sneakoscope 8.1.0 → 8.1.2

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.1.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 8.1.2** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.1.0"
+version = "8.1.2"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.1.0"
+version = "8.1.2"
 edition = "2021"
 
 [dependencies]

package/dist/cli/install-helpers-codex-lb-chain.js

@@ -172,13 +172,13 @@ function codexLbServiceTierEvidence(...responses) {
         fast_actual: actual === CODEX_LB_CANONICAL_FAST_SERVICE_TIER || effective === CODEX_LB_CANONICAL_FAST_SERVICE_TIER
     };
 }
-function codexLbGatewayHeaders(apiKey, authTransport = 'x-codex-lb-api-key') {
-    const credentialHeader = String(authTransport).startsWith('authorization-bearer')
-        ? { authorization: `Bearer ${String(apiKey)}` }
-        : { 'X-Codex-LB-API-Key': String(apiKey) };
+function codexLbGatewayHeaders(apiKey, authTransport = 'authorization-bearer-compat') {
+    const credentialHeader = authTransport === 'x-codex-lb-api-key'
+        ? { 'X-Codex-LB-API-Key': String(apiKey) }
+        : { authorization: `Bearer ${String(apiKey)}` };
     return { ...credentialHeader, 'content-type': 'application/json' };
 }
-async function fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs, authTransport = 'x-codex-lb-api-key') {
+async function fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs, authTransport = 'authorization-bearer-compat') {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs).unref?.();
     try {
@@ -436,7 +436,7 @@ export async function checkCodexLbResponseChain(status = {}, opts = {}) {
     if (!model)
         return { ok: true, status: 'skipped', skipped: true, reason: 'model_unselected_use_explicit_model_or_codex_catalog' };
     const timeoutMs = Number(opts.timeoutMs || env.SKS_CODEX_LB_CHAIN_CHECK_TIMEOUT_MS || 8000);
-    const gatewayAuthTransport = opts.gatewayAuthTransport || 'x-codex-lb-api-key';
+    const gatewayAuthTransport = opts.gatewayAuthTransport || 'authorization-bearer-compat';
     const serviceTier = opts.fastMode === true || opts.serviceTier === 'fast' || opts.serviceTier === CODEX_LB_CANONICAL_FAST_SERVICE_TIER
         ? CODEX_LB_CANONICAL_FAST_SERVICE_TIER
         : null;

