sneakoscope 8.0.2 → 8.0.4

package/dist/commands/doctor.js

@@ -1,6 +1,7 @@
 import os from 'node:os';
 import path from 'node:path';
-import { projectRoot, exists, formatBytes, nowIso, writeJsonAtomic } from '../core/fsx.js';
+import { createHash } from 'node:crypto';
+import { projectRoot, exists, formatBytes, nowIso, readText, writeJsonAtomic } from '../core/fsx.js';
 import { flag } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
 import { ui as cliUi } from '../cli/cli-theme.js';
@@ -10,10 +11,18 @@ import { codexAppIntegrationStatus } from '../core/codex-app.js';
 import { codexLbMetrics, readCodexLbCircuit } from '../core/codex-lb-circuit.js';
 import { codexLbStatus } from '../cli/install-helpers.js';
 import { codexLbToolOutputRecoveryOverrideAcknowledged } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
+import { codexLbEnvPath, loadCodexLbEnv } from '../core/codex-lb/codex-lb-env.js';
+import { codexLbLegacyKeychainMigrationStampPath, inspectDesktopCenterLaunchCredentials, inspectCodexLbLegacyKeychainMigration, repairCodexLbLegacyKeychainMigration, syncDesktopCenterLaunchCredentials } from '../core/codex-lb/desktop-center-credentials.js';
+import { codexLbRoutingTruthIsActive, measureAndWriteCodexLbRoutingTruth, readCodexLbRoutingTruthReceipt } from '../core/codex-lb/routing-truth.js';
+import { removeCodexLbOrphanManagedMarkers } from '../cli/install-helpers-codex-lb-config.js';
+import { safeWriteCodexConfigToml } from '../core/codex-runtime/codex-desktop-config-policy.js';
+import { probeTelegram, telegramSelfHealAction } from '../core/telegram/doctor.js';
+import { TelegramClient } from '../core/telegram/client.js';
+import { resolveTelegramBotToken } from '../core/telegram/keychain.js';
+import { telegramLivenessPath } from '../core/telegram/liveness.js';
 import { normalizeInstallScope } from '../core/init.js';
 import { inspectCodexConfigReadability } from '../core/codex/codex-config-readability.js';
 import { inspectOAuthCallbackPortConflict, oauthCallbackDoctorGuidance } from '../core/codex/oauth-callback-port-diagnostic.js';
-import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
 import { inventoryCodexPermissionProfiles } from '../core/codex/codex-permission-profiles.js';
 import { appendMigrationEvents, hashConfigText } from '../core/migration/migration-transaction-journal.js';
 import { resolveProviderContext } from '../core/provider/provider-context.js';
@@ -27,13 +36,18 @@ import { withSecretPreservationGuard } from '../core/config/config-migration-jou
 import { reconcileDoctorSkills } from '../core/doctor/doctor-skill-reconcile.js';
 import { buildSksMenuBarDoctorPostcheck } from '../core/doctor/sks-menubar-doctor.js';
 import { isUpdateMigrationReceiptCurrent, projectUpdateMigrationReceiptPath, writeProjectUpdateMigrationReceipt } from '../core/update/update-migration-state.js';
-import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
+import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarPaths, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
+import { restartLaunchAgent } from '../core/codex-app/menubar/launch-agent.js';
 import { sweepSksTempDirs } from '../core/retention.js';
 import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
 import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 import { formatHarnessConflictReport, scanHarnessConflicts } from '../core/harness-conflicts.js';
-import { doctorArgWarnings, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs } from './doctor-profile.js';
-export { doctorArgWarnings, doctorMenuBarInstallPolicy, doctorProfileFromArgs } from './doctor-profile.js';
+import { doctorArgWarnings as baseDoctorArgWarnings, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs } from './doctor-profile.js';
+export { doctorMenuBarInstallPolicy, doctorProfileFromArgs } from './doctor-profile.js';
+const CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG = '--retry-codex-lb-keychain-migration';
+export function doctorArgWarnings(args = []) {
+    return baseDoctorArgWarnings(args.filter((arg) => arg !== CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG));
+}
 export function deferCommandAliasCleanupToMigrationReceipt(result) {
     const observedBlockers = Array.isArray(result?.blockers)
         ? result.blockers.map(String).filter(Boolean)
@@ -53,6 +67,196 @@ export function deferCommandAliasCleanupToMigrationReceipt(result) {
         ]
     };
 }
+export async function inspectDoctorCodexLbSecretResolution(input = {}, deps = {}) {
+    const processEnv = input.processEnv || process.env;
+    const home = path.resolve(input.home || processEnv.HOME || os.homedir());
+    const suppliedMigrationOptions = input.migrationOptions || {};
+    const migrationOptions = {
+        ...suppliedMigrationOptions,
+        home,
+        env: suppliedMigrationOptions.env || processEnv,
+        processEnv: suppliedMigrationOptions.processEnv || processEnv,
+        ...(input.baseUrl ? { baseUrl: input.baseUrl } : {}),
+        ...(input.forceRetry === true ? { forceRetry: true } : {})
+    };
+    if (processEnv.SKS_TEST_FORBID_REAL_HOME === '1' && suppliedMigrationOptions.platform === undefined) {
+        migrationOptions.platform = 'linux';
+    }
+    const mode = input.fix === true ? 'repair' : 'inspect';
+    const reconcile = mode === 'repair'
+        ? deps.repairImpl || repairCodexLbLegacyKeychainMigration
+        : deps.inspectImpl || inspectCodexLbLegacyKeychainMigration;
+    let migration;
+    try {
+        migration = await reconcile(migrationOptions);
+    }
+    catch (error) {
+        migration = {
+            schema: 'sks.codex-lb-legacy-keychain-reconciliation.v1',
+            ok: false,
+            status: `${mode}_failed`,
+            mode,
+            env_key_valid: false,
+            keychain_item_present: null,
+            prompt_risk: 'none',
+            attempted: false,
+            stamp_path: codexLbLegacyKeychainMigrationStampPath(home),
+            stamp_outcome: null,
+            keychain_deleted: false,
+            keychain_cleared: [],
+            blockers: [`codex_lb_legacy_keychain_${mode}_failed:${error instanceof Error ? error.message : String(error)}`]
+        };
+    }
+    const envPath = String(suppliedMigrationOptions.envPath || codexLbEnvPath(home));
+    let loaded = null;
+    let resolutionError = null;
+    try {
+        loaded = await (deps.loadEnvImpl || loadCodexLbEnv)({
+            home,
+            processEnv,
+            envPath,
+            ...(suppliedMigrationOptions.metadataPath ? { metadataPath: suppliedMigrationOptions.metadataPath } : {})
+        });
+    }
+    catch (error) {
+        resolutionError = error instanceof Error ? error.message : String(error);
+    }
+    const source = String(loaded?.source || 'missing');
+    const unsafeEnvFile = Array.isArray(loaded?.blockers)
+        && loaded.blockers.some((blocker) => String(blocker).startsWith('codex_lb_env_file_'));
+    const resolutionPath = source === 'env-file' || unsafeEnvFile
+        ? String(loaded?.env_paths?.[0] || envPath)
+        : null;
+    const operatorActions = [];
+    if (mode === 'inspect' && migration.prompt_risk === 'one_time_on_repair') {
+        operatorActions.push('Run `sks doctor --fix` to perform the one-time legacy Keychain transfer.');
+    }
+    if (mode === 'repair'
+        && migration.ok === false
+        && (migration.attempted === true || migration.status === 'already_attempted')) {
+        operatorActions.push(`Run \`sks doctor --fix ${CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG}\` to explicitly retry the one-time Keychain transfer.`);
+    }
+    return {
+        ok: migration.ok !== false && resolutionError === null,
+        secret_resolution: {
+            source,
+            path: resolutionPath,
+            prompt_risk: migration.prompt_risk || 'none'
+        },
+        legacy_keychain_migration: {
+            ...migration,
+            operator_actions: operatorActions,
+            ...(resolutionError ? { resolution_error: resolutionError } : {})
+        }
+    };
+}
+export async function inspectDoctorCodexLbDivergence(input = {}, deps = {}) {
+    const processEnv = input.processEnv || process.env;
+    const home = path.resolve(input.home || processEnv.HOME || os.homedir());
+    const status = input.providerStatus || {};
+    const configPath = String(status.config_path || path.join(home, '.codex', 'config.toml'));
+    const configText = await (deps.readTextImpl || readText)(configPath, '');
+    const orphan = removeCodexLbOrphanManagedMarkers(configText);
+    let orphanRepair = {
+        schema: 'sks.codex-lb-orphan-managed-marker-repair.v1',
+        attempted: false,
+        changed: false,
+        markers: orphan.orphan_markers,
+        receipt: null
+    };
+    if (input.fix === true && orphan.changed) {
+        const write = deps.writeConfigImpl || safeWriteCodexConfigToml;
+        const receipt = await write(configPath, configText, orphan.text, 'doctor-codex-lb-orphan-marker');
+        orphanRepair = {
+            ...orphanRepair,
+            attempted: true,
+            changed: receipt?.ok !== false,
+            receipt
+        };
+    }
+    const load = deps.loadEnvImpl || loadCodexLbEnv;
+    const canonical = await load({
+        home,
+        processEnv: {},
