sneakoscope 7.0.2 → 7.0.3

package/README.md

@@ -18,7 +18,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current release: **SKS 7.0.2**, validated against the official stable **Codex CLI 0.144.5** release from July 16, 2026. It makes the Control Center Overview report build, install, cache, rebuild, and probe health from their real authorities; adds root-owned Naruto follow-up waves with recovered thread capacity; separates Terra Medium exploration, Sol High implementation, and Sol Max judgment; and replaces duplicated global guidance with one concise Core Engineering Directive. The `0.145.0-alpha` line is intentionally excluded from the stable release baseline. See [CHANGELOG.md](CHANGELOG.md).
+Current release: **SKS 7.0.3**, with the package compatibility baseline pinned to **Codex CLI 0.144.5**. It fixes codex-lb readiness, preserves provider/auth/model state across `sks update`, restores explicit Chat/Pro OAuth recovery, and adds a guarded Codex CLI updater that discovers newer stable operator releases independently. Prerelease `0.145.0-alpha` artifacts remain excluded from the pinned release contract. See [CHANGELOG.md](CHANGELOG.md).
 
 ## What 7.0.0 Ships
 
@@ -64,7 +64,7 @@ The SKS menu bar shows the installed Codex CLI version and latest known version.
 
 ## Naruto Workflow
 
-`$sks-naruto` and `sks naruto run "task" --agents 8 --max-threads 12` use Codex official subagents. The parent is GPT-5.6 Sol Max. Tiny mechanical `worker` slices use Luna Max; ordinary UI, logic, backend, and native coding uses Sol High; review, testing, debugging, architecture, integration, security, database, research, release, and other judgment-sensitive work uses Sol Max; long-context scans and direct Computer Use, Browser/Chrome, or image-generation execution uses Terra Medium. Mixed execution/judgment work is split when possible, and unsplittable judgment defaults to Sol Max.
+`$sks-naruto` and `sks naruto run "task" --agents 8 --max-threads 12` use Codex official subagents. Standalone and Codex App tasks that request project-host database, spreadsheet, or render tools require the non-persistent `--trusted-project` flag after the operator reviews the checkout; an App session ID scopes evidence but does not grant trust. The parent is GPT-5.6 Sol Max. Tiny mechanical `worker` slices use Luna Max; ordinary UI, logic, backend, and native coding uses Sol High; review, testing, debugging, architecture, integration, security, database, research, release, and other judgment-sensitive work uses Sol Max; long-context scans and direct Computer Use, Browser/Chrome, or image-generation execution uses Terra Medium. Mixed execution/judgment work is split when possible, and unsplittable judgment defaults to Sol Max.
 
 Fresh SKS-owned project config uses `max_threads = 12`, `max_depth = 1`, `job_max_runtime_seconds = 1200`, and `interrupt_message = true`. `max_depth = 1` means subagents cannot spawn nested subagents. Explicit user limits are preserved, and larger requests run in waves.
 
@@ -97,7 +97,7 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
 
 ## Proof Surfaces
 
-- Official subagents: `sks naruto run "task" --agents 14 --max-threads 12 --json`
+- Official subagents: `sks naruto run "task" --agents 14 --max-threads 12 [--trusted-project] --json`
 - Review report: `.sneakoscope/reports/review-report.json`
 - Harness benchmark: `.sneakoscope/reports/harness-benchmark.json`
 - Project memory: `sks memory build`
@@ -106,7 +106,7 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
 - codex-lb continuity: `sks codex-lb status --json` verifies the selected proxy's unauthenticated `/health` `X-App-Version`. Tool-heavy continuation requires codex-lb `1.21.0-beta.3` or later; older or unverified deployments block setup, doctor, and launch instead of silently falling back.
 - Agent bridge for any agent system: `sks mcp-server`, `sks agent-bridge setup`, `SKS_AGENT_MODE=1` — see [docs/AGENT-BRIDGE.md](docs/AGENT-BRIDGE.md)
 - Release gates: `npm run release:check:affected` for ordinary change-aware verification and `npm run release:check:confidence` for the final local confidence pass.
-- Release preparation handoff: run `npm run typecheck --silent`, one `npm run build:clean --silent`, focused tests for the changed surfaces, `npm run release:check:affected`, `npm run release:check:confidence`, and finally `npm pack --dry-run --ignore-scripts --json`. Publish authorization and publication remain a distinct repository-maintainer workflow.
+- Release preparation: typecheck, one clean build, focused tests, affected/confidence gates, then `npm publish --dry-run --json --registry https://registry.npmjs.org/ --tag latest --access public`. The dry-run does not publish; authorization remains a separate maintainer workflow.
 - Release readiness notes: [docs/release-readiness.md](docs/release-readiness.md) and [CHANGELOG.md](CHANGELOG.md)
 - Image generation review routes require Codex App `$imagegen`/`gpt-image-2` evidence with recorded output hashes; direct API fallback and mock fixtures do not satisfy full route gates.
 
