sneakoscope 8.0.2 → 8.0.3

package/dist/commands/doctor.js

@@ -1,6 +1,7 @@
 import os from 'node:os';
 import path from 'node:path';
-import { projectRoot, exists, formatBytes, nowIso, writeJsonAtomic } from '../core/fsx.js';
+import { createHash } from 'node:crypto';
+import { projectRoot, exists, formatBytes, nowIso, readText, writeJsonAtomic } from '../core/fsx.js';
 import { flag } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
 import { ui as cliUi } from '../cli/cli-theme.js';
@@ -10,6 +11,15 @@ import { codexAppIntegrationStatus } from '../core/codex-app.js';
 import { codexLbMetrics, readCodexLbCircuit } from '../core/codex-lb-circuit.js';
 import { codexLbStatus } from '../cli/install-helpers.js';
 import { codexLbToolOutputRecoveryOverrideAcknowledged } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
+import { codexLbEnvPath, loadCodexLbEnv } from '../core/codex-lb/codex-lb-env.js';
+import { codexLbLegacyKeychainMigrationStampPath, inspectDesktopCenterLaunchCredentials, inspectCodexLbLegacyKeychainMigration, repairCodexLbLegacyKeychainMigration, syncDesktopCenterLaunchCredentials } from '../core/codex-lb/desktop-center-credentials.js';
+import { codexLbRoutingTruthIsActive, measureAndWriteCodexLbRoutingTruth, readCodexLbRoutingTruthReceipt } from '../core/codex-lb/routing-truth.js';
+import { removeCodexLbOrphanManagedMarkers } from '../cli/install-helpers-codex-lb-config.js';
+import { safeWriteCodexConfigToml } from '../core/codex-runtime/codex-desktop-config-policy.js';
+import { probeTelegram, telegramSelfHealAction } from '../core/telegram/doctor.js';
+import { TelegramClient } from '../core/telegram/client.js';
+import { resolveTelegramBotToken } from '../core/telegram/keychain.js';
+import { telegramLivenessPath } from '../core/telegram/liveness.js';
 import { normalizeInstallScope } from '../core/init.js';
 import { inspectCodexConfigReadability } from '../core/codex/codex-config-readability.js';
 import { inspectOAuthCallbackPortConflict, oauthCallbackDoctorGuidance } from '../core/codex/oauth-callback-port-diagnostic.js';
@@ -27,13 +37,18 @@ import { withSecretPreservationGuard } from '../core/config/config-migration-jou
 import { reconcileDoctorSkills } from '../core/doctor/doctor-skill-reconcile.js';
 import { buildSksMenuBarDoctorPostcheck } from '../core/doctor/sks-menubar-doctor.js';
 import { isUpdateMigrationReceiptCurrent, projectUpdateMigrationReceiptPath, writeProjectUpdateMigrationReceipt } from '../core/update/update-migration-state.js';
-import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
+import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarPaths, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
+import { restartLaunchAgent } from '../core/codex-app/menubar/launch-agent.js';
 import { sweepSksTempDirs } from '../core/retention.js';
 import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
 import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 import { formatHarnessConflictReport, scanHarnessConflicts } from '../core/harness-conflicts.js';
-import { doctorArgWarnings, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs } from './doctor-profile.js';
-export { doctorArgWarnings, doctorMenuBarInstallPolicy, doctorProfileFromArgs } from './doctor-profile.js';
+import { doctorArgWarnings as baseDoctorArgWarnings, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs } from './doctor-profile.js';
+export { doctorMenuBarInstallPolicy, doctorProfileFromArgs } from './doctor-profile.js';
+const CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG = '--retry-codex-lb-keychain-migration';
+export function doctorArgWarnings(args = []) {
+    return baseDoctorArgWarnings(args.filter((arg) => arg !== CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG));
+}
 export function deferCommandAliasCleanupToMigrationReceipt(result) {
     const observedBlockers = Array.isArray(result?.blockers)
         ? result.blockers.map(String).filter(Boolean)
@@ -53,6 +68,196 @@ export function deferCommandAliasCleanupToMigrationReceipt(result) {
         ]
     };
 }
+export async function inspectDoctorCodexLbSecretResolution(input = {}, deps = {}) {
+    const processEnv = input.processEnv || process.env;
+    const home = path.resolve(input.home || processEnv.HOME || os.homedir());
+    const suppliedMigrationOptions = input.migrationOptions || {};
+    const migrationOptions = {
+        ...suppliedMigrationOptions,
+        home,
+        env: suppliedMigrationOptions.env || processEnv,
+        processEnv: suppliedMigrationOptions.processEnv || processEnv,
+        ...(input.baseUrl ? { baseUrl: input.baseUrl } : {}),
+        ...(input.forceRetry === true ? { forceRetry: true } : {})
+    };
+    if (processEnv.SKS_TEST_FORBID_REAL_HOME === '1' && suppliedMigrationOptions.platform === undefined) {
+        migrationOptions.platform = 'linux';
+    }
+    const mode = input.fix === true ? 'repair' : 'inspect';
+    const reconcile = mode === 'repair'
+        ? deps.repairImpl || repairCodexLbLegacyKeychainMigration
+        : deps.inspectImpl || inspectCodexLbLegacyKeychainMigration;
+    let migration;
+    try {
+        migration = await reconcile(migrationOptions);
+    }
+    catch (error) {
+        migration = {
+            schema: 'sks.codex-lb-legacy-keychain-reconciliation.v1',
+            ok: false,
+            status: `${mode}_failed`,
+            mode,
+            env_key_valid: false,
+            keychain_item_present: null,
+            prompt_risk: 'none',
+            attempted: false,
+            stamp_path: codexLbLegacyKeychainMigrationStampPath(home),
+            stamp_outcome: null,
+            keychain_deleted: false,
+            keychain_cleared: [],
+            blockers: [`codex_lb_legacy_keychain_${mode}_failed:${error instanceof Error ? error.message : String(error)}`]
+        };
+    }
+    const envPath = String(suppliedMigrationOptions.envPath || codexLbEnvPath(home));
+    let loaded = null;
