sneakoscope 7.0.2 → 7.0.5

package/dist/cli/install-helpers.js

@@ -18,8 +18,7 @@ import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
 import { loadCodexLbEnv, writeCodexLbKeychain, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
 import { codexLbToolCatalogPath, ensureCodexLbToolCatalog } from '../core/codex-lb/codex-lb-tool-catalog.js';
 import { codexLbToolOutputRecoveryNotChecked, codexLbToolOutputRecoveryNotSelected, codexLbToolOutputRecoveryOverrideAcknowledged, probeCodexLbToolOutputRecovery } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
-import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from '../core/providers/glm/glm-52-profile.js';
-import { GLM_52_OPENROUTER_MODEL } from '../core/providers/glm/glm-52-settings.js';
+import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES, GLM_52_OPENROUTER_MODEL } from '../core/codex-app/openrouter-provider.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellProfileSnippet, selectedCodexLbPersistenceModes } from '../core/codex-lb/codex-lb-setup.js';
 import { extractTomlTable, writeCodexConfigGuarded } from '../core/codex/codex-config-guard.js';
 import { ensureGlobalCodexFastModeDuringInstall, ensureTrailingNewline, normalizeCodexFastModeUiConfig, removeTopLevelTomlKeyIfValue, safeWriteCodexConfigToml, upsertTopLevelTomlString, upsertTomlTable } from '../core/codex-runtime/codex-desktop-config-policy.js';
@@ -41,17 +40,8 @@ export async function postinstall({ bootstrap, args = [] }) {
         return;
     }
     const codexLbConfigSnapshot = await capturePostinstallCodexLbConfigSnapshot();
-    // A failed setup side-effect must never fail `npm i`. Wrap the whole flow; always
-    // restore the codex-lb snapshot in finally (even on the early bootstrap return / on throw).
     try {
         console.log('\nSKS installed.');
-        // The published tarball deliberately excludes dist/.sks-build-stamp.json
-        // (package.json files: "!dist/.sks-build-stamp.json"), but `sks update`
-        // self-verification requires a version-matching stamp inside the installed
-        // package. Regenerate it here so npm installs are verifiable; never
-        // overwrite an existing stamp (in a dev checkout the build writes the real
-        // one, and re-stamping against the current source tree would mask a stale
-        // dist).
         try {
             const stampLib = await import('../scripts/lib/ensure-dist-fresh.js');
             await fsp.access(stampLib.distStampPath).catch(async () => {
@@ -124,7 +114,6 @@ export async function postinstall({ bootstrap, args = [] }) {
             console.log(`SKS mission cleanup: removed ${postinstallRetention.action_count} disposable runtime artifact(s) from closed missions.`);
         else if (postinstallRetention.status === 'failed')
             console.log(`SKS mission cleanup: skipped (${postinstallRetention.error || 'cleanup failed'}).`);
-        // Terminating a third-party app's processes during `npm i` is unsafe by default; opt-in only.
         const appProcessRepair = process.env.SKS_POSTINSTALL_RECONCILE_APP_PROCESSES === '1'
             ? await reconcileCodexAppUpgradeProcesses()
             : { status: 'skipped', reason: 'opt_in_required', killed: [] };
@@ -179,7 +168,7 @@ export async function postinstall({ bootstrap, args = [] }) {
     }
     finally {
         await restorePostinstallCodexLbConfigSnapshot(codexLbConfigSnapshot).catch(() => { });
-        await reportPostinstallCodexLbAuth().catch(() => { });
+        await reportPostinstallCodexLbAuth(codexLbConfigSnapshot).catch(() => { });
     }
 }
 async function runPostinstallProjectRetentionCleanup(root) {
@@ -212,8 +201,13 @@ async function runPostinstallProjectRetentionCleanup(root) {
         };
     }
 }
-async function reportPostinstallCodexLbAuth() {
-    const codexLbAuth = await ensureCodexLbAuthDuringInstall();
+async function reportPostinstallCodexLbAuth(snapshot = null) {
+    const preserveActiveCodexLb = snapshot?.selected === true && snapshot?.codex_lb_key_in_shared_auth === true;
+    const codexLbAuth = await ensureCodexLbAuthDuringInstall({
+        forceCodexLbApiKeyAuth: preserveActiveCodexLb,
+        ...(snapshot?.secret_api_key ? { apiKey: snapshot.secret_api_key } : {}),
+        ...(snapshot?.base_url ? { baseUrl: snapshot.base_url } : {})
+    });
     if (codexLbAuth.legacy_auth_migrated)
         console.log(`codex-lb auth: restored from existing Codex login cache into ${codexLbAuth.env_path}.`);
     else if (codexLbAuth.status === 'synced' || codexLbAuth.status === 'present' || codexLbAuth.status === 'repaired')
