sneakoscope 7.3.0 → 7.6.0

package/dist/scripts/codex-lb-desktop-capabilities-check.js

@@ -0,0 +1,287 @@
+#!/usr/bin/env node
+import { runCodexLbDesktopCapabilityReport, shapeCodexLbDesktopCapabilityStatus } from '../core/codex-lb/capability-runner.js';
+import { assertGate, emitGate } from './gate-lib.js';
+const checkedAt = '2026-07-28T00:00:00.000Z';
+const manifest = {
+    schema_version: 'codex-lb.desktop-capabilities.v1',
+    routes: {
+        responses_http: true,
+        models: true,
+        images_generations: true,
+        realtime_calls: true,
+        files: true,
+        transcribe: true,
+        images_edits: true,
+        thread_goal: true,
+        memories_trace_summarize: true,
+        safety_arc: true,
+        agent_identities_jwks: true
+    },
+    tools: {
+        image_generation: true,
+        computer_use_passthrough: true,
+        web_search: true
+    }
+};
+const catalog = {
+    models: [{
+            id: 'future-codex-model',
+            display_name: 'Future Codex',
+            supported_reasoning_levels: [{ effort: 'high' }],
+            truncation_policy: { mode: 'tokens' },
+            additional_speed_tiers: ['fast'],
+            service_tiers: [{ id: 'priority' }],
+            use_responses_lite: false,
+            future_catalog_field: true
+        }]
+};
+const advertisedOnly = runCodexLbDesktopCapabilityReport({
+    mode: 'desktop-native-bridge',
+    level: 'shallow',
+    configured: true,
+    oauthPreserved: true,
+    checkedAt,
+    manifest,
+    gatewayAuth: {
+        transport: 'x-codex-lb-api-key',
+        configured: true,
+        observed: false
+    },
+    providerIdentity: {
+        configured: true,
+        source: 'config'
+    },
+    browserUse: {
+        advertised: true,
+        source: 'manifest'
+    },
+    plugins: {
+        advertised: true,
+        source: 'manifest'
+    }
+});
+const advertisedStatus = shapeCodexLbDesktopCapabilityStatus(advertisedOnly);
+const fixtureOnly = runCodexLbDesktopCapabilityReport({
+    mode: 'desktop-native-bridge',
+    level: 'deep',
+    configured: true,
+    oauthPreserved: true,
+    checkedAt,
+    manifest,
+    gatewayAuth: {
+        transport: 'x-codex-lb-api-key',
+        configured: true,
+        observed: true,
+        fixture: true
+    },
+    providerIdentity: {
+        verified: true,
+        fixture: true,
+        source: 'transport'
+    },
+    bridge: {
+        configured: true,
+        processRunning: true,
+        transportAttempted: true,
+        httpRoundTrip: true,
+        websocketRoundTrip: true,
+        fixture: true
+    },
+    catalog: {
+        catalog,
+        configuredServiceTier: 'fast',
+        pickerControlVisible: true,
+        pickerSelectedModel: 'future-codex-model',
+        requestServiceTier: 'fast',
+        responseActualServiceTier: 'priority',
+        fixture: true
+    },
+    imageGeneration: {
+        attempted: true,
+        requestToolsPresent: true,
+        events: [{ type: 'response.image_generation_call.completed' }],
+        artifactMaterialized: true,
+        fixture: true
+    },
+    computerUse: {
+        attempted: true,
+        events: [{ type: 'response.computer_call.created' }],
+        localExecutorCompleted: true,
+        outputSubmitted: true,
+        followUpCompleted: true,
+        sessionAffinityPreserved: true,
+        fixture: true
+    },
+    browserUse: {
+        verified: true,
+        fixture: true,
+        source: 'deep_probe'
+    },
+    voiceMode: {
+        attempted: true,
+        createRouteVerified: true,
+        locationReceived: true,
+        locationRewritten: true,
+        websocketUpgraded: true,
+        serverEventSeen: true,
+        cleanClose: true,
+        ownerBindingVerified: true,
+        fixture: true
+    },
+    plugins: {
+        verified: true,
+        fixture: true,
+        source: 'deep_probe'
