sneakoscope 8.0.2 → 8.0.3

package/dist/core/codex-app/menubar/status.js

@@ -4,16 +4,16 @@ import path from 'node:path';
 import { exists, PACKAGE_VERSION, readJson, readText, sha256 } from '../../fsx.js';
 import { smokeSksMenuBarAction } from './action-runner.js';
 import { isCodexAppRunningByBundleId, readMenuBarConfig } from './config.js';
-import { inspectLaunchdService, isMenuBarProcessRunning, removeLaunchAgent, restartLaunchAgent } from './launch-agent.js';
+import { inspectLaunchdService, inspectRunningMenuBarProcess, removeLaunchAgent, restartLaunchAgent, waitForRunningMenuBarVersion } from './launch-agent.js';
 import { sksMenuBarPaths } from './paths.js';
 import { inspectInstalledResources } from './resources.js';
 import { inspectMenuBarArtifactSet } from './rollback.js';
 import { inspectSignature } from './signature.js';
 import { cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings } from './migration.js';
+import { inspectProjectMenuBarCanonicalState } from './global-install.js';
 export async function inspectSksMenuBarStatus(opts = {}) {
     const paths = sksMenuBarPaths(opts.home || opts.env?.HOME, opts.root);
     const installed = await exists(paths.executable_path);
-    const running = installed ? await isMenuBarProcessRunning(paths.executable_path, opts.env) : false;
     const actionText = await readText(paths.action_script_path, '');
     const nodeBin = shellAssignment(actionText, 'NODE_BIN');
     const sksEntry = shellAssignment(actionText, 'SKS_ENTRY');
@@ -25,6 +25,23 @@ export async function inspectSksMenuBarStatus(opts = {}) {
     const config = await readMenuBarConfig(paths.config_path);
     const codexRunning = config.codex_bundle_id ? await isCodexAppRunningByBundleId(config.codex_bundle_id, opts.env) : null;
     const launchd = await inspectLaunchdService(opts.env);
+    const runningProcess = await inspectRunningMenuBarProcess(paths, launchd.pid, opts.env);
+    const running = runningProcess.ok;
+    const installedVersion = buildStamp?.package_version || null;
+    const persistedVersionProbe = await readJson(paths.version_probe_path, null);
+    let versionProbe = evaluatePersistedMenuBarVersionProbe({
+        probe: persistedVersionProbe,
+        expectedVersion,
+        runningProcess,
+        persistedPath: paths.version_probe_path
+    });
+    if (!versionProbe.ok
+        && runningProcess.ok
+        && runningProcess.package_version === expectedVersion
+        && (versionProbe.error === 'menubar_version_probe_missing'
+            || versionProbe.error === 'menubar_version_probe_stale')) {
+        versionProbe = await waitForRunningMenuBarVersion(paths, expectedVersion, launchd.pid, opts.env);
+    }
     const legacyVerification = buildStamp?.legacy_v1
         ? await inspectMenuBarArtifactSet({
             appPath: paths.app_path,
@@ -36,15 +53,30 @@ export async function inspectSksMenuBarStatus(opts = {}) {
         : null;
     const signature = legacyVerification?.signature || await inspectSignature(paths.app_path, opts.env);
     const resources = legacyVerification?.resources || await inspectInstalledResources({ resourcesDir: paths.resources_path, buildStamp });
+    const canonicalState = await inspectProjectMenuBarCanonicalState({
+        paths,
+        root: paths.root,
+        ...(opts.env ? { env: opts.env } : {})
+    });
     const blockers = [];
     const warnings = [];
-    const runtime = evaluateMenuBarRuntimeReadiness({ installed, running, launchd });
+    const runtime = evaluateMenuBarRuntimeReadiness({
+        installed,
+        running,
+        verifiedProcessMatchesExpectedVersion: runningProcess.ok
+            && runningProcess.package_version === expectedVersion,
+        launchd
+    });
     if (!installed)
         blockers.push('menubar_app_missing');