@@ -235,7 +229,7 @@ async function reportPostinstallCodexLbAuth() {
         console.log(`codex-lb auth: ChatGPT OAuth preserved as backup; run \`sks codex-lb use-codex-lb\` to switch the App to codex-lb API-key auth (backup at ${reconcile.backup_path ?? 'unknown'}).`);
     }
     else if (reconcile?.status === 'oauth_restored') {
-        console.log(`codex-lb auth: restored ChatGPT OAuth from ${reconcile.backup_path ?? 'unknown'} while keeping codex-lb selected.`);
+        console.log(`codex-lb auth: restored ChatGPT OAuth from ${reconcile.backup_path ?? 'unknown'} and cleared codex-lb provider selection.`);
     }
     else if (reconcile?.status === 'apikey_forced') {
         console.log(`codex-lb auth: forced API-key auth.json for CLI-only use (OAuth backup at ${reconcile.backup_path ?? 'unknown'}).`);
@@ -264,7 +258,7 @@ async function reportPostinstallCodexLbAuth() {
 async function postinstallHarnessConflictNotice(conflictScan) {
     console.log('\nSneakoscope Codex package installed, but SKS setup is blocked.');
     console.log(formatHarnessConflictReport(conflictScan, { includePrompt: false }));
-    console.log('\nWhat this means: npm can finish installing the package, but `sks setup` and `sks doctor --fix` will refuse to activate SKS until the conflicting harness is removed with human approval.');
+    console.log('\nWhat this means: npm can finish installing the package. Conflicting OMX/DCodex markers are quarantined automatically by `sks setup`, `sks doctor --fix`, `sks update`, or `sks conflicts cleanup --yes`.');
     console.log('No files were removed by postinstall.');
     console.log('Cleanup requires a human-approved Codex App session. Keep the model selected in Codex and use high reasoning effort.');
     if (shouldAskPostinstallQuestion()) {
@@ -297,9 +291,6 @@ export async function postinstallBootstrapDecision(root) {
     const target = candidate ? installRoot : globalSksRoot();
     if (process.env.SKS_POSTINSTALL_BOOTSTRAP === '1')
         return { run: true, target, reason: 'forced by SKS_POSTINSTALL_BOOTSTRAP=1' };
-    // A global `npm i -g sneakoscope` must NOT initialize whatever project the user's shell
-    // happened to be in (that would scribble AGENTS.md/.codex/.agents into an unrelated repo).
-    // Only bootstrap the global runtime root; the user runs `sks setup` inside a project explicitly.
     if (process.env.npm_config_global === 'true' && candidate) {
         return { run: true, target: globalSksRoot(), reason: 'global install: bootstrapping global SKS runtime only (run `sks setup` inside a project to initialize it)' };
     }
@@ -328,10 +319,10 @@ async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME |
     const envText = await readText(envPath, '');
     const authExisted = await exists(authPath);
     const authText = authExisted ? await readText(authPath, '') : '';
-    const envKey = parseCodexLbEnvKey(envText);
+    const envLoad = await loadCodexLbEnv({ home, envPath });
+    const envKey = envLoad.secret_api_key || '';
     const providerConfigured = /\[model_providers\.codex-lb\]/.test(config);
-    const baseUrl = codexLbProviderBaseUrl(config) || parseCodexLbEnvBaseUrl(envText);
-    // Snapshot any codex-lb-related state so the upgrade-time bootstrap can't silently undo it.
+    const baseUrl = envLoad.base_url || codexLbProviderBaseUrl(config) || parseCodexLbEnvBaseUrl(envText);
     if (!envKey && !providerConfigured && !authExisted)
         return null;
     return {
@@ -340,6 +331,12 @@ async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME |
         auth_path: authPath,
         base_url: baseUrl ? normalizeCodexLbBaseUrl(baseUrl) : null,
         selected: hasTopLevelCodexLbSelected(config),
+        auth_mode: codexAuthModeSummary(authText).mode,
+        codex_lb_key_in_shared_auth: Boolean(envKey && parseCodexAuthApiKey(authText) === envKey),
+        credential_source: envLoad.source,
+        credential_fingerprint: envLoad.api_key.fingerprint,
+        credential_binding: envLoad.credential_binding,
+        secret_api_key: envKey || null,
         auth_existed: authExisted,
         auth_text: authText
     };
@@ -357,13 +354,15 @@ async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
             configRestored = safeWrite.ok && safeWrite.changed === true;
         }
     }
-    // Restore auth.json only if bootstrap accidentally wiped or emptied a pre-existing auth.json.
-    // We do NOT clobber a legitimately rewritten auth.json; we just heal the disappearing-auth regression.