+        envPath: String(status.env_path || codexLbEnvPath(home))
+    }).catch(() => null);
+    const ambientKey = String(processEnv.CODEX_LB_API_KEY || '').trim();
+    const canonicalKey = String(canonical?.secret_api_key || '').trim();
+    const sha256 = (value) => value
+        ? createHash('sha256').update(value).digest('hex')
+        : null;
+    const ambientHash = sha256(ambientKey);
+    const canonicalHash = sha256(canonicalKey);
+    const staleAmbient = Boolean(ambientHash && canonicalHash && ambientHash !== canonicalHash);
+    const bridgeActive = status.desktop_mode === 'desktop-native-bridge';
+    const definedButNotSelected = status.provider_configured === true
+        && status.selected !== true
+        && !bridgeActive
+        && status.desktop_mode !== 'desktop-dual-auth-compat';
+    const mode = status.selected === true
+        ? 'cli-provider'
+        : bridgeActive
+            ? 'desktop-native-bridge'
+            : 'disabled';
+    const inspectLaunch = deps.inspectLaunchImpl || inspectDesktopCenterLaunchCredentials;
+    const syncLaunch = deps.syncLaunchImpl || syncDesktopCenterLaunchCredentials;
+    const launchOptions = {
+        mode,
+        home,
+        ...(input.launchctlBin ? { launchctlBin: input.launchctlBin } : {}),
+        ...(input.platform ? { platform: input.platform } : {}),
+        ...(input.forceLaunchctl ? { force: true } : {}),
+        ...(input.runProcessImpl ? { runProcessImpl: input.runProcessImpl } : {})
+    };
+    const launchBefore = await inspectLaunch(launchOptions);
+    const launchRepair = input.fix === true && launchBefore.ok === false
+        ? await syncLaunch({ ...launchOptions, skipPurge: true })
+        : null;
+    const launchAfter = launchRepair ? await inspectLaunch(launchOptions) : launchBefore;
+    const warnings = [
+        ...(definedButNotSelected
+            ? ['codex_lb_defined_but_not_selected']
+            : []),
+        ...(staleAmbient ? ['codex_lb_stale_ambient_key'] : []),
+        ...(orphan.orphan_markers.length > 0
+            ? [`codex_lb_orphan_managed_markers:${orphan.orphan_markers.join(',')}`]
+            : [])
+    ];
+    const blockers = [
+        ...(launchAfter.ok === false ? launchAfter.blockers || ['codex_lb_launchd_selection_state_mismatch'] : []),
+        ...(input.fix === true && orphan.changed && orphanRepair.changed !== true
+            ? ['codex_lb_orphan_marker_repair_failed']
+            : [])
+    ];
+    return {
+        schema: 'sks.doctor-codex-lb-divergence.v1',
+        ok: blockers.length === 0,
+        warnings,
+        blockers,
+        operator_actions: [
+            ...(definedButNotSelected
+                ? ['Run `sks codex-lb use-cli` to select the stored provider.']
+                : []),
+            ...(staleAmbient
+                ? ['Remove or update the stale shell export: `unset CODEX_LB_API_KEY`; the canonical key remains in ~/.codex/sks-codex-lb.env.']
+                : []),
+            ...(launchAfter.operator_actions || [])
+        ],
+        ambient_key: {
+            present: Boolean(ambientKey),
+            sha256: ambientHash,
+            matches_canonical: ambientHash && canonicalHash ? ambientHash === canonicalHash : null
+        },
+        canonical_key: {
+            present: Boolean(canonicalKey),
+            sha256: canonicalHash,
+            path: String(status.env_path || codexLbEnvPath(home))
+        },
+        orphan_markers: orphan.orphan_markers,
+        orphan_marker_repair: orphanRepair,
+        launchd: { before: launchBefore, repair: launchRepair, after: launchAfter }
+    };
+}
 export async function run(_command, args = [], deps = {}) {
     const root = await projectRoot();
     if (flag(args, '--search')) {
@@ -102,9 +306,9 @@ export async function run(_command, args = [], deps = {}) {
             : root;
         return withSecretPreservationGuard(guardRoot, 'doctor-fix', async () => (globalOnly
             ? runDoctorGlobalOnlyFix(args, root, deps)
-            : runDoctor(args, root, doctorFix)));
+            : runDoctor(args, root, doctorFix, deps)));
     }
-    return runDoctor(args, root, doctorFix);
+    return runDoctor(args, root, doctorFix, deps);
 }
 export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
     const startedAtMs = Date.now();
@@ -122,7 +326,29 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
     const doctorEnv = deps.env || (deps.home
         ? { ...process.env, HOME: home }
         : process.env);
+    const statusOptions = {
+        home,
+        env: doctorEnv,
+        processEnv: doctorEnv
+    };
+    const preRepairProviderStatus = await codexLbStatusImpl({
+        ...statusOptions,
+        probeToolOutputRecovery: false
+    }).catch(() => null);
+    const codexLbSecretProbeImpl = deps.codexLbSecretProbeImpl || inspectDoctorCodexLbSecretResolution;
+    const codexLbSecretProbe = await codexLbSecretProbeImpl({
+        home,
+        processEnv: doctorEnv,
+        fix: true,
+        forceRetry: flag(args, CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG),
+        baseUrl: preRepairProviderStatus?.base_url || preRepairProviderStatus?.provider_base_url || null,
+        migrationOptions: {
+            ...(deps.codexLbMigrationOptions || {}),
+            ...(!deps.codexLbMigrationOptions && deps.codexLbStatusImpl ? { platform: 'linux' } : {})
+        }
+    });
     const providerStatus = await codexLbStatusImpl({
+        ...statusOptions,
         probeToolOutputRecovery: true,
         allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
     }).catch((err) => ({
@@ -188,6 +414,25 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    const codexLbRoutingTruth = await codexLbRoutingTruthForStatus(providerStatus, { home, remeasure: true });
+    const codexLbRoutingReady = !doctorCodexLbRouteExpected(providerStatus)
+        || codexLbRoutingTruthIsActive(codexLbRoutingTruth);
+    const codexLbDivergence = await inspectDoctorCodexLbDivergence({
+        home,
+        processEnv: doctorEnv,
+        providerStatus,
+        fix: true,
+        ...(deps.codexLbLaunchctlBin ? { launchctlBin: deps.codexLbLaunchctlBin } : {}),
+        ...(deps.codexLbLaunchPlatform ? { platform: deps.codexLbLaunchPlatform } : {}),
+        ...(deps.codexLbLaunchRunProcessImpl ? { runProcessImpl: deps.codexLbLaunchRunProcessImpl } : {})
+    }, deps.codexLbDivergenceDeps || {});
+    const telegramRemote = await inspectTelegramRemote({
+        live: true,
+        fix: true,
+        root,
+        home,
+        env: doctorEnv
+    }, deps);
     const recoveryReady = codexLbRecoveryStatusReady(providerStatus, true);
     const globalSkillsReady = !globalSkills?.error
         && globalSkills?.ok !== false
@@ -202,7 +447,12 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
             ...(!globalFastModeReady ? [`global_fast_mode_repair_failed:${globalFastMode?.error || globalFastMode?.status || 'unknown'}`] : []),
             ...(!openRouterProviderReady ? (openRouterProvider?.blockers || ['openrouter_provider_repair_failed']) : []),
             ...(!menuBarReady ? (menuBar?.blockers || ['sks_menubar_repair_failed']) : []),
-            ...(!recoveryReady ? (providerStatus?.tool_output_recovery?.blockers || ['codex_lb_tool_output_recovery_unverified']) : [])
+            ...(codexLbSecretProbe.ok === false
+                ? (codexLbSecretProbe.legacy_keychain_migration?.blockers || ['codex_lb_secret_resolution_failed'])
+                : []),
+            ...(!recoveryReady ? (providerStatus?.tool_output_recovery?.blockers || ['codex_lb_tool_output_recovery_unverified']) : []),
+            ...(!codexLbRoutingReady ? (codexLbRoutingTruth?.blockers || ['codex_lb_routing_truth_unverified']) : []),
+            ...(codexLbDivergence.blockers || [])
         ].map(String).filter(Boolean))];
     const ok = blockers.length === 0;
     return {
@@ -231,14 +481,23 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         codex_app_fast_mode: globalFastMode,
         openrouter_provider: openRouterProvider,
         sks_menubar: menuBar,
+        telegram_remote: telegramRemote,
         codex_lb: {
             provider_status: providerStatus,
             tool_output_recovery: providerStatus?.tool_output_recovery || null,
-            recovery_ok: recoveryReady
+            recovery_ok: recoveryReady,
+            routing_truth: codexLbRoutingTruth,
+            routing_ok: codexLbRoutingReady,
+            secret_resolution: codexLbSecretProbe.secret_resolution,
+            legacy_keychain_migration: codexLbSecretProbe.legacy_keychain_migration,
+            divergence: codexLbDivergence
         },
         blockers,
         next_actions: [
             ...(recoveryReady ? [] : (providerStatus?.tool_output_recovery?.operator_actions || [])),
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || []),
+            ...(codexLbDivergence.operator_actions || []),
+            ...telegramDoctorOperatorActions(telegramRemote),
             ...(!openRouterProviderReady ? ['Run `sks codex-app set-openrouter-key` to repair the stored-key provider configuration without switching models.'] : []),
             'Run `sks doctor --fix --json` from a specific project directory when project-scoped repair is required.'
