sneakoscope 8.0.2 → 8.0.4

package/dist/cli/install-helpers.js

@@ -9,7 +9,6 @@ import { guardedPackageInstall, guardContextForRoute } from '../core/safety/muta
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.js';
 import { initProject, installGlobalSkills } from '../core/init.js';
 import { context7ConfigToml, DOLLAR_SKILL_NAMES, GETDESIGN_REFERENCE, hasContext7ConfigText, RECOMMENDED_SKILLS } from '../core/routes.js';
-import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
 import { reconcileCodexAppUpgradeProcesses } from '../core/codex-app.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
 import { cleanupMacLaunchSecretEnvironment } from '../core/codex-app/menubar/index.js';
@@ -29,7 +28,7 @@ import { canAskYesNo, compareVersions, hasCodexUnstableFeatureWarningSuppression
 import { printCodexLbSetupWarnings } from './codex-lb-setup-warning-output.js';
 import { checkCodexLbResponseChain } from './install-helpers-codex-lb-chain.js';
 import { CODEX_LB_CANONICAL_FAST_SERVICE_TIER, CODEX_LB_PROVIDER_ENV_KEY, askPostinstallQuestion, codexAuthChatgptBackupPath, codexAuthPath, codexLbConfigPath, codexLbEnvPath, hasTopLevelCodexLbSelected, normalizeCodexLbBaseUrl, parseCodexLbEnvKey, redactSecretText } from './install-helpers-codex-lb-shared.js';
-import { CODEX_LB_DESKTOP_BRIDGE_MARKER, CODEX_LB_DESKTOP_COMPAT_MARKER, appliedCodexLbPersistenceModes, captureCodexLbSetupWriteState, codexLbSharedOpenAiRoutingState, detectCodexLbSetupDrift, ensureGlobalCodexAppGlmProfile, ensureStoredOpenRouterProviderDuringInstall, hardenCodexLbSetupRecoveryPath, parseCodexLbEnvBaseUrl, removeCodexLbSetupRecoveryPath, removeCodexLbSharedOpenAiRouting, removeCodexLbManagedDesktopConfig, restoreCodexLbSetupWriteState, sha256Text, shellSingleQuote, upsertCodexAppGlmConfig, upsertCodexLbConfig, upsertCodexLbCliProviderConfig, upsertCodexLbCompatDesktopConfig, upsertCodexLbNativeDesktopConfig, upsertCodexLbSharedOpenAiRouting, writeCodexLbSetupFileIfUnchanged } from './install-helpers-codex-lb-config.js';
+import { CODEX_LB_DESKTOP_BRIDGE_MARKER, CODEX_LB_DESKTOP_COMPAT_MARKER, CODEX_LB_PROVIDER_SELECTION_MARKER, appliedCodexLbPersistenceModes, captureCodexLbSetupWriteState, codexLbSharedOpenAiRoutingState, detectCodexLbSetupDrift, ensureGlobalCodexAppGlmProfile, ensureStoredOpenRouterProviderDuringInstall, hardenCodexLbSetupRecoveryPath, removeCodexLbSetupRecoveryPath, removeCodexLbOrphanManagedMarkers, removeCodexLbSharedOpenAiRouting, removeCodexLbManagedDesktopConfig, restoreCodexLbSetupWriteState, sha256Text, shellSingleQuote, upsertCodexAppGlmConfig, upsertCodexLbConfig, upsertCodexLbCliProviderConfig, upsertCodexLbCompatDesktopConfig, upsertCodexLbNativeDesktopConfig, upsertCodexLbSharedOpenAiRouting, writeCodexLbSetupFileIfUnchanged } from './install-helpers-codex-lb-config.js';
 import { detectLegacyCodexLbDesktopState } from '../core/codex-lb/legacy-migration.js';
 import { ensureCodexImagegenDuringInstall, ensureGlobalCodexSkillsDuringInstall, ensureGlobalContext7DuringInstall, ensureGlobalGetdesignSkillDuringInstall, ensureSksCommandDuringInstall } from './install-helpers-install-support.js';
 import { escapeRegExp } from '../core/text/regex.js';
@@ -236,7 +235,7 @@ async function reportPostinstallCodexLbAuth(snapshot = null) {
     else if (codexLbAuth.status === 'skipped')
         console.log(`codex-lb auth: skipped (${codexLbAuth.reason}).`);
     else if (codexLbAuth.status === 'missing_env_key')
-        console.log('codex-lb auth: stored key missing. Run `sks codex-lb setup --host <domain> --api-key-stdin` to repair.');
+        console.log('codex-lb auth: stored key missing. Store it in ~/.codex/sks-codex-lb.env, run `sks codex-lb setup --host <domain> --api-key-stdin --yes`, or provide CODEX_LB_API_KEY in the environment.');
     else if (codexLbAuth.status === 'missing_base_url')
         console.log('codex-lb auth: stored key has no recoverable base URL. Run `sks codex-lb reconfigure --host <domain> --api-key-stdin` once.');
     else if (codexLbAuth.status === 'legacy_migration_required')
@@ -557,17 +556,16 @@ function codexLbRoutingPlane(mode) {
         return 'desktop_compat_provider';
     return 'cli_provider';
 }
-async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME || os.homedir()) {
+export async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME || os.homedir()) {
     const configPath = codexLbConfigPath(home);
     const envPath = codexLbEnvPath(home);
     const authPath = codexAuthPath(home);
     const config = await readText(configPath, '');