     let authRestored = false;
     if (snapshot.auth_existed && snapshot.auth_text && snapshot.auth_text.trim()) {
         const currentAuthExists = await exists(snapshot.auth_path);
         const currentAuthText = currentAuthExists ? await readText(snapshot.auth_path, '') : '';
-        if (!currentAuthExists || !currentAuthText.trim()) {
+        const activeCodexLbAuthChanged = snapshot.selected === true
+            && snapshot.codex_lb_key_in_shared_auth === true
+            && snapshot.secret_api_key
+            && parseCodexAuthApiKey(currentAuthText) !== snapshot.secret_api_key;
+        if (!currentAuthExists || !currentAuthText.trim() || activeCodexLbAuthChanged) {
             await ensureDir(path.dirname(snapshot.auth_path));
             await writeTextAtomic(snapshot.auth_path, snapshot.auth_text, { mode: 0o600 });
             await fsp.chmod(snapshot.auth_path, 0o600).catch(() => { });
@@ -383,8 +382,6 @@ async function ensureCodexLbToolCatalogSelection(input, opts = {}) {
     const catalogPath = codexLbToolCatalogPath(codexHome);
     const current = await readText(input.configPath, '');
     const selected = hasTopLevelCodexLbSelected(current);
-    // Setup writes the catalog pointer before selecting the provider so Desktop can
-    // load GPT-5.6/tool metadata the moment model_provider becomes codex-lb.
     const canBindCatalog = selected || opts.allowUnselectedCatalogWrite === true;
     const existingCatalogPath = topLevelTomlString(current, 'model_catalog_json');
     if (canBindCatalog && existingCatalogPath && path.resolve(existingCatalogPath) !== path.resolve(catalogPath)) {
@@ -514,9 +511,6 @@ export async function configureCodexLb(opts = {}) {
     const beforeState = await captureCodexLbSetupWriteState({ home, configPath, envPath, shellProfile });
     const appliedActions = [];
     await ensureDir(path.dirname(configPath));
-    // Write the provider table first without selecting it. Desktop model/tool UI
-    // exposure depends on a validated catalog; selecting before that leaves the App
-    // on codex-lb with no GPT-5.6 picker surface.
     const current = await readText(configPath, '');
     const providerOnly = normalizeCodexFastModeUiConfig(upsertCodexLbConfig(current, baseUrl, false), {
         forceFastMode: opts.forceFastMode !== false
@@ -559,7 +553,6 @@ export async function configureCodexLb(opts = {}) {
         }
         providerSelected = true;
         appliedActions.push({ type: 'select_default_provider', target: configPath, ok: true, backup_path: selectWrite.backup_path });
-        // Re-bind after selection so model_catalog_json stays attached to the active provider.
         toolCatalog = await ensureCodexLbToolCatalogSelection({ home, configPath, baseUrl, apiKey }, opts);
         if (toolCatalog.config_changed) {
             appliedActions.push({ type: 'write_model_tool_catalog', target: toolCatalog.path, ok: toolCatalog.ok === true, status: toolCatalog.status });
@@ -595,8 +588,6 @@ export async function configureCodexLb(opts = {}) {
     if (shellProfile !== 'skip')
         appliedActions.push({ type: 'install_shell_profile_snippet', target: shellProfileResult.files?.join(', ') || shellProfile, ok: shellProfileResult.ok === true, status: shellProfileResult.status });
     const codexLb = await codexLbStatus({ ...opts, home, configPath, envPath });
-    // Never activate shared sk-clb auth while the Desktop picker is still missing a
-    // ready catalog/selection — that leaves App threads calling api.openai.com.
     const wantForceCodexLbApiKeyAuth = opts.forceCodexLbApiKeyAuth === true || opts.authMode === 'codex-lb';
     const forceCodexLbApiKeyAuth = wantForceCodexLbApiKeyAuth && providerSelected;
     const authReconcile = providerSelected
@@ -688,10 +679,13 @@ export async function codexLbStatus(opts = {}) {
     const authText = await readText(authPath, '');
     const authMode = codexAuthModeSummary(authText);
     const authApiKey = parseCodexAuthApiKey(authText);
-    const envKeyConfigured = Boolean(envLoad.api_key.present);
+    const envKeyConfigured = Boolean(envLoad.secret_api_key);
     const providerConfigured = /\[model_providers\.codex-lb\]/.test(config);
     const selected = hasTopLevelCodexLbSelected(config);
-    const baseUrl = codexLbProviderBaseUrl(config) || envLoad.base_url || null;
+    const providerBaseUrl = normalizeCodexLbBaseUrl(codexLbProviderBaseUrl(config));
+    const credentialBaseUrl = envLoad.base_url;
+    const baseUrl = credentialBaseUrl || providerBaseUrl || null;
+    const providerBaseUrlMatchesCredential = Boolean(providerBaseUrl && credentialBaseUrl && providerBaseUrl === credentialBaseUrl);
     const providerName = codexLbProviderName(config);
     const providerWireApi = codexLbProviderWireApi(config);
     const providerSupportsWebsockets = codexLbProviderSupportsWebsockets(config);
@@ -703,13 +697,14 @@ export async function codexLbStatus(opts = {}) {
