sneakoscope 6.0.3 → 6.1.2

package/dist/core/codex-app/codex-app-launcher.js

@@ -1,10 +1,11 @@
 import { findCodexBinary } from '../codex-adapter.js';
 import { runProcess } from '../fsx.js';
+import { inspectCodexLbCliLaunchRecovery } from '../codex-control/codex-lb-launch-recovery.js';
 export async function attemptCodexAppLaunch(input) {
-    const platform = process.platform;
+    const platform = input.platform || process.platform;
     const timeoutMs = Math.max(1, Math.min(Number(input.timeoutMs || 3000), 3000));
-    const codexBin = input.codexBin || await findCodexBinary();
-    const commandLine = [codexBin || 'codex', '/app'];
+    let codexBin = input.codexBin || null;
+    let commandLine = [codexBin || 'codex', '/app'];
     if (input.mode === 'artifact-only') {
         return launchAttempt({
             attempted: false,
@@ -30,18 +31,6 @@ export async function attemptCodexAppLaunch(input) {
             blockers: ['codex_app_handoff_platform_unsupported']
         });
     }
-    if (!codexBin) {
-        return launchAttempt({
-            attempted: false,
-            launched: false,
-            platform,
-            mode: input.mode,
-            command_line: commandLine,
-            exit_code: null,
-            fallback_reason: 'codex_cli_missing_artifact_only_fallback',
-            blockers: ['codex_cli_missing']
-        });
-    }
     if (process.env.SKS_CODEX_APP_LAUNCH_FAKE === '1') {
         const launched = process.env.SKS_CODEX_APP_LAUNCH_FAKE_LAUNCHED !== '0';
         return launchAttempt({
@@ -57,8 +46,46 @@ export async function attemptCodexAppLaunch(input) {
             blockers: launched ? [] : ['codex_app_launch_failed']
         });
     }
-    const result = await runProcess(codexBin, ['/app'], {
+    const env = input.env || process.env;
+    const execute = input.runProcessImpl || runProcess;
+    const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery({
+        root: input.cwd,
+        env,
+        cliArgs: ['/app'],
+        ...(input.recoveryFetch ? { fetchImpl: input.recoveryFetch } : {}),
+        ...(input.recoveryTimeoutMs === undefined ? {} : { timeoutMs: input.recoveryTimeoutMs })
+    });
+    if (!toolOutputRecovery.ok) {
+        return launchAttempt({
+            attempted: false,
+            launched: false,
+            platform,
+            mode: input.mode,
+            command_line: commandLine,
+            exit_code: null,
+            fallback_reason: 'codex_lb_tool_output_recovery_blocked',
+            blockers: toolOutputRecovery.blockers,
+            tool_output_recovery: toolOutputRecovery
+        });
+    }
+    codexBin ||= await (input.findCodexBinaryImpl || findCodexBinary)();
+    commandLine = [codexBin || 'codex', '/app'];
+    if (!codexBin) {
+        return launchAttempt({
+            attempted: false,
+            launched: false,
+            platform,
+            mode: input.mode,
+            command_line: commandLine,
+            exit_code: null,
+            fallback_reason: 'codex_cli_missing_artifact_only_fallback',
+            blockers: ['codex_cli_missing'],
+            tool_output_recovery: toolOutputRecovery
+        });
+    }
+    const result = await execute(codexBin, ['/app'], {
         cwd: input.cwd,
+        env,
         timeoutMs,
         maxOutputBytes: 32 * 1024,
         input: `Continue the SKS mission using this prompt artifact:\n${input.promptArtifactPath}\n`
@@ -66,6 +93,9 @@ export async function attemptCodexAppLaunch(input) {
         code: -1,
         stdout: '',
         stderr: err instanceof Error ? err.message : String(err),
+        stdoutBytes: 0,
+        stderrBytes: 0,
+        truncated: false,
         timedOut: false
     }));
     const code = typeof result.code === 'number' ? result.code : null;
@@ -89,7 +119,8 @@ export async function attemptCodexAppLaunch(input) {
         stdout_tail: stdout.slice(-4000),
         stderr_tail: stderr.slice(-4000),
         fallback_reason: fallbackReason,
-        blockers: launched ? [] : [timedOut ? 'codex_app_launch_interactive_or_timeout' : 'codex_app_launch_failed']
+        blockers: launched ? [] : [timedOut ? 'codex_app_launch_interactive_or_timeout' : 'codex_app_launch_failed'],
+        tool_output_recovery: toolOutputRecovery
     });
 }
 function launchAttempt(input) {

