sneakoscope 7.3.0 → 7.6.0

package/dist/core/codex-app/codex-app-restart.js

@@ -1,5 +1,77 @@
 import { exists, runProcess, which } from '../fsx.js';
 import { inspectCodexLbCliLaunchRecovery } from '../codex-control/codex-lb-launch-recovery.js';
+export async function quitCodexApp(opts = {}) {
+    const env = opts.env || process.env;
+    const appName = String(opts.appName || env.SKS_CODEX_APP_NAME || 'ChatGPT');
+    const bundleId = String(opts.bundleId || env.SKS_CODEX_APP_BUNDLE_ID || 'com.openai.codex');
+    if (opts.enabled === false)
+        return quitSkipped(appName, 'disabled');
+    if ((opts.platform || process.platform) !== 'darwin')
+        return quitSkipped(appName, 'not_macos');
+    const run = opts.runProcessImpl || runProcess;
+    const osascript = opts.osascriptPath
+        || await which('osascript').catch(() => null)
+        || await exists('/usr/bin/osascript').then((ok) => ok ? '/usr/bin/osascript' : null).catch(() => null);
+    if (!osascript) {
+        return {
+            schema: 'sks.codex-app-quit.v1',
+            ok: false,
+            status: 'blocked',
+            app_name: appName,
+            bundle_id: bundleId,
+            blockers: ['osascript_missing']
+        };
+    }
+    const appTarget = bundleId ? `application id ${JSON.stringify(bundleId)}` : `application ${JSON.stringify(appName)}`;
+    const quit = await run(osascript, ['-e', `tell ${appTarget} to quit`], {
+        timeoutMs: 5000,
+        maxOutputBytes: 8192
+    }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err?.message || String(err)
+    }));
+    const quitOk = quit.code === 0
+        || /not running|Can't get application|application isn't running/i.test(String(quit.stderr || quit.stdout || ''));
+    const exitTimeoutMs = Math.max(250, Number(opts.exitTimeoutMs ?? env.SKS_CODEX_APP_EXIT_TIMEOUT_MS ?? 5000));
+    const pollMs = Math.max(50, Number(opts.pollMs ?? 100));
+    let exited = !quitOk;
+    let attempts = 0;
+    const deadline = Date.now() + exitTimeoutMs;
+    while (quitOk && Date.now() < deadline) {
+        attempts += 1;
+        const probe = await run(osascript, ['-e', `${appTarget} is running`], {
+            timeoutMs: 1000,
+            maxOutputBytes: 1024
+        }).catch(() => null);
+        if (probe?.code === 0 && String(probe.stdout || '').trim().toLowerCase() === 'false') {
+            exited = true;
+            break;
+        }
+        await sleep(pollMs);
+    }
+    return {
+        schema: 'sks.codex-app-quit.v1',
+        ok: quitOk && exited,
+        status: quitOk && exited ? 'quit' : 'blocked',
+        app_name: appName,
+        bundle_id: bundleId,
+        quit: {
+            ok: quitOk,
+            code: quit.code,
+            error: quitOk ? null : String(quit.stderr || quit.stdout || '').trim()
+        },
+        exit_wait: {
+            ok: exited,
+            attempts,
+            error: exited ? null : 'codex_app_exit_timeout'
+        },
+        blockers: [
+            ...(quitOk ? [] : ['codex_app_quit_failed']),
+            ...(exited ? [] : ['codex_app_exit_timeout'])
+        ]
+    };
+}
 export async function restartCodexApp(opts = {}) {
     const env = opts.env || process.env;
     const appName = String(opts.appName || env.SKS_CODEX_APP_NAME || 'ChatGPT');
@@ -110,6 +182,17 @@ function skipped(appName, reason) {
         blockers: []
     };
 }
+function quitSkipped(appName, reason) {
+    return {
+        schema: 'sks.codex-app-quit.v1',
+        ok: true,
+        status: 'skipped',
+        skipped: true,
+        reason,
+        app_name: appName,
+        blockers: []
+    };
+}
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }

