sneakoscope 8.0.0 → 8.0.2

package/dist/cli/install-helpers.js

@@ -14,7 +14,7 @@ import { reconcileCodexAppUpgradeProcesses } from '../core/codex-app.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
 import { cleanupMacLaunchSecretEnvironment } from '../core/codex-app/menubar/index.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
-import { loadCodexLbEnv, writeCodexLbKeychain, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
+import { CODEX_LB_SECURE_KEYCHAIN_SERVICE, loadCodexLbEnv, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
 import { codexLbToolCatalogPath } from '../core/codex-lb/codex-lb-tool-catalog.js';
 import { codexLbToolOutputRecoveryNotChecked, codexLbToolOutputRecoveryNotSelected, codexLbToolOutputRecoveryOverrideAcknowledged, probeCodexLbToolOutputRecovery } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
 import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES, GLM_52_OPENROUTER_MODEL } from '../core/codex-app/openrouter-provider.js';
@@ -26,9 +26,10 @@ import { ensureGlobalCodexFastModeDuringInstall, ensureTrailingNewline, normaliz
 import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
 import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
 import { canAskYesNo, compareVersions, hasCodexUnstableFeatureWarningSuppression, hasDeprecatedCodexHooksFeatureFlag, isProjectSetupCandidate } from './install-tool-helpers.js';
+import { printCodexLbSetupWarnings } from './codex-lb-setup-warning-output.js';
 import { checkCodexLbResponseChain } from './install-helpers-codex-lb-chain.js';
 import { CODEX_LB_CANONICAL_FAST_SERVICE_TIER, CODEX_LB_PROVIDER_ENV_KEY, askPostinstallQuestion, codexAuthChatgptBackupPath, codexAuthPath, codexLbConfigPath, codexLbEnvPath, hasTopLevelCodexLbSelected, normalizeCodexLbBaseUrl, parseCodexLbEnvKey, redactSecretText } from './install-helpers-codex-lb-shared.js';
-import { CODEX_LB_DESKTOP_BRIDGE_MARKER, CODEX_LB_DESKTOP_COMPAT_MARKER, appliedCodexLbPersistenceModes, captureCodexLbSetupWriteState, codexLbSharedOpenAiRoutingState, detectCodexLbSetupDrift, ensureGlobalCodexAppGlmProfile, ensureStoredOpenRouterProviderDuringInstall, parseCodexLbEnvBaseUrl, removeCodexLbSharedOpenAiRouting, removeCodexLbManagedDesktopConfig, sha256Text, shellSingleQuote, upsertCodexAppGlmConfig, upsertCodexLbConfig, upsertCodexLbCliProviderConfig, upsertCodexLbCompatDesktopConfig, upsertCodexLbNativeDesktopConfig, upsertCodexLbSharedOpenAiRouting } from './install-helpers-codex-lb-config.js';
+import { CODEX_LB_DESKTOP_BRIDGE_MARKER, CODEX_LB_DESKTOP_COMPAT_MARKER, appliedCodexLbPersistenceModes, captureCodexLbSetupWriteState, codexLbSharedOpenAiRoutingState, detectCodexLbSetupDrift, ensureGlobalCodexAppGlmProfile, ensureStoredOpenRouterProviderDuringInstall, hardenCodexLbSetupRecoveryPath, parseCodexLbEnvBaseUrl, removeCodexLbSetupRecoveryPath, removeCodexLbSharedOpenAiRouting, removeCodexLbManagedDesktopConfig, restoreCodexLbSetupWriteState, sha256Text, shellSingleQuote, upsertCodexAppGlmConfig, upsertCodexLbConfig, upsertCodexLbCliProviderConfig, upsertCodexLbCompatDesktopConfig, upsertCodexLbNativeDesktopConfig, upsertCodexLbSharedOpenAiRouting, writeCodexLbSetupFileIfUnchanged } from './install-helpers-codex-lb-config.js';
 import { detectLegacyCodexLbDesktopState } from '../core/codex-lb/legacy-migration.js';
 import { ensureCodexImagegenDuringInstall, ensureGlobalCodexSkillsDuringInstall, ensureGlobalContext7DuringInstall, ensureGlobalGetdesignSkillDuringInstall, ensureSksCommandDuringInstall } from './install-helpers-install-support.js';
 import { escapeRegExp } from '../core/text/regex.js';
@@ -261,6 +262,7 @@ async function reportPostinstallCodexLbAuth(snapshot = null) {
                     console.log(`codex-lb key updated: ${result.base_url}`);
                 else
                     console.log(`codex-lb key update failed: ${result.status}${result.error ? `: ${result.error}` : ''}`);
+                printCodexLbSetupWarnings(result);
             }
         }
     }
@@ -336,6 +338,17 @@ export async function configureCodexLbDesktopRouting(opts) {
         auth_path: authPath,
         auth_before: authBefore
     };
+    if (desktopModeRequiresGlobalSecretEnvironment(mode)) {
+        return {
+            ...base,
+            ok: false,
+            status: 'desktop_dual_auth_compat_unavailable',
+            routing_plane: 'unchanged',
+            oauth_preserved: true,
+            auth_after: authBefore,
+            blockers: ['desktop_dual_auth_compat_requires_global_secret_environment']
+        };
+    }
     if (mode === 'cli-provider') {
         return {
             ...base,
@@ -640,19 +653,93 @@ export async function configureCodexLb(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const configPath = opts.configPath || codexLbConfigPath(home);
     const envPath = opts.envPath || codexLbEnvPath(home);
+    const metadataPath = opts.metadataPath || codexLbMetadataPath(home);
     const rawHost = String(opts.host || opts.baseUrl || '');
     const baseUrl = normalizeCodexLbBaseUrl(rawHost);
     const apiKey = String(opts.apiKey || '').trim();
-    const initialConfig = await readText(configPath, '');
-    const preservedDesktopMode = managedCodexLbDesktopMode(initialConfig);
-    const preservedLegacySelection = hasTopLevelCodexLbSelected(initialConfig) && !preservedDesktopMode;
     const requestedDesktopMode = parseCodexLbDesktopMode(opts.desktopMode || 'cli-provider');
-    const desktopMode = preservedDesktopMode || 'cli-provider';
-    const useDefaultProvider = desktopMode === 'desktop-dual-auth-compat' || preservedLegacySelection;
     const writeEnvFile = opts.writeEnvFile !== false;
     const storeKeychain = opts.storeKeychain === true || opts.keychain === true;
+    const keychainStoreImpl = typeof opts.keychainStoreImpl === 'function'
+        ? opts.keychainStoreImpl
+        : null;
     const syncLaunchctl = opts.syncLaunchctl === true || opts.syncLaunchEnv === true;
     const shellProfile = opts.shellProfile || 'skip';
+    if (storeKeychain && !keychainStoreImpl) {
+        return {
+            ok: false,
+            status: 'keychain_acl_helper_unavailable',
+            config_path: configPath,
+            env_path: envPath,
+            metadata_path: metadataPath,
+            keychain: {
+                ok: false,
+                status: 'keychain_acl_helper_unavailable',
+                keychain_state_verified: true,
+                keychain_state_status: 'unchanged'
+            },
+            error: 'Dedicated signed Keychain helper unavailable; use the owner-only env file.'
