sneakoscope 8.0.2 → 8.0.4

package/dist/cli/command-registry.js

@@ -157,6 +157,7 @@ const COMMAND_DEFINITIONS = {
         activeRoutePolicy: 'always'
     }),
     root: readOnly(entry('stable', 'Show active SKS root', 'dist/commands/root.js', directCommand(() => import('../commands/root.js'), 'dist/commands/root.js'))),
+    install: skipMigrationGate(entry('stable', 'Install the exact packaged SKS version globally and verify the resolved CLI', 'dist/core/commands/install-package-command.js', argsCommand(() => import('../core/commands/install-package-command.js'), 'installPackageCommand', 'dist/core/commands/install-package-command.js'))),
     update: skipMigrationGate(entry('stable', 'Inspect, review, apply, or roll back the global SKS update', 'dist/core/commands/basic-cli.js', subcommand(() => import(basicModule), 'updateCommand', 'dist/core/commands/basic-cli.js', 'now'))),
     uninstall: entry('stable', 'Uninstall SKS global skills, hooks, config, menu bar, and optional project residue', 'dist/core/commands/uninstall-command.js', argsCommand(() => import('../core/commands/uninstall-command.js'), 'uninstallCommand', 'dist/core/commands/uninstall-command.js'), {
         skipMigrationGate: true,
@@ -165,6 +166,7 @@ const COMMAND_DEFINITIONS = {
         activeRoutePolicy: 'always'
     }),
     'update-check': readOnly(entry('stable', 'Show the shared SKS, Codex CLI, and Menu Bar update status', 'dist/core/commands/basic-cli.js', basicArgs('updateCheckCommand'))),
+    config: skipMigrationGate(entry('stable', 'Adopt project Codex config into SKS management', 'dist/core/config-adopt/index.js', subcommand(() => import('../core/config-adopt/index.js'), 'configCommand', 'dist/core/config-adopt/index.js', 'adopt'))),
     mcp: skipMigrationGate(entry('beta', 'Manage scoped Codex MCP configuration', 'dist/core/commands/mcp-config-command.js', argsCommand(() => import('../core/commands/mcp-config-command.js'), 'mcpConfigCommand', 'dist/core/commands/mcp-config-command.js'))),
     wizard: entry('stable', 'Open setup wizard help', 'dist/core/commands/basic-cli.js', basicNoArgs('quickstartCommand')),
     usage: readOnly(entry('stable', 'Show focused usage topic', 'dist/core/commands/basic-cli.js', basicArgs('usageCommand'))),
@@ -185,13 +187,8 @@ const COMMAND_DEFINITIONS = {
     'codex-lb': skipMigrationGate(entry('beta', 'Inspect codex-lb status and circuit health', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js'))),
     menubar: activeRouteDiagnostic(entry('beta', 'Inspect/install/restart/uninstall SKS menu bar', 'dist/core/commands/menubar-command.js', subcommand(() => import('../core/commands/menubar-command.js'), 'menubarCommand', 'dist/core/commands/menubar-command.js', 'status'))),
     remote: entry('beta', 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', 'dist/core/commands/remote-command.js', argsCommand(() => import('../core/commands/remote-command.js'), 'remoteCommand', 'dist/core/commands/remote-command.js')),
+    telegram: skipMigrationGate(entry('beta', 'Pair and inspect the Telegram remote-control transport', 'dist/core/commands/telegram-command.js', argsCommand(() => import('../core/commands/telegram-command.js'), 'telegramCommand', 'dist/core/commands/telegram-command.js'))),
     hooks: skipMigrationGate(entry('beta', 'Explain and inspect Codex hooks', 'dist/commands/hooks.js', directCommand(() => import('../commands/hooks.js'), 'dist/commands/hooks.js'))),
-    'zellij-lane': entry('beta', 'Render a Zellij lane frame for SKS sessions', 'dist/commands/zellij-lane.js', directCommand(() => import('../commands/zellij-lane.js'), 'dist/commands/zellij-lane.js')),
-    'zellij-slot-pane': entry('beta', 'Render a compact Zellij worker slot pane', 'dist/commands/zellij-slot-pane.js', directCommand(() => import('../commands/zellij-slot-pane.js'), 'dist/commands/zellij-slot-pane.js')),