     if (runtime.blocker)
         blockers.push(runtime.blocker);
     if (runtime.warning)
         warnings.push(runtime.warning);
+    if (installed && launchd.checked && launchd.ok && !runningProcess.ok)
+        blockers.push('menubar_runtime_identity_unverified');
+    if (installed && launchd.checked && launchd.ok && !versionProbe.ok)
+        blockers.push(versionProbe.error || 'menubar_version_probe_failed');
     if (installed && !actionSmoke.executable)
         blockers.push('action_script_not_executable');
     if (installed && !actionSmoke.ok)
@@ -63,11 +95,21 @@ export async function inspectSksMenuBarStatus(opts = {}) {
         blockers.push('menubar_install_transaction_pending');
     if (await exists(paths.rollback_transaction_path))
         blockers.push('menubar_rollback_transaction_pending');
+    blockers.push(...canonicalState.blockers);
+    if (canonicalState.verified_duplicates.length > 0)
+        blockers.push('menubar_canonical_only_verified_duplicate_present');
+    if (canonicalState.unverified_collisions.length > 0)
+        blockers.push('menubar_canonical_only_unverified_duplicate_present');
+    warnings.push(...canonicalState.warnings);
     if (!config.codex_bundle_id)
         warnings.push('codex_sync_disabled');
     return {
         schema: 'sks.menubar-status.v1', ok: blockers.length === 0, platform: process.platform,
-        installed, running, paths, launchd,
+        installed, running, installed_version: installedVersion, running_process: runningProcess,
+        menubar_version_probe: versionProbe,
+        duplicate_install_candidates: canonicalState.candidate_paths,
+        paths,
+        launchd,
         action_target: {
             node_bin: nodeBin,
             node_exists: nodeBin ? await isExecutable(nodeBin) : false,
@@ -94,10 +136,39 @@ export async function inspectSksMenuBarStatus(opts = {}) {
         next_actions: blockers.length ? defaultNextActions() : ['sks menubar status --json']
     };
 }
+export function evaluatePersistedMenuBarVersionProbe(input) {
+    const base = {
+        schema: 'sks.menubar-version-probe.v1',
+        checked: true,
+        expected_version: input.expectedVersion,
+        running_version: input.runningProcess.package_version,
+        pid: input.runningProcess.pid,
+        generated_at: input.probe?.generated_at || new Date(0).toISOString(),
+        persisted_path: input.persistedPath
+    };
+    if (!input.probe || input.probe.schema !== 'sks.menubar-version-probe.v1') {
+        return { ...base, ok: false, error: 'menubar_version_probe_missing' };
+    }
+    if (!input.runningProcess.ok) {
+        return { ...base, ok: false, error: input.runningProcess.error || 'menubar_runtime_identity_unverified' };
+    }
+    if (input.probe.expected_version !== input.expectedVersion
+        || input.probe.running_version !== input.runningProcess.package_version
+        || input.probe.pid !== input.runningProcess.pid) {
+        return { ...base, ok: false, error: 'menubar_version_probe_stale' };
+    }
+    if (input.runningProcess.package_version !== input.expectedVersion) {
+        return { ...base, ok: false, error: 'menubar_running_version_mismatch' };
+    }
+    return { ...base, generated_at: input.probe.generated_at, ok: true, error: null };
+}
 export function evaluateMenuBarRuntimeReadiness(input) {
     if (!input.installed || !input.launchd.checked || input.launchd.ok) {
         return { blocker: null, warning: null };
     }
+    if (input.running && input.verifiedProcessMatchesExpectedVersion === true) {
+        return { blocker: null, warning: 'launchd_not_running_process_active' };
+    }
     return {
         blocker: 'launchd_not_running',
         warning: input.running ? 'launchd_not_running_process_active' : null