+    let resolutionError = null;
+    try {
+        loaded = await (deps.loadEnvImpl || loadCodexLbEnv)({
+            home,
+            processEnv,
+            envPath,
+            ...(suppliedMigrationOptions.metadataPath ? { metadataPath: suppliedMigrationOptions.metadataPath } : {})
+        });
+    }
+    catch (error) {
+        resolutionError = error instanceof Error ? error.message : String(error);
+    }
+    const source = String(loaded?.source || 'missing');
+    const unsafeEnvFile = Array.isArray(loaded?.blockers)
+        && loaded.blockers.some((blocker) => String(blocker).startsWith('codex_lb_env_file_'));
+    const resolutionPath = source === 'env-file' || unsafeEnvFile
+        ? String(loaded?.env_paths?.[0] || envPath)
+        : null;
+    const operatorActions = [];
+    if (mode === 'inspect' && migration.prompt_risk === 'one_time_on_repair') {
+        operatorActions.push('Run `sks doctor --fix` to perform the one-time legacy Keychain transfer.');
+    }
+    if (mode === 'repair'
+        && migration.ok === false
+        && (migration.attempted === true || migration.status === 'already_attempted')) {
+        operatorActions.push(`Run \`sks doctor --fix ${CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG}\` to explicitly retry the one-time Keychain transfer.`);
+    }
+    return {
+        ok: migration.ok !== false && resolutionError === null,
+        secret_resolution: {
+            source,
+            path: resolutionPath,
+            prompt_risk: migration.prompt_risk || 'none'
+        },
+        legacy_keychain_migration: {
+            ...migration,
+            operator_actions: operatorActions,
+            ...(resolutionError ? { resolution_error: resolutionError } : {})
+        }
+    };
+}
+export async function inspectDoctorCodexLbDivergence(input = {}, deps = {}) {
+    const processEnv = input.processEnv || process.env;
+    const home = path.resolve(input.home || processEnv.HOME || os.homedir());
+    const status = input.providerStatus || {};
+    const configPath = String(status.config_path || path.join(home, '.codex', 'config.toml'));
+    const configText = await (deps.readTextImpl || readText)(configPath, '');
+    const orphan = removeCodexLbOrphanManagedMarkers(configText);
+    let orphanRepair = {
+        schema: 'sks.codex-lb-orphan-managed-marker-repair.v1',
+        attempted: false,
+        changed: false,
+        markers: orphan.orphan_markers,
+        receipt: null
+    };
+    if (input.fix === true && orphan.changed) {
+        const write = deps.writeConfigImpl || safeWriteCodexConfigToml;
+        const receipt = await write(configPath, configText, orphan.text, 'doctor-codex-lb-orphan-marker');
+        orphanRepair = {
+            ...orphanRepair,
+            attempted: true,
+            changed: receipt?.ok !== false,
+            receipt
+        };
+    }
+    const load = deps.loadEnvImpl || loadCodexLbEnv;
+    const canonical = await load({
+        home,
+        processEnv: {},
+        envPath: String(status.env_path || codexLbEnvPath(home))
+    }).catch(() => null);
+    const ambientKey = String(processEnv.CODEX_LB_API_KEY || '').trim();
+    const canonicalKey = String(canonical?.secret_api_key || '').trim();
+    const sha256 = (value) => value
+        ? createHash('sha256').update(value).digest('hex')
+        : null;
+    const ambientHash = sha256(ambientKey);
+    const canonicalHash = sha256(canonicalKey);
+    const staleAmbient = Boolean(ambientHash && canonicalHash && ambientHash !== canonicalHash);
+    const bridgeActive = status.desktop_mode === 'desktop-native-bridge';
+    const definedButNotSelected = status.provider_configured === true
+        && status.selected !== true
+        && !bridgeActive
+        && status.desktop_mode !== 'desktop-dual-auth-compat';
+    const mode = status.selected === true
+        ? 'cli-provider'
+        : bridgeActive
+            ? 'desktop-native-bridge'
+            : 'disabled';
+    const inspectLaunch = deps.inspectLaunchImpl || inspectDesktopCenterLaunchCredentials;
+    const syncLaunch = deps.syncLaunchImpl || syncDesktopCenterLaunchCredentials;
+    const launchOptions = {
+        mode,
+        home,
+        ...(input.launchctlBin ? { launchctlBin: input.launchctlBin } : {}),
+        ...(input.platform ? { platform: input.platform } : {}),
+        ...(input.forceLaunchctl ? { force: true } : {}),
+        ...(input.runProcessImpl ? { runProcessImpl: input.runProcessImpl } : {})
+    };
+    const launchBefore = await inspectLaunch(launchOptions);
+    const launchRepair = input.fix === true && launchBefore.ok === false
+        ? await syncLaunch({ ...launchOptions, skipPurge: true })
+        : null;
+    const launchAfter = launchRepair ? await inspectLaunch(launchOptions) : launchBefore;
+    const warnings = [
+        ...(definedButNotSelected
+            ? ['codex_lb_defined_but_not_selected']
+            : []),
+        ...(staleAmbient ? ['codex_lb_stale_ambient_key'] : []),
+        ...(orphan.orphan_markers.length > 0
+            ? [`codex_lb_orphan_managed_markers:${orphan.orphan_markers.join(',')}`]
+            : [])
+    ];
+    const blockers = [
+        ...(launchAfter.ok === false ? launchAfter.blockers || ['codex_lb_launchd_selection_state_mismatch'] : []),
+        ...(input.fix === true && orphan.changed && orphanRepair.changed !== true
+            ? ['codex_lb_orphan_marker_repair_failed']
+            : [])
+    ];
+    return {
+        schema: 'sks.doctor-codex-lb-divergence.v1',
+        ok: blockers.length === 0,
+        warnings,
+        blockers,
+        operator_actions: [
+            ...(definedButNotSelected
+                ? ['Run `sks codex-lb use-cli` to select the stored provider.']
+                : []),
+            ...(staleAmbient
+                ? ['Remove or update the stale shell export: `unset CODEX_LB_API_KEY`; the canonical key remains in ~/.codex/sks-codex-lb.env.']
