sneakoscope 4.8.6 → 4.8.7

package/dist/cli/install-helpers.js

@@ -8,16 +8,19 @@ import { createRequestedScopeContract } from '../core/safety/requested-scope-con
 import { guardedPackageInstall, guardContextForRoute } from '../core/safety/mutation-guard.js';
 import { EMPTY_CODEX_INFO, getCodexInfo } from '../core/codex-adapter.js';
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.js';
-import { initProject, installSkills } from '../core/init.js';
+import { initProject, installGlobalSkills } from '../core/init.js';
 import { context7ConfigToml, DOLLAR_SKILL_NAMES, GETDESIGN_REFERENCE, hasContext7ConfigText, RECOMMENDED_SKILLS } from '../core/routes.js';
 import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
 import { reconcileCodexAppUpgradeProcesses } from '../core/codex-app.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
+import { cleanupMacLaunchSecretEnvironment } from '../core/codex-app/sks-menubar.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
 import { loadCodexLbEnv, writeCodexLbKeychain, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
 import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from '../core/providers/glm/glm-52-profile.js';
 import { GLM_52_OPENROUTER_MODEL } from '../core/providers/glm/glm-52-settings.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellProfileSnippet, selectedCodexLbPersistenceModes } from '../core/codex-lb/codex-lb-setup.js';
+import { extractTomlTable, writeCodexConfigGuarded } from '../core/codex/codex-config-guard.js';
+import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
 import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
 const CODEX_LB_PROVIDER_NAME = 'openai';
 const CODEX_LB_PROVIDER_ENV_KEY = 'CODEX_LB_API_KEY';
@@ -397,7 +400,7 @@ export async function configureCodexLb(opts = {}) {
     const useDefaultProvider = opts.useDefaultProvider !== false;
     const writeEnvFile = opts.writeEnvFile !== false;
     const storeKeychain = opts.storeKeychain === true || opts.keychain === true;
-    const syncLaunchctl = opts.syncLaunchctl !== false && opts.syncLaunchEnv !== false;
+    const syncLaunchctl = opts.syncLaunchctl === true || opts.syncLaunchEnv === true;
     const shellProfile = opts.shellProfile || 'skip';
     const setupAnswers = {
         host_or_base_url: rawHost,
@@ -464,7 +467,7 @@ export async function configureCodexLb(opts = {}) {
         appliedActions.push({ type: 'store_keychain', target: 'macOS Keychain service sks-codex-lb', ok: keychain.ok === true, status: keychain.status });
     const codexEnvironment = await syncCodexLbProviderEnvironment({ env_path: envPath, base_url: baseUrl }, { ...opts, home, apiKey, baseUrl, syncLaunchEnv: syncLaunchctl });
     if (syncLaunchctl)
-        appliedActions.push({ type: 'sync_launchctl', target: 'macOS launchctl user environment', ok: codexEnvironment.ok === true, status: codexEnvironment.status });
+        appliedActions.push({ type: 'sync_launchctl', target: 'macOS launchctl user environment (base URL only; API-key env removed)', ok: codexEnvironment.ok === true, status: codexEnvironment.status });
     const shellProfileResult = await installCodexLbShellProfileSnippet({ home, envPath, shellProfile }).catch((err) => ({ ok: false, status: 'failed', files: [], error: err.message }));
     if (shellProfile !== 'skip')
         appliedActions.push({ type: 'install_shell_profile_snippet', target: shellProfileResult.files?.join(', ') || shellProfile, ok: shellProfileResult.ok === true, status: shellProfileResult.status });
@@ -979,6 +982,10 @@ function topLevelTomlString(text = '', key) {
     const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
     return topLevel.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[2] || '';
 }
+function tomlTableString(text = '', table, key) {
+    const block = String(text || '').match(new RegExp(`(^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`))?.[2] || '';
+    return block.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[2] || '';
+}
 export async function repairCodexLbAuth(opts = {}) {
     let status = await codexLbStatus(opts);
     let configRepaired = false;
@@ -995,7 +1002,11 @@ export async function repairCodexLbAuth(opts = {}) {
     }
     if (status.env_key_configured && status.base_url && (!status.provider_contract_ok || !status.selected || legacyAuthMigrated || hasTopLevelCodexModeLock(currentConfig) || (opts.forceCodexLbApiKeyAuth === true && !status.ok))) {