package/dist/core/codex-control/codex-0139-image-path-real-probe.js

@@ -4,6 +4,7 @@ import { buildCodexExecArgs, findCodexBinary, runCodexExec } from '../codex-adap
 import { ensureDir, runProcess, writeBinaryAtomic } from '../fsx.js';
 import { buildImageArtifactPathContract } from '../image/image-artifact-path-contract.js';
 import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+import { prepareCodexAppServerRuntimeEnv } from './codex-app-server-runtime-env.js';
 const ONE_BY_ONE_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR4nGP4//8/AAX+Av4N70a4AAAAAElFTkSuQmCC', 'base64');
 export async function runCodex0139ImageReferencedPathRealProbe(input) {
     const started = Date.now();
@@ -55,6 +56,7 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
     ].join(' ');
     const extraArgs = ['-c', 'mcp_servers={}', '--image', inputB, '--skip-git-repo-check', '--ephemeral'];
     const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs });
+    const runtimeEnv = await prepareCodexAppServerRuntimeEnv({ env: input.env || process.env });
     const result = await runCodexExec({
         root: tempDir,
         recoveryRoot: input.root,
@@ -65,7 +67,7 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
         timeoutMs: input.timeoutMs || 60000,
         maxBufferBytes: 512 * 1024,
         codexBin,
-        env: input.env || process.env,
+        env: runtimeEnv,
         ...(typeof input.recoveryFetch === 'function' ? { recoveryFetch: input.recoveryFetch } : {}),
         ...(typeof input.runProcessImpl === 'function' ? { runProcessImpl: input.runProcessImpl } : {})
     }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));

package/dist/core/codex-control/codex-0139-web-search-probe.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { buildCodexExecArgs, findCodexBinary, runCodexExec } from '../codex-adapter.js';
 import { ensureDir, runProcess, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+import { prepareCodexAppServerRuntimeEnv } from './codex-app-server-runtime-env.js';
 export async function runCodex0139WebSearchRealProbe(input) {
     const started = Date.now();
     if (!input.allowNetwork) {
@@ -18,6 +19,7 @@ export async function runCodex0139WebSearchRealProbe(input) {
     const outputFile = path.join(tempDir, 'last-message.txt');
     const prompt = 'In code mode, use standalone web search to find the title of https://example.com. Return JSON {"used_web_search":true,"answer":"...","sources":[...]}.';
     const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs: ['-c', 'mcp_servers={}'] });
+    const runtimeEnv = await prepareCodexAppServerRuntimeEnv({ env: input.env || process.env });
     const result = await runCodexExec({
         root: tempDir,
         recoveryRoot: input.root,
@@ -30,7 +32,7 @@ export async function runCodex0139WebSearchRealProbe(input) {
         stdoutFile: path.join(tempDir, 'codex.stdout.log'),
         stderrFile: path.join(tempDir, 'codex.stderr.log'),
         codexBin,
-        env: input.env || process.env,
+        env: runtimeEnv,
         ...(typeof input.recoveryFetch === 'function' ? { recoveryFetch: input.recoveryFetch } : {}),
         ...(typeof input.runProcessImpl === 'function' ? { runProcessImpl: input.runProcessImpl } : {})
     }).catch((err) => ({

