sneakoscope 6.0.3 → 6.1.2

package/dist/cli/install-helpers.js

@@ -16,25 +16,21 @@ import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
 import { cleanupMacLaunchSecretEnvironment } from '../core/codex-app/sks-menubar.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
 import { loadCodexLbEnv, writeCodexLbKeychain, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
+import { codexLbToolCatalogPath, ensureCodexLbToolCatalog } from '../core/codex-lb/codex-lb-tool-catalog.js';
+import { codexLbToolOutputRecoveryNotChecked, codexLbToolOutputRecoveryNotSelected, codexLbToolOutputRecoveryOverrideAcknowledged, probeCodexLbToolOutputRecovery } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
 import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from '../core/providers/glm/glm-52-profile.js';
 import { GLM_52_OPENROUTER_MODEL } from '../core/providers/glm/glm-52-settings.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellProfileSnippet, selectedCodexLbPersistenceModes } from '../core/codex-lb/codex-lb-setup.js';
 import { extractTomlTable, writeCodexConfigGuarded } from '../core/codex/codex-config-guard.js';
-import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
+import { ensureGlobalCodexFastModeDuringInstall, ensureTrailingNewline, normalizeCodexFastModeUiConfig, removeTopLevelTomlKeyIfValue, safeWriteCodexConfigToml, upsertTopLevelTomlString, upsertTomlTable } from '../core/codex-runtime/codex-desktop-config-policy.js';
 import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
 import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
+import { canAskYesNo, compareVersions, hasCodexUnstableFeatureWarningSuppression, hasDeprecatedCodexHooksFeatureFlag, hasTopLevelCodexModeLock, isProjectSetupCandidate } from './install-tool-helpers.js';
+export { checkContext7, ensureCodexCliTool, ensureMadLaunchDependencies, ensureRelatedCliTools, ensureZellijCliTool, formatMadLaunchDependencyAction, maybePromptCodexUpdateForLaunch, maybePromptSksUpdateForLaunch, shouldAutoApproveInstall } from './install-tool-helpers.js';
+export { codexFastModeDesktopStatus, ensureGlobalCodexFastModeDuringInstall, normalizeCodexFastModeUiConfig, safeWriteCodexConfigToml } from '../core/codex-runtime/codex-desktop-config-policy.js';
 const CODEX_LB_PROVIDER_NAME = 'openai';
 const CODEX_LB_PROVIDER_ENV_KEY = 'CODEX_LB_API_KEY';
 const CODEX_LB_CANONICAL_FAST_SERVICE_TIER = 'priority';
-const DEFAULT_CODEX_APP_PLUGINS = [
-    ['browser', 'openai-bundled'],
-    ['chrome', 'openai-bundled'],
-    ['computer-use', 'openai-bundled'],
-    ['latex', 'openai-bundled'],
-    ['documents', 'openai-primary-runtime'],
-    ['presentations', 'openai-primary-runtime'],
-    ['spreadsheets', 'openai-primary-runtime']
-];
 function packagedSksEntrypoint() {
     return path.join(packageRoot(), 'dist', 'bin', 'sks.js');
 }
@@ -112,7 +108,7 @@ export async function postinstall({ bootstrap, args = [] }) {
         if (imagegenRepair.status === 'ready')
             console.log('Codex App Image Gen: ready ($imagegen/gpt-image-2 detected).');
         else if (imagegenRepair.status === 'recovered')
-            console.log('Codex App Image Gen: recovered and re-detected.');
+            console.log('Codex App Image Gen: recovered and re-detected. Start a new Codex/Work task; restart the desktop app only if the new task still lacks $imagegen.');
         else if (imagegenRepair.status === 'blocked')
             console.log(`Codex App Image Gen: blocked; run \`sks doctor --fix\`. ${(imagegenRepair.blockers || []).join(', ')}`.trim());
         else if (imagegenRepair.status === 'skipped')
@@ -395,7 +391,7 @@ async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
         const currentAuthText = currentAuthExists ? await readText(snapshot.auth_path, '') : '';
         if (!currentAuthExists || !currentAuthText.trim()) {
             await ensureDir(path.dirname(snapshot.auth_path));
-            await writeTextAtomic(snapshot.auth_path, snapshot.auth_text);
+            await writeTextAtomic(snapshot.auth_path, snapshot.auth_text, { mode: 0o600 });
             await fsp.chmod(snapshot.auth_path, 0o600).catch(() => { });
             authRestored = true;
         }
@@ -417,6 +413,73 @@ export function normalizeCodexLbBaseUrl(input = '') {
     host = host.replace(/\/+$/, '');
     return /\/backend-api\/codex$/i.test(host) ? host : `${host}/backend-api/codex`;
 }
+async function ensureCodexLbToolCatalogSelection(input, opts = {}) {
+    const codexHome = opts.codexHome || path.join(input.home, '.codex');
+    const catalogPath = codexLbToolCatalogPath(codexHome);
+    const current = await readText(input.configPath, '');
+    const selected = hasTopLevelCodexLbSelected(current);
+    const existingCatalogPath = topLevelTomlString(current, 'model_catalog_json');
+    if (selected && existingCatalogPath && path.resolve(existingCatalogPath) !== path.resolve(catalogPath)) {
+        return {
+            schema: 'sks.codex-lb-tool-catalog-selection.v1',
+            ok: false,
+            required: true,
+            status: 'user_catalog_conflict',
+            path: catalogPath,
+            configured_path: existingCatalogPath,
+            config_changed: false,
+            blockers: ['codex_lb_user_model_catalog_conflict']
+        };
+    }
+    let hostname = '';
+    try {
+        hostname = new URL(input.baseUrl).hostname.toLowerCase();
+    }
+    catch { }
+    const reservedFixtureHost = /(?:^|\.)(?:test|invalid|example)$/.test(hostname);
+    if (reservedFixtureHost && typeof opts.toolCatalogFetch !== 'function') {
+        return {
+            schema: 'sks.codex-lb-tool-catalog-selection.v1',
+            ok: true,
+            required: false,
+            status: 'skipped_reserved_host',
+            path: catalogPath,
+            config_changed: false,
+            blockers: []
+        };
+    }
+    const catalog = await ensureCodexLbToolCatalog({
+        codexHome,
+        baseUrl: input.baseUrl,
+        apiKey: input.apiKey,
+        ...(typeof opts.toolCatalogFetch === 'function' ? { fetchImpl: opts.toolCatalogFetch } : {}),
+        timeoutMs: Number(opts.toolCatalogTimeoutMs || 5000),
+        force: opts.forceToolCatalog === true
+    });
+    if (!catalog.ok || !selected) {
+        return {
+            ...catalog,
+            schema: 'sks.codex-lb-tool-catalog-selection.v1',
+            config_changed: false,
+            selected
+        };
+    }
+    const next = ensureTrailingNewline(upsertTopLevelTomlString(current, 'model_catalog_json', catalog.path));
+    if (next === ensureTrailingNewline(current)) {
+        return { ...catalog, schema: 'sks.codex-lb-tool-catalog-selection.v1', config_changed: false, selected: true };
+    }
+    const safeWrite = await safeWriteCodexConfigToml(input.configPath, current, next, 'codex-lb-tool-catalog');
+    return {
+        ...catalog,
+        schema: 'sks.codex-lb-tool-catalog-selection.v1',
+        ok: catalog.ok && safeWrite.ok,
+        status: safeWrite.ok ? catalog.status : safeWrite.status,
+        config_changed: safeWrite.ok && safeWrite.changed === true,
+        backup_path: safeWrite.backup_path,
+        selected: true,
+        blockers: safeWrite.ok ? catalog.blockers : [...new Set([...(catalog.blockers || []), 'codex_lb_tool_catalog_config_write_failed'])]
+    };
+}
 export async function configureCodexLb(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const configPath = opts.configPath || codexLbConfigPath(home);
@@ -455,6 +518,26 @@ export async function configureCodexLb(opts = {}) {
         return { ok: false, status: 'invalid_host_or_base_url', config_path: configPath, env_path: envPath, error: 'host_or_base_url_contains_whitespace_or_control_character' };
     if (!apiKey)
         return { ok: false, status: 'missing_api_key', config_path: configPath, env_path: envPath };
+    const toolOutputRecovery = await probeCodexLbToolOutputRecovery({
+        baseUrl,
+        ...(typeof opts.toolOutputRecoveryFetch === 'function' ? { fetchImpl: opts.toolOutputRecoveryFetch } : {}),
+        timeoutMs: Number(opts.toolOutputRecoveryTimeoutMs || 4_000),
+        allowUnverified: opts.allowUnverifiedToolOutputRecovery === true
+            || codexLbToolOutputRecoveryOverrideAcknowledged({ env: opts.env || process.env })
+    });
+    if (!toolOutputRecovery.ok) {
+        return {
+            ok: false,
+            status: 'tool_output_recovery_blocked',
+            plan: plan,
+            config_path: configPath,
+            env_path: envPath,
+            base_url: baseUrl,
+            tool_output_recovery: toolOutputRecovery,
+            drift: toolOutputRecovery.blockers,
+            warnings: toolOutputRecovery.warnings
+        };
+    }
     const insecureLocalWarning = /^http:\/\//i.test(baseUrl) && !/^http:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::|\/|$)/i.test(baseUrl) && !opts.allowInsecureHttp
         ? ['codex-lb base URL uses http outside localhost; prefer https or pass an explicit allow flag in the calling surface.']
