sneakoscope 8.0.2 → 8.0.3

package/dist/commands/codex-lb.js

@@ -5,6 +5,7 @@ import { projectRoot, readStdin, readText } from '../core/fsx.js';
 import { flag, readOption } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
 import { printCodexLbSetupWarnings } from '../cli/codex-lb-setup-warning-output.js';
+import { testCodexLbConnection } from '../cli/install-helpers-codex-lb-chain.js';
 import { codexLbMetrics, readCodexLbCircuit, recordCodexLbHealthEvent, resetCodexLbCircuit, codexLbProofEvidence } from '../core/codex-lb-circuit.js';
 import { checkCodexLbResponseChain, codexLbStatus, configureCodexLb, repairCodexLbAuth } from '../cli/install-helpers.js';
 import { buildCodexLbSetupPlan, renderCodexLbSetupPlan } from '../core/codex-lb/codex-lb-setup.js';
@@ -13,6 +14,7 @@ import { loadCodexLbEnv } from '../core/codex-lb/codex-lb-env.js';
 import { activateCodexLbDesktopMode, buildCodexLbDesktopCapabilities, codexLbDesktopStatusV2, configureCodexLbCliMode, disableCodexLbDesktopRouting, migrateLegacyCodexLbDesktopMode, readCodexLbDesktopDeepEvidence, readCodexLbDesktopDeepEvidenceTrustAnchors, rollbackCodexLbDesktopMode } from '../core/codex-lb/desktop-controller.js';
 import { serveDesktopBridge } from '../core/codex-lb/desktop-service.js';
 import { parseCodexLbGatewayAuthTransport } from '../core/codex-lb/desktop-mode.js';
+import { codexLbRoutingTruthIsActive, measureAndWriteCodexLbRoutingTruth } from '../core/codex-lb/routing-truth.js';
 export async function run(command, args = []) {
     const root = await projectRoot();
     const action = args[0] || 'status';
@@ -26,7 +28,12 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'status' || action === 'check') {
-        const result = await codexLbDesktopStatusV2(controllerOptions(args));
+        const options = controllerOptions(args);
+        options.networkProbes = action === 'check'
+            || flag(args, '--deep')
+            || flag(args, '--fix')
+            || flag(args, '--remeasure');
+        const result = await codexLbDesktopStatusV2(options);
         if (result.ok !== true)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -45,6 +52,29 @@ export async function run(command, args = []) {
             process.exitCode = 1;
         return;
     }
+    if (action === 'connect-test') {
+        const status = await codexLbStatus();
+        const modelSelection = await resolveCodexLbHealthModel(status);
+        const loadedEnv = await loadCodexLbEnv({
+            home: path.dirname(path.dirname(status.env_path)),
+            envPath: status.env_path
+        });
+        const result = await testCodexLbConnection(status, {
+            requireSelected: true,
+            model: modelSelection.model,
+            baseUrl: loadedEnv.base_url,
+            apiKey: loadedEnv.secret_api_key,
+            credentialBindingBlockers: loadedEnv.credential_binding.blockers
+        });
+        if (!result.ok)
+            process.exitCode = 1;
+        if (flag(args, '--json'))
+            return printJson(result);
+        console.log(result.ok
+            ? `codex-lb connect test: ok (${result.model}, ${result.latency_ms}ms): ${result.result || ''}`
+            : `codex-lb connect test: failed (${result.status})`);
+        return;
+    }
     if (action === 'health' || action === 'verify-chain' || action === 'chain') {
         const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
         const status = await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery });
@@ -73,7 +103,20 @@ export async function run(command, args = []) {
                     apiKey: loadedEnv.secret_api_key
                 })
                 : { ok: false, status: blocker, codex_lb: status };
-        const result = { ...chain, codex_lb: status, model_selection: modelSelection };
+        const routingTruth = await measureAndWriteCodexLbRoutingTruth({
+            selected: status.selected === true,
+            baseUrl: loadedEnv.base_url,
+            apiKey: loadedEnv.secret_api_key
+        }, {
+            home: path.dirname(path.dirname(status.env_path))
+        });
+        const result = {
+            ...chain,
+            ok: chain.ok === true && routingTruth.ok,
+            codex_lb: status,
+            model_selection: modelSelection,
+            routing_truth: routingTruth
+        };
         if (!result.ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -98,9 +141,16 @@ export async function run(command, args = []) {
         const evidence = await fastEvidenceFromChain(chain, readOption(args, '--request-log', readOption(args, '--request-log-json', null)));
         const providerReady = status.provider_contract_ok === true;
