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags = {}, requiredFeatureFlagsOk = true, defaultPlugins = { ok: true, missing_enabled: [] }, productDesignPlugin = null, pluginSkillShadows = { ok: true, blocking: [] }, fastModeConfig = { ok: true, blockers: [] }, gitActions = { ok: true, blockers: [] }, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl }) {
+function codexNativeSksMenuStatus() {
+    return {
+        schema: 'sks.codex-app-native-menu.v1',
+        supported: false,
+        status: 'unsupported_official_api',
+        requested_label: 'SKS',
+        requested_position: 'between Window and Help',
+        companion_supported: process.platform === 'darwin',
+        companion_position: 'right macOS menu bar status item',
+        companion_install_command: 'sks doctor --fix',
+        alternatives: [
+            'sks doctor --fix',
+            'sks codex-lb use-codex-lb',
+            'sks codex-lb use-oauth',
+            'sks codex-app set-openrouter-key --api-key-stdin',
+            'codex://settings'
+        ],
+        evidence: [
+            'Codex official docs expose settings deep links, slash commands, skills/plugins, and app-server/remote-control surfaces, not third-party native macOS menu insertion.'
+        ]
+    };
+}
+export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags = {}, requiredFeatureFlagsOk = true, defaultPlugins = { ok: true, missing_enabled: [] }, productDesignPlugin = null, pluginSkillShadows = { ok: true, blocking: [] }, fastModeConfig = { ok: true, blockers: [] }, providerModelUi = null, nativeSksMenu = null, gitActions = { ok: true, blockers: [] }, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl }) {
     const lines = [];
     if (!appInstalled) {
         lines.push('Install and open Codex App for first-party MCP/plugin tools. SKS Zellij launch can still run with Codex CLI alone, but Codex Computer Use and imagegen/gpt-image-2 evidence will be unavailable until Codex App is ready.');
@@ -503,6 +533,28 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
         lines.push(`Codex App speed selector can be hidden or locked by config: ${fastModeConfig.blockers.join(', ')}.`);
         lines.push('Run: sks doctor --fix');
     }
+    if (providerModelUi?.glm?.exposed && providerModelUi.glm.openrouter_key_present) {
+        lines.push(`GLM model selector profile is exposed: ${providerModelUi.glm.model} via profiles ${providerModelUi.glm.profiles_present.join(', ')}.`);
+    }
+    else if (providerModelUi?.glm?.exposed) {
+        lines.push(`GLM model selector profile is exposed for ${providerModelUi.glm.model}, but the OpenRouter key is missing.`);
+        lines.push(`Run: ${providerModelUi.glm.key_command}; restart Codex App if the model picker was already open.`);
+    }
+    else if (providerModelUi?.glm) {
+        lines.push(`GLM model selector profile is not exposed yet: ${providerModelUi.glm.blockers.join(', ') || 'profile setup required'}.`);
+        lines.push(`Run: ${providerModelUi.glm.key_command}; then ${providerModelUi.glm.install_command}; restart Codex App if the model picker was already open.`);
+    }
+    if (providerModelUi?.codex_lb?.key_entry_visible && providerModelUi.codex_lb.key_present && providerModelUi.codex_lb.provider_present && providerModelUi.codex_lb.provider_contract_ok && providerModelUi.codex_lb.base_url_present) {
+        lines.push(`codex-lb key entry path is visible and configured; update command ${providerModelUi.codex_lb.set_key_command}.`);
+    }
+    else if (providerModelUi?.codex_lb?.key_entry_visible) {
+        lines.push(`codex-lb key entry path is visible, but setup is incomplete: ${providerModelUi.codex_lb.blockers.join(', ') || 'setup required'}.`);
+        lines.push(`Run: ${providerModelUi.codex_lb.setup_command} or ${providerModelUi.codex_lb.set_key_command}.`);
+    }
+    else if (providerModelUi?.codex_lb) {
+        lines.push(`codex-lb key entry path is not exposed yet: ${providerModelUi.codex_lb.blockers.join(', ') || 'setup required'}.`);
+        lines.push(`Run: ${providerModelUi.codex_lb.setup_command} or ${providerModelUi.codex_lb.set_key_command}.`);
