sneakoscope 4.8.6 → 5.1.2

package/dist/cli/install-helpers.js

@@ -8,17 +8,21 @@ import { createRequestedScopeContract } from '../core/safety/requested-scope-con
 import { guardedPackageInstall, guardContextForRoute } from '../core/safety/mutation-guard.js';
 import { EMPTY_CODEX_INFO, getCodexInfo } from '../core/codex-adapter.js';
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.js';
-import { initProject, installSkills } from '../core/init.js';
+import { initProject, installGlobalSkills } from '../core/init.js';
 import { context7ConfigToml, DOLLAR_SKILL_NAMES, GETDESIGN_REFERENCE, hasContext7ConfigText, RECOMMENDED_SKILLS } from '../core/routes.js';
 import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
 import { reconcileCodexAppUpgradeProcesses } from '../core/codex-app.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
+import { cleanupMacLaunchSecretEnvironment } from '../core/codex-app/sks-menubar.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
 import { loadCodexLbEnv, writeCodexLbKeychain, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
 import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from '../core/providers/glm/glm-52-profile.js';
 import { GLM_52_OPENROUTER_MODEL } from '../core/providers/glm/glm-52-settings.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellProfileSnippet, selectedCodexLbPersistenceModes } from '../core/codex-lb/codex-lb-setup.js';
+import { extractTomlTable, writeCodexConfigGuarded } from '../core/codex/codex-config-guard.js';
+import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
 import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
+import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
 const CODEX_LB_PROVIDER_NAME = 'openai';
 const CODEX_LB_PROVIDER_ENV_KEY = 'CODEX_LB_API_KEY';
 const CODEX_LB_CANONICAL_FAST_SERVICE_TIER = 'priority';
@@ -87,6 +91,15 @@ export async function postinstall({ bootstrap, args = [] }) {
             console.log(`Codex App Fast mode: skipped (${fastModeRepair.reason}).`);
         else if (fastModeRepair.status === 'failed')
             console.log(`Codex App Fast mode: auto repair failed. Run \`sks setup\`. ${fastModeRepair.error || ''}`.trim());
+        const imagegenRepair = await ensureCodexImagegenDuringInstall();
+        if (imagegenRepair.status === 'ready')
+            console.log('Codex App Image Gen: ready ($imagegen/gpt-image-2 detected).');
+        else if (imagegenRepair.status === 'recovered')
+            console.log('Codex App Image Gen: recovered and re-detected.');
+        else if (imagegenRepair.status === 'blocked')
+            console.log(`Codex App Image Gen: blocked; run \`sks doctor --fix\`. ${(imagegenRepair.blockers || []).join(', ')}`.trim());
+        else if (imagegenRepair.status === 'skipped')
+            console.log(`Codex App Image Gen: skipped (${imagegenRepair.reason}).`);
         const postinstallDoctor = await runPostinstallGlobalDoctorAndMarkPending().catch((err) => ({
             ok: false,
             doctor: null,
@@ -397,7 +410,7 @@ export async function configureCodexLb(opts = {}) {
     const useDefaultProvider = opts.useDefaultProvider !== false;
     const writeEnvFile = opts.writeEnvFile !== false;
     const storeKeychain = opts.storeKeychain === true || opts.keychain === true;
-    const syncLaunchctl = opts.syncLaunchctl !== false && opts.syncLaunchEnv !== false;
+    const syncLaunchctl = opts.syncLaunchctl === true || opts.syncLaunchEnv === true;
     const shellProfile = opts.shellProfile || 'skip';
     const setupAnswers = {
         host_or_base_url: rawHost,
@@ -464,7 +477,7 @@ export async function configureCodexLb(opts = {}) {
         appliedActions.push({ type: 'store_keychain', target: 'macOS Keychain service sks-codex-lb', ok: keychain.ok === true, status: keychain.status });
     const codexEnvironment = await syncCodexLbProviderEnvironment({ env_path: envPath, base_url: baseUrl }, { ...opts, home, apiKey, baseUrl, syncLaunchEnv: syncLaunchctl });
     if (syncLaunchctl)