package/dist/core/codex-app/codex-app-ui-state-snapshot.js

@@ -325,12 +325,16 @@ function hasActiveCodexLbProviderSelectionSignals(signals) {
     const selected = signals.some((signal) => signal.key_path === 'model_provider' && signal.value_preview === 'codex-lb');
     if (!selected)
         return false;
-    const has = (key, value) => signals.some((signal) => signal.key_path === key && signal.value_preview === value);
+    const has = (key, value) => signals.some((signal) => (signal.key_path === key && signal.value_preview.toLowerCase() === value));
     const present = (key) => signals.some((signal) => signal.key_path === key);
-    return has('model_providers.codex-lb.name', 'openai')
-        && has('model_providers.codex-lb.wire_api', 'responses')
-        && present('model_providers.codex-lb.env_key')
+    const cliProviderAuth = present('model_providers.codex-lb.env_key')
+        && present('model_providers.codex-lb.requires_openai_auth');
+    const desktopCompatAuth = present('model_providers.codex-lb.env_http_headers')
         && present('model_providers.codex-lb.requires_openai_auth');
+    return (has('model_providers.codex-lb.name', 'openai') || has('model_providers.codex-lb.name', 'codex-lb'))
+        && present('model_providers.codex-lb.base_url')
+        && has('model_providers.codex-lb.wire_api', 'responses')
+        && (cliProviderAuth || desktopCompatAuth);
 }
 function redactValuePreview(keyPath, value) {
     if (SECRET_KEY_RE.test(keyPath))

package/dist/core/codex-app/desktop-routing-snapshot.js

@@ -139,7 +139,7 @@ export async function restoreDesktopRoutingSnapshot(input) {
             status: 'snapshot_missing',
             blockers: ['desktop_routing_snapshot_missing'],
             warnings: [],
-            hint: 'No previous Desktop routing snapshot. Use sks codex-lb use-codex-lb or Restore Chat / Pro.'
+            hint: 'No previous Desktop routing snapshot. Use `sks codex-lb use-desktop-full` to enable managed routing or `sks codex-lb disable` to remove only SKS-managed routing.'
         };
     }
     const configPath = input.configPath || path.join(codexHomePath({ home, env }), 'config.toml');

package/dist/core/codex-app/menubar/constants.js

@@ -17,13 +17,18 @@ export const NATIVE_SOURCE_FILES = [
     'SidebarItem.swift',
     'ControlKit.swift',
     'OverviewViewController.swift',
+    'OverviewSummary.swift',
     'UpdatesViewController.swift',
     'MCPServersViewController.swift',
     'ProvidersViewController.swift',
+    'ProvidersRoutingTruth.swift',
     'ProvidersOpenRouter.swift',
     'ProvidersRoleModels.swift',
     'ProvidersMultiProvider.swift',
+    'TelegramHubSupervisor.swift',
     'RemoteTelegramViewController.swift',
+    'RemoteTelegramCenterState.swift',
+    'RemoteTelegramRendering.swift',
     'DiagnosticsViewController.swift',
     'SettingsViewController.swift',
     'OperationCoordinator.swift',

package/dist/core/codex-app/menubar/generation-transaction-journal.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { readJson, writeJsonAtomic } from '../../fsx.js';
+export { messageOf as errorMessage } from '../../errors/message.js';
 export const JOURNAL_SCHEMA = 'sks.menubar-generation-transaction.v1';
 const OUTCOME_SCHEMA = 'sks.menubar-generation-transaction-outcome.v1';
 export async function loadJournal(input) {
@@ -87,9 +88,6 @@ export async function outcomeFromUnknownJournal(purpose, journalPath, status, er
 export async function existsNoFollow(file) {
     return fs.lstat(file).then(() => true).catch(() => false);
 }
-export function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
 async function pairOutcome(pair) {
     return {
         kind: pair.kind,

