sneakoscope 8.0.0 → 8.0.2

package/dist/cli/router.js

@@ -146,12 +146,15 @@ async function ensureActiveRouteCommandGate(command, args) {
         return { ok: true, status: 'allowed_status_subcommand' };
     if (safeActiveRouteVisualQuery(command, args))
         return { ok: true, status: 'allowed_visual_query' };
-    const [{ projectRoot, readJson }, { stateFile }] = await Promise.all([
+    const [{ projectRoot }, { loadOwnedRouteState }] = await Promise.all([
         import('../core/fsx.js'),
         import('../core/mission.js')
     ]);
     const root = await projectRoot(process.cwd()).catch(() => process.cwd());
-    const state = await readJson(stateFile(root), {}).catch(() => ({}));
+    const appSessionKey = process.env.SKS_NARUTO_STANDALONE_CLI === '1'
+        ? ''
+        : String(process.env.CODEX_THREAD_ID || '').trim();
+    const state = await loadOwnedRouteState(root, appSessionKey);
     if (safeActiveRouteContinuation(command, args, state))
         return { ok: true, status: 'allowed_active_route_continuation' };
     if (!activeRouteStateBlocksCommand(state))

package/dist/commands/codex-lb.js

@@ -4,6 +4,7 @@ import { stdin as input, stdout as output } from 'node:process';
 import { projectRoot, readStdin, readText } from '../core/fsx.js';
 import { flag, readOption } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
+import { printCodexLbSetupWarnings } from '../cli/codex-lb-setup-warning-output.js';
 import { codexLbMetrics, readCodexLbCircuit, recordCodexLbHealthEvent, resetCodexLbCircuit, codexLbProofEvidence } from '../core/codex-lb-circuit.js';
 import { checkCodexLbResponseChain, codexLbStatus, configureCodexLb, repairCodexLbAuth } from '../cli/install-helpers.js';
 import { buildCodexLbSetupPlan, renderCodexLbSetupPlan } from '../core/codex-lb/codex-lb-setup.js';
@@ -175,8 +176,8 @@ export async function run(command, args = []) {
         const result = await configureCodexLb({
             host,
             apiKey: newKey,
-            keychain: true,
-            storeKeychain: true,
+            keychain: false,
+            storeKeychain: false,
             writeEnvFile: true,
             syncLaunchctl: true,
             desktopMode: 'cli-provider',
@@ -184,7 +185,6 @@ export async function run(command, args = []) {
         });
         let routing = null;
         const restartRequested = flag(args, '--restart-app') || flag(args, '--restart')
-            || current.mode === 'desktop-dual-auth-compat'
             || current.mode === 'desktop-native-bridge';
         if (result.ok && current.mode === 'desktop-native-bridge') {
             routing = await activateCodexLbDesktopMode({
@@ -193,19 +193,19 @@ export async function run(command, args = []) {
                 restartApp: restartRequested
             });
         }
-        else if (result.ok && current.mode === 'desktop-dual-auth-compat') {
-            routing = await activateCodexLbDesktopMode({
-                ...controllerOptions(args),
-                mode: 'desktop-dual-auth-compat',
-                restartApp: restartRequested
-            });
-        }
         const ok = Boolean(result.ok && routing?.ok !== false);
         const output = {
             ...result,
             schema: 'sks.codex-lb-set-key.v2',
             ok,
             action: 'set-key',
+            provider_ready: result.ok === true,
+            routing_active: Boolean(result.ok
+                && current.mode === 'desktop-native-bridge'
+                && routing?.ok !== false),
+            activation_required: Boolean(result.ok
+                && current.mode !== 'desktop-native-bridge'
+                && current.mode !== 'desktop-dual-auth-compat'),
             desktop_auth_mutated: false,
             fast_mode_mutated: false,
             desktop_routing: routing,
@@ -216,6 +216,7 @@ export async function run(command, args = []) {
         if (flag(args, '--json'))
             return printJson(output);
         console.log(result.ok ? `codex-lb API key updated (${result.base_url || host}).` : `codex-lb key update failed: ${result.status}${result.error ? `: ${result.error}` : ''}`);
+        printCodexLbSetupWarnings(result);
         if (!ok)
             process.exitCode = 1;
         return;
@@ -239,21 +240,6 @@ export async function run(command, args = []) {
             : `Desktop Full Capability activation failed: ${String(result.status || 'failed')}`);
         return;
     }
-    if (action === 'use-desktop-compat') {
-        const result = await activateCodexLbDesktopMode({
-            ...controllerOptions(args),
-            mode: 'desktop-dual-auth-compat',
-            gatewayAuthTransport: 'x-codex-lb-api-key'
-        });
-        if (result.ok !== true)
-            process.exitCode = 1;
-        if (flag(args, '--json'))
-            return printJson(result);
-        console.log(result.ok === true
-            ? 'Codex Desktop compatibility routing enabled; ChatGPT OAuth remains active.'