         : [];
@@ -472,12 +555,16 @@ export async function configureCodexLb(opts = {}) {
     if (useDefaultProvider)
         appliedActions.push({ type: 'select_default_provider', target: configPath, ok: true });
     if (writeEnvFile) {
-        await writeTextAtomic(envPath, `export CODEX_LB_BASE_URL=${shellSingleQuote(baseUrl)}\nexport CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`);
+        await writeTextAtomic(envPath, `export CODEX_LB_BASE_URL=${shellSingleQuote(baseUrl)}\nexport CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`, { mode: 0o600 });
         await fsp.chmod(envPath, 0o600).catch(() => { });
         appliedActions.push({ type: 'write_env_file', target: envPath, ok: true });
     }
     process.env.CODEX_LB_BASE_URL = baseUrl;
     process.env.CODEX_LB_API_KEY = apiKey;
+    const toolCatalog = await ensureCodexLbToolCatalogSelection({ home, configPath, baseUrl, apiKey }, opts);
+    if (toolCatalog.config_changed || toolCatalog.status === 'repaired' || toolCatalog.status === 'cached_compatible') {
+        appliedActions.push({ type: 'write_model_tool_catalog', target: toolCatalog.path, ok: toolCatalog.ok === true, status: toolCatalog.status });
+    }
     const keyFingerprint = await sha256Text(apiKey);
     const metadataPath = opts.metadataPath || codexLbMetadataPath(home);
     await writeTextAtomic(metadataPath, `${JSON.stringify({
@@ -507,20 +594,23 @@ export async function configureCodexLb(opts = {}) {
     const finalCodexLb = await codexLbStatus({ ...opts, home, configPath, envPath });
     const ok = Boolean(codexEnvironment.ok && codexLogin.ok);
     const afterState = await captureCodexLbSetupWriteState({ home, configPath, envPath, shellProfile });
-    const drift = detectCodexLbSetupDrift({
-        useDefaultProvider,
-        writeEnvFile,
-        storeKeychain,
-        syncLaunchctl,
-        shellProfile,
-        selected: finalCodexLb.selected,
-        envFile: finalCodexLb.env_file,
-        keychain,
-        codexEnvironment,
-        shellProfileResult,
-        beforeState,
-        afterState
-    });
+    const drift = [
+        ...detectCodexLbSetupDrift({
+            useDefaultProvider,
+            writeEnvFile,
+            storeKeychain,
+            syncLaunchctl,
+            shellProfile,
+            selected: finalCodexLb.selected,
+            envFile: finalCodexLb.env_file,
+            keychain,
+            codexEnvironment,
+            shellProfileResult,
+            beforeState,
+            afterState
+        }),
+        ...(toolCatalog.required !== false && toolCatalog.ok !== true ? ['codex_lb_gpt56_tool_catalog_not_ready'] : [])
+    ];
     const appliedPersistenceModes = appliedCodexLbPersistenceModes({
         writeEnvFile,
         storeKeychain,
@@ -537,7 +627,11 @@ export async function configureCodexLb(opts = {}) {
         appliedModes: appliedPersistenceModes,
         processOnly: appliedPersistenceModes.includes('process_only_ephemeral')
     });
-    const warnings = [...insecureLocalWarning, ...persistence.warnings];
+    const warnings = [
+        ...insecureLocalWarning,
+        ...persistence.warnings,
+        ...(toolCatalog.required !== false && toolCatalog.ok !== true ? ['codex_lb_gpt56_tool_catalog_not_ready'] : [])
+    ];
     return {
         ok: ok && drift.length === 0,
         status: ok && drift.length === 0 ? 'configured' : drift.length ? 'setup_choice_drift' : (codexEnvironment.status || codexLogin.status),
@@ -556,6 +650,8 @@ export async function configureCodexLb(opts = {}) {
         codex_lb: finalCodexLb,
         codex_environment: codexEnvironment,
         codex_login: codexLogin,
+        tool_catalog: toolCatalog,
+        tool_output_recovery: toolOutputRecovery,
         error: authReconcile.error || codexEnvironment.error || codexLogin.error || null
     };
 }
@@ -595,8 +691,22 @@ export async function codexLbStatus(opts = {}) {
         status: 'inspect_failed',
         error: err.message
     }));
+    const providerReady = providerContractOk && envKeyConfigured && Boolean(baseUrl) && authMode.codex_app_usable;
+    const probeToolOutputRecovery = opts.probeToolOutputRecovery === true;
+    const toolOutputRecovery = !selected
+        ? codexLbToolOutputRecoveryNotSelected()
+        : !probeToolOutputRecovery
+            ? codexLbToolOutputRecoveryNotChecked(true)
+            : await probeCodexLbToolOutputRecovery({
+                baseUrl,
+                ...(typeof opts.toolOutputRecoveryFetch === 'function' ? { fetchImpl: opts.toolOutputRecoveryFetch } : {}),
+                timeoutMs: Number(opts.toolOutputRecoveryTimeoutMs || 4_000),
+                allowUnverified: opts.allowUnverifiedToolOutputRecovery === true
+                    || codexLbToolOutputRecoveryOverrideAcknowledged({ env: opts.env || process.env })
+            });
     return {
-        ok: providerContractOk && envKeyConfigured && Boolean(baseUrl) && authMode.codex_app_usable,
+        ok: providerReady && (!selected || !probeToolOutputRecovery || toolOutputRecovery.ok),
+        provider_ready: providerReady,
         config_path: configPath,
         env_path: envPath,
         provider_configured: providerConfigured,
@@ -627,7 +737,8 @@ export async function codexLbStatus(opts = {}) {
         auth_usable_for_codex_app: authMode.codex_app_usable || codexAppUsableWithCodexLb,
         auth_summary: codexAppUsableWithCodexLb ? `codex-lb provider uses ${authMode.mode} OpenAI-style auth through Codex App` : authMode.summary,
         fast_mode: fastMode,
-        launch_environment: launchEnvironment
+        launch_environment: launchEnvironment,
+        tool_output_recovery: toolOutputRecovery
     };
 }
 export function formatCodexLbStatusText(status = {}, opts = {}) {
@@ -642,6 +753,14 @@ export function formatCodexLbStatusText(status = {}, opts = {}) {
         `Provider OpenAI Auth: ${status.provider_requires_openai_auth ? 'required' : 'not required/drifted'} (${status.provider_name || 'missing'})`,
         `Codex App auth: ${status.auth_usable_for_codex_app ? 'ok' : 'needs sign-in/repair'} (${status.auth_mode || 'unknown'})`
     ];
+    if (status.tool_output_recovery?.status && status.tool_output_recovery.status !== 'not_selected') {
+        const recovery = status.tool_output_recovery;
+        lines.push(`Interrupted tool-output recovery: ${recovery.ok ? 'ready' : 'blocked'} (${recovery.observed_version || recovery.status}; minimum ${recovery.minimum_version})`);
+        if (!recovery.ok) {
+            for (const action of recovery.operator_actions || [])
+                lines.push(`  action: ${action}`);
+        }
+    }
     if (status.auth_summary)
         lines.push(`Auth detail: ${status.auth_summary}`);
     if (status.fast_mode) {
@@ -1016,17 +1135,39 @@ function tomlTableString(text = '', table, key) {
     return block.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[2] || '';
 }
 export async function repairCodexLbAuth(opts = {}) {
-    let status = await codexLbStatus(opts);
+    let status = await codexLbStatus({
+        ...opts,
+        probeToolOutputRecovery: true,
+        allowUnverifiedToolOutputRecovery: opts.allowUnverifiedToolOutputRecovery === true
+    });
     let configRepaired = false;
     let legacyAuthMigrated = false;
     let legacyAuthPath = null;
+    const toolOutputRecovery = status.base_url
+        ? await probeCodexLbToolOutputRecovery({
+            baseUrl: status.base_url,
+            ...(typeof opts.toolOutputRecoveryFetch === 'function' ? { fetchImpl: opts.toolOutputRecoveryFetch } : {}),
+            timeoutMs: Number(opts.toolOutputRecoveryTimeoutMs || 4_000),
+            allowUnverified: opts.allowUnverifiedToolOutputRecovery === true
+                || codexLbToolOutputRecoveryOverrideAcknowledged({ env: opts.env || process.env })
+        })
+        : status.tool_output_recovery;
+    if (status.base_url && toolOutputRecovery?.ok !== true) {
+        return {
+            ok: false,
+            status: 'tool_output_recovery_blocked',
+            codex_lb: status,
+            tool_output_recovery: toolOutputRecovery,
+            error: toolOutputRecovery?.blockers?.join(', ') || 'codex-lb interrupted tool-output recovery is unverified'
+        };
+    }
     const currentConfig = await readText(status.config_path, '');
     if (!status.env_key_configured && status.base_url && (status.provider_configured || status.selected || status.env_base_url_configured)) {
         const legacyAuth = await restoreCodexLbEnvFromSharedLogin(status, opts);
         if (legacyAuth.ok) {
             legacyAuthMigrated = true;
             legacyAuthPath = legacyAuth.auth_path;
-            status = await codexLbStatus(opts);
+            status = await codexLbStatus({ ...opts, probeToolOutputRecovery: true });
         }
     }
     if (status.env_key_configured && status.base_url && (!status.provider_contract_ok || !status.selected || legacyAuthMigrated || hasTopLevelCodexModeLock(currentConfig) || (opts.forceCodexLbApiKeyAuth === true && !status.ok))) {
@@ -1037,7 +1178,7 @@ export async function repairCodexLbAuth(opts = {}) {
         });
         const safeWrite = await safeWriteCodexConfigToml(status.config_path, currentConfig, next, 'codex-lb-repair');
         configRepaired = safeWrite.ok && safeWrite.changed === true;
-        status = await codexLbStatus(opts);
+        status = await codexLbStatus({ ...opts, probeToolOutputRecovery: true });
     }
     const canRepairAuthMode = opts.forceCodexLbApiKeyAuth === true && status.provider_contract_ok && status.env_key_configured && Boolean(status.base_url);
     if (!status.ok && !canRepairAuthMode) {
@@ -1052,13 +1193,19 @@ export async function repairCodexLbAuth(opts = {}) {
     await migrateCodexAuthKeyFormat({ home: opts.home });
     const codexEnvironment = await syncCodexLbProviderEnvironment(status, opts);
     const apiKey = parseCodexLbEnvKey(await readText(status.env_path, ''));
+    const toolCatalog = await ensureCodexLbToolCatalogSelection({
+        home: opts.home || process.env.HOME || os.homedir(),
+        configPath: status.config_path,
+        baseUrl: String(status.base_url || ''),
+        apiKey
+    }, opts);
     const forceCodexLbApiKeyAuth = opts.forceCodexLbApiKeyAuth === true || opts.authMode === 'codex-lb';