     const sharedOpenAiRoutingSafe = !codexLbKeyInSharedAuth || sharedOpenAiRouting.status === 'matched';
     const authRoutingCoherent = selected === codexLbKeyInSharedAuth && sharedOpenAiRoutingSafe;
     const providerContractOk = providerConfigured
+        && providerBaseUrlMatchesCredential
         && providerName === CODEX_LB_PROVIDER_NAME
         && providerWireApi === 'responses'
         && providerEnvKey === CODEX_LB_PROVIDER_ENV_KEY
         && providerSupportsWebsockets === true
         && providerRequiresOpenAiAuth === true;
     const providerUsesCodexLbEnvAuth = providerConfigured && providerEnvKey === CODEX_LB_PROVIDER_ENV_KEY && providerOpenAiAuthDisabled;
-    const codexAppUsableWithCodexLb = providerContractOk && envKeyConfigured && Boolean(baseUrl) && authMode.codex_app_usable;
+    const codexAppUsableWithCodexLb = providerContractOk && envLoad.configured && Boolean(baseUrl) && authMode.codex_app_usable;
     const fastMode = codexLbFastModeConfigStatus(config);
     const launchEnvironment = await inspectCodexLbMacLaunchEnvironment(baseUrl, opts).catch((err) => ({
         checked: true,
@@ -717,11 +712,11 @@ export async function codexLbStatus(opts = {}) {
         status: 'inspect_failed',
         error: err.message
     }));
-    const providerReady = providerContractOk && envKeyConfigured && Boolean(baseUrl) && authMode.codex_app_usable && authRoutingCoherent;
+    const providerReady = providerContractOk && envLoad.configured && Boolean(baseUrl) && authMode.codex_app_usable && authRoutingCoherent;
     const probeToolOutputRecovery = opts.probeToolOutputRecovery === true;
     const toolOutputRecovery = !selected
         ? codexLbToolOutputRecoveryNotSelected()
-        : !probeToolOutputRecovery
+        : !probeToolOutputRecovery || !providerContractOk || !envLoad.configured
             ? codexLbToolOutputRecoveryNotChecked(true)
             : await probeCodexLbToolOutputRecovery({
                 baseUrl,
@@ -736,6 +731,9 @@ export async function codexLbStatus(opts = {}) {
         config_path: configPath,
         env_path: envPath,
         provider_configured: providerConfigured,
+        provider_base_url: providerBaseUrl || null,
+        credential_base_url: credentialBaseUrl || null,
+        provider_base_url_matches_credential: providerBaseUrlMatchesCredential,
         provider_name: providerName || null,
         provider_wire_api: providerWireApi || null,
         provider_supports_websockets: providerSupportsWebsockets,
@@ -754,6 +752,7 @@ export async function codexLbStatus(opts = {}) {
             source: envLoad.source,
             source_priority: envLoad.source_priority,
             api_key: envLoad.api_key,
+            credential_binding: envLoad.credential_binding,
             keychain: envLoad.keychain,
             env_paths: envLoad.env_paths
         },
@@ -965,7 +964,12 @@ export async function repairCodexLbAuth(opts = {}) {
     }
     await migrateCodexAuthKeyFormat({ home: opts.home });
     const codexEnvironment = await syncCodexLbProviderEnvironment(status, opts);
-    const apiKey = parseCodexLbEnvKey(await readText(status.env_path, ''));
+    const loadedEnv = await loadCodexLbEnv({
+        ...opts,
+        home: opts.home || process.env.HOME || os.homedir(),
+        envPath: status.env_path
+    });
+    const apiKey = String(opts.apiKey || loadedEnv.secret_api_key || '').trim();
     const toolCatalog = await ensureCodexLbToolCatalogSelection({
         home: opts.home || process.env.HOME || os.homedir(),
         configPath: status.config_path,
@@ -978,10 +982,17 @@ export async function repairCodexLbAuth(opts = {}) {
         ? { ok: ['apikey_forced', 'apikey_auth_active'].includes(authReconcile.status), status: authReconcile.status, ...(authReconcile.reason ? { reason: authReconcile.reason } : {}), error: authReconcile.error || null }
         : await maybeSyncCodexLbSharedLogin(apiKey, { ...opts, home: opts.home || process.env.HOME || os.homedir(), force: true });
     const finalStatus = await codexLbStatus({ ...opts, probeToolOutputRecovery: true });
-    const ok = Boolean(codexEnvironment.ok && codexLogin.ok && (toolCatalog.required === false || toolCatalog.ok === true));
+    const finalReady = finalStatus.selected === true
+        && finalStatus.provider_ready === true
+        && finalStatus.auth_routing_coherent === true
+        && finalStatus.shared_openai_routing?.safe === true;
+    const baseOk = Boolean(codexEnvironment.ok
+        && codexLogin.ok
+        && (toolCatalog.required === false || toolCatalog.ok === true));
+    const ok = baseOk && finalReady;
     return {
         ok,
-        status: ok ? 'repaired' : (codexEnvironment.status || codexLogin.status),
+        status: ok ? 'repaired' : baseOk ? 'final_readiness_failed' : (codexEnvironment.status || codexLogin.status),
         config_path: status.config_path,
         env_path: status.env_path,