-    const envText = await readText(envPath, '');
     const auth = await captureCodexAuthSnapshot({ home, authPath });
     const envLoad = await loadCodexLbEnv({ home, envPath });
     const envKey = envLoad.secret_api_key || '';
     const providerConfigured = /\[model_providers\.codex-lb\]/.test(config);
-    const baseUrl = envLoad.base_url || codexLbProviderBaseUrl(config) || parseCodexLbEnvBaseUrl(envText);
+    const baseUrl = envLoad.base_url || codexLbProviderBaseUrl(config);
     const desktopMode = managedCodexLbDesktopMode(config);
     const bridgeBaseUrl = desktopMode === 'desktop-native-bridge'
         ? topLevelTomlString(config, 'openai_base_url')
@@ -590,7 +588,7 @@ async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME |
         secret_api_key: envKey || null
     };
 }
-async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
+export async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
     if (!snapshot)
         return { status: 'skipped', reason: 'no_snapshot' };
     let configRestored = false;
@@ -608,15 +606,12 @@ async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
             else if (snapshot.desktop_mode === 'desktop-dual-auth-compat') {
                 next = upsertCodexLbCompatDesktopConfig(current, { remoteBaseUrl: snapshot.base_url });
             }
-            else if (snapshot.selected !== true) {
+            else {
                 next = upsertCodexLbCliProviderConfig(current, {
                     remoteBaseUrl: snapshot.base_url,
-                    selectGlobally: false
+                    selectGlobally: snapshot.selected === true
                 });
             }
-            else {
-                configStatus = 'legacy_migration_required';
-            }
         }
         catch (error) {
             return {
@@ -629,7 +624,7 @@ async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
                 error: error instanceof Error ? error.message : String(error)
             };
         }
-        if (configStatus !== 'legacy_migration_required' && ensureTrailingNewline(next) !== ensureTrailingNewline(current)) {
+        if (ensureTrailingNewline(next) !== ensureTrailingNewline(current)) {
             const safeWrite = await safeWriteCodexConfigToml(snapshot.config_path, current, next, 'codex-lb-safe-routing-restore', { verifyUnchangedBeforeWrite: true });
             configRestored = safeWrite.ok && safeWrite.changed === true;
             configStatus = safeWrite.ok ? (configRestored ? 'restored' : 'present') : safeWrite.status;
@@ -728,7 +723,11 @@ export async function configureCodexLb(opts = {}) {
         ? Buffer.from(String(configBeforeEntry.bytes_base64 || ''), 'base64').toString('utf8')
         : '';
     const preservedDesktopMode = managedCodexLbDesktopMode(initialConfig);
-    const preservedLegacySelection = hasTopLevelCodexLbSelected(initialConfig) && !preservedDesktopMode;
+    const managedCliSelection = hasTopLevelMarker(initialConfig, CODEX_LB_PROVIDER_SELECTION_MARKER)
+        && hasTopLevelCodexLbSelected(initialConfig);
+    const preservedLegacySelection = hasTopLevelCodexLbSelected(initialConfig)
+        && !preservedDesktopMode
+        && !managedCliSelection;
     const desktopMode = preservedDesktopMode || 'cli-provider';
     if (desktopModeRequiresGlobalSecretEnvironment(desktopMode)) {
         return {
@@ -739,11 +738,15 @@ export async function configureCodexLb(opts = {}) {
             error: 'desktop_dual_auth_compat_requires_global_secret_environment'
         };
     }
-    const useDefaultProvider = desktopMode === 'desktop-dual-auth-compat' || preservedLegacySelection;
+    const useDefaultProvider = desktopMode === 'desktop-dual-auth-compat'
+        || preservedLegacySelection
+        || managedCliSelection
+        || (desktopMode === 'cli-provider' && opts.useDefaultProvider === true);
     const setupAnswers = {
         host_or_base_url: rawHost,
         api_key_source: opts.apiKeySource || 'stdin',
         desktop_mode: 'cli-provider',
+        use_as_default_provider: useDefaultProvider,
         gateway_auth_transport: (opts.gatewayAuthTransport || DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT),
         write_env_file: writeEnvFile,
         store_keychain: storeKeychain,
@@ -823,7 +826,7 @@ export async function configureCodexLb(opts = {}) {
         else if (!preservedLegacySelection) {
             providerOnly = upsertCodexLbCliProviderConfig(current, {
                 remoteBaseUrl: baseUrl,
-                selectGlobally: false
+                selectGlobally: useDefaultProvider