     const authReconcile = await reconcileCodexLbAuthConflict({ ...opts, status, forceCodexLbApiKeyAuth }).catch((err) => ({ status: 'failed', reason: 'exception', error: err.message }));
     const codexLogin = forceCodexLbApiKeyAuth
         ? { ok: ['apikey_forced', 'apikey_auth_active'].includes(authReconcile.status), status: authReconcile.status, ...(authReconcile.reason ? { reason: authReconcile.reason } : {}), error: authReconcile.error || null }
         : await maybeSyncCodexLbSharedLogin(apiKey, { ...opts, home: opts.home || process.env.HOME || os.homedir(), force: true });
-    const finalStatus = await codexLbStatus(opts);
-    const ok = Boolean(codexEnvironment.ok && codexLogin.ok);
+    const finalStatus = await codexLbStatus({ ...opts, probeToolOutputRecovery: true });
+    const ok = Boolean(codexEnvironment.ok && codexLogin.ok && (toolCatalog.required === false || toolCatalog.ok === true));
     return {
         ok,
         status: ok ? 'repaired' : (codexEnvironment.status || codexLogin.status),
@@ -1071,7 +1218,8 @@ export async function repairCodexLbAuth(opts = {}) {
         auth_reconcile: authReconcile,
         codex_lb: finalStatus,
         codex_environment: codexEnvironment,
-        codex_login: codexLogin
+        codex_login: codexLogin,
+        tool_catalog: toolCatalog
     };
 }
 export async function ensureCodexLbAuthDuringInstall(opts = {}) {
@@ -1101,10 +1249,16 @@ export async function ensureCodexLbAuthDuringInstall(opts = {}) {
     }
     const codexEnvironment = await syncCodexLbProviderEnvironment(status, opts);
     const apiKey = parseCodexLbEnvKey(await readText(status.env_path, ''));
+    const toolCatalog = await ensureCodexLbToolCatalogSelection({
+        home: opts.home || process.env.HOME || os.homedir(),
+        configPath: status.config_path,
+        baseUrl: String(status.base_url || ''),
+        apiKey
+    }, opts);
     const codexLogin = await maybeSyncCodexLbSharedLogin(apiKey, { ...opts, home: opts.home || process.env.HOME || os.homedir(), force: true });
     const authReconcile = await reconcileCodexLbAuthConflict({ ...opts, status }).catch((err) => ({ status: 'failed', reason: 'exception', error: err.message }));
     const finalStatus = await codexLbStatus(opts);
-    const ok = Boolean(codexEnvironment.ok && codexLogin.ok);
+    const ok = Boolean(codexEnvironment.ok && codexLogin.ok && (toolCatalog.required === false || toolCatalog.ok === true));
     return {
         ok,
         status: ok ? 'present' : (codexEnvironment.status || codexLogin.status),
@@ -1114,6 +1268,7 @@ export async function ensureCodexLbAuthDuringInstall(opts = {}) {
         codex_lb: finalStatus,
         codex_environment: codexEnvironment,
         codex_login: codexLogin,
+        tool_catalog: toolCatalog,
         auth_reconcile: authReconcile,
         error: codexEnvironment.error || codexLogin.error || null
     };
@@ -1130,7 +1285,7 @@ async function restoreCodexLbEnvFromSharedLogin(status = {}, opts = {}) {
     if (!baseUrl)
         return { ok: false, status: 'missing_base_url', auth_path: authPath, env_path: envPath };
     await ensureDir(path.dirname(envPath));
-    await writeTextAtomic(envPath, `export CODEX_LB_BASE_URL=${shellSingleQuote(normalizeCodexLbBaseUrl(baseUrl))}\nexport CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`);
+    await writeTextAtomic(envPath, `export CODEX_LB_BASE_URL=${shellSingleQuote(normalizeCodexLbBaseUrl(baseUrl))}\nexport CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`, { mode: 0o600 });
     await fsp.chmod(envPath, 0o600).catch(() => { });
     return { ok: true, status: 'migrated_login_cache', auth_path: authPath, env_path: envPath, base_url: normalizeCodexLbBaseUrl(baseUrl) };
 }
@@ -1203,7 +1358,7 @@ async function migrateCodexAuthKeyFormat(opts = {}) {
         if (!legacyKey)
             return { status: 'skipped', reason: 'no_key_found' };
         const replacement = `${JSON.stringify({ auth_mode: 'apikey', OPENAI_API_KEY: legacyKey })}\n`;
-        await writeTextAtomic(authPath, replacement);
+        await writeTextAtomic(authPath, replacement, { mode: 0o600 });
         await fsp.chmod(authPath, 0o600).catch(() => { });
         return { status: 'migrated', auth_path: authPath };
     }
@@ -1234,7 +1389,7 @@ export async function reconcileCodexLbAuthConflict(opts = {}) {
     const forceCodexLbApiKeyAuth = opts.forceCodexLbApiKeyAuth === true;
     const writeApiKeyAuth = async (reason, backupPathForResult = null) => {
         try {
-            await writeTextAtomic(authPath, `${JSON.stringify({ auth_mode: 'apikey', OPENAI_API_KEY: apiKey }, null, 2)}\n`);
+            await writeTextAtomic(authPath, `${JSON.stringify({ auth_mode: 'apikey', OPENAI_API_KEY: apiKey }, null, 2)}\n`, { mode: 0o600 });
             await fsp.chmod(authPath, 0o600).catch(() => { });
             return {
                 status: 'apikey_forced',
@@ -1260,7 +1415,7 @@ export async function reconcileCodexLbAuthConflict(opts = {}) {
     if (hasChatgptOAuthTokens(authText)) {
         try {
             await ensureDir(path.dirname(backupPath));
-            await writeTextAtomic(backupPath, authText);
+            await writeTextAtomic(backupPath, authText, { mode: 0o600 });
             await fsp.chmod(backupPath, 0o600).catch(() => { });
         }
         catch (err) {
@@ -1286,7 +1441,7 @@ export async function reconcileCodexLbAuthConflict(opts = {}) {
         }
         try {
             const replacement = `${JSON.stringify({ auth_mode: 'apikey', OPENAI_API_KEY: apiKey }, null, 2)}\n`;
-            await writeTextAtomic(authPath, replacement);
+            await writeTextAtomic(authPath, replacement, { mode: 0o600 });
             await fsp.chmod(authPath, 0o600).catch(() => { });
         }
         catch (err) {
@@ -1316,7 +1471,7 @@ export async function reconcileCodexLbAuthConflict(opts = {}) {
         if (hasChatgptOAuthTokens(backupText) && process.env.SKS_CODEX_LB_KEEP_APIKEY_AUTH !== '1') {
             try {
                 const restored = backupText.endsWith('\n') ? backupText : `${backupText}\n`;
-                await writeTextAtomic(authPath, restored);
+                await writeTextAtomic(authPath, restored, { mode: 0o600 });
                 await fsp.chmod(authPath, 0o600).catch(() => { });
                 return {
                     status: 'oauth_restored',
@@ -1369,18 +1524,46 @@ export async function unselectCodexLbProvider(opts = {}) {
     const configPath = opts.configPath || codexLbConfigPath(home);
     const current = await readText(configPath, '');
     if (!current.trim())
-        return { status: 'not_selected', reason: 'no_config', config_path: configPath };
-    if (!hasTopLevelCodexLbSelected(current))
-        return { status: 'not_selected', config_path: configPath };
+        return { ok: true, status: 'not_selected', reason: 'no_config', config_path: configPath };
+    const managedCatalogPath = codexLbToolCatalogPath(opts.codexHome || path.join(home, '.codex'));
+    const managedCatalogSelected = topLevelTomlString(current, 'model_catalog_json') === managedCatalogPath;
+    if (!hasTopLevelCodexLbSelected(current) && !managedCatalogSelected)
+        return { ok: true, status: 'not_selected', config_path: configPath };
     try {
-        const next = ensureTrailingNewline(removeTopLevelTomlString(current, 'model_provider'));
+        let next = removeTopLevelTomlString(current, 'model_provider');
+        next = removeTopLevelTomlKeyIfValue(next, 'model_catalog_json', managedCatalogPath);
+        next = ensureTrailingNewline(next);
         const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'codex-lb-unselect');
-        return { status: safeWrite.ok ? 'unselected' : safeWrite.status, config_path: configPath, backup_path: safeWrite.backup_path };
+        const after = safeWrite.ok ? await readText(configPath, '') : current;
+        const selectionRemoved = !hasTopLevelCodexLbSelected(after)
+            && topLevelTomlString(after, 'model_catalog_json') !== managedCatalogPath;
+        if (safeWrite.ok && selectionRemoved)
+            return { ok: true, status: 'unselected', config_path: configPath, backup_path: safeWrite.backup_path };
+        const providerError = safeWrite.ok ? 'provider_selection_remains_after_write' : safeWrite.status || 'provider_config_write_blocked';
+        return {
+            ok: false,
+            status: 'failed',
+            reason: 'provider_config_write_blocked',
+            provider_error: providerError,
+            write_status: safeWrite.status || 'failed',
+            config_path: configPath,
+            backup_path: safeWrite.backup_path,
+            config_preserved: safeWrite.changed !== true
+        };
     }
     catch (err) {
-        return { status: 'failed', reason: 'write_failed', config_path: configPath, error: err.message };
+        return { ok: false, status: 'failed', reason: 'write_failed', provider_error: err.message || 'write_failed', config_path: configPath, error: err.message };
     }
 }
+function providerDeselectionOutcome(result) {
+    const ok = result?.status === 'unselected' || result?.status === 'not_selected';
+    return {
+        ok,
+        provider_unselected: ok,
+        provider_status: result?.status || 'failed',
+        provider_error: ok ? null : String(result?.provider_error || result?.error || result?.reason || result?.status || 'unselect_failed')
+    };
+}
 // Reverse of reconcileCodexLbAuthConflict: restore the ChatGPT OAuth blob from the backup file
 // so the user can return to the official ChatGPT account login. Also deselects codex-lb at the
 // model_provider level by default so the restored OAuth blob actually wins; pass keepProvider
@@ -1397,6 +1580,7 @@ export async function releaseCodexLbAuthHold(opts = {}) {
     const authPath = opts.authPath || codexAuthPath(home);
     const backupPath = opts.backupPath || codexAuthChatgptBackupPath(home);
     const configPath = opts.configPath || codexLbConfigPath(home);
+    const authExisted = await exists(authPath);
     const currentAuthText = await readText(authPath, '');
     const trimmedCurrent = currentAuthText.trim();
     // Repeated "Use ChatGPT OAuth" is idempotent. If OAuth/browser auth is
@@ -1404,21 +1588,20 @@ export async function releaseCodexLbAuthHold(opts = {}) {
     // codex-lb provider is no longer selected.
