sneakoscope 8.0.0 → 8.0.2

package/dist/core/codex/codex-config-guard.js

@@ -85,7 +85,7 @@ export async function writeCodexConfigGuarded(input) {
         if (input.verifyUnchangedBeforeWrite === true) {
             const observed = await readConfigCommitSnapshot(configPath);
             const expectedExists = input.expectedBeforeExists ?? true;
-            if (!configCommitSnapshotMatches(observed, expectedExists, before)) {
+            if (!configCommitSnapshotMatches(observed, expectedExists, before, input.expectedBeforeMode)) {
                 return recordConcurrentConfigChange({
                     root,
                     reportPath: input.reportPath,
@@ -93,6 +93,9 @@ export async function writeCodexConfigGuarded(input) {
                     configPath,
                     before,
                     expectedExists,
+                    ...(input.expectedBeforeMode === undefined
+                        ? {}
+                        : { expectedBeforeMode: input.expectedBeforeMode }),
                     observed,
                     backupPath: null,
                     repairedKeys: preserved.keys,
@@ -103,7 +106,30 @@ export async function writeCodexConfigGuarded(input) {
         else {
             await writeTextAtomic(configPath, next, { mode: 0o600 });
         }
-        const result = { ok: true, status: 'present', config_path: configPath, backup_path: null, changed: false, repaired_keys: preserved.keys, forbidden_top_level: forbiddenTopLevel };
+        const expectedAfterExists = input.verifyUnchangedBeforeWrite === true
+            ? (input.expectedBeforeExists ?? true)
+            : true;
+        const expectedAfterMode = expectedAfterExists
+            ? input.verifyUnchangedBeforeWrite === true
+                ? (input.expectedBeforeMode === undefined ? null : Number(input.expectedBeforeMode) & 0o777)
+                : 0o600
+            : null;
+        const result = {
+            ok: true,
+            status: 'present',
+            config_path: configPath,
+            backup_path: null,
+            changed: false,
+            repaired_keys: preserved.keys,
+            forbidden_top_level: forbiddenTopLevel,
+            expected_after: {
+                exists: expectedAfterExists,
+                text: expectedAfterExists
+                    ? (input.verifyUnchangedBeforeWrite === true ? before : next)
+                    : '',
+                mode: expectedAfterMode
+            }
+        };
         if (preserved.keys.length || forbiddenTopLevel.length) {
             await recordCodexConfigGuard(root, input.reportPath, {
                 cause,
@@ -125,6 +151,9 @@ export async function writeCodexConfigGuarded(input) {
             before,
             next,
             expectedExists,
+            ...(input.expectedBeforeMode === undefined
+                ? {}
+                : { expectedBeforeMode: input.expectedBeforeMode }),
             backupTag: input.backupTag || cause
         });
         if (!commit.ok) {
@@ -135,6 +164,9 @@ export async function writeCodexConfigGuarded(input) {
                 configPath,
                 before,
                 expectedExists,
+                ...(input.expectedBeforeMode === undefined
+                    ? {}
+                    : { expectedBeforeMode: input.expectedBeforeMode }),
                 observed: commit.observed,
                 backupPath: commit.backupPath,
                 repairedKeys: preserved.keys,
@@ -157,7 +189,12 @@ export async function writeCodexConfigGuarded(input) {
         backup_path: backupPath,
         changed: true,
         repaired_keys: preserved.keys,
-        forbidden_top_level: forbiddenTopLevel
+        forbidden_top_level: forbiddenTopLevel,
+        expected_after: {
+            exists: true,
+            text: next,
+            mode: 0o600
+        }
     };
     const reportPath = await recordCodexConfigGuard(root, input.reportPath, {
         cause,
@@ -181,10 +218,13 @@ export async function writeCodexConfigGuarded(input) {