-    'zellij-monitor-pane': skipMigrationGate(readOnly(entry('beta', 'Render the live Zellij MAD/Naruto monitor pane', 'dist/commands/zellij-monitor-pane.js', directCommand(() => import('../commands/zellij-monitor-pane.js'), 'dist/commands/zellij-monitor-pane.js')))),
-    'zellij-viewport-pane': skipMigrationGate(readOnly(entry('beta', 'Render a dynamically bound Zellij worker viewport pane', 'dist/commands/zellij-viewport-pane.js', directCommand(() => import('../commands/zellij-viewport-pane.js'), 'dist/commands/zellij-viewport-pane.js')))),
-    'zellij-slot-column-anchor': entry('beta', 'Render the compact SLOTS anchor pane for first-slot-down Zellij stacks', 'dist/commands/zellij-slot-column-anchor.js', directCommand(() => import('../commands/zellij-slot-column-anchor.js'), 'dist/commands/zellij-slot-column-anchor.js')),
-    zellij: activeRouteDiagnostic(entry('beta', 'Inspect Zellij runtime status and explain repair (no auto-install)', 'dist/commands/zellij.js', directCommand(() => import('../commands/zellij.js'), 'dist/commands/zellij.js'))),
     'mad-sks': routeStateMutator(entry('beta', 'MAD-SKS scoped permission modifier + SQL-plane execution', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')), ['mad-sks-gate.json']),
     'auto-review': entry('beta', 'Manage auto-review profile', 'dist/commands/auto-review.js', directCommand(() => import('../commands/auto-review.js'), 'dist/commands/auto-review.js')),
     'dollar-commands': entry('stable', 'List Codex App dollar commands', 'dist/core/commands/basic-cli.js', basicArgs('dollarCommandsCommand')),
@@ -260,6 +257,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     check: { risk: 'R1', latency: 'long' },
     'commit-and-push': { risk: 'R3' },
     'computer-use': { latency: 'long' },
+    config: { risk: 'R2', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     dfix: { latency: 'long' },
     eval: { latency: 'long' },
     gates: {
@@ -267,6 +265,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     },
     harness: { latency: 'long' },
     'image-ux-review': { latency: 'long' },
+    install: { risk: 'R2', latency: 'long' },
     loop: { latency: 'long' },
     'mad-sks': { risk: 'R3', latency: 'long' },
     mcp: { risk: 'R2', latency: 'long', supportsJson: true, inputProfile: 'json-only' },
@@ -307,6 +306,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
+    telegram: { risk: 'R2', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     trust: {
         risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },

package/dist/cli/feature-commands.js

@@ -55,14 +55,14 @@ export async function featuresCommand(sub = 'list', args = []) {
     }
     if (action === 'complete') {
         const report = await writeAllFeatureCompletionReport({ root });
+        if (!report.ok)
+            process.exitCode = report.status === 'contract_covered_unverified' ? 2 : 1;
         if (flag(args, '--json'))
             console.log(JSON.stringify(report, null, 2));
         else {
             console.log(`All feature completion: ${report.status}`);
             console.log(`Report: ${path.relative(root, report.files.json)}`);
         }
-        if (!report.ok)
-            process.exitCode = 1;
         return;
     }
     console.error('Usage: sks features list|check|inventory|complete [--json] [--write-docs]');
@@ -73,12 +73,14 @@ export async function allFeaturesCommand(sub = 'selftest', args = []) {
     if (action === 'complete' || action === 'completion') {
         const root = await projectRoot();
         const report = await writeAllFeatureCompletionReport({ root });
-        if (flag(args, '--json'))
-            return console.log(JSON.stringify(report, null, 2));
-        console.log(`All feature completion: ${report.status}`);
-        console.log(`Report: ${path.relative(root, report.files.json)}`);
         if (!report.ok)
-            process.exitCode = 1;
+            process.exitCode = report.status === 'contract_covered_unverified' ? 2 : 1;
