sneakoscope 8.0.2 → 8.0.3

package/dist/cli/install-helpers-codex-lb-config.js

@@ -13,14 +13,42 @@ import { escapeRegExp } from '../core/text/regex.js';
 export const CODEX_LB_DESKTOP_BRIDGE_MARKER = '# sks-codex-lb-managed-desktop-bridge';
 export const CODEX_LB_DESKTOP_COMPAT_MARKER = '# sks-codex-lb-managed-desktop-compat';
 export const CODEX_LB_MODEL_CATALOG_MARKER = '# sks-codex-lb-managed-model-catalog';
-const LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
+export const CODEX_LB_PROVIDER_SELECTION_MARKER = '# sks-codex-lb-managed-provider-selection';
+export const CODEX_LB_OAUTH_SELECTION_MARKER = '# sks-codex-lb-managed-oauth-selection';
+export const LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
+export function removeCodexLbOrphanManagedMarkers(text) {
+    const source = String(text || '');
+    const selectedProvider = topLevelTomlString(source, 'model_provider');
+    const markerTargets = [
+        [CODEX_LB_DESKTOP_BRIDGE_MARKER, Boolean(topLevelTomlString(source, 'openai_base_url'))],
+        [LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER, Boolean(topLevelTomlString(source, 'openai_base_url'))],
+        [CODEX_LB_DESKTOP_COMPAT_MARKER, selectedProvider === 'codex-lb'],
+        [CODEX_LB_MODEL_CATALOG_MARKER, Boolean(topLevelTomlString(source, 'model_catalog_json'))],
+        [CODEX_LB_PROVIDER_SELECTION_MARKER, selectedProvider === 'codex-lb'],
+        [CODEX_LB_OAUTH_SELECTION_MARKER, selectedProvider === 'openai']
+    ];
+    const orphanMarkers = markerTargets
+        .filter(([marker, hasManagedContent]) => topLevelHasLine(source, marker) && !hasManagedContent)
+        .map(([marker]) => marker);
+    let next = source;
+    for (const marker of orphanMarkers)
+        next = removeTopLevelLine(next, marker);
+    return {
+        schema: 'sks.codex-lb-orphan-managed-marker-cleanup.v1',
+        changed: orphanMarkers.length > 0,
+        orphan_markers: orphanMarkers,
+        text: next
+    };
+}
 export function upsertCodexLbNativeDesktopConfig(text, input) {
-    let next = String(text || '');
+    let next = removeCodexLbOrphanManagedMarkers(String(text || '')).text;
     const selectedProvider = topLevelTomlString(next, 'model_provider');
     if (selectedProvider && selectedProvider !== 'openai' && selectedProvider !== 'codex-lb') {
         throw new Error('codex_lb_user_owned_model_provider_conflict');
     }
-    if (selectedProvider === 'codex-lb' && !topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)) {
+    if (selectedProvider === 'codex-lb'
+        && !topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)
+        && !topLevelHasLine(next, CODEX_LB_PROVIDER_SELECTION_MARKER)) {
         throw new Error('codex_lb_legacy_desktop_config_requires_migration');
     }
     if (topLevelHasLine(next, LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER)
@@ -31,10 +59,10 @@ export function upsertCodexLbNativeDesktopConfig(text, input) {
     if (modelCatalog && !topLevelHasLine(next, CODEX_LB_MODEL_CATALOG_MARKER)) {
         throw new Error('codex_lb_user_owned_model_catalog_json_conflict');
     }
-    next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
+    next = removeManagedCodexLbSelection(next);
     next = removeTopLevelLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER);
     next = removeManagedModelCatalogJson(next);
-    next = upsertManagedTopLevelTomlString(next, 'openai_base_url', input.bridgeBaseUrl, CODEX_LB_DESKTOP_BRIDGE_MARKER);
+    next = upsertManagedTopLevelTomlString(next, 'openai_base_url', input.bridgeBaseUrl, CODEX_LB_DESKTOP_BRIDGE_MARKER, [LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER]);
     next = upsertTomlTable(next, 'model_providers.codex-lb', cliProviderBlock(input.remoteBaseUrl));
     return ensureTrailingNewline(next);
 }
@@ -55,19 +83,50 @@ export function upsertCodexLbCompatDesktopConfig(text, input) {
     return ensureTrailingNewline(next);
 }
 export function upsertCodexLbCliProviderConfig(text, input) {
+    const cleaned = removeCodexLbOrphanManagedMarkers(String(text || '')).text;