-            : `Desktop compatibility activation failed: ${String(result.status || 'failed')}`);
-        return;
-    }
     if (action === 'use-cli') {
         const result = await configureCodexLbCliMode(controllerOptions(args));
         if (result.ok !== true)
@@ -327,27 +313,23 @@ export async function run(command, args = []) {
         const toRaw = String(readOption(args, '--to', readOption(args, '--target', 'bridge')) || 'bridge')
             .trim()
             .toLowerCase();
-        const mode = toRaw === 'compat'
-            || toRaw === 'desktop-compat'
-            || toRaw === 'desktop-dual-auth-compat'
-            ? 'desktop-dual-auth-compat'
-            : toRaw === 'bridge'
-                || toRaw === 'desktop-full'
-                || toRaw === 'desktop-native-bridge'
-                || toRaw === ''
-                ? 'desktop-native-bridge'
-                : null;
+        const mode = toRaw === 'bridge'
+            || toRaw === 'desktop-full'
+            || toRaw === 'desktop-native-bridge'
+            || toRaw === ''
+            ? 'desktop-native-bridge'
+            : null;
         if (!mode) {
             const result = {
                 schema: 'sks.codex-lb-legacy-migration-command.v2',
                 ok: false,
                 status: 'invalid_migration_target',
-                blockers: ['migration_target_must_be_bridge_or_compat']
+                blockers: ['migration_target_must_be_bridge']
             };
             process.exitCode = 1;
             if (flag(args, '--json'))
                 return printJson(result);
-            console.error('Invalid --to value. Use bridge or compat.');
+            console.error('Invalid --to value. Use bridge.');
             return;
         }
         const result = await migrateLegacyCodexLbDesktopMode({
@@ -471,7 +453,7 @@ export async function run(command, args = []) {
                 plan,
                 applied_actions: [],
                 persistence: plan.persistence,
-                guidance: ['Pass --yes to acknowledge process_only_ephemeral setup, or enable --write-env-file, --keychain, --launchctl, or --shell-profile.']
+                guidance: ['Pass --yes to acknowledge process_only_ephemeral setup, or enable --write-env-file, --launchctl, or --shell-profile.']