-        appliedActions.push({ type: 'sync_launchctl', target: 'macOS launchctl user environment', ok: codexEnvironment.ok === true, status: codexEnvironment.status });
+        appliedActions.push({ type: 'sync_launchctl', target: 'macOS launchctl user environment (base URL only; API-key env removed)', ok: codexEnvironment.ok === true, status: codexEnvironment.status });
     const shellProfileResult = await installCodexLbShellProfileSnippet({ home, envPath, shellProfile }).catch((err) => ({ ok: false, status: 'failed', files: [], error: err.message }));
     if (shellProfile !== 'skip')
         appliedActions.push({ type: 'install_shell_profile_snippet', target: shellProfileResult.files?.join(', ') || shellProfile, ok: shellProfileResult.ok === true, status: shellProfileResult.status });
@@ -979,6 +992,10 @@ function topLevelTomlString(text = '', key) {
     const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
     return topLevel.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[2] || '';
 }
+function tomlTableString(text = '', table, key) {
+    const block = String(text || '').match(new RegExp(`(^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`))?.[2] || '';
+    return block.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[2] || '';
+}
 export async function repairCodexLbAuth(opts = {}) {
     let status = await codexLbStatus(opts);
     let configRepaired = false;
@@ -995,7 +1012,11 @@ export async function repairCodexLbAuth(opts = {}) {
     }
     if (status.env_key_configured && status.base_url && (!status.provider_contract_ok || !status.selected || legacyAuthMigrated || hasTopLevelCodexModeLock(currentConfig) || (opts.forceCodexLbApiKeyAuth === true && !status.ok))) {
         await ensureDir(path.dirname(status.config_path));
-        const next = normalizeCodexFastModeUiConfig(upsertCodexLbConfig(currentConfig, status.base_url), {
+        const preservedUserFastMode = extractTomlTable(currentConfig, 'user.fast_mode');
+        let next = upsertCodexLbConfig(currentConfig, status.base_url);
+        if (preservedUserFastMode)
+            next = upsertTomlTable(next, 'user.fast_mode', preservedUserFastMode);
+        next = normalizeCodexFastModeUiConfig(next, {
             forceFastMode: opts.forceFastMode === true || opts.forceCodexLbApiKeyAuth === true
         });
         const safeWrite = await safeWriteCodexConfigToml(status.config_path, currentConfig, next, 'codex-lb-repair');
@@ -1337,8 +1358,8 @@ export async function unselectCodexLbProvider(opts = {}) {
         return { status: 'not_selected', config_path: configPath };
     try {
         const next = ensureTrailingNewline(removeTopLevelTomlString(current, 'model_provider'));
-        await writeTextAtomic(configPath, next);
-        return { status: 'unselected', config_path: configPath };
+        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'codex-lb-unselect');
+        return { status: safeWrite.ok ? 'unselected' : safeWrite.status, config_path: configPath, backup_path: safeWrite.backup_path };
     }
     catch (err) {
         return { status: 'failed', reason: 'write_failed', config_path: configPath, error: err.message };
@@ -1552,11 +1573,11 @@ async function syncCodexLbProviderEnvironment(status = {}, opts = {}) {
     process.env.CODEX_LB_API_KEY = apiKey;
     if (baseUrl)
         process.env.CODEX_LB_BASE_URL = baseUrl;
-    const launchEnv = await syncCodexLbMacLaunchEnvironment({ CODEX_LB_API_KEY: apiKey, ...(baseUrl ? { CODEX_LB_BASE_URL: baseUrl } : {}) }, opts);
+    const launchEnv = await syncCodexLbMacLaunchEnvironment(baseUrl ? { CODEX_LB_BASE_URL: baseUrl } : {}, opts);
     const ok = launchEnv.ok || launchEnv.skipped || launchEnv.status === 'not_macos';
     return {
         ok,
-        status: launchEnv.status === 'synced' ? 'synced' : ok ? 'process_env' : launchEnv.status,
+        status: launchEnv.status === 'synced' ? 'launch_base_url_synced_secret_env_removed' : ok ? 'process_env' : launchEnv.status,
         env_path: envPath,
         base_url: baseUrl || null,
         launch_environment: launchEnv,
@@ -1571,7 +1592,15 @@ async function syncCodexLbMacLaunchEnvironment(values = {}, opts = {}) {