+    },
+    auxiliarySurfaces: {
+        attempted: true,
+        inputEvents: [{ type: 'future.desktop.event', payload: { keep: true } }],
+        outputEvents: [{ type: 'future.desktop.event', payload: { keep: true } }],
+        requestBodyHashPreserved: true,
+        sessionAffinityPreserved: true,
+        fixture: true
+    }
+});
+const fixtureStatus = shapeCodexLbDesktopCapabilityStatus(fixtureOnly);
+const textOnly = runCodexLbDesktopCapabilityReport({
+    mode: 'cli-provider',
+    level: 'transport',
+    configured: true,
+    oauthPreserved: false,
+    checkedAt,
+    manifest,
+    textResponses: {
+        attempted: true,
+        verified: true,
+        source: 'transport',
+        evidence: { response_completed: true }
+    },
+    browserUse: {
+        advertised: true,
+        source: 'manifest'
+    },
+    plugins: {
+        advertised: true,
+        source: 'manifest'
+    }
+});
+const authIndependentBase = {
+    mode: 'cli-provider',
+    level: 'shallow',
+    configured: true,
+    checkedAt,
+    manifest,
+    gatewayAuth: {
+        transport: 'x-codex-lb-api-key',
+        configured: true,
+        observed: false
+    },
+    providerIdentity: {
+        requiresOauth: true,
+        configured: true
+    },
+    catalog: {
+        catalog,
+        configuredServiceTier: 'fast'
+    },
+    browserUse: {
+        advertised: true,
+        source: 'manifest'
+    },
+    plugins: {
+        advertised: true,
+        source: 'manifest'
+    }
+};
+const oauthAvailable = runCodexLbDesktopCapabilityReport({
+    ...authIndependentBase,
+    oauthPreserved: true
+});
+const oauthMissing = runCodexLbDesktopCapabilityReport({
+    ...authIndependentBase,
+    oauthPreserved: false
+});
+const fixtureVerifiableKeys = [
+    'gateway_auth_transport',
+    'provider_identity',
+    'bridge',
+    'catalog',
+    'model_picker',
+    'fast_mode',
+    'image_generation',
+    'computer_use',
+    'browser_use',
+    'voice_mode',
+    'plugins',
+    'auxiliary_surfaces'
+];
+const authIndependentKeys = [
+    'gateway_auth_transport',
+    'catalog',
+    'model_picker',
+    'fast_mode',
+    'image_generation',
+    'computer_use',
+    'browser_use',
+    'voice_mode',
+    'plugins',
+    'auxiliary_surfaces'
+];
+const textIndependentKeys = [
+    'image_generation',
+    'computer_use',
+    'browser_use',
+    'voice_mode',
+    'plugins',
+    'auxiliary_surfaces'
+];
+const advertisedNotVerified = advertisedStatus.ready === false
+    && advertisedOnly.overall === 'available_unverified'
+    && capabilityEntries(advertisedOnly).every(([, evidence]) => evidence.state !== 'verified');
+const fixtureNotVerified = fixtureStatus.ready === false
+    && fixtureOnly.overall === 'available_unverified'
+    && fixtureVerifiableKeys.every((key) => fixtureOnly[key].state === 'available_unverified');
+const textDoesNotPromoteOtherCapabilities = textOnly.text_responses.state === 'verified'
+    && textIndependentKeys.every((key) => textOnly[key].state !== 'verified');
+const independentFromAuthMode = oauthAvailable.provider_identity.state === 'available_unverified'
+    && oauthMissing.provider_identity.state === 'blocked'
+    && authIndependentKeys.every((key) => (oauthAvailable[key].state === oauthMissing[key].state
+        && JSON.stringify(oauthAvailable[key].blockers) === JSON.stringify(oauthMissing[key].blockers)));
+const report = {
+    schema: 'sks.codex-lb-desktop-capabilities-check.v1',
+    ok: advertisedNotVerified
+        && fixtureNotVerified
+        && textDoesNotPromoteOtherCapabilities
+        && independentFromAuthMode,
+    advertised_not_verified: advertisedNotVerified,
+    fixture_not_verified: fixtureNotVerified,
+    text_does_not_promote_other_capabilities: textDoesNotPromoteOtherCapabilities,
+    independent_from_auth_mode: independentFromAuthMode,
+    states: {
+        advertised_only: advertisedOnly.overall,