+        if (flag(args, '--json'))
+            console.log(JSON.stringify(report, null, 2));
+        else {
+            console.log(`All feature completion: ${report.status}`);
+            console.log(`Report: ${path.relative(root, report.files.json)}`);
+        }
         return;
     }
     if (action !== 'selftest') {

package/dist/cli/install-helpers-codex-lb-chain.js

@@ -172,16 +172,19 @@ function codexLbServiceTierEvidence(...responses) {
         fast_actual: actual === CODEX_LB_CANONICAL_FAST_SERVICE_TIER || effective === CODEX_LB_CANONICAL_FAST_SERVICE_TIER
     };
 }
-async function fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs) {
+function codexLbGatewayHeaders(apiKey, authTransport = 'x-codex-lb-api-key') {
+    const credentialHeader = String(authTransport).startsWith('authorization-bearer')
+        ? { authorization: `Bearer ${String(apiKey)}` }
+        : { 'X-Codex-LB-API-Key': String(apiKey) };
+    return { ...credentialHeader, 'content-type': 'application/json' };
+}
+async function fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs, authTransport = 'x-codex-lb-api-key') {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs).unref?.();
     try {
         const response = await fetchImpl(endpoint, {
             method: 'POST',
-            headers: {
-                authorization: `Bearer ${apiKey}`,
-                'content-type': 'application/json'
-            },
+            headers: codexLbGatewayHeaders(apiKey, authTransport),
             body: JSON.stringify(body),
             redirect: 'error',
             signal: controller.signal
@@ -204,6 +207,193 @@ async function fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs
         clearTimeout(timer);
     }
 }
+const CODEX_LB_CONNECT_TEST_MAX_OUTPUT_TOKENS = 32;
+const CODEX_LB_CONNECT_TEST_MAX_RESULT_CHARS = 256;
+const CODEX_LB_CONNECT_TEST_MAX_ERROR_CHARS = 512;
+const CODEX_LB_CONNECT_TEST_TIMEOUT_MS = 15_000;
+function boundedText(value, maxChars) {
+    const text = String(value || '').trim();
+    return text.length <= maxChars ? text : text.slice(0, maxChars);
+}
+function codexLbCompletedResponse(json, events = []) {
+    if (json?.response && typeof json.response === 'object')
+        return json.response;
+    if (json?.data?.response && typeof json.data.response === 'object')
+        return json.data.response;
+    if (json?.data && typeof json.data === 'object')
+        return json.data;
+    if (json && typeof json === 'object')
+        return json;
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event?.type === 'response.completed' && event?.response && typeof event.response === 'object') {
+            return event.response;
+        }
+    }
+    return null;
+}
+function codexLbOutputText(response, events = []) {
+    const parts = [];
+    for (const output of Array.isArray(response?.output) ? response.output : []) {
+        for (const content of Array.isArray(output?.content) ? output.content : []) {
+            if (content?.type === 'output_text' && typeof content.text === 'string' && content.text.trim()) {
+                parts.push(content.text.trim());
+            }
+        }
+    }
+    if (parts.length === 0) {
+        for (const event of events) {
+            if (event?.type === 'response.output_text.done' && typeof event.text === 'string' && event.text.trim()) {
+                parts.push(event.text.trim());
+            }
+        }
+    }
+    return parts.join('\n').trim();
+}
+function boundedCodexLbUsage(usage) {
+    const tokenCount = (value) => Number.isSafeInteger(value) && value >= 0 ? value : null;
+    return {
+        input_tokens: tokenCount(usage?.input_tokens),
+        output_tokens: tokenCount(usage?.output_tokens),
+        total_tokens: tokenCount(usage?.total_tokens),
+        reasoning_tokens: tokenCount(usage?.output_tokens_details?.reasoning_tokens)
+    };
+}
+function codexLbConnectTestFailure(status, extra = {}) {