     const launchctl = opts.launchctlBin || await which('launchctl').catch(() => null) || await exists('/bin/launchctl').then((ok) => ok ? '/bin/launchctl' : null).catch(() => null);
     if (!launchctl)
         return { ok: false, status: 'launchctl_missing', error: 'launchctl not found on PATH' };
-    const variables = Object.entries(values).filter(([, value]) => value);
+    const secretCleanup = await cleanupMacLaunchSecretEnvironment({ force: opts.forceLaunchEnv === true }).catch((err) => ({
+        ok: false,
+        status: 'partial',
+        variables: ['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'],
+        cleaned: [],
+        failed: [{ key: 'CODEX_LB_API_KEY', error: err?.message || String(err) }, { key: 'OPENROUTER_API_KEY', error: err?.message || String(err) }],
+        next_actions: ['Run launchctl unsetenv for CODEX_LB_API_KEY and OPENROUTER_API_KEY']
+    }));
+    const variables = Object.entries(values).filter(([key, value]) => value && !['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'].includes(String(key)));
     const results = [];
     for (const [key, value] of variables) {
         const result = await runProcess(launchctl, ['setenv', key, String(value)], { timeoutMs: 5000, maxOutputBytes: 8192 });
@@ -1583,8 +1612,14 @@ async function syncCodexLbMacLaunchEnvironment(values = {}, opts = {}) {
     }
     const failed = results.filter((result) => !result.ok);
     if (failed.length)
-        return { ok: false, status: 'launch_env_failed', variables: results.map((result) => result.key), failed, error: failed.map((result) => `${result.key}: ${result.error}`).join('; ') };
-    return { ok: true, status: 'synced', variables: results.map((result) => result.key) };
+        return { ok: false, status: 'launch_env_failed', variables: results.map((result) => result.key), failed, secret_env_cleanup: secretCleanup, error: failed.map((result) => `${result.key}: ${result.error}`).join('; ') };
+    return {
+        ok: secretCleanup.ok !== false,
+        status: variables.length ? 'synced' : 'secret_env_removed',
+        variables: results.map((result) => result.key),
+        skipped_secret_variables: ['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'],
+        secret_env_cleanup: secretCleanup
+    };
 }
 async function inspectCodexLbMacLaunchEnvironment(baseUrl = '', opts = {}) {
     if (process.platform !== 'darwin' && !opts.forceLaunchEnv)
@@ -1598,20 +1633,33 @@ async function inspectCodexLbMacLaunchEnvironment(baseUrl = '', opts = {}) {
     };
     const currentBaseUrl = await readVar('CODEX_LB_BASE_URL');
     const currentApiKey = await readVar('CODEX_LB_API_KEY');
+    const currentOpenRouterKey = await readVar('OPENROUTER_API_KEY');
     const baseMatches = !baseUrl || currentBaseUrl === String(baseUrl || '').trim();
     const basePresent = Boolean(currentBaseUrl);
     const keyPresent = Boolean(currentApiKey);
+    const openRouterKeyPresent = Boolean(currentOpenRouterKey);
     return {
         checked: true,
         available: true,
-        status: basePresent && keyPresent && baseMatches ? 'synced' : basePresent || keyPresent ? 'partial' : 'missing',
+        status: keyPresent || openRouterKeyPresent
+            ? 'secret_env_present'
+            : basePresent && baseMatches
+                ? 'base_url_only'
+                : basePresent
+                    ? 'partial'
+                    : 'missing',
         variables: [
             ...(keyPresent ? ['CODEX_LB_API_KEY'] : []),
+            ...(openRouterKeyPresent ? ['OPENROUTER_API_KEY'] : []),
             ...(basePresent ? ['CODEX_LB_BASE_URL'] : [])
         ],
         base_url_present: basePresent,
         base_url_matches: baseMatches,
-        api_key_present: keyPresent
+        api_key_present: keyPresent,
+        openrouter_api_key_present: openRouterKeyPresent,
+        next_actions: keyPresent || openRouterKeyPresent
+            ? ['Run: sks doctor --fix', 'Rotate CODEX_LB_API_KEY and OPENROUTER_API_KEY if they were exposed in launchd.']