     const currentAuthMode = codexAuthModeSummary(currentAuthText);
     if (!opts.force && (currentAuthMode.mode === 'chatgpt_oauth' || currentAuthMode.mode === 'browser_marker')) {
-        let providerUnselected = false;
-        let providerError = null;
+        let provider = { ok: true, provider_unselected: false, provider_status: 'kept', provider_error: null };
         if (!opts.keepProvider) {
             const unselected = await unselectCodexLbProvider({ ...opts, home, configPath });
-            if (unselected.status === 'unselected' || unselected.status === 'not_selected')
-                providerUnselected = true;
-            else if (unselected.status === 'failed')
-                providerError = unselected.error || unselected.reason || 'unselect_failed';
+            provider = providerDeselectionOutcome(unselected);
         }
         return {
-            status: providerError ? 'failed' : 'already_chatgpt',
+            ok: provider.ok,
+            status: provider.ok ? 'already_chatgpt' : 'failed',
+            ...(provider.ok ? {} : { reason: 'provider_unselect_failed' }),
             auth_path: authPath,
             backup_path: backupPath,
-            provider_unselected: providerUnselected,
-            provider_error: providerError
+            provider_unselected: provider.provider_unselected,
+            provider_status: provider.provider_status,
+            provider_error: provider.provider_error
         };
     }
     const backupExists = await exists(backupPath);
@@ -1443,21 +1626,20 @@ export async function releaseCodexLbAuthHold(opts = {}) {
     // If auth.json already looks like ChatGPT OAuth (user re-logged in some other way), don't
     // clobber it — but still honor the deselect request so the OAuth blob takes effect.
     if (trimmedCurrent && hasChatgptOAuthTokens(currentAuthText) && !opts.force) {
-        let providerUnselected = false;
-        let providerError = null;
+        let provider = { ok: true, provider_unselected: false, provider_status: 'kept', provider_error: null };
         if (!opts.keepProvider) {
             const unselected = await unselectCodexLbProvider({ ...opts, home, configPath });
-            if (unselected.status === 'unselected')
-                providerUnselected = true;
-            else if (unselected.status === 'failed')
-                providerError = unselected.error || unselected.reason || 'unselect_failed';
+            provider = providerDeselectionOutcome(unselected);
         }
         return {
-            status: 'already_chatgpt',
+            ok: provider.ok,
+            status: provider.ok ? 'already_chatgpt' : 'failed',
+            ...(provider.ok ? {} : { reason: 'provider_unselect_failed' }),
             auth_path: authPath,
             backup_path: backupPath,
-            provider_unselected: providerUnselected,
-            provider_error: providerError
+            provider_unselected: provider.provider_unselected,
+            provider_status: provider.provider_status,
+            provider_error: provider.provider_error
         };
     }
     // Refuse to clobber unfamiliar auth.json shapes unless forced. We expect either an empty file,
@@ -1478,7 +1660,7 @@ export async function releaseCodexLbAuthHold(opts = {}) {
     try {
         await ensureDir(path.dirname(authPath));
         const restored = backupText.endsWith('\n') ? backupText : `${backupText}\n`;
-        await writeTextAtomic(authPath, restored);
+        await writeTextAtomic(authPath, restored, { mode: 0o600 });
         await fsp.chmod(authPath, 0o600).catch(() => { });
     }
     catch (err) {
@@ -1491,6 +1673,28 @@ export async function releaseCodexLbAuthHold(opts = {}) {
             provider_unselected: false
         };
     }
+    let provider = { ok: true, provider_unselected: false, provider_status: 'kept', provider_error: null };
+    if (!opts.keepProvider) {
+        const unselected = await unselectCodexLbProvider({ ...opts, home, configPath });
+        provider = providerDeselectionOutcome(unselected);
+    }
+    if (!provider.ok) {
+        const rollback = await rollbackCodexAuthRestore({ authPath, authExisted, currentAuthText });
+        return {
+            ok: false,
+            status: 'failed',
+            reason: 'provider_unselect_failed',
+            auth_path: authPath,
+            backup_path: backupPath,
+            backup_removed: false,
+            auth_restored: rollback.ok !== true,
+            auth_rollback: rollback,
+            rollback_safe: rollback.ok === true,
+            provider_unselected: false,
+            provider_status: provider.provider_status,
+            provider_error: provider.provider_error
+        };
+    }
     let backupRemoved = false;
     if (opts.deleteBackup) {
         try {
@@ -1498,31 +1702,57 @@ export async function releaseCodexLbAuthHold(opts = {}) {
             backupRemoved = true;
         }
         catch {
-            // Non-fatal: the restore already landed.
+            // Non-fatal: the restore and provider deselection already landed.
         }
     }
-    let providerUnselected = false;
-    let providerError = null;
-    if (!opts.keepProvider) {
-        const unselected = await unselectCodexLbProvider({ ...opts, home, configPath });
-        if (unselected.status === 'unselected')
-            providerUnselected = true;
-        else if (unselected.status === 'failed')
-            providerError = unselected.error || unselected.reason || 'unselect_failed';
-    }
     return {
+        ok: true,
         status: 'released',
         auth_path: authPath,
         backup_path: backupPath,
         backup_removed: backupRemoved,
-        provider_unselected: providerUnselected,
-        provider_error: providerError
+        auth_restored: true,
+        provider_unselected: provider.provider_unselected,
+        provider_status: provider.provider_status,
+        provider_error: provider.provider_error
     };
 }
+async function rollbackCodexAuthRestore(input) {
+    try {
+        if (input.authExisted) {
+            await writeTextAtomic(input.authPath, input.currentAuthText, { mode: 0o600 });
+            await fsp.chmod(input.authPath, 0o600).catch(() => { });
+        }
+        else {
+            await fsp.rm(input.authPath, { force: true });
+        }
+        return { ok: true, status: 'restored_previous_auth' };
+    }
+    catch (err) {
+        return { ok: false, status: 'rollback_failed', error: err.message };
+    }
+}
 export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
     if (args.includes('--json') || args.includes('--skip-codex-lb') || process.env.SKS_SKIP_CODEX_LB_PROMPT === '1')
         return { status: 'skipped' };
-    let status = await codexLbStatus(opts);
+    const allowUnverifiedToolOutputRecovery = opts.allowUnverifiedToolOutputRecovery === true
+        || codexLbToolOutputRecoveryOverrideAcknowledged({ args, env: opts.env || process.env });
+    let status = await codexLbStatus({
+        ...opts,
+        probeToolOutputRecovery: true,
+        allowUnverifiedToolOutputRecovery
+    });
+    if (status.selected && status.tool_output_recovery?.ok !== true) {
+        return {
+            status: 'tool_output_recovery_blocked',
+            ok: false,
+            codex_lb: status,
+            tool_output_recovery: status.tool_output_recovery,
+            blockers: status.tool_output_recovery.blockers,
+            operator_actions: status.tool_output_recovery.operator_actions,
+            bypass_codex_lb: false
+        };
+    }
     if (status.env_key_configured && status.base_url && !status.selected && status.auth_mode === 'chatgpt_oauth') {
         return { status: 'continued_to_codex', ok: false, chain_health: null, codex_lb: status, reason: 'chatgpt_oauth_active_codex_lb_unselected' };
     }
@@ -1534,8 +1764,20 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
             if (/^(n|no|아니|아니요|ㄴ)$/i.test(restore))
                 return { status: 'continued_to_codex', codex_lb: status };
         }
-        const repaired = await repairCodexLbAuth(opts);
-        status = await codexLbStatus(opts);
+        const repaired = await repairCodexLbAuth({ ...opts, allowUnverifiedToolOutputRecovery });
+        status = await codexLbStatus({ ...opts, probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery });
+        if (status.selected && status.tool_output_recovery?.ok !== true) {
+            return {
+                status: 'tool_output_recovery_blocked',
+                ok: false,
+                repair: repaired,
+                codex_lb: status,
+                tool_output_recovery: status.tool_output_recovery,
+                blockers: status.tool_output_recovery.blockers,
+                operator_actions: status.tool_output_recovery.operator_actions,
+                bypass_codex_lb: false
+            };
+        }
         if (!status.ok)
             return { status: 'repair_failed', ok: false, repair: repaired, codex_lb: status };
         if (!repaired.ok && repaired.error && promptedRestore)
@@ -1550,6 +1792,15 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
         if (codexEnvironment.status === 'synced')
             console.log('codex-lb provider auth synced for this user session.');
         const apiKey = parseCodexLbEnvKey(await readText(status.env_path, ''));
+        const toolCatalog = await ensureCodexLbToolCatalogSelection({
+            home: opts.home || process.env.HOME || os.homedir(),
+            configPath: status.config_path,
+            baseUrl: String(status.base_url || ''),
+            apiKey
+        }, opts);
+        if (toolCatalog.required !== false && toolCatalog.ok !== true) {
+            return { status: 'repair_failed', ok: false, codex_lb: status, codex_environment: codexEnvironment, tool_catalog: toolCatalog };
+        }
         const codexLogin = await maybeSyncCodexLbSharedLogin(apiKey, { ...opts, home: opts.home || process.env.HOME || os.homedir() });
         if (codexLogin.status === 'synced')
             console.log('codex-lb auth synced with Codex CLI login cache.');
@@ -1560,7 +1811,7 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
             // health probe fails. Keep codex-lb active and just warn.
