sneakoscope 6.1.2 → 6.4.0

package/dist/cli/commands-fast.js

@@ -26,4 +26,3 @@ function fastCommandRow(entry) {
         row.hidden = true;
     return row;
 }
-//# sourceMappingURL=commands-fast.js.map

package/dist/cli/context7-command.js

@@ -202,4 +202,3 @@ async function resolveMissionId(root, arg) {
     const { findLatestMission } = await import('../core/mission.js');
     return (!arg || arg === 'latest') ? findLatestMission(root) : arg;
 }
-//# sourceMappingURL=context7-command.js.map

package/dist/cli/feature-commands.js

@@ -489,4 +489,3 @@ function printFeatureCoverage(coverage = {}) {
     if (coverage.blockers?.length)
         console.log(`Blockers: ${coverage.blockers.join(', ')}`);
 }
-//# sourceMappingURL=feature-commands.js.map

package/dist/cli/global-mode-router.js

@@ -1,4 +1,24 @@
 const RESERVED_COMMANDS = new Set(['help', '--help', '-h', 'version', '--version', '-v']);
+const RETIRED_NARUTO_OPTION = ['--', 'naruto'].join('');
+const RETIRED_AGENT_OPTION = ['--', 'agent'].join('');
+const RETIRED_CLONES_OPTION = ['--', 'clones'].join('');
+const RETIRED_GLOBAL_EXECUTION_OPTION_NAMES = new Set([
+    RETIRED_NARUTO_OPTION,
+    RETIRED_AGENT_OPTION,
+    RETIRED_CLONES_OPTION,
+    '--mad-db',
+    '--mad-native-swarm',
+    '--mad-swarm',
+    '--no-swarm',
+    '--no-mad-swarm',
+    '--mad-agents',
+    '--mad-swarm-agents',
+    '--mad-swarm-work-items',
+    '--mad-swarm-backend',
+    '--mad-swarm-prompt',
+    '--tmux-smoke',
+    '--require-tmux-smoke'
+]);
 export function detectGlobalMode(args = []) {
     if (!args.length || RESERVED_COMMANDS.has(String(args[0])))
         return null;
@@ -14,6 +34,17 @@ export function detectGlobalMode(args = []) {
 export function stripGlobalModeFlags(args) {
     return args.filter((arg) => arg !== '--mad' && arg !== '--glm');
 }
+export function findRetiredGlobalExecutionArgumentErrors(args = []) {
+    const errors = [];
+    for (const value of args) {
+        const arg = String(value);
+        const separator = arg.indexOf('=');
+        const name = separator >= 0 ? arg.slice(0, separator) : arg;
+        if (RETIRED_GLOBAL_EXECUTION_OPTION_NAMES.has(name))
+            errors.push(`unsupported_argument:${name}`);
+    }
+    return [...new Set(errors)];
+}
 export function glmWithoutMadResult() {
     return {
         ok: false,
@@ -23,4 +54,3 @@ export function glmWithoutMadResult() {
         hint: 'use sks --mad --glm'
     };
 }
-//# sourceMappingURL=global-mode-router.js.map

package/dist/cli/help-fast.js

@@ -6,9 +6,8 @@ SNEAKOSCOPE CODEX v${PACKAGE_VERSION}
 
 3-pillar frontdoor
 
-  $Plan "task"              plan only; writes .sneakoscope/plans, no code edits
-  $Work                     execute the latest plan with evidence gates
-  $Swarm "task"             Naruto alias for the Codex official subagent workflow
+  $sks-plan "task"          plan only; writes .sneakoscope/plans, no code edits
+  $sks-work                 execute the latest plan with evidence gates
 
 Local surfaces
 
@@ -35,4 +34,3 @@ function commandRows() {
         maturity: entry.maturity
     })).sort((a, b) => a.name.localeCompare(b.name));
 }
-//# sourceMappingURL=help-fast.js.map