     });
     return { ...result, report_path: reportPath };
 }
-function configCommitSnapshotMatches(observed, expectedExists, expectedText) {
+function configCommitSnapshotMatches(observed, expectedExists, expectedText, expectedMode) {
     return observed.ok
         && observed.exists === expectedExists
-        && sha256(observed.text) === sha256(expectedText);
+        && sha256(observed.text) === sha256(expectedText)
+        && (!expectedExists
+            || expectedMode === undefined
+            || observed.mode === (Number(expectedMode) & 0o777));
 }
 async function recordConcurrentConfigChange(input) {
     const result = {
@@ -203,6 +243,10 @@ async function recordConcurrentConfigChange(input) {
         status: result.status,
         expected_exists: input.expectedExists,
         observed_exists: input.observed.exists,
+        expected_mode: input.expectedBeforeMode === undefined
+            ? null
+            : Number(input.expectedBeforeMode) & 0o777,
+        observed_mode: input.observed.mode,
         expected_sha256: sha256(input.before),
         observed_sha256: input.observed.ok ? sha256(input.observed.text) : null,
         observed_status: input.observed.status,
@@ -219,7 +263,7 @@ async function commitCodexConfigIfUnchanged(input) {
     try {
         await writeTextAtomic(candidatePath, input.next, { mode: 0o600 });
         const observed = await readConfigCommitSnapshot(input.configPath);
-        if (!configCommitSnapshotMatches(observed, input.expectedExists, input.before)) {
+        if (!configCommitSnapshotMatches(observed, input.expectedExists, input.before, input.expectedBeforeMode)) {
             return { ok: false, backupPath, observed };
         }
         if (input.expectedExists) {
@@ -231,7 +275,7 @@ async function commitCodexConfigIfUnchanged(input) {
                 return { ok: false, backupPath: null, observed: await readConfigCommitSnapshot(input.configPath) };
             }
             const claimed = await readConfigCommitSnapshot(backupPath);
-            if (!configCommitSnapshotMatches(claimed, true, input.before)) {
+            if (!configCommitSnapshotMatches(claimed, true, input.before, input.expectedBeforeMode)) {
                 await restoreClaimedConfigIfAbsent(backupPath, input.configPath, claimed);
                 return { ok: false, backupPath, observed: claimed };
             }
@@ -283,19 +327,29 @@ async function readConfigCommitSnapshot(configPath) {
         stat = await fsp.lstat(configPath);
     }
     catch (error) {
-        if (error?.code === 'ENOENT')
-            return { ok: true, exists: false, text: '', status: 'missing' };
-        return { ok: false, exists: false, text: '', status: 'read_failed' };
+        if (error?.code === 'ENOENT') {
+            return { ok: true, exists: false, text: '', status: 'missing', mode: null };
+        }
+        return { ok: false, exists: false, text: '', status: 'read_failed', mode: null };
+    }
+    const mode = stat.mode & 0o777;
+    if (stat.isSymbolicLink()) {
+        return { ok: false, exists: true, text: '', status: 'symlink', mode };
+    }
+    if (!stat.isFile()) {
+        return { ok: false, exists: true, text: '', status: 'non_regular', mode };
     }
-    if (stat.isSymbolicLink())
-        return { ok: false, exists: true, text: '', status: 'symlink' };
-    if (!stat.isFile())
-        return { ok: false, exists: true, text: '', status: 'non_regular' };
     try {
-        return { ok: true, exists: true, text: await fsp.readFile(configPath, 'utf8'), status: 'regular' };
+        return {
+            ok: true,
+            exists: true,
+            text: await fsp.readFile(configPath, 'utf8'),
+            status: 'regular',
+            mode
+        };
     }
     catch {
-        return { ok: false, exists: true, text: '', status: 'read_failed' };
+        return { ok: false, exists: true, text: '', status: 'read_failed', mode };
     }
 }
 export function extractTomlTable(text, tableName) {