         const chainVerified = isCodexLbFastChainVerified(chain);
+        const routingTruth = await measureAndWriteCodexLbRoutingTruth({
+            selected: status.selected === true,
+            baseUrl: loadedEnv.base_url,
+            apiKey: loadedEnv.secret_api_key
+        }, {
+            home: path.dirname(path.dirname(status.env_path))
+        });
         const result = {
             schema: 'sks.codex-lb-fast-check.v1',
-            ok: Boolean(providerReady && chainVerified && evidence.fast_requested && evidence.fast_actual),
+            ok: Boolean(providerReady && chainVerified && routingTruth.ok && evidence.fast_requested && evidence.fast_actual),
             status: !providerReady
                 ? 'provider_contract_drift'
                 : chain.skipped === true
@@ -115,11 +165,13 @@ export async function run(command, args = []) {
             codex_lb: status,
             model_selection: modelSelection,
             chain,
+            routing_truth: routingTruth,
             evidence,
             degraded_models: Array.isArray(chain.degraded_models) ? chain.degraded_models : [],
             quota_low: Boolean(chain.quota_low),
             blockers: [
                 ...(providerReady ? [] : ['codex_lb_provider_contract_drift']),
+                ...routingTruth.blockers,
                 ...modelSelection.blockers,
                 ...(chain.skipped === true
                     ? ['codex_lb_fast_check_chain_skipped']
@@ -181,6 +233,7 @@ export async function run(command, args = []) {
             writeEnvFile: true,
             syncLaunchctl: true,
             desktopMode: 'cli-provider',
+            useDefaultProvider: current.mode === 'cli-provider' && current.routing_active === true,
             allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
         });
         let routing = null;
@@ -201,8 +254,8 @@ export async function run(command, args = []) {
             action: 'set-key',
             provider_ready: result.ok === true,
             routing_active: Boolean(result.ok
-                && current.mode === 'desktop-native-bridge'
-                && routing?.ok !== false),
+                && ((current.mode === 'desktop-native-bridge' && routing?.ok !== false)
+                    || (current.mode === 'cli-provider' && result.codex_lb?.selected === true))),
             activation_required: Boolean(result.ok
                 && current.mode !== 'desktop-native-bridge'
                 && current.mode !== 'desktop-dual-auth-compat'),
@@ -247,7 +300,7 @@ export async function run(command, args = []) {
         if (flag(args, '--json'))
             return printJson(result);
         console.log(result.ok === true
-            ? `codex-lb CLI provider ready. Run: ${String(result.command)}`
+            ? `codex-lb CLI provider active (${String(result.routing_truth?.actual_host || 'verified route')}).`
             : `codex-lb CLI provider setup failed: ${String(result.status || 'failed')}`);
         return;
     }
@@ -468,6 +521,7 @@ export async function run(command, args = []) {
             host: options.host,
             apiKey: options.apiKey,
             desktopMode: 'cli-provider',
+            useDefaultProvider: options.useDefaultProvider,
             gatewayAuthTransport: options.gatewayAuthTransport,
             keychain: options.keychain,
             storeKeychain: options.keychain,
@@ -502,6 +556,17 @@ export async function run(command, args = []) {
             })
             : null;
         const capabilityDiagnosticOk = codexLbSetupCapabilityDiagnosticOk(capabilities);
+        const setupRoutingTruth = result.ok && options.desktopMode === 'cli-provider'
+            ? await measureAndWriteCodexLbRoutingTruth({
+                selected: result.codex_lb?.selected === true,
+                baseUrl: result.base_url || null,
+                apiKey: options.apiKey,
+                authTransport: 'authorization-bearer'
+            }, {
+                home: path.dirname(path.dirname(result.env_path))
+            })
+            : desktopActivation?.post_activation_status?.routing_truth || null;
+        const cliRoutingActive = codexLbRoutingTruthIsActive(setupRoutingTruth);
         const shaped = {
             ...result,
             schema: 'sks.codex-lb-setup.v2',
@@ -516,9 +581,11 @@ export async function run(command, args = []) {
             desktop_auth_mutated: false,
             fast_mode_mutated: false,
             provider_ready: result.ok === true,
-            routing_active: Boolean(result.ok && desktopActivation?.ok === true),