+                : []),
+            ...(launchAfter.operator_actions || [])
+        ],
+        ambient_key: {
+            present: Boolean(ambientKey),
+            sha256: ambientHash,
+            matches_canonical: ambientHash && canonicalHash ? ambientHash === canonicalHash : null
+        },
+        canonical_key: {
+            present: Boolean(canonicalKey),
+            sha256: canonicalHash,
+            path: String(status.env_path || codexLbEnvPath(home))
+        },
+        orphan_markers: orphan.orphan_markers,
+        orphan_marker_repair: orphanRepair,
+        launchd: { before: launchBefore, repair: launchRepair, after: launchAfter }
+    };
+}
 export async function run(_command, args = [], deps = {}) {
     const root = await projectRoot();
     if (flag(args, '--search')) {
@@ -102,9 +307,9 @@ export async function run(_command, args = [], deps = {}) {
             : root;
         return withSecretPreservationGuard(guardRoot, 'doctor-fix', async () => (globalOnly
             ? runDoctorGlobalOnlyFix(args, root, deps)
-            : runDoctor(args, root, doctorFix)));
+            : runDoctor(args, root, doctorFix, deps)));
     }
-    return runDoctor(args, root, doctorFix);
+    return runDoctor(args, root, doctorFix, deps);
 }
 export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
     const startedAtMs = Date.now();
@@ -122,7 +327,29 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
     const doctorEnv = deps.env || (deps.home
         ? { ...process.env, HOME: home }
         : process.env);
+    const statusOptions = {
+        home,
+        env: doctorEnv,
+        processEnv: doctorEnv
+    };
+    const preRepairProviderStatus = await codexLbStatusImpl({
+        ...statusOptions,
+        probeToolOutputRecovery: false
+    }).catch(() => null);
+    const codexLbSecretProbeImpl = deps.codexLbSecretProbeImpl || inspectDoctorCodexLbSecretResolution;
+    const codexLbSecretProbe = await codexLbSecretProbeImpl({
+        home,
+        processEnv: doctorEnv,
+        fix: true,
+        forceRetry: flag(args, CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG),
+        baseUrl: preRepairProviderStatus?.base_url || preRepairProviderStatus?.provider_base_url || null,
+        migrationOptions: {
+            ...(deps.codexLbMigrationOptions || {}),
+            ...(!deps.codexLbMigrationOptions && deps.codexLbStatusImpl ? { platform: 'linux' } : {})
+        }
+    });
     const providerStatus = await codexLbStatusImpl({
+        ...statusOptions,
         probeToolOutputRecovery: true,
         allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
     }).catch((err) => ({
@@ -188,6 +415,25 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    const codexLbRoutingTruth = await codexLbRoutingTruthForStatus(providerStatus, { home, remeasure: true });
+    const codexLbRoutingReady = !doctorCodexLbRouteExpected(providerStatus)
+        || codexLbRoutingTruthIsActive(codexLbRoutingTruth);
+    const codexLbDivergence = await inspectDoctorCodexLbDivergence({
+        home,
+        processEnv: doctorEnv,
+        providerStatus,
+        fix: true,
+        ...(deps.codexLbLaunchctlBin ? { launchctlBin: deps.codexLbLaunchctlBin } : {}),
+        ...(deps.codexLbLaunchPlatform ? { platform: deps.codexLbLaunchPlatform } : {}),
+        ...(deps.codexLbLaunchRunProcessImpl ? { runProcessImpl: deps.codexLbLaunchRunProcessImpl } : {})
+    }, deps.codexLbDivergenceDeps || {});
+    const telegramRemote = await inspectTelegramRemote({
+        live: true,
+        fix: true,
+        root,
+        home,
+        env: doctorEnv
+    }, deps);
     const recoveryReady = codexLbRecoveryStatusReady(providerStatus, true);
     const globalSkillsReady = !globalSkills?.error
         && globalSkills?.ok !== false
@@ -202,7 +448,12 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
             ...(!globalFastModeReady ? [`global_fast_mode_repair_failed:${globalFastMode?.error || globalFastMode?.status || 'unknown'}`] : []),
             ...(!openRouterProviderReady ? (openRouterProvider?.blockers || ['openrouter_provider_repair_failed']) : []),
             ...(!menuBarReady ? (menuBar?.blockers || ['sks_menubar_repair_failed']) : []),
-            ...(!recoveryReady ? (providerStatus?.tool_output_recovery?.blockers || ['codex_lb_tool_output_recovery_unverified']) : [])
+            ...(codexLbSecretProbe.ok === false
+                ? (codexLbSecretProbe.legacy_keychain_migration?.blockers || ['codex_lb_secret_resolution_failed'])
+                : []),
+            ...(!recoveryReady ? (providerStatus?.tool_output_recovery?.blockers || ['codex_lb_tool_output_recovery_unverified']) : []),
+            ...(!codexLbRoutingReady ? (codexLbRoutingTruth?.blockers || ['codex_lb_routing_truth_unverified']) : []),
+            ...(codexLbDivergence.blockers || [])
         ].map(String).filter(Boolean))];
     const ok = blockers.length === 0;
     return {
@@ -231,14 +482,23 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         codex_app_fast_mode: globalFastMode,
         openrouter_provider: openRouterProvider,
         sks_menubar: menuBar,
+        telegram_remote: telegramRemote,
         codex_lb: {
             provider_status: providerStatus,
             tool_output_recovery: providerStatus?.tool_output_recovery || null,
-            recovery_ok: recoveryReady
+            recovery_ok: recoveryReady,
+            routing_truth: codexLbRoutingTruth,
+            routing_ok: codexLbRoutingReady,
+            secret_resolution: codexLbSecretProbe.secret_resolution,
+            legacy_keychain_migration: codexLbSecretProbe.legacy_keychain_migration,
+            divergence: codexLbDivergence
         },
         blockers,
         next_actions: [
             ...(recoveryReady ? [] : (providerStatus?.tool_output_recovery?.operator_actions || [])),
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || []),
+            ...(codexLbDivergence.operator_actions || []),
+            ...telegramDoctorOperatorActions(telegramRemote),
             ...(!openRouterProviderReady ? ['Run `sks codex-app set-openrouter-key` to repair the stored-key provider configuration without switching models.'] : []),
             'Run `sks doctor --fix --json` from a specific project directory when project-scoped repair is required.'