package/dist/core/codex/oauth-callback-port-diagnostic.js

@@ -0,0 +1,121 @@
+import { runProcess } from '../fsx.js';
+export const CODEX_OAUTH_CALLBACK_PORT = 1455;
+export const OAUTH_CALLBACK_RECOVERY_GUIDANCE = 'If the OAuth callback ends on a dead page, replace localhost with 127.0.0.1 in the address bar and retry immediately; the authorization code is short-lived and one-time.';
+const DEFAULT_TIMEOUT_MS = 1_500;
+const MAX_OUTPUT_BYTES = 64 * 1024;
+const LSOF_ARGS = ['-nP', `-iTCP:${CODEX_OAUTH_CALLBACK_PORT}`, '-sTCP:LISTEN'];
+export async function inspectOAuthCallbackPortConflict(input = {}) {
+    const execute = input.run || runProcess;
+    let result;
+    try {
+        result = await execute('lsof', LSOF_ARGS, {
+            timeoutMs: Math.max(1, Math.min(input.timeoutMs ?? DEFAULT_TIMEOUT_MS, DEFAULT_TIMEOUT_MS)),
+            maxOutputBytes: MAX_OUTPUT_BYTES
+        });
+    }
+    catch (error) {
+        return diagnostic(isUnavailableError(error) ? 'unavailable' : 'probe_failed');
+    }
+    if (result.timedOut)
+        return diagnostic('timeout');
+    if (result.code === -1 && isUnavailableError(result.stderr))
+        return diagnostic('unavailable');
+    const listeners = parseLsofListeners(result.stdout);
+    if (result.code !== 0 && listeners.length === 0) {
+        if (result.code === 1 && String(result.stdout || '').trim() === '' && String(result.stderr || '').trim() === '') {
+            return diagnostic('clear');
+        }
+        return diagnostic(result.code === -1 ? 'unavailable' : 'probe_failed');
+    }
+    const loopbackCodex = listeners.filter((listener) => (listener.scope === 'loopback_ipv4'
+        && isCodexProcessName(listener.command)));
+    const competing = listeners.filter((listener) => (listener.scope === 'wildcard' || listener.scope === 'ipv6'));
+    const conflict = loopbackCodex.some((codexListener) => (competing.some((listener) => listener.pid !== codexListener.pid)));
+    return {
+        ...diagnostic(conflict ? 'conflict' : 'clear'),
+        listeners,
+        warnings: conflict ? ['oauth_callback_port_1455_conflict'] : []
+    };
+}
+export function oauthCallbackRecoveryGuidance(failureOutput, diagnosticResult) {
+    return diagnosticResult.conflict && isCodexAuthenticationFailure(failureOutput)
+        ? [OAUTH_CALLBACK_RECOVERY_GUIDANCE]
+        : [];
+}
+export function oauthCallbackDoctorGuidance(diagnosticResult) {
+    return diagnosticResult.conflict ? [OAUTH_CALLBACK_RECOVERY_GUIDANCE] : [];
+}
+export function isCodexAuthenticationFailure(output) {
+    return /(?:not\s+(?:logged|signed)\s+in|not\s+authenticated|authentication\s+(?:is\s+)?required|login\s+required|please\s+(?:run\s+)?(?:codex\s+)?log\s*in|unauthenticated|unauthorized|http\s*401|\b401\s+unauthorized\b)/i