package/dist/core/codex-app/codex-app-restart.js

@@ -1,4 +1,5 @@
 import { exists, runProcess, which } from '../fsx.js';
+import { inspectCodexLbCliLaunchRecovery } from '../codex-control/codex-lb-launch-recovery.js';
 export async function restartCodexApp(opts = {}) {
     const env = opts.env || process.env;
     const appName = String(opts.appName || env.SKS_CODEX_APP_NAME || 'ChatGPT');
@@ -23,6 +24,24 @@ export async function restartCodexApp(opts = {}) {
             ]
         };
     }
+    const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery({
+        root: opts.root || process.cwd(),
+        env,
+        cliArgs: ['/app'],
+        ...(opts.recoveryFetch ? { fetchImpl: opts.recoveryFetch } : {}),
+        ...(opts.recoveryTimeoutMs === undefined ? {} : { timeoutMs: opts.recoveryTimeoutMs })
+    });
+    if (!toolOutputRecovery.ok) {
+        return {
+            schema: 'sks.codex-app-restart.v1',
+            ok: false,
+            status: 'tool_output_recovery_blocked',
+            app_name: appName,
+            bundle_id: bundleId,
+            blockers: toolOutputRecovery.blockers,
+            tool_output_recovery: toolOutputRecovery
+        };
+    }
     const appTarget = bundleId ? `application id ${JSON.stringify(bundleId)}` : `application ${JSON.stringify(appName)}`;
     const quit = await run(osascript, ['-e', `tell ${appTarget} to quit`], { timeoutMs: 5000, maxOutputBytes: 8192 }).catch((err) => ({
         code: 1,
@@ -53,7 +72,8 @@ export async function restartCodexApp(opts = {}) {
             bundle_id: bundleId,
             quit: { ok: true, code: quit.code, error: null },
             exit_wait: { ok: false, attempts, error: 'codex_app_exit_timeout' },
-            blockers: ['codex_app_exit_timeout']
+            blockers: ['codex_app_exit_timeout'],
+            tool_output_recovery: toolOutputRecovery
         };
     }
     await sleep(Number(opts.delayMs ?? env.SKS_CODEX_APP_RESTART_DELAY_MS ?? 150));
@@ -75,7 +95,8 @@ export async function restartCodexApp(opts = {}) {
         blockers: [
             ...(quitOk ? [] : ['codex_app_quit_failed']),
             ...(openOk ? [] : ['codex_app_open_failed'])
-        ]
+        ],
+        tool_output_recovery: toolOutputRecovery
     };
 }
 function skipped(appName, reason) {