         ]
@@ -261,6 +521,15 @@ async function runDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         console.log(`SKS Doctor global repair: ${result.ok ? 'ok' : 'blocked'}`);
         console.log(`Global skills: ${result.skills.global?.error ? 'blocked' : 'reconciled'}`);
         console.log(`SKS menu bar: ${result.sks_menubar?.status || (result.sks_menubar?.ok ? 'ok' : 'blocked')}`);
+        const telegramOutcome = result.telegram_remote?.self_heal_outcome;
+        const telegramAction = telegramOutcome?.attempted
+            ? telegramOutcome.action
+            : result.telegram_remote?.self_heal_action || 'none';
+        console.log(`Telegram Remote: ${result.telegram_remote?.status || 'unknown'} (self-heal ${telegramAction}${telegramOutcome?.attempted ? `, ${telegramOutcome.recovered ? 'recovered' : 'still degraded'}` : ''})`);
+        const telegramCheckedLine = telegramDoctorCheckedLine(result.telegram_remote);
+        if (telegramCheckedLine)
+            console.log(telegramCheckedLine);
+        console.log(`codex-lb key: ${result.codex_lb.secret_resolution.source} (prompt risk ${result.codex_lb.secret_resolution.prompt_risk})`);
         for (const blocker of result.blockers)
             console.log(`- blocker: ${blocker}`);
         for (const action of result.next_actions)
@@ -277,8 +546,203 @@ function codexLbRecoveryStatusReady(status, probeRequired = false) {
         return false;
     if (status.selected === false)
         return true;
+    if (!probeRequired)
+        return true;
     return status.selected === true && status.tool_output_recovery?.ok === true;
 }
+export async function codexLbRoutingTruthForStatus(status, deps = {}) {
+    if (!status)
+        return null;
+    const statusEnvPath = typeof status.env_path === 'string' && status.env_path
+        ? status.env_path
+        : null;
+    const resolvedHome = deps.home
+        ? path.resolve(deps.home)
+        : statusEnvPath
+            ? path.dirname(path.dirname(statusEnvPath))
+            : undefined;
+    const envOptions = {
+        ...(resolvedHome ? { home: resolvedHome } : {}),
+        ...(statusEnvPath ? { envPath: statusEnvPath } : {})
+    };
+    const routeSelected = doctorCodexLbRouteExpected(status);
+    const mode = status.desktop_mode === 'desktop-native-bridge' ? 'bridge' : 'cli-provider';
+    const receiptOptions = {
+        ...(resolvedHome ? { home: resolvedHome } : {}),
+        ...(deps.receiptPath ? { receiptPath: deps.receiptPath } : {}),
+        expectedMode: mode,
+        expectedSelected: routeSelected
+    };
+    const receipt = await readCodexLbRoutingTruthReceipt(receiptOptions).catch(() => null);
+    if (deps.remeasure !== true && receipt?.fresh === true)
+        return receipt;
+    try {
+        const loaded = await loadCodexLbEnv({ ...envOptions, processEnv: {} });
+        const baseUrl = loaded.base_url || status.base_url || null;
+        const configuredHost = publicUrlHost(baseUrl);
+        const authTransport = mode === 'cli-provider'
+            ? 'authorization-bearer'
+            : doctorBridgeRoutingTransport(status, receipt);
+        const contextReceipt = await readCodexLbRoutingTruthReceipt({
+            ...receiptOptions,
+            expectedConfiguredHost: configuredHost,
+            expectedAuthTransport: authTransport
+        }).catch(() => null);
+        if (deps.remeasure !== true && contextReceipt?.fresh === true)
+            return contextReceipt;
+        return measureAndWriteCodexLbRoutingTruth({
+            mode,
+            selected: routeSelected,
+            baseUrl,
+            apiKey: loaded.secret_api_key,
+            authTransport,
+            measure: routeSelected,
+            ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {})
+        }, {
+            ...envOptions,
+            ...(deps.receiptPath ? { receiptPath: deps.receiptPath } : {})
+        });
+    }
+    catch {
+        return measureAndWriteCodexLbRoutingTruth({
+            mode,
+            selected: routeSelected,
+            baseUrl: status.base_url || null,
+            apiKey: null,
+            authTransport: mode === 'cli-provider'
+                ? 'authorization-bearer'
+                : doctorBridgeRoutingTransport(status, receipt),
+            measure: false
+        }, {
+            ...envOptions,
+            ...(deps.receiptPath ? { receiptPath: deps.receiptPath } : {})
+        });
+    }
+}
+function doctorCodexLbRouteExpected(status) {
+    return status?.selected === true || status?.desktop_mode === 'desktop-native-bridge';
+}
+function doctorBridgeRoutingTransport(status, receipt) {
+    if (receipt?.mode === 'bridge'
+        && (receipt.auth_transport === 'authorization-bearer'
+            || receipt.auth_transport === 'x-codex-lb-api-key')) {
+        return receipt.auth_transport;
+    }
+    return status?.gateway_auth_transport === 'authorization-bearer-compat'
+        ? 'authorization-bearer'
+        : 'x-codex-lb-api-key';
+}
+function publicUrlHost(value) {
+    try {
+        return value ? new URL(String(value)).host : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function inspectTelegramRemote(input = {}, deps = {}) {
+    const env = input.env || process.env;
+    const home = path.resolve(input.home || env.HOME || os.homedir());
+    const receiptPath = input.receiptPath || telegramLivenessPath(home);
+    const probeImpl = deps.probeTelegramImpl || probeTelegram;
+    let tokenProvider = deps.telegramTokenProvider;
+    let client = deps.telegramClient;
+    if (input.live && (!tokenProvider || !client)) {
+        const resolveImpl = deps.resolveTelegramBotTokenImpl || resolveTelegramBotToken;
+        let resolvedToken = null;
+        tokenProvider ||= {
+            loadToken: () => {
+                resolvedToken ||= Promise.resolve(resolveImpl({ env })).then((result) => result.token);
+                return resolvedToken;
+            }
+        };
+        client ||= new TelegramClient({ tokenProvider });
+    }
+    const runProbe = () => {
+        if (!input.live)
+            return probeImpl({ receiptPath });
+        if (!client || !tokenProvider)
+            throw new Error('telegram_live_probe_dependencies_missing');
+        return probeImpl({ client, tokenProvider, receiptPath });
