sneakoscope 7.3.0 → 7.6.0

package/dist/core/codex-lb/codex-lb-tool-catalog.js

@@ -11,58 +11,18 @@ const CODEX_LB_TOOL_CATALOG_MAX_METADATA_BYTES = 16 * 1024;
 const DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 const GPT56_MODEL_RE = /^gpt-5\.6-(?:sol|terra|luna)$/;
 const ensureInflight = new Map();
-const REQUIRED_CODEX_0144_MODEL_FIELDS = {
+const REQUIRED_MODEL_FIELDS = {
     slug: ['string'],
     display_name: ['string'],
     supported_reasoning_levels: ['array'],
-    shell_type: ['string'],
-    visibility: ['string'],
-    supported_in_api: ['boolean'],
-    priority: ['number'],
-    base_instructions: ['string'],
-    support_verbosity: ['boolean'],
-    truncation_policy: ['object'],
-    supports_parallel_tool_calls: ['boolean'],
-    experimental_supported_tools: ['array']
-};
-const REASONING_SUMMARY_FIELD_NAMES = ['supports_reasoning_summaries', 'supports_reasoning_summary_parameter'];
-const CODEX_0144_MODEL_FIELD_TYPES = {
-    ...REQUIRED_CODEX_0144_MODEL_FIELDS,
-    supports_reasoning_summaries: ['boolean'],
-    supports_reasoning_summary_parameter: ['boolean'],
-    description: ['string'],
-    default_reasoning_level: ['string'],
-    additional_speed_tiers: ['array'],
-    service_tiers: ['array'],
-    availability_nux: ['object', 'null'],
-    upgrade: ['object', 'null'],
-    model_messages: ['object'],
-    include_skills_usage_instructions: ['boolean'],
-    default_reasoning_summary: ['string'],
-    default_verbosity: ['string'],
-    apply_patch_tool_type: ['string'],
-    web_search_tool_type: ['string'],
-    supports_image_detail_original: ['boolean'],
-    context_window: ['number'],
-    max_context_window: ['number'],
-    comp_hash: ['string'],
-    effective_context_window_percent: ['number'],
-    input_modalities: ['array'],
-    supports_search_tool: ['boolean'],
-    use_responses_lite: ['boolean'],
-    tool_mode: ['string', 'null'],
-    multi_agent_version: ['string', 'null'],
-    minimal_client_version: ['string'],
-    available_in_plans: ['array'],
-    prefer_websockets: ['boolean'],
-    auto_review_model_override: ['string', 'null'],
-    auto_compact_token_limit: ['number', 'null'],
-    reasoning_summary_format: ['string'],
-    default_service_tier: ['string', 'null']
+    truncation_policy: ['object']
 };
 export function isCodexLbGpt56Model(model) {
     return GPT56_MODEL_RE.test(String(model || '').trim());
 }
+export function shouldBindLocalModelCatalog(mode) {
+    return mode === 'desktop-dual-auth-compat' || mode === 'cli-provider';
+}
 export function codexLbToolCatalogPath(codexHome) {
     return path.join(path.resolve(codexHome), CODEX_LB_TOOL_CATALOG_FILENAME);
 }
@@ -85,30 +45,34 @@ export function normalizeCodexLbToolCatalog(payload, opts = {}) {
             validationIssues.push(`codex_lb_model_catalog_row_invalid:${index}:object`);
             return {};
         }
-        const model = String(row.slug || row.id || row.model || row.name || '').trim();
+        let normalized;
+        try {
+            normalized = normalizeCodexLbModelRow(row, index);
+        }
+        catch (error) {
+            validationIssues.push(error instanceof Error ? error.message : `codex_lb_model_catalog_row_invalid:${index}`);
+            return {};
+        }
+        const model = String(normalized.slug || '').trim();
         if (isCodexLbGpt56Model(model))