+        };
+    }
+    const beforeState = await captureCodexLbSetupWriteState({
+        home,
+        configPath,
+        envPath,
+        metadataPath,
+        shellProfile
+    });
+    await opts.testHooks?.afterBeforeStateCapture?.({ configPath });
+    const configBeforeEntry = beforeState.files.find((entry) => entry?.path === configPath);
+    if (!configBeforeEntry) {
+        return {
+            ok: false,
+            status: 'setup_snapshot_failed',
+            config_path: configPath,
+            env_path: envPath,
+            metadata_path: metadataPath
+        };
+    }
+    const setupMutationPaths = new Set([
+        configPath,
+        metadataPath,
+        ...(writeEnvFile ? [envPath] : []),
+        ...(shellProfile === 'skip'
+            ? []
+            : beforeState.files
+                .map((entry) => String(entry?.path || ''))
+                .filter((file) => file && file !== configPath && file !== envPath && file !== metadataPath))
+    ]);
+    const unsafeSetupTargets = beforeState.files
+        .filter((entry) => setupMutationPaths.has(String(entry?.path || ''))
+        && entry?.existed === true
+        && entry?.kind !== 'regular')
+        .map((entry) => `unsafe_setup_write_target:${entry.path}:${entry.kind}`);
+    if (unsafeSetupTargets.length > 0) {
+        return {
+            ok: false,
+            status: 'unsafe_setup_write_target',
+            config_path: configPath,
+            env_path: envPath,
+            metadata_path: metadataPath,
+            drift: unsafeSetupTargets
+        };
+    }
+    const initialConfig = configBeforeEntry.existed === true
+        ? Buffer.from(String(configBeforeEntry.bytes_base64 || ''), 'base64').toString('utf8')
+        : '';
+    const preservedDesktopMode = managedCodexLbDesktopMode(initialConfig);
+    const preservedLegacySelection = hasTopLevelCodexLbSelected(initialConfig) && !preservedDesktopMode;
+    const desktopMode = preservedDesktopMode || 'cli-provider';
+    if (desktopModeRequiresGlobalSecretEnvironment(desktopMode)) {
+        return {
+            ok: false,
+            status: 'desktop_dual_auth_compat_unavailable',
+            config_path: configPath,
+            env_path: envPath,
+            error: 'desktop_dual_auth_compat_requires_global_secret_environment'
+        };
+    }
+    const useDefaultProvider = desktopMode === 'desktop-dual-auth-compat' || preservedLegacySelection;
     const setupAnswers = {
         host_or_base_url: rawHost,
         api_key_source: opts.apiKeySource || 'stdin',
@@ -660,6 +747,7 @@ export async function configureCodexLb(opts = {}) {
         gateway_auth_transport: (opts.gatewayAuthTransport || DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT),
         write_env_file: writeEnvFile,
         store_keychain: storeKeychain,
+        keychain_helper_verified: Boolean(keychainStoreImpl),
         sync_launchctl: syncLaunchctl,
         install_shell_profile: shellProfile,
         run_health_check: opts.runHealth === true,
@@ -703,11 +791,14 @@ export async function configureCodexLb(opts = {}) {
     const insecureLocalWarning = /^http:\/\//i.test(baseUrl) && !/^http:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::|\/|$)/i.test(baseUrl) && !opts.allowInsecureHttp
         ? ['codex-lb base URL uses http outside localhost; prefer https or pass an explicit allow flag in the calling surface.']
         : [];
-    const beforeState = await captureCodexLbSetupWriteState({ home, configPath, envPath, shellProfile });
+    const processEnvBefore = {
+        baseUrl: process.env.CODEX_LB_BASE_URL,
+        apiKey: process.env.CODEX_LB_API_KEY
+    };
     const authBefore = await captureCodexAuthSnapshot({ home, authPath: opts.authPath || codexAuthPath(home) });
     const appliedActions = [];
     await ensureDir(path.dirname(configPath));
-    const current = await readText(configPath, '');
+    const current = initialConfig;
     let providerOnly = current;
     try {
         if (desktopMode === 'desktop-native-bridge') {
@@ -746,7 +837,14 @@ export async function configureCodexLb(opts = {}) {
             error: error instanceof Error ? error.message : String(error)
         };
     }
-    const safeWrite = await safeWriteCodexConfigToml(configPath, current, providerOnly, 'codex-lb');
+    await opts.testHooks?.beforeInitialConfigWrite?.({ configPath });
+    const safeWrite = await safeWriteCodexConfigToml(configPath, current, providerOnly, 'codex-lb', {
+        verifyUnchangedBeforeWrite: true,
+        expectedBeforeExists: configBeforeEntry.existed === true,
+        ...(configBeforeEntry.existed === true
+            ? { expectedBeforeMode: Number(configBeforeEntry.mode) }
+            : {})
+    });
     if (!safeWrite.ok)
         return { ok: false, status: safeWrite.status, config_path: configPath, env_path: envPath, backup_path: safeWrite.backup_path };
     appliedActions.push({
@@ -761,13 +859,205 @@ export async function configureCodexLb(opts = {}) {
         ok: true,
         backup_path: safeWrite.backup_path
     });
-    if (writeEnvFile) {
-        await writeTextAtomic(envPath, `export CODEX_LB_BASE_URL=${shellSingleQuote(baseUrl)}\nexport CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`, { mode: 0o600 });
-        await fsp.chmod(envPath, 0o600).catch(() => { });
-        appliedActions.push({ type: 'write_env_file', target: envPath, ok: true });
+    const configExpectedAfter = safeWrite.expected_after;
+    if (!configExpectedAfter || typeof configExpectedAfter.exists !== 'boolean') {
+        return {
+            ok: false,
+            status: 'partial_configuration_phase_snapshot_failed',
+            mode: desktopMode,
+            identity_plane: 'unchanged',
+            routing_plane: codexLbRoutingPlane(desktopMode),
+            oauth_preserved: true,
+            auth_mutated: false,
+            plan: plan,
+            applied_actions: appliedActions,
+            drift: ['setup_phase_snapshot_failed:after_config_write'],
+            config_path: configPath,
+            env_path: envPath,
+            metadata_path: metadataPath,
+            backup_path: safeWrite.backup_path,
+            error: 'guarded config writer did not return an owned post-write snapshot'
+        };
     }
-    process.env.CODEX_LB_BASE_URL = baseUrl;
-    process.env.CODEX_LB_API_KEY = apiKey;
+    let setupExpectedState = {
+        ...beforeState,
+        files: beforeState.files.map((entry) => entry.path === configPath
+            ? configExpectedAfter.exists
+                ? {
+                    path: configPath,
+                    existed: true,
+                    kind: 'regular',
+                    bytes_base64: Buffer.from(String(configExpectedAfter.text || '')).toString('base64'),
+                    mode: Number(configExpectedAfter.mode)
+                }
+                : { path: configPath, existed: false, kind: 'missing', bytes_base64: '', mode: null }
+            : entry)
+    };
+    const recordExpectedRegularFile = (file, text, mode) => {
+        setupExpectedState = {
+            ...setupExpectedState,
+            files: setupExpectedState.files.map((entry) => entry.path === file
+                ? {