+    };
+    const before = await runProbe();
+    const action = telegramSelfHealAction(before);
+    if (!input.fix || action !== 'restart_poll' || !before.token_configured || before.paired_chat_count < 1) {
+        return {
+            ...before,
+            self_heal_action: action,
+            self_heal_outcome: {
+                requested: input.fix === true,
+                attempted: false,
+                action,
+                reason: input.fix !== true
+                    ? 'report_only'
+                    : action !== 'restart_poll'
+                        ? 'action_not_restart_poll'
+                        : 'telegram_not_configured_or_paired'
+            }
+        };
+    }
+    const restartImpl = deps.restartLaunchAgentImpl || restartLaunchAgent;
+    const restart = await restartImpl(sksMenuBarPaths(home, input.root), env).catch((error) => ({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error)
+    }));
+    const maximumReprobes = Math.max(1, Math.min(deps.telegramReprobeAttempts ?? 3, 5));
+    const reprobeDelayMs = Math.max(0, Math.min(deps.telegramReprobeDelayMs ?? 500, 5_000));
+    const sleepImpl = deps.telegramSleepImpl || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let reprobeAttempts = 1;
+    let after = await runProbe();
+    let afterAction = telegramSelfHealAction(after);
+    while (restart?.ok === true && afterAction === 'restart_poll' && reprobeAttempts < maximumReprobes) {
+        await sleepImpl(reprobeDelayMs);
+        after = await runProbe();
+        afterAction = telegramSelfHealAction(after);
+        reprobeAttempts += 1;
+    }
+    return {
+        ...after,
+        self_heal_action: afterAction,
+        self_heal_attempted_action: action,
+        self_heal_before: before,
+        self_heal_outcome: {
+            requested: true,
+            attempted: true,
+            action,
+            after_action: afterAction,
+            restart_ok: restart?.ok === true,
+            reprobe_ok: after.ok,
+            reprobe_attempts: reprobeAttempts,
+            recovered: restart?.ok === true && after.ok && afterAction === 'none',
+            error: restart?.error || null,
+            restart
+        }
+    };
+}
+export function telegramDoctorCheckedLine(probe, indent = '') {
+    if (!probe?.getme_checked_at)
+        return null;
+    return `${indent}checked: ${probe.getme_checked_at} (${probe.getme_latency_ms ?? 'unknown'} ms, ${probe.getme_check_kind || 'receipt'})`;
+}
+function telegramDoctorOperatorActions(probe) {
+    if (!probe || probe.status === 'not_configured')
+        return [];
+    if (probe.self_heal_action === 'restart_poll') {
+        if (probe.self_heal_outcome?.recovered === true)
+            return [];
+        return ['Run `sks menubar restart` to restart the resident Telegram long poller.'];
+    }
+    if (probe.self_heal_action === 'revalidate_token') {
+        return ['Run `sks telegram setup --token-stdin`, then `sks menubar restart`, to revalidate the bot identity.'];
+    }
+    if (probe.self_heal_action === 'operator_remove_webhook') {
+        return ['Remove the Telegram bot webhook through the Bot API, then run `sks menubar restart`; getUpdates and webhooks cannot be active together.'];
+    }
+    if (probe.self_heal_action === 'operator_repair_audit') {
+        return ['Restore owner-only write access to `~/.codex/sks-menubar/logs/telegram-audit.jsonl`, then run `sks menubar restart`.'];
+    }
+    return [];
+}
 async function runDoctorJsonFastPath(args = [], root) {
     const startedAtMs = Date.now();
     const reportFile = readOption(args, '--report-file', null);
@@ -289,7 +753,7 @@ async function runDoctorJsonFastPath(args = [], root) {
         requireActualCodex: false,
         codexBin: codexBin || undefined
     };
-    const [codex, rust, codexConfig, sneakoscopeExists, oauthCallbackPortDiagnostic] = await Promise.all([
+    const [codex, rust, codexConfig, sneakoscopeExists, oauthCallbackPortDiagnostic, codexLbSecretProbe] = await Promise.all([
         codexBin
             ? Promise.resolve({ bin: codexBin, version: 'fixture-or-explicit', available: true })
             : getCodexInfo().catch(() => ({ bin: null, version: null, available: false })),
@@ -301,9 +765,11 @@ async function runDoctorJsonFastPath(args = [], root) {
             blockers: [err?.message || String(err)]
         })),
         exists(`${root}/.sneakoscope`),
-        inspectOAuthCallbackPortConflict()
+        inspectOAuthCallbackPortConflict(),
+        inspectDoctorCodexLbSecretResolution({ processEnv: process.env, fix: false })
     ]);
     const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
+    const telegramRemote = await inspectTelegramRemote();
     const ready = {
         schema: 'sks.doctor-readiness-matrix.v2',
         generated_at: nowIso(),
@@ -340,13 +806,20 @@ async function runDoctorJsonFastPath(args = [], root) {
         deep_diagnostics_skipped: true,
         deep_ok: null,
         not_counted_as_full_doctor: true,
-        next_actions: ['Run sks doctor --full --json for deep diagnostics.'],
+        next_actions: [
+            'Run sks doctor --full --json for deep diagnostics.',
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || []),
+            ...telegramDoctorOperatorActions(telegramRemote)
+        ],
         root,
         fast_path: true,
         no_fix_write_policy: reportFile ? 'report_file_only' : 'no_writes_performed',
         arg_warnings: doctorArgWarnings(args),
         warnings: [...oauthCallbackPortDiagnostic.warnings],
-        operator_actions: oauthCallbackOperatorActions,
+        operator_actions: [
+            ...oauthCallbackOperatorActions,
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || [])
+        ],
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
         oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic,
@@ -371,6 +844,7 @@ async function runDoctorJsonFastPath(args = [], root) {
             blockers: [],
             warnings: ['menubar_install_deferred_to_fix_or_full_doctor']
         },
+        telegram_remote: telegramRemote,
         provider_context: {
             schema: 'sks.provider-context.v1',
             generated_at: nowIso(),
@@ -384,7 +858,13 @@ async function runDoctorJsonFastPath(args = [], root) {