+        .test(String(output || ''));
+}
+function parseLsofListeners(output) {
+    const listeners = new Map();
+    for (const line of String(output || '').split(/\r?\n/)) {
+        const match = line.match(/^(\S+)\s+(\d+)\s+.*?\bTCP\s+(.+?)\s+\(LISTEN\)\s*$/);
+        if (!match)
+            continue;
+        const command = safeProcessName(match[1]);
+        const pid = Number(match[2]);
+        const address = safeListenerAddress(match[3]);
+        if (!command || !Number.isSafeInteger(pid) || pid <= 0 || !address)
+            continue;
+        const listener = {
+            command,
+            pid,
+            address,
+            scope: listenerScope(address)
+        };
+        listeners.set(listenerKey(listener), listener);
+    }
+    return [...listeners.values()];
+}
+function listenerScope(address) {
+    if (address === `127.0.0.1:${CODEX_OAUTH_CALLBACK_PORT}`)
+        return 'loopback_ipv4';
+    if (address === `*:${CODEX_OAUTH_CALLBACK_PORT}`
+        || address === `0.0.0.0:${CODEX_OAUTH_CALLBACK_PORT}`
+        || address === `:::${CODEX_OAUTH_CALLBACK_PORT}`
+        || address === `[::]:${CODEX_OAUTH_CALLBACK_PORT}`) {
+        return 'wildcard';
+    }
+    const colonCount = address.match(/:/g)?.length || 0;
+    if ((address.startsWith('[') || colonCount >= 2) && /(?:^|:|\])1455$/.test(address))
+        return 'ipv6';
+    return 'other';
+}
+function safeProcessName(value) {
+    const name = String(value || '').trim();
+    return name.length <= 64 && /^[A-Za-z0-9._+-]+$/.test(name) ? name : '';
+}
+function safeListenerAddress(value) {
+    const address = String(value || '').trim();
+    return address.length <= 96 && /^[0-9A-Fa-f.*:[\]-]+$/.test(address) ? address : '';
+}
+function isCodexProcessName(command) {
+    const normalized = command.toLowerCase();
+    if (normalized === 'codex')
+        return true;
+    const appServerName = 'codex-app-server';
+    return normalized.length >= 'codex-app'.length
+        && normalized.length <= appServerName.length
+        && appServerName.startsWith(normalized);
+}
+function listenerKey(listener) {
+    return `${listener.command}:${listener.pid}:${listener.address}`;
+}
+function isUnavailableError(error) {
+    const text = error instanceof Error ? `${error.name} ${error.message}` : String(error || '');
+    return /\bENOENT\b|not found|no such file or directory/i.test(text);
+}
+function diagnostic(status) {
+    return {
+        schema: 'sks.codex-oauth-callback-port-diagnostic.v1',
+        port: CODEX_OAUTH_CALLBACK_PORT,
+        status,
+        available: !['unavailable', 'timeout', 'probe_failed'].includes(status),
+        conflict: status === 'conflict',
+        listeners: [],
+        warnings: []
+    };
+}