package/dist/cli/install-helpers-codex-lb-chain.js

@@ -0,0 +1,274 @@
+import path from 'node:path';
+import os from 'node:os';
+import fsp from 'node:fs/promises';
+import { ensureDir, packageRoot, readText, writeTextAtomic } from '../core/fsx.js';
+import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
+import { CODEX_LB_CANONICAL_FAST_SERVICE_TIER, codexLbEnvPath, parseCodexLbEnvKey, redactSecretText } from './install-helpers-codex-lb-shared.js';
+function codexLbResponsesEndpoint(baseUrl = '') {
+    const base = String(baseUrl || '').trim().replace(/\/+$/, '');
+    if (!base)
+        return '';
+    return /\/responses$/i.test(base) ? base : `${base}/responses`;
+}
+function codexLbChainCheckEnabled(env = process.env) {
+    return env.SKS_CODEX_LB_CHAIN_CHECK !== '0' && env.SKS_SKIP_CODEX_LB_CHAIN_CHECK !== '1';
+}
+function codexLbChainCachePath(home = process.env.HOME || os.homedir()) {
+    return path.join(home, '.codex', 'sks-codex-lb-chain-health.json');
+}
+function codexLbChainCacheTtlMs(status = '', env = process.env) {
+    const hardFailure = Boolean(status && !['chain_ok', 'previous_response_not_found'].includes(status));
+    const key = hardFailure ? 'SKS_CODEX_LB_CHAIN_CHECK_FAILURE_CACHE_TTL_MS' : 'SKS_CODEX_LB_CHAIN_CHECK_CACHE_TTL_MS';
+    const fallback = hardFailure ? 30 * 1000 : 5 * 60 * 1000;
+    const raw = env[key] ?? env.SKS_CODEX_LB_CHAIN_CHECK_CACHE_TTL_MS;
+    if (raw === undefined || raw === '')
+        return fallback;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) ? Math.max(0, parsed) : fallback;
+}
+function codexLbChainCacheEnabled(opts = {}, env = process.env) {
+    if (opts.force || opts.cache === false)
+        return false;
+    if (opts.fetch)
+        return false;
+    if (env.SKS_CODEX_LB_CHAIN_CHECK_CACHE === '0')
+        return false;
+    return true;
+}
+async function readCodexLbChainCache({ endpoint, home, opts = {}, env = process.env } = {}) {
+    if (!endpoint || !codexLbChainCacheEnabled(opts, env))
+        return null;
+    const cachePath = opts.cachePath || codexLbChainCachePath(home || env.HOME || os.homedir());
+    const text = await readText(cachePath, '');
+    if (!text.trim())
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed?.schema !== 'sks.codex-lb-chain-health.v1' || parsed.endpoint !== endpoint || !parsed.result?.status)
+            return null;
+        const now = typeof opts.now === 'function' ? opts.now() : Date.now();
+        const checkedAt = Number(parsed.checked_at_ms || 0);
+        const ttlMs = codexLbChainCacheTtlMs(parsed.result.status, env);
+        if (!checkedAt || ttlMs <= 0 || now - checkedAt > ttlMs)
+            return null;
+        return {
+            ...parsed.result,
+            endpoint,
+            cached: true,
+            cache_path: cachePath,
+            cache_age_ms: Math.max(0, now - checkedAt)
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function writeCodexLbChainCache(result = {}, { endpoint, home, opts = {}, env = process.env } = {}) {
+    if (!endpoint || !result.status || !codexLbChainCacheEnabled(opts, env))
+        return result;
+    const cachePath = opts.cachePath || codexLbChainCachePath(home || env.HOME || os.homedir());
+    const now = typeof opts.now === 'function' ? opts.now() : Date.now();
+    const cacheResult = {
+        ok: Boolean(result.ok),
+        status: result.status,
+        chain_unhealthy: result.chain_unhealthy === true,
+        http_status: result.http_status || null,
+        error: result.error || null
+    };
+    try {
+        await ensureDir(path.dirname(cachePath));
+        await writeTextAtomic(cachePath, `${JSON.stringify({
+            schema: 'sks.codex-lb-chain-health.v1',
+            endpoint,
+            checked_at_ms: now,
+            result: cacheResult
+        }, null, 2)}\n`);
+        await fsp.chmod(cachePath, 0o600).catch(() => { });
+    }
+    catch {
+        // Cache writes are a launch optimization only; never block codex-lb startup.
+    }
+    return result;
+}
+function isPreviousResponseNotFound(payload = {}) {
+    const error = payload?.error || payload?.response?.error || payload;
+    const text = typeof error === 'string'
+        ? error
