sneakoscope 7.3.0 → 7.6.0

package/dist/core/codex-control/codex-app-server-runtime-env.js

@@ -0,0 +1,86 @@
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { readTopLevelTomlString } from '../codex-app/codex-model-catalog.js';
+import { loadCodexLbEnv } from '../codex-lb/codex-lb-env.js';
+export const CODEX_APP_SERVER_PROVIDER_CREDENTIALS_UNAVAILABLE = 'codex_app_server_provider_credentials_unavailable';
+export const CODEX_APP_SERVER_CONFIG_READ_FAILED = 'codex_app_server_config_read_failed';
+export class CodexAppServerRuntimeEnvError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'CodexAppServerRuntimeEnvError';
+    }
+}
+export function codexAppServerExecutablePath(input) {
+    const home = path.resolve(input.home || process.env.HOME || os.homedir());
+    const candidates = [
+        path.dirname(path.resolve(input.nodeBin)),
+        path.join(home, '.local', 'bin'),
+        ...(input.inheritedPath || '').split(path.delimiter),
+        '/opt/homebrew/bin',
+        '/usr/local/bin',
+        '/usr/bin',
+        '/bin',
+        '/usr/sbin',
+        '/sbin'
+    ];
+    return [...new Set(candidates
+            .map((entry) => String(entry || '').trim())
+            .filter((entry) => path.isAbsolute(entry)))]
+        .join(path.delimiter);
+}
+export async function prepareCodexAppServerRuntimeEnv(input = {}) {
+    const sourceEnv = input.env || process.env;
+    const home = path.resolve(input.home || sourceEnv.HOME || os.homedir());
+    const codexHome = path.resolve(input.codexHome || sourceEnv.CODEX_HOME || path.join(home, '.codex'));
+    let configText = input.configText;
+    if (configText === undefined) {
+        const configPath = path.join(codexHome, 'config.toml');
+        const readConfigText = input.readConfigTextImpl
+            ?? ((file) => fsp.readFile(file, 'utf8'));
+        try {
+            configText = await readConfigText(configPath);
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                configText = '';
+            else
+                throw new CodexAppServerRuntimeEnvError(CODEX_APP_SERVER_CONFIG_READ_FAILED);
+        }
+    }
+    const selectedProvider = readTopLevelTomlString(configText, 'model_provider');
+    const env = {
+        ...sourceEnv,
+        PATH: codexAppServerExecutablePath({
+            nodeBin: input.nodeBin || process.execPath,
+            home,
+            ...(sourceEnv.PATH === undefined ? {} : { inheritedPath: sourceEnv.PATH })
+        })
+    };
+    if (selectedProvider !== 'codex-lb') {
+        delete env.CODEX_LB_API_KEY;
+        delete env.CODEX_LB_BASE_URL;
+        return env;
+    }
+    const load = input.loadCodexLbEnvImpl || loadCodexLbEnv;
+    let loaded = null;
+    try {
+        loaded = await load({
+            home,
+            processEnv: {},
+            envPath: path.join(codexHome, 'sks-codex-lb.env'),
+            metadataPath: path.join(codexHome, 'sks-codex-lb.json')
+        });
+    }
+    catch {
+        throw new CodexAppServerRuntimeEnvError(CODEX_APP_SERVER_PROVIDER_CREDENTIALS_UNAVAILABLE);
+    }
+    if (!loaded?.configured || !loaded.secret_api_key || !loaded.base_url) {
+        throw new CodexAppServerRuntimeEnvError(CODEX_APP_SERVER_PROVIDER_CREDENTIALS_UNAVAILABLE);
+    }
+    env.CODEX_LB_API_KEY = loaded.secret_api_key;
+    env.CODEX_LB_BASE_URL = loaded.base_url;
+    return env;
+}

package/dist/core/codex-control/codex-app-server-v2-client.js

@@ -1,18 +1,34 @@
 import { spawn } from 'node:child_process';
 import { nowIso, PACKAGE_VERSION } from '../fsx.js';
 import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
+export class CodexAppServerRequestError extends Error {
+    method;
+    kind;
+    rpcCode;
+    constructor(method, kind, message, rpcCode = null) {
+        super(message);
+        this.method = method;
+        this.kind = kind;
+        this.rpcCode = rpcCode;
+        this.name = 'CodexAppServerRequestError';
+    }
+}
 export class CodexAppServerV2Client {
     command;
     args;
     env;
     cwd;
     timeoutMs;
+    maxFrameBytes;
+    maxNotifications;
+    maxNotificationBytes;
     currentTimeProvider;
     approvalPolicy;
     child = null;
     nextId = 1;
     pending = new Map();