         ]
@@ -261,6 +520,15 @@ async function runDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         console.log(`SKS Doctor global repair: ${result.ok ? 'ok' : 'blocked'}`);
         console.log(`Global skills: ${result.skills.global?.error ? 'blocked' : 'reconciled'}`);
         console.log(`SKS menu bar: ${result.sks_menubar?.status || (result.sks_menubar?.ok ? 'ok' : 'blocked')}`);
+        const telegramOutcome = result.telegram_remote?.self_heal_outcome;
+        const telegramAction = telegramOutcome?.attempted
+            ? telegramOutcome.action
+            : result.telegram_remote?.self_heal_action || 'none';
+        console.log(`Telegram Remote: ${result.telegram_remote?.status || 'unknown'} (self-heal ${telegramAction}${telegramOutcome?.attempted ? `, ${telegramOutcome.recovered ? 'recovered' : 'still degraded'}` : ''})`);
+        const telegramCheckedLine = telegramDoctorCheckedLine(result.telegram_remote);
+        if (telegramCheckedLine)
+            console.log(telegramCheckedLine);
+        console.log(`codex-lb key: ${result.codex_lb.secret_resolution.source} (prompt risk ${result.codex_lb.secret_resolution.prompt_risk})`);
         for (const blocker of result.blockers)
             console.log(`- blocker: ${blocker}`);
         for (const action of result.next_actions)
@@ -277,8 +545,203 @@ function codexLbRecoveryStatusReady(status, probeRequired = false) {
         return false;
     if (status.selected === false)
         return true;
+    if (!probeRequired)
+        return true;
     return status.selected === true && status.tool_output_recovery?.ok === true;
 }
+export async function codexLbRoutingTruthForStatus(status, deps = {}) {
+    if (!status)
+        return null;
+    const statusEnvPath = typeof status.env_path === 'string' && status.env_path
+        ? status.env_path
+        : null;
+    const resolvedHome = deps.home
+        ? path.resolve(deps.home)
+        : statusEnvPath
+            ? path.dirname(path.dirname(statusEnvPath))
+            : undefined;
+    const envOptions = {
+        ...(resolvedHome ? { home: resolvedHome } : {}),
+        ...(statusEnvPath ? { envPath: statusEnvPath } : {})
+    };
+    const routeSelected = doctorCodexLbRouteExpected(status);
+    const mode = status.desktop_mode === 'desktop-native-bridge' ? 'bridge' : 'cli-provider';
+    const receiptOptions = {
+        ...(resolvedHome ? { home: resolvedHome } : {}),
+        ...(deps.receiptPath ? { receiptPath: deps.receiptPath } : {}),
+        expectedMode: mode,
+        expectedSelected: routeSelected
+    };
+    const receipt = await readCodexLbRoutingTruthReceipt(receiptOptions).catch(() => null);
+    if (deps.remeasure !== true && receipt?.fresh === true)
+        return receipt;
+    try {
+        const loaded = await loadCodexLbEnv({ ...envOptions, processEnv: {} });
+        const baseUrl = loaded.base_url || status.base_url || null;
+        const configuredHost = publicUrlHost(baseUrl);
+        const authTransport = mode === 'cli-provider'
+            ? 'x-codex-lb-api-key'
+            : doctorBridgeRoutingTransport(status, receipt);
+        const contextReceipt = await readCodexLbRoutingTruthReceipt({
+            ...receiptOptions,
+            expectedConfiguredHost: configuredHost,
+            expectedAuthTransport: authTransport
+        }).catch(() => null);
+        if (deps.remeasure !== true && contextReceipt?.fresh === true)
+            return contextReceipt;
+        return measureAndWriteCodexLbRoutingTruth({
+            mode,
+            selected: routeSelected,
+            baseUrl,
+            apiKey: loaded.secret_api_key,
+            authTransport,
+            measure: routeSelected,
+            ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {})
+        }, {
+            ...envOptions,
+            ...(deps.receiptPath ? { receiptPath: deps.receiptPath } : {})
+        });
+    }
+    catch {
+        return measureAndWriteCodexLbRoutingTruth({
+            mode,
+            selected: routeSelected,
+            baseUrl: status.base_url || null,
+            apiKey: null,
+            authTransport: mode === 'cli-provider'
+                ? 'x-codex-lb-api-key'
+                : doctorBridgeRoutingTransport(status, receipt),
+            measure: false
+        }, {
+            ...envOptions,
+            ...(deps.receiptPath ? { receiptPath: deps.receiptPath } : {})
+        });
+    }
+}
+function doctorCodexLbRouteExpected(status) {
+    return status?.selected === true || status?.desktop_mode === 'desktop-native-bridge';
+}
+function doctorBridgeRoutingTransport(status, receipt) {
+    if (receipt?.mode === 'bridge'
+        && (receipt.auth_transport === 'authorization-bearer'
+            || receipt.auth_transport === 'x-codex-lb-api-key')) {
+        return receipt.auth_transport;
+    }
+    return status?.gateway_auth_transport === 'authorization-bearer-compat'
+        ? 'authorization-bearer'
+        : 'x-codex-lb-api-key';
+}
+function publicUrlHost(value) {
+    try {
+        return value ? new URL(String(value)).host : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function inspectTelegramRemote(input = {}, deps = {}) {
+    const env = input.env || process.env;
+    const home = path.resolve(input.home || env.HOME || os.homedir());
+    const receiptPath = input.receiptPath || telegramLivenessPath(home);
+    const probeImpl = deps.probeTelegramImpl || probeTelegram;
+    let tokenProvider = deps.telegramTokenProvider;
+    let client = deps.telegramClient;
+    if (input.live && (!tokenProvider || !client)) {
+        const resolveImpl = deps.resolveTelegramBotTokenImpl || resolveTelegramBotToken;
+        let resolvedToken = null;
+        tokenProvider ||= {
+            loadToken: () => {
+                resolvedToken ||= Promise.resolve(resolveImpl({ env })).then((result) => result.token);
+                return resolvedToken;
+            }
+        };
+        client ||= new TelegramClient({ tokenProvider });
+    }
+    const runProbe = () => {
+        if (!input.live)
+            return probeImpl({ receiptPath });
+        if (!client || !tokenProvider)
+            throw new Error('telegram_live_probe_dependencies_missing');
+        return probeImpl({ client, tokenProvider, receiptPath });
+    };
+    const before = await runProbe();
+    const action = telegramSelfHealAction(before);
+    if (!input.fix || action !== 'restart_poll' || !before.token_configured || before.paired_chat_count < 1) {
+        return {
+            ...before,
+            self_heal_action: action,
+            self_heal_outcome: {
+                requested: input.fix === true,
+                attempted: false,
+                action,
+                reason: input.fix !== true
+                    ? 'report_only'
+                    : action !== 'restart_poll'
+                        ? 'action_not_restart_poll'
+                        : 'telegram_not_configured_or_paired'
+            }
+        };
+    }
+    const restartImpl = deps.restartLaunchAgentImpl || restartLaunchAgent;
+    const restart = await restartImpl(sksMenuBarPaths(home, input.root), env).catch((error) => ({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error)
+    }));
+    const maximumReprobes = Math.max(1, Math.min(deps.telegramReprobeAttempts ?? 3, 5));
+    const reprobeDelayMs = Math.max(0, Math.min(deps.telegramReprobeDelayMs ?? 500, 5_000));
+    const sleepImpl = deps.telegramSleepImpl || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let reprobeAttempts = 1;
+    let after = await runProbe();
+    let afterAction = telegramSelfHealAction(after);
+    while (restart?.ok === true && afterAction === 'restart_poll' && reprobeAttempts < maximumReprobes) {
+        await sleepImpl(reprobeDelayMs);
+        after = await runProbe();
+        afterAction = telegramSelfHealAction(after);
+        reprobeAttempts += 1;
+    }
+    return {
+        ...after,
+        self_heal_action: afterAction,
+        self_heal_attempted_action: action,
+        self_heal_before: before,
+        self_heal_outcome: {
+            requested: true,
+            attempted: true,
+            action,
+            after_action: afterAction,
+            restart_ok: restart?.ok === true,