+        : [error?.type, error?.code, error?.message, error?.param, JSON.stringify(error || {})].filter(Boolean).join(' ');
+    return /previous_response_not_found|previous_response_id.*not found|previous_response_id/i.test(text);
+}
+function parseCodexLbSseEvents(text = '') {
+    const events = [];
+    for (const line of String(text || '').split(/\r?\n/)) {
+        if (!line.startsWith('data:'))
+            continue;
+        const data = line.slice(5).trim();
+        if (!data || data === '[DONE]')
+            continue;
+        try {
+            events.push(JSON.parse(data));
+        }
+        catch { }
+    }
+    return events;
+}
+function codexLbResponseId(payload = {}) {
+    if (typeof payload?.id === 'string' && payload.id)
+        return payload.id;
+    if (typeof payload?.response?.id === 'string' && payload.response.id)
+        return payload.response.id;
+    if (typeof payload?.data?.id === 'string' && payload.data.id)
+        return payload.data.id;
+    if (typeof payload?.data?.response?.id === 'string' && payload.data.response.id)
+        return payload.data.response.id;
+    return null;
+}
+function codexLbResponseError(json, events = []) {
+    if (json?.error)
+        return json;
+    for (const event of events) {
+        if (event?.error || event?.response?.error || event?.type === 'response.failed' || event?.type === 'error')
+            return event;
+    }
+    return null;
+}
+function codexLbServiceTierEvidence(...responses) {
+    const values = [];
+    const visit = (value) => {
+        if (!value || typeof value !== 'object')
+            return;
+        values.push(value);
+        if (Array.isArray(value)) {
+            for (const item of value)
+                visit(item);
+            return;
+        }
+        for (const child of Object.values(value))
+            visit(child);
+    };
+    for (const response of responses) {
+        visit(response?.json);
+        visit(response?.events);
+    }
+    const firstString = (...keys) => {
+        for (const row of values) {
+            for (const key of keys) {
+                const value = row?.[key];
+                if (typeof value === 'string' && value.trim())
+                    return value.trim().toLowerCase();
+            }
+        }
+        return null;
+    };
+    const requested = firstString('requestedServiceTier', 'requested_service_tier', 'requested_serviceTier');
+    const actual = firstString('actualServiceTier', 'actual_service_tier', 'actual_serviceTier');
+    const effective = firstString('serviceTier', 'service_tier');
+    return {
+        requested_service_tier: requested,
+        actual_service_tier: actual,
+        effective_service_tier: effective,
+        fast_requested: requested === CODEX_LB_CANONICAL_FAST_SERVICE_TIER || effective === CODEX_LB_CANONICAL_FAST_SERVICE_TIER,
+        fast_actual: actual === CODEX_LB_CANONICAL_FAST_SERVICE_TIER || effective === CODEX_LB_CANONICAL_FAST_SERVICE_TIER
+    };
+}
+async function fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs).unref?.();
+    try {
+        const response = await fetchImpl(endpoint, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${apiKey}`,
+                'content-type': 'application/json'
+            },
+            body: JSON.stringify(body),
+            signal: controller.signal
+        });
+        const text = await response.text();
+        let json = null;
+        try {
+            json = text ? JSON.parse(text) : null;
+        }
+        catch { }
+        const events = json ? [] : parseCodexLbSseEvents(text);
+        const responseId = codexLbResponseId(json) || events.map((event) => codexLbResponseId(event)).find(Boolean) || null;
+        const errorPayload = codexLbResponseError(json, events);
+        return { ok: response.ok && !errorPayload, status: response.status, json, text, events, response_id: responseId, error_payload: errorPayload };
+    }
+    catch (err) {
+        return { ok: false, status: 0, json: null, text: err.name === 'AbortError' ? 'request timed out' : err.message, events: [], response_id: null, error_payload: null };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function checkCodexLbResponseChain(status = {}, opts = {}) {
+    const env = opts.env || process.env;
+    if (!codexLbChainCheckEnabled(env) && !opts.force)
