sneakoscope 8.0.0 → 8.0.2

package/dist/core/codex-app.js

@@ -946,19 +946,12 @@ export async function codexProviderModelUiStatus(opts = {}) {
         && hasTomlString(codexLbProvider, 'env_key', 'CODEX_LB_API_KEY')
         && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
         && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', false);
-    const codexLbCompatProviderContractOk = codexLbProviderPresent
-        && hasTomlString(codexLbProvider, 'name', 'OpenAI')
-        && hasTomlString(codexLbProvider, 'wire_api', 'responses')
-        && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
-        && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', true)
-        && !hasTomlKey(codexLbProvider, 'env_key')
-        && hasCodexLbGatewayEnvHeader(codexLbProvider);
     const codexLbSelectedDefault = /(?:^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(topLevelToml(globalConfig));
     const codexLbDesktopMode = opts.codexLbDesktopMode
         || inferCodexLbDesktopModeForUi(globalConfig);
-    const codexLbProviderContractOk = codexLbDesktopMode === 'desktop-dual-auth-compat'
-        ? codexLbCompatProviderContractOk
-        : codexLbCliProviderContractOk;
+    const retiredCodexLbCompatConfigured = codexLbDesktopMode === 'desktop-dual-auth-compat';
+    const codexLbProviderContractOk = !retiredCodexLbCompatConfigured
+        && codexLbCliProviderContractOk;
     const metadata = await readJsonIfExists(opts.codexLbMetadataPath || codexLbMetadataPath(home));
     const gatewayAuthTransport = normalizeCodexLbGatewayAuthTransportForUi(opts.codexLbGatewayAuthTransport || metadata?.gateway_auth_transport);
     const localCatalogBindingAllowed = shouldBindLocalModelCatalog(codexLbDesktopMode);
@@ -1009,7 +1002,11 @@ export async function codexProviderModelUiStatus(opts = {}) {
     ];
     const codexLbBlockers = [
         ...(codexLbProviderPresent ? [] : ['codex_lb_provider_missing']),
-        ...(codexLbProviderPresent && !codexLbProviderContractOk ? ['codex_lb_provider_contract_drift'] : []),
+        ...(retiredCodexLbCompatConfigured
+            ? ['desktop_dual_auth_compat_unavailable']
+            : codexLbProviderPresent && !codexLbProviderContractOk
+                ? ['codex_lb_provider_contract_drift']
+                : []),
         ...(codexLbApiKeySource !== 'missing' ? [] : ['codex_lb_api_key_missing']),
         ...(codexLbBaseUrlSource !== 'missing' ? [] : ['codex_lb_base_url_missing']),
         ...(codexLbDesktopMode === 'desktop-native-bridge' && managedCatalogConfigured
@@ -1050,7 +1047,11 @@ export async function codexProviderModelUiStatus(opts = {}) {
     const installCommand = 'sks codex-app use-openrouter --model z-ai/glm-5.2';
     const setupCommand = 'sks codex-lb setup --host <domain> --api-key-stdin --yes';
     const setKeyCommand = 'sks codex-lb set-key --api-key-stdin';
-    const desktopPickerEvidence = opts.desktopPickerEvidence || opts.codexLbCapabilityReport?.model_picker || null;
+    const desktopPickerEvidence = opts.desktopPickerEvidence
+        || opts.codexLbCapabilityReport?.model_picker
+        || opts.codexLbCapabilityReport?.capabilities?.model_picker
+        || opts.codexLbStatus?.capabilities?.model_picker
+        || null;
     const desktopPickerVerified = desktopPickerEvidence?.state === 'verified'
         || desktopPickerEvidence?.verified === true;
