sneakoscope 6.0.2 → 6.1.0

package/dist/core/codex/codex-config-guard.js

@@ -64,6 +64,7 @@ export async function writeCodexConfigGuarded(input) {
         return result;
     }
     if (next === ensureTrailingNewline(before)) {
+        await writeTextAtomic(configPath, next, { mode: 0o600 });
         const result = { ok: true, status: 'present', config_path: configPath, backup_path: null, changed: false, repaired_keys: preserved.keys, forbidden_top_level: forbiddenTopLevel };
         if (preserved.keys.length || forbiddenTopLevel.length) {
             await recordCodexConfigGuard(root, input.reportPath, {
@@ -80,7 +81,7 @@ export async function writeCodexConfigGuarded(input) {
     }
     const backupPath = before.trim() ? await backupCodexConfig(configPath, before, input.backupTag || cause) : null;
     await ensureDir(path.dirname(configPath));
-    await writeTextAtomic(configPath, next);
+    await writeTextAtomic(configPath, next, { mode: 0o600 });
     const afterSnapshot = await snapshotForConfig(root, configPath).catch(() => null);
     const diff = beforeSnapshot && afterSnapshot ? diffCodexAppUiSnapshots(beforeSnapshot, afterSnapshot) : null;
     const result = {
@@ -161,15 +162,36 @@ export function removeLegacyTopLevelCodexModeLocks(text = '') {
             return true;
         if (!/^\s*(?:model|model_reasoning_effort)\s*=/.test(line))
             return true;
-        return !isSksProvenanceLine(line, lines[index - 1] || '');
+        return !hasSksModeLockProvenance(lines, index);
     }).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n'));
 }
-function isSksProvenanceLine(...lines) {
-    return lines.some((line) => {
-        const trimmed = String(line || '').trim();
-        const comment = trimmed.startsWith('#') ? trimmed : trimmed.includes('#') ? trimmed.slice(trimmed.indexOf('#')) : '';
-        return /(?:SKS|Sneakoscope|codex-lb|sks fast)/i.test(comment);
-    });
+function hasSksModeLockProvenance(lines, index) {
+    const current = String(lines[index] || '');
+    const inlineComment = current.includes('#') ? current.slice(current.indexOf('#')) : '';
+    if (isSksModeLockMarker(inlineComment))
+        return true;
+    const allowedManagedKeys = new Set([
+        'service_tier', 'model', 'model_reasoning_effort', 'model_provider',
+        'approval_policy', 'sandbox_mode', 'web_search', 'notify', 'preferred_auth_method'
+    ]);
+    const lowerBound = Math.max(0, index - 16);
+    for (let cursor = index - 1; cursor >= lowerBound; cursor -= 1) {
+        const candidate = String(lines[cursor] || '').trim();
+        if (!candidate)
+            continue;
+        if (candidate.startsWith('#')) {
+            if (isSksModeLockMarker(candidate))
+                return true;
+            continue;
+        }
+        const key = candidate.match(/^([A-Za-z0-9_-]+)\s*=/)?.[1] || '';
+        if (!allowedManagedKeys.has(key))
+            return false;
+    }
+    return false;
+}
+function isSksModeLockMarker(value = '') {
+    return /^#\s*(?:SKS|Sneakoscope)\b.*(?:moved machine-local Codex config|forced fast UI|managed (?:Codex )?(?:model|reasoning)|codex-lb (?:model|reasoning))/i.test(String(value || '').trim());
 }
 function mergeLostFastUiKeys(before, nextInput) {
     let next = String(nextInput || '');
@@ -301,7 +323,7 @@ async function snapshotForConfig(root, configPath) {
 async function backupCodexConfig(configPath, text, tag) {
     try {
         const backupPath = `${configPath}.sks-${tag}-${Date.now().toString(36)}.bak`;
-        await writeTextAtomic(backupPath, text);
+        await writeTextAtomic(backupPath, text, { mode: 0o600 });
         await cleanupCodexConfigBackups(configPath, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
         return backupPath;
     }