             gpt56Models.push(model);
-        const sanitized = sanitizeCodex0144Model(row);
-        validationIssues.push(...validateCodex0144Model(sanitized, index));
-        if (!isCodexLbGpt56Model(model))
-            return sanitized;
         if (row.use_responses_lite !== false)
             patchedModels.push(model);
-        return { ...sanitized, use_responses_lite: false };
+        validationIssues.push(...validateKnownModelFields(normalized, index));
+        return normalized;
     });
-    const compatibleRows = models.filter((row) => isCodexLbGpt56Model(row.slug));
-    const compatible = gpt56Models.length > 0
-        && compatibleRows.length === gpt56Models.length
-        && compatibleRows.every((row) => row.use_responses_lite === false);
+    const compatible = models.length > 0
+        && validationIssues.length === 0
+        && models.every((row) => row.use_responses_lite === false);
     const blockers = uniqueBounded([
         ...(rows.length ? [] : ['codex_lb_model_catalog_empty']),
         ...(rows.length > maxModels ? [`codex_lb_model_catalog_model_limit_exceeded:${rows.length}:${maxModels}`] : []),
         ...validationIssues,
-        ...(gpt56Models.length ? [] : ['codex_lb_gpt56_models_missing']),
-        ...(compatible ? [] : ['codex_lb_gpt56_tools_transport_incompatible'])
+        ...(compatible ? [] : ['codex_lb_model_catalog_tools_transport_incompatible'])
     ]);
     return {
         schema: CODEX_LB_TOOL_CATALOG_SCHEMA,
+        contract: 'codex-model-catalog-pass-through.v2',
         ok: blockers.length === 0,
         catalog: { models },
         model_count: models.length,
@@ -230,7 +194,11 @@ async function ensureValidatedCodexLbToolCatalog(input, outputPath, baseUrl, api
             const { catalog: _catalog, ...status } = normalized;
             return { ...status, generated_at: nowIso(), status: 'blocked', path: outputPath, exists: await exists(outputPath), fetched: true, required: true };
         }
-        await writeSecureCatalog(outputPath, normalized.catalog, identity);
+        await writeSecureCatalog(outputPath, normalized.catalog, identity, {
+            upstream_etag: response.headers.get('etag'),
+            upstream_last_modified: response.headers.get('last-modified'),
+            client_version: String(input.clientVersion || 'runtime-discovered')
+        });
         const verified = await inspectCodexLbToolCatalog(outputPath, inspectOpts);
         return {
             ...verified,
@@ -305,7 +273,7 @@ function parseCatalogJson(text) {
         throw new CatalogFetchError('codex_lb_tool_catalog_response_json_invalid');
     }
 }
-async function writeSecureCatalog(file, catalog, identity) {
+async function writeSecureCatalog(file, catalog, identity, upstream) {
     const text = `${JSON.stringify(catalog, null, 2)}\n`;
     const metadataPath = codexLbToolCatalogMetadataPath(file);
     const metadata = {
@@ -314,7 +282,12 @@ async function writeSecureCatalog(file, catalog, identity) {
         catalog_schema: CODEX_LB_TOOL_CATALOG_SCHEMA,
         catalog_sha256: sha256(text),
         identity,
-        model_count: Array.isArray(catalog?.models) ? catalog.models.length : 0
+        model_count: Array.isArray(catalog?.models) ? catalog.models.length : 0,
+        upstream_etag: upstream.upstream_etag,