package/dist/core/codex-app/codex-app-ui-state-snapshot.js

@@ -12,7 +12,7 @@ export const PROJECT_LOCAL_FORBIDDEN_CODEX_KEYS = [
     'otel'
 ];
 const HOST_OWNED_KEY_RE = /^(?:model|model_reasoning_effort|openai_base_url|chatgpt_base_url|apps_mcp_product_sku|model_provider|model_providers(?:\.|$)|notify|profile|profiles(?:\.|$)|experimental_realtime_ws_base_url|otel(?:\.|$)|features\.fast_mode|service_tier|user\.fast_mode(?:\.|$))/;
-const SECRET_KEY_RE = /(?:key|token|secret|password|credential|cookie|authorization|bearer|refresh|access)/i;
+const SECRET_KEY_RE = /(?:key|token|secret|password|credential|cookie|authorization|auth|bearer|refresh|access|headers?|env)/i;
 export function codexHome(input) {
     return path.resolve(String(input?.codexHome || process.env.CODEX_HOME || path.join(os.homedir(), '.codex')));
 }
@@ -41,8 +41,6 @@ export async function snapshotCodexAppUiState(root = process.cwd(), input = {})
             return true;
         if ((signal.key_path === 'model' || signal.key_path === 'model_reasoning_effort') && signal.sks_related)
             return true;
-        if (signal.key_path === 'service_tier' && signal.sks_related)
-            return true;
         return false;
     });
     return {
@@ -98,6 +96,9 @@ export function scanTomlSignals(text) {
     const tables = [];
     let table = null;
     const lines = text.split(/\r?\n/);
+    const firstTableIndex = lines.findIndex((line) => /^\s*\[/.test(line));
+    const topLevelLines = firstTableIndex === -1 ? lines : lines.slice(0, firstTableIndex);
+    const sksManagedTopLevel = topLevelLines.some((line) => /(?:SKS|Sneakoscope|codex-lb|sks fast)/i.test(line));
     lines.forEach((lineText, index) => {
         const tableMatch = lineText.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
         if (tableMatch?.[1]) {
@@ -124,6 +125,7 @@ export function scanTomlSignals(text) {
             fast_ui_related: /(?:fast_mode|service_tier|model_reasoning_effort|^model$)/i.test(keyPath) || /(?:fast|priority|default)/i.test(value),
             provider_related: /(?:provider|base_url|auth|profile|openai|chatgpt|codex-lb)/i.test(lowerPath),
             sks_related: /(?:sks|sneakoscope|codex-lb)/i.test(lineText)
+                || (table == null && sksManagedTopLevel && (key === 'model' || key === 'model_reasoning_effort'))
         });
     });
     return { signals, tables: [...new Set(tables)] };
@@ -252,7 +254,13 @@ function hostOwnedFingerprint(snapshot) {
 function redactValuePreview(keyPath, value) {
     if (SECRET_KEY_RE.test(keyPath))
         return '<redacted>';
+    if (/^\s*\{/.test(value))
+        return '<redacted-object>';
+    if (/^\s*\[/.test(value))
+        return '<redacted-array>';
     const normalized = value.replace(/^['"]|['"]$/g, '');
+    if (/^[a-z][a-z0-9+.-]*:\/\/[^/@\s]+@/i.test(normalized))
+        return '<redacted-url-credentials>';
     if (SECRET_KEY_RE.test(normalized))
         return '<redacted>';
     return normalized.length > 80 ? `${normalized.slice(0, 77)}...` : normalized;

package/dist/core/codex-app/sks-menubar.js

@@ -20,6 +20,9 @@ const MENU_ITEMS = [
     'Fast Check',
     'SKS Version Check',
     'Update SKS Now',
+    'Codex CLI Version',
+    'Update Codex CLI Now',
+    'Run sks doctor --fix',
     'Open Dashboard',
     'Open Codex Settings',
     'Restart Codex',
@@ -754,13 +757,22 @@ resolve_node_bin() {
     printf '%s\\n' "$NODE_BIN"
     return 0
   fi
+  # launchd does not initialize NVM, and a login shell can resolve a different
+  # global Node before the menu owner's current NVM install. Prefer the
+  # HOME-scoped runtime; run_node_entry prepends its bin directory to PATH.
+  for cand in "$HOME"/.nvm/versions/node/*/bin/node(Nn[-1]); do
+    if [ -x "$cand" ]; then
+      printf '%s\\n' "$cand"
+      return 0
+    fi
+  done
   local login_node
   login_node="$(/bin/zsh -lc 'command -v node' 2>/dev/null | /usr/bin/head -n 1 || true)"
   if [ -n "$login_node" ] && [ -x "$login_node" ]; then
     printf '%s\\n' "$login_node"
     return 0
   fi
-  for cand in "$HOME"/.nvm/versions/node/*/bin/node(Nn[-1]) /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
+  for cand in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
     if [ -x "$cand" ]; then
       printf '%s\\n' "$cand"
       return 0
@@ -780,6 +792,11 @@ run_node_entry() {
   if [ -z "$node_bin" ]; then
     return 1
   fi
+  local node_bin_dir
+  node_bin_dir="$(/usr/bin/dirname "$node_bin")"
+  if [ -d "$node_bin_dir" ]; then
+    export PATH="$node_bin_dir:$PATH"
+  fi
   exec "$node_bin" "$entry" "$@"
 }
 