package/dist/core/codex-app/codex-app-fast-ui-repair.js

@@ -4,8 +4,12 @@ import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic }
 import { codexHome, scanProjectLocalForbiddenKeys, snapshotCodexAppUiState } from './codex-app-ui-state-snapshot.js';
 import { assertCodexAppUiMutationAllowed } from './codex-app-ui-clobber-guard.js';
 import { codexProviderModelUiStatus } from '../codex-app.js';
+import { cleanupCodexConfigBackups } from '../codex/codex-config-toml.js';
 export const CODEX_APP_FAST_UI_REPAIR_SCHEMA = 'sks.codex-app-fast-ui-repair.v1';
-const FAST_UI_TOP_LEVEL_RE = /^\s*(?:model|model_reasoning_effort|service_tier)\s*=/;
+// `service_tier = "fast"` is the current Codex Desktop default-selection
+// contract. Removing it would silently turn Fast mode off, not restore the
+// selector. Only legacy SKS model/effort pins lock the native picker.
+const FAST_UI_TOP_LEVEL_RE = /^\s*(?:model|model_reasoning_effort)\s*=/;
 const FAST_UI_FEATURE_LINE_RE = /^\s*fast_mode\s*=/;
 const FAST_UI_LEGACY_TABLES = new Set(['user.fast_mode', 'profiles.sks-fast-high']);
 const SKS_CAUSED_RE = /(?:SKS|Sneakoscope|codex-lb|sks-mad|sks fast)/i;
@@ -20,6 +24,7 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
     const actions = [];
     const detectedProjectLocalForbiddenKeys = [];
     const unsafeReasons = [];
+    let permissionsHardened = 0;
     let detectedSksCausedMutation = false;
     for (const candidate of candidates) {
         const text = await readText(candidate.file, null);
@@ -27,34 +32,39 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
             actions.push({ scope: candidate.scope, file: displayPath(candidate.file), status: 'missing', changed: false });
             continue;
         }
+        if (input.apply === true)
+            permissionsHardened += await hardenCodexConfigPermissions(candidate.file);
         const repaired = candidate.mode === 'project_forbidden_keys'
             ? stripProjectLocalForbiddenKeys(text)
             : stripSksCausedHostOwnedLines(text);
+        const candidateUnsafeReasons = detectUnsafeFastUiRepair(text);
+        unsafeReasons.push(...candidateUnsafeReasons);
         if (candidate.mode === 'project_forbidden_keys')
             detectedProjectLocalForbiddenKeys.push(...repaired.removedKeys);
         if (candidate.mode === 'sks_caused_host_owned_keys') {
-            const unsafe = detectUnsafeFastUiRepair(text);
-            unsafeReasons.push(...unsafe);
             if (repaired.text !== text)
                 detectedSksCausedMutation = true;
         }
         if (repaired.text === text) {
-            actions.push({ scope: candidate.scope, file: displayPath(candidate.file), status: unsafeReasons.length && candidate.mode === 'sks_caused_host_owned_keys' ? 'requires_confirmation' : 'ok', changed: false, removed_keys: repaired.removedKeys });
+            actions.push({ scope: candidate.scope, file: displayPath(candidate.file), status: candidateUnsafeReasons.length ? 'requires_confirmation' : 'ok', changed: false, removed_keys: repaired.removedKeys });
             continue;
         }
         const backupPath = `${candidate.file}.codex-app-ui-repair-${Date.now().toString(36)}.bak`;
-        if (input.apply) {
+        const applyAllowed = input.apply === true && (candidateUnsafeReasons.length === 0 || input.force === true);
+        if (applyAllowed) {
             await ensureDir(path.dirname(candidate.file));
-            await fs.writeFile(backupPath, text, 'utf8');
+            await fs.writeFile(backupPath, text, { encoding: 'utf8', mode: 0o600 });
+            await fs.chmod(backupPath, 0o600);
             assertCodexAppUiMutationAllowed({ kind: 'codex_app_ui_state', scope: 'codex-app-ui-repair', backupPath });
-            await writeTextAtomic(candidate.file, repaired.text);
+            await writeTextAtomic(candidate.file, repaired.text, { mode: 0o600 });
+            await cleanupCodexConfigBackups(candidate.file, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
         }
         actions.push({
             scope: candidate.scope,
             file: displayPath(candidate.file),
-            status: input.apply ? 'repaired' : 'planned',
+            status: applyAllowed ? 'repaired' : input.apply ? 'requires_confirmation' : 'planned',
             changed: true,
-            backup_path: input.apply ? displayPath(backupPath) : null,
+            backup_path: applyAllowed ? displayPath(backupPath) : null,
             before_hash: sha256(text),
             after_hash: sha256(repaired.text),
             removed_keys: repaired.removedKeys
@@ -63,17 +73,24 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