             warnings: ['provider_context_optional_diagnostic_skipped'],
             signals: {}
         },
-        codex_lb: codexLbMetrics(await readCodexLbCircuit(root).catch(() => ({}))),
+        codex_lb: {
+            ...codexLbMetrics(await readCodexLbCircuit(root).catch(() => ({}))),
+            routing_truth: null,
+            routing_measurement_deferred: true,
+            secret_resolution: codexLbSecretProbe.secret_resolution,
+            legacy_keychain_migration: codexLbSecretProbe.legacy_keychain_migration
+        },
         codex_doctor: null,
         pre_repair_codex_doctor: null,
         post_repair_codex_doctor: null,
@@ -452,7 +932,7 @@ async function runDoctorJsonFastPath(args = [], root) {
         process.exitCode = 1;
     return result;
 }
-async function runDoctor(args = [], root, doctorFix) {
+async function runDoctor(args = [], root, doctorFix, deps = {}) {
     const startedAtMs = Date.now();
     const oauthCallbackPortDiagnostic = await inspectOAuthCallbackPortConflict();
     const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
@@ -630,29 +1110,54 @@ async function runDoctor(args = [], root, doctorFix) {
         ? await codexAppIntegrationStatus({ codex }).catch((err) => ({ ok: false, error: err.message }))
         : { ok: false, skipped: true, warnings: ['codex_app_optional_diagnostic_skipped'] };
     const codexLbCircuit = codexLbMetrics(await readCodexLbCircuit(root).catch(() => ({})));
-    const codexLbProviderStatus = deepDiagnostics || doctorFix
-        ? await codexLbStatus({
-            probeToolOutputRecovery: true,
-            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
-        }).catch((err) => ({
-            selected: null,
-            provider_ready: false,
-            recovery_probe_failed: true,
-            tool_output_recovery: {
-                ok: false,
-                status: 'probe_failed',
-                blockers: ['codex_lb_tool_output_recovery_status_probe_failed'],
-                operator_actions: []
-            },
-            error: err?.message || String(err)
-        }))
+    const codexLbPreRepairStatus = doctorFix
+        ? await codexLbStatus({ probeToolOutputRecovery: false }).catch(() => null)
         : null;
+    const codexLbSecretProbe = await inspectDoctorCodexLbSecretResolution({
+        processEnv: process.env,
+        fix: doctorFix,
+        forceRetry: flag(args, CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG),
+        baseUrl: codexLbPreRepairStatus?.base_url || codexLbPreRepairStatus?.provider_base_url || null
+    });
+    const codexLbProviderStatus = await codexLbStatus({
+        probeToolOutputRecovery: deepDiagnostics || doctorFix,
+        allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
+    }).catch((err) => ({
+        selected: null,
+        provider_ready: false,
+        recovery_probe_failed: deepDiagnostics || doctorFix,
+        tool_output_recovery: {
+            ok: false,
+            status: deepDiagnostics || doctorFix ? 'probe_failed' : 'not_checked',
+            blockers: deepDiagnostics || doctorFix ? ['codex_lb_tool_output_recovery_status_probe_failed'] : [],
+            operator_actions: []
+        },
+        error: err?.message || String(err)
+    }));
     const codexLbRecoveryReady = codexLbRecoveryStatusReady(codexLbProviderStatus, deepDiagnostics || doctorFix);
+    const codexLbRoutingTruth = await codexLbRoutingTruthForStatus(codexLbProviderStatus, {
+        remeasure: deepDiagnostics || doctorFix
+    });
+    const codexLbRoutingReady = !doctorCodexLbRouteExpected(codexLbProviderStatus)
+        || codexLbRoutingTruthIsActive(codexLbRoutingTruth);
+    const codexLbDivergence = await inspectDoctorCodexLbDivergence({
+        processEnv: process.env,
+        providerStatus: codexLbProviderStatus,
+        fix: doctorFix,
+        ...(deps.codexLbLaunchctlBin ? { launchctlBin: deps.codexLbLaunchctlBin } : {}),
+        ...(deps.codexLbLaunchPlatform ? { platform: deps.codexLbLaunchPlatform } : {}),
+        ...(deps.codexLbLaunchRunProcessImpl ? { runProcessImpl: deps.codexLbLaunchRunProcessImpl } : {})
+    }, deps.codexLbDivergenceDeps || {});
     const codexLb = {
         ...codexLbCircuit,
         provider_status: codexLbProviderStatus,
         tool_output_recovery: codexLbProviderStatus?.tool_output_recovery || null,
-        recovery_ok: codexLbRecoveryReady
+        recovery_ok: codexLbRecoveryReady,
+        routing_truth: codexLbRoutingTruth,
+        routing_ok: codexLbRoutingReady,
+        secret_resolution: codexLbSecretProbe.secret_resolution,
+        legacy_keychain_migration: codexLbSecretProbe.legacy_keychain_migration,
+        divergence: codexLbDivergence
     };
     const providerContext = deepDiagnostics
         ? await resolveProviderContext({ root, route: '$Doctor', serviceTier: process.env.SKS_SERVICE_TIER || 'fast' }).catch((err) => ({
@@ -756,6 +1261,12 @@ async function runDoctor(args = [], root, doctorFix) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    const telegramRemote = await inspectTelegramRemote({
+        live: deepDiagnostics || doctorFix,
+        fix: doctorFix,
+        root,
+        env: process.env
+    }, deps);
     const zellijRepair = shouldRunZellijRepair
         ? await runDoctorZellijRepair({ root, args, doctorFix }).catch((err) => ({
             schema: 'sks.zellij-self-heal.v1',
@@ -968,14 +1479,34 @@ async function runDoctor(args = [], root, doctorFix) {
                         rollback_evidence: sksMenuBar?.launch_agent_path || sksMenuBar?.report_path || 'sks_menubar_optional_no_core_mutation'
                     }),
                     postcheck: async () => {
-                        const status = await inspectSksMenuBarStatus({ root }).catch((err) => ({
+                        const inspectMenuBarStatusImpl = deps.inspectSksMenuBarStatusImpl || inspectSksMenuBarStatus;
+                        const status = await inspectMenuBarStatusImpl({ root }).catch((err) => ({
                             ok: false,
                             launchd: { ok: false, state: null, pid: null, error: err?.message || String(err) },
                             action_target: { ok: false, smoke_code: null, smoke_output: null },