             });
         }
     }
@@ -1235,7 +1238,7 @@ export async function configureCodexLb(opts = {}) {
     }
     const skipLaunchEnvironment = opts.syncLaunchEnv === false
         || process.env.SKS_SKIP_CODEX_LB_LAUNCH_ENV === '1';
-    const { purgeStaleCodexLbCredentialTwins, syncDesktopCenterLaunchCredentials, verifyCodexLbLegacyKeychainReplacementStore } = await import('../core/codex-lb/desktop-center-credentials.js');
+    const { repairCodexLbLegacyKeychainMigration, syncDesktopCenterLaunchCredentials } = await import('../core/codex-lb/desktop-center-credentials.js');
     const centerCredentials = skipLaunchEnvironment
         ? {
             schema: 'sks.codex-lb-desktop-center-credentials.v1',
@@ -1493,43 +1496,36 @@ export async function configureCodexLb(opts = {}) {
     };
     if ((opts.platform || process.platform) === 'darwin' && writeEnvFile && !storeKeychain) {
         await opts.testHooks?.beforeLegacyKeychainCleanup?.({ envPath, metadataPath });
-        const replacement = await verifyCodexLbLegacyKeychainReplacementStore({
+        const migration = await repairCodexLbLegacyKeychainMigration({
             home,
+            baseUrl,
             envPath,
             metadataPath,
             account: opts.account || process.env.USER || 'sks',
-            expectedApiKeySha256: keyFingerprint
-        });
-        const cleanup = await purgeStaleCodexLbCredentialTwins({
-            home,
-            account: opts.account || process.env.USER || 'sks',
-            platform: 'darwin',
-            skipStaleEnvTwins: true,
+            platform: opts.platform || process.platform,
             ...(opts.securityBin ? { securityBin: opts.securityBin } : {}),
             ...(opts.runProcessImpl ? { runProcessImpl: opts.runProcessImpl } : {}),
-            ...(replacement.receipt
-                ? { legacyKeychainMigrationReceipt: replacement.receipt }
-                : {})
+            expectedApiKeySha256: keyFingerprint
         });
-        const cleanupBlockers = [
-            ...(!replacement.ok && replacement.blockers.length === 0
-                ? ['legacy_keychain_replacement_store_unverified']
-                : replacement.blockers),
-            ...cleanup.blockers
-        ];
-        const cleanupOk = replacement.ok && cleanupBlockers.length === 0;
+        const cleanupBlockers = [...new Set(migration.blockers)];
+        const replacementStoreVerified = migration.env_key_valid
+            && migration.status !== 'replacement_store_unverified'
+            && migration.status !== 'env_file_unsafe';
+        const cleanupOk = replacementStoreVerified
+            && migration.ok
+            && cleanupBlockers.length === 0;
         legacyKeychainCleanup = {
             ok: cleanupOk,
-            status: !replacement.ok
+            status: !replacementStoreVerified
                 ? 'legacy_keychain_cleanup_blocked_replacement_store_unverified'
-                : cleanupBlockers.length === 0
-                    ? cleanup.keychain_cleared.length > 0
+                : cleanupOk
+                    ? migration.keychain_cleared.length > 0
                         ? 'legacy_keychain_removed'
                         : 'legacy_keychain_absent'
                     : 'legacy_keychain_cleanup_failed_secure_store_retained',
-            replacement_store_verified: replacement.ok,
-            keychain_cleared: cleanup.keychain_cleared,
-            blockers: [...new Set(cleanupBlockers)]
+            replacement_store_verified: replacementStoreVerified,
+            keychain_cleared: migration.keychain_cleared,
+            blockers: cleanupBlockers
         };
         appliedActions.push({
             type: 'migrate_legacy_keychain',
@@ -1601,9 +1597,10 @@ export async function codexLbStatus(opts = {}) {
     const home = opts.home || process.env.HOME || os.homedir();
     const configPath = opts.configPath || codexLbConfigPath(home);
     const envPath = opts.envPath || codexLbEnvPath(home);
-    const config = await readText(configPath, '');
+    const rawConfig = await readText(configPath, '');
+    const orphanManagedMarkerCleanup = removeCodexLbOrphanManagedMarkers(rawConfig);
+    const config = orphanManagedMarkerCleanup.text;
     const envExists = await exists(envPath);
-    const envText = envExists ? await readText(envPath, '') : '';
     const envLoad = await loadCodexLbEnv({ ...opts, home, envPath });
     const authPath = opts.authPath || codexAuthPath(home);
     const authText = await readText(authPath, '');