         await ensureDir(path.dirname(status.config_path));
-        const next = normalizeCodexFastModeUiConfig(upsertCodexLbConfig(currentConfig, status.base_url), {
+        const preservedUserFastMode = extractTomlTable(currentConfig, 'user.fast_mode');
+        let next = upsertCodexLbConfig(currentConfig, status.base_url);
+        if (preservedUserFastMode)
+            next = upsertTomlTable(next, 'user.fast_mode', preservedUserFastMode);
+        next = normalizeCodexFastModeUiConfig(next, {
             forceFastMode: opts.forceFastMode === true || opts.forceCodexLbApiKeyAuth === true
         });
         const safeWrite = await safeWriteCodexConfigToml(status.config_path, currentConfig, next, 'codex-lb-repair');
@@ -1337,8 +1348,8 @@ export async function unselectCodexLbProvider(opts = {}) {
         return { status: 'not_selected', config_path: configPath };
     try {
         const next = ensureTrailingNewline(removeTopLevelTomlString(current, 'model_provider'));
-        await writeTextAtomic(configPath, next);
-        return { status: 'unselected', config_path: configPath };
+        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'codex-lb-unselect');
+        return { status: safeWrite.ok ? 'unselected' : safeWrite.status, config_path: configPath, backup_path: safeWrite.backup_path };
     }
     catch (err) {
         return { status: 'failed', reason: 'write_failed', config_path: configPath, error: err.message };
@@ -1552,11 +1563,11 @@ async function syncCodexLbProviderEnvironment(status = {}, opts = {}) {
     process.env.CODEX_LB_API_KEY = apiKey;
     if (baseUrl)
         process.env.CODEX_LB_BASE_URL = baseUrl;
-    const launchEnv = await syncCodexLbMacLaunchEnvironment({ CODEX_LB_API_KEY: apiKey, ...(baseUrl ? { CODEX_LB_BASE_URL: baseUrl } : {}) }, opts);
+    const launchEnv = await syncCodexLbMacLaunchEnvironment(baseUrl ? { CODEX_LB_BASE_URL: baseUrl } : {}, opts);
     const ok = launchEnv.ok || launchEnv.skipped || launchEnv.status === 'not_macos';
     return {
         ok,
-        status: launchEnv.status === 'synced' ? 'synced' : ok ? 'process_env' : launchEnv.status,
+        status: launchEnv.status === 'synced' ? 'launch_base_url_synced_secret_env_removed' : ok ? 'process_env' : launchEnv.status,
         env_path: envPath,
         base_url: baseUrl || null,
         launch_environment: launchEnv,
@@ -1571,7 +1582,15 @@ async function syncCodexLbMacLaunchEnvironment(values = {}, opts = {}) {
     const launchctl = opts.launchctlBin || await which('launchctl').catch(() => null) || await exists('/bin/launchctl').then((ok) => ok ? '/bin/launchctl' : null).catch(() => null);
     if (!launchctl)
         return { ok: false, status: 'launchctl_missing', error: 'launchctl not found on PATH' };
-    const variables = Object.entries(values).filter(([, value]) => value);
+    const secretCleanup = await cleanupMacLaunchSecretEnvironment({ force: opts.forceLaunchEnv === true }).catch((err) => ({
+        ok: false,
+        status: 'partial',
+        variables: ['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'],
+        cleaned: [],
+        failed: [{ key: 'CODEX_LB_API_KEY', error: err?.message || String(err) }, { key: 'OPENROUTER_API_KEY', error: err?.message || String(err) }],
+        next_actions: ['Run launchctl unsetenv for CODEX_LB_API_KEY and OPENROUTER_API_KEY']
+    }));
+    const variables = Object.entries(values).filter(([key, value]) => value && !['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'].includes(String(key)));
     const results = [];
     for (const [key, value] of variables) {
         const result = await runProcess(launchctl, ['setenv', key, String(value)], { timeoutMs: 5000, maxOutputBytes: 8192 });
@@ -1583,8 +1602,14 @@ async function syncCodexLbMacLaunchEnvironment(values = {}, opts = {}) {
     }
     const failed = results.filter((result) => !result.ok);
     if (failed.length)
-        return { ok: false, status: 'launch_env_failed', variables: results.map((result) => result.key), failed, error: failed.map((result) => `${result.key}: ${result.error}`).join('; ') };
-    return { ok: true, status: 'synced', variables: results.map((result) => result.key) };