+                    path: file,
+                    existed: true,
+                    kind: 'regular',
+                    bytes_base64: Buffer.from(text).toString('base64'),
+                    mode: mode & 0o777
+                }
+                : entry)
+        };
+    };
+    const setupWriteRecoveryPaths = [];
+    const writeSetupFile = async (input) => {
+        const expected = beforeState.files.find((entry) => path.resolve(String(entry?.path || '')) === path.resolve(input.file));
+        if (!expected) {
+            throw new Error(`setup_snapshot_missing:${input.file}`);
+        }
+        const result = await writeCodexLbSetupFileIfUnchanged({
+            file: input.file,
+            expected,
+            text: input.text,
+            mode: input.mode,
+            ...(input.beforeReplacement ? { beforeReplacement: input.beforeReplacement } : {})
+        });
+        if (result.recovery_path)
+            setupWriteRecoveryPaths.push(result.recovery_path);
+        if (result.ok || result.installed) {
+            recordExpectedRegularFile(input.file, input.text, input.mode);
+        }
+        if (!result.ok) {
+            throw new Error(`${result.status}:${input.file}${result.error ? `:${result.error}` : ''}`);
+        }
+        return result;
+    };
+    const rollbackSetupAfterFailure = async (input) => {
+        const rollback = await restoreCodexLbSetupWriteState(beforeState, input.expectedCurrentState, {
+            ...(typeof opts.testHooks?.beforeRollbackFileReplacement === 'function'
+                ? { beforeReplacement: opts.testHooks.beforeRollbackFileReplacement }
+                : {})
+        });
+        const rollbackBlockers = [...rollback.blockers];
+        const processRollbackBlockers = [];
+        if (input.restoreProcessEnvironment) {
+            if (process.env.CODEX_LB_BASE_URL === processEnvBefore.baseUrl) {
+            }
+            else if (process.env.CODEX_LB_BASE_URL === baseUrl) {
+                if (processEnvBefore.baseUrl === undefined)
+                    delete process.env.CODEX_LB_BASE_URL;
+                else
+                    process.env.CODEX_LB_BASE_URL = processEnvBefore.baseUrl;
+            }
+            else {
+                processRollbackBlockers.push('setup_rollback_conflict:process.env.CODEX_LB_BASE_URL');
+            }
+            if (process.env.CODEX_LB_API_KEY === processEnvBefore.apiKey) {
+            }
+            else if (process.env.CODEX_LB_API_KEY === apiKey) {
+                if (processEnvBefore.apiKey === undefined)
+                    delete process.env.CODEX_LB_API_KEY;
+                else
+                    process.env.CODEX_LB_API_KEY = processEnvBefore.apiKey;
+            }
+            else {
+                processRollbackBlockers.push('setup_rollback_conflict:process.env.CODEX_LB_API_KEY');
+            }
+        }
+        rollbackBlockers.push(...processRollbackBlockers);
+        const afterRollback = await captureCodexLbSetupWriteState({
+            home,
+            configPath,
+            envPath,
+            metadataPath,
+            shellProfile
+        });
+        if (beforeState.stateHash !== afterRollback.stateHash) {
+            rollbackBlockers.push('setup_rollback_state_verification_failed');
+        }
+        const recoveryPaths = [
+            ...(safeWrite.backup_path ? [safeWrite.backup_path] : []),
+            ...setupWriteRecoveryPaths,
+            ...rollback.recovery
+        ];
+        const secretRecoveryPaths = [...new Set(recoveryPaths)]
+            .filter((recoveryPath) => isRecoveryPathForFile(recoveryPath, envPath));
+        for (const recoveryPath of secretRecoveryPaths) {
+            if (!await hardenCodexLbSetupRecoveryPath(recoveryPath)) {
+                rollbackBlockers.push(`setup_secret_recovery_mode_unverified:${recoveryPath}`);
+            }
+        }
+        if (secretRecoveryPaths.length > 0) {
+            rollbackBlockers.push('setup_secret_recovery_retained');
+        }
+        const filesystemRollbackOk = rollbackBlockers.length === 0;
+        const keychain = input.keychain || { ok: false, status: 'not_written' };
+        return {
+            ok: false,
+            status: input.keychainRetained
+                ? 'partial_configuration_keychain_retained'
+                : input.externalStateMayBeMutated
+                    ? 'partial_configuration_external_state_unknown'
+                    : filesystemRollbackOk
+                        ? 'setup_failed_rolled_back'
+                        : 'setup_failed_rollback_incomplete',
+            mode: desktopMode,
+            identity_plane: 'unchanged',
+            routing_plane: codexLbRoutingPlane(desktopMode),
+            oauth_preserved: true,
+            auth_mutated: false,
+            plan: plan,
+            applied_actions: appliedActions,
+            drift: [
+                `setup_stage_failed:${input.stage}`,
+                ...(input.keychainRetained ? ['codex_lb_keychain_replacement_retained'] : []),
+                ...(input.externalStateMayBeMutated ? ['codex_lb_external_environment_requires_inspection'] : []),
+                ...rollbackBlockers
+            ],
+            rollback: {
+                ...rollback,
+                ok: filesystemRollbackOk,
+                blockers: rollbackBlockers,
+                byte_and_mode_verified: filesystemRollbackOk,
+                keychain_retained: input.keychainRetained,
+                secret_recovery_paths: secretRecoveryPaths,
+                config_backup_path: safeWrite.backup_path || null,
+                config_backup_status: safeWrite.backup_path ? 'retained_for_recovery' : 'not_created',
+                recovery_paths: recoveryPaths
+            },
+            partial_configuration: {
+                schema: 'sks.codex-lb-partial-configuration.v1',
+                failure_stage: input.stage,
+                filesystem_state: filesystemRollbackOk ? 'restored' : 'indeterminate',
+                process_environment_state: input.restoreProcessEnvironment
+                    ? (processRollbackBlockers.length === 0 ? 'restored' : 'indeterminate')
+                    : 'unchanged',
+                keychain_state: input.keychainRetained ? 'replacement_retained' : 'unchanged',
+                external_environment_state: input.externalStateMayBeMutated ? 'inspect_with_status' : 'unchanged',
+                durable_applied_state: [
+                    ...(input.keychainRetained
+                        ? [`macOS Keychain service ${CODEX_LB_SECURE_KEYCHAIN_SERVICE}`]
+                        : []),
+                    ...(input.externalStateMayBeMutated ? ['Center/launch environment may retain a partial update'] : [])
+                ],
+                recovery_actions: [
+                    'Run: sks codex-lb status --json',
+                    'Rerun setup with --api-key-stdin after resolving the failed stage.',
+                    `Inspect ${CODEX_LB_SECURE_KEYCHAIN_SERVICE} before removing any retained Keychain credential.`,
+                    ...(secretRecoveryPaths.length > 0
+                        ? ['Review and securely remove secret_recovery_paths after preserving any concurrent user edits.']