+    if (topLevelHasLine(cleaned, LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER)) {
+        throw new Error('codex_lb_legacy_desktop_config_requires_migration');
+    }
+    const cliBase = removeCodexLbManagedDesktopConfig(cleaned);
+    const claimedSelection = input.selectGlobally === true
+        && topLevelTomlString(cliBase, 'model_provider') === 'codex-lb'
+        && !topLevelHasLine(cliBase, CODEX_LB_PROVIDER_SELECTION_MARKER)
+        ? addTopLevelMarkerBeforeKey(cliBase, 'model_provider', CODEX_LB_PROVIDER_SELECTION_MARKER)
+        : cliBase;
     let next = input.selectGlobally === true
-        ? upsertTopLevelTomlString(text, 'model_provider', 'codex-lb')
-        : removeTopLevelTomlKeyIfValue(text, 'model_provider', 'codex-lb');
+        ? upsertManagedTopLevelTomlString(removeTopLevelTomlKeyIfValue(removeManagedOAuthSelection(claimedSelection), 'model_provider', 'openai'), 'model_provider', 'codex-lb', CODEX_LB_PROVIDER_SELECTION_MARKER)
+        : removeManagedCodexLbSelection(cliBase);
     next = upsertTomlTable(next, 'model_providers.codex-lb', cliProviderBlock(input.remoteBaseUrl));
     return ensureTrailingNewline(next);
 }
+export function restoreCodexLbOAuthSelectionConfig(text) {
+    let next = removeManagedCodexLbSelection(String(text || ''));
+    next = upsertManagedTopLevelTomlString(next, 'model_provider', 'openai', CODEX_LB_OAUTH_SELECTION_MARKER);
+    return ensureTrailingNewline(next);
+}
+export function removeManagedCodexLbSelection(text) {
+    let next = removeTopLevelTomlKeyIfValue(String(text || ''), 'model_provider', 'codex-lb');
+    next = removeTopLevelLine(next, CODEX_LB_PROVIDER_SELECTION_MARKER);
+    return next;
+}
+function removeManagedOAuthSelection(text) {
+    let next = String(text || '');
+    if (topLevelHasLine(next, CODEX_LB_OAUTH_SELECTION_MARKER)) {
+        next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'openai');
+        next = removeTopLevelLine(next, CODEX_LB_OAUTH_SELECTION_MARKER);
+    }
+    return next;
+}
 export function removeCodexLbManagedDesktopConfig(text) {
-    let next = removeManagedDesktopBridgeRouting(String(text || ''));
+    let next = removeManagedDesktopBridgeRouting(removeCodexLbOrphanManagedMarkers(String(text || '')).text);
     if (topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)) {
         next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
         next = removeTopLevelLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER);
     }
     next = removeManagedModelCatalogJson(next);
+    if (topLevelTomlString(next, 'model_provider') === 'codex-lb') {
+        next = restoreCodexLbOAuthSelectionConfig(next);
+    }
     return ensureTrailingNewline(next);
 }
 export function removeManagedModelCatalogJson(text) {
@@ -159,6 +218,13 @@ export function upsertCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
 }
 export function removeCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
     const state = codexLbSharedOpenAiRoutingState(text, baseUrl);
+    if (state.status === 'missing' && state.managed) {
+        return {
+            ...state,
+            changed: true,
+            text: removeTopLevelLine(String(text || ''), CODEX_LB_SHARED_OPENAI_ROUTING_MARKER)
+        };
+    }
     if (state.status !== 'matched' || !state.managed)
         return { ...state, changed: false, text: String(text || '') };
     const withoutValue = removeTopLevelTomlKeyIfValue(text, 'openai_base_url', state.expected_base_url);

package/dist/cli/install-helpers.js

@@ -29,7 +29,7 @@ import { canAskYesNo, compareVersions, hasCodexUnstableFeatureWarningSuppression
 import { printCodexLbSetupWarnings } from './codex-lb-setup-warning-output.js';
 import { checkCodexLbResponseChain } from './install-helpers-codex-lb-chain.js';
 import { CODEX_LB_CANONICAL_FAST_SERVICE_TIER, CODEX_LB_PROVIDER_ENV_KEY, askPostinstallQuestion, codexAuthChatgptBackupPath, codexAuthPath, codexLbConfigPath, codexLbEnvPath, hasTopLevelCodexLbSelected, normalizeCodexLbBaseUrl, parseCodexLbEnvKey, redactSecretText } from './install-helpers-codex-lb-shared.js';