package/dist/core/codex-control/codex-app-server-runtime-env.js

@@ -7,12 +7,21 @@ export const CODEX_APP_SERVER_PROVIDER_CREDENTIALS_UNAVAILABLE = 'codex_app_serv
 export const CODEX_APP_SERVER_CONFIG_READ_FAILED = 'codex_app_server_config_read_failed';
 export class CodexAppServerRuntimeEnvError extends Error {
     code;
-    constructor(code) {
-        super(code);
+    operatorActions;
+    constructor(code, operatorActions = []) {
+        super(operatorActions.length > 0 ? `${code}: ${operatorActions.join(' ')}` : code);
         this.code = code;
+        this.operatorActions = operatorActions;
         this.name = 'CodexAppServerRuntimeEnvError';
     }
 }
+export function codexAppServerProviderCredentialGuidance(home) {
+    return [
+        `Store the key in ${path.join(home, '.codex', 'sks-codex-lb.env')} (owner-only mode 0600).`,
+        'Run: sks codex-lb setup --host <domain> --api-key-stdin --yes',
+        'Alternatively, provide CODEX_LB_API_KEY in the launching environment.'
+    ];
+}
 export function codexAppServerExecutablePath(input) {
     const home = path.resolve(input.home || process.env.HOME || os.homedir());
     const candidates = [
@@ -75,10 +84,10 @@ export async function prepareCodexAppServerRuntimeEnv(input = {}) {
         });
     }
     catch {
-        throw new CodexAppServerRuntimeEnvError(CODEX_APP_SERVER_PROVIDER_CREDENTIALS_UNAVAILABLE);
+        throw new CodexAppServerRuntimeEnvError(CODEX_APP_SERVER_PROVIDER_CREDENTIALS_UNAVAILABLE, codexAppServerProviderCredentialGuidance(home));
     }
     if (!loaded?.configured || !loaded.secret_api_key || !loaded.base_url) {
-        throw new CodexAppServerRuntimeEnvError(CODEX_APP_SERVER_PROVIDER_CREDENTIALS_UNAVAILABLE);
+        throw new CodexAppServerRuntimeEnvError(CODEX_APP_SERVER_PROVIDER_CREDENTIALS_UNAVAILABLE, codexAppServerProviderCredentialGuidance(home));
     }
     env.CODEX_LB_API_KEY = loaded.secret_api_key;
     env.CODEX_LB_BASE_URL = loaded.base_url;

package/dist/core/codex-control/codex-app-server-v2-client.js

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { nowIso, PACKAGE_VERSION } from '../fsx.js';
 import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
+import { prepareCodexAppServerRuntimeEnv } from './codex-app-server-runtime-env.js';
 export class CodexAppServerRequestError extends Error {
     method;
     kind;
@@ -333,13 +334,12 @@ export async function createCodexAppServerV2Client(options = {}) {
     });
     if (!runtime.identity)
         throw new Error(`Codex runtime not found: ${runtime.blockers.join(',')}`);
-    const clientOptions = { command: runtime.identity.realpath };
+    const runtimeEnv = await prepareCodexAppServerRuntimeEnv({ env: options.env || process.env });
+    const clientOptions = { command: runtime.identity.realpath, env: runtimeEnv };
     if (options.args !== undefined)
         clientOptions.args = options.args;
     if (options.cwd !== undefined)
         clientOptions.cwd = options.cwd;
-    if (options.env !== undefined)
-        clientOptions.env = options.env;
     if (options.timeoutMs !== undefined)
         clientOptions.timeoutMs = options.timeoutMs;
     if (options.maxFrameBytes !== undefined)

package/dist/core/codex-exec-output-schema.js

@@ -4,6 +4,7 @@ import { ensureDir, exists, packageRoot, readJson, runProcess, which } from './f
 import { codexVersionPolicy, compareSemverLike, parseCodexVersionText } from './codex-compat/codex-version-policy.js';
 import { validateJsonSchemaRecursive } from './json-schema-validator.js';
 import { inspectCodexLbCliLaunchRecovery } from './codex-control/codex-lb-launch-recovery.js';
+import { prepareCodexAppServerRuntimeEnv } from './codex-control/codex-app-server-runtime-env.js';
 export async function detectCodexExecOutputSchemaSyntax(opts = {}) {
     const codexBin = opts.codexBin || await which('codex').catch(() => null);
     if (!codexBin) {
@@ -169,7 +170,9 @@ export async function buildCodexExecResumeOutputSchemaArgs(input) {
 }
 export async function runCodexExecResumeWithOutputSchema(input, opts = {}) {
     const root = opts.cwd || packageRoot();
-    const env = opts.env || process.env;
+    const env = await (opts.prepareCodexRuntimeEnvImpl || prepareCodexAppServerRuntimeEnv)({
+        env: opts.env || process.env
+    });
     const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery({
         root,
         env,