     const selectedProviderConfigured = selectedProviderBlockers.length === 0;
@@ -1110,8 +1111,8 @@ export async function codexProviderModelUiStatus(opts = {}) {
             key_entry_visible: true,
             provider_present: codexLbProviderPresent,
             provider_contract_ok: codexLbProviderContractOk,
-            provider_contract: codexLbDesktopMode === 'desktop-dual-auth-compat'
-                ? 'desktop-dual-auth-compat'
+            provider_contract: retiredCodexLbCompatConfigured
+                ? 'retired-desktop-dual-auth-compat'
                 : 'cli-provider',
             selected_default: codexLbSelectedDefault,
             key_present: codexLbApiKeySource !== 'missing',
@@ -1187,12 +1188,6 @@ function normalizeCodexLbGatewayAuthTransportForUi(value) {
         ? 'authorization-bearer-compat'
         : 'x-codex-lb-api-key';
 }
-function hasTomlKey(text, key) {
-    return new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=`).test(text);
-}
-function hasCodexLbGatewayEnvHeader(text) {
-    return /(?:^|\n)\s*env_http_headers\s*=\s*\{[^}\n]*"X-Codex-LB-API-Key"\s*=\s*"CODEX_LB_API_KEY"[^}\n]*\}\s*(?:#.*)?(?=\n|$)/.test(text);
-}
 async function findDefaultPluginSource(plugin, { home, configText }) {
     const cached = await findPluginCache(plugin.name, { home });
     if (cached)

package/dist/core/codex-control/codex-lb-launch-recovery.js

@@ -69,6 +69,12 @@ export async function inspectCodexLbCliLaunchRecovery(input) {
     if (selectedProvider !== 'codex-lb') {
         return codexLbToolOutputRecoveryNotSelected();
     }
+    const codexProcessSelectsCodexLb = overrides.modelProvider === 'codex-lb'
+        || profileConfig.modelProvider === 'codex-lb'
+        || userConfig.modelProvider === 'codex-lb';
+    if (environmentSelectsCodexLb && !codexProcessSelectsCodexLb) {
+        return environmentSelectionNotForwardedBlocked();
+    }
     const baseUrl = overrides.baseUrl
         ?? profileConfig.baseUrl
         ?? userConfig.baseUrl
@@ -124,6 +130,13 @@ export function codexLbRecoveryBlockedProcessResult(probe) {
     };
 }
 export function codexLbRecoveryBlockedMessage(probe) {
+    if (probe.blockers.includes('codex_lb_launch_selection_not_forwarded')) {
+        return [
+            'Codex launch blocked: codex-lb was requested by the SKS environment but was not selected in the Codex process.',
+            ...probe.blockers.map((blocker) => `blocker: ${blocker}`),
+            ...probe.operator_actions
+        ].join('\n');
+    }
     return [
         'Codex launch blocked: selected codex-lb interrupted tool-output recovery is not verified.',
         ...probe.blockers.map((blocker) => `blocker: ${blocker}`),
@@ -291,3 +304,16 @@ function projectProviderConfigBlocked() {
         ]
     };
 }
+function environmentSelectionNotForwardedBlocked() {
+    const base = codexLbToolOutputRecoveryNotChecked(true);
+    return {
+        ...base,
+        status: 'version_unverified',
+        blockers: ['codex_lb_launch_selection_not_forwarded'],
+        warnings: ['sks_provider_environment_does_not_select_the_codex_process_provider'],
+        operator_actions: [
+            `Launch Codex with \`--config model_provider='"codex-lb"'\`, or select codex-lb in the active Codex profile.`,
+            'Rerun `sks codex-lb status` before launching Codex.'