                             blockers: [err?.message || String(err)],
                             warnings: []
                         }));
-                        return buildSksMenuBarDoctorPostcheck(status);
+                        const launchdRepair = await rebootstrapSksMenuBarLaunchdForDoctorFix({
+                            fix: doctorFix,
+                            root,
+                            env: process.env,
+                            status
+                        }, {
+                            inspectSksMenuBarStatusImpl: inspectMenuBarStatusImpl,
+                            restartLaunchAgentImpl: deps.restartLaunchAgentImpl
+                        });
+                        const postcheck = buildSksMenuBarDoctorPostcheck(launchdRepair.status);
+                        return launchdRepair.attempted
+                            ? {
+                                ...postcheck,
+                                repaired: launchdRepair.ok,
+                                warnings: [
+                                    ...(postcheck.warnings || []),
+                                    launchdRepair.ok ? 'launchd_rebootstrap_recovered' : 'launchd_rebootstrap_failed'
+                                ]
+                            }
+                            : postcheck;
                     }
                 },
                 {
@@ -1284,6 +1815,7 @@ async function runDoctor(args = [], root, doctorFix) {
         repair: configRepair,
         codex_app_ui: codexAppUi,
         sks_menubar: sksMenuBar,
+        telegram_remote: telegramRemote,
         codex_0138_doctor: codex0138Doctor,
         codex_plugin_inventory: pluginInventory?.report || null,
         codex_plugin_app_template_policy: pluginPolicy,
@@ -1295,7 +1827,9 @@ async function runDoctor(args = [], root, doctorFix) {
             ...(zellijRepair && !zellijRepair.ok && zellijRepair.command ? [`Run: ${zellijRepair.command}`] : []),
             ...(codexStartupRepair.manual_actions || []),
             ...(codexConfigSyntaxRepair?.manual_actions || []),
-            ...(pluginPolicy?.doctor_warnings || [])
+            ...(pluginPolicy?.doctor_warnings || []),
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || []),
+            ...telegramDoctorOperatorActions(telegramRemote)
         ]
     };
     let ready = await writeDoctorReadinessMatrix(root, doctorReadinessInput);
@@ -1316,6 +1850,7 @@ async function runDoctor(args = [], root, doctorFix) {
             && readinessBlockers.every(isMigrationUserOwnedProjectConfigBlocker);
         const receiptBlockers = preservedUserOwnedConfig ? [] : readinessBlockers;
         const migrationWarnings = [
+            ...(commandAliasCleanup?.warnings || []),
             ...(doctorNativeCapabilityRepair?.optional_warnings || []),
             ...(doctorFixPostcheck?.optional_warnings || []),
             ...(preservedUserOwnedConfig
@@ -1371,7 +1906,10 @@ async function runDoctor(args = [], root, doctorFix) {
         && agentRoleConfigRepair.ok !== false
         && openRouterProviderRepair.ok !== false
         && (officialSubagentConfig.blockers || []).length === 0
-        && codexLbRecoveryReady;
+        && codexLbSecretProbe.ok !== false
+        && codexLbDivergence.ok !== false
+        && codexLbRecoveryReady
+        && codexLbRoutingReady;
     const result = {
         schema: 'sks.doctor-status.v3',
         elapsed_ms: Date.now() - startedAtMs,
@@ -1386,8 +1924,12 @@ async function runDoctor(args = [], root, doctorFix) {
         not_counted_as_full_doctor: !deepDiagnostics,
         root,
         arg_warnings: argWarnings,
-        warnings: [...oauthCallbackPortDiagnostic.warnings],
-        operator_actions: oauthCallbackOperatorActions,
+        warnings: [...oauthCallbackPortDiagnostic.warnings, ...(codexLbDivergence.warnings || [])],
+        operator_actions: [
+            ...oauthCallbackOperatorActions,
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || []),
+            ...(codexLbDivergence.operator_actions || [])
+        ],
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
         oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic,
@@ -1397,6 +1939,7 @@ async function runDoctor(args = [], root, doctorFix) {
         codex_app_ui: codexAppUi,
         openrouter_provider: openRouterProviderRepair,
         sks_menubar: sksMenuBar,
+        telegram_remote: telegramRemote,
         provider_context: providerContext,
         codex_lb: codexLb,
         codex_doctor: authoritativeCodexDoctor,
@@ -1607,6 +2150,8 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  next action: ${codexAppUi.next_action}`);
     console.log('SKS Menu Bar:');
     console.log(`  status: ${sksMenuBar.status || (sksMenuBar.ok ? 'ok' : 'blocked')}`);
+    for (const line of sksMenuBarRunningVersionConsoleLines(sksMenuBar))
+        console.log(line);
     const menubarPhase = doctorFixTransaction?.phases?.find((phase) => phase?.id === 'sks_menubar');
     if (menubarPhase) {
         const menubarSummary = menubarPhase.ok
@@ -1622,6 +2167,21 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  blockers: ${sksMenuBar.blockers.join(', ')}`);
     if (Array.isArray(sksMenuBar.warnings) && sksMenuBar.warnings.length)
         console.log(`  warnings: ${sksMenuBar.warnings.join(', ')}`);
+    console.log('Telegram Remote:');
+    console.log(`  status: ${telegramRemote.status || 'unknown'}`);
+    console.log(`  getMe: ${telegramRemote.bot_identity_valid ? 'verified' : telegramRemote.token_configured ? 'invalid' : 'not configured'}`);
+    console.log(`  audit: ${telegramRemote.audit_healthy ? 'healthy' : 'unavailable'}`);
+    const telegramCheckedLine = telegramDoctorCheckedLine(telegramRemote, '  ');
+    if (telegramCheckedLine)
+        console.log(telegramCheckedLine);
+    console.log(`  long poll: ${telegramRemote.poller?.running ? 'running' : 'stopped'}`);
+    const telegramSelfHealOutcome = telegramRemote.self_heal_outcome;
+    const telegramDisplayedAction = telegramSelfHealOutcome?.attempted
+        ? telegramSelfHealOutcome.action
+        : telegramRemote.self_heal_action;
+    if (telegramDisplayedAction && telegramDisplayedAction !== 'none') {
+        console.log(`  self-heal: ${telegramDisplayedAction}${telegramSelfHealOutcome?.attempted ? ` (${telegramSelfHealOutcome.recovered ? 'recovered' : 'attempted, still degraded'})` : ''}`);