@@ -1093,10 +1110,18 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     var oauthItem: NSMenuItem!
     var fastModeOnItem: NSMenuItem!
     var fastModeOffItem: NSMenuItem!
+    var codexCliVersionItem: NSMenuItem!
+    var codexCliUpdateItem: NSMenuItem!
     var timer: Timer?
     var busy = false
     var lastFailure = false
     var quitWithCodex = false
+    var codexCliCurrentVersion: String?
+    var codexCliLatestVersion: String?
+    var codexCliUpdateAvailable = false
+    var codexCliMissing = false
+    var codexCliStatusUnavailable = false
+    var codexCliStatusRequestGeneration = 0
 
     func applicationDidFinishLaunching(_ notification: Notification) {
         NSApp.setActivationPolicy(.accessory)
@@ -1124,6 +1149,12 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         add(menu, "SKS Version Check", #selector(sksVersionCheck))
         add(menu, "Update SKS Now", #selector(updateSksNow))
         menu.addItem(NSMenuItem.separator())
+        codexCliVersionItem = NSMenuItem(title: "Codex CLI: checking…", action: nil, keyEquivalent: "")
+        codexCliVersionItem.isEnabled = false
+        menu.addItem(codexCliVersionItem)
+        codexCliUpdateItem = add(menu, "Update Codex CLI Now", #selector(updateCodexCliNow))
+        add(menu, "Run sks doctor --fix", #selector(runDoctorFix))
+        menu.addItem(NSMenuItem.separator())
         add(menu, "Open Dashboard", #selector(openDashboard))
         add(menu, "Open Codex Settings", #selector(openCodexSettings))
         add(menu, "Restart Codex", #selector(restartCodex))
@@ -1133,6 +1164,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         statusItem.menu = menu
         configureCodexLifecycleSync()
         updateState()
+        updateCodexCliStatus()
         timer = Timer.scheduledTimer(withTimeInterval: 30.0, repeats: true) { [weak self] _ in self?.updateState() }
     }
 
@@ -1140,6 +1172,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         updateState()
         updateAuthModeChecks()
         updateFastModeChecks()
+        updateCodexCliStatus()
     }
 
     func configureStatusButton(_ button: NSStatusBarButton, title: String) {
@@ -1195,10 +1228,23 @@ ${codexLifecycleSource}
         if lastFailure {
             return MenuState(title: "SKS ⚠", line: "SKS v\\(packageVersion) - last action failed")
         }
+        if codexCliMissing {
+            return MenuState(title: "SKS ⚠", line: "SKS v\\(packageVersion) · Codex CLI not installed")
+        }
+        if codexCliStatusUnavailable {
+            let current = codexCliCurrentVersion.map { " " + $0 } ?? ""
+            return MenuState(title: "SKS ⚠", line: "SKS v\\(packageVersion) · Codex CLI\\(current) status unavailable")
+        }
+        if codexCliUpdateAvailable {
+            let current = codexCliCurrentVersion ?? "unknown"
+            let latest = codexCliLatestVersion ?? "latest"
+            return MenuState(title: "SKS ⬆", line: "SKS v\\(packageVersion) · Codex CLI \\(current) → \\(latest) update available")
+        }
         if updateAvailable() {
             return MenuState(title: "SKS ↑", line: "SKS v\\(packageVersion) - update available")
         }
-        return MenuState(title: "SKS", line: "SKS v\\(packageVersion) - OK")
+        let codexVersion = codexCliCurrentVersion.map { " · Codex CLI " + $0 } ?? ""
+        return MenuState(title: "SKS", line: "SKS v\\(packageVersion)\\(codexVersion) · OK")
     }
 
     func actionScriptUsable() -> Bool {
@@ -1296,14 +1342,83 @@ ${codexLifecycleSource}
                 self.fastModeOffItem.state = .off
                 return
             }
+            guard let global = json["global"] as? [String: Any], let desktopFast = global["on"] as? Bool else {
+                self.fastModeOnItem.state = .off
+                self.fastModeOffItem.state = .off
+                return
+            }
             let fastMode = json["fast_mode"] as? Bool == true
             let serviceTier = (json["service_tier"] as? String)?.lowercased()
-            let fastActive = code == 0 && (fastMode || serviceTier == "fast" || serviceTier == "priority")
-            self.fastModeOnItem.state = fastActive ? .on : .off
-            self.fastModeOffItem.state = fastActive ? .off : .on
+            let projectFast = fastMode || serviceTier == "fast" || serviceTier == "priority"
+            self.fastModeOnItem.state = projectFast && desktopFast ? .on : .off
+            self.fastModeOffItem.state = !projectFast && !desktopFast ? .on : .off
         }
     }
 