+            : []
     };
 }
 async function maybeSyncCodexLbSharedLogin(apiKey, opts = {}) {
@@ -1731,7 +1779,9 @@ function detectCodexLbSetupDrift(state = {}) {
     if (!state.storeKeychain && state.keychain?.status && state.keychain.status !== 'skipped')
         drift.push('keychain_touched_despite_no_keychain');
     if (!state.syncLaunchctl && state.codexEnvironment?.launch_environment?.status === 'synced')
-        drift.push('launchctl_synced_despite_no_launchctl');
+        drift.push('launchctl_base_url_synced_despite_no_launchctl');
+    if (state.codexEnvironment?.launch_environment?.secret_env_cleanup?.status === 'partial')
+        drift.push('launchctl_secret_env_cleanup_incomplete');
     if (state.shellProfile === 'skip' && state.shellProfileResult?.status === 'installed')
         drift.push('shell_profile_written_despite_skip');
     if (state.shellProfile === 'skip' && state.beforeState && state.afterState && state.beforeState.profileHash !== state.afterState.profileHash)
@@ -1773,7 +1823,7 @@ function appliedCodexLbPersistenceModes(state = {}) {
     if (state.storeKeychain && state.keychain?.ok === true)
         modes.push('durable_keychain');
     if (state.syncLaunchctl && state.codexEnvironment?.launch_environment?.status === 'synced')
-        modes.push('durable_launchctl');
+        modes.push('process_only_ephemeral');
     if (state.shellProfile !== 'skip' && state.shellProfileResult?.status === 'installed')
         modes.push('shell_profile');
     if (!modes.length && state.apiKeySource === 'process.env')
@@ -1805,14 +1855,13 @@ export async function ensureGlobalCodexFastModeDuringInstall(opts = {}) {
         });
         if (next === ensureTrailingNewline(current))
             return { status: 'present', config_path: configPath };
-        // Safety gate 2: never WRITE a config that would not parse.
-        const nextSmoke = codexConfigParseSmoke(next);
-        if (!nextSmoke.ok)
-            return { status: 'skipped_unsafe_rewrite', config_path: configPath, parse_smoke: nextSmoke };
-        // Safety gate 3: back up the user's good config before mutating it.
-        const backupPath = current.trim() ? await backupCodexConfig(configPath, current, 'pre-update') : null;
-        await writeTextAtomic(configPath, next);
-        return { status: 'updated', config_path: configPath, backup_path: backupPath };
+        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'codex-fast-mode-install');
+        return {
+            status: safeWrite.status === 'written' ? 'updated' : safeWrite.status,
+            config_path: configPath,
+            backup_path: safeWrite.backup_path,
+            parse_smoke: safeWrite.ok ? undefined : safeWrite
+        };
     }
     catch (err) {
         return { status: 'failed', config_path: configPath, error: err.message };
@@ -1827,7 +1876,9 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
     // Keep model and reasoning selection out of top-level config so Codex Desktop can
     // expose its native model/speed selectors. SKS-owned defaults live in profiles below.