+        ]
+    };
+}

package/dist/core/codex-lb/capability-runner.js

@@ -165,6 +165,7 @@ export function shapeCodexLbDesktopCapabilityStatus(report) {
         configured: report.configured,
         oauth_preserved: report.oauth_preserved,
         gateway_auth_transport: String(report.gateway_auth_transport.evidence.configured_gateway_auth_transport || 'unknown'),
+        model_picker: report.model_picker,
         verified: entries.filter(([, value]) => value.state === 'verified').map(([key]) => key),
         available_unverified: entries.filter(([, value]) => value.state === 'available_unverified').map(([key]) => key),
         blocked: Object.fromEntries(entries

package/dist/core/codex-lb/codex-lb-env.js

@@ -1,16 +1,9 @@
 import path from 'node:path';
 import os from 'node:os';
-import { exists, readJson, readText, runProcess, which } from '../fsx.js';
+import { exists, readJson, readText } from '../fsx.js';
 import { escapeRegExp } from '../text/regex.js';
-const KEYCHAIN_WRITER_SWIFT = `import Foundation
-import Security
-let a=CommandLine.arguments[1],s=CommandLine.arguments[2]
-guard let k=String(data:FileHandle.standardInput.readDataToEndOfFile(),encoding:.utf8)?.trimmingCharacters(in:.whitespacesAndNewlines),!k.isEmpty else{exit(64)}
-let q:[String:Any]=[kSecClass as String:kSecClassGenericPassword,kSecAttrAccount as String:a,kSecAttrService as String:s]
-let v:[String:Any]=[kSecValueData as String:Data(k.utf8)]
-var r=SecItemUpdate(q as CFDictionary,v as CFDictionary)
-if r==errSecItemNotFound{var n=q;n[kSecValueData as String]=Data(k.utf8);r=SecItemAdd(n as CFDictionary,nil)}
-if r != errSecSuccess{FileHandle.standardError.write(Data("keychain_status=\\(r)\\n".utf8));exit(1)}`;
+export const CODEX_LB_SECURE_KEYCHAIN_SERVICE = 'com.sneakoscope.codex-lb.api-key.v2';
+export const CODEX_LB_LEGACY_KEYCHAIN_SERVICE = 'sks-codex-lb';
 export function codexLbEnvPath(home = process.env.HOME || os.homedir()) {
     return path.join(String(home || os.homedir()), '.codex', 'sks-codex-lb.env');
 }
@@ -161,14 +154,16 @@ export async function loadCodexLbEnv(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const metadataPath = opts.metadataPath || codexLbMetadataPath(home);
     const envPaths = [opts.envPath || codexLbEnvPath(home)];
-    const sourcePriority = ['env-file', 'keychain', 'process.env'];
+    const sourcePriority = ['env-file', 'process.env'];
     if (opts.allowProjectSecrets)
         sourcePriority.push('project-local');
     const processEnv = pickEnv(opts.processEnv || process.env);
     const envFile = await readEnvFile(envPaths[0]);
-    const keychain = await readMacKeychain(opts);
     const projectLocal = opts.allowProjectSecrets ? await readEnvFile(path.join(opts.root || process.cwd(), '.env')) : {};
     const metadata = await readCodexLbCredentialMetadata(metadataPath);
+    const keychain = await keychainReadIsNeeded(opts, metadata, [envFile.apiKey, processEnv.apiKey, projectLocal.apiKey])
+        ? await readMacKeychain(opts)
+        : { checked: false, available: false, status: 'skipped_not_needed', apiKey: '' };
     const apiKeyCandidates = [
         { source: 'env-file', apiKey: envFile.apiKey },
         { source: 'keychain', apiKey: keychain.apiKey },
@@ -192,12 +187,20 @@ export async function loadCodexLbEnv(opts = {}) {
         apiKeySha256,
         configuredBaseUrl
     });
+    const keychainBlockers = keychain.status === 'keychain_read_failed'
+        ? ['codex_lb_keychain_read_failed']
+        : keychain.status === 'legacy_keychain_migration_required'
+            ? ['codex_lb_legacy_keychain_migration_required']
+            : keychain.status === 'keychain_acl_helper_unavailable'