@@ -117,7 +117,9 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
 - macOS optional: menu bar integration and `/usr/bin/open`
   - The menubar icon shows and hides itself automatically as the Codex desktop app launches/quits; set `quit_with_codex: true` in `~/.codex/sks-menubar/config.json` to have the menubar fully quit with Codex instead of just hiding (default `false`).
   - Native input dialogs (API keys, codex-lb setup) pass secrets to `sks` via `--api-key-stdin` instead of a visible Terminal window or process arguments.
-  - Auth/provider changes wait for the ChatGPT/Codex app to exit and reopen by bundle id; a failed restart is reported as a failed menu action.
+  - Auth/provider changes require a successful app restart; skipped or failed restarts fail the action.
+  - `sks update` preserves the selected codex-lb or ChatGPT OAuth mode, model, reasoning, catalog, and routing state.
+  - Providers exposes **Restore Chat / Pro (OAuth)** as an explicit auth-mode switch while retaining saved codex-lb credentials.
   - Update installs always rebuild the companion with the newly installed SKS package, preventing a previous-version updater from restoring a stale menu binary.
   - The menubar dropdown's `View Last Log` item opens the most recent background action's log file, so you don't need to keep a Terminal window open to see command output.
   - `Manage MCP Servers…` provides a resizable native table and add/remove/enable/disable controls for global Codex MCP configuration. Secret environment values and command arguments are accepted through native dialogs/stdin but omitted from list output and logs.

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "7.0.2"
+version = "7.0.3"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "7.0.2"
+version = "7.0.3"
 edition = "2021"
 
 [dependencies]

package/dist/bin/sks-dispatch.js

@@ -28,9 +28,6 @@ async function runSks(args) {
         await hookUserPromptSubmitPerfInline();
     }
     else if (args[0] === 'hook' && args[1] && process.env.SKS_HOOK_DAEMON === '1') {
-        // 20차 P2-1: opt-in daemon-accelerated hook path. Default hook behavior
-        // (.codex/hooks.json's actual command) is unchanged until this has been
-        // verified and deliberately turned on.
         const { hookDaemonInline } = await import('../core/daemon/sksd-hook-dispatch.js');
         await hookDaemonInline(args[1]);
     }

package/dist/cli/command-registry.js

@@ -7,7 +7,6 @@ const SAFE_COMMAND_CONTRACT = {
     inputProfile: 'none',
     requiredCapabilities: []
 };
-/** Loaded ESM modules are unknown at the boundary; narrow before calling exports. */
 export function hasFunctionExport(mod, exportName) {
     if (!mod || typeof mod !== 'object')
         return false;
@@ -19,7 +18,6 @@ function functionExport(mod, exportName) {
         throw new Error(`Missing export ${exportName}`);
     return mod[exportName];
 }
-/** Pick runner from default export object shape used by legacy command files. */
 function pickRunner(mod) {
     for (const k of ['run', 'main', 'default']) {
         const v = mod[k];