+        upstream_last_modified: upstream.upstream_last_modified,
+        client_version: upstream.client_version,
+        unknown_fields_preserved: true,
+        normalizations: ['desktop_full_responses_required']
     };
     await ensureDir(path.dirname(file));
     await writeTextAtomic(file, text, { mode: 0o600 });
@@ -344,14 +317,26 @@ async function inspectSecureRegularFile(file, maxBytes, prefix) {
         blockers.push(`${prefix}_mode_insecure:${mode.toString(8)}`);
     return { ok: blockers.length === 0, exists: true, updated_at_ms: stat.mtimeMs, size_bytes: stat.size, mode: mode.toString(8).padStart(3, '0'), owner_uid: ownerUid, blockers };
 }
-function sanitizeCodex0144Model(row) {
-    return Object.fromEntries(Object.keys(CODEX_0144_MODEL_FIELD_TYPES)
-        .filter((field) => Object.prototype.hasOwnProperty.call(row, field))
-        .map((field) => [field, row[field]]));
+export function normalizeCodexLbModelRow(row, index = 0) {
+    const cloned = structuredClone(row);
+    for (const key of Object.keys(cloned)) {
+        if (isSensitiveCatalogField(key))
+            delete cloned[key];
+    }
+    const slug = String(cloned.slug ?? cloned.id ?? cloned.model ?? cloned.name ?? '').trim();
+    if (!slug)
+        throw new Error(`codex_lb_model_catalog_slug_missing:${index}`);
+    if (!Object.prototype.hasOwnProperty.call(cloned, 'slug'))
+        cloned.slug = slug;
+    cloned.use_responses_lite = false;
+    return cloned;
+}
+function isSensitiveCatalogField(field) {
+    return /(?:^|[_-])(?:authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|cookie|set[_-]?cookie)(?:$|[_-])/i.test(field);
 }
-function validateCodex0144Model(row, index) {
+function validateKnownModelFields(row, index) {
     const issues = [];
-    for (const [field, allowedTypes] of Object.entries(REQUIRED_CODEX_0144_MODEL_FIELDS)) {
+    for (const [field, allowedTypes] of Object.entries(REQUIRED_MODEL_FIELDS)) {
         if (!Object.prototype.hasOwnProperty.call(row, field)) {
             issues.push(`codex_lb_model_catalog_required_field_missing:${index}:${field}`);
             continue;
@@ -359,13 +344,6 @@ function validateCodex0144Model(row, index) {
         if (!allowedTypes.includes(valueType(row[field])))
             issues.push(`codex_lb_model_catalog_field_type_invalid:${index}:${field}`);
     }
-    if (!REASONING_SUMMARY_FIELD_NAMES.some((field) => Object.prototype.hasOwnProperty.call(row, field))) {
-        issues.push(`codex_lb_model_catalog_required_field_missing:${index}:supports_reasoning_summaries`);
-    }
-    for (const [field, value] of Object.entries(row)) {
-        if (!(CODEX_0144_MODEL_FIELD_TYPES[field] || []).includes(valueType(value)))
-            issues.push(`codex_lb_model_catalog_field_type_invalid:${index}:${field}`);
-    }
     if (typeof row.slug === 'string' && !row.slug.trim())
         issues.push(`codex_lb_model_catalog_field_empty:${index}:slug`);
     if (typeof row.display_name === 'string' && !row.display_name.trim())
@@ -394,7 +372,7 @@ function catalogIdentity(baseUrl, apiKey) {
         origin: new URL(baseUrl).origin,
         base_url_sha256: sha256(baseUrl),
         api_key_sha256: sha256(apiKey),
-        contract: 'codex-cli-0.144.5-model-catalog'
+        contract: 'codex-model-catalog-pass-through.v2'
     };
 }
 function sameCatalogIdentity(actual, expected) {