package/dist/cli/install-helpers-codex-lb-config.js

@@ -17,6 +17,25 @@ export const CODEX_LB_MODEL_CATALOG_MARKER = '# sks-codex-lb-managed-model-catal
 export const CODEX_LB_PROVIDER_SELECTION_MARKER = '# sks-codex-lb-managed-provider-selection';
 export const CODEX_LB_OAUTH_SELECTION_MARKER = '# sks-codex-lb-managed-oauth-selection';
 export const LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
+const SKS_SWITCHABLE_THIRD_PARTY_PROVIDER_IDS = ['openrouter', 'sks-router'];
+const SKS_THIRD_PARTY_CATALOG_BASENAMES = ['sks-openrouter-catalog.json', 'opencodex-catalog.json'];
+export function releaseSksManagedThirdPartySelection(text) {
+    let next = String(text || '');
+    const selected = topLevelTomlString(next, 'model_provider');
+    if (!selected || !SKS_SWITCHABLE_THIRD_PARTY_PROVIDER_IDS.includes(selected)) {
+        return next;
+    }
+    if (!new RegExp(`(^|\\n)\\[model_providers\\.${escapeRegExp(selected)}\\]`).test(next))
+        return next;
+    next = removeTopLevelTomlKeyIfValue(next, 'model_provider', selected);
+    const catalog = topLevelTomlString(next, 'model_catalog_json');
+    if (catalog
+        && !topLevelHasLine(next, CODEX_LB_MODEL_CATALOG_MARKER)
+        && SKS_THIRD_PARTY_CATALOG_BASENAMES.some((name) => catalog.endsWith(`/${name}`) || catalog === name)) {
+        next = removeTopLevelTomlKey(next, 'model_catalog_json');
+    }
+    return next;
+}
 export function removeCodexLbOrphanManagedMarkers(text) {
     const source = String(text || '');
     const selectedProvider = topLevelTomlString(source, 'model_provider');
@@ -42,7 +61,7 @@ export function removeCodexLbOrphanManagedMarkers(text) {
     };
 }
 export function upsertCodexLbNativeDesktopConfig(text, input) {
-    let next = removeCodexLbOrphanManagedMarkers(String(text || '')).text;
+    let next = releaseSksManagedThirdPartySelection(removeCodexLbOrphanManagedMarkers(String(text || '')).text);
     const selectedProvider = topLevelTomlString(next, 'model_provider');
     if (selectedProvider && selectedProvider !== 'openai' && selectedProvider !== 'codex-lb') {
         throw new Error('codex_lb_user_owned_model_provider_conflict');
@@ -89,7 +108,9 @@ export function upsertCodexLbCliProviderConfig(text, input) {
     if (topLevelHasLine(cleaned, LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER)) {
         throw new Error('codex_lb_legacy_desktop_config_requires_migration');
     }
-    const cliBase = removeCodexLbManagedDesktopConfig(cleaned);
+    const cliBase = input.selectGlobally === true
+        ? releaseSksManagedThirdPartySelection(removeCodexLbManagedDesktopConfig(cleaned))
+        : removeCodexLbManagedDesktopConfig(cleaned);
     const claimedSelection = input.selectGlobally === true
         && topLevelTomlString(cliBase, 'model_provider') === 'codex-lb'
         && !topLevelHasLine(cliBase, CODEX_LB_PROVIDER_SELECTION_MARKER)
@@ -161,7 +182,7 @@ function cliProviderBlock(remoteBaseUrl) {
         'name = "codex-lb"',
         `base_url = ${JSON.stringify(remoteBaseUrl)}`,
         'wire_api = "responses"',
-        'env_http_headers = { "X-Codex-LB-API-Key" = "CODEX_LB_API_KEY" }',
+        'env_key = "CODEX_LB_API_KEY"',
         'supports_websockets = true',
         'requires_openai_auth = false'
     ].join('\n');