package/dist/core/codex-app/menubar/installer.js

@@ -73,6 +73,24 @@ export async function installSksMenuBar(opts = {}) {
     cleanup = await cleanupMacLaunchSecretEnvironment({ env });
     if (!cleanup.ok)
         warnings.push('launch_secret_env_cleanup_incomplete');
+    try {
+        const { syncDesktopCenterLaunchCredentials } = await import('../../codex-lb/desktop-center-credentials.js');
+        const { CODEX_LB_DESKTOP_COMPAT_MARKER } = await import('../../../cli/install-helpers-codex-lb-config.js');
+        const { readText } = await import('../../fsx.js');
+        const configText = await readText(path.join(paths.home, '.codex', 'config.toml'), '');
+        if (configText.includes(CODEX_LB_DESKTOP_COMPAT_MARKER)) {
+            const restored = await syncDesktopCenterLaunchCredentials({
+                mode: 'desktop-dual-auth-compat',
+                home: paths.home
+            });
+            if (!restored.ok)
+                warnings.push('desktop_compat_launch_env_restore_incomplete');
+            else
+                actions.push('restored Center Codex LB credentials into Desktop launch environment');
+        }
+    }
+    catch {
+    }
     const swiftc = env.SKS_MENUBAR_SWIFTC || await which('swiftc').catch(() => null) || '/usr/bin/swiftc';
     const codesign = env.SKS_MENUBAR_CODESIGN || await which('codesign').catch(() => null) || '/usr/bin/codesign';
     const launchctl = env.SKS_MENUBAR_LAUNCHCTL || await which('launchctl').catch(() => null) || '/bin/launchctl';

package/dist/core/codex-app/multi-provider-router.js

@@ -254,11 +254,6 @@ export async function useMultiProviderRouter(input) {
             hint: OPENCODEX_DESIGN_B_FORCE_HINT
         };
     }
-    const unselect = await unselectCodexLbProvider({
-        home,
-        configPath,
-        allowActiveSharedAuthTransition: true
-    }).catch((err) => ({ ok: false, status: 'failed', provider_error: err?.message || String(err) }));
     const providerBody = tomlTableBody(current, `model_providers.${MULTI_PROVIDER_ROUTER_ID}`);
     const existingProviderName = tomlString(providerBody, 'name');
     if (providerBody && existingProviderName !== MULTI_PROVIDER_ROUTER_NAME) {
@@ -285,6 +280,26 @@ export async function useMultiProviderRouter(input) {
             hint: 'Re-run with --replace-catalog only if replacing the current user model catalog is intentional.'
         };
     }
+    const unselect = await unselectCodexLbProvider({
+        home,
+        configPath,
+        processEnv: env
+    }).catch((err) => ({ ok: false, status: 'failed', provider_error: err?.message || String(err) }));
+    if (unselect?.ok !== true) {
+        return {
+            ...routerBlocked('sks.codex-app-use-multi-provider-router.v1', unselect?.reason === 'shared_codex_lb_auth_active'
+                ? 'legacy_codex_lb_desktop_config_requires_migration'
+                : String(unselect?.status || 'codex_lb_unselect_failed')),
+            model,
+            base_url: baseUrlResult.value,
+            catalog_path: catalogPath,
+            unselect,
+            guidance: unselect?.reason === 'shared_codex_lb_auth_active'
+                ? ['Run: sks codex-lb migrate-legacy-desktop --restart-app']
+                : []
+        };
+    }
+    const currentAfterUnselect = await readText(configPath, '');
     const providerBlock = [
         `[model_providers.${MULTI_PROVIDER_ROUTER_ID}]`,
         `name = ${JSON.stringify(MULTI_PROVIDER_ROUTER_NAME)}`,
@@ -292,13 +307,13 @@ export async function useMultiProviderRouter(input) {
         'wire_api = "responses"',
         'requires_openai_auth = false'
     ].join('\n');
-    let next = upsertTomlTable(current, `model_providers.${MULTI_PROVIDER_ROUTER_ID}`, providerBlock);
+    let next = upsertTomlTable(currentAfterUnselect, `model_providers.${MULTI_PROVIDER_ROUTER_ID}`, providerBlock);
     next = upsertTopLevelTomlString(next, 'model_catalog_json', catalogPath);
     next = upsertTopLevelTomlString(next, 'model_provider', MULTI_PROVIDER_ROUTER_ID);
     next = upsertTopLevelTomlString(next, 'model', model);
     next = normalizeCodexFastModeUiConfig(next);
     next = ensureTrailingNewline(next);
-    const write = await safeWriteCodexConfigToml(configPath, current, next, 'multi-provider-router-use', {
+    const write = await safeWriteCodexConfigToml(configPath, currentAfterUnselect, next, 'multi-provider-router-use', {
         verifyUnchangedBeforeWrite: true,
         expectedBeforeExists: configExistedBefore
     });
@@ -365,9 +380,6 @@ export async function useMultiProviderRouter(input) {
             ...catalog.warnings,
             ...ownership.warnings,
             ...cache.warnings,
-            ...(unselect?.ok === false
-                ? [`codex_lb_unselect:${unselect.provider_error || unselect.status}`]
-                : []),
             ...(catalog.models.find((entry) => entry.model === model)?.multi_agent_version === 'v2'
                 ? []
                 : ['multi_provider_router_model_multi_agent_v2_missing']),