@@ -1635,11 +1632,16 @@ export async function codexLbStatus(opts = {}) {
         && providerName === 'codex-lb'
         && providerWireApi === 'responses'
         && providerEnvKey === CODEX_LB_PROVIDER_ENV_KEY
+        && providerHasSeparateGatewayAuth
         && providerSupportsWebsockets === true
         && providerOpenAiAuthDisabled;
     const retiredCompatConfigured = desktopMode === 'desktop-dual-auth-compat';
+    const definedButNotSelected = providerConfigured && !selected && desktopMode === null;
     const providerContractOk = !retiredCompatConfigured && cliProviderContractOk;
-    const providerUsesCodexLbEnvAuth = providerConfigured && providerEnvKey === CODEX_LB_PROVIDER_ENV_KEY && providerOpenAiAuthDisabled;
+    const providerUsesCodexLbEnvAuth = providerConfigured
+        && providerEnvKey === CODEX_LB_PROVIDER_ENV_KEY
+        && providerHasSeparateGatewayAuth
+        && providerOpenAiAuthDisabled;
     const oauthAvailable = authMode.mode === 'chatgpt_oauth' || authMode.mode === 'browser_marker';
     const authRoutingCoherent = desktopMode === 'desktop-native-bridge'
         ? !selected && oauthAvailable && !codexLbKeyInSharedAuth
@@ -1682,9 +1684,23 @@ export async function codexLbStatus(opts = {}) {
                 allowUnverified: opts.allowUnverifiedToolOutputRecovery === true
                     || codexLbToolOutputRecoveryOverrideAcknowledged({ env: opts.env || process.env })
             });
+    const secretResolution = {
+        source: envLoad.source,
+        path: envLoad.source === 'env-file' ? envLoad.env_paths[0] || envPath : null,
+        prompt_risk: 'none'
+    };
     return {
         ok: providerReady && (!selected || !probeToolOutputRecovery || toolOutputRecovery.ok),
         blockers,
+        warnings: definedButNotSelected ? ['codex_lb_defined_but_not_selected'] : [],
+        orphan_managed_markers: orphanManagedMarkerCleanup.orphan_markers,
+        managed_marker_cleanup_required: orphanManagedMarkerCleanup.changed,
+        activation_guidance: definedButNotSelected
+            ? [
+                'Run `sks codex-lb use-cli` to select the CLI provider.',
+                'Run `sks codex-lb use-desktop-full` to activate managed Desktop bridge mode.'
+            ]
+            : [],
         provider_ready: providerReady,
         config_path: configPath,
         env_path: envPath,
@@ -1717,10 +1733,13 @@ export async function codexLbStatus(opts = {}) {
             source: envLoad.source,
             source_priority: envLoad.source_priority,
             api_key: envLoad.api_key,
+            blockers: envLoad.blockers,
+            guidance: envLoad.guidance,
             credential_binding: envLoad.credential_binding,
             keychain: envLoad.keychain,
             env_paths: envLoad.env_paths
         },
+        secret_resolution: secretResolution,
         base_url: baseUrl,
         auth_path: authPath,
         auth_mode: authMode.mode,
@@ -1746,6 +1765,19 @@ export async function codexLbStatus(opts = {}) {
 export function formatCodexLbStatusText(status = {}, opts = {}) {
     const backupPresent = Boolean(opts.backupPresent);
     const backupPath = opts.backupPath || '';
+    const resolution = status.secret_resolution || {};
+    const resolutionSource = String(resolution.source || status.env_loader?.source || 'missing');
+    const resolutionPath = resolution.path
+        || (resolutionSource === 'env-file' ? status.env_loader?.env_paths?.[0] || status.env_path : null);
+    const displayResolutionPath = resolutionPath
+        ? formatCodexLbStatusPath(String(resolutionPath), opts.home || os.homedir())
+        : '';
+    const resolutionLabel = displayResolutionPath
+        ? `${resolutionSource} (${displayResolutionPath})`
+        : resolutionSource;
+    const keychainUsage = resolutionSource === 'keychain' ? 'used' : 'not used';
+    const promptRisk = String(resolution.prompt_risk
+        || (resolutionSource === 'keychain' ? 'possible' : 'none'));
     const lines = [
         'SKS codex-lb',
         '',
@@ -1755,7 +1787,8 @@ export function formatCodexLbStatusText(status = {}, opts = {}) {
         `Provider OpenAI Auth: ${status.provider_requires_openai_auth ? 'required' : 'not required/drifted'} (${status.provider_name || 'missing'})`,
         `Codex App auth: ${status.auth_usable_for_codex_app ? 'ok' : 'needs sign-in/repair'} (${status.auth_mode || 'unknown'})`,
         `Shared OpenAI routing: ${status.shared_openai_routing?.safe === false ? 'unsafe' : status.shared_openai_routing?.status || 'unknown'}${status.shared_openai_routing?.managed ? ' (sks-managed)' : ''}`,