package/dist/core/codex-lb/codex-lb-env.js

@@ -1,7 +1,9 @@
 import path from 'node:path';
 import os from 'node:os';
+import fsp from 'node:fs/promises';
 import { exists, readJson, readText } from '../fsx.js';
 import { escapeRegExp } from '../text/regex.js';
+import { PrivateCredentialFileError, readPrivateCredentialFile } from '../security/private-credential-file.js';
 export const CODEX_LB_SECURE_KEYCHAIN_SERVICE = 'com.sneakoscope.codex-lb.api-key.v2';
 export const CODEX_LB_LEGACY_KEYCHAIN_SERVICE = 'sks-codex-lb';
 export function codexLbEnvPath(home = process.env.HOME || os.homedir()) {
@@ -158,15 +160,13 @@ export async function loadCodexLbEnv(opts = {}) {
     if (opts.allowProjectSecrets)
         sourcePriority.push('project-local');
     const processEnv = pickEnv(opts.processEnv || process.env);
-    const envFile = await readEnvFile(envPaths[0]);
-    const projectLocal = opts.allowProjectSecrets ? await readEnvFile(path.join(opts.root || process.cwd(), '.env')) : {};
+    const envFile = await readEnvFile(envPaths[0], { privateFile: true });
+    const projectLocal = opts.allowProjectSecrets
+        ? await readEnvFile(path.join(opts.root || process.cwd(), '.env'))
+        : {};
     const metadata = await readCodexLbCredentialMetadata(metadataPath);
-    const keychain = await keychainReadIsNeeded(opts, metadata, [envFile.apiKey, processEnv.apiKey, projectLocal.apiKey])
-        ? await readMacKeychain(opts)
-        : { checked: false, available: false, status: 'skipped_not_needed', apiKey: '' };
     const apiKeyCandidates = [
         { source: 'env-file', apiKey: envFile.apiKey },
-        { source: 'keychain', apiKey: keychain.apiKey },
         { source: 'process.env', apiKey: processEnv.apiKey },
         ...(opts.allowProjectSecrets ? [{ source: 'project-local', apiKey: String(projectLocal.apiKey || '') }] : [])
     ].filter((candidate) => Boolean(candidate.apiKey));
@@ -174,9 +174,7 @@ export async function loadCodexLbEnv(opts = {}) {
         ...candidate,
         sha256: await sha256Full(candidate.apiKey)
     })));
-    const selectedApiKey = metadata.valid
-        ? candidateFingerprints.find((candidate) => candidate.sha256 === metadata.apiKeySha256) || candidateFingerprints[0]
-        : candidateFingerprints[0];
+    const selectedApiKey = candidateFingerprints[0];
     const keySource = selectedApiKey?.source || 'missing';
     const apiKey = selectedApiKey?.apiKey || '';
     const configuredBaseUrl = normalizeCodexLbBaseUrl(envFile.baseUrl || processEnv.baseUrl || projectLocal.baseUrl || '');
@@ -187,20 +185,23 @@ export async function loadCodexLbEnv(opts = {}) {
         apiKeySha256,
         configuredBaseUrl
     });
-    const keychainBlockers = keychain.status === 'keychain_read_failed'
-        ? ['codex_lb_keychain_read_failed']
-        : keychain.status === 'legacy_keychain_migration_required'
-            ? ['codex_lb_legacy_keychain_migration_required']
-            : keychain.status === 'keychain_acl_helper_unavailable'
-                ? ['codex_lb_keychain_acl_helper_unavailable']
-                : [];
+    const resolutionBlockers = [
+        ...envFile.blockers,
+        ...(apiKey ? [] : ['codex_lb_api_key_missing'])
+    ];
     const baseUrl = binding.present && metadata.baseUrl ? metadata.baseUrl : configuredBaseUrl;
-    const apiKeyUsable = Boolean(apiKey) && binding.blockers.length === 0 && keychainBlockers.length === 0;
+    const apiKeyUsable = Boolean(apiKey) && binding.blockers.length === 0 && resolutionBlockers.length === 0;
     const missing = [
         ...(apiKey ? [] : ['CODEX_LB_API_KEY']),
         ...(baseUrl ? [] : ['CODEX_LB_BASE_URL']),
         ...(binding.blockers.length ? ['CODEX_LB_CREDENTIAL_BINDING'] : []),
-        ...(keychainBlockers.length ? ['CODEX_LB_KEYCHAIN'] : [])
+        ...(envFile.blockers.length ? ['CODEX_LB_CREDENTIAL_FILE'] : [])
+    ];
+    const guidance = [
+        ...envFile.guidance,
+        ...(!apiKey
+            ? [`Configure CODEX_LB_API_KEY with \`sks codex-lb setup --host <domain> --api-key-stdin --yes\`, put it in ${envPaths[0]} (mode 0600), or export CODEX_LB_API_KEY.`]
+            : [])
     ];
     return {
         schema: 'sks.codex-lb-env.v1',
@@ -217,32 +218,20 @@ export async function loadCodexLbEnv(opts = {}) {
             fingerprint: apiKeySha256 ? apiKeySha256.slice(0, 16) : null
         },
         secret_api_key: apiKeyUsable ? apiKey : null,
+        blockers: [...new Set([...binding.blockers, ...resolutionBlockers])],