package/dist/cli/install-helpers-codex-lb-chain.js

@@ -3,6 +3,7 @@ import os from 'node:os';
 import fsp from 'node:fs/promises';
 import { ensureDir, packageRoot, readText, writeTextAtomic } from '../core/fsx.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
+import { codexLbBaseUrlSecurityBlocker } from '../core/codex-lb/codex-lb-env.js';
 import { CODEX_LB_CANONICAL_FAST_SERVICE_TIER, codexLbEnvPath, parseCodexLbEnvKey, redactSecretText } from './install-helpers-codex-lb-shared.js';
 function codexLbResponsesEndpoint(baseUrl = '') {
     const base = String(baseUrl || '').trim().replace(/\/+$/, '');
@@ -86,7 +87,6 @@ async function writeCodexLbChainCache(result = {}, { endpoint, home, opts = {},
         await fsp.chmod(cachePath, 0o600).catch(() => { });
     }
     catch {
-        // Cache writes are a launch optimization only; never block codex-lb startup.
     }
     return result;
 }
@@ -182,6 +182,7 @@ async function fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs
                 'content-type': 'application/json'
             },
             body: JSON.stringify(body),
+            redirect: 'error',
             signal: controller.signal
         });
         const text = await response.text();
@@ -206,9 +207,30 @@ export async function checkCodexLbResponseChain(status = {}, opts = {}) {
     const env = opts.env || process.env;
     if (!codexLbChainCheckEnabled(env) && !opts.force)
         return { ok: true, status: 'skipped', skipped: true, reason: 'SKS_CODEX_LB_CHAIN_CHECK=0' };
-    const endpoint = codexLbResponsesEndpoint(opts.baseUrl || status.base_url);
+    if (status.provider_base_url_matches_credential === false) {
+        return recordCodexLbChainHealth({
+            ok: false,
+            status: 'provider_base_url_mismatch',
+            chain_unhealthy: true,
+            blockers: ['codex_lb_provider_base_url_mismatch'],
+            error: 'codex_lb_provider_base_url_mismatch'
+        }, opts);
+    }
+    const baseUrl = opts.baseUrl || status.base_url;
+    const endpoint = codexLbResponsesEndpoint(baseUrl);
     if (!endpoint)
         return recordCodexLbChainHealth({ ok: false, status: 'missing_base_url', chain_unhealthy: true }, opts);
+    const transportBlocker = codexLbBaseUrlSecurityBlocker(baseUrl);
+    if (transportBlocker) {
+        return recordCodexLbChainHealth({
+            ok: false,
+            status: 'transport_blocked',
+            chain_unhealthy: true,
+            endpoint,
+            blockers: [transportBlocker],
+            error: transportBlocker
+        }, opts);
+    }
     const home = opts.home || env.HOME || os.homedir();
     const apiKey = opts.apiKey || parseCodexLbEnvKey(await readText(opts.envPath || status.env_path || codexLbEnvPath(home), ''));
     if (!apiKey)

package/dist/cli/install-helpers-codex-lb-config.js

@@ -22,11 +22,6 @@ export function upsertCodexLbConfig(text = '', baseUrl, selectDefault = true) {
     return `${next.trim()}\n`;
 }
 const CODEX_LB_SHARED_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
-// Codex App can retain a per-thread `model_provider = "openai"` selection even
-// after the global provider changes. While SKS places the codex-lb key in the
-// shared OpenAI auth store, pin the built-in provider to the same LB endpoint so
-// that stale threads cannot send that key to api.openai.com. A different existing
-// override is user-owned and must never be clobbered.
 export function codexLbSharedOpenAiRoutingState(text = '', baseUrl = '') {
     const expectedBaseUrl = normalizeCodexLbBaseUrl(baseUrl);
     const configuredBaseUrl = topLevelTomlString(text, 'openai_base_url');
@@ -46,8 +41,6 @@ export function upsertCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
     if (state.status === 'matched' && state.managed) {
         return { ...state, routing_status: state.status, ok: true, status: 'present', text: String(text || '') };
     }
-    // Matched-but-unmanaged means the URL already points at codex-lb. Claim the SKS
-    // marker so release/unselect can remove only this activation pin later.
     const withValue = state.status === 'matched'
         ? String(text || '')
         : upsertTopLevelTomlString(text, 'openai_base_url', state.expected_base_url);