+            routing_active: Boolean(result.ok && (desktopActivation?.ok === true || cliRoutingActive)),
+            routing_truth: setupRoutingTruth,
             activation_required: Boolean(result.ok
                 && options.desktopMode === 'cli-provider'
+                && !cliRoutingActive
                 && desktopActivation === null),
             desktop_activation: desktopActivation,
             capabilities
@@ -617,12 +684,12 @@ export async function run(command, args = []) {
         console.log(`codex-lb proof evidence: ${result.status}`);
         return;
     }
-    console.error('Usage: sks codex-lb status|setup|set-key|use-desktop-full|use-cli|disable|capabilities [--level shallow|transport|deep] [--evidence <file> --trust-anchors <file>]|migrate-legacy-desktop|rollback <receipt-id>|health|metrics|doctor|repair|circuit reset|circuit record-fixture|proof-evidence [--json]');
+    console.error('Usage: sks codex-lb status|setup|set-key|connect-test|use-desktop-full|use-cli|disable|capabilities [--level shallow|transport|deep] [--evidence <file> --trust-anchors <file>]|migrate-legacy-desktop|rollback <receipt-id>|health|metrics|doctor|repair|circuit reset|circuit record-fixture|proof-evidence [--json]');
     console.error(`  ${CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG}  explicitly acknowledge an old/unverified proxy for this command (unsafe)`);
     console.error('  set-key       swap the codex-lb API key (reuses the stored host): sks codex-lb set-key --api-key-stdin');
     console.error('  --keychain    fail-closed until a dedicated signed SKS Keychain helper is available; the default 0600 env file is used');
     console.error('  use-desktop-full   keep ChatGPT OAuth/built-in OpenAI and route data through the local bridge');
-    console.error('  use-cli            configure an unselected CLI-only provider');
+    console.error('  use-cli            verify, write, and atomically select the CLI codex-lb provider');
     console.error('  disable            remove only SKS-managed Desktop routing; auth.json is untouched');
     process.exitCode = 1;
 }
@@ -668,25 +735,35 @@ async function resolveCodexLbModel(status = {}, env = process.env, opts = {}) {
     const configured = topLevelTomlString(config, 'model');
     if (configured)
         return { model: configured, source: 'global_config', blockers: [] };
+    const home = String(env.HOME || '').trim();
     const configuredCatalogPath = topLevelTomlString(config, 'model_catalog_json');
-    if (!configuredCatalogPath)
+    const defaultCatalogPath = configPath
+        ? path.join(path.dirname(configPath), 'models_cache.json')
+        : home
+            ? path.join(home, '.codex', 'models_cache.json')
+            : '';
+    const requestedCatalogPath = configuredCatalogPath || defaultCatalogPath;
+    if (!requestedCatalogPath)
         return { model: null, source: null, blockers: [`${opts.blockerPrefix}_model_unselected`] };
-    const home = String(env.HOME || '').trim();
-    const expandedCatalogPath = configuredCatalogPath.startsWith('~/') && home
-        ? path.join(home, configuredCatalogPath.slice(2))
-        : configuredCatalogPath;
+    const expandedCatalogPath = requestedCatalogPath.startsWith('~/') && home
+        ? path.join(home, requestedCatalogPath.slice(2))
+        : requestedCatalogPath;
     const catalogPath = path.isAbsolute(expandedCatalogPath)
         ? expandedCatalogPath
         : path.resolve(path.dirname(configPath), expandedCatalogPath);
     try {
-        const payload = JSON.parse(await readText(catalogPath, ''));
+        const catalogText = await readText(catalogPath, '');
+        if (!catalogText.trim()) {
+            return { model: null, source: null, blockers: [`${opts.blockerPrefix}_model_unselected`] };
+        }
+        const payload = JSON.parse(catalogText);
         const model = selectCatalogModel(payload, opts.requirePriority === true);
         return model
-            ? { model, source: 'model_catalog_json', blockers: [] }
-            : { model: null, source: 'model_catalog_json', blockers: [`${opts.blockerPrefix}_${opts.requirePriority === true ? 'priority_' : ''}model_unavailable`] };
+            ? { model, source: configuredCatalogPath ? 'model_catalog_json' : 'codex_models_cache', blockers: [] }
+            : { model: null, source: configuredCatalogPath ? 'model_catalog_json' : 'codex_models_cache', blockers: [`${opts.blockerPrefix}_${opts.requirePriority === true ? 'priority_' : ''}model_unavailable`] };
     }
     catch {
-        return { model: null, source: 'model_catalog_json', blockers: [`${opts.blockerPrefix}_catalog_invalid`] };