     const after = await snapshotCodexAppUiState(resolvedRoot, { codexHome: home });
     const providerModelUi = await codexProviderModelUiStatus({
         cwd: resolvedRoot,
+        env: input.env,
         home: path.dirname(home),
         configPath: path.join(home, 'config.toml'),
         codexLbEnvPath: path.join(home, 'sks-codex-lb.env')
     });
     const changed = actions.some((action) => action.changed);
+    const applied = actions.some((action) => action.status === 'repaired');
+    const pending = actions.some((action) => action.changed && action.status !== 'repaired');
     const requiresConfirmation = unsafeReasons.length > 0 && input.force !== true;
+    const selectedProviderBlockers = Array.isArray(providerModelUi.selected_provider_blockers)
+        ? providerModelUi.selected_provider_blockers
+        : [];
     const safeAutoApply = changed && !requiresConfirmation;
     const manual = changed && !input.apply;
     const blockers = [
         ...(requiresConfirmation ? ['codex_app_fast_ui_repair_requires_confirmation'] : []),
         ...(manual && !safeAutoApply ? ['codex_app_fast_ui_repair_requires_explicit_apply'] : []),
+        ...selectedProviderBlockers.map((blocker) => `selected_provider:${blocker}`),
         ...(after.indicators.secret_leak_suspected ? ['codex_app_ui_repair_secret_leak_suspected'] : [])
     ];
     const report = {
@@ -86,12 +103,15 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
         detected_sks_caused_mutation: detectedSksCausedMutation,
         detected_project_local_forbidden_keys: [...new Set(detectedProjectLocalForbiddenKeys)],
         unsafe_repair_reasons: [...new Set(unsafeReasons)],
-        fast_selector: changed ? (input.apply ? 'repaired' : 'manual_action_required') : before.indicators.fast_selector === 'maybe_hidden_or_locked' ? 'manual_action_required' : 'ok',
-        provider_selector: providerModelUi.ok ? 'ok' : 'manual_action_required',
+        permissions_hardened: permissionsHardened,
+        fast_selector: pending ? 'manual_action_required' : applied ? 'repaired' : before.indicators.fast_selector === 'maybe_hidden_or_locked' ? 'manual_action_required' : 'ok',
+        provider_selector: selectedProviderBlockers.length ? 'manual_action_required' : 'selected_provider_ready',
         provider_model_ui: providerModelUi,
         provider_actions: providerModelUi.ui_actions || [],
         provider_blockers: providerModelUi.blockers || [],
-        host_owned_config: input.apply && changed ? 'repaired_with_backup' : changed ? 'preserved_until_explicit_apply' : 'preserved',
+        selected_provider_blockers: selectedProviderBlockers,
+        optional_provider_blockers: providerModelUi.optional_provider_blockers || [],
+        host_owned_config: applied && !pending ? 'repaired_with_backup' : changed ? 'preserved_until_explicit_apply' : 'preserved',
         actions,
         before_fast_selector: before.indicators.fast_selector,
         after_fast_selector: after.indicators.fast_selector,
@@ -102,16 +122,27 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
         await writeJsonAtomic(input.reportPath, report);
     return report;
 }
+async function hardenCodexConfigPermissions(configFile) {
+    const dir = path.dirname(configFile);
+    const base = path.basename(configFile);
+    const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const targets = [configFile, ...entries
+            .filter((entry) => entry.isFile() && entry.name.startsWith(`${base}.`) && entry.name.endsWith('.bak'))
+            .map((entry) => path.join(dir, entry.name))];
+    let hardened = 0;
+    for (const target of targets) {
+        const stat = await fs.lstat(target).catch(() => null);
+        if (!stat?.isFile() || stat.isSymbolicLink())
+            continue;
+        if ((stat.mode & 0o777) !== 0o600) {
+            await fs.chmod(target, 0o600);
+            hardened += 1;
+        }
+    }
+    return hardened;
+}
 function detectUnsafeFastUiRepair(text) {
     const reasons = [];
-    const lines = text.split(/\r?\n/);
-    for (let i = 0; i < lines.length; i += 1) {
-        const line = lines[i] || '';
-        const serviceTier = line.match(/^\s*service_tier\s*=\s*"(standard|flex)"\s*(?:#.*)?$/i)?.[1];
-        const sksMarked = SKS_CAUSED_RE.test(line) || SKS_CAUSED_RE.test(lines[i - 1] || '') || SKS_CAUSED_RE.test(lines[i + 1] || '');
-        if (serviceTier && !sksMarked)
-            reasons.push(`user_selected_service_tier_${serviceTier.toLowerCase()}`);
-    }
     if (hasOddUnescapedQuotes(text))
         reasons.push('unparseable_config_requires_manual_review');
     return [...new Set(reasons)];