-        `Auth/routing coherent: ${status.auth_routing_coherent ? 'yes' : 'no'}`
+        `Auth/routing coherent: ${status.auth_routing_coherent ? 'yes' : 'no'}`,
+        `Key source: ${resolutionLabel} · keychain: ${keychainUsage} · prompt risk: ${promptRisk}`
     ];
     if (status.tool_output_recovery?.status && status.tool_output_recovery.status !== 'not_selected') {
         const recovery = status.tool_output_recovery;
@@ -1777,13 +1810,18 @@ export function formatCodexLbStatusText(status = {}, opts = {}) {
     if (status.base_url)
         lines.push(`Base URL:   ${status.base_url}`);
     lines.push(`ChatGPT backup: ${backupPresent ? `yes (${backupPath})` : 'no'}`);
+    if ((status.warnings || []).includes('codex_lb_defined_but_not_selected')) {
+        lines.push('', 'Warning [codex_lb_defined_but_not_selected]: the codex-lb provider is defined but not selected.');
+        for (const action of status.activation_guidance || [])
+            lines.push(`  ${action}`);
+    }
     if (status.legacy_migration_required || status.shared_openai_routing?.safe === false)
         lines.push('', 'Run: sks codex-lb migrate-legacy-desktop --restart-app. Ordinary repair will not rewrite shared Codex auth.');
     else if (status.provider_configured && !status.provider_contract_ok)
         lines.push('', 'Run: sks codex-lb repair to rewrite the provider block to the current codex-lb App contract.');
     else if (status.desktop_mode === 'desktop-native-bridge' && !status.auth_usable_for_codex_app)
         lines.push('', 'Sign in with ChatGPT OAuth, then run: sks codex-lb use-desktop-full.');
-    else if (status.ok && status.desktop_mode === 'cli-provider' && !status.selected)
+    else if (status.ok && status.desktop_mode === 'cli-provider' && !status.selected && !(status.warnings || []).includes('codex_lb_defined_but_not_selected'))
         lines.push('', 'CLI provider is stored but unselected. Run `sks codex-lb use-cli` for CLI use or `sks codex-lb use-desktop-full` for managed Desktop routing.');
     else if (status.desktop_mode === 'desktop-dual-auth-compat')
         lines.push('', 'The retired compatibility route is blocked. Run `sks codex-lb use-desktop-full` or `sks codex-lb disable`.');
@@ -1791,12 +1829,22 @@ export function formatCodexLbStatusText(status = {}, opts = {}) {
         lines.push('', 'Status: configured; no ordinary repair needed.');
     else if (!status.ok && status.base_url && status.env_key_configured)
         lines.push('', 'Run: sks codex-lb repair. To change routing explicitly, use `use-desktop-full`, `use-cli`, or `disable`.');
+    else if (!status.ok && !status.env_key_configured)
+        lines.push('', 'Gateway key missing. Store CODEX_LB_API_KEY in ~/.codex/sks-codex-lb.env, run `sks codex-lb setup --host <domain> --api-key-stdin --yes`, or provide CODEX_LB_API_KEY in the environment.');
     else if (!status.ok)
         lines.push('', 'Run: sks codex-lb setup --host <domain> --api-key-stdin');
     if (backupPresent)
         lines.push('Legacy OAuth backup detected; use `sks codex-lb migrate-legacy-desktop --restart-app` instead of background auth switching.');
     return `${lines.join('\n')}\n`;
 }
+function formatCodexLbStatusPath(file, home) {
+    const resolvedFile = path.resolve(file);
+    const resolvedHome = path.resolve(String(home || ''));
+    const relative = path.relative(resolvedHome, resolvedFile);
+    return relative && relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)
+        ? `~/${relative.split(path.sep).join('/')}`
+        : file;
+}
 export function formatCodexLbRepairResultText(result = {}) {
     const lines = [
         'codex-lb credential/provider configuration repaired without changing Codex shared auth.',
@@ -1839,11 +1887,15 @@ function codexLbProviderOpenAiAuthDisabled(text = '') {
 }
 function codexLbProviderEnvKey(text = '') {
     const block = String(text || '').match(/(^|\n)\[model_providers\.codex-lb\]([\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/)?.[2] || '';
-    return block.match(/(^|\n)\s*env_key\s*=\s*"([^"]+)"/)?.[2] || '';
+    return block.match(/(^|\n)\s*env_key\s*=\s*"([^"]+)"/)?.[2]
+        || block.match(/env_http_headers\s*=\s*\{[^}]*"X-Codex-LB-API-Key"\s*=\s*"([^"]+)"[^}]*\}/)?.[1]
+        || '';
 }
 function codexLbProviderHasSeparateGatewayAuth(text = '') {
     const block = String(text || '').match(/(^|\n)\[model_providers\.codex-lb\]([\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/)?.[2] || '';