+    func updateCodexCliStatus(refresh: Bool = false) {
+        codexCliStatusRequestGeneration += 1
+        let requestGeneration = codexCliStatusRequestGeneration
+        var args = ["codex", "update-status", "--json"]
+        if refresh { args.append("--refresh") }
+        runSksSilent(args) { [weak self] code, output in
+            guard let self = self else { return }
+            guard self.codexCliStatusRequestGeneration == requestGeneration else { return }
+            guard let json = parseJsonObject(output),
+                  json["schema"] as? String == "sks.codex-cli-update-status.v1",
+                  let ok = json["ok"] as? Bool,
+                  let installed = json["installed"] as? Bool,
+                  let status = json["status"] as? String,
+                  ["current", "update_available", "missing", "update_check_unavailable"].contains(status),
+                  code == 0 || (!ok && !installed && status == "missing") else {
+                self.markCodexCliStatusUnavailable()
+                return
+            }
+            let current = json["current_version"] as? String
+            let latest = json["latest_version"] as? String
+            let reportedUpdateAvailable = json["update_available"] as? Bool
+            let trusted = status == "missing"
+                ? !ok && !installed && current == nil
+                : ok && installed && current != nil
+                    && (status == "update_check_unavailable"
+                        || (status == "update_available" && reportedUpdateAvailable == true)
+                        || (status == "current" && reportedUpdateAvailable == false))
+            guard trusted else {
+                self.markCodexCliStatusUnavailable()
+                return
+            }
+            let updateAvailable = reportedUpdateAvailable == true
+            self.codexCliCurrentVersion = current
+            self.codexCliLatestVersion = latest
+            self.codexCliUpdateAvailable = updateAvailable
+            self.codexCliMissing = !installed
+            self.codexCliStatusUnavailable = status == "update_check_unavailable"
+            if !installed {
+                self.codexCliVersionItem.title = "Codex CLI: not installed"
+            } else if status == "update_check_unavailable" {
+                self.codexCliVersionItem.title = "Codex CLI: \\(current ?? "unknown") (update check unavailable)"
+            } else if updateAvailable {
+                self.codexCliVersionItem.title = "Codex CLI: \\(current ?? "unknown") → \\(latest ?? "latest")  ⬆"
+            } else if let current = current, let latest = latest {
+                self.codexCliVersionItem.title = current == latest ? "Codex CLI: \\(current) (current)" : "Codex CLI: \\(current) · latest \\(latest)"
+            } else {
+                self.codexCliVersionItem.title = "Codex CLI: \\(current ?? "unknown") (latest check unavailable)"
+            }
+            self.codexCliUpdateItem.title = updateAvailable ? "Update Codex CLI Now  ⬆" : "Update Codex CLI Now"
+            self.updateState()
+        }
+    }
+
+    func markCodexCliStatusUnavailable() {
+        codexCliVersionItem.title = "Codex CLI: status unavailable"
+        codexCliUpdateItem.title = "Update Codex CLI Now"
+        codexCliCurrentVersion = nil
+        codexCliLatestVersion = nil
+        codexCliUpdateAvailable = false
+        codexCliMissing = false
+        codexCliStatusUnavailable = true
+        updateState()
+    }
+
     @objc func useCodexLb() {
         runSksBackground(["codex-lb", "use-codex-lb", "--restart-app", "--json"], title: "Use codex-lb") { [weak self] code, _ in
             if code == 0 { self?.updateAuthModeChecks() }
@@ -1353,6 +1468,22 @@ ${codexLifecycleSource}
         runSksBackground(["update"], title: "Update SKS Now")
     }
 