+                        : [])
+                ],
+                recovery_paths: recoveryPaths,
+                secret_recovery_paths: secretRecoveryPaths
+            },
+            config_path: configPath,
+            env_path: envPath,
+            metadata_path: metadataPath,
+            keychain,
+            ...(input.centerCredentials ? { center_credentials: input.centerCredentials } : {}),
+            ...(input.codexEnvironment ? { codex_environment: input.codexEnvironment } : {}),
+            error: redactSecretText(input.error instanceof Error ? input.error.message : String(input.error || input.stage), [apiKey])
+        };
+    };
     const toolCatalog = {
         schema: 'sks.codex-lb-tool-catalog-selection.v1',
         ok: true,
@@ -783,8 +1073,7 @@ export async function configureCodexLb(opts = {}) {
         blockers: []
     };
     const keyFingerprint = await sha256Text(apiKey);
-    const metadataPath = opts.metadataPath || codexLbMetadataPath(home);
-    await writeTextAtomic(metadataPath, `${JSON.stringify({
+    const metadataText = `${JSON.stringify({
         schema: 'sks.codex-lb-metadata.v1',
         base_url: baseUrl,
         updated_at: new Date().toISOString(),
@@ -793,38 +1082,302 @@ export async function configureCodexLb(opts = {}) {
         requested_desktop_mode: requestedDesktopMode,
         gateway_auth_transport: opts.gatewayAuthTransport || DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT,
         api_key: { redacted: true, sha256: keyFingerprint }
-    }, null, 2)}\n`);
-    await fsp.chmod(metadataPath, 0o600).catch(() => { });
-    appliedActions.push({ type: 'write_metadata', target: metadataPath, ok: true });
-    const keychain = storeKeychain ? await writeCodexLbKeychain(apiKey, opts).catch((err) => ({ ok: false, status: 'keychain_store_failed', error: err.message })) : { ok: false, status: 'skipped' };
+    }, null, 2)}\n`;
+    try {
+        await opts.testHooks?.beforeMetadataWrite?.({ metadataPath });
+        const metadataWrite = await writeSetupFile({
+            file: metadataPath,
+            text: metadataText,
+            mode: 0o600,
+            ...(typeof opts.testHooks?.beforeSetupFileReplacement === 'function'
+                ? { beforeReplacement: opts.testHooks.beforeSetupFileReplacement }
+                : {})
+        });
+        appliedActions.push({
+            type: 'write_metadata',
+            target: metadataPath,
+            ok: true,
+            status: metadataWrite.status,
+            recovery_path: metadataWrite.recovery_path || null
+        });
+    }
+    catch (error) {
+        return rollbackSetupAfterFailure({
+            stage: 'write_metadata',
+            error,
+            keychainRetained: false,
+            restoreProcessEnvironment: false,
+            expectedCurrentState: setupExpectedState
+        });
+    }
+    const keychainWriteState = setupExpectedState;
+    const keychain = storeKeychain
+        ? await keychainStoreImpl(apiKey, opts).catch((err) => ({
+            ok: false,
+            status: 'keychain_store_failed',
+            error: err.message
+        }))
+        : { ok: false, status: 'skipped' };
     if (storeKeychain)
-        appliedActions.push({ type: 'store_keychain', target: 'macOS Keychain service sks-codex-lb', ok: keychain.ok === true, status: keychain.status });
-    const { syncDesktopCenterLaunchCredentials } = await import('../core/codex-lb/desktop-center-credentials.js');
-    const centerCredentials = await syncDesktopCenterLaunchCredentials({
-        mode: desktopMode,
-        home,
-        loadedEnv: await loadCodexLbEnv({ home, processEnv: {}, envPath, metadataPath })
-    });
+        appliedActions.push({ type: 'store_keychain', target: `macOS Keychain service ${CODEX_LB_SECURE_KEYCHAIN_SERVICE}`, ok: keychain.ok === true, status: keychain.status });
+    if (storeKeychain && keychain.ok !== true) {
+        await opts.testHooks?.beforeRollbackStart?.({ configPath });
+        const rollback = await restoreCodexLbSetupWriteState(beforeState, keychainWriteState, {
+            ...(typeof opts.testHooks?.beforeRollbackFileReplacement === 'function'
+                ? { beforeReplacement: opts.testHooks.beforeRollbackFileReplacement }
+                : {})
+        });
+        const rollbackBlockers = [...rollback.blockers];
+        if (keychain.keychain_state_verified !== true) {
+            rollbackBlockers.push('setup_rollback_keychain_state_indeterminate');
+        }
+        const backupStatus = safeWrite.backup_path ? 'retained_for_recovery' : 'not_created';
+        const afterRollback = await captureCodexLbSetupWriteState({ home, configPath, envPath, metadataPath, shellProfile });
+        if (beforeState.stateHash !== afterRollback.stateHash) {
+            rollbackBlockers.push('setup_rollback_state_verification_failed');
+        }
+        const recoveryPaths = [
+            ...(safeWrite.backup_path ? [safeWrite.backup_path] : []),
+            ...setupWriteRecoveryPaths,
+            ...rollback.recovery
+        ];
+        const secretRecoveryPaths = [...new Set(recoveryPaths)]
+            .filter((recoveryPath) => isRecoveryPathForFile(recoveryPath, envPath));
+        for (const recoveryPath of secretRecoveryPaths) {
+            if (!await hardenCodexLbSetupRecoveryPath(recoveryPath)) {
+                rollbackBlockers.push(`setup_secret_recovery_mode_unverified:${recoveryPath}`);
+            }
+        }
+        if (secretRecoveryPaths.length > 0) {
+            rollbackBlockers.push('setup_secret_recovery_retained');
+        }
+        const finalRollbackOk = rollbackBlockers.length === 0;
+        return {
+            ok: false,
+            status: finalRollbackOk
+                ? 'keychain_store_failed_rolled_back'
+                : keychain.keychain_state_verified !== true
+                    ? 'keychain_state_indeterminate'
+                    : 'keychain_store_failed_rollback_incomplete',
+            mode: desktopMode,
+            identity_plane: 'unchanged',
+            routing_plane: codexLbRoutingPlane(desktopMode),
+            oauth_preserved: true,
+            auth_mutated: false,
+            plan: plan,
+            applied_actions: appliedActions,
+            drift: ['codex_lb_keychain_store_failed', ...rollbackBlockers],
+            rollback: {
+                ...rollback,
+                ok: finalRollbackOk,
+                blockers: rollbackBlockers,
+                byte_and_mode_verified: finalRollbackOk,