+    }
     if (!gitActions?.ok) {
         lines.push(`Codex App git commit/push actions are blocked: ${gitActions?.blockers?.join(', ') || 'git action readiness'}. The app Commit, Push, Commit and Push, and PR flows need codex_git_commit, hooks, and Codex CLI remote-control support.`);
         lines.push(`Run: sks doctor --fix; if remote-control is still blocked, update Codex CLI to ${CODEX_REMOTE_CONTROL_MIN_VERSION}+ and restart older app-server/TUI sessions.`);
@@ -510,6 +562,9 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
     else {
         lines.push('Codex App git actions are enabled for Commit, Push, Commit and Push, and PR flows; SKS hooks treat those app metadata actions as lightweight git UI actions.');
     }
+    if (nativeSksMenu?.supported === false) {
+        lines.push('Codex App does not expose a documented third-party API for inserting SKS between Window and Help, so SKS uses a right-side macOS menu bar companion instead. Run `sks doctor --fix` to install or refresh it.');
+    }
     if (appInstalled && (!computerUseReady || !browserToolReady)) {
         lines.push('Open Codex App settings and enable recommended MCP/plugin tools. Codex CLI 0.130.0+ remote-control/app-server sessions can pick up config changes live; restart older CLI/TUI sessions.');
         lines.push(`Required for SKS web QA/UX/browser evidence: Codex Chrome Extension first (${CODEX_CHROME_EXTENSION_SETUP_DOCS_URL}). Computer Use is reserved for native Mac/non-web surfaces.`);
@@ -551,6 +606,10 @@ export function formatCodexAppStatus(status, { includeRaw = false } = {}) {
         `Remote Ctrl: ${status.remote_control?.ok ? 'ok' : 'missing'}${status.remote_control?.codex_cli?.version_number ? ` min ${status.remote_control.min_version}` : ''}`,
         `App Flags:  ${status.features?.required_flags_ok ? 'ok' : `missing ${missingRequiredFeatureFlags(status.features?.required_flags).join(', ') || 'required flags'}`}`,
         `Fast UI:    ${status.features?.fast_mode_config?.ok ? 'ok' : `locked ${(status.features?.fast_mode_config?.blockers || []).join(', ') || 'config'}`}`,
+        `SKS Menu:   ${sksNativeMenuSummary(status.app?.sks_menu)}`,
+        `Provider UI:${providerModelUiSummary(status.features?.provider_model_ui)}`,
+        `GLM Model:  ${glmModelUiSummary(status.features?.provider_model_ui?.glm)}`,
+        `codex-lb Key:${codexLbKeyUiSummary(status.features?.provider_model_ui?.codex_lb)}`,
         `Default Plugins:${status.plugins?.default_plugins?.ok ? ' ok' : ` missing ${defaultPluginMissingSummary(status.plugins?.default_plugins) || 'plugin install/config'}`}`,
         `Product Design:${productDesignStatusSummary(status.plugins?.design_product)}`,
         `Plugin Picker:${status.plugins?.picker?.ok ? ' ok' : ` blocked ${pluginPickerBlockers(status).join(', ') || 'config'}`}`,
@@ -817,6 +876,134 @@ async function codexFastModeConfigStatus(opts = {}) {
         blockers
     };
 }
+export async function codexProviderModelUiStatus(opts = {}) {
+    const inputEnv = opts.env || process.env;
+    const home = opts.home || inputEnv.HOME || os.homedir();
+    const cwd = opts.cwd || process.cwd();
+    const env = { ...inputEnv, HOME: String(opts.home || inputEnv.HOME || home) };
+    const globalConfigPath = opts.configPath || path.join(home || '', '.codex', 'config.toml');
+    const projectConfigPath = path.join(cwd || '', '.codex', 'config.toml');
+    const globalConfig = await readTextIfExists(globalConfigPath);
+    const projectConfig = path.resolve(projectConfigPath) === path.resolve(globalConfigPath)
+        ? ''
+        : await readTextIfExists(projectConfigPath);
+    const configText = `${globalConfig}\n${projectConfig}`;
+    const openRouterKey = await resolveOpenRouterApiKey({ env }).catch((err) => ({
+        key: null,
+        source: null,
+        key_preview: null,
+        blockers: ['openrouter_key_lookup_failed'],
+        warnings: [err?.message || 'openrouter key lookup failed']
+    }));
+    const codexLbEnvFilePath = opts.codexLbEnvPath || codexLbEnvPath(home);