+    @objc func updateCodexCliNow() {
+        runSksBackground(["codex", "update", "--json"], title: "Update Codex CLI Now") { [weak self] _, _ in
+            self?.updateCodexCliStatus(refresh: true)
+        }
+    }
+
+    @objc func runDoctorFix() {
+        runSksBackground(["doctor", "--fix", "--global-only", "--json"], title: "Run sks doctor --fix") { [weak self] code, _ in
+            if code == 0 {
+                self?.updateAuthModeChecks()
+                self?.updateFastModeChecks()
+                self?.updateCodexCliStatus(refresh: true)
+            }
+        }
+    }
+
     @objc func openDashboard() {
         let urlString = "http://127.0.0.1:4477"
         runProcess("/usr/bin/curl", ["-fsS", "--max-time", "1", urlString]) { [weak self] code, _ in

package/dist/core/codex-app.js

@@ -10,6 +10,7 @@ import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } fro
 import { GLM_52_OPENROUTER_MODEL } from './providers/glm/glm-52-settings.js';
 import { resolveOpenRouterApiKey } from './providers/openrouter/openrouter-secret-store.js';
 import { codexLbEnvPath, loadCodexLbEnv, parseShellEnvValue, readCodexLbModelCatalog } from './codex-lb/codex-lb-env.js';
+import { redactString } from './secret-redaction.js';
 export const CODEX_APP_DOCS_URL = 'https://developers.openai.com/codex/app/features';
 export const CODEX_CHANGELOG_URL = 'https://developers.openai.com/codex/changelog';
 export const CODEX_ACCESS_TOKENS_DOCS_URL = 'https://developers.openai.com/codex/enterprise/access-tokens';
@@ -98,30 +99,32 @@ export async function codexMcpList(opts = {}) {
     const codex = opts.codex || await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
     if (!codex.bin)
         return { ok: false, checked: false, stdout: '', stderr: 'Codex CLI missing.' };
-    const out = await runProcess(codex.bin, ['mcp', 'list'], {
+    const execute = opts.runProcess || runProcess;
+    const out = await execute(codex.bin, ['mcp', 'list'], {
         timeoutMs: opts.timeoutMs || 10000,
         maxOutputBytes: 64 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
     return {
         ok: out.code === 0,
         checked: true,
-        stdout: out.stdout || '',
-        stderr: out.stderr || ''
+        stdout: redactString(out.stdout || ''),
+        stderr: redactString(out.stderr || '')
     };
 }
 export async function codexFeatureList(opts = {}) {
     const codex = opts.codex || await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
     if (!codex.bin)
         return { ok: false, checked: false, stdout: '', stderr: 'Codex CLI missing.' };
-    const out = await runProcess(codex.bin, ['features', 'list'], {
+    const execute = opts.runProcess || runProcess;
+    const out = await execute(codex.bin, ['features', 'list'], {
         timeoutMs: opts.timeoutMs || 10000,
         maxOutputBytes: 64 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
     return {
         ok: out.code === 0,
         checked: true,
-        stdout: out.stdout || '',
-        stderr: out.stderr || ''
+        stdout: redactString(out.stdout || ''),
+        stderr: redactString(out.stderr || '')
     };
 }
 export async function codexAppIntegrationStatus(opts = {}) {
@@ -163,7 +166,8 @@ export async function codexAppIntegrationStatus(opts = {}) {
     });
     const pluginPickerReady = requiredFeatureFlags.tool_suggest && requiredFeatureFlags.plugins && requiredFeatureFlags.apps && defaultPlugins.ok && pluginSkillShadows.ok && fastModeConfig.ok;
     const gitActions = codexGitActionReadiness({ requiredFeatureFlags, remoteControl });
-    const ready = appInstalled && Boolean(codex.bin) && mcpList.ok && featureList.ok && requiredFeatureFlagsOk && pluginPickerReady && fastModeConfig.ok && imageGenerationReady && gitActions.ok && computerUseReady && browserToolReady && chromeExtension.ok;
+    const selectedProviderReady = providerModelUi.selected_provider_ok !== false;