+            reprobe_ok: after.ok,
+            reprobe_attempts: reprobeAttempts,
+            recovered: restart?.ok === true && after.ok && afterAction === 'none',
+            error: restart?.error || null,
+            restart
+        }
+    };
+}
+export function telegramDoctorCheckedLine(probe, indent = '') {
+    if (!probe?.getme_checked_at)
+        return null;
+    return `${indent}checked: ${probe.getme_checked_at} (${probe.getme_latency_ms ?? 'unknown'} ms, ${probe.getme_check_kind || 'receipt'})`;
+}
+function telegramDoctorOperatorActions(probe) {
+    if (!probe || probe.status === 'not_configured')
+        return [];
+    if (probe.self_heal_action === 'restart_poll') {
+        if (probe.self_heal_outcome?.recovered === true)
+            return [];
+        return ['Run `sks menubar restart` to restart the resident Telegram long poller.'];
+    }
+    if (probe.self_heal_action === 'revalidate_token') {
+        return ['Run `sks telegram setup --token-stdin`, then `sks menubar restart`, to revalidate the bot identity.'];
+    }
+    if (probe.self_heal_action === 'operator_remove_webhook') {
+        return ['Remove the Telegram bot webhook through the Bot API, then run `sks menubar restart`; getUpdates and webhooks cannot be active together.'];
+    }
+    if (probe.self_heal_action === 'operator_repair_audit') {
+        return ['Restore owner-only write access to `~/.codex/sks-menubar/logs/telegram-audit.jsonl`, then run `sks menubar restart`.'];
+    }
+    return [];
+}
 async function runDoctorJsonFastPath(args = [], root) {
     const startedAtMs = Date.now();
     const reportFile = readOption(args, '--report-file', null);
@@ -289,7 +752,7 @@ async function runDoctorJsonFastPath(args = [], root) {
         requireActualCodex: false,
         codexBin: codexBin || undefined
     };
-    const [codex, rust, codexConfig, sneakoscopeExists, oauthCallbackPortDiagnostic] = await Promise.all([
+    const [codex, rust, codexConfig, sneakoscopeExists, oauthCallbackPortDiagnostic, codexLbSecretProbe] = await Promise.all([
         codexBin
             ? Promise.resolve({ bin: codexBin, version: 'fixture-or-explicit', available: true })
             : getCodexInfo().catch(() => ({ bin: null, version: null, available: false })),
@@ -301,9 +764,11 @@ async function runDoctorJsonFastPath(args = [], root) {
             blockers: [err?.message || String(err)]
         })),
         exists(`${root}/.sneakoscope`),
-        inspectOAuthCallbackPortConflict()
+        inspectOAuthCallbackPortConflict(),
+        inspectDoctorCodexLbSecretResolution({ processEnv: process.env, fix: false })
     ]);
     const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
+    const telegramRemote = await inspectTelegramRemote();
     const ready = {
         schema: 'sks.doctor-readiness-matrix.v2',
         generated_at: nowIso(),
@@ -313,15 +778,13 @@ async function runDoctorJsonFastPath(args = [], root) {
         managed_state_current: sneakoscopeExists,
         codex_config_readable_by_node: Boolean(codexConfig?.ok),
         codex_config_readable_by_codex_cli: false,
-        codex_config_readable_in_zellij_context: false,
         codex_app_ready: false,
         primary_blocker: codexConfig?.ok ? null : 'codex_config_unreadable',
         blockers: codexConfig?.ok ? [] : ['codex_config_unreadable'],
         next_actions: codexConfig?.ok ? [] : ['Run `sks doctor --fix --json` to repair managed config.']
     };
     const codexNativeFeatureMatrix = fallbackCodexNativeFeatureMatrix(codex, [], ['native_feature_matrix_deferred_to_full_doctor_or_route_gate']);
-    const zellijReadiness = buildZellijReadiness(root, { status: 'skipped', required_for: ['sks --mad', 'interactive lane UI'] }, ready);
-    const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
+    const runtimeReadiness = buildRuntimeReadiness(codexNativeFeatureMatrix);
     const deferredImagegen = deferredNativeRepair('sks.doctor-imagegen-repair.v1', false, [
         'Run `sks doctor --fix --repair-native-capabilities --json` after enabling Codex App image_generation.'
     ]);
@@ -340,13 +803,20 @@ async function runDoctorJsonFastPath(args = [], root) {
         deep_diagnostics_skipped: true,
         deep_ok: null,
         not_counted_as_full_doctor: true,
-        next_actions: ['Run sks doctor --full --json for deep diagnostics.'],
+        next_actions: [
+            'Run sks doctor --full --json for deep diagnostics.',
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || []),
+            ...telegramDoctorOperatorActions(telegramRemote)
+        ],
         root,
         fast_path: true,
         no_fix_write_policy: reportFile ? 'report_file_only' : 'no_writes_performed',
         arg_warnings: doctorArgWarnings(args),
         warnings: [...oauthCallbackPortDiagnostic.warnings],
-        operator_actions: oauthCallbackOperatorActions,
+        operator_actions: [
+            ...oauthCallbackOperatorActions,
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || [])
+        ],
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
         oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic,
@@ -371,6 +841,7 @@ async function runDoctorJsonFastPath(args = [], root) {
             blockers: [],
             warnings: ['menubar_install_deferred_to_fix_or_full_doctor']
         },
+        telegram_remote: telegramRemote,
         provider_context: {
             schema: 'sks.provider-context.v1',
             generated_at: nowIso(),
@@ -384,14 +855,18 @@ async function runDoctorJsonFastPath(args = [], root) {
             warnings: ['provider_context_optional_diagnostic_skipped'],
             signals: {}
         },
-        codex_lb: codexLbMetrics(await readCodexLbCircuit(root).catch(() => ({}))),
+        codex_lb: {
+            ...codexLbMetrics(await readCodexLbCircuit(root).catch(() => ({}))),
+            routing_truth: null,
+            routing_measurement_deferred: true,
+            secret_resolution: codexLbSecretProbe.secret_resolution,
+            legacy_keychain_migration: codexLbSecretProbe.legacy_keychain_migration
+        },
         codex_doctor: null,
         pre_repair_codex_doctor: null,
         post_repair_codex_doctor: null,
         codex_doctor_diff: null,
         observational_codex_doctor_diff: null,
-        zellij: { ok: true, skipped: true, status: 'skipped_fast_path', required_for: ['sks --mad', 'interactive lane UI'] },
-        zellij_repair: { schema: 'sks.zellij-self-heal.v1', ok: true, skipped: true, blockers: [], warnings: ['zellij_repair_deferred_to_full_doctor_or_route_gate'] },
         context7_repair: { schema: 'sks.doctor-context7-repair.v1', ok: true, fix: false, skipped: true, actions: [], blockers: [], warnings: ['context7_repair_deferred_to_fix'] },
         codex_startup_repair: { schema: 'sks.doctor-codex-startup-repair.v1', ok: true, fix: false, skipped: true, actions: [], blockers: [], warnings: ['codex_startup_repair_deferred_to_fix'] },
         startup_config_repair: null,
@@ -402,7 +877,6 @@ async function runDoctorJsonFastPath(args = [], root) {
         postcheck: null,
         local_model: null,
         agent_role_config: { schema: 'sks.agent-role-config-repair.v1', ok: true, apply: false, skipped: true, blockers: [] },
-        zellij_readiness: zellijReadiness,
         codex_permission_profiles: { skipped: true, reason: 'doctor_json_fast_path_optional_diagnostics_skipped' },
         command_aliases: { schema: 'sks.command-alias-cleanup.v1', ok: true, skipped: true, reason: 'doctor_json_fast_path_no_write' },
         sks_temp_sweep: { ok: true, skipped: true, action_count: 0, reason: 'doctor_without_fix', error: null },
@@ -423,7 +897,6 @@ async function runDoctorJsonFastPath(args = [], root) {
             migration_journal: null,
             global_sks_installs: null,
             agent_role_config: null,
-            zellij: null,
             context7: null,
             codex_startup: null,
             startup_config: null,
@@ -452,7 +925,7 @@ async function runDoctorJsonFastPath(args = [], root) {
         process.exitCode = 1;
     return result;
 }
-async function runDoctor(args = [], root, doctorFix) {
+async function runDoctor(args = [], root, doctorFix, deps = {}) {
     const startedAtMs = Date.now();