+    return {
+        schema: 'sks.codex-lb-connect-test.v1',
+        ok: false,
+        status,
+        response_id: null,
+        model: extra.model || null,
+        latency_ms: extra.latency_ms ?? null,
+        usage: extra.usage || null,
+        result: null,
+        result_truncated: false,
+        http_status: extra.http_status ?? null,
+        blockers: Array.isArray(extra.blockers) ? extra.blockers : [status],
+        ...(extra.error ? { error: extra.error } : {})
+    };
+}
+export async function testCodexLbConnection(status = {}, opts = {}) {
+    const providerSelected = status?.selected === true || status?.provider?.selected === true;
+    if (opts.requireSelected === true && !providerSelected) {
+        return codexLbConnectTestFailure('provider_unselected', {
+            blockers: ['codex_lb_provider_not_selected']
+        });
+    }
+    const credentialBindingBlockers = Array.isArray(opts.credentialBindingBlockers)
+        ? opts.credentialBindingBlockers.map((value) => boundedText(value, 128)).filter(Boolean)
+        : [];
+    if (credentialBindingBlockers.length > 0) {
+        return codexLbConnectTestFailure('credential_binding_drift', { blockers: credentialBindingBlockers });
+    }
+    if (status.provider_base_url_matches_credential !== true) {
+        return codexLbConnectTestFailure('provider_base_url_mismatch', {
+            blockers: ['codex_lb_provider_base_url_mismatch']
+        });
+    }
+    if (status.provider_contract_ok !== true) {
+        return codexLbConnectTestFailure('provider_contract_drift', {
+            blockers: ['codex_lb_provider_contract_drift']
+        });
+    }
+    const baseUrl = opts.baseUrl || status.base_url;
+    const endpoint = codexLbResponsesEndpoint(baseUrl);
+    if (!endpoint)
+        return codexLbConnectTestFailure('missing_base_url');
+    const transportBlocker = codexLbBaseUrlSecurityBlocker(baseUrl);
+    if (transportBlocker)
+        return codexLbConnectTestFailure('transport_blocked', { blockers: [transportBlocker] });
+    const env = opts.env || process.env;
+    const home = opts.home || env.HOME || os.homedir();
+    const apiKey = opts.apiKey || parseCodexLbEnvKey(await readText(opts.envPath || status.env_path || codexLbEnvPath(home), ''));
+    if (!apiKey)
+        return codexLbConnectTestFailure('missing_env_key');
+    const model = String(opts.model || env.SKS_CODEX_MODEL || env.CODEX_MODEL || '').trim();
+    if (!model)
+        return codexLbConnectTestFailure('model_unselected');
+    if (model.length > 128)
+        return codexLbConnectTestFailure('model_invalid');
+    const fetchImpl = opts.fetch || globalThis.fetch;
+    if (typeof fetchImpl !== 'function')
+        return codexLbConnectTestFailure('fetch_unavailable', { model });
+    const timeoutMs = Number(opts.timeoutMs || env.SKS_CODEX_LB_CONNECT_TEST_TIMEOUT_MS || CODEX_LB_CONNECT_TEST_TIMEOUT_MS);
+    const body = {
+        model,
+        input: 'Reply OK.',
+        store: false,
+        reasoning: { effort: 'low' },
+        max_output_tokens: CODEX_LB_CONNECT_TEST_MAX_OUTPUT_TOKENS
+    };
+    const nowMs = typeof opts.nowMs === 'function' ? opts.nowMs : Date.now;
+    const startedAt = nowMs();
+    const fetched = await fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs, opts.gatewayAuthTransport);
+    const latencyMs = Math.max(0, Math.round(nowMs() - startedAt));
+    if (!fetched.ok) {
+        const error = redactSecretText(fetched.error_payload?.error?.message
+            || fetched.error_payload?.response?.error?.message
+            || fetched.text
+            || 'codex-lb Responses request failed', [apiKey]);
+        return codexLbConnectTestFailure('request_failed', {
+            model,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            error: boundedText(error, CODEX_LB_CONNECT_TEST_MAX_ERROR_CHARS)
+        });
+    }
+    const response = codexLbCompletedResponse(fetched.json, fetched.events);