+                ? ['codex_lb_keychain_acl_helper_unavailable']
+                : [];
     const baseUrl = binding.present && metadata.baseUrl ? metadata.baseUrl : configuredBaseUrl;
-    const apiKeyUsable = Boolean(apiKey) && binding.blockers.length === 0;
+    const apiKeyUsable = Boolean(apiKey) && binding.blockers.length === 0 && keychainBlockers.length === 0;
     const missing = [
         ...(apiKey ? [] : ['CODEX_LB_API_KEY']),
         ...(baseUrl ? [] : ['CODEX_LB_BASE_URL']),
-        ...(binding.blockers.length ? ['CODEX_LB_CREDENTIAL_BINDING'] : [])
+        ...(binding.blockers.length ? ['CODEX_LB_CREDENTIAL_BINDING'] : []),
+        ...(keychainBlockers.length ? ['CODEX_LB_KEYCHAIN'] : [])
     ];
     return {
         schema: 'sks.codex-lb-env.v1',
@@ -214,7 +217,10 @@ export async function loadCodexLbEnv(opts = {}) {
             fingerprint: apiKeySha256 ? apiKeySha256.slice(0, 16) : null
         },
         secret_api_key: apiKeyUsable ? apiKey : null,
-        credential_binding: binding,
+        credential_binding: {
+            ...binding,
+            blockers: [...binding.blockers, ...keychainBlockers]
+        },
         env_paths: envPaths,
         keychain: {
             checked: keychain.checked,
@@ -223,6 +229,20 @@ export async function loadCodexLbEnv(opts = {}) {
         }
     };
 }
+async function keychainReadIsNeeded(opts, metadata, nonKeychainKeys) {
+    if (opts.forceKeychainRead === true)
+        return true;
+    const candidates = nonKeychainKeys.map((key) => String(key || '').trim()).filter(Boolean);
+    if (candidates.length === 0)
+        return true;
+    if (!metadata.valid || !metadata.apiKeySha256)
+        return false;
+    for (const candidate of candidates) {
+        if ((await sha256Full(candidate)) === metadata.apiKeySha256)
+            return false;
+    }
+    return true;
+}
 async function readCodexLbCredentialMetadata(file) {
     if (!(await exists(file)))
         return { present: false, valid: false, baseUrl: '', apiKeySha256: '' };
@@ -308,38 +328,32 @@ export async function writeCodexLbKeychain(apiKey, opts = {}) {
         return { ok: false, status: 'missing_api_key' };
     if (process.platform !== 'darwin' && !opts.forceMacos)
         return { ok: false, status: 'not_macos' };
-    const swift = opts.swiftBin || await which('swift').catch(() => null) || (await exists('/usr/bin/swift') ? '/usr/bin/swift' : null);
-    if (!swift)
-        return { ok: false, status: 'keychain_writer_unavailable' };
     const account = opts.account || process.env.USER || 'sks';
-    const service = opts.service || 'sks-codex-lb';
-    const result = await runProcess(swift, ['-e', KEYCHAIN_WRITER_SWIFT, account, service], {
-        input: `${key}\n`,
-        timeoutMs: 30000,
-        maxOutputBytes: 8192
-    });
+    const service = opts.service || CODEX_LB_SECURE_KEYCHAIN_SERVICE;
+    const legacyService = opts.legacyService === false
+        ? ''
+        : opts.legacyService || (opts.service ? '' : CODEX_LB_LEGACY_KEYCHAIN_SERVICE);
     return {
-        ok: result.code === 0,
-        status: result.code === 0 ? 'stored' : 'keychain_store_failed',
+        ok: false,
+        status: 'keychain_acl_helper_unavailable',
         account,
         service,
-        error: result.code === 0 ? null : redactSecret(result.stderr || result.stdout || 'Security.framework keychain write failed', key)
+        legacy_service: legacyService || null,
+        keychain_state_verified: true,
+        keychain_state_status: 'unchanged',
+        timed_out: false,
+        error: 'Dedicated signed Keychain helper unavailable; use ~/.codex/sks-codex-lb.env (mode 0600).'