package/dist/core/codex-lb/codex-lb-tool-output-recovery.js

@@ -5,7 +5,7 @@ export const CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION = '1.21.0-beta.3';
 export const CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_ENV = 'SKS_ALLOW_UNVERIFIED_CODEX_LB_RECOVERY';
 export const CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG = '--allow-unverified-codex-lb-recovery';
 const UPGRADE_ACTION = `Upgrade codex-lb to ${CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION} or later, then rerun \`sks codex-lb status\`.`;
-const OAUTH_ACTION = 'To avoid the proxy, run `sks codex-lb use-oauth`; SKS will not switch providers silently.';
+const OAUTH_ACTION = 'To bypass codex-lb routing while preserving ChatGPT OAuth, run `sks codex-lb disable`; SKS will not change routing silently.';
 const FRESH_THREAD_ACTION = 'After upgrading or switching providers, open a fresh Codex thread and continue the persisted mission; do not replay the corrupted turn.';
 export async function probeCodexLbToolOutputRecovery(opts = {}) {
     const baseUrl = normalizeCodexLbBaseUrl(opts.baseUrl);

package/dist/core/codex-lb/desktop-auth-invariant.js

@@ -0,0 +1,185 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+export async function captureCodexAuthSnapshot(input = {}) {
+    const home = input.home || process.env.HOME || os.homedir();
+    const authPath = input.authPath || path.join(home, '.codex', 'auth.json');
+    let bytes;
+    try {
+        const stat = await fsp.lstat(authPath);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new Error('desktop_auth_not_regular_file');
+        bytes = await fsp.readFile(authPath);
+    }
+    catch (error) {
+        if (isMissingFileError(error)) {
+            return {
+                path: authPath,
+                exists: false,
+                sha256: null,
+                semantic_fingerprint: null,
+                mode: 'missing',
+                has_refresh_token: false,
+                has_access_token: false,
+                has_api_key: false
+            };
+        }
+        throw error;
+    }
+    const parsed = parseJsonObject(bytes.toString('utf8'));
+    const hasRefreshToken = containsNamedSecret(parsed, /^(?:refresh_token|refreshToken)$/);
+    const hasAccessToken = containsNamedSecret(parsed, /^(?:access_token|accessToken)$/);
+    const hasIdToken = containsNamedSecret(parsed, /^(?:id_token|idToken)$/);
+    const apiKey = findNamedSecret(parsed, /^(?:key|api_key|apiKey|openai_api_key|OPENAI_API_KEY)$/);
+    const hasApiKey = Boolean(apiKey);
+    const authMode = stringField(parsed, ['auth_mode', 'authMode', 'mode']).toLowerCase();
+    const oauth = hasRefreshToken || hasAccessToken || hasIdToken || /chatgpt|oauth|browser/.test(authMode);
+    const mode = oauth && hasApiKey
+        ? 'mixed'
+        : oauth
+            ? 'chatgpt_oauth'
+            : hasApiKey
+                ? 'openai_api_key'
+                : 'unknown';
+    return {
+        path: authPath,
+        exists: true,
+        sha256: sha256(bytes),
+        semantic_fingerprint: oauth ? oauthSemanticFingerprint(parsed) : null,
+        mode,
+        has_refresh_token: hasRefreshToken,
+        has_access_token: hasAccessToken,
+        has_api_key: hasApiKey
+    };
+}
+export async function codexAuthApiKeyMatches(input) {
+    const expectedApiKey = String(input.expectedApiKey || '');
+    if (!expectedApiKey)
+        return false;
+    const home = input.home || process.env.HOME || os.homedir();
+    const authPath = input.authPath || path.join(home, '.codex', 'auth.json');
+    try {
+        const stat = await fsp.lstat(authPath);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return false;
+        const parsed = parseJsonObject(await fsp.readFile(authPath, 'utf8'));
+        const apiKey = findNamedSecret(parsed, /^(?:key|api_key|apiKey|openai_api_key|OPENAI_API_KEY)$/);
+        if (!apiKey)
+            return false;
+        const actualDigest = Buffer.from(sha256(apiKey), 'hex');