+    const responseId = boundedText(codexLbResponseId(response), 128);
+    const responseModel = boundedText(response?.model || model, 128);
+    const usage = boundedCodexLbUsage(response?.usage);
+    if (!responseId) {
+        return codexLbConnectTestFailure('missing_response_id', {
+            model: responseModel,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            usage
+        });
+    }
+    if (response?.error) {
+        return codexLbConnectTestFailure('response_error', {
+            model: responseModel,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            usage,
+            error: boundedText(redactSecretText(response.error?.message || response.error, [apiKey]), CODEX_LB_CONNECT_TEST_MAX_ERROR_CHARS)
+        });
+    }
+    if (response?.status !== 'completed') {
+        return codexLbConnectTestFailure('response_not_completed', {
+            model: responseModel,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            usage
+        });
+    }
+    const outputText = codexLbOutputText(response, fetched.events);
+    if (!outputText) {
+        return codexLbConnectTestFailure('empty_result', {
+            model: responseModel,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            usage
+        });
+    }
+    return {
+        schema: 'sks.codex-lb-connect-test.v1',
+        ok: true,
+        status: 'connected',
+        response_id: responseId,
+        model: responseModel,
+        latency_ms: latencyMs,
+        usage,
+        result: boundedText(outputText, CODEX_LB_CONNECT_TEST_MAX_RESULT_CHARS),
+        result_truncated: outputText.length > CODEX_LB_CONNECT_TEST_MAX_RESULT_CHARS,
+        http_status: fetched.status,
+        blockers: []
+    };
+}
 export async function checkCodexLbResponseChain(status = {}, opts = {}) {
     const env = opts.env || process.env;
     if (!codexLbChainCheckEnabled(env) && !opts.force)
@@ -246,6 +436,7 @@ export async function checkCodexLbResponseChain(status = {}, opts = {}) {
     if (!model)
         return { ok: true, status: 'skipped', skipped: true, reason: 'model_unselected_use_explicit_model_or_codex_catalog' };
     const timeoutMs = Number(opts.timeoutMs || env.SKS_CODEX_LB_CHAIN_CHECK_TIMEOUT_MS || 8000);
+    const gatewayAuthTransport = opts.gatewayAuthTransport || 'x-codex-lb-api-key';
     const serviceTier = opts.fastMode === true || opts.serviceTier === 'fast' || opts.serviceTier === CODEX_LB_CANONICAL_FAST_SERVICE_TIER
         ? CODEX_LB_CANONICAL_FAST_SERVICE_TIER
         : null;
@@ -260,7 +451,7 @@ export async function checkCodexLbResponseChain(status = {}, opts = {}) {
         tool_choice: 'auto',
         reasoning: { effort: 'low' }
     };
-    const first = await fetchCodexLbResponse(fetchImpl, endpoint, apiKey, baseBody, timeoutMs);
+    const first = await fetchCodexLbResponse(fetchImpl, endpoint, apiKey, baseBody, timeoutMs, gatewayAuthTransport);
     if (!first.ok || !first.response_id) {
         return recordCodexLbChainHealth(await writeCodexLbChainCache({
             ok: false,
@@ -273,7 +464,7 @@ export async function checkCodexLbResponseChain(status = {}, opts = {}) {
             error: redactSecretText(first.error_payload?.error?.message || first.error_payload?.response?.error?.message || first.text || 'codex-lb first Responses request failed', [apiKey])
         }, { endpoint, home, opts, env }), opts);
     }
-    const second = await fetchCodexLbResponse(fetchImpl, endpoint, apiKey, { ...baseBody, previous_response_id: first.response_id }, timeoutMs);
+    const second = await fetchCodexLbResponse(fetchImpl, endpoint, apiKey, { ...baseBody, previous_response_id: first.response_id }, timeoutMs, gatewayAuthTransport);
     if (second.ok)