         base_url: status.base_url,
@@ -999,7 +1010,7 @@ export async function ensureCodexLbAuthDuringInstall(opts = {}) {
     if (process.env.SKS_SKIP_POSTINSTALL_CODEX_LB_AUTH === '1' && !opts.force)
         return { status: 'skipped', reason: 'SKS_SKIP_POSTINSTALL_CODEX_LB_AUTH=1' };
     const status = await codexLbStatus(opts);
-    if (!status.selected && !status.provider_configured && !status.env_file)
+    if (!status.selected && !status.provider_configured && !status.env_key_configured)
         return { status: 'not_configured', codex_lb: status };
     if (status.ok && !status.selected && status.auth_mode === 'chatgpt_oauth') {
         return {
@@ -1021,7 +1032,12 @@ export async function ensureCodexLbAuthDuringInstall(opts = {}) {
         return { status: status.env_key_configured ? 'missing_base_url' : 'missing_env_key', codex_lb: status, config_path: status.config_path, env_path: status.env_path };
     }
     const codexEnvironment = await syncCodexLbProviderEnvironment(status, opts);
-    const apiKey = parseCodexLbEnvKey(await readText(status.env_path, ''));
+    const loadedEnv = await loadCodexLbEnv({
+        ...opts,
+        home: opts.home || process.env.HOME || os.homedir(),
+        envPath: status.env_path
+    });
+    const apiKey = String(opts.apiKey || loadedEnv.secret_api_key || '').trim();
     const toolCatalog = await ensureCodexLbToolCatalogSelection({
         home: opts.home || process.env.HOME || os.homedir(),
         configPath: status.config_path,
@@ -1031,10 +1047,17 @@ export async function ensureCodexLbAuthDuringInstall(opts = {}) {
     const codexLogin = await maybeSyncCodexLbSharedLogin(apiKey, { ...opts, home: opts.home || process.env.HOME || os.homedir(), force: true });
     const authReconcile = await reconcileCodexLbAuthConflict({ ...opts, status }).catch((err) => ({ status: 'failed', reason: 'exception', error: err.message }));
     const finalStatus = await codexLbStatus(opts);
-    const ok = Boolean(codexEnvironment.ok && codexLogin.ok && (toolCatalog.required === false || toolCatalog.ok === true));
+    const finalReady = finalStatus.selected === true
+        && finalStatus.provider_ready === true
+        && finalStatus.auth_routing_coherent === true
+        && finalStatus.shared_openai_routing?.safe === true;
+    const baseOk = Boolean(codexEnvironment.ok
+        && codexLogin.ok
+        && (toolCatalog.required === false || toolCatalog.ok === true));
+    const ok = baseOk && finalReady;
     return {
         ok,
-        status: ok ? 'present' : (codexEnvironment.status || codexLogin.status),
+        status: ok ? 'present' : baseOk ? 'final_readiness_failed' : (codexEnvironment.status || codexLogin.status),
         config_path: status.config_path,
         env_path: status.env_path,
         base_url: status.base_url,
@@ -1060,10 +1083,17 @@ async function restoreCodexLbEnvFromSharedLogin(status = {}, opts = {}) {
     await ensureDir(path.dirname(envPath));
     await writeTextAtomic(envPath, `export CODEX_LB_BASE_URL=${shellSingleQuote(normalizeCodexLbBaseUrl(baseUrl))}\nexport CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`, { mode: 0o600 });
     await fsp.chmod(envPath, 0o600).catch(() => { });
+    const metadataPath = opts.metadataPath || codexLbMetadataPath(home);
+    await writeTextAtomic(metadataPath, `${JSON.stringify({
+        schema: 'sks.codex-lb-metadata.v1',
+        base_url: normalizeCodexLbBaseUrl(baseUrl),
+        updated_at: new Date().toISOString(),
+        source: 'legacy-login-migration',
+        api_key: { redacted: true, sha256: await sha256Text(apiKey) }
+    }, null, 2)}\n`, { mode: 0o600 });
+    await fsp.chmod(metadataPath, 0o600).catch(() => { });
     return { ok: true, status: 'migrated_login_cache', auth_path: authPath, env_path: envPath, base_url: normalizeCodexLbBaseUrl(baseUrl) };
 }
-// Detects a real ChatGPT OAuth token blob in auth.json.
-// A bare {"auth_mode":"browser"} marker is NOT considered an OAuth token blob — we preserve it.
 function hasChatgptOAuthTokens(text = '') {
     try {
         const parsed = JSON.parse(String(text || ''));
@@ -1076,7 +1106,6 @@ function hasChatgptOAuthTokens(text = '') {
                 return true;
         }
         if (authMode && /chatgpt|oauth|browser/.test(authMode)) {
-            // Only treat as an OAuth blob when real tokens or a refresh metadata trail are also present.
             if (parsed.last_refresh || parsed.expires_at || parsed.refresh_token || parsed.access_token || parsed.id_token)
                 return true;
         }
@@ -1113,8 +1142,6 @@ function codexAuthModeSummary(text = '') {
     catch { }
     return { mode: 'unknown', codex_app_usable: false, summary: 'unrecognized auth.json shape' };
 }
-// Migrate auth.json from legacy {"auth_mode":"apikey","key":"..."} to the codex 0.130.0+
-// format {"auth_mode":"apikey","OPENAI_API_KEY":"..."}. Safe: preserves key value, only renames field.