package/dist/cli/install-helpers-codex-lb-selftest-chain.js

@@ -14,7 +14,6 @@ async function safeReadText(file, fallback = '') {
 }
 export async function runCodexLbLaunchChainSelftest(input) {
     const { tmp, codexLbHome, codexLbFakeBin, codexLbConfig } = input;
-    // SKS_CODEX_LB_AUTOBYPASS=1 restores the old silent-bypass behavior for CI/automation.
     process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
     let autobypassLaunch;
     try {
@@ -94,8 +93,6 @@ export async function runCodexLbLaunchChainSelftest(input) {
     });
     if (brokenChain.ok || brokenChain.status !== 'previous_response_not_found' || brokenChain.chain_unhealthy !== true)
         throw new Error('selftest: codex-lb response chain health check did not detect previous_response_not_found');
-    // 0.144 contract: removed feature stamps and legacy fast profile tables are
-    // stripped, while stable Computer Use/Browser/ImageGen/plugin flags remain.
     const legacyStamps = ['remote_control = true', 'fast_mode_ui = true', 'codex_git_commit = true', '[user.fast_mode]', '[profiles.sks-fast-high]', 'fast_default_opt_out = true'];
     const survivingLegacy = legacyStamps.filter((stamp) => codexLbConfig.includes(stamp));
     const stableCapabilityStamps = ['computer_use = true', 'browser_use = true', 'browser_use_external = true', 'image_generation = true', 'in_app_browser = true', 'guardian_approval = true', 'tool_suggest = true', 'plugins = true'];