+                config_backup_path: safeWrite.backup_path || null,
+                config_backup_status: backupStatus,
+                recovery_paths: recoveryPaths,
+                secret_recovery_paths: secretRecoveryPaths
+            },
+            config_path: configPath,
+            env_path: envPath,
+            metadata_path: metadataPath,
+            keychain,
+            error: keychain.error || keychain.status
+        };
+    }
+    const writeSetupEnvFile = async () => {
+        await opts.testHooks?.beforeEnvWrite?.({ envPath });
+        const envText = `export CODEX_LB_BASE_URL=${shellSingleQuote(baseUrl)}\nexport CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`;
+        const envWrite = await writeSetupFile({
+            file: envPath,
+            text: envText,
+            mode: 0o600,
+            ...(typeof opts.testHooks?.beforeSetupFileReplacement === 'function'
+                ? { beforeReplacement: opts.testHooks.beforeSetupFileReplacement }
+                : {})
+        });
+        appliedActions.push({
+            type: 'write_env_file',
+            target: envPath,
+            ok: true,
+            status: envWrite.status,
+            recovery_path: envWrite.recovery_path || null
+        });
+        await opts.testHooks?.afterEnvWrite?.({ envPath });
+    };
+    if (writeEnvFile && !storeKeychain) {
+        try {
+            await writeSetupEnvFile();
+        }
+        catch (error) {
+            return rollbackSetupAfterFailure({
+                stage: 'write_env_file',
+                error,
+                keychain,
+                keychainRetained: false,
+                restoreProcessEnvironment: false,
+                expectedCurrentState: setupExpectedState
+            });
+        }
+    }
+    let shellProfileResult = { ok: true, status: 'skipped', files: [] };
+    try {
+        await opts.testHooks?.beforeCenterSync?.();
+    }
+    catch (error) {
+        return rollbackSetupAfterFailure({
+            stage: 'sync_center_desktop_credentials',
+            error,
+            keychain,
+            keychainRetained: storeKeychain && keychain.ok === true,
+            restoreProcessEnvironment: false,
+            expectedCurrentState: setupExpectedState
+        });
+    }
+    const skipLaunchEnvironment = opts.syncLaunchEnv === false
+        || process.env.SKS_SKIP_CODEX_LB_LAUNCH_ENV === '1';
+    const { purgeStaleCodexLbCredentialTwins, syncDesktopCenterLaunchCredentials, verifyCodexLbLegacyKeychainReplacementStore } = await import('../core/codex-lb/desktop-center-credentials.js');
+    const centerCredentials = skipLaunchEnvironment
+        ? {
+            schema: 'sks.codex-lb-desktop-center-credentials.v1',
+            ok: true,
+            status: 'skipped',
+            mode: desktopMode,
+            api_key_fingerprint: keyFingerprint,
+            base_url_present: true,
+            launch_env: { api_key: 'skipped', base_url: 'skipped' },
+            stale_twins_removed: [],
+            stale_twins_quarantined: [],
+            stale_keychain_cleared: [],
+            blockers: []
+        }
+        : await syncDesktopCenterLaunchCredentials({
+            mode: desktopMode,
+            home,
+            ...(opts.platform ? { platform: opts.platform } : {}),
+            ...(opts.launchctlBin ? { launchctlBin: opts.launchctlBin } : {}),
+            ...(opts.securityBin ? { securityBin: opts.securityBin } : {}),
+            ...(opts.runProcessImpl ? { runProcessImpl: opts.runProcessImpl } : {}),
+            deferLegacyKeychainCleanup: writeEnvFile && !storeKeychain,
+            loadedEnv: await loadCodexLbEnv({ ...opts, home, processEnv: {}, envPath, metadataPath })
+        }).catch((error) => ({
+            ok: false,
+            status: 'center_desktop_credentials_failed',
+            error: error instanceof Error ? error.message : String(error)
+        }));
     appliedActions.push({
         type: 'sync_center_desktop_credentials',
         target: 'launchctl from official sks-codex-lb store',
         ok: centerCredentials.ok === true,
         status: centerCredentials.status
     });
+    if (centerCredentials.ok !== true) {
+        return rollbackSetupAfterFailure({
+            stage: 'sync_center_desktop_credentials',
+            error: centerCredentials.error || centerCredentials.status,
+            keychain,
+            keychainRetained: storeKeychain && keychain.ok === true,
+            restoreProcessEnvironment: false,
+            externalStateMayBeMutated: true,
+            expectedCurrentState: setupExpectedState,
+            centerCredentials
+        });
+    }
     const codexEnvironment = await syncCodexLbProviderEnvironment({ env_path: envPath, base_url: baseUrl }, {
         ...opts,
         home,
         apiKey,
         baseUrl,
         syncLaunchEnv: syncLaunchctl && desktopMode !== 'desktop-dual-auth-compat'
-    });
+    }).catch((error) => ({
+        ok: false,
+        status: 'environment_failed',
+        error: error instanceof Error ? error.message : String(error)
+    }));
     if (syncLaunchctl && desktopMode !== 'desktop-dual-auth-compat') {
         appliedActions.push({ type: 'sync_launchctl', target: 'macOS launchctl user environment (base URL only; API-key env removed)', ok: codexEnvironment.ok === true, status: codexEnvironment.status });
     }
-    const shellProfileResult = await installCodexLbShellProfileSnippet({ home, envPath, shellProfile }).catch((err) => ({ ok: false, status: 'failed', files: [], error: err.message }));
-    if (shellProfile !== 'skip')
-        appliedActions.push({ type: 'install_shell_profile_snippet', target: shellProfileResult.files?.join(', ') || shellProfile, ok: shellProfileResult.ok === true, status: shellProfileResult.status });
-    const codexLb = await codexLbStatus({ ...opts, home, configPath, envPath });
+    if (codexEnvironment.ok !== true) {
+        return rollbackSetupAfterFailure({
+            stage: 'sync_codex_environment',
+            error: codexEnvironment.error || codexEnvironment.status,
+            keychain,
+            keychainRetained: storeKeychain && keychain.ok === true,
+            restoreProcessEnvironment: true,
+            externalStateMayBeMutated: true,
+            expectedCurrentState: setupExpectedState,
+            centerCredentials,
+            codexEnvironment
+        });
+    }
+    if (writeEnvFile && storeKeychain) {
+        try {
+            await writeSetupEnvFile();
+        }
+        catch (error) {