         return recordCodexLbChainHealth(await writeCodexLbChainCache({ ok: true, status: 'chain_ok', endpoint, response_id: first.response_id, chained_response_id: second.response_id || null, http_status: second.status, requested_service_tier: serviceTier, service_tier_evidence: codexLbServiceTierEvidence(first, second) }, { endpoint, home, opts, env }), opts);
     const previousMissing = isPreviousResponseNotFound(second.error_payload || second.json || second.text);

package/dist/cli/install-helpers-codex-lb-config.js

@@ -10,17 +10,46 @@ import { reconcileRetiredSksConfigText } from '../core/auto-review.js';
 import { ensureTrailingNewline, removeTopLevelTomlKeyIfValue, safeWriteCodexConfigToml, upsertTopLevelTomlString, upsertTomlTable } from '../core/codex-runtime/codex-desktop-config-policy.js';
 import { codexLbConfigPath, normalizeCodexLbBaseUrl } from './install-helpers-codex-lb-shared.js';
 import { escapeRegExp } from '../core/text/regex.js';
+import { upsertExplicitCodexProviderMode } from '../core/codex-app/provider-mode.js';
 export const CODEX_LB_DESKTOP_BRIDGE_MARKER = '# sks-codex-lb-managed-desktop-bridge';
 export const CODEX_LB_DESKTOP_COMPAT_MARKER = '# sks-codex-lb-managed-desktop-compat';
 export const CODEX_LB_MODEL_CATALOG_MARKER = '# sks-codex-lb-managed-model-catalog';
-const LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
+export const CODEX_LB_PROVIDER_SELECTION_MARKER = '# sks-codex-lb-managed-provider-selection';
+export const CODEX_LB_OAUTH_SELECTION_MARKER = '# sks-codex-lb-managed-oauth-selection';
+export const LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
+export function removeCodexLbOrphanManagedMarkers(text) {
+    const source = String(text || '');
+    const selectedProvider = topLevelTomlString(source, 'model_provider');
+    const markerTargets = [
+        [CODEX_LB_DESKTOP_BRIDGE_MARKER, Boolean(topLevelTomlString(source, 'openai_base_url'))],
+        [LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER, Boolean(topLevelTomlString(source, 'openai_base_url'))],
+        [CODEX_LB_DESKTOP_COMPAT_MARKER, selectedProvider === 'codex-lb'],
+        [CODEX_LB_MODEL_CATALOG_MARKER, Boolean(topLevelTomlString(source, 'model_catalog_json'))],
+        [CODEX_LB_PROVIDER_SELECTION_MARKER, selectedProvider === 'codex-lb'],
+        [CODEX_LB_OAUTH_SELECTION_MARKER, selectedProvider === 'openai']
+    ];
+    const orphanMarkers = markerTargets
+        .filter(([marker, hasManagedContent]) => topLevelHasLine(source, marker) && !hasManagedContent)
+        .map(([marker]) => marker);
+    let next = source;
+    for (const marker of orphanMarkers)
+        next = removeTopLevelLine(next, marker);
+    return {
+        schema: 'sks.codex-lb-orphan-managed-marker-cleanup.v1',
+        changed: orphanMarkers.length > 0,
+        orphan_markers: orphanMarkers,
+        text: next
+    };
+}
 export function upsertCodexLbNativeDesktopConfig(text, input) {
-    let next = String(text || '');
+    let next = removeCodexLbOrphanManagedMarkers(String(text || '')).text;
     const selectedProvider = topLevelTomlString(next, 'model_provider');
     if (selectedProvider && selectedProvider !== 'openai' && selectedProvider !== 'codex-lb') {
         throw new Error('codex_lb_user_owned_model_provider_conflict');
     }
-    if (selectedProvider === 'codex-lb' && !topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)) {
+    if (selectedProvider === 'codex-lb'
+        && !topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)
+        && !topLevelHasLine(next, CODEX_LB_PROVIDER_SELECTION_MARKER)) {
         throw new Error('codex_lb_legacy_desktop_config_requires_migration');
     }
     if (topLevelHasLine(next, LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER)
@@ -31,12 +60,13 @@ export function upsertCodexLbNativeDesktopConfig(text, input) {
     if (modelCatalog && !topLevelHasLine(next, CODEX_LB_MODEL_CATALOG_MARKER)) {
         throw new Error('codex_lb_user_owned_model_catalog_json_conflict');
     }
-    next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
+    next = removeManagedCodexLbSelection(next);