     const oauthCallbackPortDiagnostic = await inspectOAuthCallbackPortConflict();
     const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
@@ -471,7 +944,6 @@ async function runDoctor(args = [], root, doctorFix) {
     const actualCodexProbeEnabled = deepDiagnostics || actualCodexProbeRequested;
     const requireActualCodexProbe = flag(args, '--require-actual-codex') || (deepDiagnostics && doctorFix);
     const shouldEvaluateCodexAppUiRepair = doctorFix || deepDiagnostics || flag(args, '--repair-codex-app-ui');
-    const shouldRunZellijRepair = deepDiagnostics || flag(args, '--repair-zellij') || flag(args, '--install-homebrew') || process.env.SKS_REQUIRE_ZELLIJ === '1';
     const nativeCapabilityDiagnosticsRequested = deepDiagnostics || flag(args, '--repair-native-capabilities');
     const requireLegacyGlobalHookCleanup = doctorFix && doctorProfile === 'migration';
     const migrationReceiptOwnsReconcile = doctorFix && doctorProfile === 'migration';
@@ -482,7 +954,6 @@ async function runDoctor(args = [], root, doctorFix) {
     const { runDoctorContext7Repair } = await import('../core/doctor/doctor-context7-repair.js');
     const { compareCodexDoctorBridge, runCodexDoctorBridge } = await import('../core/doctor/codex-doctor-bridge.js');
     const { repairCodexAppFastUi } = await import('../core/codex-app/codex-app-fast-ui-repair.js');
-    const { runDoctorZellijRepair, doctorZellijRepairConsoleLine } = await import('../core/doctor/doctor-zellij-repair.js');
     const { repairAgentRoleConfigs } = await import('../core/agents/agent-role-config.js');
     const { runCodex0138Doctor } = await import('../core/doctor/codex-0138-doctor.js');
     const { writeDoctorReadinessMatrix } = await import('../core/doctor/doctor-readiness-matrix.js');
@@ -630,29 +1101,54 @@ async function runDoctor(args = [], root, doctorFix) {
         ? await codexAppIntegrationStatus({ codex }).catch((err) => ({ ok: false, error: err.message }))
         : { ok: false, skipped: true, warnings: ['codex_app_optional_diagnostic_skipped'] };
     const codexLbCircuit = codexLbMetrics(await readCodexLbCircuit(root).catch(() => ({})));
-    const codexLbProviderStatus = deepDiagnostics || doctorFix
-        ? await codexLbStatus({
-            probeToolOutputRecovery: true,
-            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
-        }).catch((err) => ({
-            selected: null,
-            provider_ready: false,
-            recovery_probe_failed: true,
-            tool_output_recovery: {
-                ok: false,
-                status: 'probe_failed',
-                blockers: ['codex_lb_tool_output_recovery_status_probe_failed'],
-                operator_actions: []
-            },
-            error: err?.message || String(err)
-        }))
+    const codexLbPreRepairStatus = doctorFix
+        ? await codexLbStatus({ probeToolOutputRecovery: false }).catch(() => null)
         : null;
+    const codexLbSecretProbe = await inspectDoctorCodexLbSecretResolution({
+        processEnv: process.env,
+        fix: doctorFix,
+        forceRetry: flag(args, CODEX_LB_KEYCHAIN_MIGRATION_RETRY_FLAG),
+        baseUrl: codexLbPreRepairStatus?.base_url || codexLbPreRepairStatus?.provider_base_url || null
+    });
+    const codexLbProviderStatus = await codexLbStatus({
+        probeToolOutputRecovery: deepDiagnostics || doctorFix,
+        allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
+    }).catch((err) => ({
+        selected: null,
+        provider_ready: false,
+        recovery_probe_failed: deepDiagnostics || doctorFix,
+        tool_output_recovery: {
+            ok: false,
+            status: deepDiagnostics || doctorFix ? 'probe_failed' : 'not_checked',
+            blockers: deepDiagnostics || doctorFix ? ['codex_lb_tool_output_recovery_status_probe_failed'] : [],
+            operator_actions: []
+        },
+        error: err?.message || String(err)
+    }));
     const codexLbRecoveryReady = codexLbRecoveryStatusReady(codexLbProviderStatus, deepDiagnostics || doctorFix);
+    const codexLbRoutingTruth = await codexLbRoutingTruthForStatus(codexLbProviderStatus, {
+        remeasure: deepDiagnostics || doctorFix
+    });
+    const codexLbRoutingReady = !doctorCodexLbRouteExpected(codexLbProviderStatus)
+        || codexLbRoutingTruthIsActive(codexLbRoutingTruth);
+    const codexLbDivergence = await inspectDoctorCodexLbDivergence({
+        processEnv: process.env,
+        providerStatus: codexLbProviderStatus,
+        fix: doctorFix,
+        ...(deps.codexLbLaunchctlBin ? { launchctlBin: deps.codexLbLaunchctlBin } : {}),
+        ...(deps.codexLbLaunchPlatform ? { platform: deps.codexLbLaunchPlatform } : {}),
+        ...(deps.codexLbLaunchRunProcessImpl ? { runProcessImpl: deps.codexLbLaunchRunProcessImpl } : {})
+    }, deps.codexLbDivergenceDeps || {});
     const codexLb = {
         ...codexLbCircuit,
         provider_status: codexLbProviderStatus,
         tool_output_recovery: codexLbProviderStatus?.tool_output_recovery || null,
-        recovery_ok: codexLbRecoveryReady
+        recovery_ok: codexLbRecoveryReady,
+        routing_truth: codexLbRoutingTruth,
+        routing_ok: codexLbRoutingReady,
+        secret_resolution: codexLbSecretProbe.secret_resolution,
+        legacy_keychain_migration: codexLbSecretProbe.legacy_keychain_migration,
+        divergence: codexLbDivergence
     };
     const providerContext = deepDiagnostics
         ? await resolveProviderContext({ root, route: '$Doctor', serviceTier: process.env.SKS_SERVICE_TIER || 'fast' }).catch((err) => ({
@@ -756,42 +1252,12 @@ async function runDoctor(args = [], root, doctorFix) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
-    const zellijRepair = shouldRunZellijRepair
-        ? await runDoctorZellijRepair({ root, args, doctorFix }).catch((err) => ({
-            schema: 'sks.zellij-self-heal.v1',
-            ok: false,
-            requested_by: 'doctor --fix',
-            fix_requested: doctorFix,
-            auto_approved: flag(args, '--yes') || flag(args, '-y'),
-            install_homebrew_allowed: false,
-            before: { status: 'unknown', version: null, bin: null },
-            latest_version: null,
-            strategy: 'failed',
-            command: 'sks doctor --fix --yes',
-            after: { status: 'unknown', version: null, bin: null },
-            mutation_guard_artifact: null,
-            homebrew: { present: false, bin: null, install_attempted: false, install_allowed: false },
-            blockers: [err?.message || String(err)],
-            warnings: []
-        }))
-        : {
-            schema: 'sks.zellij-self-heal.v1',
-            ok: true,
-            skipped: true,
-            requested_by: 'doctor --fix',
-            fix_requested: doctorFix,
-            auto_approved: false,
-            install_homebrew_allowed: false,
-            before: { status: 'skipped', version: null, bin: null },
-            latest_version: null,
-            strategy: 'deferred',
-            command: 'sks doctor --fix --full --yes',
-            after: { status: 'skipped', version: null, bin: null },
-            mutation_guard_artifact: null,
-            homebrew: { present: false, bin: null, install_attempted: false, install_allowed: false },
-            blockers: [],
-            warnings: ['zellij_repair_deferred_to_full_doctor_or_route_gate']
-        };
+    const telegramRemote = await inspectTelegramRemote({
+        live: deepDiagnostics || doctorFix,
+        fix: doctorFix,
+        root,
+        env: process.env
+    }, deps);
     const context7Repair = await runDoctorContext7Repair({ root, fix: doctorFix }).catch((err) => ({
         schema: 'sks.doctor-context7-repair.v1',
         ok: false,
@@ -968,14 +1434,34 @@ async function runDoctor(args = [], root, doctorFix) {
                         rollback_evidence: sksMenuBar?.launch_agent_path || sksMenuBar?.report_path || 'sks_menubar_optional_no_core_mutation'
                     }),
                     postcheck: async () => {
-                        const status = await inspectSksMenuBarStatus({ root }).catch((err) => ({
+                        const inspectMenuBarStatusImpl = deps.inspectSksMenuBarStatusImpl || inspectSksMenuBarStatus;