+            return rollbackSetupAfterFailure({
+                stage: 'write_env_file',
+                error,
+                keychain,
+                keychainRetained: true,
+                restoreProcessEnvironment: true,
+                externalStateMayBeMutated: true,
+                expectedCurrentState: setupExpectedState,
+                centerCredentials,
+                codexEnvironment
+            });
+        }
+    }
+    process.env.CODEX_LB_BASE_URL = baseUrl;
+    process.env.CODEX_LB_API_KEY = apiKey;
+    shellProfileResult = await installCodexLbShellProfileSnippet({
+        home,
+        envPath,
+        shellProfile,
+        expectedFiles: beforeState.files,
+        writeFileIfUnchanged: async ({ file, text, mode }) => {
+            try {
+                await opts.testHooks?.beforeShellProfileWrite?.({ file });
+                return await writeSetupFile({
+                    file,
+                    text,
+                    mode,
+                    ...(typeof opts.testHooks?.beforeSetupFileReplacement === 'function'
+                        ? { beforeReplacement: opts.testHooks.beforeSetupFileReplacement }
+                        : {})
+                });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                return {
+                    ok: false,
+                    status: message.split(':', 1)[0] || 'write_failed',
+                    error: message
+                };
+            }
+        }
+    })
+        .catch((err) => ({ ok: false, status: 'failed', files: [], error: err.message }));
+    if (shellProfile !== 'skip') {
+        appliedActions.push({
+            type: 'install_shell_profile_snippet',
+            target: shellProfileResult.files?.join(', ') || shellProfile,
+            ok: shellProfileResult.ok === true,
+            status: shellProfileResult.status
+        });
+    }
+    if (shellProfileResult.ok !== true) {
+        return rollbackSetupAfterFailure({
+            stage: 'install_shell_profile_snippet',
+            error: shellProfileResult.error || shellProfileResult.status,
+            keychain,
+            keychainRetained: storeKeychain && keychain.ok === true,
+            restoreProcessEnvironment: true,
+            externalStateMayBeMutated: true,
+            expectedCurrentState: setupExpectedState,
+            centerCredentials,
+            codexEnvironment
+        });
+    }
     const authAfter = await captureCodexAuthSnapshot({ home, authPath: opts.authPath || codexAuthPath(home) });
     let authInvariantError = null;
     try {
@@ -845,9 +1398,23 @@ export async function configureCodexLb(opts = {}) {
         reason: authInvariantError || 'cli_gateway_key_is_separate_from_chatgpt_oauth',
         error: authInvariantError
     };
+    if (authInvariantError) {
+        return rollbackSetupAfterFailure({
+            stage: 'verify_desktop_auth_invariant',
+            error: authInvariantError,
+            keychain,
+            keychainRetained: storeKeychain && keychain.ok === true,
+            restoreProcessEnvironment: true,
+            externalStateMayBeMutated: true,
+            expectedCurrentState: setupExpectedState,
+            centerCredentials,
+            codexEnvironment
+        });
+    }
     const finalCodexLb = await codexLbStatus({ ...opts, home, configPath, envPath });
-    const ok = Boolean(codexEnvironment.ok && codexLogin.ok && centerCredentials.ok !== false);
-    const afterState = await captureCodexLbSetupWriteState({ home, configPath, envPath, shellProfile });
+    const keychainOk = !storeKeychain || keychain.ok === true;
+    const ok = Boolean(codexEnvironment.ok && codexLogin.ok && keychainOk);
+    const afterState = await captureCodexLbSetupWriteState({ home, configPath, envPath, metadataPath, shellProfile });
     const drift = [
         ...detectCodexLbSetupDrift({
             useDefaultProvider,
@@ -864,6 +1431,7 @@ export async function configureCodexLb(opts = {}) {
             afterState
         }),
         ...(authInvariantError ? ['desktop_auth_byte_invariant_failed'] : []),
+        ...(!keychainOk ? ['codex_lb_keychain_store_failed'] : []),
         ...(toolCatalog.required !== false && toolCatalog.ok !== true ? ['codex_lb_gpt56_tool_catalog_not_ready'] : [])
     ];
     const appliedPersistenceModes = appliedCodexLbPersistenceModes({
@@ -888,16 +1456,103 @@ export async function configureCodexLb(opts = {}) {
         ...(preservedLegacySelection ? ['legacy_desktop_auth_routing_requires_explicit_migrate_legacy_desktop'] : []),
         ...(toolCatalog.required !== false && toolCatalog.ok !== true ? ['codex_lb_gpt56_tool_catalog_not_ready'] : [])
     ];
-    const failureStatus = centerCredentials.ok !== true
-        ? (centerCredentials.status || 'center_desktop_credentials_failed')
-        : codexEnvironment.ok !== true
-            ? (codexEnvironment.status || 'environment_failed')
-            : codexLogin.ok !== true
-                ? (codexLogin.status || 'login_failed')
-                : null;
+    if (!ok || drift.length > 0) {
+        return rollbackSetupAfterFailure({
+            stage: 'verify_final_setup_state',
+            error: drift.join(',') || 'configuration_failed',
+            keychain,
+            keychainRetained: storeKeychain && keychain.ok === true,
+            restoreProcessEnvironment: true,
+            externalStateMayBeMutated: true,
+            expectedCurrentState: setupExpectedState,
+            centerCredentials,
+            codexEnvironment
+        });
+    }
+    const retainedSetupRecoveryPaths = [];
+    for (const recoveryPath of [...new Set(setupWriteRecoveryPaths)]) {
+        if (await removeCodexLbSetupRecoveryPath(recoveryPath)) {
+            for (const action of appliedActions) {
+                if (action.recovery_path === recoveryPath) {
+                    action.recovery_path = null;
+                    action.recovery_claim_cleanup = 'removed_after_final_verification';
+                }
+            }
+            continue;
+        }
+        retainedSetupRecoveryPaths.push(recoveryPath);
+        await hardenCodexLbSetupRecoveryPath(recoveryPath);
+    }
+    const retainedSecretRecoveryPaths = retainedSetupRecoveryPaths
+        .filter((recoveryPath) => isRecoveryPathForFile(recoveryPath, envPath));
+    let legacyKeychainCleanup = {
+        ok: true,
+        status: 'not_applicable',
+        keychain_cleared: [],
+        blockers: []
+    };