+    }
     console.log(`Provider: ${providerContext.provider || 'unknown'} ${providerContext.service_tier || ''} (${providerContext.source || 'unknown'}, ${providerContext.confidence || 'low'})`);
     const imagegenReady = imagegen.auth_readiness;
     if (imagegenReady) {
@@ -1674,6 +2234,17 @@ async function runDoctor(args = [], root, doctorFix) {
     if (codex0138Doctor?.fixed?.length)
         console.log(`  doctor --fix repaired: ${codex0138Doctor.fixed.join(', ')}`);
     console.log(`codex-lb:  ${codexLb.ok ? 'ok' : `warning ${codexLb.circuit?.state || 'unknown'}`}`);
+    console.log(`  key source: ${codexLb.secret_resolution.source}${codexLb.secret_resolution.path ? ` (${codexLb.secret_resolution.path})` : ''}; prompt risk: ${codexLb.secret_resolution.prompt_risk}`);
+    for (const action of codexLb.legacy_keychain_migration?.operator_actions || [])
+        console.log(`  action: ${action}`);
+    for (const warning of codexLb.divergence?.warnings || [])
+        console.log(`  warning: ${warning}`);
+    for (const action of codexLb.divergence?.operator_actions || [])
+        console.log(`  action: ${action}`);
+    if (codexLb.routing_truth) {
+        const routingTruth = codexLb.routing_truth;
+        console.log(`  routing truth: ${codexLb.routing_ok ? 'verified' : 'blocked'} (${routingTruth.actual_host || routingTruth.configured_host || 'host unavailable'}, ${routingTruth.auth_outcome}, ${routingTruth.latency_ms ?? 'unmeasured'} ms at ${routingTruth.checked_at})`);
+    }
     if (codexLb.tool_output_recovery) {
         const recovery = codexLb.tool_output_recovery;
         console.log(`  interrupted tool-output recovery: ${recovery.ok ? 'ready' : 'blocked'} (${recovery.observed_version || recovery.status}; minimum ${recovery.minimum_version})`);
@@ -2011,6 +2582,95 @@ export function formatCodexDoctorConsoleStatus(report) {
         return 'unavailable';
     return report.disposition || (report.exit_code === 0 ? 'pass' : 'warn');
 }
+export function sksMenuBarRunningVersionConsoleLines(status) {
+    const runningVersion = status?.running_process?.package_version
+        || status?.menubar_version_probe?.running_version
+        || null;
+    const runningPid = status?.running_process?.pid ?? status?.menubar_version_probe?.pid ?? null;
+    if (typeof runningVersion !== 'string' || !runningVersion || !Number.isInteger(runningPid) || runningPid <= 0) {
+        return [];
+    }
+    const expectedVersion = status?.menubar_version_probe?.expected_version
+        || status?.action_target?.expected_version
+        || status?.package_version
+        || null;
+    const installedVersion = status?.installed_version || status?.build_stamp?.package_version || null;
+    return [
+        `  RUNNING: version ${runningVersion} (PID ${runningPid})`,
+        ...(typeof expectedVersion === 'string' && expectedVersion && expectedVersion !== runningVersion
+            ? [`  expected: version ${expectedVersion}`]
+            : []),
+        ...(typeof installedVersion === 'string' && installedVersion && installedVersion !== runningVersion
+            ? [`  installed: version ${installedVersion}`]
+            : [])
+    ];
+}
+export async function rebootstrapSksMenuBarLaunchdForDoctorFix(input, deps = {}) {
+    const env = input.env || process.env;
+    const status = input.status;
+    const expectedVersion = status?.menubar_version_probe?.expected_version
+        || status?.action_target?.expected_version
+        || status?.installed_version
+        || null;
+    const warningOnlyVerifiedProcess = input.fix
+        && !sksMenuBarRestartDeferred(env)
+        && status?.launchd?.checked === true
+        && status?.launchd?.ok === false
+        && Array.isArray(status?.warnings)
+        && status.warnings.includes('launchd_not_running_process_active')
+        && !(Array.isArray(status?.blockers) && status.blockers.includes('launchd_not_running'))
+        && status?.running_process?.ok === true
+        && typeof expectedVersion === 'string'
+        && status.running_process.package_version === expectedVersion;
+    if (!warningOnlyVerifiedProcess) {
+        return { attempted: false, ok: true, status, restart: null };
+    }
+    const paths = sksMenuBarPaths(input.home || env.HOME, input.root);
+    const restartImpl = deps.restartLaunchAgentImpl || restartLaunchAgent;
+    const inspectImpl = deps.inspectSksMenuBarStatusImpl || inspectSksMenuBarStatus;
+    const restart = await restartImpl(paths, env).catch((error) => ({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error)
+    }));
+    if (restart?.ok !== true) {
+        const detail = restart?.error ? `:${restart.error}` : '';
+        return {
+            attempted: true,
+            ok: false,
+            restart,
+            status: {
+                ...status,
+                ok: false,
+                blockers: [...new Set([...(status?.blockers || []), `launchd_rebootstrap_failed${detail}`])]
+            }
+        };
+    }
+    const refreshed = await inspectImpl({
+        root: input.root,
+        ...(input.home ? { home: input.home } : {}),
+        ...(input.env ? { env: input.env } : {})
+    }).catch((error) => ({
+        ...status,
+        ok: false,
+        blockers: [...new Set([
+                ...(status?.blockers || []),
+                `launchd_rebootstrap_status_failed:${error instanceof Error ? error.message : String(error)}`
+            ])]
+    }));
+    if (refreshed?.launchd?.checked !== true || refreshed?.launchd?.ok !== true) {
+        return {
+            attempted: true,
+            ok: false,
+            restart,
+            status: {
+                ...refreshed,
+                ok: false,
+                blockers: [...new Set([...(refreshed?.blockers || []), 'launchd_rebootstrap_not_confirmed'])]
+            }
+        };
+    }
+    return { attempted: true, ok: true, status: refreshed, restart };
+}
 function mergeObservedCodexStartupWarnings(startupRepair, codexDoctor) {
     const text = `${codexDoctor?.stdout_tail || ''}\n${codexDoctor?.stderr_tail || ''}`;
     const manual = new Set(Array.isArray(startupRepair?.manual_actions) ? startupRepair.manual_actions : []);