+        return { ok: false, status: 'launch_env_failed', variables: results.map((result) => result.key), failed, secret_env_cleanup: secretCleanup, error: failed.map((result) => `${result.key}: ${result.error}`).join('; ') };
+    return {
+        ok: secretCleanup.ok !== false,
+        status: variables.length ? 'synced' : 'secret_env_removed',
+        variables: results.map((result) => result.key),
+        skipped_secret_variables: ['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'],
+        secret_env_cleanup: secretCleanup
+    };
 }
 async function inspectCodexLbMacLaunchEnvironment(baseUrl = '', opts = {}) {
     if (process.platform !== 'darwin' && !opts.forceLaunchEnv)
@@ -1598,20 +1623,33 @@ async function inspectCodexLbMacLaunchEnvironment(baseUrl = '', opts = {}) {
     };
     const currentBaseUrl = await readVar('CODEX_LB_BASE_URL');
     const currentApiKey = await readVar('CODEX_LB_API_KEY');
+    const currentOpenRouterKey = await readVar('OPENROUTER_API_KEY');
     const baseMatches = !baseUrl || currentBaseUrl === String(baseUrl || '').trim();
     const basePresent = Boolean(currentBaseUrl);
     const keyPresent = Boolean(currentApiKey);
+    const openRouterKeyPresent = Boolean(currentOpenRouterKey);
     return {
         checked: true,
         available: true,
-        status: basePresent && keyPresent && baseMatches ? 'synced' : basePresent || keyPresent ? 'partial' : 'missing',
+        status: keyPresent || openRouterKeyPresent
+            ? 'secret_env_present'
+            : basePresent && baseMatches
+                ? 'base_url_only'
+                : basePresent
+                    ? 'partial'
+                    : 'missing',
         variables: [
             ...(keyPresent ? ['CODEX_LB_API_KEY'] : []),
+            ...(openRouterKeyPresent ? ['OPENROUTER_API_KEY'] : []),
             ...(basePresent ? ['CODEX_LB_BASE_URL'] : [])
         ],
         base_url_present: basePresent,
         base_url_matches: baseMatches,
-        api_key_present: keyPresent
+        api_key_present: keyPresent,
+        openrouter_api_key_present: openRouterKeyPresent,
+        next_actions: keyPresent || openRouterKeyPresent
+            ? ['Run: sks doctor --fix', 'Rotate CODEX_LB_API_KEY and OPENROUTER_API_KEY if they were exposed in launchd.']
+            : []
     };
 }
 async function maybeSyncCodexLbSharedLogin(apiKey, opts = {}) {
@@ -1731,7 +1769,9 @@ function detectCodexLbSetupDrift(state = {}) {
     if (!state.storeKeychain && state.keychain?.status && state.keychain.status !== 'skipped')
         drift.push('keychain_touched_despite_no_keychain');
     if (!state.syncLaunchctl && state.codexEnvironment?.launch_environment?.status === 'synced')
-        drift.push('launchctl_synced_despite_no_launchctl');
+        drift.push('launchctl_base_url_synced_despite_no_launchctl');
+    if (state.codexEnvironment?.launch_environment?.secret_env_cleanup?.status === 'partial')
+        drift.push('launchctl_secret_env_cleanup_incomplete');
     if (state.shellProfile === 'skip' && state.shellProfileResult?.status === 'installed')
         drift.push('shell_profile_written_despite_skip');
     if (state.shellProfile === 'skip' && state.beforeState && state.afterState && state.beforeState.profileHash !== state.afterState.profileHash)
@@ -1773,7 +1813,7 @@ function appliedCodexLbPersistenceModes(state = {}) {
     if (state.storeKeychain && state.keychain?.ok === true)
         modes.push('durable_keychain');
     if (state.syncLaunchctl && state.codexEnvironment?.launch_environment?.status === 'synced')
-        modes.push('durable_launchctl');
+        modes.push('process_only_ephemeral');
     if (state.shellProfile !== 'skip' && state.shellProfileResult?.status === 'installed')
         modes.push('shell_profile');
     if (!modes.length && state.apiKeySource === 'process.env')
@@ -1805,14 +1845,13 @@ export async function ensureGlobalCodexFastModeDuringInstall(opts = {}) {
         });
         if (next === ensureTrailingNewline(current))
             return { status: 'present', config_path: configPath };
-        // Safety gate 2: never WRITE a config that would not parse.
-        const nextSmoke = codexConfigParseSmoke(next);
-        if (!nextSmoke.ok)
-            return { status: 'skipped_unsafe_rewrite', config_path: configPath, parse_smoke: nextSmoke };
-        // Safety gate 3: back up the user's good config before mutating it.