     notifications = [];
+    notificationBytes = 0;
     listeners = new Set();
     stdoutBuffer = '';
     stderr = '';
@@ -22,6 +38,9 @@ export class CodexAppServerV2Client {
         this.env = options.env || process.env;
         this.cwd = options.cwd || process.cwd();
         this.timeoutMs = Number(options.timeoutMs || 20_000);
+        this.maxFrameBytes = Math.max(1_024, Math.min(32 * 1024 * 1024, options.maxFrameBytes ?? 8 * 1024 * 1024));
+        this.maxNotifications = Math.max(16, Math.min(8_192, options.maxNotifications ?? 2_048));
+        this.maxNotificationBytes = Math.max(1_024, Math.min(64 * 1024 * 1024, options.maxNotificationBytes ?? 4 * 1024 * 1024));
         this.currentTimeProvider = options.currentTimeProvider || (() => new Date());
         this.approvalPolicy = options.approvalPolicy || {};
     }
@@ -57,6 +76,12 @@ export class CodexAppServerV2Client {
     async readThread(threadId, includeTurns = false) {
         return await this.request('thread/read', { threadId, includeTurns });
     }
+    async listThreadTurns(threadId, params = {}) {
+        return await this.request('thread/turns/list', {
+            threadId,
+            ...normalizeThreadListParams(params)
+        });
+    }
     async startTurn(params = {}) {
         return await this.request('turn/start', params);
     }
@@ -131,9 +156,9 @@ export class CodexAppServerV2Client {
             if (this.stderr.length > 64 * 1024)
                 this.stderr = this.stderr.slice(-64 * 1024);
         });
-        this.child.on('error', (err) => this.rejectAll(err));
+        this.child.on('error', (err) => this.rejectAll(err, 'transport'));
         this.child.on('close', (code, signal) => {
-            this.rejectAll(new Error(`Codex app-server exited before response (code ${code ?? signal ?? 'unknown'}). ${this.stderr.trim()}`.trim()));
+            this.rejectAll(new Error(`Codex app-server exited before response (code ${code ?? signal ?? 'unknown'}). ${this.stderr.trim()}`.trim()), 'process_exit');
         });
     }
     request(method, params) {
@@ -143,7 +168,7 @@ export class CodexAppServerV2Client {
         return new Promise((resolve, reject) => {
             const timer = setTimeout(() => {
                 this.pending.delete(id);
-                reject(new Error(`Codex app-server request timed out: ${method}. ${this.stderr.trim()}`.trim()));
+                reject(new CodexAppServerRequestError(method, 'timeout', `Codex app-server request timed out: ${method}. ${this.stderr.trim()}`.trim()));
             }, this.timeoutMs);
             timer.unref?.();
             this.pending.set(id, { method, resolve, reject, timer });
@@ -158,9 +183,17 @@ export class CodexAppServerV2Client {
         this.stdoutBuffer += chunk.toString('utf8');
         const lines = this.stdoutBuffer.split(/\r?\n/);
         this.stdoutBuffer = lines.pop() || '';
+        if (Buffer.byteLength(this.stdoutBuffer, 'utf8') > this.maxFrameBytes) {
+            this.abortProtocol('codex_app_server_frame_too_large');
+            return;
+        }
         for (const line of lines) {
             if (!line.trim())
                 continue;
+            if (Buffer.byteLength(line, 'utf8') > this.maxFrameBytes) {
+                this.abortProtocol('codex_app_server_frame_too_large');
+                return;
+            }
             let message;
             try {
                 message = JSON.parse(line);
@@ -176,7 +209,18 @@ export class CodexAppServerV2Client {
             }
             else {
                 const event = { ...message, received_at: nowIso() };
-                this.notifications.push(event);
+                const eventBytes = notificationByteLength(event);
+                if (eventBytes <= this.maxNotificationBytes) {
+                    this.notifications.push(event);
+                    this.notificationBytes += eventBytes;
+                    while (this.notifications.length > this.maxNotifications
+                        || this.notificationBytes > this.maxNotificationBytes) {
+                        const removed = this.notifications.shift();
+                        if (!removed)
+                            break;