+        return { ok: true, status: 'skipped', skipped: true, reason: 'SKS_CODEX_LB_CHAIN_CHECK=0' };
+    const endpoint = codexLbResponsesEndpoint(opts.baseUrl || status.base_url);
+    if (!endpoint)
+        return recordCodexLbChainHealth({ ok: false, status: 'missing_base_url', chain_unhealthy: true }, opts);
+    const home = opts.home || env.HOME || os.homedir();
+    const apiKey = opts.apiKey || parseCodexLbEnvKey(await readText(opts.envPath || status.env_path || codexLbEnvPath(home), ''));
+    if (!apiKey)
+        return recordCodexLbChainHealth({ ok: false, status: 'missing_env_key', chain_unhealthy: true }, opts);
+    const cached = await readCodexLbChainCache({ endpoint, home, opts, env });
+    if (cached)
+        return cached;
+    const fetchImpl = opts.fetch || globalThis.fetch;
+    if (typeof fetchImpl !== 'function')
+        return { ok: true, status: 'skipped', skipped: true, reason: 'fetch unavailable' };
+    const model = String(opts.model || env.SKS_CODEX_MODEL || env.CODEX_MODEL || '').trim();
+    if (!model)
+        return { ok: true, status: 'skipped', skipped: true, reason: 'model_unselected_use_explicit_model_or_codex_catalog' };
+    const timeoutMs = Number(opts.timeoutMs || env.SKS_CODEX_LB_CHAIN_CHECK_TIMEOUT_MS || 8000);
+    const serviceTier = opts.fastMode === true || opts.serviceTier === 'fast' || opts.serviceTier === CODEX_LB_CANONICAL_FAST_SERVICE_TIER
+        ? CODEX_LB_CANONICAL_FAST_SERVICE_TIER
+        : null;
+    const baseBody = {
+        model,
+        instructions: 'You are running a short SKS codex-lb response-chain health check.',
+        input: 'SKS codex-lb response-chain health check. Reply with OK.',
+        ...(serviceTier ? { service_tier: serviceTier } : {}),
+        stream: true,
+        store: true,
+        parallel_tool_calls: false,
+        tool_choice: 'auto',
+        reasoning: { effort: 'low' }
+    };
+    const first = await fetchCodexLbResponse(fetchImpl, endpoint, apiKey, baseBody, timeoutMs);
+    if (!first.ok || !first.response_id) {
+        return recordCodexLbChainHealth(await writeCodexLbChainCache({
+            ok: false,
+            status: first.ok ? 'missing_response_id' : 'first_request_failed',
+            chain_unhealthy: true,
+            endpoint,
+            http_status: first.status,
+            requested_service_tier: serviceTier,
+            service_tier_evidence: codexLbServiceTierEvidence(first),
+            error: redactSecretText(first.error_payload?.error?.message || first.error_payload?.response?.error?.message || first.text || 'codex-lb first Responses request failed', [apiKey])
+        }, { endpoint, home, opts, env }), opts);
+    }
+    const second = await fetchCodexLbResponse(fetchImpl, endpoint, apiKey, { ...baseBody, previous_response_id: first.response_id }, timeoutMs);
+    if (second.ok)
+        return recordCodexLbChainHealth(await writeCodexLbChainCache({ ok: true, status: 'chain_ok', endpoint, response_id: first.response_id, chained_response_id: second.response_id || null, http_status: second.status, requested_service_tier: serviceTier, service_tier_evidence: codexLbServiceTierEvidence(first, second) }, { endpoint, home, opts, env }), opts);
+    const previousMissing = isPreviousResponseNotFound(second.error_payload || second.json || second.text);
+    return recordCodexLbChainHealth(await writeCodexLbChainCache({
+        ok: false,
+        status: previousMissing ? 'previous_response_not_found' : 'second_request_failed',
+        chain_unhealthy: true,
+        endpoint,
+        response_id: first.response_id,
+        http_status: second.status,
+        requested_service_tier: serviceTier,
+        service_tier_evidence: codexLbServiceTierEvidence(first, second),
+        error: redactSecretText(second.error_payload?.error?.message || second.error_payload?.response?.error?.message || second.text || 'codex-lb chained Responses request failed', [apiKey])
+    }, { endpoint, home, opts, env }), opts);
+}
+async function recordCodexLbChainHealth(result, opts = {}) {
+    if (!result || result.skipped || opts.recordCircuit === false)
+        return result;
+    await recordCodexLbHealthEvent(opts.root || packageRoot(), result).catch(() => null);
+    return result;
+}