package/dist/cli/install-helpers.js

@@ -28,7 +28,7 @@ import { canAskYesNo, compareVersions, hasCodexUnstableFeatureWarningSuppression
 import { printCodexLbSetupWarnings } from './codex-lb-setup-warning-output.js';
 import { checkCodexLbResponseChain } from './install-helpers-codex-lb-chain.js';
 import { CODEX_LB_CANONICAL_FAST_SERVICE_TIER, CODEX_LB_PROVIDER_ENV_KEY, askPostinstallQuestion, codexAuthChatgptBackupPath, codexAuthPath, codexLbConfigPath, codexLbEnvPath, hasTopLevelCodexLbSelected, normalizeCodexLbBaseUrl, parseCodexLbEnvKey, redactSecretText } from './install-helpers-codex-lb-shared.js';
-import { CODEX_LB_DESKTOP_BRIDGE_MARKER, CODEX_LB_DESKTOP_COMPAT_MARKER, CODEX_LB_PROVIDER_SELECTION_MARKER, appliedCodexLbPersistenceModes, captureCodexLbSetupWriteState, codexLbSharedOpenAiRoutingState, detectCodexLbSetupDrift, ensureGlobalCodexAppGlmProfile, ensureStoredOpenRouterProviderDuringInstall, hardenCodexLbSetupRecoveryPath, removeCodexLbSetupRecoveryPath, removeCodexLbOrphanManagedMarkers, removeCodexLbSharedOpenAiRouting, removeCodexLbManagedDesktopConfig, restoreCodexLbSetupWriteState, sha256Text, shellSingleQuote, upsertCodexAppGlmConfig, upsertCodexLbConfig, upsertCodexLbCliProviderConfig, upsertCodexLbCompatDesktopConfig, upsertCodexLbNativeDesktopConfig, upsertCodexLbSharedOpenAiRouting, writeCodexLbSetupFileIfUnchanged } from './install-helpers-codex-lb-config.js';
+import { CODEX_LB_DESKTOP_BRIDGE_MARKER, CODEX_LB_DESKTOP_COMPAT_MARKER, CODEX_LB_PROVIDER_SELECTION_MARKER, appliedCodexLbPersistenceModes, captureCodexLbSetupWriteState, codexLbSharedOpenAiRoutingState, detectCodexLbSetupDrift, ensureGlobalCodexAppGlmProfile, ensureStoredOpenRouterProviderDuringInstall, hardenCodexLbSetupRecoveryPath, removeCodexLbSetupRecoveryPath, removeCodexLbOrphanManagedMarkers, removeCodexLbSharedOpenAiRouting, releaseSksManagedThirdPartySelection, removeCodexLbManagedDesktopConfig, restoreCodexLbSetupWriteState, sha256Text, shellSingleQuote, upsertCodexAppGlmConfig, upsertCodexLbConfig, upsertCodexLbCliProviderConfig, upsertCodexLbCompatDesktopConfig, upsertCodexLbNativeDesktopConfig, upsertCodexLbSharedOpenAiRouting, writeCodexLbSetupFileIfUnchanged } from './install-helpers-codex-lb-config.js';
 import { detectLegacyCodexLbDesktopState } from '../core/codex-lb/legacy-migration.js';
 import { ensureCodexImagegenDuringInstall, ensureGlobalCodexSkillsDuringInstall, ensureGlobalContext7DuringInstall, ensureGlobalGetdesignSkillDuringInstall, ensureSksCommandDuringInstall } from './install-helpers-install-support.js';
 import { escapeRegExp } from '../core/text/regex.js';
@@ -416,7 +416,7 @@ export async function configureCodexLbDesktopRouting(opts) {
             })
             : mode === 'desktop-dual-auth-compat'
                 ? upsertCodexLbCompatDesktopConfig(current, { remoteBaseUrl: String(opts.remoteBaseUrl) })
-                : removeCodexLbManagedDesktopConfig(current);
+                : releaseSksManagedThirdPartySelection(removeCodexLbManagedDesktopConfig(current));
     }
     catch (error) {
         return {
@@ -494,10 +494,38 @@ export async function configureCodexLbCliProvider(opts) {
     const authPath = opts.authPath || codexAuthPath(home);
     const authBefore = await captureCodexAuthSnapshot({ home, authPath });
     const current = await readText(configPath, '');
-    const next = upsertCodexLbCliProviderConfig(current, {
-        remoteBaseUrl: opts.remoteBaseUrl,
-        ...(opts.selectGlobally === undefined ? {} : { selectGlobally: opts.selectGlobally })
-    });
+    let next;
+    try {
+        next = upsertCodexLbCliProviderConfig(current, {
+            remoteBaseUrl: opts.remoteBaseUrl,
+            ...(opts.selectGlobally === undefined ? {} : { selectGlobally: opts.selectGlobally })
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            schema: 'sks.codex-lb-cli-provider.v1',
+            ok: false,
+            status: message,
+            mode: 'cli-provider',
+            identity_plane: 'unchanged',
+            routing_plane: 'cli_provider',
+            oauth_preserved: true,
+            auth_mutated: false,
+            config_path: configPath,
+            auth_path: authPath,
+            auth_before: authBefore,
+            auth_after: authBefore,
+            blockers: [message],
+            guidance: message === 'codex_lb_user_owned_model_provider_conflict'
+                ? [
+                    'config.toml has a model_provider line SKS does not manage.',
+                    'Remove or change that line yourself, then retry Use Codex LB.'
+                ]
+                : [],
+            backup_path: null
+        };
+    }
     const write = await safeWriteCodexConfigToml(configPath, current, next, 'codex-lb-cli-provider', { verifyUnchangedBeforeWrite: true });
     const authAfter = await captureCodexAuthSnapshot({ home, authPath });
     try {
@@ -1893,9 +1921,8 @@ function codexLbProviderEnvKey(text = '') {
 }
 function codexLbProviderHasSeparateGatewayAuth(text = '') {
     const block = String(text || '').match(/(^|\n)\[model_providers\.codex-lb\]([\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/)?.[2] || '';
-    return /X-Codex-LB-API-Key/.test(block)
-        && /CODEX_LB_API_KEY/.test(block)
-        && !/(^|\n)\s*env_key\s*=/.test(block);
+    return /(^|\n)\s*env_key\s*=\s*"CODEX_LB_API_KEY"\s*(?:#.*)?(?=\n|$)/.test(block)
+        && !/X-Codex-LB-API-Key/.test(block);
 }
 function codexLbFastModeConfigStatus(text = '') {
     const globalServiceTier = topLevelTomlString(text, 'service_tier');