-        const backupPath = current.trim() ? await backupCodexConfig(configPath, current, 'pre-update') : null;
-        await writeTextAtomic(configPath, next);
-        return { status: 'updated', config_path: configPath, backup_path: backupPath };
+        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'codex-fast-mode-install');
+        return {
+            status: safeWrite.status === 'written' ? 'updated' : safeWrite.status,
+            config_path: configPath,
+            backup_path: safeWrite.backup_path,
+            parse_smoke: safeWrite.ok ? undefined : safeWrite
+        };
     }
     catch (err) {
         return { status: 'failed', config_path: configPath, error: err.message };
@@ -1827,7 +1866,9 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
     // Keep model and reasoning selection out of top-level config so Codex Desktop can
     // expose its native model/speed selectors. SKS-owned defaults live in profiles below.
     let next = String(text || '');
+    const misplacedDefaultProfile = tomlTableString(next, 'user.fast_mode', 'default_profile');
     next = removeLegacyTopLevelCodexModeLocks(next);
+    next = removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
     next = removeTomlTableKey(next, 'notice', 'fast_default_opt_out');
     next = removeTomlTableKey(next, 'features', 'codex_hooks');
     if (opts.forceFastMode === true) {
@@ -1846,19 +1887,25 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
         'fast_mode_ui = true', 'codex_git_commit = true', 'computer_use = true', 'browser_use = true',
         'browser_use_external = true', 'image_generation = true', 'in_app_browser = true',
         'guardian_approval = true', 'tool_suggest = true', 'apps = true', 'plugins = true'
-    ])
-        next = upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
+    ]) {
+        const featureKey = featureLine.split('=')[0]?.trim();
+        next = opts.forceFastMode === true && ['fast_mode', 'fast_mode_ui'].includes(String(featureKey || ''))
+            ? upsertTomlTableKey(next, 'features', featureLine)
+            : upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
+    }
     if (opts.forceFastMode === true || opts.forceFastModeOff === true) {
         next = upsertTomlTableKey(next, 'user.fast_mode', 'visible = true');
         next = upsertTomlTableKey(next, 'user.fast_mode', 'enabled = true');
         next = opts.forceFastMode === true
-            ? upsertTomlTableKey(next, 'user.fast_mode', 'default_profile = "sks-fast-high"')
-            : removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
+            ? upsertTopLevelTomlString(next, 'default_profile', 'sks-fast-high')
+            : removeTopLevelTomlKeyIfValue(next, 'default_profile', 'sks-fast-high');
     }
     else {
         next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'visible = true');
         next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'enabled = true');
-        next = removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
+        if (misplacedDefaultProfile === 'sks-fast-high') {
+            next = upsertTopLevelTomlString(next, 'default_profile', 'sks-fast-high');
+        }
     }
     // Keep ONLY the sks-fast-high config-profile table for explicit fast-mode opt-in
     // and CLI `--profile` use. The other SKS config profiles are
@@ -1955,6 +2002,8 @@ function upsertTomlTableKey(text, table, line) {
             return lines.join('\n').replace(/\n{3,}/g, '\n\n');
         }
     }
+    if (hasTomlTableKey(lines.join('\n'), table, key))
+        return lines.join('\n').replace(/\n{3,}/g, '\n\n');
     lines.splice(end, 0, line);
     return lines.join('\n').replace(/\n{3,}/g, '\n\n');
 }
@@ -2039,6 +2088,7 @@ async function backupCodexConfig(configPath, text, tag) {
         const stamp = `${PACKAGE_VERSION}-${Date.now().toString(36)}`;
         const backupPath = `${configPath}.sks-${tag}-${stamp}.bak`;
         await writeTextAtomic(backupPath, text);
+        await cleanupCodexConfigBackups(configPath, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
         return backupPath;
     }
     catch {
@@ -2052,20 +2102,32 @@ async function backupCodexConfig(configPath, text, tag) {
 //     string), leaving the existing config untouched,
 //   - otherwise back up the prior config before mutating.