 async function migrateCodexAuthKeyFormat(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const authPath = opts.authPath || codexAuthPath(home);
@@ -1139,11 +1166,6 @@ async function migrateCodexAuthKeyFormat(opts = {}) {
         return { status: 'skipped', reason: 'parse_error' };
     }
 }
-// Codex App uses the shared OpenAI auth store for providers with
-// requires_openai_auth=true. Before putting the codex-lb key in that store, SKS
-// must also guard the built-in `openai` provider with the same LB base URL. This
-// covers stale App threads and explicit CLI overrides that retain `openai`; the
-// config guard is written and verified before auth.json changes.
 export async function reconcileCodexLbAuthConflict(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const status = opts.status || await codexLbStatus({ ...opts, home });
@@ -1154,9 +1176,8 @@ export async function reconcileCodexLbAuthConflict(opts = {}) {
     }
     const authExists = await exists(authPath);
     const authText = authExists ? await readText(authPath, '') : '';
-    const envText = await readText(status.env_path, '');
-    const apiKey = parseCodexLbEnvKey(envText)
-        || String(opts.apiKey || (opts.env || process.env).CODEX_LB_API_KEY || '').trim();
+    const envLoad = await loadCodexLbEnv({ ...opts, home, envPath: status.env_path });
+    const apiKey = String(opts.apiKey || envLoad.secret_api_key || '').trim();
     if (!apiKey) {
         return { status: 'skipped', reason: 'missing_env_key', auth_path: authPath };
     }
@@ -1388,12 +1409,9 @@ export async function reconcileCodexLbAuthConflict(opts = {}) {
     }
     return { status: 'no_oauth_conflict', auth_path: authPath };
 }
-// Expose the ChatGPT OAuth backup path so the CLI can surface it in status / release output.
 export function codexLbChatgptBackupPath(home = process.env.HOME || os.homedir()) {
     return codexAuthChatgptBackupPath(home);
 }
-// Remove a top-level TOML key (only above the first table header). Returns the original text
-// unchanged when the key isn't present.
 function removeTopLevelTomlString(text, key) {
     const lines = String(text || '').split('\n');
     const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
@@ -1412,8 +1430,6 @@ function removeTopLevelTomlString(text, key) {
         return text;
     return lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
 }
-// Unselect codex-lb at the top-level model_provider setting. Leaves [model_providers.codex-lb]
-// and the env file alone so the user can re-engage with `sks codex-lb repair`.
 export async function unselectCodexLbProvider(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const configPath = opts.configPath || codexLbConfigPath(home);
@@ -1480,17 +1496,6 @@ function providerDeselectionOutcome(result) {
         provider_error: ok ? null : String(result?.provider_error || result?.error || result?.reason || result?.status || 'unselect_failed')
     };
 }
-// Reverse of reconcileCodexLbAuthConflict: restore the ChatGPT OAuth blob from the backup file
-// so the user can return to the official ChatGPT account login. Also deselects codex-lb at the
-// model_provider level by default so the restored OAuth blob actually wins; pass keepProvider
-// to skip that.
-//
-// Options:
-//   home          - HOME override (selftest)
-//   keepProvider  - leave `model_provider = "codex-lb"` selected (default: deselect)
-//   deleteBackup  - remove ~/.codex/auth.chatgpt-backup.json after a successful restore
-//                   (default: false; keeping it makes the next reconcile cycle a no-op clobber risk)
-//   force         - restore even if the current auth.json shape isn't recognized
 export async function releaseCodexLbAuthHold(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const authPath = opts.authPath || codexAuthPath(home);
@@ -1514,9 +1519,6 @@ export async function releaseCodexLbAuthHold(opts = {}) {
             };
         }
     }
-    // Repeated "Use ChatGPT OAuth" is idempotent. If OAuth/browser auth is
-    // already active, a historical backup is unnecessary; only ensure that the
-    // codex-lb provider is no longer selected.
     const currentAuthMode = codexAuthModeSummary(currentAuthText);
     if (!opts.force && (currentAuthMode.mode === 'chatgpt_oauth' || currentAuthMode.mode === 'browser_marker')) {
         let provider = { ok: true, provider_unselected: false, provider_status: 'kept', provider_error: null };
@@ -1560,8 +1562,6 @@ export async function releaseCodexLbAuthHold(opts = {}) {
             provider_unselected: false
         };
     }
-    // If auth.json already looks like ChatGPT OAuth (user re-logged in some other way), don't
-    // clobber it — but still honor the deselect request so the OAuth blob takes effect.
     if (trimmedCurrent && hasChatgptOAuthTokens(currentAuthText) && !opts.force) {
         let provider = { ok: true, provider_unselected: false, provider_status: 'kept', provider_error: null };
         if (!opts.keepProvider) {
@@ -1585,8 +1585,6 @@ export async function releaseCodexLbAuthHold(opts = {}) {
             provider_error: provider.provider_error
         };
     }
-    // Refuse to clobber unfamiliar auth.json shapes unless forced. We expect either an empty file,
-    // the apikey shape we wrote during reconcile, or a stray `{"auth_mode":"browser"}` marker.