-    return /X-Codex-LB-API-Key/.test(block) && /CODEX_LB_API_KEY/.test(block);
+    return /X-Codex-LB-API-Key/.test(block)
+        && /CODEX_LB_API_KEY/.test(block)
+        && !/(^|\n)\s*env_key\s*=/.test(block);
 }
 function codexLbFastModeConfigStatus(text = '') {
     const globalServiceTier = topLevelTomlString(text, 'service_tier');
@@ -2827,7 +2879,7 @@ async function inspectCodexLbMacLaunchEnvironment(baseUrl = '', opts = {}) {
             : []
     };
 }
-export { checkContext7, ensureCodexCliTool, ensureMadLaunchDependencies, ensureRelatedCliTools, ensureZellijCliTool, formatMadLaunchDependencyAction, maybePromptCodexUpdateForLaunch, maybePromptSksUpdateForLaunch, shouldAutoApproveInstall } from './install-tool-helpers.js';
+export { checkContext7, ensureCodexCliTool, ensureRelatedCliTools, maybePromptCodexUpdateForLaunch, maybePromptSksUpdateForLaunch, shouldAutoApproveInstall } from './install-tool-helpers.js';
 export { codexFastModeDesktopStatus, ensureGlobalCodexFastModeDuringInstall, normalizeCodexFastModeUiConfig, safeWriteCodexConfigToml } from '../core/codex-runtime/codex-desktop-config-policy.js';
 export { checkRequiredSkills, context7GlobalMcpStatus, ensureCodexImagegenDuringInstall, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureSksCommandDuringInstall, globalCodexSkillsRoot, selftestSksShimRepair } from './install-helpers-install-support.js';
 export { askPostinstallQuestion, codexLbConfigPath, codexLbEnvPath, normalizeCodexLbBaseUrl } from './install-helpers-codex-lb-shared.js';

package/dist/cli/install-tool-helpers.js

@@ -7,56 +7,10 @@ import { exists, globalSksRoot, PACKAGE_VERSION, runProcess, which } from '../co
 import { hasContext7ConfigText } from '../core/routes.js';
 import { createRequestedScopeContract } from '../core/safety/requested-scope-contract.js';
 import { guardedPackageInstall, guardContextForRoute } from '../core/safety/mutation-guard.js';
-import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
 export async function ensureRelatedCliTools(args = []) {
     const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
     const codex = await ensureCodexCliTool({ skip, args });
-    const zellijRepair = skip ? { status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' } : await ensureZellijCliTool(args);
-    const zellij = await checkZellijCapability({ require: false, writeReport: false });
-    return {
-        codex,
-        zellij: {
-            ok: zellij.status === 'ok',
-            bin: zellij.bin,
-            version: zellij.version,
-            min_version: zellij.min_version,
-            current_session: false,
-            repair: zellijRepair,
-            install_hint: zellij.status === 'ok' ? null : zellijInstallHint(),
-            error: zellijRepair.error || zellij.blockers[0] || zellij.warnings[0] || null
-        }
-    };
-}
-export async function ensureMadLaunchDependencies(args = []) {
-    const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
-    const zellijRepair = skip ? { target: 'zellij', status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' } : await ensureZellijCliTool(args);
-    const zellij = await checkZellijCapability({ require: false, writeReport: false });
-    const ready = zellij.status === 'ok';
-    return {
-        ready,
-        actions: ready ? [] : [{
-                target: 'zellij',
-                status: zellijRepair.status,
-                command: zellijRepair.command || zellijInstallHint(),
-                error: zellijRepair.error || zellij.blockers[0] || zellij.warnings[0] || null,
-                repair: zellijRepair
-            }],
-        status: {
-            zellij: {
-                ok: ready,
-                status: zellij.status,
-                version: zellij.version,
-                min_version: zellij.min_version,
-                repair: zellijRepair,
-                install_hint: ready ? null : zellijInstallHint()
-            }
-        }
-    };
-}
-export function formatMadLaunchDependencyAction(action = {}) {
-    const command = action.command ? ` Run: ${action.command}.` : '';
-    const error = action.error ? ` ${action.error}` : '';
-    return `${action.target || 'dependency'} ${action.status || 'blocked'}.${command}${error}`.trim();
+    return { codex };
 }
 export async function ensureCodexCliTool({ skip = false, args = [] } = {}) {
     if (skip)
@@ -88,37 +42,6 @@ export async function ensureCodexCliTool({ skip = false, args = [] } = {}) {
         hint: after.bin ? null : 'npm completed, but codex is not on PATH. Restart the shell or set SKS_CODEX_BIN.'