package/dist/commands/codex-lb.js

@@ -67,7 +67,10 @@ export async function run(command, args = []) {
             baseUrl: loadedEnv.base_url,
             apiKey: loadedEnv.secret_api_key,
             credentialBindingBlockers: loadedEnv.credential_binding.blockers,
-            gatewayAuthTransport: options.gatewayAuthTransport || loadedEnv.gateway_auth_transport || undefined
+            gatewayAuthTransport: options.gatewayAuthTransport
+                || (directGatewayProbeTransport(status, loadedEnv) === 'x-codex-lb-api-key'
+                    ? 'x-codex-lb-api-key'
+                    : 'authorization-bearer-compat')
         });
         if (!result.ok)
             process.exitCode = 1;
@@ -110,7 +113,7 @@ export async function run(command, args = []) {
             selected: status.selected === true,
             baseUrl: loadedEnv.base_url,
             apiKey: loadedEnv.secret_api_key,
-            authTransport: 'x-codex-lb-api-key'
+            authTransport: directGatewayProbeTransport(status, loadedEnv)
         }, {
             home: path.dirname(path.dirname(status.env_path))
         });
@@ -149,7 +152,7 @@ export async function run(command, args = []) {
             selected: status.selected === true,
             baseUrl: loadedEnv.base_url,
             apiKey: loadedEnv.secret_api_key,
-            authTransport: 'x-codex-lb-api-key'
+            authTransport: directGatewayProbeTransport(status, loadedEnv)
         }, {
             home: path.dirname(path.dirname(status.env_path))
         });
@@ -428,6 +431,25 @@ export async function run(command, args = []) {
     }
     if (action === 'setup' || action === 'reconfigure') {
         const options = await codexLbSetupOptions(args);
+        if (options.desktopMode === 'cli-provider' && options.gatewayAuthTransport === 'x-codex-lb-api-key') {
+            const result = {
+                schema: 'sks.codex-lb-setup.v1',
+                ok: false,
+                status: 'custom_header_transport_requires_desktop_bridge',
+                guidance: [
+                    'The atomic CLI provider always sends Authorization: Bearer (Codex env_key).',
+                    'For a gateway that only accepts the X-Codex-LB-API-Key header, use Desktop Bridge mode:',
+                    'sks codex-lb setup --host <domain> --desktop-mode desktop-full --gateway-auth custom-header --api-key-stdin --yes'
+                ]
+            };
+            if (flag(args, '--json')) {
+                process.exitCode = 1;
+                return printJson(result);
+            }
+            console.error('codex-lb setup rejected: --gateway-auth custom-header only applies to Desktop Bridge mode; the CLI provider always uses Authorization: Bearer.');
+            process.exitCode = 1;
+            return;
+        }
         const plan = buildCodexLbSetupPlan({
             host_or_base_url: options.host || '',
             api_key_source: options.apiKeySource,
@@ -546,13 +568,6 @@ export async function run(command, args = []) {
                 gatewayAuthTransport: options.gatewayAuthTransport
             });
         }
-        else if (result.ok && options.desktopMode === 'desktop-dual-auth-compat') {
-            desktopActivation = await activateCodexLbDesktopMode({
-                ...controllerOptions(args),
-                mode: 'desktop-dual-auth-compat',
-                gatewayAuthTransport: 'x-codex-lb-api-key'