package/dist/core/codex-app/openrouter-activate.js

@@ -188,8 +188,33 @@ export async function useOpenRouter(input) {
     const unselect = await unselectCodexLbProvider({
         home,
         configPath,
-        allowActiveSharedAuthTransition: true
+        processEnv: env
     }).catch((err) => ({ ok: false, status: 'failed', provider_error: err?.message || String(err) }));
+    if (unselect?.ok !== true) {
+        const sharedAuthActive = unselect?.reason === 'shared_codex_lb_auth_active';
+        return {
+            schema: 'sks.codex-app-use-openrouter.v1',
+            generated_at: nowIso(),
+            ok: false,
+            status: 'blocked',
+            mode: 'openrouter',
+            model,
+            profile: activationProfile,
+            unselect,
+            routing_snapshot: routingSnapshot,
+            routing_snapshot_write: snapshotWrite,
+            thread_visibility: threadVisibility,
+            blockers: [
+                sharedAuthActive
+                    ? 'legacy_codex_lb_desktop_config_requires_migration'
+                    : String(unselect?.status || 'codex_lb_unselect_failed')
+            ],
+            warnings: [],
+            ...(sharedAuthActive
+                ? { guidance: ['Run: sks codex-lb migrate-legacy-desktop --restart-app'] }
+                : {})
+        };
+    }
     const modelCatalog = await writeOpenRouterManagedCatalog({ model, home, env });
     const current = await readText(configPath, '');
     const catalogBind = openRouterCatalogBindDecision(current, { home, env, configPath });