-import { CODEX_LB_DESKTOP_BRIDGE_MARKER, CODEX_LB_DESKTOP_COMPAT_MARKER, appliedCodexLbPersistenceModes, captureCodexLbSetupWriteState, codexLbSharedOpenAiRoutingState, detectCodexLbSetupDrift, ensureGlobalCodexAppGlmProfile, ensureStoredOpenRouterProviderDuringInstall, hardenCodexLbSetupRecoveryPath, parseCodexLbEnvBaseUrl, removeCodexLbSetupRecoveryPath, removeCodexLbSharedOpenAiRouting, removeCodexLbManagedDesktopConfig, restoreCodexLbSetupWriteState, sha256Text, shellSingleQuote, upsertCodexAppGlmConfig, upsertCodexLbConfig, upsertCodexLbCliProviderConfig, upsertCodexLbCompatDesktopConfig, upsertCodexLbNativeDesktopConfig, upsertCodexLbSharedOpenAiRouting, writeCodexLbSetupFileIfUnchanged } from './install-helpers-codex-lb-config.js';
+import { CODEX_LB_DESKTOP_BRIDGE_MARKER, CODEX_LB_DESKTOP_COMPAT_MARKER, CODEX_LB_PROVIDER_SELECTION_MARKER, appliedCodexLbPersistenceModes, captureCodexLbSetupWriteState, codexLbSharedOpenAiRoutingState, detectCodexLbSetupDrift, ensureGlobalCodexAppGlmProfile, ensureStoredOpenRouterProviderDuringInstall, hardenCodexLbSetupRecoveryPath, removeCodexLbSetupRecoveryPath, removeCodexLbOrphanManagedMarkers, removeCodexLbSharedOpenAiRouting, removeCodexLbManagedDesktopConfig, restoreCodexLbSetupWriteState, sha256Text, shellSingleQuote, upsertCodexAppGlmConfig, upsertCodexLbConfig, upsertCodexLbCliProviderConfig, upsertCodexLbCompatDesktopConfig, upsertCodexLbNativeDesktopConfig, upsertCodexLbSharedOpenAiRouting, writeCodexLbSetupFileIfUnchanged } from './install-helpers-codex-lb-config.js';
 import { detectLegacyCodexLbDesktopState } from '../core/codex-lb/legacy-migration.js';
 import { ensureCodexImagegenDuringInstall, ensureGlobalCodexSkillsDuringInstall, ensureGlobalContext7DuringInstall, ensureGlobalGetdesignSkillDuringInstall, ensureSksCommandDuringInstall } from './install-helpers-install-support.js';
 import { escapeRegExp } from '../core/text/regex.js';
@@ -236,7 +236,7 @@ async function reportPostinstallCodexLbAuth(snapshot = null) {
     else if (codexLbAuth.status === 'skipped')
         console.log(`codex-lb auth: skipped (${codexLbAuth.reason}).`);
     else if (codexLbAuth.status === 'missing_env_key')
-        console.log('codex-lb auth: stored key missing. Run `sks codex-lb setup --host <domain> --api-key-stdin` to repair.');
+        console.log('codex-lb auth: stored key missing. Store it in ~/.codex/sks-codex-lb.env, run `sks codex-lb setup --host <domain> --api-key-stdin --yes`, or provide CODEX_LB_API_KEY in the environment.');
     else if (codexLbAuth.status === 'missing_base_url')
         console.log('codex-lb auth: stored key has no recoverable base URL. Run `sks codex-lb reconfigure --host <domain> --api-key-stdin` once.');
     else if (codexLbAuth.status === 'legacy_migration_required')
@@ -557,17 +557,16 @@ function codexLbRoutingPlane(mode) {
         return 'desktop_compat_provider';
     return 'cli_provider';
 }
-async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME || os.homedir()) {
+export async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME || os.homedir()) {
     const configPath = codexLbConfigPath(home);
     const envPath = codexLbEnvPath(home);
     const authPath = codexAuthPath(home);
     const config = await readText(configPath, '');
-    const envText = await readText(envPath, '');
     const auth = await captureCodexAuthSnapshot({ home, authPath });
     const envLoad = await loadCodexLbEnv({ home, envPath });
     const envKey = envLoad.secret_api_key || '';
     const providerConfigured = /\[model_providers\.codex-lb\]/.test(config);
-    const baseUrl = envLoad.base_url || codexLbProviderBaseUrl(config) || parseCodexLbEnvBaseUrl(envText);
+    const baseUrl = envLoad.base_url || codexLbProviderBaseUrl(config);
     const desktopMode = managedCodexLbDesktopMode(config);
     const bridgeBaseUrl = desktopMode === 'desktop-native-bridge'
         ? topLevelTomlString(config, 'openai_base_url')
@@ -590,7 +589,7 @@ async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME |
         secret_api_key: envKey || null
     };
 }
-async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
+export async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
     if (!snapshot)
         return { status: 'skipped', reason: 'no_snapshot' };
     let configRestored = false;
@@ -608,15 +607,12 @@ async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
             else if (snapshot.desktop_mode === 'desktop-dual-auth-compat') {
                 next = upsertCodexLbCompatDesktopConfig(current, { remoteBaseUrl: snapshot.base_url });
             }
-            else if (snapshot.selected !== true) {
+            else {
                 next = upsertCodexLbCliProviderConfig(current, {
                     remoteBaseUrl: snapshot.base_url,
-                    selectGlobally: false
+                    selectGlobally: snapshot.selected === true
                 });
             }
-            else {
-                configStatus = 'legacy_migration_required';
-            }
         }
         catch (error) {
             return {
@@ -629,7 +625,7 @@ async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
                 error: error instanceof Error ? error.message : String(error)
             };
         }
-        if (configStatus !== 'legacy_migration_required' && ensureTrailingNewline(next) !== ensureTrailingNewline(current)) {
+        if (ensureTrailingNewline(next) !== ensureTrailingNewline(current)) {
             const safeWrite = await safeWriteCodexConfigToml(snapshot.config_path, current, next, 'codex-lb-safe-routing-restore', { verifyUnchangedBeforeWrite: true });
             configRestored = safeWrite.ok && safeWrite.changed === true;
             configStatus = safeWrite.ok ? (configRestored ? 'restored' : 'present') : safeWrite.status;
@@ -728,7 +724,11 @@ export async function configureCodexLb(opts = {}) {
         ? Buffer.from(String(configBeforeEntry.bytes_base64 || ''), 'base64').toString('utf8')
         : '';
     const preservedDesktopMode = managedCodexLbDesktopMode(initialConfig);
-    const preservedLegacySelection = hasTopLevelCodexLbSelected(initialConfig) && !preservedDesktopMode;
+    const managedCliSelection = hasTopLevelMarker(initialConfig, CODEX_LB_PROVIDER_SELECTION_MARKER)
+        && hasTopLevelCodexLbSelected(initialConfig);
+    const preservedLegacySelection = hasTopLevelCodexLbSelected(initialConfig)
+        && !preservedDesktopMode
+        && !managedCliSelection;
     const desktopMode = preservedDesktopMode || 'cli-provider';
     if (desktopModeRequiresGlobalSecretEnvironment(desktopMode)) {
         return {
@@ -739,11 +739,15 @@ export async function configureCodexLb(opts = {}) {
             error: 'desktop_dual_auth_compat_requires_global_secret_environment'
         };
     }
-    const useDefaultProvider = desktopMode === 'desktop-dual-auth-compat' || preservedLegacySelection;
+    const useDefaultProvider = desktopMode === 'desktop-dual-auth-compat'
+        || preservedLegacySelection
+        || managedCliSelection
+        || (desktopMode === 'cli-provider' && opts.useDefaultProvider === true);
     const setupAnswers = {
         host_or_base_url: rawHost,
         api_key_source: opts.apiKeySource || 'stdin',
         desktop_mode: 'cli-provider',
+        use_as_default_provider: useDefaultProvider,
         gateway_auth_transport: (opts.gatewayAuthTransport || DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT),
         write_env_file: writeEnvFile,
         store_keychain: storeKeychain,
@@ -823,7 +827,7 @@ export async function configureCodexLb(opts = {}) {
         else if (!preservedLegacySelection) {
             providerOnly = upsertCodexLbCliProviderConfig(current, {
                 remoteBaseUrl: baseUrl,
-                selectGlobally: false
+                selectGlobally: useDefaultProvider
             });
         }
     }
@@ -1235,7 +1239,7 @@ export async function configureCodexLb(opts = {}) {
     }
     const skipLaunchEnvironment = opts.syncLaunchEnv === false