package/dist/core/codex-app/codex-app-restart.js

@@ -1,15 +1,16 @@
 import { exists, runProcess, which } from '../fsx.js';
 export async function restartCodexApp(opts = {}) {
     const env = opts.env || process.env;
-    const appName = String(opts.appName || env.SKS_CODEX_APP_NAME || 'Codex');
+    const appName = String(opts.appName || env.SKS_CODEX_APP_NAME || 'ChatGPT');
+    const bundleId = String(opts.bundleId || env.SKS_CODEX_APP_BUNDLE_ID || 'com.openai.codex');
     if (opts.enabled === false || env.SKS_SKIP_CODEX_APP_RESTART === '1') {
         return skipped(appName, 'disabled');
     }
-    if (process.platform !== 'darwin')
+    if ((opts.platform || process.platform) !== 'darwin')
         return skipped(appName, 'not_macos');
     const run = opts.runProcessImpl || runProcess;
-    const osascript = await which('osascript').catch(() => null) || await exists('/usr/bin/osascript').then((ok) => ok ? '/usr/bin/osascript' : null).catch(() => null);
-    const open = await which('open').catch(() => null) || await exists('/usr/bin/open').then((ok) => ok ? '/usr/bin/open' : null).catch(() => null);
+    const osascript = opts.osascriptPath || await which('osascript').catch(() => null) || await exists('/usr/bin/osascript').then((ok) => ok ? '/usr/bin/osascript' : null).catch(() => null);
+    const open = opts.openPath || await which('open').catch(() => null) || await exists('/usr/bin/open').then((ok) => ok ? '/usr/bin/open' : null).catch(() => null);
     if (!osascript || !open) {
         return {
             schema: 'sks.codex-app-restart.v1',
@@ -22,25 +23,54 @@ export async function restartCodexApp(opts = {}) {
             ]
         };
     }
-    const quit = await run(osascript, ['-e', `tell application ${JSON.stringify(appName)} to quit`], { timeoutMs: 5000, maxOutputBytes: 8192 }).catch((err) => ({
+    const appTarget = bundleId ? `application id ${JSON.stringify(bundleId)}` : `application ${JSON.stringify(appName)}`;
+    const quit = await run(osascript, ['-e', `tell ${appTarget} to quit`], { timeoutMs: 5000, maxOutputBytes: 8192 }).catch((err) => ({
         code: 1,
         stdout: '',
         stderr: err?.message || String(err)
     }));
-    await sleep(Number(opts.delayMs ?? env.SKS_CODEX_APP_RESTART_DELAY_MS ?? 1200));
-    const launched = await run(open, ['-a', appName], { timeoutMs: 10000, maxOutputBytes: 8192 }).catch((err) => ({
+    const quitOk = quit.code === 0 || /not running|Can't get application|application isn't running/i.test(String(quit.stderr || quit.stdout || ''));
+    const exitTimeoutMs = Math.max(250, Number(opts.exitTimeoutMs ?? env.SKS_CODEX_APP_EXIT_TIMEOUT_MS ?? 5000));
+    const pollMs = Math.max(50, Number(opts.pollMs ?? 100));
+    let exited = !quitOk;
+    let attempts = 0;
+    const deadline = Date.now() + exitTimeoutMs;
+    while (quitOk && Date.now() < deadline) {
+        attempts += 1;
+        const probe = await run(osascript, ['-e', `${appTarget} is running`], { timeoutMs: 1000, maxOutputBytes: 1024 }).catch(() => null);
+        if (probe?.code === 0 && String(probe.stdout || '').trim().toLowerCase() === 'false') {
+            exited = true;
+            break;
+        }
+        await sleep(pollMs);
+    }
+    if (quitOk && !exited) {
+        return {
+            schema: 'sks.codex-app-restart.v1',
+            ok: false,
+            status: 'blocked',
+            app_name: appName,
+            bundle_id: bundleId,
+            quit: { ok: true, code: quit.code, error: null },
+            exit_wait: { ok: false, attempts, error: 'codex_app_exit_timeout' },
+            blockers: ['codex_app_exit_timeout']
+        };
+    }
+    await sleep(Number(opts.delayMs ?? env.SKS_CODEX_APP_RESTART_DELAY_MS ?? 150));
+    const launched = await run(open, bundleId ? ['-b', bundleId] : ['-a', appName], { timeoutMs: 10000, maxOutputBytes: 8192 }).catch((err) => ({
         code: 1,
         stdout: '',
         stderr: err?.message || String(err)
     }));
-    const quitOk = quit.code === 0 || /not running|Can't get application|application isn't running/i.test(String(quit.stderr || quit.stdout || ''));
     const openOk = launched.code === 0;
     return {
         schema: 'sks.codex-app-restart.v1',
         ok: quitOk && openOk,
         status: quitOk && openOk ? 'restarted' : 'blocked',
         app_name: appName,
+        bundle_id: bundleId,
         quit: { ok: quitOk, code: quit.code, error: quitOk ? null : String(quit.stderr || quit.stdout || '').trim() },
+        exit_wait: { ok: exited, attempts, error: exited ? null : 'codex_app_exit_timeout' },
         open: { ok: openOk, code: launched.code, error: openOk ? null : String(launched.stderr || launched.stdout || '').trim() },
         blockers: [
             ...(quitOk ? [] : ['codex_app_quit_failed']),