 export async function safeWriteCodexConfigToml(configPath, current, next, tag = 'codex-lb') {
-    const cur = String(current || '');
-    if (cur.trim() && !codexConfigParseSmoke(cur).ok) {
-        const backupPath = await backupCodexConfig(configPath, cur, `${tag}-unparseable`);
-        return { ok: false, status: 'unparseable_config_preserved', config_path: configPath, backup_path: backupPath };
-    }
-    if (!codexConfigParseSmoke(next).ok) {
-        return { ok: false, status: 'skipped_unsafe_rewrite', config_path: configPath, backup_path: null };
-    }
-    if (next === ensureTrailingNewline(cur)) {
-        return { ok: true, status: 'present', config_path: configPath, backup_path: null, changed: false };
-    }
-    const backupPath = cur.trim() ? await backupCodexConfig(configPath, cur, tag) : null;
-    await writeTextAtomic(configPath, next);
-    return { ok: true, status: 'written', config_path: configPath, backup_path: backupPath, changed: true };
+    return writeCodexConfigGuarded({
+        configPath,
+        before: String(current || ''),
+        cause: tag,
+        removeTopLevelModeLocks: true,
+        mutate: () => String(next || '')
+    });
+}
+export function codexFastModeDesktopStatus(text = '') {
+    const validation = validateCodexConfigRoundTrip(String(text || ''));
+    const profile = validation.parsed?.profiles?.['sks-fast-high'];
+    const globalOn = validation.ok
+        && validation.default_profile === 'sks-fast-high'
+        && profile?.model === 'gpt-5.5'
+        && profile?.service_tier === 'fast';
+    return {
+        schema: 'sks.codex-fast-mode-desktop-status.v1',
+        ok: validation.ok,
+        on: Boolean(globalOn),
+        default_profile: validation.default_profile || null,
+        top_level_default_profile: validation.top_level_default_profile === true,
+        user_fast_mode_default_profile: validation.user_fast_mode_default_profile,
+        profile_model: profile?.model || null,
+        profile_service_tier: profile?.service_tier || null,
+        validation
+    };
 }
 function upsertTopLevelTomlBoolean(text, key, value) {
     const line = `${key} = ${value ? 'true' : 'false'}`;
@@ -2374,14 +2436,14 @@ export async function ensureGlobalCodexSkillsDuringInstall(opts = {}) {
         return { status: 'skipped', reason: 'home directory unavailable' };
     const root = globalCodexSkillsRoot(home);
     try {
-        const install = await installSkills(home);
+        const install = await installGlobalSkills(home);
         const skills = await checkRequiredSkills(home, root);
         return {
             status: skills.ok ? 'installed' : 'partial',
             root,
-            installed_count: install.installed_skills.length,
-            removed_aliases: install.removed_agent_skill_aliases,
-            removed_stale_generated_skills: install.removed_stale_generated_skills,
+            installed_count: install.installed.length,
+            removed_aliases: [],
+            removed_stale_generated_skills: install.removed,
             missing_skills: skills.missing
         };
     }
@@ -2685,7 +2747,13 @@ export async function ensureProjectContext7Config(root, transport = 'local') {
     }
     if (hasContext7ConfigText(current))
         return false;
-    await writeTextAtomic(configPath, `${current.trimEnd()}${current.trim() ? '\n\n' : ''}${block}\n`);
+    await writeCodexConfigGuarded({
+        root,
+        configPath,
+        before: current,
+        cause: 'context7-project-config',
+        mutate: () => `${current.trimEnd()}${current.trim() ? '\n\n' : ''}${block}\n`
+    });
     return true;
 }
 export async function checkRequiredSkills(root, skillRoot = root ? path.join(root, '.agents', 'skills') : globalCodexSkillsRoot()) {

package/dist/cli/router.js

@@ -1,6 +1,8 @@
 import { COMMAND_ALIASES, COMMANDS, } from './command-registry.js';
 import { detectGlobalMode, glmWithoutMadResult } from './global-mode-router.js';
 import { ensureCurrentMigrationBeforeCommand } from '../core/update/update-migration-state.js';
+import { projectRoot, readJson } from '../core/fsx.js';
+import { stateFile } from '../core/mission.js';
 export function isCommandName(value) {
     return Object.prototype.hasOwnProperty.call(COMMANDS, value);
 }
@@ -49,15 +51,29 @@ export async function dispatch(args) {
         return result;
     }
     const entry = COMMANDS[command];
-    const migrationGate = await ensureCurrentMigrationBeforeCommand({ command, args: rest });
+    const commandGate = await ensureActiveRouteCommandGate(command, rest);