+                        this.notificationBytes = Math.max(0, this.notificationBytes - notificationByteLength(removed));
+                    }
+                }
                 for (const listener of this.listeners) {
                     try {
                         listener(event);
@@ -247,15 +291,16 @@ export class CodexAppServerV2Client {
             return;
         this.pending.delete(id);
         clearTimeout(pending.timer);
-        if (message.error)
-            pending.reject(new Error(jsonRpcErrorMessage(pending.method, message.error)));
+        if (message.error) {
+            pending.reject(new CodexAppServerRequestError(pending.method, 'rpc_rejection', jsonRpcErrorMessage(pending.method, message.error), jsonRpcErrorCode(message.error)));
+        }
         else
             pending.resolve(message.result);
     }
-    rejectAll(err) {
+    rejectAll(err, kind) {
         for (const [id, pending] of this.pending.entries()) {
             clearTimeout(pending.timer);
-            pending.reject(err);
+            pending.reject(new CodexAppServerRequestError(pending.method, kind, err.message));
             this.pending.delete(id);
         }
     }
@@ -270,6 +315,16 @@ export class CodexAppServerV2Client {
     write(message) {
         this.child?.stdin.write(`${JSON.stringify(message)}\n`);
     }
+    abortProtocol(code) {
+        const child = this.child;
+        this.child = null;
+        this.stdoutBuffer = '';
+        this.rejectAll(new Error(code), 'protocol_overflow');
+        if (!child)
+            return;
+        child.stdin.end();
+        child.kill('SIGTERM');
+    }
 }
 export async function createCodexAppServerV2Client(options = {}) {
     const runtime = await resolveCodexRuntime({
@@ -287,6 +342,12 @@ export async function createCodexAppServerV2Client(options = {}) {
         clientOptions.env = options.env;
     if (options.timeoutMs !== undefined)
         clientOptions.timeoutMs = options.timeoutMs;
+    if (options.maxFrameBytes !== undefined)
+        clientOptions.maxFrameBytes = options.maxFrameBytes;
+    if (options.maxNotifications !== undefined)
+        clientOptions.maxNotifications = options.maxNotifications;
+    if (options.maxNotificationBytes !== undefined)
+        clientOptions.maxNotificationBytes = options.maxNotificationBytes;
     if (options.currentTimeProvider !== undefined)
         clientOptions.currentTimeProvider = options.currentTimeProvider;
     if (options.approvalPolicy !== undefined)
@@ -317,6 +378,12 @@ function jsonRpcErrorMessage(method, error) {
         return `${method}: ${String(error.message)}`;
     return `${method}: ${JSON.stringify(error)}`;
 }
+function jsonRpcErrorCode(error) {
+    if (!error || typeof error !== 'object' || !('code' in error))
+        return null;
+    const code = Number(error.code);
+    return Number.isSafeInteger(code) ? code : null;
+}
 function isTurnCompletionEvent(event, threadId, turnId) {
     if (String(event.method || '') !== 'turn/completed')
         return false;
@@ -329,3 +396,6 @@ function isTurnCompletionEvent(event, threadId, turnId) {
     return String(params.threadId || '') === threadId
         && (!turnId || String(completedTurn.id || params.turnId || '') === turnId);
 }
+function notificationByteLength(event) {
+    return Buffer.byteLength(JSON.stringify(event), 'utf8');
+}

package/dist/core/codex-control/codex-task-runner.js

@@ -595,12 +595,12 @@ async function ensurePythonCodexLbConfig(env, config) {
         'approval_policy = "never"',
         '',
         '[model_providers.codex-lb]',
-        'name = "openai"',
+        'name = "codex-lb"',
         `base_url = ${tomlQuote(lbBaseUrl)}`,
         'wire_api = "responses"',
         'env_key = "CODEX_LB_API_KEY"',
         'supports_websockets = true',
-        'requires_openai_auth = true',
+        'requires_openai_auth = false',
         ''
     ].join('\n');
     const configPath = path.join(codexHome, 'config.toml');

package/dist/core/codex-lb/capability-runner.js

@@ -0,0 +1,204 @@
+import { runAuxiliarySurfacesProbe } from './probes/auxiliary-surfaces-probe.js';
+import { runBridgeProbe, gatewayAuthTransportEvidence } from './probes/bridge-probe.js';