package/dist/core/codex-app/codex-app-ui-state-snapshot.js

@@ -12,7 +12,7 @@ export const PROJECT_LOCAL_FORBIDDEN_CODEX_KEYS = [
     'otel'
 ];
 const HOST_OWNED_KEY_RE = /^(?:model|model_reasoning_effort|openai_base_url|chatgpt_base_url|apps_mcp_product_sku|model_provider|model_providers(?:\.|$)|notify|profile|profiles(?:\.|$)|experimental_realtime_ws_base_url|otel(?:\.|$)|features\.fast_mode|service_tier|user\.fast_mode(?:\.|$))/;
-const SECRET_KEY_RE = /(?:key|token|secret|password|credential|cookie|authorization|bearer|refresh|access)/i;
+const SECRET_KEY_RE = /(?:key|token|secret|password|credential|cookie|authorization|auth|bearer|refresh|access|headers?|env)/i;
 export function codexHome(input) {
     return path.resolve(String(input?.codexHome || process.env.CODEX_HOME || path.join(os.homedir(), '.codex')));
 }
@@ -41,8 +41,6 @@ export async function snapshotCodexAppUiState(root = process.cwd(), input = {})
             return true;
         if ((signal.key_path === 'model' || signal.key_path === 'model_reasoning_effort') && signal.sks_related)
             return true;
-        if (signal.key_path === 'service_tier' && signal.sks_related)
-            return true;
         return false;
     });
     return {
@@ -98,6 +96,9 @@ export function scanTomlSignals(text) {
     const tables = [];
     let table = null;
     const lines = text.split(/\r?\n/);
+    const firstTableIndex = lines.findIndex((line) => /^\s*\[/.test(line));
+    const topLevelLines = firstTableIndex === -1 ? lines : lines.slice(0, firstTableIndex);
+    const sksManagedTopLevel = topLevelLines.some((line) => /(?:SKS|Sneakoscope|codex-lb|sks fast)/i.test(line));
     lines.forEach((lineText, index) => {
         const tableMatch = lineText.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
         if (tableMatch?.[1]) {
@@ -124,6 +125,7 @@ export function scanTomlSignals(text) {
             fast_ui_related: /(?:fast_mode|service_tier|model_reasoning_effort|^model$)/i.test(keyPath) || /(?:fast|priority|default)/i.test(value),
             provider_related: /(?:provider|base_url|auth|profile|openai|chatgpt|codex-lb)/i.test(lowerPath),
             sks_related: /(?:sks|sneakoscope|codex-lb)/i.test(lineText)
+                || (table == null && sksManagedTopLevel && (key === 'model' || key === 'model_reasoning_effort'))
         });
     });
     return { signals, tables: [...new Set(tables)] };
@@ -252,7 +254,13 @@ function hostOwnedFingerprint(snapshot) {
 function redactValuePreview(keyPath, value) {
     if (SECRET_KEY_RE.test(keyPath))
         return '<redacted>';
+    if (/^\s*\{/.test(value))
+        return '<redacted-object>';
+    if (/^\s*\[/.test(value))
+        return '<redacted-array>';
     const normalized = value.replace(/^['"]|['"]$/g, '');
+    if (/^[a-z][a-z0-9+.-]*:\/\/[^/@\s]+@/i.test(normalized))
+        return '<redacted-url-credentials>';
     if (SECRET_KEY_RE.test(normalized))
         return '<redacted>';
     return normalized.length > 80 ? `${normalized.slice(0, 77)}...` : normalized;