+        const expectedDigest = Buffer.from(sha256(expectedApiKey), 'hex');
+        return timingSafeEqual(actualDigest, expectedDigest);
+    }
+    catch {
+        return false;
+    }
+}
+export async function assertDesktopAuthUnchangedBySks(before, afterConfigCommitBeforeRestart) {
+    if (before.path !== afterConfigCommitBeforeRestart.path
+        || before.exists !== afterConfigCommitBeforeRestart.exists
+        || before.sha256 !== afterConfigCommitBeforeRestart.sha256) {
+        throw new Error('desktop_auth_mutated_by_sks');
+    }
+}
+export function assertDesktopOAuthSemanticIdentity(before, afterAppRestart) {
+    if (before.mode !== 'chatgpt_oauth' && before.mode !== 'mixed') {
+        throw new Error(`desktop_oauth_missing_before_restart:${before.mode}`);
+    }
+    if (afterAppRestart.mode !== 'chatgpt_oauth' && afterAppRestart.mode !== 'mixed') {
+        throw new Error(`desktop_oauth_missing_after_restart:${afterAppRestart.mode}`);
+    }
+    if (before.semantic_fingerprint === null || afterAppRestart.semantic_fingerprint === null) {
+        throw new Error('desktop_oauth_identity_unverifiable');
+    }
+    if (before.semantic_fingerprint !== afterAppRestart.semantic_fingerprint) {
+        throw new Error('desktop_oauth_identity_changed');
+    }
+}
+function parseJsonObject(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function containsNamedSecret(value, keyPattern) {
+    return Boolean(findNamedSecret(value, keyPattern));
+}
+function findNamedSecret(value, keyPattern) {
+    if (!value || typeof value !== 'object')
+        return null;
+    for (const [key, entry] of Object.entries(value)) {
+        if (keyPattern.test(key) && typeof entry === 'string' && entry.trim())
+            return entry.trim();
+        const nested = findNamedSecret(entry, keyPattern);
+        if (nested)
+            return nested;
+    }
+    return null;
+}
+function stringField(value, keys) {
+    if (!value)
+        return '';
+    for (const key of keys) {
+        const entry = value[key];
+        if (typeof entry === 'string')
+            return entry;
+    }
+    return '';
+}
+function oauthSemanticFingerprint(parsed) {
+    const identity = {};
+    collectIdentityFields(parsed, identity);
+    for (const token of collectTokenValues(parsed, /^(?:id_token|idToken|access_token|accessToken)$/)) {
+        collectIdentityFields(decodeJwtClaims(token), identity);
+    }
+    if (Object.keys(identity).length === 0)
+        return null;
+    const sortedIdentity = Object.fromEntries(Object.entries(identity).sort(([left], [right]) => left.localeCompare(right)));
+    return sha256(JSON.stringify(sortedIdentity));
+}
+function collectIdentityFields(value, output) {
+    if (!value || typeof value !== 'object')
+        return;
+    for (const [key, entry] of Object.entries(value)) {
+        if (/^(?:sub|email|account_id|accountId|chatgpt_account_id|chatgptAccountId|user_id|userId|organization_id|organizationId)$/i.test(key)
+            && (typeof entry === 'string' || typeof entry === 'number')) {
+            output[key.toLowerCase()] = String(entry);
+        }
+        if (typeof entry === 'object')
+            collectIdentityFields(entry, output);
+    }
+}
+function collectTokenValues(value, keyPattern, output = []) {
+    if (!value || typeof value !== 'object')
+        return output;
+    for (const [key, entry] of Object.entries(value)) {
+        if (keyPattern.test(key) && typeof entry === 'string' && entry.trim())
+            output.push(entry);
+        else if (typeof entry === 'object')
+            collectTokenValues(entry, keyPattern, output);
+    }
+    return output;
+}
+function decodeJwtClaims(token) {
+    const payload = token.split('.')[1];
+    if (!payload)
+        return null;
+    try {
+        return parseJsonObject(Buffer.from(payload, 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function isMissingFileError(error) {
+    return Boolean(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT');
+}