     };
 }
 async function readMacKeychain(opts = {}) {
     if (process.platform !== 'darwin' && !opts.forceMacos)
         return { checked: false, available: false, status: 'not_macos', apiKey: '' };
-    const security = opts.securityBin || await which('security').catch(() => null) || (await exists('/usr/bin/security') ? '/usr/bin/security' : null);
-    if (!security)
-        return { checked: true, available: false, status: 'keychain_unavailable', apiKey: '' };
-    const account = opts.account || process.env.USER || 'sks';
-    const service = opts.service || 'sks-codex-lb';
-    const result = await runProcess(security, ['find-generic-password', '-a', account, '-s', service, '-w'], {
-        timeoutMs: 5000,
-        maxOutputBytes: 8192
-    });
-    const apiKey = result.code === 0 ? String(result.stdout || '').trim() : '';
-    return { checked: true, available: true, status: apiKey ? 'found' : 'missing', apiKey };
+    return {
+        checked: false,
+        available: false,
+        status: 'keychain_acl_helper_unavailable',
+        apiKey: ''
+    };
 }
 async function readEnvFile(file) {
     const text = await readText(file, '');
@@ -383,6 +397,3 @@ async function sha256Full(value) {
     const { createHash } = await import('node:crypto');
     return createHash('sha256').update(value).digest('hex');
 }
-function redactSecret(text, secret) {
-    return String(text || '').split(String(secret || '')).join('[redacted]');
-}

package/dist/core/codex-lb/codex-lb-setup.js

@@ -1,7 +1,8 @@
 import os from 'node:os';
 import path from 'node:path';
+import fsp from 'node:fs/promises';
 import { ensureDir, exists, readText, writeTextAtomic } from '../fsx.js';
-import { codexLbEnvPath, codexLbMetadataPath, normalizeCodexLbBaseUrl } from './codex-lb-env.js';
+import { CODEX_LB_SECURE_KEYCHAIN_SERVICE, codexLbBaseUrlSecurityBlocker, codexLbEnvPath, codexLbMetadataPath, normalizeCodexLbBaseUrl } from './codex-lb-env.js';
 import { DEFAULT_CODEX_LB_DESKTOP_MODE, DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT } from './desktop-mode.js';
 export function buildCodexLbSetupPlan(answers, opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
@@ -14,8 +15,16 @@ export function buildCodexLbSetupPlan(answers, opts = {}) {
     const blockers = [];
     if (!baseUrl)
         blockers.push('missing_host_or_base_url');
+    else {
+        const transportBlocker = codexLbBaseUrlSecurityBlocker(baseUrl);
+        if (transportBlocker)
+            blockers.push(transportBlocker);
+    }
     if (answers.install_shell_profile !== 'skip' && !answers.write_env_file)
         blockers.push('shell_profile_snippet_requires_env_file');
+    if (answers.store_keychain && answers.keychain_helper_verified !== true) {
+        blockers.push('keychain_acl_helper_unavailable');
+    }
     const actions = [];
     if (desktopMode === 'desktop-native-bridge') {
         actions.push({
@@ -35,6 +44,7 @@ export function buildCodexLbSetupPlan(answers, opts = {}) {
         });
     }
     else if (desktopMode === 'desktop-dual-auth-compat') {
+        blockers.push('desktop_dual_auth_compat_requires_global_secret_environment');
         if (gatewayAuthTransport !== 'x-codex-lb-api-key') {
             blockers.push('desktop_compat_requires_x_codex_lb_api_key_transport');
         }
@@ -60,7 +70,11 @@ export function buildCodexLbSetupPlan(answers, opts = {}) {
         actions.push({ type: 'write_env_file', target: envPath, effect: 'write CODEX_LB_BASE_URL and redacted CODEX_LB_API_KEY env loader with chmod 0600' });
     }
     if (answers.store_keychain) {
-        actions.push({ type: 'store_keychain', target: 'macOS Keychain service sks-codex-lb', effect: 'store the redacted codex-lb API key through Security.framework with stdin-only secret input' });
+        actions.push({
+            type: 'store_keychain',
+            target: `macOS Keychain service ${CODEX_LB_SECURE_KEYCHAIN_SERVICE}`,