+    if ((opts.platform || process.platform) === 'darwin' && writeEnvFile && !storeKeychain) {
+        await opts.testHooks?.beforeLegacyKeychainCleanup?.({ envPath, metadataPath });
+        const replacement = await verifyCodexLbLegacyKeychainReplacementStore({
+            home,
+            envPath,
+            metadataPath,
+            account: opts.account || process.env.USER || 'sks',
+            expectedApiKeySha256: keyFingerprint
+        });
+        const cleanup = await purgeStaleCodexLbCredentialTwins({
+            home,
+            account: opts.account || process.env.USER || 'sks',
+            platform: 'darwin',
+            skipStaleEnvTwins: true,
+            ...(opts.securityBin ? { securityBin: opts.securityBin } : {}),
+            ...(opts.runProcessImpl ? { runProcessImpl: opts.runProcessImpl } : {}),
+            ...(replacement.receipt
+                ? { legacyKeychainMigrationReceipt: replacement.receipt }
+                : {})
+        });
+        const cleanupBlockers = [
+            ...(!replacement.ok && replacement.blockers.length === 0
+                ? ['legacy_keychain_replacement_store_unverified']
+                : replacement.blockers),
+            ...cleanup.blockers
+        ];
+        const cleanupOk = replacement.ok && cleanupBlockers.length === 0;
+        legacyKeychainCleanup = {
+            ok: cleanupOk,
+            status: !replacement.ok
+                ? 'legacy_keychain_cleanup_blocked_replacement_store_unverified'
+                : cleanupBlockers.length === 0
+                    ? cleanup.keychain_cleared.length > 0
+                        ? 'legacy_keychain_removed'
+                        : 'legacy_keychain_absent'
+                    : 'legacy_keychain_cleanup_failed_secure_store_retained',
+            replacement_store_verified: replacement.ok,
+            keychain_cleared: cleanup.keychain_cleared,
+            blockers: [...new Set(cleanupBlockers)]
+        };
+        appliedActions.push({
+            type: 'migrate_legacy_keychain',
+            target: 'macOS Keychain service sks-codex-lb',
+            ok: legacyKeychainCleanup.ok,
+            status: legacyKeychainCleanup.status
+        });
+    }
+    const finalWarnings = [
+        ...warnings,
+        ...(retainedSetupRecoveryPaths.length > 0 ? ['setup_recovery_claim_cleanup_required'] : []),
+        ...(retainedSecretRecoveryPaths.length > 0 ? ['setup_secret_recovery_retained'] : []),
+        ...(!legacyKeychainCleanup.ok
+            ? ['legacy_keychain_cleanup_indeterminate_rotate_provider_key']
+            : legacyKeychainCleanup.keychain_cleared.length > 0
+                ? ['legacy_keychain_removed_rotate_provider_key_if_not_already_rotated']
+                : [])
+    ];
     return {
-        ok: ok && drift.length === 0,
-        status: ok && drift.length === 0 ? 'configured' : failureStatus || (drift.length ? 'setup_choice_drift' : 'configuration_failed'),
+        ok: legacyKeychainCleanup.ok,
+        status: legacyKeychainCleanup.ok
+            ? 'configured'
+            : 'legacy_keychain_cleanup_failed_secure_store_retained',
         mode: desktopMode,
         identity_plane: 'unchanged',
         routing_plane: codexLbRoutingPlane(desktopMode),
@@ -906,16 +1561,25 @@ export async function configureCodexLb(opts = {}) {
         auth_mutated: false,
         plan: plan,
         applied_actions: appliedActions,
-        drift,
+        drift: [...drift, ...legacyKeychainCleanup.blockers],
         persistence,
         center_credentials: centerCredentials,
         config_path: configPath,
         env_path: envPath,
         metadata_path: metadataPath,
+        backup_path: safeWrite.backup_path || null,
+        recovery_paths: [
+            ...new Set([
+                ...(safeWrite.backup_path ? [safeWrite.backup_path] : []),
+                ...retainedSetupRecoveryPaths
+            ])
+        ],
+        secret_recovery_paths: retainedSecretRecoveryPaths,
         base_url: baseUrl,
         env_key: 'CODEX_LB_API_KEY',
         keychain,
-        warnings,
+        legacy_keychain_cleanup: legacyKeychainCleanup,
+        warnings: finalWarnings,
         auth_reconcile: authReconcile,
         codex_lb: finalCodexLb,
         codex_environment: codexEnvironment,
@@ -925,6 +1589,14 @@ export async function configureCodexLb(opts = {}) {
         error: authReconcile.error || codexEnvironment.error || codexLogin.error || null
     };
 }
+function isRecoveryPathForFile(recoveryPath, file) {
+    const target = path.resolve(file);
+    const candidate = path.resolve(String(recoveryPath || ''));
+    return candidate.startsWith(`${target}.sks-`);
+}
+function desktopModeRequiresGlobalSecretEnvironment(mode) {
+    return mode === 'desktop-dual-auth-compat';
+}
 export async function codexLbStatus(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const configPath = opts.configPath || codexLbConfigPath(home);
@@ -965,17 +1637,8 @@ export async function codexLbStatus(opts = {}) {
         && providerEnvKey === CODEX_LB_PROVIDER_ENV_KEY
         && providerSupportsWebsockets === true
         && providerOpenAiAuthDisabled;
-    const compatProviderContractOk = providerConfigured
-        && providerBaseUrlMatchesCredential
-        && providerName === 'OpenAI'
-        && providerWireApi === 'responses'
-        && providerSupportsWebsockets === true
-        && providerRequiresOpenAiAuth === true
-        && !providerEnvKey
-        && providerHasSeparateGatewayAuth;
-    const providerContractOk = desktopMode === 'desktop-dual-auth-compat'
-        ? compatProviderContractOk
-        : cliProviderContractOk;
+    const retiredCompatConfigured = desktopMode === 'desktop-dual-auth-compat';
+    const providerContractOk = !retiredCompatConfigured && cliProviderContractOk;
     const providerUsesCodexLbEnvAuth = providerConfigured && providerEnvKey === CODEX_LB_PROVIDER_ENV_KEY && providerOpenAiAuthDisabled;
     const oauthAvailable = authMode.mode === 'chatgpt_oauth' || authMode.mode === 'browser_marker';
     const authRoutingCoherent = desktopMode === 'desktop-native-bridge'
@@ -985,8 +1648,8 @@ export async function codexLbStatus(opts = {}) {
             : !codexLbKeyInSharedAuth && (!selected || providerUsesCodexLbEnvAuth);
     const codexAppUsableWithCodexLb = desktopMode === 'desktop-native-bridge'
         ? Boolean(bridgeBaseUrl && oauthAvailable)
-        : desktopMode === 'desktop-dual-auth-compat'
-            ? compatProviderContractOk && oauthAvailable
+        : retiredCompatConfigured