package/dist/core/codex-app/sks-menubar.js

@@ -444,7 +444,7 @@ async function resolveCodexBundleId(input) {
 }
 export async function smokeSksMenuBarAction(actionScriptPath) {
     if (!(await exists(actionScriptPath)))
-        return { ok: false, code: null, output: null, versionDetected: false, executable: false };
+        return { ok: false, code: null, output: null, versionDetected: false, detectedVersion: null, executable: false };
     // The Swift app runs the script directly (which requires the executable bit), so the smoke
     // check must invoke it the same way. Running it via `/bin/zsh <script>` — as this check used
     // to — succeeds even when +x is missing, which let doctor/status report a healthy action
@@ -456,6 +456,7 @@ export async function smokeSksMenuBarAction(actionScriptPath) {
             code: null,
             output: 'action script is not executable (missing +x); the menu bar app cannot run it',
             versionDetected: false,
+            detectedVersion: null,
             executable: false
         };
     }
@@ -464,12 +465,14 @@ export async function smokeSksMenuBarAction(actionScriptPath) {
         maxOutputBytes: 16 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
     const output = String(`${result.stdout || ''}\n${result.stderr || ''}`).trim();
-    const versionDetected = /\b(?:sks|sneakoscope)?\s*v?\d+\.\d+\.\d+\b/i.test(output);
+    const detectedVersion = output.match(/\b(?:sks|sneakoscope)?\s*v?(\d+\.\d+\.\d+)\b/i)?.[1] || null;
+    const versionDetected = Boolean(detectedVersion);
     return {
         ok: result.code === 0 && versionDetected,
         code: result.code,
         output: output ? output.slice(0, 700) : null,
         versionDetected,
+        detectedVersion,
         executable: true
     };
 }
@@ -505,6 +508,10 @@ export async function inspectSksMenuBarStatus(opts = {}) {
         warning: config.codex_bundle_id ? null : 'codex_sync_disabled'
     };
     const buildStamp = await readJson(paths.build_stamp_path, null);
+    const actionIntegrity = evaluateActionScriptIntegrity(actionText, buildStamp);
+    const expectedActionVersion = buildStamp?.package_version || PACKAGE_VERSION;
+    const actionVersionMatchesExpected = actionSmoke.detectedVersion === expectedActionVersion
+        && actionSmoke.detectedVersion === PACKAGE_VERSION;
     const launchd = await inspectLaunchdService(opts.env);
     const signature = await inspectSignature(paths.app_path, opts.env);
     const blockers = [];
@@ -517,6 +524,12 @@ export async function inspectSksMenuBarStatus(opts = {}) {
         blockers.push('action_script_not_executable');
     if (installed && !actionSmoke.ok)
         blockers.push('action_script_smoke_failed');
+    if (installed && actionSmoke.ok && !actionVersionMatchesExpected)
+        blockers.push('action_target_version_mismatch');
+    if (installed && !buildStamp)
+        blockers.push('build_stamp_missing');
+    if (installed && buildStamp && !actionIntegrity.script_hash_matches_stamp)
+        blockers.push('action_script_hash_mismatch');
     if (installed && signature.checked && !signature.ok)
         warnings.push('codesign_identifier_unexpected');
     if (!codexSync.ok)
@@ -539,8 +552,12 @@ export async function inspectSksMenuBarStatus(opts = {}) {
             smoke_code: actionSmoke.code,
             smoke_output: actionSmoke.output,
             version_detected: actionSmoke.versionDetected,
+            detected_version: actionSmoke.detectedVersion,
+            expected_version: expectedActionVersion,
+            version_matches_expected: actionVersionMatchesExpected,
+            ...actionIntegrity,
             executable: actionSmoke.executable,
-            ok: actionSmoke.ok
+            ok: actionSmoke.ok && actionVersionMatchesExpected && actionIntegrity.script_hash_matches_stamp
         },
         codex_sync: codexSync,
         build_stamp: buildStamp,
@@ -551,6 +568,15 @@ export async function inspectSksMenuBarStatus(opts = {}) {
         next_actions: blockers.length || warnings.length ? defaultNextActions() : ['sks menubar status --json']
     };
 }
+export function evaluateActionScriptIntegrity(actionText, buildStamp) {
+    const scriptSha256 = actionText ? sha256(actionText) : null;
+    const expectedScriptSha256 = buildStamp?.action_script_sha256 || null;
+    return {
+        script_sha256: scriptSha256,
+        expected_script_sha256: expectedScriptSha256,
+        script_hash_matches_stamp: Boolean(scriptSha256 && expectedScriptSha256 && scriptSha256 === expectedScriptSha256)
+    };
+}
 export async function restartSksMenuBar(opts = {}) {
     const env = opts.env || process.env;
     const paths = sksMenuBarPaths(opts.home || env.HOME, opts.root);
@@ -757,6 +783,14 @@ run_node_entry() {
   exec "$node_bin" "$entry" "$@"
 }
 