         || process.env.SKS_SKIP_CODEX_LB_LAUNCH_ENV === '1';
-    const { purgeStaleCodexLbCredentialTwins, syncDesktopCenterLaunchCredentials, verifyCodexLbLegacyKeychainReplacementStore } = await import('../core/codex-lb/desktop-center-credentials.js');
+    const { repairCodexLbLegacyKeychainMigration, syncDesktopCenterLaunchCredentials } = await import('../core/codex-lb/desktop-center-credentials.js');
     const centerCredentials = skipLaunchEnvironment
         ? {
             schema: 'sks.codex-lb-desktop-center-credentials.v1',
@@ -1493,43 +1497,36 @@ export async function configureCodexLb(opts = {}) {
     };
     if ((opts.platform || process.platform) === 'darwin' && writeEnvFile && !storeKeychain) {
         await opts.testHooks?.beforeLegacyKeychainCleanup?.({ envPath, metadataPath });
-        const replacement = await verifyCodexLbLegacyKeychainReplacementStore({
+        const migration = await repairCodexLbLegacyKeychainMigration({
             home,
+            baseUrl,
             envPath,
             metadataPath,
             account: opts.account || process.env.USER || 'sks',
-            expectedApiKeySha256: keyFingerprint
-        });
-        const cleanup = await purgeStaleCodexLbCredentialTwins({
-            home,
-            account: opts.account || process.env.USER || 'sks',
-            platform: 'darwin',
-            skipStaleEnvTwins: true,
+            platform: opts.platform || process.platform,
             ...(opts.securityBin ? { securityBin: opts.securityBin } : {}),
             ...(opts.runProcessImpl ? { runProcessImpl: opts.runProcessImpl } : {}),
-            ...(replacement.receipt
-                ? { legacyKeychainMigrationReceipt: replacement.receipt }
-                : {})
+            expectedApiKeySha256: keyFingerprint
         });
-        const cleanupBlockers = [
-            ...(!replacement.ok && replacement.blockers.length === 0
-                ? ['legacy_keychain_replacement_store_unverified']
-                : replacement.blockers),
-            ...cleanup.blockers
-        ];
-        const cleanupOk = replacement.ok && cleanupBlockers.length === 0;
+        const cleanupBlockers = [...new Set(migration.blockers)];
+        const replacementStoreVerified = migration.env_key_valid
+            && migration.status !== 'replacement_store_unverified'
+            && migration.status !== 'env_file_unsafe';
+        const cleanupOk = replacementStoreVerified
+            && migration.ok
+            && cleanupBlockers.length === 0;
         legacyKeychainCleanup = {
             ok: cleanupOk,
-            status: !replacement.ok
+            status: !replacementStoreVerified
                 ? 'legacy_keychain_cleanup_blocked_replacement_store_unverified'
-                : cleanupBlockers.length === 0
-                    ? cleanup.keychain_cleared.length > 0
+                : cleanupOk
+                    ? migration.keychain_cleared.length > 0
                         ? 'legacy_keychain_removed'
                         : 'legacy_keychain_absent'
                     : 'legacy_keychain_cleanup_failed_secure_store_retained',
-            replacement_store_verified: replacement.ok,
-            keychain_cleared: cleanup.keychain_cleared,
-            blockers: [...new Set(cleanupBlockers)]
+            replacement_store_verified: replacementStoreVerified,
+            keychain_cleared: migration.keychain_cleared,
+            blockers: cleanupBlockers
         };
         appliedActions.push({
             type: 'migrate_legacy_keychain',
@@ -1601,9 +1598,10 @@ export async function codexLbStatus(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const configPath = opts.configPath || codexLbConfigPath(home);
     const envPath = opts.envPath || codexLbEnvPath(home);
-    const config = await readText(configPath, '');
+    const rawConfig = await readText(configPath, '');
+    const orphanManagedMarkerCleanup = removeCodexLbOrphanManagedMarkers(rawConfig);
+    const config = orphanManagedMarkerCleanup.text;
     const envExists = await exists(envPath);