+        guidance: [...new Set(guidance)],
         credential_binding: {
             ...binding,
-            blockers: [...binding.blockers, ...keychainBlockers]
+            blockers: [...new Set([...binding.blockers, ...resolutionBlockers])]
         },
         env_paths: envPaths,
         keychain: {
-            checked: keychain.checked,
-            available: keychain.available,
-            status: keychain.status
+            checked: false,
+            available: false,
+            status: 'not_used'
         }
     };
 }
-async function keychainReadIsNeeded(opts, metadata, nonKeychainKeys) {
-    if (opts.forceKeychainRead === true)
-        return true;
-    const candidates = nonKeychainKeys.map((key) => String(key || '').trim()).filter(Boolean);
-    if (candidates.length === 0)
-        return true;
-    if (!metadata.valid || !metadata.apiKeySha256)
-        return false;
-    for (const candidate of candidates) {
-        if ((await sha256Full(candidate)) === metadata.apiKeySha256)
-            return false;
-    }
-    return true;
-}
 async function readCodexLbCredentialMetadata(file) {
     if (!(await exists(file)))
         return { present: false, valid: false, baseUrl: '', apiKeySha256: '' };
@@ -322,44 +311,46 @@ function evaluateCodexLbCredentialBinding(input) {
         blockers: []
     };
 }
-export async function writeCodexLbKeychain(apiKey, opts = {}) {
-    const key = String(apiKey || '').trim();
-    if (!key)
-        return { ok: false, status: 'missing_api_key' };
-    if (process.platform !== 'darwin' && !opts.forceMacos)
-        return { ok: false, status: 'not_macos' };
-    const account = opts.account || process.env.USER || 'sks';
-    const service = opts.service || CODEX_LB_SECURE_KEYCHAIN_SERVICE;
-    const legacyService = opts.legacyService === false
-        ? ''
-        : opts.legacyService || (opts.service ? '' : CODEX_LB_LEGACY_KEYCHAIN_SERVICE);
-    return {
-        ok: false,
-        status: 'keychain_acl_helper_unavailable',
-        account,
-        service,
-        legacy_service: legacyService || null,
-        keychain_state_verified: true,
-        keychain_state_status: 'unchanged',
-        timed_out: false,
-        error: 'Dedicated signed Keychain helper unavailable; use ~/.codex/sks-codex-lb.env (mode 0600).'
-    };
-}
-async function readMacKeychain(opts = {}) {
-    if (process.platform !== 'darwin' && !opts.forceMacos)
-        return { checked: false, available: false, status: 'not_macos', apiKey: '' };
-    return {
-        checked: false,
-        available: false,
-        status: 'keychain_acl_helper_unavailable',
-        apiKey: ''
-    };
-}
-async function readEnvFile(file) {
-    const text = await readText(file, '');
+async function readEnvFile(file, opts = {}) {
+    let text = '';
+    const blockers = [];
+    const guidance = [];
+    if (opts.privateFile) {
+        let pathExists = false;
+        try {
+            await fsp.lstat(file);
+            pathExists = true;
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT') {
+                blockers.push('codex_lb_env_file_read_failed');
+                guidance.push(`Replace the unreadable credential file at ${file} with \`sks codex-lb setup --host <domain> --api-key-stdin --yes\`.`);
+            }
+        }
+        if (!pathExists) {
+            return { apiKey: '', baseUrl: '', blockers, guidance };
+        }
+        try {
+            text = (await readPrivateCredentialFile(path.dirname(file), file, 'codex_lb_env_file')).bytes.toString('utf8');
+        }
+        catch (error) {
+            if (!(error instanceof PrivateCredentialFileError) || error.code !== 'missing') {
+                const code = error instanceof PrivateCredentialFileError ? error.code : 'read_failed';
+                blockers.push(`codex_lb_env_file_${code}`);
+                guidance.push(code === 'mode_not_0600'
+                    ? `Run \`chmod 600 ${file}\` or \`sks doctor --fix\`, then retry.`
+                    : `Replace the unsafe credential file at ${file} with \`sks codex-lb setup --host <domain> --api-key-stdin --yes\`.`);
+            }
+        }
+    }
+    else {
+        text = await readText(file, '');
+    }
     return {
         apiKey: parseShellEnvValue(text, 'CODEX_LB_API_KEY'),
-        baseUrl: parseShellEnvValue(text, 'CODEX_LB_BASE_URL')
+        baseUrl: parseShellEnvValue(text, 'CODEX_LB_BASE_URL'),
+        blockers,
+        guidance
     };
 }
 function pickEnv(env) {