package/dist/cli/install-helpers-codex-lb-selftest.js

@@ -42,9 +42,6 @@ export async function selftestCodexLb(tmp) {
     const codexLbFakeBin = path.join(tmp, 'codex-lb-fake-bin');
     await ensureDir(codexLbFakeBin);
     const codexLbFakeCodex = path.join(codexLbFakeBin, 'codex');
-    // NOTE: printf format uses literal double-quotes inside single-quoted shell strings so the
-    // fake login writes proper JSON in both bash and dash (where `\"` is a non-standard printf
-    // escape that dash emits literally and bash collapses to `"`).
     await writeTextAtomic(codexLbFakeCodex, "#!/bin/sh\nif [ \"$1\" = \"--version\" ]; then echo \"codex-cli 99.0.0\"; exit 0; fi\nif [ \"$1\" = \"login\" ] && [ \"$2\" = \"status\" ]; then echo \"logged in with browser auth\"; exit 0; fi\nif [ \"$1\" = \"login\" ] && [ \"$2\" = \"--with-api-key\" ]; then read key; mkdir -p \"$HOME/.codex\"; printf '{\"auth_mode\":\"apikey\",\"OPENAI_API_KEY\":\"%s\"}\\n' \"$key\" > \"$HOME/.codex/auth.json\"; printf '%s\\n' \"$key\" >> \"$HOME/.codex/login-calls.log\"; exit 0; fi\necho \"fake codex unsupported\" >&2\nexit 1\n");
     await fsp.chmod(codexLbFakeCodex, 0o755);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), `model_reasoning_effort = "low"\nservice_tier = "fast"\nsuppress_unstable_features_warning = true\n\n[profiles.custom]\nmodel_reasoning_effort = "low"\n\n[notice]\nfast_default_opt_out = true\n\n[features]\nhooks = true\n`);
@@ -195,7 +192,6 @@ export async function selftestCodexLb(tmp) {
         throw new Error('selftest: doctor codex-lb');
     if (!codexLbDoctorConfig.includes('requires_openai_auth = true') || !codexLbDoctorConfig.includes('name = "openai"'))
         throw new Error('selftest: doctor codex-lb did not restore current App provider contract');
-    // codex-lb auth: ChatGPT OAuth ↔ codex-lb env_key conflict reconciliation.
     const oauthAuthJson = JSON.stringify({
         auth_mode: 'chatgpt',
         tokens: { id_token: 'oauth-id', access_token: 'oauth-access', refresh_token: 'oauth-refresh' },
@@ -213,7 +209,6 @@ export async function selftestCodexLb(tmp) {
     const codexLbReconcileBackup = await safeReadText(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'));
     if (codexLbReconcileJson.auth_reconcile?.status !== 'oauth_preserved' || !codexLbReconcileAuth.includes('oauth-id') || !codexLbReconcileAuth.includes('oauth-refresh') || codexLbReconcileAuth.includes('sk-test') || !codexLbReconcileBackup.includes('oauth-id') || !codexLbReconcileBackup.includes('oauth-refresh'))
         throw new Error('selftest: codex-lb oauth reconcile should preserve ChatGPT OAuth and back it up');
-    // Opt-out path: SKS_CODEX_LB_NO_AUTH_RECONCILE=1 keeps auth.json untouched but still backs up the OAuth blob.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), `${oauthAuthJson}\n`);
     await fsp.rm(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), { force: true });
     const codexLbReconcileOptOutRepair = await runProcess(process.execPath, [packagedSksEntrypoint(), 'auth', 'repair', '--json'], { cwd: tmp, env: { ...codexLbEnvForSelftest, SKS_CODEX_LB_NO_AUTH_RECONCILE: '1' }, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
@@ -224,8 +219,6 @@ export async function selftestCodexLb(tmp) {
     const codexLbReconcileOptOutBackup = await safeReadText(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'));
     if (codexLbReconcileOptOutJson.auth_reconcile?.status !== 'backup_only' || !codexLbReconcileOptOutAuth.includes('oauth-id') || !codexLbReconcileOptOutBackup.includes('oauth-id'))
         throw new Error('selftest: codex-lb oauth reconcile opt-out should back up but not rewrite auth.json');
-    // Restore path: older SKS versions could leave the codex-lb API key in auth.json. Repair should
-    // restore the ChatGPT OAuth backup while keeping codex-lb selected for provider routing.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), '{"auth_mode":"apikey","OPENAI_API_KEY":"sk-test"}\n');
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), `${oauthAuthJson}\n`);
     const codexLbReconcileRestoreRepair = await runProcess(process.execPath, [packagedSksEntrypoint(), 'auth', 'repair', '--json'], { cwd: tmp, env: codexLbEnvForSelftest, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
@@ -236,14 +229,10 @@ export async function selftestCodexLb(tmp) {
     const codexLbReconcileRestoreConfig = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
     if (codexLbReconcileRestoreJson.auth_reconcile?.status !== 'oauth_restored' || !codexLbReconcileRestoreAuth.includes('oauth-id') || codexLbReconcileRestoreAuth.includes('sk-test') || hasTopLevelCodexLbSelected(codexLbReconcileRestoreConfig) || /sks-codex-lb-managed-openai-base-url/.test(codexLbReconcileRestoreConfig))
         throw new Error('selftest: codex-lb oauth restore should replace apikey auth.json with ChatGPT OAuth backup and leave an unselected, unpinned provider state');
-    // codex-lb auth: release flow — restore ChatGPT OAuth from backup so the user can return to
-    // the official ChatGPT account login. Default deselects model_provider; keeping codex-lb
-    // selected with shared OAuth is rejected because it would route OAuth credentials to the LB.
     const codexLbReleaseConfig = 'model_provider = "codex-lb"\n\n[model_providers.codex-lb]\nname = "openai"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true\n';
     const codexLbReleaseEnv = "export CODEX_LB_BASE_URL='https://lb.example.test/backend-api/codex'\nexport CODEX_LB_API_KEY='sk-test'\n";