package/dist/core/codex-app.js

@@ -9,8 +9,8 @@ import { PRODUCT_DESIGN_AUTO_INSTALL_ENV, ensureProductDesignPluginInstalled, pr
 import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_52_OPENROUTER_MODEL, RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS } from './codex-app/openrouter-provider.js';
 import { sksOpenRouterCatalogPath } from './codex-app/codex-model-catalog.js';
 import { resolveOpenRouterApiKey } from './providers/openrouter/openrouter-secret-store.js';
-import { codexLbEnvPath, loadCodexLbEnv, parseShellEnvValue, readCodexLbModelCatalog } from './codex-lb/codex-lb-env.js';
-import { codexLbToolCatalogPath, inspectCodexLbToolCatalog } from './codex-lb/codex-lb-tool-catalog.js';
+import { codexLbEnvPath, codexLbMetadataPath, loadCodexLbEnv, parseShellEnvValue, readCodexLbModelCatalog } from './codex-lb/codex-lb-env.js';
+import { codexLbToolCatalogPath, inspectCodexLbToolCatalog, shouldBindLocalModelCatalog } from './codex-lb/codex-lb-tool-catalog.js';
 import { isSksOwnedGlobalUiLock } from './codex-app/codex-app-ui-state-snapshot.js';
 import { redactString } from './secret-redaction.js';
 import { escapeRegExp } from './text/regex.js';
@@ -169,7 +169,7 @@ export async function codexAppIntegrationStatus(opts = {}) {
     });
     const pluginPickerReady = requiredFeatureFlags.tool_suggest && requiredFeatureFlags.plugins && requiredFeatureFlags.apps && defaultPlugins.ok && pluginSkillShadows.ok && fastModeConfig.ok;
     const gitActions = codexGitActionReadiness({ requiredFeatureFlags, remoteControl });
-    const selectedProviderReady = providerModelUi.selected_provider_ok !== false;
+    const selectedProviderReady = providerModelUi.effective_ready === true;
     const ready = appInstalled && Boolean(codex.bin) && mcpList.ok && featureList.ok && requiredFeatureFlagsOk && pluginPickerReady && fastModeConfig.ok && selectedProviderReady && imageGenerationReady && gitActions.ok && computerUseReady && browserToolReady && chromeExtension.ok;
     return {
         ok: ready,
@@ -204,6 +204,7 @@ export async function codexAppIntegrationStatus(opts = {}) {
             fast_mode_config: fastModeConfig,
             provider_model_ui: providerModelUi,
             selected_provider_ready: selectedProviderReady,
+            codex_lb_capabilities: opts.codexLbCapabilityReport || null,
             git_actions: gitActions,
             image_generation: imageGenerationReady,
             image_generation_source: imageGenerationReady ? 'codex_features_list' : 'missing',
@@ -472,8 +473,8 @@ function codexNativeSksMenuStatus() {
         companion_install_command: 'sks doctor --fix',
         alternatives: [
             'sks doctor --fix',
-            'sks codex-lb use-codex-lb',
-            'sks codex-lb use-oauth',
+            'sks codex-lb use-desktop-full',
+            'sks codex-lb disable',
             'sks codex-app set-openrouter-key --api-key-stdin',
             'codex://settings'
         ],
@@ -568,7 +569,7 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
     }
     if (!gitActions?.ok) {
         lines.push(`Codex App git commit/push actions are blocked: ${gitActions?.blockers?.join(', ') || 'git action readiness'}. The app Commit, Push, Commit and Push, and PR flows need codex_git_commit, hooks, and Codex CLI remote-control support.`);
-        lines.push(`Run: sks doctor --fix; if remote-control is still blocked, update Codex CLI to ${CODEX_REMOTE_CONTROL_MIN_VERSION}+ and restart older app-server/TUI sessions.`);
+        lines.push('Run: sks doctor --fix; if remote-control is still blocked, update Codex CLI to the official latest stable release and restart older app-server/TUI sessions.');
     }
     else {
         lines.push('Codex App git actions are enabled for Commit, Push, Commit and Push, and PR flows; SKS hooks treat those app metadata actions as lightweight git UI actions.');
@@ -577,7 +578,7 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
         lines.push('Codex App does not expose a documented third-party API for inserting SKS between Window and Help, so SKS uses a right-side macOS menu bar companion instead. Run `sks doctor --fix` to install or refresh it.');
     }
     if (appInstalled && (!computerUseReady || !browserToolReady)) {
-        lines.push('Open Codex App settings and enable recommended MCP/plugin tools. Codex CLI 0.130.0+ remote-control/app-server sessions can pick up config changes live; restart older CLI/TUI sessions.');