             };
             if (flag(args, '--json')) {
                 printJson(result);
@@ -533,6 +515,11 @@ export async function run(command, args = []) {
             env_file_chmod: options.writeEnvFile ? '0600' : null,
             desktop_auth_mutated: false,
             fast_mode_mutated: false,
+            provider_ready: result.ok === true,
+            routing_active: Boolean(result.ok && desktopActivation?.ok === true),
+            activation_required: Boolean(result.ok
+                && options.desktopMode === 'cli-provider'
+                && desktopActivation === null),
             desktop_activation: desktopActivation,
             capabilities
         };
@@ -551,10 +538,51 @@ export async function run(command, args = []) {
             process.exitCode = 1;
         if (flag(args, '--json'))
             return printJson(shaped);
+        if (!shaped.ok) {
+            console.error(`codex-lb setup failed: ${String(result.status || 'configuration_failed')}`);
+            const recoveryPaths = Array.isArray(result.rollback?.recovery_paths)
+                ? result.rollback.recovery_paths.map((value) => String(value || '')).filter(Boolean)
+                : [];
+            if (recoveryPaths.length > 0) {
+                console.error('Recovery files retained:');
+                for (const recoveryPath of recoveryPaths)
+                    console.error(`  ${recoveryPath}`);
+            }
+            const secretRecoveryPaths = Array.isArray(result.rollback?.secret_recovery_paths)
+                ? result.rollback.secret_recovery_paths.map((value) => String(value || '')).filter(Boolean)
+                : [];
+            if (secretRecoveryPaths.length > 0) {
+                console.error('Warning: the following owner-only recovery files may contain the submitted API key:');
+                for (const recoveryPath of secretRecoveryPaths)
+                    console.error(`  ${recoveryPath}`);
+            }
+            if (result.keychain?.keychain_state_verified === false) {
+                console.error('Keychain state is indeterminate; do not assume the previous credential was restored.');
+            }
+            printCodexLbSetupWarnings(result);
+            return;
+        }
         console.log(`codex-lb configured: ${result.base_url || result.status}`);
         console.log(`Desktop mode: ${options.desktopMode}${desktopActivation ? ` (${String(desktopActivation.status || 'applied')})` : ' (routing unchanged)'}`);
-        if (shaped.persistence?.warning)
-            console.log(`warning: ${shaped.persistence.warning}`);
+        const retainedRecoveryPaths = Array.isArray(result.recovery_paths)
+            ? result.recovery_paths.map((value) => String(value || '')).filter(Boolean)
+            : [];
+        const retainedSecretRecoveryPaths = Array.isArray(result.secret_recovery_paths)
+            ? result.secret_recovery_paths.map((value) => String(value || '')).filter(Boolean)
+            : [];
+        const secretRecoverySet = new Set(retainedSecretRecoveryPaths);
+        const nonSecretRecoveryPaths = retainedRecoveryPaths.filter((value) => !secretRecoverySet.has(value));
+        if (nonSecretRecoveryPaths.length > 0) {
+            console.log('Recovery backups retained:');
+            for (const recoveryPath of nonSecretRecoveryPaths)
+                console.log(`  ${recoveryPath}`);
+        }
+        if (retainedSecretRecoveryPaths.length > 0) {
+            console.error('Warning: owner-only recovery files may contain a previous API key and require secure review:');
+            for (const recoveryPath of retainedSecretRecoveryPaths)
+                console.error(`  ${recoveryPath}`);
+        }
+        printCodexLbSetupWarnings(shaped);
         if (!shaped.ok)
             process.exitCode = 1;
         return;
@@ -589,11 +617,11 @@ export async function run(command, args = []) {
         console.log(`codex-lb proof evidence: ${result.status}`);
         return;
     }
-    console.error('Usage: sks codex-lb status|setup|set-key|use-desktop-full|use-desktop-compat|use-cli|disable|capabilities [--level shallow|transport|deep] [--evidence <file> --trust-anchors <file>]|migrate-legacy-desktop|rollback <receipt-id>|health|metrics|doctor|repair|circuit reset|circuit record-fixture|proof-evidence [--json]');
+    console.error('Usage: sks codex-lb status|setup|set-key|use-desktop-full|use-cli|disable|capabilities [--level shallow|transport|deep] [--evidence <file> --trust-anchors <file>]|migrate-legacy-desktop|rollback <receipt-id>|health|metrics|doctor|repair|circuit reset|circuit record-fixture|proof-evidence [--json]');