     const codexLbReleaseApikeyAuth = '{"auth_mode":"apikey","OPENAI_API_KEY":"sk-test"}\n';
     const codexLbReleaseOauthBackup = `${oauthAuthJson}\n`;
-    // Happy path: deselect model_provider and preserve backup file.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), codexLbReleaseApikeyAuth);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), codexLbReleaseOauthBackup);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'sks-codex-lb.env'), codexLbReleaseEnv);
@@ -257,7 +246,6 @@ export async function selftestCodexLb(tmp) {
     const codexLbReleaseConfigAfter = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
     if (codexLbReleaseJson.status !== 'released' || codexLbReleaseJson.provider_unselected !== true || codexLbReleaseJson.backup_removed !== false || !codexLbReleaseAuth.includes('oauth-id') || !codexLbReleaseAuth.includes('oauth-refresh') || codexLbReleaseAuth.includes('apikey') || !codexLbReleaseBackupAfter.includes('oauth-id') || hasTopLevelCodexLbSelected(codexLbReleaseConfigAfter))
         throw new Error('selftest: codex-lb release happy path did not restore OAuth, preserve backup, and deselect model_provider');
-    // --keep-provider is unsafe with shared OpenAI auth and must fail without changing either file.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), codexLbReleaseApikeyAuth);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), codexLbReleaseOauthBackup);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), codexLbReleaseConfig);
@@ -267,7 +255,6 @@ export async function selftestCodexLb(tmp) {
     const codexLbReleaseKeepAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
     if (codexLbReleaseKeepRun.code === 0 || codexLbReleaseKeepJson.status !== 'failed' || codexLbReleaseKeepJson.reason !== 'keep_provider_unsafe_with_shared_auth' || !hasTopLevelCodexLbSelected(codexLbReleaseKeepConfig) || !codexLbReleaseKeepAuth.includes('apikey'))
         throw new Error('selftest: codex-lb release --keep-provider should fail closed without changing the coherent codex-lb state');
-    // --delete-backup: restore auth.json and remove the backup file.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), codexLbReleaseApikeyAuth);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), codexLbReleaseOauthBackup);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), codexLbReleaseConfig);
@@ -278,7 +265,6 @@ export async function selftestCodexLb(tmp) {
     const codexLbReleaseDeleteBackupExists = await exists(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'));
     if (codexLbReleaseDeleteJson.status !== 'released' || codexLbReleaseDeleteJson.backup_removed !== true || codexLbReleaseDeleteBackupExists)
         throw new Error('selftest: codex-lb release --delete-backup should remove the backup file after restore');
-    // No backup: release should refuse and exit 1.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), codexLbReleaseApikeyAuth);
     await fsp.rm(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), { force: true });
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), codexLbReleaseConfig);
@@ -287,7 +273,6 @@ export async function selftestCodexLb(tmp) {
     const codexLbReleaseMissingAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
     if (codexLbReleaseMissingRun.code === 0 || codexLbReleaseMissingJson.status !== 'no_backup' || !codexLbReleaseMissingAuth.includes('apikey'))
         throw new Error('selftest: codex-lb release with no backup should exit non-zero and report no_backup without touching auth.json');
-    // unselect must refuse while the shared auth store still contains the codex-lb key.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), codexLbReleaseApikeyAuth);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), codexLbReleaseConfig);
     const codexLbUnselectRun = await runProcess(process.execPath, [packagedSksEntrypoint(), 'codex-lb', 'unselect', '--json'], { cwd: tmp, env: codexLbEnvForSelftest, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
@@ -296,7 +281,6 @@ export async function selftestCodexLb(tmp) {
     const codexLbUnselectAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
     if (codexLbUnselectRun.code === 0 || codexLbUnselectJson.status !== 'failed' || codexLbUnselectJson.reason !== 'shared_codex_lb_auth_active' || !hasTopLevelCodexLbSelected(codexLbUnselectConfig) || !codexLbUnselectAuth.includes('apikey'))
         throw new Error('selftest: codex-lb unselect should fail closed while shared codex-lb auth is active');
-    // Restore the doctor-test auth.json shape so downstream selftest assertions still hold.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), '{"auth_mode":"browser"}\n');
     await fsp.rm(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), { force: true });
     const codexLbContext7Bin = path.join(tmp, 'codex-lb-context7-bin');
@@ -477,7 +461,6 @@ export async function selftestCodexLb(tmp) {
     }));
     if (nonInteractiveBrokenLaunch.status !== 'present' || nonInteractiveBrokenLaunch.bypass_codex_lb === true || nonInteractiveBrokenLaunch.chain_health?.status !== 'previous_response_not_found')
         throw new Error('selftest: previous_response_not_found should keep codex-lb active (stateless LB is normal), not silently bypass to ChatGPT OAuth');
-    // Hard chain failure (e.g. 500) in non-interactive context should still keep codex-lb by default — the user explicitly configured it, so don't silently swap providers.
     const hardBrokenLaunchCalls = [];
     const hardBrokenLaunch = (await maybePromptCodexLbSetupForLaunch([], {
         home: codexLbHome,