+        fixture_only: fixtureOnly.overall,
+        text_only: textOnly.overall,
+        oauth_available_provider_identity: oauthAvailable.provider_identity.state,
+        oauth_missing_provider_identity: oauthMissing.provider_identity.state
+    },
+    blockers: [
+        ...(advertisedNotVerified ? [] : ['manifest_or_config_promoted_to_verified']),
+        ...(fixtureNotVerified ? [] : ['fixture_evidence_promoted_to_verified']),
+        ...(textDoesNotPromoteOtherCapabilities ? [] : ['text_response_evidence_promoted_other_capability']),
+        ...(independentFromAuthMode ? [] : ['independent_capability_changed_with_auth_mode'])
+    ]
+};
+assertGate(report.ok, 'codex-lb Desktop capability evidence gate failed', report);
+emitGate('codex-lb:desktop-capabilities', {
+    advertised_not_verified: report.advertised_not_verified,
+    fixture_not_verified: report.fixture_not_verified,
+    text_does_not_promote_other_capabilities: report.text_does_not_promote_other_capabilities,
+    independent_from_auth_mode: report.independent_from_auth_mode
+});
+function capabilityEntries(report) {
+    return Object.entries(report)
+        .filter((entry) => {
+        const value = entry[1];
+        return Boolean(value && typeof value === 'object' && 'state' in value && 'evidence' in value);
+    });
+}

package/dist/scripts/codex-lb-desktop-real-evidence-check.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { writeJsonAtomic } from '../core/fsx.js';
+import { codexLbDesktopStatusV2, readCodexLbDesktopDeepEvidence, readCodexLbDesktopDeepEvidenceTrustAnchors } from '../core/codex-lb/desktop-controller.js';
+import { CODEX_LB_DESKTOP_REAL_EVIDENCE_CHECK_SCHEMA, validateCodexLbDesktopRealEvidence } from '../core/codex-lb/desktop-real-evidence.js';
+import { uniqueValues as unique } from '../core/text/strings.js';
+const args = process.argv.slice(2);
+const evidencePath = readArg('--evidence')
+    || process.env.SKS_CODEX_LB_DESKTOP_REAL_EVIDENCE_PATH
+    || null;
+const trustAnchorsPath = readArg('--trust-anchors')
+    || process.env.SKS_CODEX_LB_DESKTOP_REAL_EVIDENCE_TRUST_ANCHORS_PATH
+    || null;
+const home = readArg('--home') || process.env.HOME || null;
+const maxAgeMs = positiveNumber(readArg('--max-age-ms') || process.env.SKS_CODEX_LB_DESKTOP_REAL_EVIDENCE_MAX_AGE_MS);
+const reportPath = path.join(process.cwd(), '.sneakoscope', 'reports', 'codex-lb-desktop-real-evidence-check.json');
+const blockers = [];
+let status = null;
+let result;
+try {
+    status = await codexLbDesktopStatusV2({
+        ...(home ? { home } : {}),
+        networkProbes: false
+    });
+    const mode = String(status.mode || 'disabled');
+    const bridge = asRecord(status.bridge);
+    const endpoint = loopbackCodexEndpoint(bridge.listen_origin);
+    if (mode !== 'desktop-native-bridge')
+        blockers.push('codex_lb_desktop_real_evidence_native_mode_required');
+    if (!endpoint)
+        blockers.push('codex_lb_desktop_real_evidence_loopback_endpoint_missing');
+    if (!evidencePath)
+        blockers.push('codex_lb_desktop_real_evidence_path_missing');
+    if (!trustAnchorsPath)
+        blockers.push('codex_lb_desktop_real_evidence_trust_anchors_path_missing');
+    if (blockers.length || !evidencePath || !trustAnchorsPath || !endpoint) {
+        result = missingResult(mode, endpoint, blockers);
+    }
+    else {
+        const [evidence, trustAnchors] = await Promise.all([
+            readCodexLbDesktopDeepEvidence(evidencePath),
+            readCodexLbDesktopDeepEvidenceTrustAnchors(trustAnchorsPath)
+        ]);
+        result = validateCodexLbDesktopRealEvidence(evidence, {
+            expectedMode: 'desktop-native-bridge',
+            expectedEndpoint: endpoint,
+            trustAnchors,
+            ...(maxAgeMs ? { maxAgeMs } : {})
+        });
+    }
+}
+catch (error) {