+    const codexLbEnvText = await readTextIfExists(codexLbEnvFilePath);
+    const codexLbApiKeySource = String(env.CODEX_LB_API_KEY || '').trim()
+        ? 'process.env'
+        : parseShellEnvValue(codexLbEnvText, 'CODEX_LB_API_KEY')
+            ? 'env-file'
+            : 'missing';
+    const codexLbBaseUrlSource = String(env.CODEX_LB_BASE_URL || '').trim()
+        ? 'process.env'
+        : parseShellEnvValue(codexLbEnvText, 'CODEX_LB_BASE_URL')
+            ? 'env-file'
+            : 'missing';
+    const openrouterProvider = tomlTableAny(configText, [
+        `model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}`,
+        `model_providers."${GLM_CODEX_CONFIG_PROVIDER_ID}"`
+    ]);
+    const glmProviderPresent = Boolean(openrouterProvider);
+    const profilesPresent = [];
+    const profilesMissing = [];
+    const glmProfileBlockers = [];
+    for (const profile of GLM_CODEX_CONFIG_REASONING_PROFILES) {
+        const body = tomlTableAny(configText, [`profiles.${profile.id}`, `profiles."${profile.id}"`]);
+        if (!body) {
+            profilesMissing.push(profile.id);
+            glmProfileBlockers.push(`glm_profile_missing:${profile.id}`);
+            continue;
+        }
+        profilesPresent.push(profile.id);
+        if (!hasTomlString(body, 'model_provider', GLM_CODEX_CONFIG_PROVIDER_ID))
+            glmProfileBlockers.push(`glm_profile_provider_invalid:${profile.id}`);
+        if (!hasTomlString(body, 'model', GLM_52_OPENROUTER_MODEL))
+            glmProfileBlockers.push(`glm_profile_model_invalid:${profile.id}`);
+        if (!hasTomlString(body, 'model_reasoning_effort', profile.reasoning_effort))
+            glmProfileBlockers.push(`glm_profile_reasoning_invalid:${profile.id}`);
+    }
+    const codexLbProvider = tomlTableAny(configText, ['model_providers.codex-lb', 'model_providers."codex-lb"']);
+    const codexLbProviderPresent = Boolean(codexLbProvider);
+    const codexLbProviderContractOk = codexLbProviderPresent
+        && hasTomlString(codexLbProvider, 'name', 'openai')
+        && hasTomlString(codexLbProvider, 'wire_api', 'responses')
+        && hasTomlString(codexLbProvider, 'env_key', 'CODEX_LB_API_KEY')
+        && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
+        && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', true);
+    const codexLbSelectedDefault = /(?:^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(topLevelToml(globalConfig));
+    const glmBlockers = [
+        ...(glmProviderPresent ? [] : ['glm_openrouter_provider_missing']),
+        ...glmProfileBlockers,
+        ...(openRouterKey.key ? [] : ['openrouter_key_missing'])
+    ];
+    const codexLbBlockers = [
+        ...(codexLbProviderPresent ? [] : ['codex_lb_provider_missing']),
+        ...(codexLbProviderPresent && !codexLbProviderContractOk ? ['codex_lb_provider_contract_drift'] : []),
+        ...(codexLbApiKeySource !== 'missing' ? [] : ['codex_lb_api_key_missing']),
+        ...(codexLbBaseUrlSource !== 'missing' ? [] : ['codex_lb_base_url_missing'])
+    ];
+    const blockers = [...glmBlockers, ...codexLbBlockers];
+    const keyCommand = 'sks codex-app set-openrouter-key --api-key-stdin';
+    const installCommand = 'sks codex-app glm-profile install';
+    const setupCommand = 'sks codex-lb setup --host <domain> --api-key-stdin --yes';
+    const setKeyCommand = 'sks codex-lb set-key --api-key-stdin';
+    return {
+        schema: 'sks.codex-app-provider-model-ui.v1',
+        ok: blockers.length === 0,
+        checked: true,
+        status: blockers.length === 0 ? 'ready' : 'setup_required',
+        config_paths: {
+            codex_config: globalConfigPath,
+            project_config: projectConfig ? projectConfigPath : null,
+            codex_lb_env: codexLbEnvFilePath
+        },
+        glm: {
+            exposed: glmProviderPresent && profilesMissing.length === 0 && glmProfileBlockers.length === 0,
+            provider_present: glmProviderPresent,
+            provider: GLM_CODEX_CONFIG_PROVIDER_ID,
+            model: GLM_52_OPENROUTER_MODEL,
+            profiles_present: profilesPresent,
+            profiles_missing: profilesMissing,