+# The installer pins the entry that produced this menu build. Prefer it over
+# PATH/global copies so a newly updated 6.0.3 companion cannot execute stale
+# 6.0.2 auth/restart logic. Fall back only when the pinned file or Node runtime
+# is unavailable.
+if [ -f "$SKS_ENTRY" ]; then
+  run_node_entry "$SKS_ENTRY" "$@" || true
+fi
+
 SKS_BIN="$(/bin/zsh -lc 'command -v sks' 2>/dev/null | /usr/bin/head -n 1 || true)"
 if [ -n "$SKS_BIN" ] && [ -x "$SKS_BIN" ]; then
   exec "$SKS_BIN" "$@"
@@ -772,7 +806,6 @@ for entry in "$HOME"/.nvm/versions/node/*/lib/node_modules/sneakoscope/dist/bin/
     run_node_entry "$entry" "$@" || true
   fi
 done
-run_node_entry "$SKS_ENTRY" "$@" || true
 notify_sks_missing
 echo "SKS command not found. Run npm install -g sneakoscope or sks doctor --fix, then try again." >&2
 exit 127
@@ -1176,9 +1209,10 @@ ${codexLifecycleSource}
         let cachePath = NSString(string: "~/.sneakoscope/cache/update-notice.json").expandingTildeInPath
         guard let data = FileManager.default.contents(atPath: cachePath) else { return false }
         guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else { return false }
-        if let available = json["update_available"] as? Bool { return available }
-        guard let latest = json["latest_version"] as? String else { return false }
-        return latest != packageVersion && !latest.isEmpty
+        if let latest = json["latest_version"] as? String, !latest.isEmpty {
+            return latest.compare(packageVersion, options: .numeric) == .orderedDescending
+        }
+        return json["update_available"] as? Bool == true
     }
 
     func runSksCapture(_ args: [String], title: String, stdinText: String? = nil, notify: Bool = true, completion: ((Int32, String) -> Void)? = nil) {
@@ -1238,12 +1272,18 @@ ${codexLifecycleSource}
         runSksSilent(["codex-lb", "status", "--json"]) { [weak self] code, output in
             guard let self = self else { return }
             let json = parseJsonObject(output)
-            let selected = json?["selected"] as? Bool == true
-            let provider = (json?["model_provider"] as? String)?.lowercased() == "codex-lb"
-            let mode = (json?["mode"] as? String)?.lowercased() == "codex-lb"
-            let codexLbActive = code == 0 && (selected || provider || mode)
+            guard code == 0, let json = json else {
+                self.codexLbItem.state = .off
+                self.oauthItem.state = .off
+                return
+            }
+            let selected = json["selected"] as? Bool == true
+            let providerContract = json["provider_contract_ok"] as? Bool == true
+            let authMode = (json["auth_mode"] as? String)?.lowercased() ?? ""
+            let codexLbActive = selected && providerContract && authMode == "apikey"
+            let oauthActive = !selected && (authMode.contains("chatgpt") || authMode.contains("oauth") || authMode.contains("browser"))
             self.codexLbItem.state = codexLbActive ? .on : .off
-            self.oauthItem.state = codexLbActive ? .off : .on
+            self.oauthItem.state = oauthActive ? .on : .off
         }
     }
 
@@ -1251,22 +1291,32 @@ ${codexLifecycleSource}
         runSksSilent(["fast-mode", "status", "--json"]) { [weak self] code, output in
             guard let self = self else { return }
             let json = parseJsonObject(output)
-            let fastMode = json?["fast_mode"] as? Bool == true
-            let serviceTier = (json?["service_tier"] as? String)?.lowercased()
-            let fastActive = code == 0 && (fastMode || serviceTier == "fast" || serviceTier == "priority")
-            self.fastModeOnItem.state = fastActive ? .on : .off
-            self.fastModeOffItem.state = fastActive ? .off : .on
+            guard code == 0, let json = json else {
+                self.fastModeOnItem.state = .off
+                self.fastModeOffItem.state = .off
+                return
+            }
+            guard let global = json["global"] as? [String: Any], let desktopFast = global["on"] as? Bool else {
+                self.fastModeOnItem.state = .off
+                self.fastModeOffItem.state = .off
+                return
+            }
+            let fastMode = json["fast_mode"] as? Bool == true
+            let serviceTier = (json["service_tier"] as? String)?.lowercased()
+            let projectFast = fastMode || serviceTier == "fast" || serviceTier == "priority"
+            self.fastModeOnItem.state = projectFast && desktopFast ? .on : .off
+            self.fastModeOffItem.state = !projectFast && !desktopFast ? .on : .off
         }
     }
 
     @objc func useCodexLb() {
-        runSksBackground(["codex-lb", "use-codex-lb", "--json"], title: "Use codex-lb") { [weak self] code, _ in
+        runSksBackground(["codex-lb", "use-codex-lb", "--restart-app", "--json"], title: "Use codex-lb") { [weak self] code, _ in
             if code == 0 { self?.updateAuthModeChecks() }
         }
     }
 