+    result = missingResult(String(status?.mode || 'disabled'), loopbackCodexEndpoint(asRecord(status?.bridge).listen_origin), [safeError(error)]);
+}
+const report = {
+    ...result,
+    evidence_path: evidencePath ? path.resolve(evidencePath) : null,
+    trust_anchors_path: trustAnchorsPath ? path.resolve(trustAnchorsPath) : null,
+    actual_status: {
+        mode: status?.mode || null,
+        bridge_running: asRecord(status?.bridge).running === true,
+        oauth_present: asRecord(status?.oauth).present === true,
+        built_in_provider_retained: asRecord(status?.provider).built_in === true
+    },
+    report_path: path.relative(process.cwd(), reportPath).split(path.sep).join('/')
+};
+await writeJsonAtomic(reportPath, report);
+console.log(JSON.stringify(report, null, 2));
+if (report.ok !== true)
+    process.exitCode = 1;
+function missingResult(mode, endpoint, reasons) {
+    return {
+        schema: CODEX_LB_DESKTOP_REAL_EVIDENCE_CHECK_SCHEMA,
+        ok: false,
+        status: 'real_required_missing',
+        release_authorizing: false,
+        mode,
+        endpoint,
+        producer_id: null,
+        deep_evidence_validation: null,
+        required_true_fields: [],
+        required_string_fields: [],
+        required_array_fields: [],
+        verified_fields: [],
+        blockers: unique(reasons.length ? reasons : ['codex_lb_desktop_real_evidence_missing']),
+        warnings: []
+    };
+}
+function loopbackCodexEndpoint(value) {
+    try {
+        const origin = new URL(String(value || ''));
+        if (origin.protocol !== 'http:'
+            || !['127.0.0.1', '::1'].includes(origin.hostname)
+            || origin.username
+            || origin.password
+            || origin.search
+            || origin.hash)
+            return null;
+        return new URL('/backend-api/codex', origin).toString().replace(/\/+$/, '');
+    }
+    catch {
+        return null;
+    }
+}
+function readArg(name) {
+    const index = args.indexOf(name);
+    return index >= 0 && args[index + 1] ? String(args[index + 1]) : null;
+}
+function positiveNumber(value) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function safeError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /^[a-z0-9_:-]+$/i.test(message)
+        ? message
+        : 'codex_lb_desktop_real_evidence_check_failed';
+}

package/dist/scripts/codex-lb-fast-mode-truth-check.js

@@ -13,15 +13,22 @@ await fs.writeFile(path.join(home, '.codex', 'config.toml'), [
     'service_tier = "fast"',
     '',
     '[model_providers.codex-lb]',
-    'name = "openai"',
+    'name = "codex-lb"',
     'base_url = "https://lb.example.test/backend-api/codex"',
     'wire_api = "responses"',
     'env_key = "CODEX_LB_API_KEY"',
     'supports_websockets = true',
-    'requires_openai_auth = true',
+    'requires_openai_auth = false',
     ''
 ].join('\n'));
-await fs.writeFile(path.join(home, '.codex', 'auth.json'), `${JSON.stringify({ auth_mode: 'apikey', OPENAI_API_KEY: 'sk-fixture' })}\n`);
+await fs.writeFile(path.join(home, '.codex', 'auth.json'), `${JSON.stringify({
+    auth_mode: 'chatgpt',
+    account_id: 'acct-fast-truth',
+    tokens: {
+        access_token: 'oauth-fast-truth',
+        refresh_token: 'refresh-fast-truth'
+    }
+})}\n`);
 await fs.writeFile(path.join(home, '.codex', 'sks-codex-lb.env'), "export CODEX_LB_BASE_URL='https://lb.example.test/backend-api/codex'\nexport CODEX_LB_API_KEY='sk-fixture'\n");
 const chain = await runFastCheck({
     HOME: home,

package/dist/scripts/codex-lb-fast-ui-preservation-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { codexLbConfigPath, codexLbEnvPath, ensureGlobalCodexFastModeDuringInstall, releaseCodexLbAuthHold, repairCodexLbAuth } from '../cli/install-helpers.js';
+import { codexLbConfigPath, codexLbEnvPath, configureCodexLbDesktopRouting, ensureGlobalCodexFastModeDuringInstall, repairCodexLbAuth } from '../cli/install-helpers.js';
 import { escapeRegExp } from '../core/text/regex.js';