package/dist/core/codex-lb/codex-lb-setup.js

@@ -63,7 +63,9 @@ export function buildCodexLbSetupPlan(answers, opts = {}) {
         actions.push({
             type: 'write_cli_provider',
             target: configPath,
-            effect: 'write an unselected CLI-only codex-lb provider using CODEX_LB_API_KEY without changing Desktop OAuth'
+            effect: answers.use_as_default_provider === true
+                ? 'atomically write and select the codex-lb provider using CODEX_LB_API_KEY without changing auth.json'
+                : 'write an unselected CLI-only codex-lb provider using CODEX_LB_API_KEY without changing Desktop OAuth'
         });
     }
     if (answers.write_env_file) {
@@ -77,7 +79,18 @@ export function buildCodexLbSetupPlan(answers, opts = {}) {
         });
     }
     if (answers.sync_launchctl) {
-        actions.push({ type: 'sync_launchctl', target: 'macOS launchctl user environment', effect: 'sync non-secret CODEX_LB_BASE_URL only and remove API-key launchd env', command: 'launchctl setenv CODEX_LB_BASE_URL ...; launchctl unsetenv CODEX_LB_API_KEY OPENROUTER_API_KEY' });
+        const cliProviderSelected = desktopMode === 'cli-provider'
+            && answers.use_as_default_provider === true;
+        actions.push({
+            type: 'sync_launchctl',
+            target: 'macOS launchctl user environment',
+            effect: cliProviderSelected
+                ? 'set CODEX_LB_API_KEY and CODEX_LB_BASE_URL from the canonical owner-only env file for selected CLI-provider mode'
+                : 'remove CODEX_LB_API_KEY outside selected CLI-provider mode and reconcile the non-secret base URL for the chosen mode',
+            command: cliProviderSelected
+                ? 'launchctl setenv CODEX_LB_API_KEY <canonical-env-file-value>; launchctl setenv CODEX_LB_BASE_URL ...; launchctl unsetenv OPENROUTER_API_KEY'
+                : 'launchctl unsetenv CODEX_LB_API_KEY OPENROUTER_API_KEY; reconcile CODEX_LB_BASE_URL for the chosen mode'
+        });
     }
     if (answers.install_shell_profile !== 'skip') {
         actions.push({ type: 'install_shell_profile_snippet', target: profileTargets(home, answers.install_shell_profile).join(', '), effect: `install managed shell snippet for ${answers.install_shell_profile}` });