+    const ready = appInstalled && Boolean(codex.bin) && mcpList.ok && featureList.ok && requiredFeatureFlagsOk && pluginPickerReady && fastModeConfig.ok && selectedProviderReady && imageGenerationReady && gitActions.ok && computerUseReady && browserToolReady && chromeExtension.ok;
     return {
         ok: ready,
         app: {
@@ -196,6 +200,7 @@ export async function codexAppIntegrationStatus(opts = {}) {
             required_flags_ok: requiredFeatureFlagsOk,
             fast_mode_config: fastModeConfig,
             provider_model_ui: providerModelUi,
+            selected_provider_ready: selectedProviderReady,
             git_actions: gitActions,
             image_generation: imageGenerationReady,
             image_generation_source: imageGenerationReady ? 'codex_features_list' : 'missing',
@@ -963,18 +968,29 @@ export async function codexProviderModelUiStatus(opts = {}) {
             ? ['codex_lb_gpt_5_6_catalog_unverified']
             : [])
     ];
-    const blockers = [...glmBlockers, ...codexLbBlockers];
+    const selectedProviderBlockers = codexLbSelectedDefault ? codexLbBlockers : [];
+    const optionalProviderBlockers = codexLbSelectedDefault
+        ? glmBlockers
+        : [...glmBlockers, ...codexLbBlockers];
     const keyCommand = 'sks codex-app set-openrouter-key --api-key-stdin';
     const installCommand = 'sks codex-app glm-profile install';
     const setupCommand = 'sks codex-lb setup --host <domain> --api-key-stdin --yes';
     const setKeyCommand = 'sks codex-lb set-key --api-key-stdin';
     return {
         schema: 'sks.codex-app-provider-model-ui.v1',
-        ok: blockers.length === 0,
+        // The top-level readiness contract is intentionally scoped to the active
+        // provider. Optional GLM/OpenRouter and codex-lb setup diagnostics remain
+        // visible below without making an unrelated provider selection fail.
+        ok: selectedProviderBlockers.length === 0,
+        selected_provider_ok: selectedProviderBlockers.length === 0,
+        selected_provider: codexLbSelectedDefault ? 'codex-lb' : 'oauth',
+        selected_provider_blockers: selectedProviderBlockers,
+        optional_provider_blockers: optionalProviderBlockers,
         checked: true,
         verification_scope: 'config_and_provider_catalog',
         desktop_picker_verified: false,
-        status: blockers.length === 0 ? 'ready' : 'setup_required',
+        status: selectedProviderBlockers.length === 0 ? 'ready' : 'setup_required',
+        optional_provider_status: optionalProviderBlockers.length === 0 ? 'ready' : 'setup_available',
         config_paths: {
             codex_config: globalConfigPath,
             project_config: projectConfig ? projectConfigPath : null,
@@ -1022,7 +1038,7 @@ export async function codexProviderModelUiStatus(opts = {}) {
             setKeyCommand,
             'sks codex-app status'
         ],
-        blockers
+        blockers: selectedProviderBlockers
     };
 }
 async function readTextIfExists(file) {
@@ -1087,9 +1103,14 @@ function productDesignStatusSummary(status = {}) {
 function providerModelUiSummary(status = {}) {
     if (!status?.checked)
         return ' not checked';
-    if (status.ok)
-        return ' config/catalog ready (live picker reload required)';
-    return ` setup ${(status.blockers || []).join(', ') || 'required'}`;
+    const selected = status.selected_provider || 'oauth';
+    if (status.ok) {
+        const optionalSetup = (status.optional_provider_blockers || []).length > 0
+            ? ', optional providers can be configured'
+            : '';
+        return ` ${selected} ready${optionalSetup} (live picker reload required)`;
+    }
+    return ` ${selected} setup ${(status.selected_provider_blockers || status.blockers || []).join(', ') || 'required'}`;
 }
 function sksNativeMenuSummary(status = {}) {
     if (!status)