+            effect: 'blocked until SKS ships a dedicated signed Keychain helper; reusable interpreters are never trusted for secret access'
+        });
     }
     if (answers.sync_launchctl) {
         actions.push({ type: 'sync_launchctl', target: 'macOS launchctl user environment', effect: 'sync non-secret CODEX_LB_BASE_URL only and remove API-key launchd env', command: 'launchctl setenv CODEX_LB_BASE_URL ...; launchctl unsetenv CODEX_LB_API_KEY OPENROUTER_API_KEY' });
@@ -113,15 +127,78 @@ export async function installCodexLbShellProfileSnippet(opts) {
     if (!(await exists(opts.envPath))) {
         return { ok: true, status: 'skipped', skipped: true, reason: 'env_file_not_written', files: [] };
     }
+    if (Boolean(opts.expectedFiles) !== Boolean(opts.writeFileIfUnchanged)) {
+        return {
+            ok: false,
+            status: 'setup_cas_contract_incomplete',
+            files: [],
+            error: 'expectedFiles and writeFileIfUnchanged must be provided together'
+        };
+    }
     const home = opts.home || process.env.HOME || os.homedir();
-    const files = profileTargets(home, opts.shellProfile);
-    for (const file of files) {
-        const current = await readText(file, '');
+    const targets = profileTargets(home, opts.shellProfile);
+    const files = [];
+    const recoveryPaths = [];
+    for (const file of targets) {
+        const expected = opts.expectedFiles?.find((entry) => path.resolve(entry.path) === path.resolve(file));
+        if (opts.expectedFiles && !expected) {
+            return {
+                ok: false,
+                status: 'setup_snapshot_missing',
+                files,
+                recovery_paths: recoveryPaths,
+                error: `setup_snapshot_missing:${file}`
+            };
+        }
+        if (expected?.existed === true && expected.kind !== 'regular') {
+            return {
+                ok: false,
+                status: 'unsafe_setup_write_target',
+                files,
+                recovery_paths: recoveryPaths,
+                error: `unsafe_setup_write_target:${file}:${expected.kind}`
+            };
+        }
+        const current = expected
+            ? (expected.existed === true
+                ? Buffer.from(String(expected.bytes_base64 || ''), 'base64').toString('utf8')
+                : '')
+            : await readText(file, '');
         const block = shellProfileBlock(file, opts.envPath);
-        await ensureDir(path.dirname(file));
-        await writeTextAtomic(file, upsertManagedBlock(current, block));
+        const text = upsertManagedBlock(current, block);
+        const existingMode = expected
+            ? (expected.existed === true ? Number(expected.mode) & 0o777 : null)
+            : await fsp.lstat(file)
+                .then((stat) => stat.isFile() && !stat.isSymbolicLink() ? stat.mode & 0o777 : null)
+                .catch(() => null);
+        const mode = existingMode ?? (0o666 & ~process.umask());
+        if (expected && opts.writeFileIfUnchanged) {
+            const result = await opts.writeFileIfUnchanged({ file, expected, text, mode });
+            if (result.recovery_path)
+                recoveryPaths.push(result.recovery_path);
+            if (!result.ok) {
+                return {
+                    ok: false,
+                    status: result.status,
+                    files,
+                    recovery_paths: recoveryPaths,
+                    error: result.error || `${result.status}:${file}`
+                };
+            }
+        }
+        else {
+            await ensureDir(path.dirname(file));
+            await writeTextAtomic(file, text);
+        }
+        await opts.onFileWritten?.({ file, text, mode });
+        files.push(file);
     }
-    return { ok: true, status: 'installed', files };
+    return {
+        ok: true,
+        status: 'installed',
+        files,
+        ...(recoveryPaths.length ? { recovery_paths: recoveryPaths } : {})
+    };
 }
 export function selectedCodexLbPersistenceModes(answers) {
     const modes = [];