+                        const status = await inspectMenuBarStatusImpl({ root }).catch((err) => ({
                             ok: false,
                             launchd: { ok: false, state: null, pid: null, error: err?.message || String(err) },
                             action_target: { ok: false, smoke_code: null, smoke_output: null },
                             blockers: [err?.message || String(err)],
                             warnings: []
                         }));
-                        return buildSksMenuBarDoctorPostcheck(status);
+                        const launchdRepair = await rebootstrapSksMenuBarLaunchdForDoctorFix({
+                            fix: doctorFix,
+                            root,
+                            env: process.env,
+                            status
+                        }, {
+                            inspectSksMenuBarStatusImpl: inspectMenuBarStatusImpl,
+                            restartLaunchAgentImpl: deps.restartLaunchAgentImpl
+                        });
+                        const postcheck = buildSksMenuBarDoctorPostcheck(launchdRepair.status);
+                        return launchdRepair.attempted
+                            ? {
+                                ...postcheck,
+                                repaired: launchdRepair.ok,
+                                warnings: [
+                                    ...(postcheck.warnings || []),
+                                    launchdRepair.ok ? 'launchd_rebootstrap_recovered' : 'launchd_rebootstrap_failed'
+                                ]
+                            }
+                            : postcheck;
                     }
                 },
                 {
@@ -1029,7 +1515,6 @@ async function runDoctor(args = [], root, doctorFix) {
         }))
         : null;
     const doctorFixPostcheck = doctorFix ? (await import('../core/doctor/doctor-repair-postcheck.js')).doctorRepairPostcheck(doctorFixTransaction) : null;
-    const zellij = await checkZellijCapability({ root, require: process.env.SKS_REQUIRE_ZELLIJ === '1' });
     const localModel = await readLocalModelConfig().catch(() => null);
     const permissionProfiles = await inventoryCodexPermissionProfiles(root, { writeReport: true });
     const startupRoleRepair = startupConfigRepair?.role_repair;
@@ -1265,7 +1750,6 @@ async function runDoctor(args = [], root, doctorFix) {
         pre_repair_codex_doctor: preRepairCodexDoctor,
         post_repair_codex_doctor: postRepairCodexDoctor,
         require_codex_doctor: deepDiagnostics || flag(args, '--require-actual-codex'),
-        zellij,
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
         startup_config_repair: startupConfigRepair,
@@ -1284,6 +1768,7 @@ async function runDoctor(args = [], root, doctorFix) {
         repair: configRepair,
         codex_app_ui: codexAppUi,
         sks_menubar: sksMenuBar,
+        telegram_remote: telegramRemote,
         codex_0138_doctor: codex0138Doctor,
         codex_plugin_inventory: pluginInventory?.report || null,
         codex_plugin_app_template_policy: pluginPolicy,
@@ -1292,19 +1777,15 @@ async function runDoctor(args = [], root, doctorFix) {
         operator_actions: [
             ...(codexConfig.operator_actions || []),
             ...(configRepair?.operator_actions || []),
-            ...(zellijRepair && !zellijRepair.ok && zellijRepair.command ? [`Run: ${zellijRepair.command}`] : []),
             ...(codexStartupRepair.manual_actions || []),
             ...(codexConfigSyntaxRepair?.manual_actions || []),
-            ...(pluginPolicy?.doctor_warnings || [])
+            ...(pluginPolicy?.doctor_warnings || []),
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || []),
+            ...telegramDoctorOperatorActions(telegramRemote)
         ]
     };
     let ready = await writeDoctorReadinessMatrix(root, doctorReadinessInput);
     if (doctorFix) {
-        if (migrationReceiptOwnsReconcile) {
-            commandAliasCleanup = await inspectCommandAliasCleanup(false);
-            doctorReadinessInput.command_aliases = commandAliasCleanup;
-            ready = await writeDoctorReadinessMatrix(root, doctorReadinessInput);
-        }
         const readinessBlockers = [
             ...(Array.isArray(ready.blockers) ? ready.blockers.map(String).filter(Boolean) : []),
             ...(openRouterProviderRepair?.ok === false
@@ -1316,6 +1797,7 @@ async function runDoctor(args = [], root, doctorFix) {
             && readinessBlockers.every(isMigrationUserOwnedProjectConfigBlocker);
         const receiptBlockers = preservedUserOwnedConfig ? [] : readinessBlockers;
         const migrationWarnings = [
+            ...(commandAliasCleanup?.warnings || []),
             ...(doctorNativeCapabilityRepair?.optional_warnings || []),
             ...(doctorFixPostcheck?.optional_warnings || []),
             ...(preservedUserOwnedConfig
@@ -1334,6 +1816,21 @@ async function runDoctor(args = [], root, doctorFix) {
             };
             if (receiptBlockers.length)
                 receiptInput.status = 'blocked';
+            if (migrationReceiptOwnsReconcile) {
+                receiptInput.postMigrationStageCheck = async () => {
+                    commandAliasCleanup = await inspectCommandAliasCleanup(false);
+                    doctorReadinessInput.command_aliases = commandAliasCleanup;
+                    ready = await writeDoctorReadinessMatrix(root, doctorReadinessInput);
+                    return {
+                        blockers: Array.isArray(commandAliasCleanup?.blockers)
+                            ? commandAliasCleanup.blockers.map(String).filter(Boolean)
+                            : [],
+                        warnings: Array.isArray(commandAliasCleanup?.warnings)
+                            ? commandAliasCleanup.warnings.map(String).filter(Boolean)
+                            : []
+                    };
+                };
+            }
             const receipt = await writeProjectUpdateMigrationReceipt(receiptInput);
             sksUpdate = {
                 schema: 'sks.update-now.v2',
@@ -1361,8 +1858,7 @@ async function runDoctor(args = [], root, doctorFix) {
             };
         }
     }
-    const zellijReadiness = buildZellijReadiness(root, zellij, ready);
-    const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
+    const runtimeReadiness = buildRuntimeReadiness(codexNativeFeatureMatrix);
     const resultOk = ready.ready
         && (!sksUpdate || sksUpdate.ok !== false)
         && commandAliasCleanup.ok !== false
@@ -1371,7 +1867,10 @@ async function runDoctor(args = [], root, doctorFix) {
         && agentRoleConfigRepair.ok !== false
         && openRouterProviderRepair.ok !== false
         && (officialSubagentConfig.blockers || []).length === 0
-        && codexLbRecoveryReady;
+        && codexLbSecretProbe.ok !== false
+        && codexLbDivergence.ok !== false
+        && codexLbRecoveryReady
+        && codexLbRoutingReady;
     const result = {
         schema: 'sks.doctor-status.v3',
         elapsed_ms: Date.now() - startedAtMs,
@@ -1386,8 +1885,12 @@ async function runDoctor(args = [], root, doctorFix) {
         not_counted_as_full_doctor: !deepDiagnostics,
         root,
         arg_warnings: argWarnings,
-        warnings: [...oauthCallbackPortDiagnostic.warnings],
-        operator_actions: oauthCallbackOperatorActions,
+        warnings: [...oauthCallbackPortDiagnostic.warnings, ...(codexLbDivergence.warnings || [])],
+        operator_actions: [
+            ...oauthCallbackOperatorActions,
+            ...(codexLbSecretProbe.legacy_keychain_migration?.operator_actions || []),
+            ...(codexLbDivergence.operator_actions || [])
+        ],
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
         oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic,
@@ -1397,6 +1900,7 @@ async function runDoctor(args = [], root, doctorFix) {
         codex_app_ui: codexAppUi,
         openrouter_provider: openRouterProviderRepair,
         sks_menubar: sksMenuBar,
+        telegram_remote: telegramRemote,
         provider_context: providerContext,
         codex_lb: codexLb,
         codex_doctor: authoritativeCodexDoctor,