     if (!opts.force && trimmedCurrent) {
         const looksApikey = /"auth_mode"\s*:\s*"apikey"/.test(currentAuthText) && Boolean(parseCodexAuthApiKey(currentAuthText));
         const looksBrowserMarker = /^\{\s*"auth_mode"\s*:\s*"browser"\s*\}\s*$/.test(currentAuthText);
@@ -1618,8 +1616,6 @@ export async function releaseCodexLbAuthHold(opts = {}) {
     }
     let provider = { ok: true, provider_unselected: false, provider_status: 'kept', provider_error: null };
     if (!opts.keepProvider) {
-        // Auth was just restored to ChatGPT OAuth. Allow deselection even if a stale
-        // shared-key read would otherwise refuse, so release cannot leave OAuth + LB pin.
         const unselected = await unselectCodexLbProvider({
             ...opts,
             home,
@@ -1653,7 +1649,6 @@ export async function releaseCodexLbAuthHold(opts = {}) {
             backupRemoved = true;
         }
         catch {
-            // Non-fatal: the restore and provider deselection already landed.
         }
     }
     return {
@@ -1757,16 +1752,10 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
             console.log('codex-lb auth synced with Codex CLI login cache.');
         const chainHealth = await checkCodexLbResponseChain(status, opts);
         if (!chainHealth.ok && chainHealth.chain_unhealthy) {
-            // `previous_response_not_found` is normal for stateless LB deployments that don't persist
-            // Responses across requests. The codex-lb provider still works fine — only the chained
-            // health probe fails. Keep codex-lb active and just warn.
             if (chainHealth.status === 'previous_response_not_found') {
                 console.log('codex-lb response chain check: previous_response_id not persisted by the load balancer (this is normal for stateless deployments). Keeping codex-lb active.');
                 return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth };
             }
-            // Hard chain failure (auth rejected, timeout, missing base URL, etc.). Don't silently
-            // demote a configured codex-lb to ChatGPT OAuth — surface the failure and let the user
-            // decide. Default keeps codex-lb (just press Enter).
             console.log(`codex-lb response chain check failed (${chainHealth.status}${chainHealth.error ? `: ${chainHealth.error}` : ''}).`);
             if (process.env.SKS_CODEX_LB_AUTOBYPASS === '1') {
                 console.log('SKS_CODEX_LB_AUTOBYPASS=1 set; bypassing codex-lb to ChatGPT OAuth for this launch.');
@@ -1781,8 +1770,6 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
                 console.log('Keeping codex-lb active. To switch back to ChatGPT OAuth: `sks codex-lb release`.');
                 return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth };
             }
-            // Non-interactive context with no opt-out env var. The user explicitly configured codex-lb,
-            // so default to keeping it active rather than silently swapping providers.
             console.log('Non-interactive launch + chain check failure. Keeping codex-lb active. Set SKS_CODEX_LB_AUTOBYPASS=1 to auto-bypass to ChatGPT OAuth.');
             return { status: 'present', ...status, codex_environment: codexEnvironment, codex_login: codexLogin, tool_catalog: toolCatalog, chain_health: chainHealth };
         }
@@ -1805,11 +1792,11 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
 async function syncCodexLbProviderEnvironment(status = {}, opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const envPath = opts.envPath || status.env_path || codexLbEnvPath(home);
-    const envText = await readText(envPath, '');
-    const apiKey = String(opts.apiKey || '').trim() || parseCodexLbEnvKey(envText);
+    const envLoad = await loadCodexLbEnv({ ...opts, home, envPath });
+    const apiKey = String(opts.apiKey || envLoad.secret_api_key || '').trim();
     if (!apiKey)
         return { ok: false, status: 'missing_env_key' };
-    const baseUrl = status.base_url || opts.baseUrl || parseCodexLbEnvBaseUrl(envText);
+    const baseUrl = envLoad.base_url || opts.baseUrl || status.base_url;
     process.env.CODEX_LB_API_KEY = apiKey;
     if (baseUrl)
         process.env.CODEX_LB_BASE_URL = baseUrl;
@@ -1871,9 +1858,6 @@ async function inspectCodexLbMacLaunchEnvironment(baseUrl = '', opts = {}) {
         const result = await runProcess(launchctl, ['getenv', key], { timeoutMs: 3000, maxOutputBytes: 8192 });
         return result.code === 0 ? String(result.stdout || '').trim() : '';
     };
-    // launchctl can stall behind the same launchd/TCC boundary for every key.