+import { runCatalogProbe } from './probes/catalog-probe.js';
+import { runComputerUseProbe } from './probes/computer-use-probe.js';
+import { runImageGenerationProbe } from './probes/image-generation-probe.js';
+import { probeEvidence } from './probes/probe-evidence.js';
+import { runVoiceRealtimeProbe } from './probes/voice-realtime-probe.js';
+import { CODEX_LB_DEEP_EVIDENCE_VALIDATION_SCHEMA } from './trusted-deep-evidence.js';
+const REQUIRED_FOR_FULL = [
+    'gateway_auth_transport',
+    'provider_identity',
+    'bridge',
+    'catalog',
+    'model_picker',
+    'fast_mode',
+    'image_generation',
+    'computer_use',
+    'browser_use',
+    'voice_mode',
+    'plugins',
+    'auxiliary_surfaces'
+];
+export function runCodexLbDesktopCapabilityReport(input) {
+    const level = input.level || 'shallow';
+    const checkedAt = input.checkedAt || new Date().toISOString();
+    const manifest = input.manifest || null;
+    const catalog = runCatalogProbe({
+        mode: input.mode,
+        level,
+        checkedAt,
+        manifest,
+        ...(input.catalog || {})
+    });
+    const providerIdentityBlockers = [
+        ...(input.providerIdentity?.blockers || []),
+        ...(input.providerIdentity?.requiresOauth === true && input.oauthPreserved !== true
+            ? ['chatgpt_oauth_identity_not_preserved']
+            : [])
+    ];
+    const providerIdentity = probeEvidence({
+        ...(input.providerIdentity || {}),
+        blockers: providerIdentityBlockers,
+        evidence: {
+            ...(input.providerIdentity?.evidence || {}),
+            oauth_required: input.providerIdentity?.requiresOauth === true,
+            oauth_preserved: input.oauthPreserved === true
+        }
+    }, checkedAt);
+    const bridge = runBridgeProbe({
+        mode: input.mode,
+        level,
+        checkedAt,
+        manifest,
+        ...(input.bridge || {})
+    });
+    const reportWithoutOverall = {
+        schema: 'sks.codex-lb-desktop-capabilities.v2',
+        mode: input.mode,
+        configured: input.configured === true,
+        oauth_preserved: input.oauthPreserved === true,
+        gateway_auth_transport: gatewayAuthTransportEvidence({
+            checkedAt,
+            ...(input.gatewayAuth || {})
+        }),
+        provider_identity: providerIdentity,
+        bridge,
+        catalog: catalog.catalog,
+        model_picker: catalog.model_picker,
+        fast_mode: catalog.fast_mode,
+        text_responses: probeEvidence(input.textResponses || {
+            skipped: true,
+            evidence: { reason: 'text_responses_probe_not_run' }
+        }, checkedAt),
+        image_generation: runImageGenerationProbe({
+            level,
+            checkedAt,
+            manifestRouteAdvertised: manifestFlag(manifest, 'routes', 'images_generations')
+                ?? manifestFlag(manifest, 'routes', 'responses_http')
+                ?? undefined,
+            toolAdvertised: manifestFlag(manifest, 'tools', 'image_generation') ?? undefined,
+            ...(input.imageGeneration || {})
+        }),
+        computer_use: runComputerUseProbe({
+            level,
+            checkedAt,
+            toolAdvertised: manifestFlag(manifest, 'tools', 'computer_use_passthrough') ?? undefined,
+            ...(input.computerUse || {})
+        }),
+        browser_use: probeEvidence(input.browserUse || {
+            source: 'config',
+            evidence: {
+                independent_from_computer_use: true,
+                independent_from_auth_mode: true,
+                reason: 'browser_use_probe_not_run'
+            }
+        }, checkedAt),
+        voice_mode: runVoiceRealtimeProbe({
+            level,
+            checkedAt,
+            routeAdvertised: manifestFlag(manifest, 'routes', 'realtime_calls') ?? undefined,
+            ...(input.voiceMode || {})
+        }),
+        plugins: probeEvidence(input.plugins || {
+            source: 'config',
+            evidence: {
+                independent_from_auth_mode: true
+            }
+        }, checkedAt),
+        auxiliary_surfaces: runAuxiliarySurfacesProbe({
+            level,
+            checkedAt,
+            routesAdvertised: auxiliaryRoutesAdvertised(manifest),