package/dist/core/codex-app/codex-app-fast-ui-repair.js

@@ -74,7 +74,8 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
         home: path.dirname(home),
         configPath: path.join(home, 'config.toml'),
         codexLbEnvPath: path.join(home, 'sks-codex-lb.env'),
-        ...(input.codexLbModelCatalog ? { codexLbModelCatalog: input.codexLbModelCatalog } : {})
+        ...(input.codexLbModelCatalog ? { codexLbModelCatalog: input.codexLbModelCatalog } : {}),
+        ...(input.desktopPickerEvidence ? { desktopPickerEvidence: input.desktopPickerEvidence } : {})
     });
     const changed = actions.some((action) => action.changed);
     const applied = actions.some((action) => action.status === 'repaired');
@@ -84,12 +85,16 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
     const selectedProviderBlockers = Array.isArray(providerModelUi.selected_provider_blockers)
         ? providerModelUi.selected_provider_blockers
         : [];
+    const selectedProviderReady = providerModelUi.effective_ready === true;
     const safeAutoApply = changed && !requiresConfirmation;
     const manual = changed && !input.apply;
     const blockers = [
         ...(requiresConfirmation ? ['codex_app_fast_ui_repair_requires_confirmation'] : []),
         ...(manual && !safeAutoApply ? ['codex_app_fast_ui_repair_requires_explicit_apply'] : []),
         ...selectedProviderBlockers.map((blocker) => `selected_provider:${blocker}`),
+        ...(!selectedProviderReady && selectedProviderBlockers.length === 0
+            ? ['selected_provider:routing_or_picker_unverified']
+            : []),
         ...(after.indicators.secret_leak_suspected ? ['codex_app_ui_repair_secret_leak_suspected'] : [])
     ];
     const report = {
@@ -104,7 +109,7 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
         unsafe_repair_reasons: [...new Set(unsafeReasons)],
         permissions_hardened: permissionsHardened,
         fast_selector: pending ? 'manual_action_required' : applied ? 'repaired' : before.indicators.fast_selector === 'maybe_hidden_or_locked' ? 'manual_action_required' : 'ok',
-        provider_selector: selectedProviderBlockers.length ? 'manual_action_required' : 'selected_provider_ready',
+        provider_selector: selectedProviderReady ? 'selected_provider_ready' : 'manual_action_required',
         provider_model_ui: providerModelUi,
         provider_actions: providerModelUi.ui_actions || [],
         provider_blockers: providerModelUi.blockers || [],