     @objc func useChatGptOAuth() {
-        runSksBackground(["codex-lb", "use-oauth", "--json"], title: "Use ChatGPT OAuth") { [weak self] code, _ in
+        runSksBackground(["codex-lb", "use-oauth", "--restart-app", "--json"], title: "Use ChatGPT OAuth") { [weak self] code, _ in
             if code == 0 { self?.updateAuthModeChecks() }
         }
     }
@@ -1274,14 +1324,14 @@ ${codexLifecycleSource}
     @objc func setCodexLbDomainAndKey() {
         guard let domain = promptText(title: "Set codex-lb Domain", message: "Enter just your codex-lb domain or base URL — the /backend-api/codex path is added automatically.", placeholder: "lb.example.com") else { return }
         guard let key = promptText(title: "Set codex-lb Key", message: "Enter your codex-lb API key.", placeholder: "sk-clb-...", secure: true) else { return }
-        runSksBackground(["codex-lb", "setup", "--host", domain, "--api-key-stdin", "--yes", "--json"], title: "Set codex-lb", stdinText: key + "\\n") { [weak self] code, _ in
+        runSksBackground(["codex-lb", "setup", "--host", domain, "--api-key-stdin", "--yes", "--restart-app", "--json"], title: "Set codex-lb", stdinText: key + "\\n") { [weak self] code, _ in
             if code == 0 { self?.updateAuthModeChecks() }
         }
     }
 
     @objc func setOpenRouterKey() {
         guard let key = promptText(title: "Set OpenRouter Key", message: "Enter your OpenRouter API key.", placeholder: "sk-or-v1-...", secure: true) else { return }
-        runSksBackground(["codex-app", "set-openrouter-key", "--api-key-stdin", "--json"], title: "Set OpenRouter Key", stdinText: key + "\\n")
+        runSksBackground(["codex-app", "set-openrouter-key", "--api-key-stdin", "--restart-app", "--json"], title: "Set OpenRouter Key", stdinText: key + "\\n")
     }
 
     @objc func fastModeOn() {
@@ -1312,36 +1362,46 @@ ${codexLifecycleSource}
         let urlString = "http://127.0.0.1:4477"
         runProcess("/usr/bin/curl", ["-fsS", "--max-time", "1", urlString]) { [weak self] code, _ in
             DispatchQueue.main.async {
-                if code != 0 {
+                if code == 0 {
+                    if let url = URL(string: urlString) { NSWorkspace.shared.open(url) }
+                } else {
                     self?.startSksDetached(["ui"], title: "SKS Dashboard")
+                    self?.waitForDashboard(urlString, attempts: 20)
                 }
-                if let url = URL(string: urlString) {
-                    NSWorkspace.shared.open(url)
+            }
+        }
+    }
+
+    func waitForDashboard(_ urlString: String, attempts: Int) {
+        runProcess("/usr/bin/curl", ["-fsS", "--max-time", "1", urlString]) { [weak self] code, _ in
+            if code == 0 {
+                DispatchQueue.main.async {
+                    if let url = URL(string: urlString) { NSWorkspace.shared.open(url) }
+                }
+            } else if attempts > 1 {
+                DispatchQueue.global().asyncAfter(deadline: .now() + 0.25) {
+                    self?.waitForDashboard(urlString, attempts: attempts - 1)
+                }
+            } else {
+                DispatchQueue.main.async {
+                    showAlert("SKS Dashboard failed", informative: "Dashboard did not become ready at \(urlString). See View Last Log.")
                 }
             }
         }
     }
 
     @objc func openCodexSettings() {
-        runProcess("/usr/bin/open", ["codex://settings"])
+        runProcess("/usr/bin/open", ["codex://settings"]) { code, output in
+            if code != 0 {
+                DispatchQueue.main.async {
+                    showAlert("Open Codex Settings failed", informative: humanizeSksFailure(redactSecrets(output)))
+                }
+            }
+        }
     }
 
     @objc func restartCodex() {
-        let running = NSWorkspace.shared.runningApplications.filter { app in
-            if let bundle = codexBundleId, app.bundleIdentifier == bundle { return true }
-            return app.localizedName == "Codex"
-        }
-        for app in running {
-            app.terminate()
-        }
-        DispatchQueue.main.asyncAfter(deadline: .now() + 1.5) {
-            if let bundle = codexBundleId, let url = NSWorkspace.shared.urlForApplication(withBundleIdentifier: bundle) {
-                NSWorkspace.shared.open(url)
-                showNotification("Restart Codex", "requested")
-            } else {
-                showAlert("Restart Codex failed", informative: "Codex app bundle could not be resolved.")
-            }
-        }
+        runSksBackground(["codex-app", "restart", "--json"], title: "Restart Codex")
     }
 
     @objc func viewLastLog() {