+    if (!commandGate.ok) {
+        console.error(commandGate.message);
+        process.exitCode = 1;
+        return commandGate;
+    }
+    const migrationGate = await ensureCurrentMigrationBeforeCommand({
+        command,
+        args: rest,
+        skipMigrationGate: entry.skipMigrationGate === true || entry.readonly === true
+    });
     if (!migrationGate.ok) {
         console.error('SKS project migration blocked.');
+        console.error(`Scope: ${migrationGate.scope || 'project'}`);
+        console.error(`Stage: ${migrationGate.failed_stage_id || migrationGate.status}`);
+        if (migrationGate.failed_stage_id)
+            console.error(`Failed stage: ${migrationGate.failed_stage_id}`);
         for (const blocker of migrationGate.blockers)
             console.error(`Required blocker: ${blocker}`);
         for (const warning of migrationGate.warnings)
             console.error(`Optional warning: ${warning}`);
         console.error(`Receipt: ${migrationGate.receipt_path}`);
-        console.error('Run: sks doctor --fix --yes');
+        console.error('Remedies: run `sks doctor --fix --yes`, then retry; diagnostics that must bypass this gate are marked skipMigrationGate in the command registry.');
         process.exitCode = 1;
         return migrationGate;
     }
@@ -66,4 +82,44 @@ export async function dispatch(args) {
         throw new Error(`Command ${command} must export run(command, args)`);
     return mod.run(rawCommand || command, rest);
 }
+async function ensureActiveRouteCommandGate(command, args) {
+    const entry = COMMANDS[command];
+    if (command === 'route' || entry.readonly === true || entry.allowedDuringActiveRoute === true && entry.mutatesRouteState !== true) {
+        return { ok: true, status: 'allowed' };
+    }
+    if (entry.mutatesRouteState !== true)
+        return { ok: true, status: 'allowed' };
+    if (safeReadOnlySubcommand(args))
+        return { ok: true, status: 'allowed_status_subcommand' };
+    const root = await projectRoot(process.cwd()).catch(() => process.cwd());
+    const state = await readJson(stateFile(root), {}).catch(() => ({}));
+    if (!activeRouteStateBlocksCommand(state))
+        return { ok: true, status: 'allowed' };
+    return {
+        schema: 'sks.command-gate-active-route.v1',
+        ok: false,
+        status: 'blocked',
+        command,
+        active_mission_id: state.mission_id || null,
+        active_route: state.route || state.route_command || state.mode || null,
+        active_phase: state.phase || null,
+        message: `SKS command gate blocked '${command}' because active route mission ${state.mission_id} is not closed. Run: sks route close --mission ${state.mission_id}`
+    };
+}
+function safeReadOnlySubcommand(args) {
+    const sub = String(args.find((arg) => !String(arg).startsWith('-')) || '').toLowerCase();
+    if (!['status', 'show', 'list', 'observe', 'watch', 'doctor', 'help'].includes(sub))
+        return false;
+    return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
+}
+function activeRouteStateBlocksCommand(state = {}) {
+    if (!state?.mission_id || state.route_closed === true)
+        return false;
+    const mode = String(state.mode || '').toUpperCase();
+    if (!mode || ['WIKI', 'STATUS', 'HELP'].includes(mode))
+        return false;
+    if (/(?:DONE|COMPLETE|CLOSED|BLOCKED|FAILED)$/i.test(String(state.phase || '')))
+        return false;
+    return Boolean(state.route || state.route_command || ['NARUTO', 'AGENT', 'QALOOP', 'RESEARCH', 'LOOP', 'MADSKS', 'MADDB', 'GOAL'].includes(mode));
+}
 //# sourceMappingURL=router.js.map

package/dist/commands/codex-lb.js

@@ -443,8 +443,8 @@ function shapeCodexLbStatus(status = {}) {
         modes.push('durable_env_file');
     if (status.env_loader?.api_key?.source === 'keychain' || status.env_loader?.keychain?.status === 'present')
         modes.push('durable_keychain');
-    if (status.launch_environment?.status === 'synced')
-        modes.push('durable_launchctl');
+    if (status.launch_environment?.status === 'secret_env_present')
+        modes.push('process_only_ephemeral');
     if (!modes.length && status.env_loader?.api_key?.source === 'process.env')
         modes.push('process_only_ephemeral');
     const mode = modes[0] || 'none';
@@ -493,7 +493,7 @@ async function codexLbSetupOptions(args = []) {
         writeEnvFile = true;
     if (flag(args, '--no-keychain'))
         keychain = false;
-    let syncLaunchctl = flag(args, '--no-launchctl') ? false : true;
+    let syncLaunchctl = false;
     if (flag(args, '--launchctl'))