+            ...(input.auxiliarySurfaces || {})
+        })
+    };
+    return {
+        ...reportWithoutOverall,
+        deep_evidence_validation: input.deepEvidenceValidation || {
+            schema: CODEX_LB_DEEP_EVIDENCE_VALIDATION_SCHEMA,
+            state: 'available_unverified',
+            trusted: false,
+            evidence: null,
+            producer_id: null,
+            created_at: null,
+            content_sha256: null,
+            trust_anchor_id: null,
+            blockers: ['codex_lb_deep_evidence_missing'],
+            warnings: []
+        },
+        overall: overallCapabilityState(reportWithoutOverall)
+    };
+}
+export function overallCapabilityState(report) {
+    if (report.mode === 'cli-provider' || report.mode === 'disabled')
+        return 'available_unverified';
+    const required = report.mode === 'desktop-native-bridge'
+        ? REQUIRED_FOR_FULL
+        : REQUIRED_FOR_FULL.filter((key) => key !== 'bridge');
+    const states = required.map((key) => report[key].state);
+    if (states.some((state) => state === 'blocked'))
+        return 'blocked';
+    if (states.some((state) => state === 'unsupported'))
+        return 'unsupported';
+    if (report.configured && states.every((state) => state === 'verified'))
+        return 'verified';
+    return 'available_unverified';
+}
+export function shapeCodexLbDesktopCapabilityStatus(report) {
+    const entries = capabilityEntries(report);
+    return {
+        schema: 'sks.codex-lb-desktop-capability-status.v2',
+        ready: report.overall === 'verified',
+        state: report.overall,
+        configured: report.configured,
+        oauth_preserved: report.oauth_preserved,
+        gateway_auth_transport: String(report.gateway_auth_transport.evidence.configured_gateway_auth_transport || 'unknown'),
+        verified: entries.filter(([, value]) => value.state === 'verified').map(([key]) => key),
+        available_unverified: entries.filter(([, value]) => value.state === 'available_unverified').map(([key]) => key),
+        blocked: Object.fromEntries(entries
+            .filter(([, value]) => value.state === 'blocked')
+            .map(([key, value]) => [key, value.blockers])),
+        unsupported: entries.filter(([, value]) => value.state === 'unsupported').map(([key]) => key),
+        skipped: entries.filter(([, value]) => value.state === 'skipped').map(([key]) => key)
+    };
+}
+function capabilityEntries(report) {
+    const keys = [
+        'gateway_auth_transport',
+        'provider_identity',
+        'bridge',
+        'catalog',
+        'model_picker',
+        'fast_mode',
+        'text_responses',
+        'image_generation',
+        'computer_use',
+        'browser_use',
+        'voice_mode',
+        'plugins',
+        'auxiliary_surfaces'
+    ];
+    return keys.map((key) => [key, report[key]]);
+}
+function manifestFlag(manifest, section, key) {
+    const row = manifest?.[section];
+    if (!row || typeof row !== 'object' || Array.isArray(row))
+        return null;
+    const value = row[key];
+    return typeof value === 'boolean' ? value : null;
+}
+function auxiliaryRoutesAdvertised(manifest) {
+    if (!manifest)
+        return undefined;
+    const flags = [
+        manifestFlag(manifest, 'routes', 'files'),
+        manifestFlag(manifest, 'routes', 'transcribe'),
+        manifestFlag(manifest, 'routes', 'images_edits'),
+        manifestFlag(manifest, 'routes', 'thread_goal'),
+        manifestFlag(manifest, 'routes', 'memories_trace_summarize'),
+        manifestFlag(manifest, 'routes', 'safety_arc'),
+        manifestFlag(manifest, 'routes', 'agent_identities_jwks')
+    ];
+    return flags.some((flag) => flag === true);
+}

package/dist/core/codex-lb/capability-types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/codex-lb/codex-lb-env.js

@@ -14,9 +14,6 @@ if r != errSecSuccess{FileHandle.standardError.write(Data("keychain_status=\\(r)
 export function codexLbEnvPath(home = process.env.HOME || os.homedir()) {
     return path.join(String(home || os.homedir()), '.codex', 'sks-codex-lb.env');
 }
-export function legacyCodexLbEnvPath(home = process.env.HOME || os.homedir()) {