+        lines.push('Open Codex App settings and enable recommended MCP/plugin tools. Codex CLI sessions that expose remote-control/app-server can pick up config changes live; restart older CLI/TUI sessions.');
         lines.push(`Required for SKS web QA/UX/browser evidence: Codex Chrome Extension first (${CODEX_CHROME_EXTENSION_SETUP_DOCS_URL}). Computer Use is reserved for native Mac/non-web surfaces.`);
         lines.push('Verify with: codex features list; codex mcp list');
     }
@@ -939,13 +940,28 @@ export async function codexProviderModelUiStatus(opts = {}) {
     }
     const codexLbProvider = tomlTableAny(configText, ['model_providers.codex-lb', 'model_providers."codex-lb"']);
     const codexLbProviderPresent = Boolean(codexLbProvider);
-    const codexLbProviderContractOk = codexLbProviderPresent
-        && hasTomlString(codexLbProvider, 'name', 'openai')
+    const codexLbCliProviderContractOk = codexLbProviderPresent
+        && hasTomlString(codexLbProvider, 'name', 'codex-lb')
         && hasTomlString(codexLbProvider, 'wire_api', 'responses')
         && hasTomlString(codexLbProvider, 'env_key', 'CODEX_LB_API_KEY')
         && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
-        && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', true);
+        && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', false);
+    const codexLbCompatProviderContractOk = codexLbProviderPresent
+        && hasTomlString(codexLbProvider, 'name', 'OpenAI')
+        && hasTomlString(codexLbProvider, 'wire_api', 'responses')
+        && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
+        && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', true)
+        && !hasTomlKey(codexLbProvider, 'env_key')
+        && hasCodexLbGatewayEnvHeader(codexLbProvider);
     const codexLbSelectedDefault = /(?:^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(topLevelToml(globalConfig));
+    const codexLbDesktopMode = opts.codexLbDesktopMode
+        || inferCodexLbDesktopModeForUi(globalConfig);
+    const codexLbProviderContractOk = codexLbDesktopMode === 'desktop-dual-auth-compat'
+        ? codexLbCompatProviderContractOk
+        : codexLbCliProviderContractOk;
+    const metadata = await readJsonIfExists(opts.codexLbMetadataPath || codexLbMetadataPath(home));
+    const gatewayAuthTransport = normalizeCodexLbGatewayAuthTransportForUi(opts.codexLbGatewayAuthTransport || metadata?.gateway_auth_transport);
+    const localCatalogBindingAllowed = shouldBindLocalModelCatalog(codexLbDesktopMode);
     const selectedProviderValue = topLevelToml(globalConfig)
         .match(/(?:^|\n)\s*model_provider\s*=\s*"([^"]+)"\s*(?:#.*)?(?=\n|$)/)?.[1] || null;
     const managedCatalogPath = codexLbToolCatalogPath(path.join(home || '', '.codex'));
@@ -953,13 +969,18 @@ export async function codexProviderModelUiStatus(opts = {}) {
     const managedCatalogConfigured = Boolean(configuredCatalogPath)
         && path.resolve(configuredCatalogPath) === path.resolve(managedCatalogPath);
     let persistedCatalog = null;
-    if (!opts.codexLbModelCatalog && managedCatalogConfigured) {
+    if (!opts.codexLbModelCatalog && managedCatalogConfigured && localCatalogBindingAllowed) {
         persistedCatalog = await inspectCodexLbToolCatalog(managedCatalogPath).catch(() => null);
     }
     let liveCatalog = opts.codexLbModelCatalog || null;
     if (!liveCatalog && !persistedCatalog?.ok && codexLbProviderContractOk && codexLbApiKeySource !== 'missing' && codexLbBaseUrlSource !== 'missing') {
         const loadedEnv = await loadCodexLbEnv({ home, envPath: codexLbEnvFilePath }).catch(() => null);
-        liveCatalog = loadedEnv ? await readCodexLbModelCatalog({ loadedEnv }).catch(() => null) : null;
+        liveCatalog = loadedEnv
+            ? await readCodexLbModelCatalog({
+                loadedEnv,
+                gatewayAuthTransport
+            }).catch(() => null)
+            : null;
     }
     const codexLbModelCatalog = opts.codexLbModelCatalog || (persistedCatalog?.ok
         ? {
@@ -979,9 +1000,8 @@ export async function codexProviderModelUiStatus(opts = {}) {
                     source: 'persisted_model_catalog_json'
                 }
                 : null);
-    const expectedCodexLbModels = ['gpt-5.6-luna', 'gpt-5.6-terra', 'gpt-5.6-sol'];
     const catalogModels = Array.isArray(codexLbModelCatalog?.models) ? codexLbModelCatalog.models.map(String) : [];
-    const expectedCodexLbModelsPresent = expectedCodexLbModels.every((model) => catalogModels.includes(model));
+    const advertisedCodexLbModelsPresent = codexLbModelCatalog?.ok === true && catalogModels.length > 0;