         syncLaunchctl = true;
     const shellProfile = normalizeShellProfile(readOption(args, '--shell-profile', 'skip'));
@@ -508,7 +508,7 @@ async function codexLbSetupOptions(args = []) {
         writeEnvFile = parseYesNo(await ask('4. Write shell env loader to ~/.codex/sks-codex-lb.env? [Y/n] '), true);
         const storeKeychain = (await ask('5. Store the key in macOS Keychain when available? [Y/n] ')).trim();
         keychain = !/^(n|no|아니|아니요|ㄴ)$/i.test(storeKeychain || 'y');
-        syncLaunchctl = parseYesNo(await ask('6. Sync macOS launchctl environment when available? [Y/n] '), true);
+        syncLaunchctl = parseYesNo(await ask('6. Sync non-secret macOS launchctl base URL only? API keys are never stored in launchd. [y/N] '), false);
         const profile = (await ask('7. Install shell profile snippet? [zsh/bash/fish/all/skip] ')).trim();
         const interactiveShellProfile = normalizeShellProfile(profile || 'skip');
         const runHealth = (await ask('8. Run health check now? [Y/n] ')).trim();

package/dist/commands/doctor.js

@@ -1,3 +1,5 @@
+import os from 'node:os';
+import path from 'node:path';
 import { projectRoot, exists, formatBytes } from '../core/fsx.js';
 import { flag } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
@@ -40,6 +42,8 @@ import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 import { writeProjectUpdateMigrationReceipt } from '../core/update/update-migration-state.js';
 import { installSksMenuBar } from '../core/codex-app/sks-menubar.js';
+import { sweepSksTempDirs } from '../core/retention.js';
+import { reconcileSkills } from '../core/init/skills.js';
 export async function run(_command, args = []) {
     const root = await projectRoot();
     const doctorFix = flag(args, '--fix');
@@ -49,9 +53,15 @@ export async function run(_command, args = []) {
 }
 async function runDoctor(args = [], root, doctorFix) {
     const startedAtMs = Date.now();
+    const sksTempSweep = doctorFix ? await sweepSksTempDirs(root, { maxAgeHours: 24 }).catch((err) => ({
+        ok: false,
+        error: err?.message || String(err),
+        actions: []
+    })) : { ok: true, skipped: true, reason: 'doctor_without_fix', actions: [] };
     const doctorProfile = doctorProfileFromArgs(args, doctorFix);
     const machineOnly = flag(args, '--machine-only');
     const reportFile = readOption(args, '--report-file', null);
+    const argWarnings = doctorArgWarnings(args);
     const deepDiagnostics = doctorProfile === 'full' || doctorProfile === 'capabilities';
     const codexBin = readOption(args, '--codex-bin', process.env.SKS_DOCTOR_CODEX_BIN || '');
     const actualCodexProbeRequested = flag(args, '--actual-codex') || flag(args, '--require-actual-codex') || Boolean(codexBin);
@@ -99,6 +109,20 @@ async function runDoctor(args = [], root, doctorFix) {
                 : deepDiagnostics ? await ensureGlobalCodexFastModeDuringInstall().catch((err) => ({ status: 'failed', error: err?.message || String(err) })) : { status: 'skipped', reason: 'default_doctor_no_global_fast_mode_regeneration' }
         };
     }
+    const skillsReconcile = doctorFix
+        ? {
+            global: await reconcileSkills({
+                targetDir: path.join(os.homedir(), '.agents', 'skills'),
+                scope: 'global',
+                fix: true
+            }).catch((err) => ({ ok: false, error: err?.message || String(err) })),
+            project: await reconcileSkills({
+                targetDir: path.join(root, '.agents', 'skills'),
+                scope: 'project',
+                fix: true
+            }).catch((err) => ({ ok: false, error: err?.message || String(err) }))
+        }
+        : { skipped: true, reason: 'doctor_without_fix' };
     const commandAliasCleanup = await runDoctorCommandAliasCleanup({
         root,
         fix: doctorFix
@@ -289,10 +313,18 @@ async function runDoctor(args = [], root, doctorFix) {
         executable_path: null,
         launch_agent_path: null,
         action_script_path: null,
+        build_stamp_path: null,
         report_path: `${root}/.sneakoscope/reports/sks-menubar.json`,
         menu_items: [],
         actions: [],
         launch: { requested: doctorFix, method: 'none', ok: false, error: err?.message || String(err) },
+        tcc_automation_status: 'unknown',
+        next_actions: [
+            'Run: sks menubar status',
+            'Run: sks menubar install',
+            'Run: sks menubar restart',
+            'Rotate CODEX_LB_API_KEY and OPENROUTER_API_KEY if they were previously exposed in launchd.'