package/dist/core/codex-app/menubar/constants.js

@@ -30,6 +30,9 @@ export const NATIVE_SOURCE_FILES = [
     'SettingsViewController.swift',
     'OperationCoordinator.swift',
     'ProcessClient.swift',
+    'ProcessExecutionState.swift',
+    'ProcessIdentityGuard.swift',
+    'SecureProcessEnvelope.swift',
     'NotificationCoordinator.swift',
     'AlertFactory.swift',
     'AppIdentity.swift'

package/dist/core/codex-app/menubar/installer.js

@@ -19,6 +19,14 @@ export function sksMenuBarRestartDeferred(env = process.env) {
     return env.SKS_UPDATE_DEFER_MENUBAR_RESTART === '1'
         || env.SKS_SKIP_SKS_MENUBAR_LAUNCH === '1';
 }
+export function menuBarCredentialEnvironmentBlocker(input) {
+    if (!input.cleanupOk)
+        return 'launch_secret_env_cleanup_incomplete';
+    if (input.compatibilityConfigured && input.compatibilityRestored !== true) {
+        return 'desktop_compat_launch_env_restore_incomplete';
+    }
+    return null;
+}
 export async function installSksMenuBar(opts = {}) {
     const apply = opts.apply === true;
     const env = opts.env || process.env;
@@ -89,9 +97,18 @@ export async function installSksMenuBar(opts = {}) {
     if (retiredBindings.status === 'quarantined') {
         actions.push(`quarantined ${retiredBindings.retired_binding_count} retired remote bridge binding(s)`);
     }
-    cleanup = await cleanupMacLaunchSecretEnvironment({ env });
-    if (!cleanup.ok)
-        warnings.push('launch_secret_env_cleanup_incomplete');
+    const injectedTestLaunchctl = (env.SKS_TEST_FORBID_REAL_HOME === '1'
+        || env.SKS_TEST_ISOLATION === '1')
+        ? env.SKS_MENUBAR_LAUNCHCTL
+        : undefined;
+    cleanup = await cleanupMacLaunchSecretEnvironment({
+        env,
+        ...(injectedTestLaunchctl ? { launchctlBin: injectedTestLaunchctl } : {})
+    });
+    const cleanupBlocker = menuBarCredentialEnvironmentBlocker({ cleanupOk: cleanup.ok });
+    if (cleanupBlocker) {
+        return blocked(cleanupBlocker, 'Global GUI secret environment cleanup could not be verified.');
+    }
     try {
         const { syncDesktopCenterLaunchCredentials } = await import('../../codex-lb/desktop-center-credentials.js');
         const { CODEX_LB_DESKTOP_COMPAT_MARKER } = await import('../../../cli/install-helpers-codex-lb-config.js');
@@ -100,15 +117,21 @@ export async function installSksMenuBar(opts = {}) {
         if (configText.includes(CODEX_LB_DESKTOP_COMPAT_MARKER)) {
             const restored = await syncDesktopCenterLaunchCredentials({
                 mode: 'desktop-dual-auth-compat',
-                home: paths.home
+                home: paths.home,
+                ...(injectedTestLaunchctl ? { launchctlBin: injectedTestLaunchctl } : {})
             });
-            if (!restored.ok)
-                warnings.push('desktop_compat_launch_env_restore_incomplete');
-            else
-                actions.push('restored Center Codex LB credentials into Desktop launch environment');
+            const restoreBlocker = menuBarCredentialEnvironmentBlocker({
+                cleanupOk: true,
+                compatibilityConfigured: true,
+                compatibilityRestored: restored.ok
+            });
+            if (restoreBlocker) {
+                return blocked(restored.blockers[0] || restoreBlocker, 'Desktop compatibility cannot be restored without exposing a global GUI secret; use the local bridge.');
+            }
         }
     }
-    catch {
+    catch (error) {
+        return blocked('desktop_compat_launch_env_restore_failed', error instanceof Error ? error.message : String(error));
     }
     const swiftc = env.SKS_MENUBAR_SWIFTC || await which('swiftc').catch(() => null) || '/usr/bin/swiftc';
     const codesign = env.SKS_MENUBAR_CODESIGN || await which('codesign').catch(() => null) || '/usr/bin/codesign';