package/dist/core/codex-lb/desktop-bridge/client.js

@@ -0,0 +1,34 @@
+import { readDesktopBridgeState } from './state.js';
+import { safeBridgeErrorCode } from './security.js';
+export const desktopBridgeProcessExists = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+};
+export async function getDesktopBridgeStatus(input) {
+    let state;
+    try {
+        state = await readDesktopBridgeState(input.statePath);
+    }
+    catch (error) {
+        return { status: 'invalid', state: null, blocker: safeBridgeErrorCode(error) };
+    }
+    if (!state)
+        return { status: 'missing', state: null };
+    if (input.expectedConfigGeneration && state.config_generation !== input.expectedConfigGeneration) {
+        return {
+            status: 'configuration_mismatch',
+            state,
+            blocker: 'bridge_config_generation_mismatch',
+        };
+    }
+    const processExists = input.processExists || desktopBridgeProcessExists;
+    if (!processExists(state.pid)) {
+        return { status: 'stale', state, blocker: 'bridge_process_not_running' };
+    }
+    return { status: 'running', state };
+}

package/dist/core/codex-lb/desktop-bridge/header-policy.js

@@ -0,0 +1,106 @@
+import { rewriteLocationHeader } from './location-rewrite.js';
+import { DesktopBridgeError } from './types.js';
+const HOP_BY_HOP = new Set([
+    'connection',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+const NEVER_FORWARD_FROM_CLIENT = new Set([
+    'authorization',
+    'cookie',
+    'forwarded',
+    'proxy-authorization',
+    'x-codex-lb-api-key',
+    'x-forwarded-for',
+    'x-forwarded-host',
+    'x-forwarded-port',
+    'x-forwarded-proto',
+    'x-real-ip',
+]);
+const NEVER_FORWARD_TO_CLIENT = new Set([
+    'authorization',
+    'cookie',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'set-cookie',
+    'x-codex-lb-api-key',
+]);
+function connectionTokens(inbound) {
+    const raw = inbound.connection;
+    const values = Array.isArray(raw) ? raw : raw ? [raw] : [];
+    return new Set(values.flatMap((value) => value.split(',')).map((value) => value.trim().toLowerCase()).filter(Boolean));
+}
+function injectGatewayCredential(result, gatewayKey, transport) {
+    if (transport === 'x-codex-lb-api-key') {
+        result['x-codex-lb-api-key'] = gatewayKey;
+        return;
+    }
+    result.authorization = `Bearer ${gatewayKey}`;
+}
+export function buildUpstreamHeaders(inbound, config, upstreamHost) {
+    const result = {};
+    const dynamicHopByHop = connectionTokens(inbound);
+    for (const [rawName, rawValue] of Object.entries(inbound)) {
+        if (rawValue === undefined)
+            continue;
+        const name = rawName.toLowerCase();
+        if (HOP_BY_HOP.has(name) || dynamicHopByHop.has(name))
+            continue;
+        if (NEVER_FORWARD_FROM_CLIENT.has(name) || name === 'host')
+            continue;
+        result[name] = rawValue;
+    }
+    result.host = upstreamHost;
+    injectGatewayCredential(result, config.gatewayKey, config.gatewayAuthTransport);
+    return result;
+}
+export function buildWebSocketHeaders(inbound, config, upstreamHost) {
+    const result = buildUpstreamHeaders(inbound, config, upstreamHost);
+    for (const [rawName, rawValue] of Object.entries(inbound)) {
+        if (rawValue === undefined)
+            continue;
+        const name = rawName.toLowerCase();
+        if (name === 'connection' || name === 'upgrade' || name.startsWith('sec-websocket-')) {
+            result[name] = rawValue;
+        }
+    }
+    result.connection = 'Upgrade';
+    result.upgrade = 'websocket';
+    return result;
+}
+export function rewriteResponseHeaders(inbound, config, localOrigin) {
+    const result = {};
+    const dynamicHopByHop = connectionTokens(inbound);
+    for (const [rawName, rawValue] of Object.entries(inbound)) {
+        if (rawValue === undefined)
+            continue;
+        const name = rawName.toLowerCase();
+        if (HOP_BY_HOP.has(name) || dynamicHopByHop.has(name) || NEVER_FORWARD_TO_CLIENT.has(name))
+            continue;
+        if (name.startsWith('access-control-'))
+            continue;
+        if (name === 'location') {
+            if (Array.isArray(rawValue) && rawValue.length !== 1) {
+                throw new DesktopBridgeError('bridge_location_header_invalid');
+            }
+            const location = Array.isArray(rawValue) ? rawValue[0] : rawValue;
+            if (!location)
+                throw new DesktopBridgeError('bridge_location_header_invalid');
+            result.location = rewriteLocationHeader(location, config.remoteBaseUrl, localOrigin);
+            continue;
+        }
+        result[name] = rawValue;
+    }
+    return result;
+}
+export function isRedactedHeaderName(name) {
+    const normalized = name.toLowerCase();
+    return NEVER_FORWARD_FROM_CLIENT.has(normalized)
+        || NEVER_FORWARD_TO_CLIENT.has(normalized)
+        || normalized === 'set-cookie';
+}