     };
 }
-export async function ensureZellijCliTool(args = [], opts = {}) {
-    const before = await checkZellijCapability({ require: false, writeReport: false });
-    if (before.status === 'ok')
-        return { target: 'zellij', status: 'present', bin: before.bin, version: before.version || null };
-    const command = zellijInstallHint();
-    if (process.platform !== 'darwin')
-        return { target: 'zellij', status: 'manual_required', command, error: before.blockers[0] || before.warnings[0] || 'zellij not found' };
-    const brew = await which('brew').catch(() => null);
-    if (!brew)
-        return { target: 'zellij', status: 'manual_required', command: 'Install Homebrew, then run: brew install zellij', error: before.blockers[0] || before.warnings[0] || 'zellij not found' };
-    if (args.includes('--dry-run') || opts.dryRun)
-        return { target: 'zellij', status: 'dry_run', command, error: before.blockers[0] || before.warnings[0] || null };
-    const hasInstalledZellij = Boolean(before.version);
-    const question = hasInstalledZellij
-        ? `Homebrew Zellij ${before.version || 'unknown'} is not ready. Upgrade to latest Zellij with ${command}?`
-        : `Zellij is missing. Install latest Zellij with ${command}?`;
-    if (!await confirmInstallYesDefault(question, args))
-        return { target: 'zellij', status: 'needs_approval', command, error: before.blockers[0] || before.warnings[0] || null };
-    const brewArgs = hasInstalledZellij ? ['upgrade', 'zellij'] : ['install', 'zellij'];
-    const zellijRoot = globalSksRoot();
-    const zellijContract = createRequestedScopeContract({
-        route: 'install', userRequest: command, projectRoot: zellijRoot, overrides: { package_install: true, zellij_install: true }
-    });
-    const install = await guardedPackageInstall(guardContextForRoute(zellijRoot, zellijContract, command), 'zellij', { confirmed: true, command: brew, args: brewArgs, timeoutMs: 180000 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
-    if (install.code !== 0)
-        return { target: 'zellij', status: 'failed', command, error: `${install.stderr || install.stdout || command + ' failed'}`.trim() };
-    const after = await checkZellijCapability({ require: false, writeReport: false });
-    if (after.status !== 'ok')
-        return { target: 'zellij', status: 'installed_not_ready', command, error: after.blockers[0] || after.warnings[0] || 'zellij installed but not ready' };
-    return { target: 'zellij', status: hasInstalledZellij ? 'upgraded' : 'installed', command, bin: after.bin, version: after.version || null };
-}
 export async function maybePromptCodexUpdateForLaunch(args = [], opts = {}) {
     if (hasFlag(args, '--json') || hasFlag(args, '--skip-cli-tools') || hasFlag(args, '--skip-codex-update') || process.env.SKS_SKIP_CODEX_UPDATE === '1')
         return { status: 'skipped' };
@@ -126,7 +49,7 @@ export async function maybePromptCodexUpdateForLaunch(args = [], opts = {}) {
     const codex = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
     const current = codexCliVersionNumber(codex.version);
     const command = 'npm i -g @openai/codex@latest';
-    const label = opts.label || 'Zellij launch';
+    const label = opts.label || 'Codex launch';
     const missing = !codex.bin;
     const updateAvailable = Boolean(latest.version && current && compareVersions(latest.version, current) > 0);
     if (!missing && !updateAvailable)
@@ -215,9 +138,6 @@ export async function checkContext7(root) {
     result.ok = result.project.ok || result.codex_mcp_list.ok || (result.global.ok && !list.checked);
     return result;
 }
-function zellijInstallHint() {
-    return process.platform === 'darwin' ? 'brew install zellij' : 'Install Zellij from https://zellij.dev/documentation/installation.html';
-}
 async function confirmInstallYesDefault(question, args = []) {
     if (hasFlag(args, '--from-postinstall') && process.env.SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS !== '1')
         return false;

package/dist/cli/output.js

@@ -2,6 +2,11 @@ import { PACKAGE_VERSION } from '../core/version.js';
 export function sksTextLogo() {
     return `SKS\nSNEAKOSCOPE CODEX v${PACKAGE_VERSION}`;
 }
-export function printJson(value) {
+export function printJson(value, options = {}) {
+    if (options.failureExitCode !== false && value && typeof value === 'object' && value.ok === false) {
+        const current = Number(process.exitCode || 0);
+        if (!Number.isFinite(current) || current === 0)
+            process.exitCode = 1;
+    }
     console.log(JSON.stringify(value, null, 2));
 }

package/dist/cli/router.js

@@ -1,7 +1,53 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
 import { COMMAND_ALIASES_LITE, COMMAND_MANIFEST_BY_NAME, COMMAND_NAME_SET, } from './command-manifest-lite.js';
 import { ui as cliUi } from './cli-theme.js';
 import { helpResult, isHelpRequest, renderManifestHelp } from './help.js';
 import { findRetiredGlobalExecutionArgumentErrors } from './global-mode-router.js';
+import { normalizeIntentCommand, } from '../core/commands/intent-normalization/normalizer.js';
+const routerIntentStorage = new AsyncLocalStorage();
+export function currentRouterIntentContract() {
+    return routerIntentStorage.getStore() || null;
+}
+export function prepareRouterExecutionIntent(argv, inheritance = {}) {
+    const effectiveArgv = argv.length ? [...argv] : ['doctor'];