     let next = String(text || '');
+    const misplacedDefaultProfile = tomlTableString(next, 'user.fast_mode', 'default_profile');
     next = removeLegacyTopLevelCodexModeLocks(next);
+    next = removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
     next = removeTomlTableKey(next, 'notice', 'fast_default_opt_out');
     next = removeTomlTableKey(next, 'features', 'codex_hooks');
     if (opts.forceFastMode === true) {
@@ -1846,19 +1897,25 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
         'fast_mode_ui = true', 'codex_git_commit = true', 'computer_use = true', 'browser_use = true',
         'browser_use_external = true', 'image_generation = true', 'in_app_browser = true',
         'guardian_approval = true', 'tool_suggest = true', 'apps = true', 'plugins = true'
-    ])
-        next = upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
+    ]) {
+        const featureKey = featureLine.split('=')[0]?.trim();
+        next = opts.forceFastMode === true && ['fast_mode', 'fast_mode_ui'].includes(String(featureKey || ''))
+            ? upsertTomlTableKey(next, 'features', featureLine)
+            : upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
+    }
     if (opts.forceFastMode === true || opts.forceFastModeOff === true) {
         next = upsertTomlTableKey(next, 'user.fast_mode', 'visible = true');
         next = upsertTomlTableKey(next, 'user.fast_mode', 'enabled = true');
         next = opts.forceFastMode === true
-            ? upsertTomlTableKey(next, 'user.fast_mode', 'default_profile = "sks-fast-high"')
-            : removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
+            ? upsertTopLevelTomlString(next, 'default_profile', 'sks-fast-high')
+            : removeTopLevelTomlKeyIfValue(next, 'default_profile', 'sks-fast-high');
     }
     else {
         next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'visible = true');
         next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'enabled = true');
-        next = removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
+        if (misplacedDefaultProfile === 'sks-fast-high') {
+            next = upsertTopLevelTomlString(next, 'default_profile', 'sks-fast-high');
+        }
     }
     // Keep ONLY the sks-fast-high config-profile table for explicit fast-mode opt-in
     // and CLI `--profile` use. The other SKS config profiles are
@@ -1955,6 +2012,8 @@ function upsertTomlTableKey(text, table, line) {
             return lines.join('\n').replace(/\n{3,}/g, '\n\n');
         }
     }
+    if (hasTomlTableKey(lines.join('\n'), table, key))
+        return lines.join('\n').replace(/\n{3,}/g, '\n\n');
     lines.splice(end, 0, line);
     return lines.join('\n').replace(/\n{3,}/g, '\n\n');
 }
@@ -2039,6 +2098,7 @@ async function backupCodexConfig(configPath, text, tag) {
         const stamp = `${PACKAGE_VERSION}-${Date.now().toString(36)}`;
         const backupPath = `${configPath}.sks-${tag}-${stamp}.bak`;
         await writeTextAtomic(backupPath, text);
+        await cleanupCodexConfigBackups(configPath, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
         return backupPath;
     }
     catch {
@@ -2052,20 +2112,32 @@ async function backupCodexConfig(configPath, text, tag) {
 //     string), leaving the existing config untouched,
 //   - otherwise back up the prior config before mutating.