package/dist/cli/install-helpers-codex-lb-config.js

@@ -0,0 +1,191 @@
+import path from 'node:path';
+import os from 'node:os';
+import { ensureDir, readText } from '../core/fsx.js';
+import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from '../core/providers/glm/glm-52-profile.js';
+import { GLM_52_OPENROUTER_MODEL } from '../core/providers/glm/glm-52-settings.js';
+import { removeTopLevelTomlKeyIfValue, safeWriteCodexConfigToml, upsertTopLevelTomlString, upsertTomlTable } from '../core/codex-runtime/codex-desktop-config-policy.js';
+import { codexLbConfigPath, normalizeCodexLbBaseUrl } from './install-helpers-codex-lb-shared.js';
+export function upsertCodexLbConfig(text = '', baseUrl, selectDefault = true) {
+    let next = selectDefault
+        ? upsertTopLevelTomlString(text, 'model_provider', 'codex-lb')
+        : removeTopLevelTomlKeyIfValue(text, 'model_provider', 'codex-lb');
+    const block = [
+        '[model_providers.codex-lb]',
+        'name = "openai"',
+        `base_url = "${baseUrl}"`,
+        'wire_api = "responses"',
+        'env_key = "CODEX_LB_API_KEY"',
+        'supports_websockets = true',
+        'requires_openai_auth = true'
+    ].join('\n');
+    next = upsertTomlTable(next, 'model_providers.codex-lb', block);
+    return `${next.trim()}\n`;
+}
+export function upsertCodexAppGlmConfig(text = '') {
+    let next = String(text || '');
+    const providerBlock = [
+        `[model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}]`,
+        'name = "OpenRouter"',
+        'base_url = "https://openrouter.ai/api/v1"',
+        'wire_api = "responses"',
+        'env_key = "OPENROUTER_API_KEY"',
+        'requires_openai_auth = false'
+    ].join('\n');
+    next = upsertTomlTable(next, `model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}`, providerBlock);
+    for (const profile of GLM_CODEX_CONFIG_REASONING_PROFILES) {
+        const profileBlock = [
+            `[profiles.${profile.id}]`,
+            `model_provider = "${GLM_CODEX_CONFIG_PROVIDER_ID}"`,
+            `model = "${GLM_52_OPENROUTER_MODEL}"`,
+            `model_reasoning_effort = "${profile.reasoning_effort}"`,
+            'service_tier = "default"',
+            'approval_policy = "on-request"'
+        ].join('\n');
+        next = upsertTomlTable(next, `profiles.${profile.id}`, profileBlock);
+    }
+    return `${next.trim()}\n`;
+}
+export async function ensureGlobalCodexAppGlmProfile(opts = {}) {
+    if (process.env.SKS_SKIP_CODEX_GLM_PROFILE_REPAIR === '1' && opts.force !== true) {
+        return { ok: true, status: 'skipped', reason: 'SKS_SKIP_CODEX_GLM_PROFILE_REPAIR=1' };
+    }
+    const home = opts.home || process.env.HOME || os.homedir();
+    const configPath = opts.configPath || codexLbConfigPath(home);
+    try {
+        await ensureDir(path.dirname(configPath));
+        const current = await readText(configPath, '');
+        const next = upsertCodexAppGlmConfig(current);
+        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'glm-profile');
+        return {
+            ...safeWrite,
+            status: safeWrite.status === 'written' ? 'updated' : safeWrite.status,
+            provider: GLM_CODEX_CONFIG_PROVIDER_ID,
+            model: GLM_52_OPENROUTER_MODEL,
+            codex_config_profile: GLM_CODEX_CONFIG_PROFILE_ID,
+            reasoning_profiles: GLM_CODEX_CONFIG_REASONING_PROFILES.map((profile) => profile.id)
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 'failed',
+            config_path: configPath,
+            error: err.message,
+            provider: GLM_CODEX_CONFIG_PROVIDER_ID,
+            model: GLM_52_OPENROUTER_MODEL,
+            codex_config_profile: GLM_CODEX_CONFIG_PROFILE_ID,
+            reasoning_profiles: GLM_CODEX_CONFIG_REASONING_PROFILES.map((profile) => profile.id)
+        };
+    }
+}
+export function detectCodexLbSetupDrift(state = {}) {
+    const drift = [];
+    if (state.useDefaultProvider && state.selected !== true)
+        drift.push('default_provider_not_selected');
+    if (!state.useDefaultProvider && state.selected === true)
+        drift.push('default_provider_selected_despite_no_default_provider');
+    if (state.writeEnvFile && state.envFile !== true)
+        drift.push('env_file_not_written');
+    if (!state.writeEnvFile && state.beforeState && state.afterState && state.beforeState.envHash !== state.afterState.envHash)
+        drift.push('env_file_changed_despite_no_env_file');
+    if (!state.writeEnvFile && !state.beforeState && state.envFile === true)
+        drift.push('env_file_written_despite_no_env_file');