     next = removeTopLevelLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER);
     next = removeManagedModelCatalogJson(next);
-    next = upsertManagedTopLevelTomlString(next, 'openai_base_url', input.bridgeBaseUrl, CODEX_LB_DESKTOP_BRIDGE_MARKER);
+    next = upsertManagedTopLevelTomlString(next, 'openai_base_url', input.bridgeBaseUrl, CODEX_LB_DESKTOP_BRIDGE_MARKER, [LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER]);
+    next = upsertTopLevelTomlString(next, 'model_provider', 'openai');
     next = upsertTomlTable(next, 'model_providers.codex-lb', cliProviderBlock(input.remoteBaseUrl));
-    return ensureTrailingNewline(next);
+    return ensureTrailingNewline(upsertExplicitCodexProviderMode(next, 'codex-lb'));
 }
 export function upsertCodexLbCompatDesktopConfig(text, input) {
     let next = removeManagedDesktopBridgeRouting(String(text || ''));
@@ -55,19 +85,50 @@ export function upsertCodexLbCompatDesktopConfig(text, input) {
     return ensureTrailingNewline(next);
 }
 export function upsertCodexLbCliProviderConfig(text, input) {
+    const cleaned = removeCodexLbOrphanManagedMarkers(String(text || '')).text;
+    if (topLevelHasLine(cleaned, LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER)) {
+        throw new Error('codex_lb_legacy_desktop_config_requires_migration');
+    }
+    const cliBase = removeCodexLbManagedDesktopConfig(cleaned);
+    const claimedSelection = input.selectGlobally === true
+        && topLevelTomlString(cliBase, 'model_provider') === 'codex-lb'
+        && !topLevelHasLine(cliBase, CODEX_LB_PROVIDER_SELECTION_MARKER)
+        ? addTopLevelMarkerBeforeKey(cliBase, 'model_provider', CODEX_LB_PROVIDER_SELECTION_MARKER)
+        : cliBase;
     let next = input.selectGlobally === true
-        ? upsertTopLevelTomlString(text, 'model_provider', 'codex-lb')
-        : removeTopLevelTomlKeyIfValue(text, 'model_provider', 'codex-lb');
+        ? upsertManagedTopLevelTomlString(removeTopLevelTomlKeyIfValue(removeManagedOAuthSelection(claimedSelection), 'model_provider', 'openai'), 'model_provider', 'codex-lb', CODEX_LB_PROVIDER_SELECTION_MARKER)
+        : removeManagedCodexLbSelection(cliBase);
     next = upsertTomlTable(next, 'model_providers.codex-lb', cliProviderBlock(input.remoteBaseUrl));
     return ensureTrailingNewline(next);
 }
+export function restoreCodexLbOAuthSelectionConfig(text) {
+    let next = removeManagedCodexLbSelection(String(text || ''));
+    next = upsertManagedTopLevelTomlString(next, 'model_provider', 'openai', CODEX_LB_OAUTH_SELECTION_MARKER);
+    return ensureTrailingNewline(upsertExplicitCodexProviderMode(next, 'chatgpt-oauth'));
+}
+export function removeManagedCodexLbSelection(text) {
+    let next = removeTopLevelTomlKeyIfValue(String(text || ''), 'model_provider', 'codex-lb');
+    next = removeTopLevelLine(next, CODEX_LB_PROVIDER_SELECTION_MARKER);
+    return next;
+}
+function removeManagedOAuthSelection(text) {
+    let next = String(text || '');
+    if (topLevelHasLine(next, CODEX_LB_OAUTH_SELECTION_MARKER)) {
+        next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'openai');
+        next = removeTopLevelLine(next, CODEX_LB_OAUTH_SELECTION_MARKER);
+    }
+    return next;
+}
 export function removeCodexLbManagedDesktopConfig(text) {
-    let next = removeManagedDesktopBridgeRouting(String(text || ''));
+    let next = removeManagedDesktopBridgeRouting(removeCodexLbOrphanManagedMarkers(String(text || '')).text);
     if (topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)) {
         next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
         next = removeTopLevelLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER);
     }
     next = removeManagedModelCatalogJson(next);
+    if (topLevelTomlString(next, 'model_provider') === 'codex-lb') {
+        next = restoreCodexLbOAuthSelectionConfig(next);
+    }
     return ensureTrailingNewline(next);