@@ -1404,8 +1908,6 @@ async function runDoctor(args = [], root, doctorFix) {
         post_repair_codex_doctor: postRepairCodexDoctor,
         codex_doctor_diff: codexDoctorAuthoritativeDiff,
         observational_codex_doctor_diff: codexDoctorDiff,
-        zellij,
-        zellij_repair: zellijRepair,
         context7_repair: context7Repair,
         codex_startup_repair: codexStartupRepair,
         startup_config_repair: startupConfigRepair,
@@ -1423,7 +1925,6 @@ async function runDoctor(args = [], root, doctorFix) {
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         official_subagent_config: officialSubagentConfig,
-        zellij_readiness: zellijReadiness,
         codex_permission_profiles: permissionProfiles,
         command_aliases: commandAliasCleanup,
         sks_temp_sweep: {
@@ -1457,7 +1958,7 @@ async function runDoctor(args = [], root, doctorFix) {
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
         skills: skillsReconcile,
-        repair: { sks_update: sksUpdate, setup: setupRepair, openrouter_provider: openRouterProviderRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, mcp_transport_collision: mcpTransportCollisionRepair, imagegen: imagegenRepair, computer_use: computerUseRepair, browser_use: browserUseRepair, hook_trust: hookTrustRepair, sks_menubar: sksMenuBar, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup, skills: skillsReconcile, sks_temp_sweep: sksTempSweep }
+        repair: { sks_update: sksUpdate, setup: setupRepair, openrouter_provider: openRouterProviderRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, context7: context7Repair, codex_startup: codexStartupRepair, startup_config: startupConfigRepair, context7_mcp: context7McpRepair, supabase_mcp: supabaseMcpRepair, mcp_transport_collision: mcpTransportCollisionRepair, imagegen: imagegenRepair, computer_use: computerUseRepair, browser_use: browserUseRepair, hook_trust: hookTrustRepair, sks_menubar: sksMenuBar, doctor_transaction: doctorFixTransaction, doctor_dirty_plan: doctorDirtyPlan, doctor_postcheck: doctorFixPostcheck, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup, skills: skillsReconcile, sks_temp_sweep: sksTempSweep }
     };
     if (reportFile)
         await writeJsonReportFile(reportFile, result);
@@ -1492,15 +1993,6 @@ async function runDoctor(args = [], root, doctorFix) {
     console.log('Project config:');
     console.log(`  node read:       ${ready.codex_config_readable_by_node ? 'ok' : 'failed'}`);
     console.log(`  codex cli read:  ${ready.codex_config_readable_by_codex_cli ? 'ok' : (actual?.status || 'failed')}`);
-    console.log('Zellij:');
-    console.log(`  binary:      ${zellijReadiness.binary} ${zellijReadiness.version || ''} ${zellijReadiness.status === 'ok' ? 'ok' : zellijReadiness.status}`);
-    console.log(`  required_for: ${zellijReadiness.required_for.join(', ')}`);
-    console.log(`  layout:      ${zellijReadiness.layout_proof}`);
-    console.log(`  pane proof:  ${zellijReadiness.pane_proof}`);
-    console.log(`  screen proof:${zellijReadiness.screen_proof}`);
-    const zellijRepairLine = doctorZellijRepairConsoleLine(zellijRepair);
-    if (zellijRepairLine)
-        console.log(zellijRepairLine);
     console.log('Context7 MCP:');
     console.log(`  transport: ${context7Repair.preferred_transport || 'remote'}`);
     console.log(`  repair: ${context7Repair.ok ? 'ok' : 'blocked'}`);
@@ -1530,7 +2022,6 @@ async function runDoctor(args = [], root, doctorFix) {
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
     console.log('SKS Runtime Readiness:');
-    console.log(`  Zellij: ${runtimeReadiness.zellij}`);
     console.log(`  Codex Native: ${runtimeReadiness.codex_native}`);
     console.log(`  Loop Mesh: ${runtimeReadiness.loop_mesh}`);
     console.log(`  QA Visual: ${runtimeReadiness.qa_visual}`);
@@ -1607,6 +2098,8 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  next action: ${codexAppUi.next_action}`);
     console.log('SKS Menu Bar:');
     console.log(`  status: ${sksMenuBar.status || (sksMenuBar.ok ? 'ok' : 'blocked')}`);
+    for (const line of sksMenuBarRunningVersionConsoleLines(sksMenuBar))
+        console.log(line);
     const menubarPhase = doctorFixTransaction?.phases?.find((phase) => phase?.id === 'sks_menubar');
     if (menubarPhase) {
         const menubarSummary = menubarPhase.ok
@@ -1622,6 +2115,21 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  blockers: ${sksMenuBar.blockers.join(', ')}`);
     if (Array.isArray(sksMenuBar.warnings) && sksMenuBar.warnings.length)
         console.log(`  warnings: ${sksMenuBar.warnings.join(', ')}`);
+    console.log('Telegram Remote:');
+    console.log(`  status: ${telegramRemote.status || 'unknown'}`);
+    console.log(`  getMe: ${telegramRemote.bot_identity_valid ? 'verified' : telegramRemote.token_configured ? 'invalid' : 'not configured'}`);
+    console.log(`  audit: ${telegramRemote.audit_healthy ? 'healthy' : 'unavailable'}`);
+    const telegramCheckedLine = telegramDoctorCheckedLine(telegramRemote, '  ');
+    if (telegramCheckedLine)
+        console.log(telegramCheckedLine);
+    console.log(`  long poll: ${telegramRemote.poller?.running ? 'running' : 'stopped'}`);
+    const telegramSelfHealOutcome = telegramRemote.self_heal_outcome;
+    const telegramDisplayedAction = telegramSelfHealOutcome?.attempted
+        ? telegramSelfHealOutcome.action
+        : telegramRemote.self_heal_action;
+    if (telegramDisplayedAction && telegramDisplayedAction !== 'none') {
+        console.log(`  self-heal: ${telegramDisplayedAction}${telegramSelfHealOutcome?.attempted ? ` (${telegramSelfHealOutcome.recovered ? 'recovered' : 'attempted, still degraded'})` : ''}`);
+    }
     console.log(`Provider: ${providerContext.provider || 'unknown'} ${providerContext.service_tier || ''} (${providerContext.source || 'unknown'}, ${providerContext.confidence || 'low'})`);
     const imagegenReady = imagegen.auth_readiness;
     if (imagegenReady) {
@@ -1674,6 +2182,17 @@ async function runDoctor(args = [], root, doctorFix) {
     if (codex0138Doctor?.fixed?.length)
         console.log(`  doctor --fix repaired: ${codex0138Doctor.fixed.join(', ')}`);
     console.log(`codex-lb:  ${codexLb.ok ? 'ok' : `warning ${codexLb.circuit?.state || 'unknown'}`}`);
+    console.log(`  key source: ${codexLb.secret_resolution.source}${codexLb.secret_resolution.path ? ` (${codexLb.secret_resolution.path})` : ''}; prompt risk: ${codexLb.secret_resolution.prompt_risk}`);
+    for (const action of codexLb.legacy_keychain_migration?.operator_actions || [])
+        console.log(`  action: ${action}`);
+    for (const warning of codexLb.divergence?.warnings || [])
+        console.log(`  warning: ${warning}`);
+    for (const action of codexLb.divergence?.operator_actions || [])
+        console.log(`  action: ${action}`);
+    if (codexLb.routing_truth) {
+        const routingTruth = codexLb.routing_truth;
+        console.log(`  routing truth: ${codexLb.routing_ok ? 'verified' : 'blocked'} (${routingTruth.actual_host || routingTruth.configured_host || 'host unavailable'}, ${routingTruth.auth_outcome}, ${routingTruth.latency_ms ?? 'unmeasured'} ms at ${routingTruth.checked_at})`);
+    }
     if (codexLb.tool_output_recovery) {
         const recovery = codexLb.tool_output_recovery;
         console.log(`  interrupted tool-output recovery: ${recovery.ok ? 'ready' : 'blocked'} (${recovery.observed_version || recovery.status}; minimum ${recovery.minimum_version})`);
@@ -1727,31 +2246,27 @@ async function runDoctor(args = [], root, doctorFix) {
     if (!result.ok)
         process.exitCode = 1;
 }
-function buildRuntimeReadiness(zellijReadiness, matrix) {
+export function buildRuntimeReadiness(matrix) {
     const defaults = matrix?.invocation_defaults || {};
     const hookPolicy = defaults.hook_evidence_policy || 'unknown-do-not-count';
     const agentStrategy = defaults.loop_worker_role_strategy || 'message-role';
     const multiAgentMode = defaults.multi_agent_mode || 'none';
     const rolloutBudget = defaults.rollout_budget_strategy || 'sks-local-only';
     const researchSource = defaults.research_source_strategy || 'local-files';
-    const zellijStatus = zellijReadiness?.status === 'ok'
-        ? 'ok'
-        : zellijReadiness?.cli_ready ? 'headless_available' : 'repair_required';