-    return path.join(String(home || os.homedir()), '.codex', 'sks.env');
-}
 export function codexLbMetadataPath(home = process.env.HOME || os.homedir()) {
     return path.join(String(home || os.homedir()), '.codex', 'sks-codex-lb.json');
 }
@@ -65,9 +62,13 @@ export async function readCodexLbModelCatalog(opts = {}) {
         };
     }
     const fetchImpl = opts.fetchImpl || fetch;
+    const gatewayAuthTransport = opts.gatewayAuthTransport || 'x-codex-lb-api-key';
+    const gatewayHeaders = gatewayAuthTransport === 'authorization-bearer-compat'
+        ? { Authorization: `Bearer ${loaded.secret_api_key}` }
+        : { 'X-Codex-LB-API-Key': loaded.secret_api_key };
     try {
         const response = await fetchImpl(`${loaded.base_url}/models`, {
-            headers: { Authorization: `Bearer ${loaded.secret_api_key}` },
+            headers: gatewayHeaders,
             redirect: 'error',
             signal: AbortSignal.timeout(Math.max(250, Number(opts.timeoutMs || 5000)))
         });
@@ -159,24 +160,19 @@ export function codexLbBaseUrlSecurityBlocker(input) {
 export async function loadCodexLbEnv(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const metadataPath = opts.metadataPath || codexLbMetadataPath(home);
-    const envPaths = [
-        opts.envPath || codexLbEnvPath(home),
-        opts.legacyEnvPath || legacyCodexLbEnvPath(home)
-    ];
-    const sourcePriority = ['process.env', 'env-file', 'keychain', 'legacy-env-file'];
+    const envPaths = [opts.envPath || codexLbEnvPath(home)];
+    const sourcePriority = ['env-file', 'keychain', 'process.env'];
     if (opts.allowProjectSecrets)
         sourcePriority.push('project-local');
     const processEnv = pickEnv(opts.processEnv || process.env);
     const envFile = await readEnvFile(envPaths[0]);
-    const legacyEnv = await readEnvFile(envPaths[1]);
     const keychain = await readMacKeychain(opts);
     const projectLocal = opts.allowProjectSecrets ? await readEnvFile(path.join(opts.root || process.cwd(), '.env')) : {};
     const metadata = await readCodexLbCredentialMetadata(metadataPath);
     const apiKeyCandidates = [
-        { source: 'process.env', apiKey: processEnv.apiKey },
         { source: 'env-file', apiKey: envFile.apiKey },
         { source: 'keychain', apiKey: keychain.apiKey },
-        { source: 'legacy-env-file', apiKey: legacyEnv.apiKey },
+        { source: 'process.env', apiKey: processEnv.apiKey },
         ...(opts.allowProjectSecrets ? [{ source: 'project-local', apiKey: String(projectLocal.apiKey || '') }] : [])
     ].filter((candidate) => Boolean(candidate.apiKey));
     const candidateFingerprints = await Promise.all(apiKeyCandidates.map(async (candidate) => ({
@@ -188,7 +184,7 @@ export async function loadCodexLbEnv(opts = {}) {
         : candidateFingerprints[0];
     const keySource = selectedApiKey?.source || 'missing';
     const apiKey = selectedApiKey?.apiKey || '';
-    const configuredBaseUrl = normalizeCodexLbBaseUrl(processEnv.baseUrl || envFile.baseUrl || legacyEnv.baseUrl || projectLocal.baseUrl || '');
+    const configuredBaseUrl = normalizeCodexLbBaseUrl(envFile.baseUrl || processEnv.baseUrl || projectLocal.baseUrl || '');
     const apiKeySha256 = selectedApiKey?.sha256 || '';
     const binding = evaluateCodexLbCredentialBinding({
         metadata,

package/dist/core/codex-lb/codex-lb-setup.js

@@ -2,22 +2,59 @@ import os from 'node:os';
 import path from 'node:path';
 import { ensureDir, exists, readText, writeTextAtomic } from '../fsx.js';
 import { codexLbEnvPath, codexLbMetadataPath, normalizeCodexLbBaseUrl } from './codex-lb-env.js';
+import { DEFAULT_CODEX_LB_DESKTOP_MODE, DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT } from './desktop-mode.js';
 export function buildCodexLbSetupPlan(answers, opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const baseUrl = normalizeCodexLbBaseUrl(answers.host_or_base_url);
     const configPath = opts.configPath || path.join(home, '.codex', 'config.toml');
     const envPath = opts.envPath || codexLbEnvPath(home);
     const metadataPath = opts.metadataPath || codexLbMetadataPath(home);
+    const desktopMode = answers.desktop_mode || DEFAULT_CODEX_LB_DESKTOP_MODE;