             if (chainHealth.status === 'previous_response_not_found') {
                 console.log('codex-lb response chain check: previous_response_id not persisted by the load balancer (this is normal for stateless deployments). Keeping codex-lb active.');
-                return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, chain_health: chainHealth };
+                return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth };
             }
             // Hard chain failure (auth rejected, timeout, missing base URL, etc.). Don't silently
             // demote a configured codex-lb to ChatGPT OAuth — surface the failure and let the user
@@ -1568,23 +1819,23 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
             console.log(`codex-lb response chain check failed (${chainHealth.status}${chainHealth.error ? `: ${chainHealth.error}` : ''}).`);
             if (process.env.SKS_CODEX_LB_AUTOBYPASS === '1') {
                 console.log('SKS_CODEX_LB_AUTOBYPASS=1 set; bypassing codex-lb to ChatGPT OAuth for this launch.');
-                return { status: 'chain_unhealthy', ...status, ok: false, codex_environment: codexEnvironment, codex_login: codexLogin, chain_health: chainHealth, bypass_codex_lb: true };
+                return { status: 'chain_unhealthy', ...status, ok: false, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth, bypass_codex_lb: true };
             }
             if (canAskYesNo()) {
                 const answer = (await askPostinstallQuestion('Use codex-lb anyway, or fall back to ChatGPT OAuth? [LB/oauth] ')).trim().toLowerCase();
                 if (/^(oauth|o|chatgpt|fall ?back|n|no|아니|아니요|ㄴ)$/.test(answer)) {
                     console.log('Falling back to ChatGPT OAuth for this launch. Re-enable codex-lb anytime with `sks codex-lb repair`.');
-                    return { status: 'chain_unhealthy', ...status, ok: false, codex_environment: codexEnvironment, codex_login: codexLogin, chain_health: chainHealth, bypass_codex_lb: true };
+                    return { status: 'chain_unhealthy', ...status, ok: false, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth, bypass_codex_lb: true };
                 }
                 console.log('Keeping codex-lb active. To switch back to ChatGPT OAuth: `sks codex-lb release`.');
-                return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, chain_health: chainHealth };
+                return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth };
             }
             // Non-interactive context with no opt-out env var. The user explicitly configured codex-lb,
             // so default to keeping it active rather than silently swapping providers.
             console.log('Non-interactive launch + chain check failure. Keeping codex-lb active. Set SKS_CODEX_LB_AUTOBYPASS=1 to auto-bypass to ChatGPT OAuth.');
-            return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, chain_health: chainHealth };
+            return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth };
         }
-        return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, chain_health: chainHealth };
+        return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth };
     }
     if (!canAskYesNo())
         return { status: 'non_interactive', codex_lb: status };
@@ -1593,7 +1844,7 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
         return { status: 'continued_to_codex' };
     const host = (await askPostinstallQuestion('codex-lb host domain [http://127.0.0.1:2455]: ')).trim() || 'http://127.0.0.1:2455';
     const apiKey = (await askPostinstallQuestion('codex-lb API key: ')).trim();
-    const configured = await configureCodexLb({ ...opts, host, apiKey });
+    const configured = await configureCodexLb({ ...opts, host, apiKey, allowUnverifiedToolOutputRecovery });
     if (configured.ok)
         console.log(`codex-lb configured: ${configured.base_url}`);
     else
@@ -1870,379 +2121,6 @@ function appliedCodexLbPersistenceModes(state = {}) {
         modes.push('none');
     return modes;
 }
-export async function ensureGlobalCodexFastModeDuringInstall(opts = {}) {
-    if (process.env.SKS_SKIP_CODEX_FAST_MODE_REPAIR === '1')
-        return { status: 'skipped', reason: 'SKS_SKIP_CODEX_FAST_MODE_REPAIR=1' };
-    const home = opts.home || process.env.HOME || os.homedir();
-    const configPath = opts.configPath || codexLbConfigPath(home);
-    try {
-        await ensureDir(path.dirname(configPath));
-        const current = await readText(configPath, '');
-        // Safety gate 1: never blind-overwrite an unparseable user config — that would
-        // entrench corruption on the file Codex actually loads. Back it up and bail.
-        if (current.trim()) {
-            const currentSmoke = codexConfigParseSmoke(current);
-            if (!currentSmoke.ok) {
-                const backupPath = await backupCodexConfig(configPath, current, 'unparseable');
-                return { status: 'unparseable_config_preserved', config_path: configPath, backup_path: backupPath, parse_smoke: currentSmoke };
-            }
-        }
-        const next = normalizeCodexFastModeUiConfig(current, {
-            forceFastMode: opts.forceFastMode === true,
-            forceFastModeOff: opts.forceFastModeOff === true
-        });
-        if (next === ensureTrailingNewline(current))
-            return { status: 'present', config_path: configPath };
-        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'codex-fast-mode-install', {
-            preserveFastUiKeys: opts.forceFastModeOff !== true
-        });
-        return {
-            status: safeWrite.status === 'written' ? 'updated' : safeWrite.status,
-            config_path: configPath,
-            backup_path: safeWrite.backup_path,
-            parse_smoke: safeWrite.ok ? undefined : safeWrite
-        };
-    }
-    catch (err) {
-        return { status: 'failed', config_path: configPath, error: err.message };
-    }
-}
-export function normalizeCodexFastModeUiConfig(text = '', opts = {}) {
-    // Run to a fixed point so a second install is a true no-op (idempotent). The per-pass
-    // table/whitespace normalization converges within one extra pass.
-    return normalizeCodexFastModeUiConfigOnce(normalizeCodexFastModeUiConfigOnce(text, opts), opts);
-}
-function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
-    // 2026-07 Codex App renewal (ChatGPT desktop merge): the config schema removed
-    // `default_profile`, `[profiles.<name>]` tables, `[user.fast_mode]`, and
-    // `notice.fast_default_opt_out`. The only documented fast-default mechanism is
-    // the plain top-level `service_tier = "fast"`. This pass strips every legacy
-    // schema stamps SKS wrote and keeps user-authored top-level choices intact.
-    let next = String(text || '');
-    next = removeLegacyTopLevelCodexModeLocks(next);
-    next = removeTopLevelTomlKeyIfValue(next, 'default_profile', 'sks-fast-high');
-    next = removeTomlTable(next, 'user.fast_mode');
-    next = removeTomlTable(next, 'profiles.sks-fast-high');
-    next = removeTomlTableKey(next, 'notice', 'fast_default_opt_out');
-    // Feature flags SKS wrote in earlier versions that are not in the current
-    // [features] reference (renewal removed/renamed them). They only trigger the
-    // under-development warning now — strip our own stamps.
-    for (const legacyFlag of [
-        'codex_hooks', 'remote_control', 'fast_mode_ui', 'codex_git_commit', 'computer_use',
-        'browser_use', 'browser_use_external', 'image_generation', 'in_app_browser',
-        'guardian_approval', 'tool_suggest', 'plugins'
-    ]) {
-        // Earlier SKS releases wrote these flags as `true`. Remove only that
-        // managed legacy value; an explicit user `false` remains authoritative.
-        next = removeTomlTableKey(next, 'features', legacyFlag, 'true');
-    }
-    if (opts.forceFastMode === true) {
-        next = upsertTopLevelTomlString(next, 'service_tier', 'fast');
-    }
-    else if (opts.forceFastModeOff === true) {
-        // "off" = remove the tier and let Codex's own default apply. The old code
-        // wrote service_tier = "default", which is not a documented tier value.
-        next = removeTopLevelTomlKey(next, 'service_tier');
-    }
-    // Documented, currently-valid feature flags are SET-IF-ABSENT: a fresh config
-    // gets SKS's defaults, but SKS never re-enables a feature the user disabled.
-    next = upsertTopLevelTomlBooleanIfAbsent(next, 'suppress_unstable_features_warning', true);
-    for (const featureLine of ['hooks = true', 'multi_agent = true', 'fast_mode = true', 'apps = true']) {
-        next = upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
-    }
-    if (process.env.SKS_ALLOW_HIGH_AGENT_CONCURRENCY !== '1') {
-        next = upsertTomlTableKey(next, 'agents', 'max_threads = 4');
-    }
-    next = removeTomlTable(next, 'features.multi_agent_v2');
-    // Plugin auto-enable is OPT-IN only. Force-writing `[plugins."name@marketplace"] enabled =
-    // true` for marketplace plugins the App may not have installed (different build/channel)
-    // makes the App reference plugins it cannot load -> broken/blocked plugin UI. It also
-    // replaced the user's whole plugin table, reverting any `enabled = false` they set. By
-    // default SKS leaves the user's [plugins] alone; opt in with SKS_MANAGE_CODEX_APP_PLUGINS=1.