-    const codexNative = matrix?.ok === true
-        ? 'ok'
-        : matrix?.codex_cli?.available ? 'degraded' : 'blocked';
+    const codexNative = matrix?.ok === true ? 'ok' : matrix?.codex_cli?.available ? 'degraded' : 'blocked';
     const repairActions = [];
-    if (zellijStatus !== 'ok') {
-        repairActions.push('Zellij: sks doctor --fix --yes');
-        repairActions.push('Homebrew + Zellij: sks doctor --fix --install-homebrew --yes');
+    if (codexNative !== 'ok') {
+        repairActions.push([
+            'Codex Native managed assets: sks doctor',
+            '--fix',
+            '--repair-codex-native',
+            '--yes'
+        ].join(' '));
     }
-    if (codexNative !== 'ok')
-        repairActions.push('Codex Native managed assets: sks doctor --fix --repair-codex-native --yes');
     if (matrix?.features?.project_memory?.ok !== true)
         repairActions.push('Project memory: sks codex-native init-deep --apply --directory-local');
     return {
         schema: 'sks.runtime-readiness-story.v1',
-        zellij: zellijStatus,
         codex_native: codexNative,
         loop_mesh: agentStrategy === 'agent_type' ? 'ok' : 'fallback',
         qa_visual: defaults.qa_visual_review_strategy || 'blocked',
@@ -1764,12 +2279,11 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
         current_time_source: defaults.current_time_source || 'external-clock',
         overload_retry_policy: defaults.overload_retry_policy || 'generic',
         notes: [
-            ...(zellijStatus === 'headless_available' ? ['MAD can run with --headless; live panes require repair'] : []),
             ...(hookPolicy !== 'approved-only' ? ['hook-derived evidence will not count'] : []),
             ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : []),
-            ...(multiAgentMode === 'proactive' ? [`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} multi-agent proactive mode available for Naruto-style routes`] : []),
-            ...(rolloutBudget === 'codex-0144-shared' ? [`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} rollout budget can be recorded in route proof`] : []),
-            ...(researchSource === 'indexed-web-search' ? [`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} indexed web search selected for source-intelligence routes`] : [])
+            ...(multiAgentMode === 'proactive' ? ['Proactive multi-agent mode is available for Naruto-style routes'] : []),
+            ...(rolloutBudget === 'codex-0144-shared' ? ['Shared rollout budgeting is available for route proof'] : []),
+            ...(researchSource === 'indexed-web-search' ? ['Indexed web search is selected for source-intelligence routes'] : [])
         ],
         repair_actions: [...new Set(repairActions)]
     };
@@ -1865,26 +2379,6 @@ function doctorDedupeStatus(skillDedupe) {
         return 'manual_required';
     return 'none';
 }
-function buildZellijReadiness(root, zellij, ready) {
-    const status = String(zellij?.status || 'missing');
-    const usable = status === 'ok';
-    const proofStatus = usable ? 'optional' : 'unavailable';
-    const readiness = {
-        schema: 'sks.zellij-readiness.v1',
-        binary: zellij?.bin || 'zellij',
-        status,
-        min_version: zellij?.min_version || '0.41.0',
-        version: zellij?.version || null,
-        required_for: zellij?.required_for || ['sks --mad', 'interactive lane UI'],
-        layout_proof: proofStatus,
-        pane_proof: proofStatus,
-        screen_proof: proofStatus,
-        mad_ready: ready?.mad_ready === true,
-        cli_ready: ready?.cli_ready === true,
-        ready_for_interactive_runtime: ready?.codex_config_readable_in_zellij_context === true
-    };
-    return readiness;
-}
 async function codexHomeConfigPath() {
     const path = await import('node:path');
     const os = await import('node:os');
@@ -2011,6 +2505,95 @@ export function formatCodexDoctorConsoleStatus(report) {
         return 'unavailable';
     return report.disposition || (report.exit_code === 0 ? 'pass' : 'warn');
 }
+export function sksMenuBarRunningVersionConsoleLines(status) {
+    const runningVersion = status?.running_process?.package_version
+        || status?.menubar_version_probe?.running_version
+        || null;
+    const runningPid = status?.running_process?.pid ?? status?.menubar_version_probe?.pid ?? null;
+    if (typeof runningVersion !== 'string' || !runningVersion || !Number.isInteger(runningPid) || runningPid <= 0) {
+        return [];
+    }
+    const expectedVersion = status?.menubar_version_probe?.expected_version
+        || status?.action_target?.expected_version
+        || status?.package_version
+        || null;
+    const installedVersion = status?.installed_version || status?.build_stamp?.package_version || null;
+    return [
+        `  RUNNING: version ${runningVersion} (PID ${runningPid})`,
+        ...(typeof expectedVersion === 'string' && expectedVersion && expectedVersion !== runningVersion
+            ? [`  expected: version ${expectedVersion}`]
+            : []),
+        ...(typeof installedVersion === 'string' && installedVersion && installedVersion !== runningVersion
+            ? [`  installed: version ${installedVersion}`]
+            : [])
+    ];
+}
+export async function rebootstrapSksMenuBarLaunchdForDoctorFix(input, deps = {}) {
+    const env = input.env || process.env;
+    const status = input.status;
+    const expectedVersion = status?.menubar_version_probe?.expected_version
+        || status?.action_target?.expected_version
+        || status?.installed_version
+        || null;
+    const warningOnlyVerifiedProcess = input.fix
+        && !sksMenuBarRestartDeferred(env)
+        && status?.launchd?.checked === true
+        && status?.launchd?.ok === false
+        && Array.isArray(status?.warnings)
+        && status.warnings.includes('launchd_not_running_process_active')
+        && !(Array.isArray(status?.blockers) && status.blockers.includes('launchd_not_running'))
+        && status?.running_process?.ok === true
+        && typeof expectedVersion === 'string'
+        && status.running_process.package_version === expectedVersion;
+    if (!warningOnlyVerifiedProcess) {
+        return { attempted: false, ok: true, status, restart: null };
+    }
+    const paths = sksMenuBarPaths(input.home || env.HOME, input.root);
+    const restartImpl = deps.restartLaunchAgentImpl || restartLaunchAgent;
+    const inspectImpl = deps.inspectSksMenuBarStatusImpl || inspectSksMenuBarStatus;
+    const restart = await restartImpl(paths, env).catch((error) => ({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error)
+    }));
+    if (restart?.ok !== true) {
+        const detail = restart?.error ? `:${restart.error}` : '';
+        return {
+            attempted: true,
+            ok: false,
+            restart,
+            status: {
+                ...status,
+                ok: false,
+                blockers: [...new Set([...(status?.blockers || []), `launchd_rebootstrap_failed${detail}`])]
+            }
+        };
+    }
+    const refreshed = await inspectImpl({
+        root: input.root,
+        ...(input.home ? { home: input.home } : {}),
+        ...(input.env ? { env: input.env } : {})
+    }).catch((error) => ({
+        ...status,
+        ok: false,
+        blockers: [...new Set([
+                ...(status?.blockers || []),
+                `launchd_rebootstrap_status_failed:${error instanceof Error ? error.message : String(error)}`
+            ])]
+    }));
+    if (refreshed?.launchd?.checked !== true || refreshed?.launchd?.ok !== true) {
+        return {
+            attempted: true,
+            ok: false,
+            restart,
+            status: {
+                ...refreshed,
+                ok: false,
+                blockers: [...new Set([...(refreshed?.blockers || []), 'launchd_rebootstrap_not_confirmed'])]
+            }
+        };
+    }
+    return { attempted: true, ok: true, status: refreshed, restart };
+}
 function mergeObservedCodexStartupWarnings(startupRepair, codexDoctor) {
     const text = `${codexDoctor?.stdout_tail || ''}\n${codexDoctor?.stderr_tail || ''}`;
     const manual = new Set(Array.isArray(startupRepair?.manual_actions) ? startupRepair.manual_actions : []);