+            openrouter_key_present: Boolean(openRouterKey.key),
+            openrouter_key_source: openRouterKey.source || null,
+            openrouter_key_preview: openRouterKey.key_preview || null,
+            key_command: keyCommand,
+            install_command: installCommand,
+            doctor_command: 'sks codex-app glm-profile doctor',
+            blockers: glmBlockers
+        },
+        codex_lb: {
+            key_entry_visible: true,
+            provider_present: codexLbProviderPresent,
+            provider_contract_ok: codexLbProviderContractOk,
+            selected_default: codexLbSelectedDefault,
+            key_present: codexLbApiKeySource !== 'missing',
+            api_key_source: codexLbApiKeySource,
+            base_url_present: codexLbBaseUrlSource !== 'missing',
+            base_url_source: codexLbBaseUrlSource,
+            setup_command: setupCommand,
+            set_key_command: setKeyCommand,
+            status_command: 'sks codex-lb status',
+            blockers: codexLbBlockers
+        },
+        ui_actions: [
+            keyCommand,
+            installCommand,
+            setupCommand,
+            setKeyCommand,
+            'sks codex-app status'
+        ],
+        blockers
+    };
+}
 async function readTextIfExists(file) {
     try {
         return await fsp.readFile(file, 'utf8');
@@ -876,6 +1063,38 @@ function productDesignStatusSummary(status = {}) {
         return ' app-server unverified';
     return ' not checked';
 }
+function providerModelUiSummary(status = {}) {
+    if (!status?.checked)
+        return ' not checked';
+    if (status.ok)
+        return ' ok (GLM + codex-lb)';
+    return ` setup ${(status.blockers || []).join(', ') || 'required'}`;
+}
+function sksNativeMenuSummary(status = {}) {
+    if (!status)
+        return 'not checked';
+    if (status.supported)
+        return 'ok';
+    return `${status.status || 'unsupported'} (use CLI/settings)`;
+}
+function glmModelUiSummary(status = {}) {
+    if (!status)
+        return 'not checked';
+    if (status.exposed) {
+        const key = status.openrouter_key_present ? `key ${status.openrouter_key_source || 'present'}` : 'key missing';
+        return `ok ${status.model} (${status.profiles_present?.length || 0} profiles, ${key})`;
+    }
+    return `setup ${(status.blockers || []).join(', ') || 'profile missing'}; run ${status.key_command || 'sks codex-app set-openrouter-key --api-key-stdin'}`;
+}
+function codexLbKeyUiSummary(status = {}) {
+    if (!status)
+        return ' not checked';
+    if (status.key_present && status.provider_contract_ok !== false)
+        return ` configured (${status.api_key_source || 'present'})`;
+    if (status.key_present)
+        return ` setup provider drift; run ${status.setup_command || 'sks codex-lb setup --host <domain> --api-key-stdin --yes'}`;
+    return ` missing (input: ${status.setup_command || 'sks codex-lb setup --host <domain> --api-key-stdin --yes'})`;
+}
 function defaultPluginMissingSummary(defaultPlugins = {}) {
     return [
         ...(defaultPlugins?.missing_installed || []),
@@ -891,6 +1110,23 @@ function tomlTable(text = '', table = '') {
     const re = new RegExp(`(?:^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`);
     return String(text || '').match(re)?.[1] || '';
 }
+function tomlTableAny(text = '', tables = []) {
+    for (const table of tables) {
+        const body = tomlTable(text, table);
+        if (body)
+            return body;
+    }
+    return '';
+}
+function hasTomlString(text = '', key = '', value = '') {
+    const re = new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"${escapeRegExp(value)}"\\s*(?:#.*)?(?=\\n|$)`);
+    return re.test(String(text || ''));
+}
+function hasTomlBoolean(text = '', key = '', value) {
+    const expected = value ? 'true' : 'false';
+    const re = new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*${expected}\\s*(?:#.*)?(?=\\n|$)`);
+    return re.test(String(text || ''));
+}
 function escapeRegExp(text = '') {
     return String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }

package/dist/core/codex-control/codex-sdk-config-policy.js

@@ -19,12 +19,12 @@ export function buildCodexSdkConfig(input) {
         config.model_provider = 'codex-lb';
         config.model_providers = {
             'codex-lb': {
-                name: 'OpenAI',
+                name: 'openai',
                 base_url: codexLbBaseUrl,
                 wire_api: 'responses',
                 env_key: 'CODEX_LB_API_KEY',
                 supports_websockets: true,
-                requires_openai_auth: false
+                requires_openai_auth: true
             }
         };
     }

package/dist/core/codex-control/codex-task-runner.js

@@ -464,12 +464,12 @@ async function ensurePythonCodexLbConfig(env, config) {
         'approval_policy = "never"',
         '',
         '[model_providers.codex-lb]',
-        'name = "OpenAI"',
+        'name = "openai"',
         `base_url = ${tomlQuote(lbBaseUrl)}`,
         'wire_api = "responses"',
         'env_key = "CODEX_LB_API_KEY"',
         'supports_websockets = true',
-        'requires_openai_auth = false',
+        'requires_openai_auth = true',
         ''
     ].join('\n');
     await writeTextAtomic(path.join(codexHome, 'config.toml'), text);

package/dist/core/codex-lb/codex-lb-setup.js

@@ -14,7 +14,7 @@ export function buildCodexLbSetupPlan(answers, opts = {}) {
     if (answers.install_shell_profile !== 'skip' && !answers.write_env_file)
         blockers.push('shell_profile_snippet_requires_env_file');
     const actions = [
-        { type: 'write_config_provider', target: configPath, effect: 'write or update [model_providers.codex-lb] with the normalized base URL, CODEX_LB_API_KEY env_key, and requires_openai_auth=false' }
+        { type: 'write_config_provider', target: configPath, effect: 'write or update [model_providers.codex-lb] with name="openai", the normalized base URL, CODEX_LB_API_KEY env_key, WebSocket support, and requires_openai_auth=true for Codex App routing' }
     ];
     if (answers.use_as_default_provider) {
         actions.push({ type: 'select_default_provider', target: configPath, effect: 'set top-level model_provider = "codex-lb"' });

package/dist/core/commands/basic-cli.js

@@ -113,24 +113,29 @@ export async function updateCheckCommand(args = []) {
         return printJson(result);
     console.log(`${sksTextLogo()}\n\n${formatSksUpdateCheckText(result)}`);
 }
-export async function updateCommand(sub = 'check', args = []) {
-    const action = String(sub || 'check').toLowerCase();
+export async function updateCommand(sub = 'now', args = []) {
+    let action = String(sub || 'now').toLowerCase();
+    let effectiveArgs = args;
+    if (action.startsWith('-')) {
+        effectiveArgs = [String(sub), ...args];
+        action = 'now';
+    }
     if (action === 'check' || action === 'status')
-        return updateCheckCommand(args);
+        return updateCheckCommand(effectiveArgs);
     if (action !== 'now') {
-        console.error('Usage: sks update check|now [--version <version>] [--json] [--dry-run]');
+        console.error('Usage: sks update [check|now] [--version <version>] [--json] [--dry-run]');
         process.exitCode = 1;
         return;
     }
     const root = await projectRoot();
     const result = await withSecretPreservationGuard(root, 'update-now', async () => runSksUpdateNow({
-        version: valueAfter(args, '--version') || valueAfter(args, '-v'),
-        dryRun: flag(args, '--dry-run'),
+        version: valueAfter(effectiveArgs, '--version') || valueAfter(effectiveArgs, '-v'),
+        dryRun: flag(effectiveArgs, '--dry-run'),
         projectRoot: root,
         timeoutMs: 10 * 60 * 1000,
         maxOutputBytes: 128 * 1024
     }));
-    if (flag(args, '--json'))
+    if (flag(effectiveArgs, '--json'))
         return printJson(result);
     console.log(`${sksTextLogo()}\n`);
     console.log(`SKS update ${result.status}`);
@@ -144,6 +149,8 @@ export async function updateCommand(sub = 'check', args = []) {
         console.log(`New version: ${result.new_version}`);
     if (result.project_receipt)
         console.log(`Migration receipt: ${result.project_receipt.root} (${result.migration_current ? 'current' : 'not current'})`);
+    if (result.sks_menubar)
+        console.log(`SKS menu bar: ${result.sks_menubar.status}${result.sks_menubar.app_path ? ` (${result.sks_menubar.app_path})` : ''}`);
     for (const stage of result.stages || [])
         console.log(`Stage ${stage.id}: ${stage.ok ? 'ok' : 'failed'} ${stage.status}`);
     if (result.error)