-    const envText = envExists ? await readText(envPath, '') : '';
     const envLoad = await loadCodexLbEnv({ ...opts, home, envPath });
     const authPath = opts.authPath || codexAuthPath(home);
     const authText = await readText(authPath, '');
@@ -1638,6 +1636,7 @@ export async function codexLbStatus(opts = {}) {
         && providerSupportsWebsockets === true
         && providerOpenAiAuthDisabled;
     const retiredCompatConfigured = desktopMode === 'desktop-dual-auth-compat';
+    const definedButNotSelected = providerConfigured && !selected && desktopMode === null;
     const providerContractOk = !retiredCompatConfigured && cliProviderContractOk;
     const providerUsesCodexLbEnvAuth = providerConfigured && providerEnvKey === CODEX_LB_PROVIDER_ENV_KEY && providerOpenAiAuthDisabled;
     const oauthAvailable = authMode.mode === 'chatgpt_oauth' || authMode.mode === 'browser_marker';
@@ -1682,9 +1681,23 @@ export async function codexLbStatus(opts = {}) {
                 allowUnverified: opts.allowUnverifiedToolOutputRecovery === true
                     || codexLbToolOutputRecoveryOverrideAcknowledged({ env: opts.env || process.env })
             });
+    const secretResolution = {
+        source: envLoad.source,
+        path: envLoad.source === 'env-file' ? envLoad.env_paths[0] || envPath : null,
+        prompt_risk: 'none'
+    };
     return {
         ok: providerReady && (!selected || !probeToolOutputRecovery || toolOutputRecovery.ok),
         blockers,
+        warnings: definedButNotSelected ? ['codex_lb_defined_but_not_selected'] : [],
+        orphan_managed_markers: orphanManagedMarkerCleanup.orphan_markers,
+        managed_marker_cleanup_required: orphanManagedMarkerCleanup.changed,
+        activation_guidance: definedButNotSelected
+            ? [
+                'Run `sks codex-lb use-cli` to select the CLI provider.',
+                'Run `sks codex-lb use-desktop-full` to activate managed Desktop bridge mode.'
+            ]
+            : [],
         provider_ready: providerReady,
         config_path: configPath,
         env_path: envPath,
@@ -1717,10 +1730,13 @@ export async function codexLbStatus(opts = {}) {
             source: envLoad.source,
             source_priority: envLoad.source_priority,
             api_key: envLoad.api_key,
+            blockers: envLoad.blockers,
+            guidance: envLoad.guidance,
             credential_binding: envLoad.credential_binding,
             keychain: envLoad.keychain,
             env_paths: envLoad.env_paths
         },
+        secret_resolution: secretResolution,
         base_url: baseUrl,
         auth_path: authPath,
         auth_mode: authMode.mode,
@@ -1746,6 +1762,19 @@ export async function codexLbStatus(opts = {}) {
 export function formatCodexLbStatusText(status = {}, opts = {}) {
     const backupPresent = Boolean(opts.backupPresent);
     const backupPath = opts.backupPath || '';
+    const resolution = status.secret_resolution || {};
+    const resolutionSource = String(resolution.source || status.env_loader?.source || 'missing');
+    const resolutionPath = resolution.path
+        || (resolutionSource === 'env-file' ? status.env_loader?.env_paths?.[0] || status.env_path : null);
+    const displayResolutionPath = resolutionPath
+        ? formatCodexLbStatusPath(String(resolutionPath), opts.home || os.homedir())
+        : '';
+    const resolutionLabel = displayResolutionPath
+        ? `${resolutionSource} (${displayResolutionPath})`
+        : resolutionSource;
+    const keychainUsage = resolutionSource === 'keychain' ? 'used' : 'not used';
+    const promptRisk = String(resolution.prompt_risk
+        || (resolutionSource === 'keychain' ? 'possible' : 'none'));
     const lines = [
         'SKS codex-lb',
         '',
@@ -1755,7 +1784,8 @@ export function formatCodexLbStatusText(status = {}, opts = {}) {
         `Provider OpenAI Auth: ${status.provider_requires_openai_auth ? 'required' : 'not required/drifted'} (${status.provider_name || 'missing'})`,