package/dist/core/codex-app/menubar/launch-agent.js

@@ -79,7 +79,22 @@ export async function launchMenuBar(input) {
     if (input.open) {
         const opened = await runProcess(input.open, [input.paths.app_path], { timeoutMs: 8_000, maxOutputBytes: 16 * 1024 })
             .catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
-        return { requested: true, method: 'open-fallback', ok: opened.code === 0, bootstrap_code: bootstrap.code, bootstrap_timed_out: false, open_code: opened.code, error: opened.code === 0 ? null : String(opened.stderr || bootstrap.stderr).trim() };
+        const running = opened.code === 0
+            && await waitForMenuBarProcessRunning(input.paths.executable_path, input.env);
+        return {
+            requested: true,
+            method: 'open-fallback',
+            ok: running,
+            bootstrap_code: bootstrap.code,
+            bootstrap_timed_out: false,
+            open_code: opened.code,
+            open_verified_running: running,
+            error: running
+                ? null
+                : opened.code === 0
+                    ? 'open_succeeded_process_not_running'
+                    : String(opened.stderr || bootstrap.stderr).trim()
+        };
     }
     return { requested: true, method: 'launchctl', ok: false, bootstrap_code: bootstrap.code, bootstrap_timed_out: false, error: String(bootstrap.stderr || bootstrap.stdout || 'launchctl_bootstrap_failed').trim() };
 }
@@ -166,16 +181,37 @@ export async function removeLaunchAgent(paths, env) {
     }
     return { actions, warnings, blockers };
 }
-export async function isMenuBarProcessRunning(executablePath) {
-    const pgrep = await which('pgrep').catch(() => null) || '/usr/bin/pgrep';
-    const result = await runProcess(pgrep, ['-f', executablePath], { timeoutMs: 2_000, maxOutputBytes: 8 * 1024 }).catch(() => ({ code: 1 }));
+export async function isMenuBarProcessRunning(executablePath, env = process.env) {
+    const injectedPgrep = env.SKS_MENUBAR_TEST_PROCESS_TOOLS === '1'
+        ? env.SKS_MENUBAR_PGREP
+        : null;
+    const pgrep = injectedPgrep
+        || (await exists('/usr/bin/pgrep') ? '/usr/bin/pgrep' : null);
+    if (!pgrep)
+        return false;
+    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    const args = [
+        ...(uid === null ? [] : ['-U', String(uid)]),
+        '-f',
+        '-x',
+        `^${posixExtendedRegexLiteral(path.resolve(executablePath))}$`
+    ];
+    const result = await runProcess(pgrep, args, { timeoutMs: 2_000, maxOutputBytes: 8 * 1024 }).catch(() => ({ code: 1 }));
     return result.code === 0;
 }
 async function terminateExistingMenuBarProcess(executablePath) {
     if (!(await exists(executablePath)))
         return;
-    const pkill = await which('pkill').catch(() => null) || '/usr/bin/pkill';
-    await runProcess(pkill, ['-f', executablePath], { timeoutMs: 3_000, maxOutputBytes: 8 * 1024 }).catch(() => undefined);
+    if (!await exists('/usr/bin/pkill'))
+        return;
+    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    const args = [
+        ...(uid === null ? [] : ['-U', String(uid)]),
+        '-f',
+        '-x',
+        `^${posixExtendedRegexLiteral(path.resolve(executablePath))}$`
+    ];
+    await runProcess('/usr/bin/pkill', args, { timeoutMs: 3_000, maxOutputBytes: 8 * 1024 }).catch(() => undefined);
 }
 export function launchDomain() {
     const uid = typeof process.getuid === 'function' ? process.getuid() : null;
@@ -208,6 +244,19 @@ async function waitForLaunchdServiceRunning(launchctl, service, env) {
         await delay(Math.min(pollIntervalMs, remainingAfterProbeMs));
     }
 }
+async function waitForMenuBarProcessRunning(executablePath, env) {
+    const timeoutMs = timeoutFromEnv(env, 'SKS_MENUBAR_OPEN_READBACK_TIMEOUT_MS', 5_000);
+    const intervalMs = timeoutFromEnv(env, 'SKS_MENUBAR_OPEN_READBACK_INTERVAL_MS', 100);
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        if (await isMenuBarProcessRunning(executablePath, env))
+            return true;
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0)
+            return false;
+        await delay(Math.min(intervalMs, remainingMs));
+    }
+}
 async function printLaunchdService(launchctl, service, timeoutMs) {
     const result = await runProcess(launchctl, ['print', service], { timeoutMs, maxOutputBytes: 32 * 1024 })
         .catch((error) => failedProcess(error));
@@ -238,6 +287,9 @@ function launchdProbeError(code, stderr, state, pid, activeCount) {
 function errorToken(value) {
     return value.trim().toLowerCase().replace(/\s+/g, '_').replace(/[^a-z0-9._-]/g, '_');
 }
+function posixExtendedRegexLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }

package/dist/core/codex-app/menubar/migration.js

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import path from 'node:path';
-import { nowIso, readText, runProcess, sha256, which, writeTextAtomic } from '../../fsx.js';
+import { exists, nowIso, readText, runProcess, sha256, which, writeTextAtomic } from '../../fsx.js';
 import { ensureConfinedDirectory, inspectConfinedPath, removeManagedPathVerified } from '../../managed-path-safety.js';
 import { SECRET_LAUNCH_ENV_KEYS } from './constants.js';
 const RETIRED_REMOTE_BRIDGE_LABEL = 'com.sneakoscope.telegram-hub';
@@ -76,7 +76,7 @@ export async function cleanupRetiredRemoteBridgeLaunchAgent(opts = {}) {
                 maxOutputBytes: 16 * 1024
             }).catch((error) => processFailure(error))]
         : [];
-    if (inspected.exists) {
+    if (serviceLoaded && inspected.exists) {
         attempts.push(await run(launchctl, ['bootout', domain, launchAgentPath], {
             timeoutMs: 5_000,
             maxOutputBytes: 16 * 1024
@@ -231,7 +231,8 @@ export async function cleanupMacLaunchSecretEnvironment(opts = {}) {
         return { ok: true, status: 'not_macos', variables: [...SECRET_LAUNCH_ENV_KEYS], cleaned: [], failed: [], next_actions: [] };
     }
     const env = opts.env || process.env;
-    const launchctl = env.SKS_MENUBAR_LAUNCHCTL || await which('launchctl').catch(() => null) || '/bin/launchctl';
+    const launchctl = opts.launchctlBin
+        || (await exists('/bin/launchctl') ? '/bin/launchctl' : null);
     if (!launchctl) {
         return {
             ok: false, status: 'launchctl_missing', variables: [...SECRET_LAUNCH_ENV_KEYS], cleaned: [],
@@ -241,8 +242,17 @@ export async function cleanupMacLaunchSecretEnvironment(opts = {}) {
     }
     const cleaned = [];
     const failed = [];
+    const childEnv = { ...env };
+    for (const key of SECRET_LAUNCH_ENV_KEYS)
+        delete childEnv[key];
+    const run = opts.runProcessImpl || runProcess;
     for (const key of SECRET_LAUNCH_ENV_KEYS) {
-        const result = await runProcess(launchctl, ['unsetenv', key], { timeoutMs: 3_000, maxOutputBytes: 8 * 1024 })
+        const result = await run(launchctl, ['unsetenv', key], {
+            timeoutMs: 3_000,
+            maxOutputBytes: 8 * 1024,
+            env: childEnv,
+            envMode: 'replace'
+        })
             .catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
         if (result.code === 0)
             cleaned.push(key);
@@ -267,6 +277,7 @@ function processFailure(error) {
 function launchdServiceAbsent(result) {
     if (result.timedOut)
         return false;
-    return /could not find service|no such (?:process|file)|not found|not loaded|does not exist/i
-        .test(`${result.stdout || ''}\n${result.stderr || ''}`);
+    const output = `${result.stdout || ''}\n${result.stderr || ''}`;
+    return /could not find service|no such (?:process|file)|not found|not loaded|does not exist/i.test(output)
+        || (result.code === 113 && /\bbad request\b/i.test(output));
 }

package/dist/core/codex-app/menubar/status.js

@@ -13,7 +13,7 @@ import { cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBin
 export async function inspectSksMenuBarStatus(opts = {}) {
     const paths = sksMenuBarPaths(opts.home || opts.env?.HOME, opts.root);
     const installed = await exists(paths.executable_path);
-    const running = installed ? await isMenuBarProcessRunning(paths.executable_path) : false;
+    const running = installed ? await isMenuBarProcessRunning(paths.executable_path, opts.env) : false;
     const actionText = await readText(paths.action_script_path, '');
     const nodeBin = shellAssignment(actionText, 'NODE_BIN');
     const sksEntry = shellAssignment(actionText, 'SKS_ENTRY');
@@ -38,10 +38,13 @@ export async function inspectSksMenuBarStatus(opts = {}) {
     const resources = legacyVerification?.resources || await inspectInstalledResources({ resourcesDir: paths.resources_path, buildStamp });
     const blockers = [];
     const warnings = [];
+    const runtime = evaluateMenuBarRuntimeReadiness({ installed, running, launchd });
     if (!installed)
         blockers.push('menubar_app_missing');
-    if (installed && launchd.checked && !launchd.ok)
-        blockers.push('launchd_not_running');
+    if (runtime.blocker)
+        blockers.push(runtime.blocker);
+    if (runtime.warning)
+        warnings.push(runtime.warning);
     if (installed && !actionSmoke.executable)
         blockers.push('action_script_not_executable');
     if (installed && !actionSmoke.ok)
@@ -91,6 +94,15 @@ export async function inspectSksMenuBarStatus(opts = {}) {
         next_actions: blockers.length ? defaultNextActions() : ['sks menubar status --json']
     };
 }
+export function evaluateMenuBarRuntimeReadiness(input) {
+    if (!input.installed || !input.launchd.checked || input.launchd.ok) {
+        return { blocker: null, warning: null };
+    }
+    return {
+        blocker: 'launchd_not_running',
+        warning: input.running ? 'launchd_not_running_process_active' : null
+    };
+}
 export function evaluateActionScriptIntegrity(actionText, buildStamp) {
     const scriptSha256 = actionText ? sha256(actionText) : null;
     const expectedScriptSha256 = buildStamp?.action_script_sha256 || null;