 export async function safeWriteCodexConfigToml(configPath, current, next, tag = 'codex-lb') {
-    const cur = String(current || '');
-    if (cur.trim() && !codexConfigParseSmoke(cur).ok) {
-        const backupPath = await backupCodexConfig(configPath, cur, `${tag}-unparseable`);
-        return { ok: false, status: 'unparseable_config_preserved', config_path: configPath, backup_path: backupPath };
-    }
-    if (!codexConfigParseSmoke(next).ok) {
-        return { ok: false, status: 'skipped_unsafe_rewrite', config_path: configPath, backup_path: null };
-    }
-    if (next === ensureTrailingNewline(cur)) {
-        return { ok: true, status: 'present', config_path: configPath, backup_path: null, changed: false };
-    }
-    const backupPath = cur.trim() ? await backupCodexConfig(configPath, cur, tag) : null;
-    await writeTextAtomic(configPath, next);
-    return { ok: true, status: 'written', config_path: configPath, backup_path: backupPath, changed: true };
+    return writeCodexConfigGuarded({
+        configPath,
+        before: String(current || ''),
+        cause: tag,
+        removeTopLevelModeLocks: true,
+        mutate: () => String(next || '')
+    });
+}
+export function codexFastModeDesktopStatus(text = '') {
+    const validation = validateCodexConfigRoundTrip(String(text || ''));
+    const profile = validation.parsed?.profiles?.['sks-fast-high'];
+    const globalOn = validation.ok
+        && validation.default_profile === 'sks-fast-high'
+        && profile?.model === 'gpt-5.5'
+        && profile?.service_tier === 'fast';
+    return {
+        schema: 'sks.codex-fast-mode-desktop-status.v1',
+        ok: validation.ok,
+        on: Boolean(globalOn),
+        default_profile: validation.default_profile || null,
+        top_level_default_profile: validation.top_level_default_profile === true,
+        user_fast_mode_default_profile: validation.user_fast_mode_default_profile,
+        profile_model: profile?.model || null,
+        profile_service_tier: profile?.service_tier || null,
+        validation
+    };
 }
 function upsertTopLevelTomlBoolean(text, key, value) {
     const line = `${key} = ${value ? 'true' : 'false'}`;
@@ -2374,14 +2446,14 @@ export async function ensureGlobalCodexSkillsDuringInstall(opts = {}) {
         return { status: 'skipped', reason: 'home directory unavailable' };
     const root = globalCodexSkillsRoot(home);
     try {
-        const install = await installSkills(home);
+        const install = await installGlobalSkills(home);
         const skills = await checkRequiredSkills(home, root);
         return {
             status: skills.ok ? 'installed' : 'partial',
             root,
-            installed_count: install.installed_skills.length,
-            removed_aliases: install.removed_agent_skill_aliases,
-            removed_stale_generated_skills: install.removed_stale_generated_skills,
+            installed_count: install.installed.length,
+            removed_aliases: [],
+            removed_stale_generated_skills: install.removed,
             missing_skills: skills.missing
         };
     }
@@ -2407,6 +2479,28 @@ async function ensureGlobalGetdesignSkillDuringInstall() {
         return { status: 'present', command: skillsBin };
     return { status: 'failed', command: skillsBin, error: out.trim() || 'skills add failed' };
 }
+export async function ensureCodexImagegenDuringInstall(opts = {}) {
+    if (process.env.SKS_POSTINSTALL_SKIP_IMAGEGEN_REPAIR === '1' || opts.skip === true) {
+        return { status: 'skipped', reason: 'SKS_POSTINSTALL_SKIP_IMAGEGEN_REPAIR' };
+    }
+    const report = await repairCodexImagegen({
+        root: opts.root || process.cwd(),
+        apply: opts.apply !== false,
+        codexBin: opts.codexBin || null,
+        autoInstallCodex: opts.autoInstallCodex === true || process.env.SKS_IMAGEGEN_AUTO_INSTALL_CODEX === '1'
+    }).catch((err) => ({
+        recovered: false,
+        blockers: [err?.message || String(err)],
+        before: null,
+        after: null