+        return { model: null, source: configuredCatalogPath ? 'model_catalog_json' : 'codex_models_cache', blockers: [`${opts.blockerPrefix}_catalog_invalid`] };
     }
 }
 function topLevelTomlString(text, key) {
@@ -821,6 +898,7 @@ export function controllerOptions(args = []) {
     const envPath = readOption(args, '--env-file', readOption(args, '--env-path', null));
     const metadataPath = readOption(args, '--metadata', readOption(args, '--metadata-path', null));
     const receiptDir = readOption(args, '--receipt-dir', null);
+    const routingTruthReceiptPath = readOption(args, '--routing-truth-receipt', null);
     const listenHost = readOption(args, '--listen-host', null);
     const normalizedListenHost = listenHost === null
         ? null
@@ -841,6 +919,7 @@ export function controllerOptions(args = []) {
         ...(envPath ? { envPath: String(envPath) } : {}),
         ...(metadataPath ? { metadataPath: String(metadataPath) } : {}),
         ...(receiptDir ? { receiptDir: String(receiptDir) } : {}),
+        ...(routingTruthReceiptPath ? { routingTruthReceiptPath: String(routingTruthReceiptPath) } : {}),
         ...(capabilityTimeoutMs !== null && Number.isFinite(capabilityTimeoutMs) && capabilityTimeoutMs > 0
             ? { capabilityTimeoutMs }
             : {}),
@@ -855,11 +934,19 @@ export function controllerOptions(args = []) {
             : {})
     };
 }
-function formatCodexLbDesktopStatusText(status) {
+export function formatCodexLbDesktopStatusText(status, opts = {}) {
     const oauth = asRecord(status.oauth);
     const provider = asRecord(status.provider);
     const bridge = asRecord(status.bridge);
     const capabilities = asRecord(status.capabilities);
+    const resolution = asRecord(status.secret_resolution);
+    const resolutionSource = String(resolution.source || 'missing');
+    const resolutionPath = resolution.path
+        ? displayHomePath(String(resolution.path), opts.home || process.env.HOME || '')
+        : '';
+    const resolutionLabel = resolutionPath
+        ? `${resolutionSource} (${resolutionPath})`
+        : resolutionSource;
     const blockers = stringArray(status.blockers);
     const guidance = stringArray(status.guidance);
     const lines = [
@@ -873,6 +960,7 @@ function formatCodexLbDesktopStatusText(status) {
         `Provider: ${String(provider.contract || 'missing')} (${provider.contract_ok === true ? 'ok' : 'blocked'})`,
         `Bridge: ${String(bridge.status || 'unknown')}${bridge.running === true ? ' (running)' : ''}`,
         `Gateway auth: ${String(status.gateway_auth_transport || 'inactive')}`,
+        `Key source: ${resolutionLabel} · keychain: not used · prompt risk: ${String(resolution.prompt_risk || 'none')}`,
         `Capabilities: ${String(status.overall || capabilities.state || 'unverified')}`,
         `Full capability: ${status.full_capability_verified === true ? 'verified' : 'unverified'}`
     ];
@@ -888,6 +976,13 @@ function formatCodexLbDesktopStatusText(status) {
     }
     return `${lines.join('\n')}\n`;
 }
+function displayHomePath(file, home) {
+    const resolvedFile = path.resolve(file);
+    const resolvedHome = home ? path.resolve(home) : '';
+    return resolvedHome && (resolvedFile === resolvedHome || resolvedFile.startsWith(`${resolvedHome}${path.sep}`))
+        ? `~${resolvedFile.slice(resolvedHome.length)}`
+        : resolvedFile;
+}
 function printDeprecationWarning(oldAction, replacement) {
     console.error(`warning: \`sks codex-lb ${oldAction}\` is deprecated; use \`${replacement}\`.`);
 }
@@ -1005,6 +1100,7 @@ async function codexLbSetupOptions(args = []) {
         syncLaunchctl = true;
     const shellProfile = normalizeShellProfile(readOption(args, '--shell-profile', 'skip'));
     const allowInsecureLocalhost = flag(args, '--allow-insecure-localhost') || flag(args, '--allow-insecure-http');
+    const useDefaultProvider = !flag(args, '--no-default-provider');
     const interactive = (!host || !apiKey || canAskInteractive(args)) && canAskInteractive(args);
     if ((!host || !apiKey) && canAskInteractive(args)) {
         console.log('SKS codex-lb setup\n');
@@ -1039,6 +1135,7 @@ async function codexLbSetupOptions(args = []) {
             shellProfile: interactiveShellProfile,
             allowInsecureLocalhost,
             apiKeySource,
+            useDefaultProvider,
             interactive: true,
             yes: flag(args, '--yes')
         };
@@ -1055,6 +1152,7 @@ async function codexLbSetupOptions(args = []) {
         shellProfile,
         allowInsecureLocalhost,
         apiKeySource,
+        useDefaultProvider,
         interactive,
         yes: flag(args, '--yes')
     };