+    const gatewayAuthTransport = answers.gateway_auth_transport || DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT;
     const blockers = [];
     if (!baseUrl)
         blockers.push('missing_host_or_base_url');
     if (answers.install_shell_profile !== 'skip' && !answers.write_env_file)
         blockers.push('shell_profile_snippet_requires_env_file');
-    const actions = [
-        { type: 'write_config_provider', target: configPath, effect: 'write or update [model_providers.codex-lb] with name="openai", the normalized base URL, CODEX_LB_API_KEY env_key, WebSocket support, and requires_openai_auth=true for Codex App routing' }
-    ];
-    if (answers.use_as_default_provider) {
-        actions.push({ type: 'select_default_provider', target: configPath, effect: 'set top-level model_provider = "codex-lb"' });
+    const actions = [];
+    if (desktopMode === 'desktop-native-bridge') {
+        actions.push({
+            type: 'configure_desktop_native_bridge',
+            target: configPath,
+            effect: `keep built-in OpenAI and ChatGPT OAuth, route model traffic through a loopback bridge, and use explicit gateway auth transport ${gatewayAuthTransport}`
+        });
+        actions.push({
+            type: 'start_desktop_bridge',
+            target: 'SKS Codex Desktop bridge',
+            effect: 'start the loopback-only bridge without changing Codex Desktop auth'
+        });
+        actions.push({
+            type: 'verify_oauth_preserved',
+            target: path.join(home, '.codex', 'auth.json'),
+            effect: 'verify byte identity before App restart and semantic OAuth identity afterward'
+        });
+    }
+    else if (desktopMode === 'desktop-dual-auth-compat') {
+        if (gatewayAuthTransport !== 'x-codex-lb-api-key') {
+            blockers.push('desktop_compat_requires_x_codex_lb_api_key_transport');
+        }
+        actions.push({
+            type: 'configure_desktop_compat_provider',
+            target: configPath,
+            effect: 'configure exact provider name "OpenAI", retain ChatGPT OAuth, and send the separate LB key only with X-Codex-LB-API-Key'
+        });
+        actions.push({
+            type: 'verify_oauth_preserved',
+            target: path.join(home, '.codex', 'auth.json'),
+            effect: 'verify Desktop configuration did not change shared OAuth bytes'
+        });
+    }
+    else if (desktopMode === 'cli-provider') {
+        actions.push({
+            type: 'write_cli_provider',
+            target: configPath,
+            effect: 'write an unselected CLI-only codex-lb provider using CODEX_LB_API_KEY without changing Desktop OAuth'
+        });
     }
     if (answers.write_env_file) {
         actions.push({ type: 'write_env_file', target: envPath, effect: 'write CODEX_LB_BASE_URL and redacted CODEX_LB_API_KEY env loader with chmod 0600' });
@@ -32,7 +69,7 @@ export function buildCodexLbSetupPlan(answers, opts = {}) {
         actions.push({ type: 'install_shell_profile_snippet', target: profileTargets(home, answers.install_shell_profile).join(', '), effect: `install managed shell snippet for ${answers.install_shell_profile}` });
     }
     if (answers.run_health_check) {
-        actions.push({ type: 'run_health_check', target: 'codex-lb response chain', effect: 'run codex-lb health check after apply' });
+        actions.push({ type: 'run_capability_check', target: 'codex-lb response chain', effect: 'run codex-lb capability check after apply' });
     }
     actions.push({ type: 'write_metadata', target: metadataPath, effect: 'write redacted setup metadata and key fingerprint with chmod 0600' });
     const selectedModes = selectedCodexLbPersistenceModes(answers);
@@ -106,8 +143,8 @@ export function codexLbPersistenceSummary({ selectedModes = [], appliedModes = [
     const warnings = effective === 'process_only_ephemeral'
         ? [
             'process_only_ephemeral',
-            'next_shell_requires_setup_or_env',
-            'Codex App GUI launch may not see credentials'
+            'next_session_requires_center_or_setup',
+            'Save credentials in SKS Center (or sks codex-lb setup --write-env-file --keychain) so Desktop can load them automatically'
         ]
         : [];
     return {