+    }));
+    if (report.before?.core_ready === true || (report.after?.core_ready === true && report.attempted === false)) {
+        return { status: 'ready', report };
+    }
+    if (report.recovered === true)
+        return { status: 'recovered', report };
+    return { status: 'blocked', blockers: report.blockers || ['codex_imagegen_unavailable'], report };
+}
 export async function ensureRelatedCliTools(args = []) {
     const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
     const codex = await ensureCodexCliTool({ skip, args });
@@ -2685,7 +2779,13 @@ export async function ensureProjectContext7Config(root, transport = 'local') {
     }
     if (hasContext7ConfigText(current))
         return false;
-    await writeTextAtomic(configPath, `${current.trimEnd()}${current.trim() ? '\n\n' : ''}${block}\n`);
+    await writeCodexConfigGuarded({
+        root,
+        configPath,
+        before: current,
+        cause: 'context7-project-config',
+        mutate: () => `${current.trimEnd()}${current.trim() ? '\n\n' : ''}${block}\n`
+    });
     return true;
 }
 export async function checkRequiredSkills(root, skillRoot = root ? path.join(root, '.agents', 'skills') : globalCodexSkillsRoot()) {

package/dist/cli/router.js

@@ -1,6 +1,8 @@
 import { COMMAND_ALIASES, COMMANDS, } from './command-registry.js';
 import { detectGlobalMode, glmWithoutMadResult } from './global-mode-router.js';
 import { ensureCurrentMigrationBeforeCommand } from '../core/update/update-migration-state.js';
+import { projectRoot, readJson } from '../core/fsx.js';
+import { stateFile } from '../core/mission.js';
 export function isCommandName(value) {
     return Object.prototype.hasOwnProperty.call(COMMANDS, value);
 }
@@ -49,15 +51,29 @@ export async function dispatch(args) {
         return result;
     }
     const entry = COMMANDS[command];
-    const migrationGate = await ensureCurrentMigrationBeforeCommand({ command, args: rest });
+    const commandGate = await ensureActiveRouteCommandGate(command, rest);
+    if (!commandGate.ok) {
+        console.error(commandGate.message);
+        process.exitCode = 1;
+        return commandGate;
+    }
+    const migrationGate = await ensureCurrentMigrationBeforeCommand({
+        command,
+        args: rest,
+        skipMigrationGate: entry.skipMigrationGate === true || entry.readonly === true
+    });
     if (!migrationGate.ok) {
         console.error('SKS project migration blocked.');
+        console.error(`Scope: ${migrationGate.scope || 'project'}`);
+        console.error(`Stage: ${migrationGate.failed_stage_id || migrationGate.status}`);
+        if (migrationGate.failed_stage_id)
+            console.error(`Failed stage: ${migrationGate.failed_stage_id}`);
         for (const blocker of migrationGate.blockers)
             console.error(`Required blocker: ${blocker}`);
         for (const warning of migrationGate.warnings)
             console.error(`Optional warning: ${warning}`);
         console.error(`Receipt: ${migrationGate.receipt_path}`);
-        console.error('Run: sks doctor --fix --yes');
+        console.error('Remedies: run `sks doctor --fix --yes`, then retry; diagnostics that must bypass this gate are marked skipMigrationGate in the command registry.');
         process.exitCode = 1;
         return migrationGate;
     }
@@ -66,4 +82,44 @@ export async function dispatch(args) {
         throw new Error(`Command ${command} must export run(command, args)`);
     return mod.run(rawCommand || command, rest);
 }
+async function ensureActiveRouteCommandGate(command, args) {
+    const entry = COMMANDS[command];
+    if (command === 'route' || entry.readonly === true || entry.allowedDuringActiveRoute === true && entry.mutatesRouteState !== true) {
+        return { ok: true, status: 'allowed' };
+    }
+    if (entry.mutatesRouteState !== true)
+        return { ok: true, status: 'allowed' };
+    if (safeReadOnlySubcommand(args))
+        return { ok: true, status: 'allowed_status_subcommand' };