-    if (process.env.SKS_MANAGE_CODEX_APP_PLUGINS === '1') {
-        for (const [name, marketplace] of DEFAULT_CODEX_APP_PLUGINS) {
-            const table = `plugins."${name}@${marketplace}"`;
-            if (!hasTomlTable(next, table))
-                next = upsertTomlTable(next, table, `[${table}]\nenabled = true`);
-        }
-    }
-    return ensureTrailingNewline(next);
-}
-function removeTopLevelTomlKey(text = '', key = '') {
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-    const end = firstTable === -1 ? lines.length : firstTable;
-    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
-    return lines.filter((line, index) => index >= end || !keyPattern.test(line)).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-}
-function removeTomlTable(text, table) {
-    const lines = String(text || '').trimEnd().split('\n');
-    const header = `[${table}]`;
-    const start = lines.findIndex((x) => x.trim() === header);
-    if (start === -1)
-        return String(text || '');
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i += 1) {
-        const ln = lines[i];
-        if (ln !== undefined && /^\s*\[.+\]\s*$/.test(ln)) {
-            end = i;
-            break;
-        }
-    }
-    return lines.filter((_, index) => index < start || index >= end).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-}
-function removeLegacyTopLevelCodexModeLocks(text = '') {
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-    const end = firstTable === -1 ? lines.length : firstTable;
-    return lines.filter((line, index) => {
-        if (index >= end)
-            return true;
-        if (!/^\s*(?:model|model_reasoning_effort)\s*=/.test(line))
-            return true;
-        return ![line, lines[index - 1] || ''].some((candidate) => {
-            const trimmed = String(candidate || '').trim();
-            const comment = trimmed.startsWith('#') ? trimmed : trimmed.includes('#') ? trimmed.slice(trimmed.indexOf('#')) : '';
-            return /(?:SKS|Sneakoscope|codex-lb|sks fast)/i.test(comment);
-        });
-    }).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-}
-function removeTopLevelTomlKeyIfValue(text = '', key = '', value = '') {
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-    const end = firstTable === -1 ? lines.length : firstTable;
-    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"${escapeRegExp(value)}"\\s*(?:#.*)?$`);
-    return lines.filter((line, index) => index >= end || !keyPattern.test(line)).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-}
-function removeTomlTableKey(text, table, key, expectedValue = null) {
-    const lines = String(text || '').trimEnd().split('\n');
-    if (lines.length === 1 && lines[0] === '')
-        return '';
-    const header = `[${table}]`;
-    const start = lines.findIndex((x) => x.trim() === header);
-    if (start === -1)
-        return String(text || '');
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i += 1) {
-        const ln = lines[i];
-        if (ln === undefined)
-            continue;
-        if (/^\s*\[.+\]\s*$/.test(ln)) {
-            end = i;
-            break;
-        }
-    }
-    const valuePattern = expectedValue === null
-        ? ''
-        : `\\s*${escapeRegExp(String(expectedValue))}\\s*(?:#.*)?$`;
-    const keyPattern = new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=${valuePattern}`);
-    return lines.filter((line, index) => index <= start || index >= end || !keyPattern.test(line)).join('\n').replace(/\n{3,}/g, '\n\n');
-}
-function upsertTomlTableKey(text, table, line) {
-    const key = String(line).split('=')[0]?.trim() ?? '';
-    const lines = String(text || '').trimEnd().split('\n');
-    if (lines.length === 1 && lines[0] === '')
-        lines.length = 0;
-    const header = `[${table}]`;
-    const start = lines.findIndex((x) => x.trim() === header);
-    if (start === -1)
-        return [...lines, ...(lines.length ? [''] : []), header, line].join('\n').replace(/\n{3,}/g, '\n\n');
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i++) {
-        const ln = lines[i];
-        if (ln === undefined)
-            continue;
-        if (/^\s*\[.+\]\s*$/.test(ln)) {
-            end = i;
-            break;
-        }
-    }
-    const keyRe = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
-    for (let i = start + 1; i < end; i++) {
-        const ln = lines[i];
-        if (ln === undefined)
-            continue;
-        if (keyRe.test(ln)) {
-            lines[i] = line;
-            return lines.join('\n').replace(/\n{3,}/g, '\n\n');
-        }
-    }
-    if (hasTomlTableKey(lines.join('\n'), table, key))
-        return lines.join('\n').replace(/\n{3,}/g, '\n\n');
-    lines.splice(end, 0, line);
-    return lines.join('\n').replace(/\n{3,}/g, '\n\n');
-}
-// True if [table] already declares `key` (so we never override a user's explicit value).
-function hasTomlTableKey(text, table, key) {
-    const lines = String(text || '').split('\n');
-    const header = `[${table}]`;
-    const start = lines.findIndex((x) => x.trim() === header);
-    if (start === -1)
-        return false;
-    const keyRe = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
-    for (let i = start + 1; i < lines.length; i += 1) {
-        const ln = lines[i];
-        if (ln === undefined)
-            continue;
-        if (/^\s*\[.+\]\s*$/.test(ln))
-            break;
-        if (keyRe.test(ln))
-            return true;
-    }
-    return false;
-}
-// Set a [table] key only when absent — preserves a Codex App feature the user toggled off
-// (so SKS never re-enables / re-surfaces UI the user hid). On a fresh config the key/table
-// is still created, preserving fresh-install enablement.
-function upsertTomlTableKeyIfAbsent(text, table, line) {
-    const key = String(line).split('=')[0]?.trim() ?? '';
-    return hasTomlTableKey(text, table, key) ? String(text || '') : upsertTomlTableKey(text, table, line);
-}
-function upsertTopLevelTomlBooleanIfAbsent(text, key, value) {
-    return hasTopLevelTomlKey(text, key) ? String(text || '') : upsertTopLevelTomlBoolean(text, key, value);
-}
-function ensureTrailingNewline(text = '') {
-    const value = String(text || '').trimEnd();
-    return value ? `${value}\n` : '';
-}
-function upsertTopLevelTomlString(text, key, value) {
-    const line = `${key} = "${value}"`;
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-    const end = firstTable === -1 ? lines.length : firstTable;
-    for (let i = 0; i < end; i++) {
-        const ln = lines[i];
-        if (ln === undefined)
-            continue;
-        if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(ln)) {
-            lines[i] = line;
-            return lines.join('\n').replace(/\n{3,}/g, '\n\n');
-        }
-    }
-    lines.splice(end, 0, line);
-    return lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-}
-function hasTopLevelTomlKey(text, key) {
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-    const end = firstTable === -1 ? lines.length : firstTable;
-    const pattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
-    for (let i = 0; i < end; i += 1) {
-        if (typeof lines[i] === 'string' && pattern.test(lines[i]))
-            return true;
-    }
-    return false;
-}
-// Preserve a user's deliberate top-level scalar (model/service_tier/reasoning); only set
-// the SKS default when the key is ABSENT. This is what stops `npm i -g` from clobbering
-// a user's global Codex config on every update.
-function upsertTopLevelTomlStringIfAbsent(text, key, value) {
-    return hasTopLevelTomlKey(text, key) ? String(text || '') : upsertTopLevelTomlString(text, key, value);
-}
-// Lightweight safety gate: detect clearly-broken TOML so we never overwrite (or produce)
-// an unparseable config that Codex itself would reject. Mirrors the project-config smoke.
-function codexConfigParseSmoke(text = '') {
-    const str = String(text || '');
-    const tripleTokens = (str.match(/"""|'''/g) || []).length;
-    const unterminatedTriple = tripleTokens % 2 !== 0;
-    const invalidHeader = str.split('\n').find((line) => /^\s*\[/.test(line) && !/^\s*\[\[?[^\]]+\]\]?\s*(?:#.*)?$/.test(line)) || null;
-    return { ok: !unterminatedTriple && !invalidHeader, unterminated_multiline_string: unterminatedTriple, invalid_table_header: invalidHeader };
-}
-async function backupCodexConfig(configPath, text, tag) {
-    try {
-        const stamp = `${PACKAGE_VERSION}-${Date.now().toString(36)}`;
-        const backupPath = `${configPath}.sks-${tag}-${stamp}.bak`;
-        await writeTextAtomic(backupPath, text);
-        await cleanupCodexConfigBackups(configPath, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
-        return backupPath;
-    }
-    catch {
-        return null;
-    }
-}
-// Single TOML-safe gate for every codex-lb config write. Mirrors the fast-mode safety so the
-// codex-lb path can NEVER corrupt ~/.codex/config.toml on install (esp. a fresh/initial one):
-//   - refuse to overwrite an existing config that is already unparseable (back it up, bail),
-//   - refuse to WRITE a result that would not parse (e.g. a regex helper mangled a multiline
-//     string), leaving the existing config untouched,
-//   - otherwise back up the prior config before mutating.
-export async function safeWriteCodexConfigToml(configPath, current, next, tag = 'codex-lb', opts = {}) {
-    return writeCodexConfigGuarded({
-        configPath,
-        before: String(current || ''),
-        cause: tag,
-        removeTopLevelModeLocks: true,
-        ...(opts.preserveFastUiKeys === undefined ? {} : { preserveFastUiKeys: opts.preserveFastUiKeys }),
-        mutate: () => String(next || '')
-    });
-}
-export function codexFastModeDesktopStatus(text = '') {
-    const validation = validateCodexConfigRoundTrip(String(text || ''));
-    // Post-renewal contract: the fast default is the plain top-level
-    // service_tier = "fast". default_profile/[profiles.*]/[user.fast_mode] are
-    // gone from the Codex config schema and are only reported as legacy_keys.