 const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-fast-ui-'));
 const home = path.join(tmp, 'home');
@@ -10,18 +10,24 @@ const codexHome = path.join(home, '.codex');
 const configPath = codexLbConfigPath(home);
 const envPath = codexLbEnvPath(home);
 const authPath = path.join(codexHome, 'auth.json');
-const oauthBackupPath = path.join(codexHome, 'auth.chatgpt-backup.json');
+const remoteBaseUrl = 'https://lb.example.test/backend-api/codex';
+const bridgeBaseUrl = 'http://127.0.0.1:54321/backend-api/codex';
 await fs.mkdir(codexHome, { recursive: true });
-const oauthAuth = JSON.stringify({
+const oauthAuth = `${JSON.stringify({
     auth_mode: 'chatgpt',
-    tokens: { id_token: 'oauth-id', access_token: 'oauth-access', refresh_token: 'oauth-refresh' },
+    tokens: {
+        id_token: 'oauth-id',
+        access_token: 'oauth-access',
+        refresh_token: 'oauth-refresh'
+    },
     account_id: 'acct-fast-ui-fixture'
-}, null, 2);
+}, null, 2)}\n`;
 await fs.writeFile(configPath, [
     'model = "future-codex-model"',
     'model_reasoning_effort = "low"',
-    'model_provider = "codex-lb"',
     'service_tier = "fast"',
+    '# sks-codex-lb-managed-desktop-bridge',
+    `openai_base_url = "${bridgeBaseUrl}"`,
     '',
     '[features]',
     'fast_mode = true',
@@ -32,61 +38,96 @@ await fs.writeFile(configPath, [
     'enabled = true',
     '',
     '[model_providers.codex-lb]',
-    'name = "openai"',
-    'base_url = "https://lb.example.test/backend-api/codex"',
+    'name = "codex-lb"',
+    `base_url = "${remoteBaseUrl}"`,
     'wire_api = "responses"',
     'env_key = "CODEX_LB_API_KEY"',
     'supports_websockets = true',
     'requires_openai_auth = false',
     ''
 ].join('\n'));
-await fs.writeFile(envPath, 'export CODEX_LB_BASE_URL="https://lb.example.test/backend-api/codex"\nexport CODEX_LB_API_KEY="sk-test-fast-ui"\n');
-await fs.writeFile(authPath, `${oauthAuth}\n`);
-const toolOutputRecoveryFetch = async () => new Response('{}', {
-    status: 200,
-    headers: {
-        'content-type': 'application/json',
-        'x-app-version': '1.21.0-beta.3'
-    }
+await fs.writeFile(envPath, `export CODEX_LB_BASE_URL="${remoteBaseUrl}"\nexport CODEX_LB_API_KEY="sk-test-fast-ui"\n`);
+await fs.writeFile(authPath, oauthAuth);
+const install = await ensureGlobalCodexFastModeDuringInstall({
+    home,
+    configPath,
+    forceFastMode: true
+});
+const firstRepair = await repairCodexLbAuth({
+    home,
+    configPath,
+    envPath,
+    forceCodexLbApiKeyAuth: true,
+    forceFastMode: true,
+    authMode: 'codex-lb'
 });
-const install = await ensureGlobalCodexFastModeDuringInstall({ home, configPath, forceFastMode: true });
-const firstRepair = await repairCodexLbAuth({ home, configPath, envPath, forceCodexLbApiKeyAuth: true, forceFastMode: true, authMode: 'codex-lb', toolOutputRecoveryFetch });
 const firstConfig = await fs.readFile(configPath, 'utf8');
-const firstAssert = assertConfig(firstConfig, 'first_use_codex_lb');
-const release = await releaseCodexLbAuthHold({ home, configPath, authPath, backupPath: oauthBackupPath });
-const releasedConfig = await fs.readFile(configPath, 'utf8');
-const releaseAssert = {
-    label: 'use_oauth',
-    ok: !topLevelKey(releasedConfig, 'model_provider') && !hasLegacyFastModeTables(releasedConfig),
-    blockers: [
-        ...(topLevelKey(releasedConfig, 'model_provider') ? ['model_provider_still_selected_after_use_oauth'] : []),
-        ...(hasLegacyFastModeTables(releasedConfig) ? ['legacy_fast_mode_tables_survived_use_oauth'] : [])
-    ]
-};
-const secondRepair = await repairCodexLbAuth({ home, configPath, envPath, forceCodexLbApiKeyAuth: true, forceFastMode: true, authMode: 'codex-lb', toolOutputRecoveryFetch });
-const secondConfig = await fs.readFile(configPath, 'utf8');
-const secondAssert = assertConfig(secondConfig, 'second_use_codex_lb');
+const firstAuth = await fs.readFile(authPath, 'utf8');