     console.error(`  ${CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG}  explicitly acknowledge an old/unverified proxy for this command (unsafe)`);
     console.error('  set-key       swap the codex-lb API key (reuses the stored host): sks codex-lb set-key --api-key-stdin');
+    console.error('  --keychain    fail-closed until a dedicated signed SKS Keychain helper is available; the default 0600 env file is used');
     console.error('  use-desktop-full   keep ChatGPT OAuth/built-in OpenAI and route data through the local bridge');
-    console.error('  use-desktop-compat keep ChatGPT OAuth and use the explicit dual-auth custom provider');
     console.error('  use-cli            configure an unselected CLI-only provider');
     console.error('  disable            remove only SKS-managed Desktop routing; auth.json is untouched');
     process.exitCode = 1;
@@ -838,11 +866,13 @@ function formatCodexLbDesktopStatusText(status) {
         'SKS codex-lb Desktop',
         '',
         `Configured: ${status.configured === true ? 'yes' : 'no'}`,
+        `Credentials ready: ${status.credentials_ready === true ? 'yes' : 'no'}`,
+        `Routing active: ${status.routing_active === true ? 'yes' : 'no'}`,
         `Mode: ${String(status.mode || 'disabled')}`,
         `ChatGPT OAuth: ${oauth.present === true ? 'present and preserved' : 'missing'}`,
         `Provider: ${String(provider.contract || 'missing')} (${provider.contract_ok === true ? 'ok' : 'blocked'})`,
         `Bridge: ${String(bridge.status || 'unknown')}${bridge.running === true ? ' (running)' : ''}`,
-        `Gateway auth: ${String(bridge.gateway_auth_transport || 'unknown')}`,
+        `Gateway auth: ${String(status.gateway_auth_transport || 'inactive')}`,
         `Capabilities: ${String(status.overall || capabilities.state || 'unverified')}`,
         `Full capability: ${status.full_capability_verified === true ? 'verified' : 'unverified'}`
     ];
@@ -903,7 +933,7 @@ function normalizeDesktopSetupMode(value) {
     if (normalized === 'desktop-compat'
         || normalized === 'compat'
         || normalized === 'desktop-dual-auth-compat') {
-        return 'desktop-dual-auth-compat';
+        throw new Error('desktop_dual_auth_compat_unavailable');
     }
     if (!normalized
         || normalized === 'cli'
@@ -981,7 +1011,7 @@ async function codexLbSetupOptions(args = []) {
         host ||= (await ask('1. codex-lb domain or base URL?\n   Example: lb.example.com or https://lb.example.com/backend-api/codex\n> ')).trim();
         apiKey ||= (await askHidden('2. API key?\n   Input hidden. Value will be stored securely and never printed.\n> ')).trim();
         apiKeySource = 'hidden_prompt';
-        desktopMode = normalizeDesktopSetupMode((await ask('3. Configure which mode? [desktop-full/desktop-compat/cli-only] (desktop-full)\n> ')).trim()
+        desktopMode = normalizeDesktopSetupMode((await ask('3. Configure which mode? [desktop-full/cli-only] (desktop-full)\n> ')).trim()
             || 'desktop-full');
         if (desktopMode === 'desktop-native-bridge') {
             gatewayAuthTransport = parseCodexLbGatewayAuthTransport(normalizeGatewayAuthChoice((await ask('4. Gateway key transport? [custom-header/bearer-compat] (custom-header)\n> ')).trim()));
@@ -990,8 +1020,8 @@ async function codexLbSetupOptions(args = []) {
             gatewayAuthTransport = 'x-codex-lb-api-key';
         }
         writeEnvFile = parseYesNo(await ask('5. Write shell env loader to ~/.codex/sks-codex-lb.env? [Y/n] '), true);
-        const storeKeychain = (await ask('6. Store the key in macOS Keychain when available? [Y/n] ')).trim();
-        keychain = !/^(n|no|아니|아니요|ㄴ)$/i.test(storeKeychain || 'y');
+        keychain = false;
+        console.log('6. Key storage: ~/.codex/sks-codex-lb.env (owner-only mode 0600).');
         syncLaunchctl = parseYesNo(await ask('7. Sync non-secret macOS launchctl base URL only? API keys are never stored in launchd. [y/N] '), false);
         const profile = (await ask('8. Install shell profile snippet? [zsh/bash/fish/all/skip] ')).trim();
         const interactiveShellProfile = normalizeShellProfile(profile || 'skip');

package/dist/commands/doctor-profile.js

@@ -35,6 +35,7 @@ export function doctorPhaseIdsForProfile(profile) {
     const required = [
         'codex_startup_repair',
         'startup_config_repair',
+        'codex_config_syntax_repair',
         'context7_repair',
         'context7_mcp_repair',
         'hook_trust_repair',