-    // These reads are independent, so keep the worst case to one timeout window
-    // instead of three serial windows on `sks --mad` preflight.
     const [currentBaseUrl, currentApiKey, currentOpenRouterKey] = await Promise.all([
         readVar('CODEX_LB_BASE_URL'),
         readVar('CODEX_LB_API_KEY'),

package/dist/cli/router.js

@@ -1,5 +1,5 @@
 import { COMMAND_ALIASES_LITE, COMMAND_MANIFEST_BY_NAME, COMMAND_NAME_SET, } from './command-manifest-lite.js';
-import { detectGlobalMode, glmWithoutMadResult } from './global-mode-router.js';
+import { findRetiredGlobalExecutionArgumentErrors } from './global-mode-router.js';
 export function isCommandName(value) {
     return COMMAND_NAME_SET.has(value);
 }
@@ -23,13 +23,6 @@ export async function dispatch(args) {
         return await dispatchInner(argv);
     }
     catch (err) {
-        // Final choke point: any uncaught bug anywhere in the dispatch chain (gate
-        // checks, lazy command import, command run()) must never leak a raw stack
-        // dump to the user as their "answer" — convert it to a structured, honest
-        // failure instead. Every existing explicit error path above already sets
-        // process.exitCode and returns normally (never throws), so this only ever
-        // catches genuinely unexpected exceptions; it changes nothing about those
-        // paths' exit codes or messages.
         const message = err instanceof Error ? err.message : String(err);
         if (err instanceof Error && err.stack)
             process.stderr.write(`${err.stack}\n`);
@@ -37,25 +30,27 @@ export async function dispatch(args) {
             process.stderr.write(`${message}\n`);
         process.exitCode = 1;
         const result = { ok: false, error: message, command: normalizeCommand(argv).rawCommand };
-        // A --json caller depends on stdout always being exactly one JSON result
-        // (this is the same non-interactive contract SKS_AGENT_MODE promises) — an
-        // uncaught crash must not leave stdout empty, or a JSON.parse on the
-        // consuming end breaks with no diagnosable output at all.
         if (argv.includes('--json'))
             console.log(JSON.stringify(result, null, 2));
         return result;
     }
 }
 async function dispatchInner(argv) {
-    const globalMode = detectGlobalMode(argv);
-    if (globalMode?.kind === 'mad-glm') {
-        const mod = await import('../core/commands/glm-command.js');
-        return mod.glmCommand(globalMode.args);
-    }
-    if (globalMode?.kind === 'glm-without-mad') {
-        const result = glmWithoutMadResult();
-        console.error(`GLM mode requires MAD: ${result.hint}`);
+    const retiredGlm = findRetiredGlobalExecutionArgumentErrors(argv).filter((item) => item.includes('--glm'));
+    if (retiredGlm.length && argv.some((arg) => arg === '--glm' || String(arg).startsWith('--glm='))) {
+        const hint = 'GLM MAD CLI was removed. Use SKS Center Providers or: sks codex-app use-openrouter --model <id>';
+        console.error(hint);
         process.exitCode = 1;
+        const result = {
+            ok: false,
+            status: 'blocked',
+            mode: 'glm',
+            reason: 'glm_mad_removed',
+            hint,
+            blockers: retiredGlm
+        };
+        if (argv.includes('--json'))
+            console.log(JSON.stringify(result, null, 2));
         return result;
     }
     const { command, rawCommand, args: rest } = normalizeCommand(argv);
@@ -96,10 +91,6 @@ async function dispatchInner(argv) {
             process.exitCode = 1;
             return commandGate;
         }
-        // 20차 P2-2: --help/-h/help must never wait on (or be blocked by) the
-        // migration gate's lock — a stuck/contended migration lock previously
-        // made `sks <cmd> --help` take the full MIGRATION_LOCK_WAIT_MS (20s) and
-        // then fail, for a request that only wants usage text.
         const { ensureCurrentMigrationBeforeCommand } = await import('../core/update/update-migration-state.js');
         const migrationGate = await ensureCurrentMigrationBeforeCommand({
             command,
@@ -134,14 +125,7 @@ async function dispatchInner(argv) {
         throw new Error(`Command ${command} must export run(command, args)`);
     return mod.run(rawCommand || command, rest);
 }
-// --help/-h/help must skip the active-route and migration gates regardless
-// of where it appears in args — a pure usage-text request should never wait
-// on (or be blocked by) project state (20차 P2-2).
 function isHelpRequest(args) {
-    // --help/-h are unambiguous flags wherever they appear; bare "help" is
-    // only treated as the request when it's the subcommand position (args[0])
-    // so an arbitrary value elsewhere (e.g. a commit message of "help") can't
-    // accidentally bypass the gates.
     return args.includes('--help') || args.includes('-h') || String(args[0] || '').toLowerCase() === 'help';
 }
 async function ensureActiveRouteCommandGate(command, args) {
@@ -208,9 +192,16 @@ function printHandledCommandBlock(result) {
 }
 export function safeReadOnlySubcommand(command, args) {
     const sub = String(args[0] || '').toLowerCase();
+    const nested = String(args[1] || '').toLowerCase();
     if (command === 'naruto' && ['status', 'subagents', 'proof'].includes(sub)) {
         return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
     }
+    if (command === 'mcp' && sub === 'config' && ['list', 'test', 'backups', 'show'].includes(nested)) {
+        return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
+    }
+    if (command === 'remote' && ['readiness', 'status', 'show'].includes(sub)) {
+        return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
+    }
     if (!['status', 'show', 'list', 'observe', 'watch', 'doctor', 'help'].includes(sub))
         return false;
     return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));