package/dist/core/codex-compat/codex-hook-warning-detector.js

@@ -15,7 +15,8 @@ export async function detectCodexHookOutputWarnings(eventLike, output) {
     const issues = [
         ...validation.structured_issues,
         ...semantic.issues,
-        ...snakeCaseKeyIssues(output)
+        ...snakeCaseKeyIssues(output),
+        ...unknownTopLevelKeyIssues(output)
     ];
     for (const key of LEGACY_TOP_LEVEL_KEYS) {
         if (output && typeof output === 'object' && Object.prototype.hasOwnProperty.call(output, key)) {
@@ -52,6 +53,14 @@ export async function detectCodexHookOutputWarnings(eventLike, output) {
         warnings: [...new Set(warnings)]
     };
 }
+function unknownTopLevelKeyIssues(output) {
+    if (!output || typeof output !== 'object' || Array.isArray(output))
+        return [];
+    const allowed = new Set(['continue', 'decision', 'reason', 'hookSpecificOutput']);
+    return Object.keys(output)
+        .filter((key) => !allowed.has(key))
+        .map((key) => makeCodexHookIssue('policy_disallowed', `unknown_field_${key}`, `Unknown top-level hook field is not accepted by the SKS zero-warning contract: ${key}.`, { path: `$.${key}`, upstream_supported: false, sks_disallowed: true }));
+}
 export async function codexHookWarningCheck(root, opts = {}) {
     root ||= await projectRoot();
     const fixtureValidation = await validateCodexFixtureOutputs(root);

package/dist/core/codex-compat/codex-release-manifest.js

@@ -3,13 +3,13 @@ import { packageRoot, readJson, readText, sha256 } from '../fsx.js';
 export const CODEX_RELEASE_MANIFEST_SCHEMA = 'sks.codex-release-manifest.v1';
 export const CURRENT_CODEX_RELEASE_MANIFEST = {
     schema: CODEX_RELEASE_MANIFEST_SCHEMA,
-    targetTag: 'rust-v0.142.0',
-    requiredCliVersion: '0.142.0',
-    sdkVersion: '0.142.0',
-    minimumSupportedVersion: '0.142.0',
+    targetTag: 'rust-v0.144.1',
+    requiredCliVersion: '0.144.1',
+    sdkVersion: '0.144.1',
+    minimumSupportedVersion: '0.144.1',
     protocolMode: 'app-server-v2',
-    generatedSchemaSha256: 'fc3c48943de51865e81c8320876fd5310e9d96bd066fc63b74616d26c0e6dd12',
-    upstreamCommit: 'rust-v0.142.0',
+    generatedSchemaSha256: '2b3f14fa2e728f77a16385ff39f3a1d85ab255c1020498a85c1c0fb24f3d2f3c',
+    upstreamCommit: 'rust-v0.144.1',
     featurePolicies: {
         multiAgentMode: 'probe',
         indexedWebSearch: 'probe',

package/dist/core/codex-control/codex-0139-doctor-real-probe.js

@@ -10,8 +10,13 @@ export async function runCodex0139DoctorEnvRealProbe(input) {
         return skippedCodex0139Probe('codex_cli_missing');
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `doctor-${Date.now()}`);
     await ensureDir(tempDir);
+    const isolatedHome = path.join(tempDir, 'home');
+    const isolatedCodexHome = path.join(isolatedHome, '.codex');
+    await ensureDir(isolatedCodexHome);
     const env = {
         ...process.env,
+        HOME: isolatedHome,
+        CODEX_HOME: isolatedCodexHome,
         EDITOR: 'vim',
         PAGER: 'less',
         TERM: 'xterm-256color',
@@ -48,7 +53,8 @@ export async function runCodex0139DoctorEnvRealProbe(input) {
             redacted_marker_or_omitted: redactedMarkerOrOmitted,
             redacted_sample_contains_secret: redactedText.includes('sk-test-secret-value') || redactedText.includes('test-secret-token'),
             process_exited_successfully: processExitedSuccessfully,
-            process_warning: processExitedSuccessfully ? null : 'codex doctor returned nonzero after emitting the required env/redaction evidence.'
+            process_warning: processExitedSuccessfully ? null : 'codex doctor returned nonzero after emitting the scoped env/redaction evidence.',
+            isolated_codex_home: true
         },
         blockers: ok ? [] : ['codex_doctor_env_redaction_real_probe_failed']
     };