 }
 export function removeManagedModelCatalogJson(text) {
@@ -100,7 +161,7 @@ function cliProviderBlock(remoteBaseUrl) {
         'name = "codex-lb"',
         `base_url = ${JSON.stringify(remoteBaseUrl)}`,
         'wire_api = "responses"',
-        'env_key = "CODEX_LB_API_KEY"',
+        'env_http_headers = { "X-Codex-LB-API-Key" = "CODEX_LB_API_KEY" }',
         'supports_websockets = true',
         'requires_openai_auth = false'
     ].join('\n');
@@ -159,6 +220,13 @@ export function upsertCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
 }
 export function removeCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
     const state = codexLbSharedOpenAiRoutingState(text, baseUrl);
+    if (state.status === 'missing' && state.managed) {
+        return {
+            ...state,
+            changed: true,
+            text: removeTopLevelLine(String(text || ''), CODEX_LB_SHARED_OPENAI_ROUTING_MARKER)
+        };
+    }
     if (state.status !== 'matched' || !state.managed)
         return { ...state, changed: false, text: String(text || '') };
     const withoutValue = removeTopLevelTomlKeyIfValue(text, 'openai_base_url', state.expected_base_url);

package/dist/cli/install-helpers-install-support.js

@@ -10,7 +10,6 @@ import { EMPTY_CODEX_INFO, getCodexInfo } from '../core/codex-adapter.js';
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.js';
 import { initProject, installGlobalSkills } from '../core/init.js';
 import { context7ConfigToml, DOLLAR_SKILL_NAMES, GETDESIGN_REFERENCE, hasContext7ConfigText, RECOMMENDED_SKILLS } from '../core/routes.js';
-import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
 import { reconcileCodexAppUpgradeProcesses } from '../core/codex-app.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
 import { cleanupMacLaunchSecretEnvironment } from '../core/codex-app/menubar/index.js';
@@ -72,12 +71,13 @@ export async function selftestSksShimRepair() {
     const staleShimTmp = tmpdir();
     const staleBin = path.join(staleShimTmp, 'old-prefix', 'bin');
     const stalePkg = path.join(staleShimTmp, 'old-prefix', 'lib', 'node_modules', 'sneakoscope');
-    await ensureDir(path.join(stalePkg, 'bin'));
+    const staleEntrypoint = path.join(stalePkg, 'dist', 'bin', 'sks.js');
+    await ensureDir(path.dirname(staleEntrypoint));
     await ensureDir(staleBin);
     await writeTextAtomic(path.join(stalePkg, 'package.json'), JSON.stringify({ name: 'sneakoscope', version: '0.0.1' }, null, 2));
-    await writeTextAtomic(path.join(stalePkg, 'bin', 'sks.js'), '#!/usr/bin/env node\nconsole.log("sneakoscope 0.0.1");\n');
-    await fsp.chmod(path.join(stalePkg, 'bin', 'sks.js'), 0o755).catch(() => { });
-    await fsp.symlink(path.join(stalePkg, 'bin', 'sks.js'), path.join(staleBin, 'sks'));
+    await writeTextAtomic(staleEntrypoint, '#!/usr/bin/env node\nconsole.log("sneakoscope 0.0.1");\n');
+    await fsp.chmod(staleEntrypoint, 0o755).catch(() => { });
+    await fsp.symlink(staleEntrypoint, path.join(staleBin, 'sks'));
     const repair = await ensureSksCommandDuringInstall({ force: true, pathEnv: staleBin, home: path.join(staleShimTmp, 'home') });
     if (repair.status !== 'repaired')
         throw new Error(`selftest: stale global sks shim was not repaired (${repair.status})`);
@@ -136,10 +136,13 @@ async function inspectSksPathShim(candidate, opts = {}) {
 }
 function sksPackageRootForBin(file) {
     const normalized = String(file || '').split(path.sep).join('/');
-    const marker = '/node_modules/sneakoscope/bin/';
+    const marker = '/node_modules/sneakoscope/';
     const idx = normalized.lastIndexOf(marker);
     if (idx < 0)
         return null;
+    const relative = normalized.slice(idx + marker.length);
+    if (!/^(?:dist\/)?bin\//.test(relative))
+        return null;
     return normalized.slice(0, idx + '/node_modules/sneakoscope'.length).split('/').join(path.sep);
 }
 async function installedPackageVersion(root) {