-    const globalOn = validation.ok && validation.service_tier === 'fast';
-    return {
-        schema: 'sks.codex-fast-mode-desktop-status.v2',
-        ok: validation.ok,
-        on: Boolean(globalOn),
-        service_tier: validation.service_tier ?? null,
-        model: validation.model ?? null,
-        legacy_keys: validation.legacy_keys,
-        validation: {
-            ok: validation.ok,
-            blockers: validation.blockers,
-            parse_error: validation.parse_error || null,
-            service_tier: validation.service_tier ?? null,
-            model: validation.model ?? null,
-            model_reasoning_effort: validation.model_reasoning_effort ?? null,
-            legacy_keys: validation.legacy_keys
-        }
-    };
-}
-function upsertTopLevelTomlBoolean(text, key, value) {
-    const line = `${key} = ${value ? 'true' : 'false'}`;
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-    const end = firstTable === -1 ? lines.length : firstTable;
-    for (let i = 0; i < end; i += 1) {
-        const ln = lines[i];
-        if (ln === undefined)
-            continue;
-        if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(ln)) {
-            lines[i] = line;
-            return lines.join('\n').replace(/\n{3,}/g, '\n\n');
-        }
-    }
-    lines.splice(end, 0, line);
-    return lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-}
-function hasTomlTable(text, table) {
-    const header = `[${table}]`;
-    return String(text || '').split('\n').some((line) => String(line).trim() === header);
-}
-function upsertTomlTable(text, table, block) {
-    let lines = String(text || '').trimEnd().split('\n');
-    if (lines.length === 1 && lines[0] === '')
-        lines = [];
-    const header = `[${table}]`;
-    const start = lines.findIndex((x) => x.trim() === header);
-    const blockLines = String(block || '').trim().split('\n');
-    if (start === -1)
-        return [...lines, ...(lines.length ? [''] : []), ...blockLines].join('\n').replace(/\n{3,}/g, '\n\n');
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i++) {
-        const ln = lines[i];
-        if (ln === undefined)
-            continue;
-        if (/^\s*\[.+\]\s*$/.test(ln)) {
-            end = i;
-            break;
-        }
-    }
-    lines.splice(start, end - start, ...blockLines);
-    return lines.join('\n').replace(/\n{3,}/g, '\n\n');
-}
 function shellSingleQuote(value) {
     return `'${String(value).replace(/'/g, `'\\''`)}'`;
 }
@@ -2562,273 +2440,6 @@ export async function ensureCodexImagegenDuringInstall(opts = {}) {
         return { status: 'recovered', report };
     return { status: 'blocked', blockers: report.blockers || ['codex_imagegen_unavailable'], report };
 }
-export async function ensureRelatedCliTools(args = []) {
-    const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
-    const codex = await ensureCodexCliTool({ skip, args });
-    const zellijRepair = skip ? { status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' } : await ensureZellijCliTool(args);
-    const zellij = await checkZellijCapability({ require: false, writeReport: false });
-    return {
-        codex,
-        zellij: {
-            ok: zellij.status === 'ok',
-            bin: zellij.bin,
-            version: zellij.version,
-            min_version: zellij.min_version,
-            current_session: false,
-            repair: zellijRepair,
-            install_hint: zellij.status === 'ok' ? null : zellijInstallHint(),
-            error: zellijRepair.error || zellij.blockers[0] || zellij.warnings[0] || null
-        }
-    };
-}
-export async function ensureMadLaunchDependencies(args = []) {
-    const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
-    const zellijRepair = skip ? { target: 'zellij', status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' } : await ensureZellijCliTool(args);
-    const zellij = await checkZellijCapability({ require: false, writeReport: false });
-    const ready = zellij.status === 'ok';
-    return {
-        ready,
-        actions: ready ? [] : [{
-                target: 'zellij',
-                status: zellijRepair.status,
-                command: zellijRepair.command || zellijInstallHint(),
-                error: zellijRepair.error || zellij.blockers[0] || zellij.warnings[0] || null,
-                repair: zellijRepair
-            }],
-        status: {
-            zellij: {
-                ok: ready,
-                status: zellij.status,
-                version: zellij.version,
-                min_version: zellij.min_version,
-                repair: zellijRepair,
-                install_hint: ready ? null : zellijInstallHint()
-            }
-        }
-    };
-}
-export function formatMadLaunchDependencyAction(action = {}) {
-    const command = action.command ? ` Run: ${action.command}.` : '';
-    const error = action.error ? ` ${action.error}` : '';
-    return `${action.target || 'dependency'} ${action.status || 'blocked'}.${command}${error}`.trim();
-}
-export async function ensureCodexCliTool({ skip = false, args = [] } = {}) {
-    if (skip)
-        return { status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' };
-    const before = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
-    if (before.bin)
-        return { status: 'present', bin: before.bin, version: before.version || null };
-    const npmBin = await which('npm');
-    if (!npmBin)
-        return { status: 'failed', error: 'npm not found on PATH; install Codex CLI manually with npm i -g @openai/codex@latest.' };
-    const command = 'npm i -g @openai/codex@latest';
-    if (args.includes('--dry-run'))
-        return { status: 'dry_run', command, error: 'Codex CLI not found on PATH.' };
-    if (!await confirmInstallYesDefault(`Codex CLI is missing. Install latest Codex CLI with ${command}?`, args)) {
-        return { status: 'needs_approval', command, error: 'Codex CLI not found on PATH.' };
-    }
-    // Global package install is a confirmation-required mutation: route it through
-    // the mutation guard so it is scope-checked and recorded in the ledger. The
-    // user already approved via confirmInstallYesDefault above (confirmed:true).
-    const installRoot = globalSksRoot();
-    const installContract = createRequestedScopeContract({
-        route: 'install', userRequest: command, projectRoot: installRoot, overrides: { package_install: true }
-    });
-    const install = await guardedPackageInstall(guardContextForRoute(installRoot, installContract, command), '@openai/codex@latest', { confirmed: true, command: npmBin, args: ['i', '-g', '@openai/codex@latest'], timeoutMs: 120000 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
-    if (install.code !== 0) {
-        return { status: 'failed', error: `${install.stderr || install.stdout || 'npm i -g @openai/codex@latest failed'}`.trim() };
-    }
-    const after = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
-    return {
-        status: after.bin ? 'installed' : 'installed_not_on_path',
-        bin: after.bin || null,
-        version: after.version || null,
-        hint: after.bin ? null : 'npm completed, but codex is not on PATH. Restart the shell or set SKS_CODEX_BIN.'
-    };
-}
-export async function ensureZellijCliTool(args = [], opts = {}) {
-    const before = await checkZellijCapability({ require: false, writeReport: false });
-    if (before.status === 'ok')
-        return { target: 'zellij', status: 'present', bin: before.bin, version: before.version || null };
-    const command = zellijInstallHint();
-    if (process.platform !== 'darwin')
-        return { target: 'zellij', status: 'manual_required', command, error: before.blockers[0] || before.warnings[0] || 'zellij not found' };
-    const brew = await which('brew').catch(() => null);
-    if (!brew)
-        return { target: 'zellij', status: 'manual_required', command: 'Install Homebrew, then run: brew install zellij', error: before.blockers[0] || before.warnings[0] || 'zellij not found' };
-    const repairCommand = command;
-    if (args.includes('--dry-run') || opts.dryRun)
-        return { target: 'zellij', status: 'dry_run', command: repairCommand, error: before.blockers[0] || before.warnings[0] || null };
-    const hasInstalledZellij = Boolean(before.version);
-    const question = hasInstalledZellij
-        ? `Homebrew Zellij ${before.version || 'unknown'} is not ready. Upgrade to latest Zellij with ${repairCommand}?`
-        : `Zellij is missing. Install latest Zellij with ${repairCommand}?`;
-    if (!await confirmInstallYesDefault(question, args))
-        return { target: 'zellij', status: 'needs_approval', command: repairCommand, error: before.blockers[0] || before.warnings[0] || null };
-    const brewArgs = hasInstalledZellij ? ['upgrade', 'zellij'] : ['install', 'zellij'];
-    const zellijRoot = globalSksRoot();
-    const zellijContract = createRequestedScopeContract({
-        route: 'install', userRequest: repairCommand, projectRoot: zellijRoot, overrides: { package_install: true, zellij_install: true }
-    });
-    const install = await guardedPackageInstall(guardContextForRoute(zellijRoot, zellijContract, repairCommand), 'zellij', { confirmed: true, command: brew, args: brewArgs, timeoutMs: 180000 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
-    if (install.code !== 0)
-        return { target: 'zellij', status: 'failed', command: repairCommand, error: `${install.stderr || install.stdout || repairCommand + ' failed'}`.trim() };
-    const after = await checkZellijCapability({ require: false, writeReport: false });
-    if (after.status !== 'ok')
-        return { target: 'zellij', status: 'installed_not_ready', command: repairCommand, error: after.blockers[0] || after.warnings[0] || 'zellij installed but not ready' };
-    return { target: 'zellij', status: hasInstalledZellij ? 'upgraded' : 'installed', command: repairCommand, bin: after.bin, version: after.version || null };
-}
-function zellijInstallHint() {
-    return process.platform === 'darwin' ? 'brew install zellij' : 'Install Zellij from https://zellij.dev/documentation/installation.html';
-}
-async function confirmInstallYesDefault(question, args = []) {
-    if (hasFlag(args, '--from-postinstall') && process.env.SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS !== '1')
-        return false;
-    if (shouldAutoApproveInstall(args))
-        return true;
-    if (!canAskYesNo())
-        return false;
-    const answer = (await askPostinstallQuestion(`${question} [Y/n] `)).trim();
-    return answer === '' || /^(y|yes|예|네|응)$/i.test(answer);
-}
-export async function maybePromptCodexUpdateForLaunch(args = [], opts = {}) {
-    if (hasFlag(args, '--json') || hasFlag(args, '--skip-cli-tools') || hasFlag(args, '--skip-codex-update') || process.env.SKS_SKIP_CODEX_UPDATE === '1')
-        return { status: 'skipped' };
-    const latest = await npmPackageVersion('@openai/codex');
-    const codex = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
-    const current = codexCliVersionNumber(codex.version);
-    const command = 'npm i -g @openai/codex@latest';
-    const label = opts.label || 'Zellij launch';
-    const missing = !codex.bin;
-    const updateAvailable = Boolean(latest.version && current && compareVersions(latest.version, current) > 0);
-    if (!missing && !updateAvailable)
-        return { status: 'current', latest: latest.version || null, current, bin: codex.bin || null, error: latest.error || null };
-    const prompt = missing
-        ? `Codex CLI missing. Install @openai/codex${latest.version ? ` ${latest.version}` : '@latest'} before ${label}? [Y/n] `
-        : `Codex CLI ${current} -> ${latest.version} update before ${label}? [Y/n] `;
-    if (shouldAutoApproveInstall(args))
-        return installCodexLatest(command, latest.version, current);