     const glmBlockers = [
         ...(glmProviderPresent ? [] : ['glm_openrouter_provider_missing']),
         ...glmProfileBlockers,
@@ -992,11 +1012,14 @@ export async function codexProviderModelUiStatus(opts = {}) {
         ...(codexLbProviderPresent && !codexLbProviderContractOk ? ['codex_lb_provider_contract_drift'] : []),
         ...(codexLbApiKeySource !== 'missing' ? [] : ['codex_lb_api_key_missing']),
         ...(codexLbBaseUrlSource !== 'missing' ? [] : ['codex_lb_base_url_missing']),
-        ...(codexLbSelectedDefault && !managedCatalogConfigured && !expectedCodexLbModelsPresent
+        ...(codexLbDesktopMode === 'desktop-native-bridge' && managedCatalogConfigured
+            ? ['native_bridge_local_catalog_replacement_forbidden']
+            : []),
+        ...(codexLbSelectedDefault && localCatalogBindingAllowed && !managedCatalogConfigured && !advertisedCodexLbModelsPresent
             ? ['codex_lb_model_catalog_json_unselected']
             : []),
-        ...(codexLbProviderContractOk && codexLbApiKeySource !== 'missing' && codexLbBaseUrlSource !== 'missing' && !expectedCodexLbModelsPresent
-            ? ['codex_lb_gpt_5_6_catalog_unverified']
+        ...(codexLbProviderContractOk && codexLbApiKeySource !== 'missing' && codexLbBaseUrlSource !== 'missing' && !advertisedCodexLbModelsPresent
+            ? ['codex_lb_model_catalog_unverified']
             : [])
     ];
     const openRouterSelectedDefault = selectedProviderValue === GLM_CODEX_CONFIG_PROVIDER_ID;
@@ -1027,17 +1050,38 @@ export async function codexProviderModelUiStatus(opts = {}) {
     const installCommand = 'sks codex-app use-openrouter --model z-ai/glm-5.2';
     const setupCommand = 'sks codex-lb setup --host <domain> --api-key-stdin --yes';
     const setKeyCommand = 'sks codex-lb set-key --api-key-stdin';
+    const desktopPickerEvidence = opts.desktopPickerEvidence || opts.codexLbCapabilityReport?.model_picker || null;
+    const desktopPickerVerified = desktopPickerEvidence?.state === 'verified'
+        || desktopPickerEvidence?.verified === true;
+    const selectedProviderConfigured = selectedProviderBlockers.length === 0;
+    const selectedProviderAdvertised = codexLbSelectedDefault
+        ? advertisedCodexLbModelsPresent
+        : true;
+    const effectiveReady = selectedProviderConfigured && selectedProviderAdvertised && desktopPickerVerified;
     return {
         schema: 'sks.codex-app-provider-model-ui.v1',
-        ok: selectedProviderBlockers.length === 0,
-        selected_provider_ok: selectedProviderBlockers.length === 0,
+        ok: effectiveReady,
+        selected_provider_ok: effectiveReady,
+        configured: selectedProviderConfigured,
+        advertised: selectedProviderAdvertised,
+        effective_ready: effectiveReady,
         selected_provider: codexLbSelectedDefault ? 'codex-lb' : (selectedProviderValue || 'oauth'),
         selected_provider_blockers: selectedProviderBlockers,
         optional_provider_blockers: optionalProviderBlockers,
         checked: true,
         verification_scope: 'config_and_provider_catalog',
-        desktop_picker_verified: false,
-        status: selectedProviderBlockers.length === 0 ? 'ready' : 'setup_required',
+        desktop_picker_verified: desktopPickerVerified,
+        desktop_picker_evidence: desktopPickerEvidence,
+        readiness_state: selectedProviderBlockers.length > 0
+            ? 'blocked'
+            : effectiveReady
+                ? 'verified'
+                : 'available_unverified',
+        status: selectedProviderBlockers.length > 0
+            ? 'setup_required'
+            : effectiveReady
+                ? 'ready'
+                : 'available_unverified',
         optional_provider_status: optionalProviderBlockers.length === 0 ? 'ready' : 'setup_available',
         config_paths: {
             codex_config: globalConfigPath,
@@ -1066,6 +1110,9 @@ export async function codexProviderModelUiStatus(opts = {}) {
             key_entry_visible: true,
             provider_present: codexLbProviderPresent,
             provider_contract_ok: codexLbProviderContractOk,
+            provider_contract: codexLbDesktopMode === 'desktop-dual-auth-compat'
+                ? 'desktop-dual-auth-compat'
+                : 'cli-provider',
             selected_default: codexLbSelectedDefault,
             key_present: codexLbApiKeySource !== 'missing',
             api_key_source: codexLbApiKeySource,
@@ -1074,11 +1121,15 @@ export async function codexProviderModelUiStatus(opts = {}) {
             model_catalog_checked: Boolean(codexLbModelCatalog),