+        ],
         blockers: [err?.message || String(err)],
         warnings: []
     }));
@@ -687,8 +719,9 @@ async function runDoctor(args = [], root, doctorFix) {
     const result = {
         schema: 'sks.doctor-status.v2',
         elapsed_ms: Date.now() - startedAtMs,
-        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false && (!doctorFixPostcheck || doctorFixPostcheck.ok !== false),
+        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false,
         root,
+        arg_warnings: argWarnings,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
         codex_config: codexConfig,
@@ -712,11 +745,24 @@ async function runDoctor(args = [], root, doctorFix) {
         supabase_mcp_repair: supabaseMcpRepair,
         doctor_fix_transaction: doctorFixTransaction,
         doctor_fix_postcheck: doctorFixPostcheck,
+        postcheck: doctorFixPostcheck ? {
+            ok: doctorFixPostcheck.ok === true,
+            pending_manual: doctorFixPostcheck.pending_manual || [],
+            required_blockers: doctorFixPostcheck.required_blockers || [],
+            optional_warnings: doctorFixPostcheck.optional_warnings || []
+        } : null,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         zellij_readiness: zellijReadiness,
         codex_permission_profiles: permissionProfiles,
         command_aliases: commandAliasCleanup,
+        sks_temp_sweep: {
+            ok: sksTempSweep.ok !== false,
+            skipped: sksTempSweep.skipped === true,
+            action_count: Array.isArray(sksTempSweep.actions) ? sksTempSweep.actions.length : 0,
+            reason: sksTempSweep.reason || null,
+            error: sksTempSweep.error || null
+        },
         imagegen: {
             ok: imagegen.auth_readiness?.available_paths?.length > 0,
             auth_readiness: imagegen.auth_readiness || null,
@@ -735,7 +781,8 @@ async function runDoctor(args = [], root, doctorFix) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, sks_menubar: sksMenuBar, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
+        skills: skillsReconcile,
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, sks_menubar: sksMenuBar, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup, skills: skillsReconcile, sks_temp_sweep: sksTempSweep }
     };
     if (reportFile)
         await writeJsonReportFile(reportFile, result);
@@ -751,6 +798,8 @@ async function runDoctor(args = [], root, doctorFix) {
         return;
     }
     console.log('SKS Doctor');
+    for (const warning of argWarnings)
+        console.log(`Argument warning: ${warning}`);
     console.log(`Root:      ${root}`);
     console.log(`Node:      ${result.node.ok ? 'ok' : 'fail'} ${result.node.version}`);
     console.log(`Codex:     ${codex.bin ? 'ok' : 'missing'} ${codex.version || ''}`);
@@ -1017,7 +1066,7 @@ function fallbackCodexNativeFeatureMatrix(codex, blockers = [], warnings = []) {
         warnings
     };
 }
-function doctorProfileFromArgs(args = [], doctorFix = false) {
+export function doctorProfileFromArgs(args = [], doctorFix = false) {
     const explicit = readOption(args, '--profile', null);
     if (explicit === 'migration' || explicit === 'full' || explicit === 'capabilities' || explicit === 'fast' || explicit === 'fix')
         return explicit;
@@ -1027,6 +1076,39 @@ function doctorProfileFromArgs(args = [], doctorFix = false) {
         return 'capabilities';
     return doctorFix ? 'fix' : 'fast';
 }
+export function doctorArgWarnings(args = []) {
+    const warnings = [];
+    const explicit = readOption(args, '--profile', null);
+    if (explicit && !['migration', 'full', 'capabilities', 'fast', 'fix'].includes(String(explicit))) {
+        warnings.push(`unknown_profile:${explicit}; supported profiles: migration, full, capabilities, fast, fix`);
+    }
+    for (const flag of unknownDoctorFlags(args))
+        warnings.push(`unknown_flag:${flag}`);
+    return warnings;
+}
+function unknownDoctorFlags(args = []) {
+    const knownBoolean = new Set([
+        '--fix', '--yes', '-y', '--machine-only', '--actual-codex', '--require-actual-codex',
+        '--full', '--capabilities', '--repair-codex-app-ui', '--repair-zellij', '--install-homebrew',
+        '--repair-native-capabilities', '--repair-codex-native', '--local-only', '--project', '--global',
+        '--dry-run', '--json'
+    ]);
+    const knownValue = new Set(['--profile', '--report-file', '--codex-bin', '--install-scope']);
+    const unknown = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = String(args[index] || '');
+        if (!arg.startsWith('-'))
+            continue;
+        if (knownValue.has(arg)) {
+            index += 1;
+            continue;
+        }
+        if (knownBoolean.has(arg))
+            continue;
+        unknown.push(arg);
+    }
+    return unknown;
+}
 function doctorPhaseIdsForProfile(profile) {
     const required = [
         'codex_startup_repair',