-    if (!canAskYesNo()) {
-        const reason = missing ? 'Codex CLI missing' : `Codex CLI update available: ${current} -> ${latest.version}`;
-        console.log(`${reason}. Run: ${command}`);
-        return { status: missing ? 'missing' : 'available', latest: latest.version || null, current, command, bin: codex.bin || null };
-    }
-    const answer = (await askPostinstallQuestion(prompt)).trim();
-    const yes = answer === '' || /^(y|yes|예|네|응)$/i.test(answer);
-    if (!yes)
-        return { status: 'skipped_by_user', latest: latest.version || null, current, command, bin: codex.bin || null };
-    return installCodexLatest(command, latest.version, current);
-}
-export async function maybePromptSksUpdateForLaunch(args = [], opts = {}) {
-    void args;
-    void opts;
-    return {
-        status: 'skipped',
-        reason: 'manual_update_commands_only',
-        current: PACKAGE_VERSION,
-        latest: null,
-        command: null
-    };
-}
-export function shouldAutoApproveInstall(args = [], env = process.env) {
-    if (hasFlag(args, '--from-postinstall') && env.SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS !== '1')
-        return false;
-    if (hasFlag(args, '--from-postinstall') && env.SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS === '1')
-        return true;
-    return hasFlag(args, '--yes') || hasFlag(args, '-y') || isAgentRuntime(env);
-}
-function canAskYesNo() {
-    return Boolean(input.isTTY && output.isTTY && process.env.CI !== 'true');
-}
-function hasFlag(args = [], name) {
-    return args.includes(name);
-}
-function isAgentRuntime(env = process.env) {
-    return [
-        'SKS_OPENCLAW',
-        'OPENCLAW',
-        'OPENCLAW_AGENT',
-        'OPENCLAW_RUN_ID',
-        'OPENCLAW_SESSION_ID',
-        'SKS_HERMES',
-        'HERMES_AGENT',
-        'HERMES_RUN_ID',
-        'HERMES_SESSION_ID'
-    ]
-        .some((key) => /^(1|true|yes|y)$/i.test(String(env[key] || '').trim()));
-}
-async function installCodexLatest(command, latestVersion, previousVersion = null) {
-    const npm = await which('npm').catch(() => null);
-    if (!npm)
-        return { status: 'failed', latest: latestVersion || null, previous: previousVersion || null, command, error: 'npm not found on PATH' };
-    const install = await runProcess(npm, ['i', '-g', '@openai/codex@latest'], { timeoutMs: 180000, maxOutputBytes: 128 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
-    if (install.code !== 0)
-        return { status: 'failed', latest: latestVersion || null, previous: previousVersion || null, command, error: `${install.stderr || install.stdout || command + ' failed'}`.trim() };
-    const after = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
-    const afterVersion = codexCliVersionNumber(after.version);
-    if (!after.bin)
-        return { status: 'updated_not_reflected', latest: latestVersion || null, previous: previousVersion || null, version: afterVersion || null, command, error: 'npm completed, but codex is not on PATH. Restart the shell or set SKS_CODEX_BIN.' };
-    if (latestVersion && afterVersion && compareVersions(afterVersion, latestVersion) < 0) {
-        return { status: 'updated_not_reflected', latest: latestVersion, previous: previousVersion || null, version: afterVersion, bin: after.bin, command, error: `npm completed, but PATH still resolves Codex CLI ${afterVersion}; expected ${latestVersion}.` };
-    }
-    console.log(`Codex CLI ready: ${previousVersion || 'missing'} -> ${after.version || after.bin}`);
-    return { status: previousVersion ? 'updated' : 'installed', latest: latestVersion || null, previous: previousVersion || null, version: afterVersion || null, raw_version: after.version || null, bin: after.bin || null, command };
-}
-function codexCliVersionNumber(versionText = '') {
-    const match = String(versionText || '').match(/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/);
-    return match ? match[1] : null;
-}
-async function npmPackageVersion(name) {
-    const envName = `SKS_NPM_VIEW_${String(name || '').replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_VERSION`;
-    if (process.env[envName])
-        return { version: process.env[envName] };
-    const npm = await which('npm').catch(() => null);
-    if (!npm)
-        return { error: 'npm not found' };
-    const result = await runProcess(npm, ['view', name, 'version'], { timeoutMs: 5000, maxOutputBytes: 4096 });
-    if (result.code !== 0)
-        return { error: `${result.stderr || result.stdout || 'npm view failed'}`.trim() };
-    return { version: result.stdout.trim().split(/\s+/).pop() };
-}
-function compareVersions(a, b) {
-    const pa = String(a || '').split(/[.-]/).map((x) => Number.parseInt(x, 10) || 0);
-    const pb = String(b || '').split(/[.-]/).map((x) => Number.parseInt(x, 10) || 0);
-    for (let i = 0; i < Math.max(pa.length, pb.length, 3); i++) {
-        if ((pa[i] || 0) > (pb[i] || 0))
-            return 1;
-        if ((pa[i] || 0) < (pb[i] || 0))
-            return -1;
-    }
-    return 0;
-}
-async function isProjectSetupCandidate(root) {
-    const markers = ['package.json', '.git', 'AGENTS.md', '.codex', '.sneakoscope'];
-    for (const marker of markers) {
-        if (await exists(path.join(root, marker)))
-            return true;
-    }
-    return false;
-}
-export async function checkContext7(root) {
-    const projectPath = path.join(root, '.codex', 'config.toml');
-    const globalPath = path.join(process.env.HOME || '', '.codex', 'config.toml');
-    const projectText = await safeReadText(projectPath);
-    const globalText = await safeReadText(globalPath);
-    const codex = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
-    let list = { checked: false, ok: false, stdout: '', stderr: '' };
-    if (codex.bin) {
-        const out = await runProcess(codex.bin, ['mcp', 'list'], { timeoutMs: 8000, maxOutputBytes: 32 * 1024 }).catch((err) => ({ code: 1, stderr: err.message, stdout: '' }));
-        list = { checked: true, ok: out.code === 0 && /context7/i.test(`${out.stdout}\n${out.stderr}`), stdout: out.stdout || '', stderr: out.stderr || '' };
-    }
-    const result = {
-        ok: false,
-        project: { path: projectPath, ok: hasContext7ConfigText(projectText) },
-        global: { path: globalPath, ok: hasContext7ConfigText(globalText) },
-        codex_mcp_list: list
-    };
-    result.ok = result.project.ok || result.codex_mcp_list.ok || (result.global.ok && !list.checked);
-    return result;
-}
 export async function ensureProjectContext7Config(root, transport = 'local') {
     const configPath = path.join(root, '.codex', 'config.toml');
     await ensureDir(path.dirname(configPath));
@@ -3435,14 +3046,14 @@ export async function selftestCodexLb(tmp) {
     });
     if (brokenChain.ok || brokenChain.status !== 'previous_response_not_found' || brokenChain.chain_unhealthy !== true)
         throw new Error('selftest: codex-lb response chain health check did not detect previous_response_not_found');
-    // 2026-07 renewal contract: only documented [features] flags remain; the flags,
-    // [user.fast_mode], [profiles.sks-fast-high], and notice.fast_default_opt_out SKS
-    // used to write must be STRIPPED by setup. User-authored tables ([profiles.custom])
-    // are preserved untouched even though the schema dropped profile tables.
-    const legacyStamps = ['remote_control = true', 'fast_mode_ui = true', 'codex_git_commit = true', 'computer_use = true', 'browser_use = true', 'browser_use_external = true', 'guardian_approval = true', 'tool_suggest = true', 'plugins = true', '[user.fast_mode]', '[profiles.sks-fast-high]', 'fast_default_opt_out = true'];
+    // 0.144 contract: removed feature stamps and legacy fast profile tables are
+    // stripped, while stable Computer Use/Browser/ImageGen/plugin flags remain.
+    const legacyStamps = ['remote_control = true', 'fast_mode_ui = true', 'codex_git_commit = true', '[user.fast_mode]', '[profiles.sks-fast-high]', 'fast_default_opt_out = true'];
     const survivingLegacy = legacyStamps.filter((stamp) => codexLbConfig.includes(stamp));
-    if (!codexLbConfig.includes('hooks = true') || hasDeprecatedCodexHooksFeatureFlag(codexLbConfig) || !codexLbConfig.includes('multi_agent = true') || !codexLbConfig.includes('fast_mode = true') || !codexLbConfig.includes('apps = true') || survivingLegacy.length || !/\[profiles\.custom\][\s\S]*?model_reasoning_effort = "low"/.test(codexLbConfig) || hasTopLevelCodexModeLock(codexLbConfig))
-        throw new Error(`selftest: codex-lb setup did not enforce the renewed feature-flag contract (documented flags present, legacy stamps stripped, user profile tables preserved)${survivingLegacy.length ? ` — surviving legacy stamps: ${survivingLegacy.join(', ')}` : ''}`);
+    const stableCapabilityStamps = ['computer_use = true', 'browser_use = true', 'browser_use_external = true', 'image_generation = true', 'in_app_browser = true', 'guardian_approval = true', 'tool_suggest = true', 'plugins = true'];
+    const missingStableCapabilities = stableCapabilityStamps.filter((stamp) => !codexLbConfig.includes(stamp));
+    if (!codexLbConfig.includes('hooks = true') || hasDeprecatedCodexHooksFeatureFlag(codexLbConfig) || !codexLbConfig.includes('multi_agent = true') || !codexLbConfig.includes('fast_mode = true') || !codexLbConfig.includes('apps = true') || survivingLegacy.length || missingStableCapabilities.length || !/\[profiles\.custom\][\s\S]*?model_reasoning_effort = "low"/.test(codexLbConfig) || hasTopLevelCodexModeLock(codexLbConfig))
+        throw new Error(`selftest: codex-lb setup did not enforce the current feature-flag contract${survivingLegacy.length ? ` — surviving legacy stamps: ${survivingLegacy.join(', ')}` : ''}${missingStableCapabilities.length ? ` — missing stable capabilities: ${missingStableCapabilities.join(', ')}` : ''}`);
     if (!hasCodexUnstableFeatureWarningSuppression(codexLbConfig))
         throw new Error('selftest: codex-lb setup did not suppress Codex unstable feature warning');
     const codexLbLaunch = `source ${path.join(tmp, '.codex', 'sks-codex-lb.env')} && codex`;
@@ -3454,30 +3065,4 @@ export async function selftestCodexLb(tmp) {
     if (!madLaunchSource.includes('const lb = await deps.maybePromptCodexLbSetupForLaunch(args)') || !madLaunchSource.includes("const launchLb = lb.status === 'present'") || !madLaunchSource.includes('codexLbImmediateLaunchOpts(cleanArgs, launchLb') || !madLaunchSource.includes('bypass_codex_lb') || !madLaunchSource.includes('model_provider="openai"') || !madLaunchSource.includes('codexLbFreshSession: true'))
         throw new Error('selftest: MAD launch does not sync codex-lb auth and fresh-session launch options');
 }
-function hasTopLevelCodexModeLock(text = '') {
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-    const top = (firstTable === -1 ? lines : lines.slice(0, firstTable)).join('\n');
-    return /(^|\n)\s*model_reasoning_effort\s*=/.test(top);
-}
-function hasDeprecatedCodexHooksFeatureFlag(text = '') {
-    const lines = String(text || '').split('\n');
-    const start = lines.findIndex((line) => line.trim() === '[features]');
-    if (start === -1)
-        return false;
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i += 1) {
-        const line = lines[i];
-        if (line === undefined)
-            continue;
-        if (/^\s*\[.+\]\s*$/.test(line)) {
-            end = i;
-            break;
-        }
-    }
-    return lines.slice(start + 1, end).some((line) => /^\s*codex_hooks\s*=/.test(line));
-}
-function hasCodexUnstableFeatureWarningSuppression(text = '') {
-    return /(^|\n)\s*suppress_unstable_features_warning\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(String(text || ''));
-}
 //# sourceMappingURL=install-helpers.js.map