+            ? false
             : authMode.codex_app_usable;
     const fastMode = codexLbFastModeConfigStatus(config);
     const launchEnvironment = await inspectCodexLbMacLaunchEnvironment(baseUrl, opts).catch((err) => ({
@@ -999,7 +1662,14 @@ export async function codexLbStatus(opts = {}) {
         && envLoad.configured
         && Boolean(baseUrl)
         && authRoutingCoherent
+        && !retiredCompatConfigured
         && (desktopMode === 'desktop-native-bridge' ? Boolean(bridgeBaseUrl) : true);
+    const blockers = [
+        ...(retiredCompatConfigured ? ['desktop_dual_auth_compat_unavailable'] : []),
+        ...(!retiredCompatConfigured && providerConfigured && !providerContractOk
+            ? ['codex_lb_provider_contract_drift']
+            : [])
+    ];
     const probeToolOutputRecovery = opts.probeToolOutputRecovery === true;
     const toolOutputRecovery = !selected
         ? codexLbToolOutputRecoveryNotSelected()
@@ -1014,6 +1684,7 @@ export async function codexLbStatus(opts = {}) {
             });
     return {
         ok: providerReady && (!selected || !probeToolOutputRecovery || toolOutputRecovery.ok),
+        blockers,
         provider_ready: providerReady,
         config_path: configPath,
         env_path: envPath,
@@ -1114,8 +1785,8 @@ export function formatCodexLbStatusText(status = {}, opts = {}) {
         lines.push('', 'Sign in with ChatGPT OAuth, then run: sks codex-lb use-desktop-full.');
     else if (status.ok && status.desktop_mode === 'cli-provider' && !status.selected)
         lines.push('', 'CLI provider is stored but unselected. Run `sks codex-lb use-cli` for CLI use or `sks codex-lb use-desktop-full` for managed Desktop routing.');
-    else if (status.ok && status.desktop_mode === 'desktop-dual-auth-compat')
-        lines.push('', 'Compatibility routing is active. Prefer `sks codex-lb use-desktop-full`; use `sks codex-lb disable` to remove managed Desktop routing.');
+    else if (status.desktop_mode === 'desktop-dual-auth-compat')
+        lines.push('', 'The retired compatibility route is blocked. Run `sks codex-lb use-desktop-full` or `sks codex-lb disable`.');
     else if (status.ok)
         lines.push('', 'Status: configured; no ordinary repair needed.');
     else if (!status.ok && status.base_url && status.env_key_configured)
@@ -2027,8 +2698,15 @@ export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
         console.log(`codex-lb credentials stored: ${configured.base_url}. Use \`sks codex-lb use-cli\`, \`use-desktop-full\`, or \`disable\` explicitly.`);
     else
         console.log('codex-lb setup skipped: API key was empty.');
+    printCodexLbSetupWarnings(configured);
     return configured;
 }
+function scrubCodexLbToolEnvironment(env = process.env) {
+    const sanitized = { ...env };
+    delete sanitized.CODEX_LB_API_KEY;
+    delete sanitized.OPENROUTER_API_KEY;
+    return sanitized;
+}
 async function syncCodexLbProviderEnvironment(status = {}, opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const envPath = opts.envPath || status.env_path || codexLbEnvPath(home);
@@ -2056,10 +2734,16 @@ async function syncCodexLbMacLaunchEnvironment(values = {}, opts = {}) {
         return { ok: true, status: 'skipped', skipped: true, reason: 'SKS_SKIP_CODEX_LB_LAUNCH_ENV=1' };
     if (process.platform !== 'darwin' && !opts.forceLaunchEnv)
         return { ok: true, status: 'not_macos', skipped: true };
-    const launchctl = opts.launchctlBin || await which('launchctl').catch(() => null) || await exists('/bin/launchctl').then((ok) => ok ? '/bin/launchctl' : null).catch(() => null);
+    const launchctl = opts.launchctlBin
+        || await exists('/bin/launchctl').then((ok) => ok ? '/bin/launchctl' : null).catch(() => null);
     if (!launchctl)
-        return { ok: false, status: 'launchctl_missing', error: 'launchctl not found on PATH' };
-    const secretCleanup = await cleanupMacLaunchSecretEnvironment({ force: opts.forceLaunchEnv === true }).catch((err) => ({
+        return { ok: false, status: 'launchctl_missing', error: '/bin/launchctl not found' };
+    const childEnv = scrubCodexLbToolEnvironment();
+    const secretCleanup = await cleanupMacLaunchSecretEnvironment({
+        force: opts.forceLaunchEnv === true,
+        launchctlBin: launchctl,
+        env: childEnv
+    }).catch((err) => ({
         ok: false,
         status: 'partial',
         variables: ['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'],
@@ -2070,7 +2754,12 @@ async function syncCodexLbMacLaunchEnvironment(values = {}, opts = {}) {
     const variables = Object.entries(values).filter(([key, value]) => value && !['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'].includes(String(key)));
     const results = [];
     for (const [key, value] of variables) {
-        const result = await runProcess(launchctl, ['setenv', key, String(value)], { timeoutMs: 5000, maxOutputBytes: 8192 });
+        const result = await runProcess(launchctl, ['setenv', key, String(value)], {
+            timeoutMs: 5000,
+            maxOutputBytes: 8192,
+            env: childEnv,
+            envMode: 'replace'
+        });
         results.push({
             key,
             ok: result.code === 0,
@@ -2091,11 +2780,18 @@ async function syncCodexLbMacLaunchEnvironment(values = {}, opts = {}) {
 async function inspectCodexLbMacLaunchEnvironment(baseUrl = '', opts = {}) {
     if (process.platform !== 'darwin' && !opts.forceLaunchEnv)
         return { checked: false, status: 'not_macos', skipped: true };
-    const launchctl = opts.launchctlBin || await which('launchctl').catch(() => null) || await exists('/bin/launchctl').then((ok) => ok ? '/bin/launchctl' : null).catch(() => null);
+    const launchctl = opts.launchctlBin
+        || await exists('/bin/launchctl').then((ok) => ok ? '/bin/launchctl' : null).catch(() => null);
     if (!launchctl)
         return { checked: true, available: false, status: 'launchctl_missing' };
+    const childEnv = scrubCodexLbToolEnvironment();
     const readVar = async (key) => {
-        const result = await runProcess(launchctl, ['getenv', key], { timeoutMs: 3000, maxOutputBytes: 8192 });
+        const result = await runProcess(launchctl, ['getenv', key], {
+            timeoutMs: 3000,
+            maxOutputBytes: 8192,
+            env: childEnv,
+            envMode: 'replace'
+        });
         return result.code === 0 ? String(result.stdout || '').trim() : '';
     };
     const [currentBaseUrl, currentApiKey, currentOpenRouterKey] = await Promise.all([