package/dist/core/doctor/doctor-dirty-planner.js

@@ -89,6 +89,8 @@ function phaseInputFiles(id) {
         return ['src/core/doctor/codex-startup-config-repair.ts', '.codex/config.toml'];
     if (id.includes('supabase'))
         return ['src/core/doctor/supabase-mcp-repair.ts', '.codex/config.toml'];
+    if (id.includes('menubar'))
+        return ['src/core/codex-app/sks-menubar.ts', 'src/commands/doctor.ts', 'package.json'];
     if (id.includes('skill'))
         return ['.agents/skills', 'src/scripts/skill-registry-ledger-check.ts'];
     if (id.includes('native'))

package/dist/core/doctor/doctor-readiness-matrix.js

@@ -60,6 +60,8 @@ export function buildDoctorReadinessMatrix(input = {}) {
         blockers.add('codex_app_fast_ui_repair_requires_confirmation');
     if (input.codex_app_ui?.fast_selector === 'repaired')
         warnings.add('codex_app_fast_selector_repaired_restart_app_if_needed');
+    if (input.sks_menubar?.ok === false)
+        warnings.add(`sks_menubar_${input.sks_menubar?.status || 'blocked'}`);
     const codex0138Doctor = input.codex_0138_doctor || null;
     if (codex0138Doctor?.ok === false)
         for (const blocker of normalizeList(codex0138Doctor.blockers))
@@ -148,6 +150,7 @@ export function buildDoctorReadinessMatrix(input = {}) {
         codex_app_harness_matrix: codexAppHarness,
         fast_mode_ready: input.fast_mode_ready !== false,
         codex_app_ui: input.codex_app_ui || null,
+        sks_menubar: input.sks_menubar || null,
         hooks_ready: input.hooks_ready !== false,
         codex_app_ready: input.codex_app?.ok === true,
         codex_app_required_for_cli: false,
@@ -205,6 +208,7 @@ function buildRepairReadiness(input = {}) {
     add('context7_repair', input.context7_repair, true);
     add('context7_mcp_repair', input.context7_mcp_repair, true);
     add('supabase_mcp_repair', input.supabase_mcp_repair, input.supabase_mcp_repair?.ready_blocking === true);
+    add('sks_menubar', input.sks_menubar, false);
     add('command_alias_cleanup', input.command_aliases, true);
     add('native_capability_repair', input.doctor_native_capability, false);
     if (input.doctor_fix_transaction) {

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.7.0';
+export const PACKAGE_VERSION = '4.7.4';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/imagegen/imagegen-capability.js

@@ -137,8 +137,8 @@ function codexLbAuthBlocker(state) {
         return 'codex_lb_not_selected';
     if (!state.providerConfigured)
         return 'codex_lb_provider_missing';
-    if (state.requiresOpenAiAuth !== false) {
-        return state.requiresOpenAiAuth === true ? 'codex_lb_requires_openai_auth' : 'codex_lb_requires_openai_auth_not_disabled';
+    if (state.requiresOpenAiAuth !== true) {
+        return state.requiresOpenAiAuth === false ? 'codex_lb_legacy_openai_auth_disabled' : 'codex_lb_requires_openai_auth_missing';
     }
     if (state.envKey !== 'CODEX_LB_API_KEY')
         return 'codex_lb_env_key_missing_or_unsupported';

package/dist/core/init.js

@@ -643,7 +643,7 @@ export async function initProject(root, opts = {}) {
         next = shouldSelectCodexLb
             ? upsertTopLevelTomlString(next, 'model_provider', 'codex-lb')
             : removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
-        next = upsertTomlTable(next, 'model_providers.codex-lb', `[model_providers.codex-lb]\nname = "OpenAI"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = false`);
+        next = upsertTomlTable(next, 'model_providers.codex-lb', `[model_providers.codex-lb]\nname = "openai"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true`);
         return `${next.trim()}\n`;
     }
     function parseCodexLbEnvKey(text = '') {