+const firstAssert = assertConfig(firstConfig, 'native_repair');
+const disabled = await configureCodexLbDesktopRouting({
+    mode: 'disabled',
+    home,
+    configPath,
+    authPath
+});
+const disabledConfig = await fs.readFile(configPath, 'utf8');
+const disabledAuth = await fs.readFile(authPath, 'utf8');
+const disableAssert = assertConfig(disabledConfig, 'routing_disabled', {
+    expectBridge: false
+});
+const reenabled = await configureCodexLbDesktopRouting({
+    mode: 'desktop-native-bridge',
+    home,
+    configPath,
+    authPath,
+    bridgeBaseUrl,
+    remoteBaseUrl,
+    gatewayAuthTransport: 'x-codex-lb-api-key'
+});
+const reenabledConfig = await fs.readFile(configPath, 'utf8');
+const reenabledAuth = await fs.readFile(authPath, 'utf8');
+const reenableAssert = assertConfig(reenabledConfig, 'native_reenabled');
+const authPreserved = [firstAuth, disabledAuth, reenabledAuth]
+    .every((value) => value === oauthAuth);
 const report = {
-    schema: 'sks.codex-lb-fast-ui-preservation-check.v1',
-    ok: firstAssert.ok && releaseAssert.ok && secondAssert.ok,
+    schema: 'sks.codex-lb-fast-ui-preservation-check.v2',
+    ok: firstRepair.ok === true
+        && disabled.ok === true
+        && reenabled.ok === true
+        && authPreserved
+        && firstAssert.ok
+        && disableAssert.ok
+        && reenableAssert.ok,
     install_status: install.status,
     first_repair_status: firstRepair.status,
-    release_status: release.status,
-    second_repair_status: secondRepair.status,
-    assertions: [firstAssert, releaseAssert, secondAssert],
+    disable_status: disabled.status,
+    reenable_status: reenabled.status,
+    oauth_preserved: authPreserved,
+    assertions: [firstAssert, disableAssert, reenableAssert],
     config_path: configPath,
-    blockers: [...firstAssert.blockers, ...releaseAssert.blockers, ...secondAssert.blockers]
+    blockers: [
+        ...(authPreserved ? [] : ['chatgpt_oauth_changed_during_routing_or_fast_repair']),
+        ...firstAssert.blockers,
+        ...disableAssert.blockers,
+        ...reenableAssert.blockers
+    ]
 };
 console.log(JSON.stringify(report, null, 2));
 if (!report.ok)
     process.exitCode = 1;
-function assertConfig(text, label) {
+function assertConfig(text, label, options = {}) {
+    const expectBridge = options.expectBridge !== false;
     const blockers = [
         ...(hasLegacyFastModeTables(text) ? ['legacy_fast_mode_tables_present'] : []),
         ...(tableKey(text, 'features', 'fast_mode') === 'true' ? [] : ['features_fast_mode_not_true']),
         ...(tableKey(text, 'features', 'fast_mode_ui') ? ['features_fast_mode_ui_legacy_flag_present'] : []),
         ...(hasTable(text, 'model_providers.codex-lb') ? [] : ['codex_lb_provider_table_missing']),
-        ...(tableKey(text, 'model_providers.codex-lb', 'requires_openai_auth') === 'true' ? [] : ['requires_openai_auth_not_true']),
+        ...(tableKey(text, 'model_providers.codex-lb', 'name') === 'codex-lb' ? [] : ['cli_provider_name_not_codex_lb']),
+        ...(tableKey(text, 'model_providers.codex-lb', 'requires_openai_auth') === 'false' ? [] : ['cli_provider_requires_openai_auth_not_false']),
+        ...(tableKey(text, 'model_providers.codex-lb', 'env_key') === 'CODEX_LB_API_KEY' ? [] : ['cli_provider_env_key_missing']),
+        ...(topLevelKey(text, 'model_provider') ? ['desktop_model_provider_must_not_be_selected'] : []),
+        ...(expectBridge && topLevelKey(text, 'openai_base_url') !== bridgeBaseUrl ? ['native_bridge_base_url_missing'] : []),
+        ...(!expectBridge && topLevelKey(text, 'openai_base_url') ? ['disabled_routing_still_has_openai_base_url'] : []),
         ...(topLevelKey(text, 'model') === 'future-codex-model' ? [] : ['user_model_not_preserved']),
         ...(topLevelKey(text, 'model_reasoning_effort') === 'low' ? [] : ['user_reasoning_effort_not_preserved'])
     ];