+    if (!state.storeKeychain && state.keychain?.status && state.keychain.status !== 'skipped')
+        drift.push('keychain_touched_despite_no_keychain');
+    if (!state.syncLaunchctl && state.codexEnvironment?.launch_environment?.status === 'synced')
+        drift.push('launchctl_base_url_synced_despite_no_launchctl');
+    if (state.codexEnvironment?.launch_environment?.secret_env_cleanup?.status === 'partial')
+        drift.push('launchctl_secret_env_cleanup_incomplete');
+    if (state.shellProfile === 'skip' && state.shellProfileResult?.status === 'installed')
+        drift.push('shell_profile_written_despite_skip');
+    if (state.shellProfile === 'skip' && state.beforeState && state.afterState && state.beforeState.profileHash !== state.afterState.profileHash)
+        drift.push('shell_profile_changed_despite_skip');
+    return drift;
+}
+export async function captureCodexLbSetupWriteState({ home, configPath, envPath, shellProfile } = {}) {
+    const profileFiles = profileFilesForDrift(home, shellProfile);
+    return {
+        configHash: await fileHashOrMissing(configPath),
+        envHash: await fileHashOrMissing(envPath),
+        profileHash: (await Promise.all(profileFiles.map((file) => fileHashOrMissing(file)))).join('|')
+    };
+}
+async function fileHashOrMissing(file) {
+    const text = await readText(file, null).catch(() => null);
+    return text === null ? 'missing' : await sha256Text(String(text));
+}
+function profileFilesForDrift(home, shellProfile) {
+    const targets = {
+        zsh: path.join(home, '.zshrc'),
+        bash: path.join(home, '.bashrc'),
+        fish: path.join(home, '.config', 'fish', 'config.fish')
+    };
+    if (shellProfile === 'zsh')
+        return [targets.zsh];
+    if (shellProfile === 'bash')
+        return [targets.bash];
+    if (shellProfile === 'fish')
+        return [targets.fish];
+    if (shellProfile === 'all')
+        return [targets.zsh, targets.bash, targets.fish];
+    return [targets.zsh, targets.bash, targets.fish];
+}
+export function appliedCodexLbPersistenceModes(state = {}) {
+    const modes = [];
+    if (state.writeEnvFile && state.envFile === true)
+        modes.push('durable_env_file');
+    if (state.storeKeychain && state.keychain?.ok === true)
+        modes.push('durable_keychain');
+    if (state.syncLaunchctl && state.codexEnvironment?.launch_environment?.status === 'synced')
+        modes.push('process_only_ephemeral');
+    if (state.shellProfile !== 'skip' && state.shellProfileResult?.status === 'installed')
+        modes.push('shell_profile');
+    if (!modes.length && state.apiKeySource === 'process.env')
+        modes.push('process_only_ephemeral');
+    if (!modes.length)
+        modes.push('none');
+    return modes;
+}
+export function shellSingleQuote(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+export function parseCodexLbEnvBaseUrl(text = '') {
+    const value = parseShellEnvValue(text, 'CODEX_LB_BASE_URL');
+    return value ? normalizeCodexLbBaseUrl(value) : '';
+}
+export function parseCodexSharedLoginApiKey(text = '') {
+    try {
+        const parsed = JSON.parse(String(text || ''));
+        const authMode = String(parsed?.auth_mode || parsed?.authMode || parsed?.mode || '').toLowerCase();
+        const key = parsed?.key || parsed?.api_key || parsed?.apiKey || parsed?.openai_api_key || parsed?.OPENAI_API_KEY;
+        if (!key || typeof key !== 'string')
+            return '';
+        if (authMode && !/api[-_]?key|apikey/.test(authMode))
+            return '';
+        return key.trim();
+    }
+    catch {
+        return '';
+    }
+}
+function parseShellEnvValue(text = '', key = '') {
+    const re = new RegExp(`^\\s*(?:export\\s+)?${escapeRegExp(key)}\\s*=\\s*(.+?)\\s*$`, 'm');
+    const envMatch = String(text || '').match(re);
+    const raw = envMatch?.[1]?.trim() || '';
+    if (!raw)
+        return '';
+    if (raw.startsWith("'"))
+        return raw.endsWith("'") && raw.length > 1 ? raw.slice(1, -1).replace(/'\\''/g, "'") : '';
+    if (raw.startsWith('"'))
+        return raw.endsWith('"') && raw.length > 1 ? raw.slice(1, -1).replace(/\\"/g, '"') : '';
+    if (raw.includes("'") || raw.includes('"') || /\s/.test(raw))
+        return '';
+    return raw;
+}
+export async function sha256Text(value = '') {
+    const { createHash } = await import('node:crypto');
+    return createHash('sha256').update(String(value || '')).digest('hex');
+}
+function escapeRegExp(value) {
+    return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}