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -0,0 +1,101 @@
+import http, {} from 'node:http';
+import https from 'node:https';
+import { pipeline } from 'node:stream/promises';
+import { buildUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
+import { resolveDesktopBridgeTarget, safeBridgeErrorCode } from './security.js';
+import { desktopBridgeListenOrigin } from './state.js';
+import { DesktopBridgeError } from './types.js';
+function connectTimeout(request, config) {
+    request.once('socket', (socket) => {
+        if (!socket.connecting)
+            return;
+        const timer = setTimeout(() => {
+            request.destroy(new DesktopBridgeError('bridge_upstream_connect_timeout'));
+        }, config.connectTimeoutMs);
+        timer.unref();
+        const event = config.remote.secure ? 'secureConnect' : 'connect';
+        socket.once(event, () => clearTimeout(timer));
+        socket.once('close', () => clearTimeout(timer));
+    });
+}
+function writeHttpBridgeError(res, error) {
+    const code = safeBridgeErrorCode(error);
+    if (res.headersSent) {
+        res.destroy(error instanceof Error ? error : undefined);
+        return;
+    }
+    res.writeHead(502, {
+        'content-type': 'application/json',
+        'cache-control': 'no-store',
+        connection: 'close',
+    });
+    res.end(JSON.stringify({
+        error: {
+            type: 'sks_bridge_error',
+            code,
+            message: code,
+        },
+    }));
+}
+export async function forwardHttp(req, res, config) {
+    const target = resolveDesktopBridgeTarget(req.url, config.remote);
+    const transport = config.remote.secure ? https : http;
+    const headers = buildUpstreamHeaders(req.headers, config, target.host);
+    const localOrigin = desktopBridgeListenOrigin(config);
+    try {
+        await new Promise((resolve, reject) => {
+            let responseStarted = false;
+            let settled = false;
+            const finish = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (error)
+                    reject(error);
+                else
+                    resolve();
+            };
+            const upstream = transport.request({
+                protocol: target.protocol,
+                hostname: config.remote.address,
+                family: config.remote.family,
+                port: config.remote.port,
+                method: req.method,
+                path: `${target.pathname}${target.search}`,
+                headers,
+                ...(config.remote.tlsServername ? { servername: config.remote.tlsServername } : {}),
+            });
+            connectTimeout(upstream, config);
+            upstream.setTimeout(config.idleTimeoutMs, () => {
+                upstream.destroy(new DesktopBridgeError('bridge_upstream_idle_timeout'));
+            });
+            const abortUpstream = () => {
+                if (!res.writableEnded)
+                    upstream.destroy(new DesktopBridgeError('bridge_client_disconnected'));
+            };
+            req.once('aborted', abortUpstream);
+            res.once('close', abortUpstream);
+            upstream.once('error', finish);
+            upstream.once('response', (upstreamResponse) => {
+                responseStarted = true;
+                try {
+                    const responseHeaders = rewriteResponseHeaders(upstreamResponse.headers, config, localOrigin);
+                    res.writeHead(upstreamResponse.statusCode || 502, responseHeaders);
+                }
+                catch (error) {
+                    upstreamResponse.destroy(error instanceof Error ? error : undefined);
+                    finish(error);
+                    return;
+                }
+                void pipeline(upstreamResponse, res).then(() => finish(), finish);
+            });
+            void pipeline(req, upstream).catch((error) => {
+                if (!responseStarted)
+                    finish(error);
+            });
+        });
+    }
+    catch (error) {
+        writeHttpBridgeError(res, error);
+    }
+}

package/dist/core/codex-lb/desktop-bridge/index.js

@@ -0,0 +1,10 @@
+export * from './types.js';
+export * from './security.js';
+export * from './header-policy.js';
+export * from './location-rewrite.js';
+export * from './state.js';
+export * from './http-forward.js';
+export * from './websocket-forward.js';
+export * from './server.js';
+export * from './client.js';
+export * from './launchd.js';