package/dist/core/managed-assets/managed-assets-manifest.js

@@ -1,6 +1,6 @@
 import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const MANAGED_ASSET_SCHEMA_VERSION = 1;
-export const MANAGED_ASSET_VERSION = '4.7.0';
+export const MANAGED_ASSET_VERSION = '4.7.4';
 export const MANAGED_ASSET_MARKER = 'SKS-MANAGED-ASSET';
 export const MANAGED_AGENT_ROLES = Object.freeze([
     role('sks-explorer', 'analysis-scout.toml', 'analysis_scout', 'SKS analysis scout for bounded read/write slices retained for stale Codex agent-role config repair.', 'workspace-write', ['analysis-scout', 'analysis_scout']),

package/dist/core/provider/provider-context.js

@@ -10,7 +10,7 @@ export async function resolveProviderContext(input = {}) {
     const codexLbProviderBlockPresent = hasCodexLbProviderBlock(configText);
     const codexLbEnvKey = codexLbProviderEnvKey(configText) || (codexLbProviderBlockPresent ? 'CODEX_LB_API_KEY' : null);
     const codexLbRequiresOpenAiAuth = codexLbProviderRequiresOpenAiAuth(configText);
-    const codexLbProviderValid = codexLbProviderBlockPresent && (codexLbRequiresOpenAiAuth === false || codexLbRequiresOpenAiAuth == null);
+    const codexLbProviderValid = codexLbProviderBlockPresent && codexLbRequiresOpenAiAuth === true;
     const openaiKey = Boolean(String(env.OPENAI_API_KEY || '').trim());
     const lbKey = Boolean(String((codexLbEnvKey ? env[codexLbEnvKey] : env.CODEX_LB_API_KEY) || env.CODEX_LB_API_KEY || '').trim());
     const envProvider = String(env.SKS_MODEL_PROVIDER || env.CODEX_MODEL_PROVIDER || env.OPENAI_MODEL_PROVIDER || '').trim();

package/dist/core/routes.js

@@ -699,10 +699,10 @@ export const COMMAND_CATALOG = [
     { name: 'quickstart', usage: 'sks quickstart', description: 'Show the shortest safe setup and verification flow.' },
     { name: 'bootstrap', usage: 'sks bootstrap [--install-scope global|project] [--local-only] [--json]', description: 'Initialize the current project, install SKS Codex App files/skills, check Context7/Codex App/Zellij, and print ready true/false.' },
     { name: 'root', usage: 'sks root [--json]', description: 'Show whether SKS is using a project root or the per-user global SKS runtime root.' },
-    { name: 'update', usage: 'sks update check|now [--version <version>] [--json] [--dry-run]', description: 'Check for SKS updates or install the requested package version through npm global mode.' },
+    { name: 'update', usage: 'sks update [check|now] [--version <version>] [--json] [--dry-run]', description: 'Check npm for the latest SKS release and update the global package by default; use `check` for status-only.' },
     { name: 'deps', usage: 'sks deps check [--json] [--yes]', description: 'Check Node/npm, Codex CLI, and Zellij readiness; pass --yes to repair missing Codex CLI/Zellij tooling when supported.' },
     { name: 'codex', usage: 'sks codex compatibility|version|doctor|schema|0.142 [--json]', description: 'Check Codex CLI rust-v0.142.0 compatibility, installed version, 0.142 manifest/capability evidence, inherited legacy baselines, and vendored hook schema snapshot freshness.' },
-    { name: 'codex-app', usage: 'sks codex-app [check|product-design|product-design --check-only|ensure-product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App install, Product Design plugin auto-install readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, and Codex CLI 0.130.0+ remote-control availability.' },
+    { name: 'codex-app', usage: 'sks codex-app [check|glm-profile install|set-openrouter-key --api-key-stdin|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App install, GLM/OpenRouter model profile visibility, codex-lb key-entry guidance, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, and Codex CLI 0.130.0+ remote-control availability.' },
     { name: 'codex-native', usage: 'sks codex-native status|feature-broker|invocation-plan|init-deep [--json]', description: 'Inspect Codex Native feature broker readiness, invocation routing, pattern evidence, and managed memory setup.' },
     { name: 'hooks', usage: 'sks hooks explain|status|trust-report|replay|codex-validate|warning-check ... [--json]', description: 'Explain Codex hook events, validate vendored latest 10-event output schemas, replay fixtures, and enforce warning-zero SKS hook policies under the 0.134 compatibility matrix.' },
     { name: 'codex-lb', usage: 'sks codex-lb status|health|metrics|doctor|circuit|repair|setup ...', description: 'Configure, health-check, repair, and record circuit evidence for codex-lb provider auth without confusing ChatGPT OAuth and proxy keys.' },