         `Codex App auth: ${status.auth_usable_for_codex_app ? 'ok' : 'needs sign-in/repair'} (${status.auth_mode || 'unknown'})`,
         `Shared OpenAI routing: ${status.shared_openai_routing?.safe === false ? 'unsafe' : status.shared_openai_routing?.status || 'unknown'}${status.shared_openai_routing?.managed ? ' (sks-managed)' : ''}`,
-        `Auth/routing coherent: ${status.auth_routing_coherent ? 'yes' : 'no'}`
+        `Auth/routing coherent: ${status.auth_routing_coherent ? 'yes' : 'no'}`,
+        `Key source: ${resolutionLabel} · keychain: ${keychainUsage} · prompt risk: ${promptRisk}`
     ];
     if (status.tool_output_recovery?.status && status.tool_output_recovery.status !== 'not_selected') {
         const recovery = status.tool_output_recovery;
@@ -1777,13 +1807,18 @@ export function formatCodexLbStatusText(status = {}, opts = {}) {
     if (status.base_url)
         lines.push(`Base URL:   ${status.base_url}`);
     lines.push(`ChatGPT backup: ${backupPresent ? `yes (${backupPath})` : 'no'}`);
+    if ((status.warnings || []).includes('codex_lb_defined_but_not_selected')) {
+        lines.push('', 'Warning [codex_lb_defined_but_not_selected]: the codex-lb provider is defined but not selected.');
+        for (const action of status.activation_guidance || [])
+            lines.push(`  ${action}`);
+    }
     if (status.legacy_migration_required || status.shared_openai_routing?.safe === false)
         lines.push('', 'Run: sks codex-lb migrate-legacy-desktop --restart-app. Ordinary repair will not rewrite shared Codex auth.');
     else if (status.provider_configured && !status.provider_contract_ok)
         lines.push('', 'Run: sks codex-lb repair to rewrite the provider block to the current codex-lb App contract.');
     else if (status.desktop_mode === 'desktop-native-bridge' && !status.auth_usable_for_codex_app)
         lines.push('', 'Sign in with ChatGPT OAuth, then run: sks codex-lb use-desktop-full.');
-    else if (status.ok && status.desktop_mode === 'cli-provider' && !status.selected)
+    else if (status.ok && status.desktop_mode === 'cli-provider' && !status.selected && !(status.warnings || []).includes('codex_lb_defined_but_not_selected'))
         lines.push('', 'CLI provider is stored but unselected. Run `sks codex-lb use-cli` for CLI use or `sks codex-lb use-desktop-full` for managed Desktop routing.');
     else if (status.desktop_mode === 'desktop-dual-auth-compat')
         lines.push('', 'The retired compatibility route is blocked. Run `sks codex-lb use-desktop-full` or `sks codex-lb disable`.');
@@ -1791,12 +1826,22 @@ export function formatCodexLbStatusText(status = {}, opts = {}) {
         lines.push('', 'Status: configured; no ordinary repair needed.');
     else if (!status.ok && status.base_url && status.env_key_configured)
         lines.push('', 'Run: sks codex-lb repair. To change routing explicitly, use `use-desktop-full`, `use-cli`, or `disable`.');
+    else if (!status.ok && !status.env_key_configured)
+        lines.push('', 'Gateway key missing. Store CODEX_LB_API_KEY in ~/.codex/sks-codex-lb.env, run `sks codex-lb setup --host <domain> --api-key-stdin --yes`, or provide CODEX_LB_API_KEY in the environment.');
     else if (!status.ok)
         lines.push('', 'Run: sks codex-lb setup --host <domain> --api-key-stdin');
     if (backupPresent)
         lines.push('Legacy OAuth backup detected; use `sks codex-lb migrate-legacy-desktop --restart-app` instead of background auth switching.');
     return `${lines.join('\n')}\n`;
 }
+function formatCodexLbStatusPath(file, home) {
+    const resolvedFile = path.resolve(file);
+    const resolvedHome = path.resolve(String(home || ''));
+    const relative = path.relative(resolvedHome, resolvedFile);
+    return relative && relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)
+        ? `~/${relative.split(path.sep).join('/')}`
+        : file;
+}
 export function formatCodexLbRepairResultText(result = {}) {
     const lines = [
         'codex-lb credential/provider configuration repaired without changing Codex shared auth.',