+    const root = await projectRoot(process.cwd()).catch(() => process.cwd());
+    const state = await readJson(stateFile(root), {}).catch(() => ({}));
+    if (!activeRouteStateBlocksCommand(state))
+        return { ok: true, status: 'allowed' };
+    return {
+        schema: 'sks.command-gate-active-route.v1',
+        ok: false,
+        status: 'blocked',
+        command,
+        active_mission_id: state.mission_id || null,
+        active_route: state.route || state.route_command || state.mode || null,
+        active_phase: state.phase || null,
+        message: `SKS command gate blocked '${command}' because active route mission ${state.mission_id} is not closed. Run: sks route close --mission ${state.mission_id}`
+    };
+}
+function safeReadOnlySubcommand(args) {
+    const sub = String(args.find((arg) => !String(arg).startsWith('-')) || '').toLowerCase();
+    if (!['status', 'show', 'list', 'observe', 'watch', 'doctor', 'help'].includes(sub))
+        return false;
+    return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
+}
+function activeRouteStateBlocksCommand(state = {}) {
+    if (!state?.mission_id || state.route_closed === true)
+        return false;
+    const mode = String(state.mode || '').toUpperCase();
+    if (!mode || ['WIKI', 'STATUS', 'HELP'].includes(mode))
+        return false;
+    if (/(?:DONE|COMPLETE|CLOSED|BLOCKED|FAILED)$/i.test(String(state.phase || '')))
+        return false;
+    return Boolean(state.route || state.route_command || ['NARUTO', 'AGENT', 'QALOOP', 'RESEARCH', 'LOOP', 'MADSKS', 'MADDB', 'GOAL'].includes(mode));
+}
 //# sourceMappingURL=router.js.map

package/dist/commands/codex-lb.js

@@ -73,6 +73,8 @@ export async function run(command, args = []) {
             codex_lb: status,
             chain,
             evidence,
+            degraded_models: Array.isArray(chain.degraded_models) ? chain.degraded_models : [],
+            quota_low: Boolean(chain.quota_low),
             blockers: [
                 ...(providerReady ? [] : ['codex_lb_provider_contract_drift']),
                 ...(chain.ok
@@ -443,8 +445,8 @@ function shapeCodexLbStatus(status = {}) {
         modes.push('durable_env_file');
     if (status.env_loader?.api_key?.source === 'keychain' || status.env_loader?.keychain?.status === 'present')
         modes.push('durable_keychain');
-    if (status.launch_environment?.status === 'synced')
-        modes.push('durable_launchctl');
+    if (status.launch_environment?.status === 'secret_env_present')
+        modes.push('process_only_ephemeral');
     if (!modes.length && status.env_loader?.api_key?.source === 'process.env')
         modes.push('process_only_ephemeral');
     const mode = modes[0] || 'none';
@@ -493,7 +495,7 @@ async function codexLbSetupOptions(args = []) {
         writeEnvFile = true;
     if (flag(args, '--no-keychain'))
         keychain = false;
-    let syncLaunchctl = flag(args, '--no-launchctl') ? false : true;
+    let syncLaunchctl = false;
     if (flag(args, '--launchctl'))
         syncLaunchctl = true;
     const shellProfile = normalizeShellProfile(readOption(args, '--shell-profile', 'skip'));
@@ -508,7 +510,7 @@ async function codexLbSetupOptions(args = []) {
         writeEnvFile = parseYesNo(await ask('4. Write shell env loader to ~/.codex/sks-codex-lb.env? [Y/n] '), true);
         const storeKeychain = (await ask('5. Store the key in macOS Keychain when available? [Y/n] ')).trim();
         keychain = !/^(n|no|아니|아니요|ㄴ)$/i.test(storeKeychain || 'y');
-        syncLaunchctl = parseYesNo(await ask('6. Sync macOS launchctl environment when available? [Y/n] '), true);
+        syncLaunchctl = parseYesNo(await ask('6. Sync non-secret macOS launchctl base URL only? API keys are never stored in launchd. [y/N] '), false);
         const profile = (await ask('7. Install shell profile snippet? [zsh/bash/fish/all/skip] ')).trim();
         const interactiveShellProfile = normalizeShellProfile(profile || 'skip');
         const runHealth = (await ask('8. Run health check now? [Y/n] ')).trim();