             model_catalog_ok: codexLbModelCatalog?.ok === true,
             model_catalog_source: codexLbModelCatalog?.source || null,
+            desktop_mode: codexLbDesktopMode,
+            gateway_auth_transport: gatewayAuthTransport,
+            local_catalog_binding_allowed: localCatalogBindingAllowed,
             model_catalog_json_configured: managedCatalogConfigured,
             model_catalog_json_path: managedCatalogConfigured ? managedCatalogPath : configuredCatalogPath || null,
             model_catalog_models: catalogModels,
-            expected_models: expectedCodexLbModels,
-            expected_models_present: expectedCodexLbModelsPresent,
+            expected_models: [],
+            expected_models_present: advertisedCodexLbModelsPresent,
+            advertised_models_present: advertisedCodexLbModelsPresent,
             tools_transport: codexLbModelCatalog?.tools_transport || null,
             model_catalog_blockers: codexLbModelCatalog?.blockers || [],
             setup_command: setupCommand,
@@ -1104,6 +1155,44 @@ async function readTextIfExists(file) {
         return '';
     }
 }
+async function readJsonIfExists(file) {
+    try {
+        const parsed = JSON.parse(await fsp.readFile(file, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function inferCodexLbDesktopModeForUi(config) {
+    const topLevel = topLevelToml(config);
+    const selected = topLevel.match(/(?:^|\n)\s*model_provider\s*=\s*"([^"]+)"\s*(?:#.*)?(?=\n|$)/)?.[1] || '';
+    const openAiBaseUrl = topLevel.match(/(?:^|\n)\s*openai_base_url\s*=\s*"([^"]+)"\s*(?:#.*)?(?=\n|$)/)?.[1] || '';
+    if (config.includes('# sks-codex-lb-managed-desktop-bridge')
+        && /^http:\/\/(?:127\.0\.0\.1|\[::1\]):\d+\/backend-api\/codex\/?$/i.test(openAiBaseUrl)) {
+        return 'desktop-native-bridge';
+    }
+    if (config.includes('# sks-codex-lb-managed-desktop-compat')
+        && selected === 'codex-lb') {
+        return 'desktop-dual-auth-compat';
+    }
+    return tomlTableAny(config, ['model_providers.codex-lb', 'model_providers."codex-lb"'])
+        ? 'cli-provider'
+        : 'disabled';
+}
+function normalizeCodexLbGatewayAuthTransportForUi(value) {
+    return value === 'authorization-bearer-compat'
+        ? 'authorization-bearer-compat'
+        : 'x-codex-lb-api-key';
+}
+function hasTomlKey(text, key) {
+    return new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=`).test(text);
+}
+function hasCodexLbGatewayEnvHeader(text) {
+    return /(?:^|\n)\s*env_http_headers\s*=\s*\{[^}\n]*"X-Codex-LB-API-Key"\s*=\s*"CODEX_LB_API_KEY"[^}\n]*\}\s*(?:#.*)?(?=\n|$)/.test(text);
+}
 async function findDefaultPluginSource(plugin, { home, configText }) {
     const cached = await findPluginCache(plugin.name, { home });
     if (cached)
@@ -1165,6 +1254,9 @@ function providerModelUiSummary(status = {}) {
             : '';
         return ` ${selected} ready${optionalSetup} (live picker reload required)`;
     }
+    if (status.configured && status.readiness_state === 'available_unverified') {
+        return ` ${selected} configured, Desktop picker unverified`;
+    }
     return ` ${selected} setup ${(status.selected_provider_blockers || status.blockers || []).join(', ') || 'required'}`;
 }
 function sksNativeMenuSummary(status = {}) {
@@ -1226,10 +1318,10 @@ function hasTomlBoolean(text = '', key = '', value) {
 }
 function remoteControlGuidance(status = {}) {
     if (!status.codex_cli?.ok)
-        return 'Codex remote-control requires Codex CLI 0.130.0+. Install with: npm i -g @openai/codex@latest';
+        return 'Codex remote-control needs a Codex CLI that exposes the app-server entrypoint. Install the official latest stable release: npm i -g @openai/codex@latest';
     if (status.reason === 'codex_cli_version_unknown')
-        return 'Codex remote-control requires Codex CLI 0.130.0+, but the installed CLI version could not be parsed. Check: codex --version';
-    return `Codex remote-control requires Codex CLI ${CODEX_REMOTE_CONTROL_MIN_VERSION}+. Update with: npm i -g @openai/codex@latest`;
+        return 'Codex remote-control needs a Codex CLI that exposes the app-server entrypoint, but the installed CLI version could not be parsed. Check: codex --version';
+    return 'The installed Codex CLI does not expose remote-control. Update to the official latest stable release: npm i -g @openai/codex@latest';
 }
 function codexCliVersionNumber(versionText = '') {
     const match = String(versionText || '').match(/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/);