+    const rawCommand = effectiveArgv[0]?.startsWith('$')
+        ? effectiveArgv.join(' ')
+        : `sks ${effectiveArgv.join(' ')}`;
+    const parent = inheritance.parentContract;
+    if (parent) {
+        const normalized = normalizeIntentCommand({
+            rawCommand,
+            naturalLanguageEffect: parent.natural_language_effect,
+            effect: parent.effect,
+            observedChangedPaths: parent.observed_changed_paths,
+            targetHashes: parent.target_hashes,
+            policyVersion: parent.policy_version,
+            modeSnapshot: parent.mode_snapshot,
+            evidenceState: parent.evidence_state,
+            retryBudget: parent.retry_budget,
+            requestedRisk: parent.risk,
+            explicitUltraOptIn: parent.risk === 'ULTRA',
+            force: parent.force,
+        });
+        if (normalized.contract.contract_hash !== parent.contract_hash) {
+            throw new Error('router_parent_intent_contract_mismatch');
+        }
+        return Object.freeze({ ...normalized, contract: parent });
+    }
+    const preflight = normalizeIntentCommand({
+        rawCommand,
+        naturalLanguageEffect: inheritance.naturalLanguageEffect || `Execute ${effectiveArgv[0] || 'doctor'}`,
+        effect: inheritance.effect || classifyCliIntentEffect(effectiveArgv),
+        targetHashes: [createHash('sha256').update(`${process.cwd()}\0${effectiveArgv[0] || 'doctor'}`).digest('hex')],
+        policyVersion: 'sks-cli-router-v1',
+        modeSnapshot: inheritance.modeSnapshot || providerModeFromEnvironment(),
+        evidenceState: inheritance.evidenceState || 'missing',
+        retryBudget: inheritance.retryBudget ?? 0,
+        force: effectiveArgv.includes('--force'),
+    });
+    return preflight;
+}
 export function isCommandName(value) {
     return COMMAND_NAME_SET.has(value);
 }
@@ -22,7 +68,28 @@ export function normalizeCommand(args = []) {
 export async function dispatch(args) {
     const argv = args ?? process.argv.slice(2);
     try {
-        return await dispatchInner(argv);
+        let intent = null;
+        try {
+            intent = prepareRouterExecutionIntent(argv);
+        }
+        catch (error) {
+            const code = error instanceof Error ? error.message : String(error);
+            if (code === 'intent_legacy_option_unsupported') {
+                process.exitCode = 1;
+                const result = { ok: false, status: 'blocked', reason: code, command: argv[0] || 'doctor' };
+                if (argv.includes('--json'))
+                    console.log(JSON.stringify(result, null, 2));
+                else
+                    console.error(code);
+                return result;
+            }
+            if (!['intent_cli_command_unknown', 'intent_dollar_command_unknown', 'intent_dollar_command_unmapped'].includes(code)) {
+                throw error;
+            }
+        }
+        return intent
+            ? await routerIntentStorage.run(intent.contract, () => dispatchInner(argv))
+            : await dispatchInner(argv);
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -37,6 +104,32 @@ export async function dispatch(args) {
         return result;
     }
 }
+function providerModeFromEnvironment() {
+    const mode = String(process.env.SKS_PROVIDER_MODE || '').trim();
+    return mode === 'codex-lb' || mode === 'openrouter' || mode === 'chatgpt-oauth'
+        ? mode
+        : 'chatgpt-oauth';
+}
+function classifyCliIntentEffect(argv) {
+    const normalized = normalizeCommand(argv);
+    const command = normalized.command;
+    const entry = command ? COMMAND_MANIFEST_BY_NAME[command] : null;
+    const tokens = argv.map((value) => String(value).toLowerCase());
+    const action = tokens.slice(1).find((value) => !value.startsWith('-')) || '';
+    if (entry?.readonly === true || safeReadOnlySubcommand(command, normalized.args))
+        return 'read';
+    if (/^(?:delete|remove|uninstall|purge|cleanup)$/.test(action))
+        return 'delete';
+    if (/^(?:deploy|publish|release|push)$/.test(action))
+        return 'deploy';
+    if (/^(?:login|logout|signin|sign-in|auth|setup|reconnect)$/.test(action))
+        return 'auth';
+    if (/^(?:install|update|upgrade|add-dependency)$/.test(action))
+        return 'dependency';
+    if (/^(?:security|permissions|sign|verify-signature|rotate)$/.test(action))
+        return 'security';
+    return 'write';
+}
 async function dispatchInner(argv) {
     const retiredGlm = findRetiredGlobalExecutionArgumentErrors(argv).filter((item) => item.includes('--glm'));
     if (retiredGlm.length && argv.some((arg) => arg === '--glm' || String(arg).startsWith('--glm='))) {
@@ -133,7 +226,13 @@ async function dispatchInner(argv) {
     }
     if (typeof mod.run !== 'function')
         throw new Error(`Command ${command} must export run(command, args)`);
-    return mod.run(rawCommand || command, rest);
+    const result = await mod.run(rawCommand || command, rest);
+    if (argv.includes('--json') && result && typeof result === 'object' && result.ok === false) {
+        const current = Number(process.exitCode || 0);
+        if (!Number.isFinite(current) || current === 0)
+            process.exitCode = 1;
+    }
+    return result;
 }
 async function ensureActiveRouteCommandGate(command, args) {
     const entry = COMMAND_MANIFEST_BY_NAME[command];