-            });
-        }
         const capabilities = options.health && result.ok
             ? await buildCodexLbDesktopCapabilities({
                 ...controllerOptions(args),
@@ -566,7 +581,7 @@ export async function run(command, args = []) {
                 selected: result.codex_lb?.selected === true,
                 baseUrl: result.base_url || null,
                 apiKey: options.apiKey,
-                authTransport: 'x-codex-lb-api-key'
+                authTransport: 'authorization-bearer'
             }, {
                 home: path.dirname(path.dirname(result.env_path))
             })
@@ -1043,19 +1058,26 @@ function normalizeDesktopSetupMode(value) {
     }
     throw new Error(`unsupported_codex_lb_desktop_mode:${normalized}`);
 }
+function directGatewayProbeTransport(status, loadedEnv) {
+    return status?.desktop_mode === 'desktop-native-bridge'
+        && loadedEnv?.gateway_auth_transport === 'x-codex-lb-api-key'
+        ? 'x-codex-lb-api-key'
+        : 'authorization-bearer';
+}
 function normalizeGatewayAuthChoice(value) {
     const normalized = String(value || '').trim().toLowerCase();
     if (!normalized
-        || normalized === 'custom-header'
-        || normalized === 'header'
-        || normalized === 'x-codex-lb-api-key') {
-        return 'x-codex-lb-api-key';
-    }
-    if (normalized === 'bearer'
+        || normalized === 'bearer'
         || normalized === 'bearer-compat'
+        || normalized === 'authorization-bearer'
         || normalized === 'authorization-bearer-compat') {
         return 'authorization-bearer-compat';
     }
+    if (normalized === 'custom-header'
+        || normalized === 'header'
+        || normalized === 'x-codex-lb-api-key') {
+        return 'x-codex-lb-api-key';
+    }
     throw new Error(`unsupported_codex_lb_gateway_auth_transport:${normalized}`);
 }
 function asRecord(value) {
@@ -1088,7 +1110,7 @@ async function codexLbSetupOptions(args = []) {
     let desktopMode = normalizeDesktopSetupMode(readOption(args, '--desktop-mode', readOption(args, '--mode', 'cli-provider')));
     let gatewayAuthTransport = parseCodexLbGatewayAuthTransport(normalizeGatewayAuthChoice(flag(args, '--compat-bearer')
         ? 'authorization-bearer-compat'
-        : readOption(args, '--gateway-auth', readOption(args, '--gateway-auth-transport', 'x-codex-lb-api-key'))));
+        : readOption(args, '--gateway-auth', readOption(args, '--gateway-auth-transport', 'bearer-compat'))));
     let keychain = flag(args, '--keychain');
     if (flag(args, '--api-key-stdin'))
         apiKey = (await readStdin()).trim();
@@ -1112,13 +1134,13 @@ async function codexLbSetupOptions(args = []) {
         host ||= (await ask('1. codex-lb domain or base URL?\n   Example: lb.example.com or https://lb.example.com/backend-api/codex\n> ')).trim();
         apiKey ||= (await askHidden('2. API key?\n   Input hidden. Value will be stored securely and never printed.\n> ')).trim();
         apiKeySource = 'hidden_prompt';
-        desktopMode = normalizeDesktopSetupMode((await ask('3. Configure which mode? [desktop-full/cli-only] (desktop-full)\n> ')).trim()
-            || 'desktop-full');
+        desktopMode = normalizeDesktopSetupMode((await ask('3. Configure which mode? [cli-only/desktop-full] (cli-only)\n> ')).trim()
+            || 'cli-only');
         if (desktopMode === 'desktop-native-bridge') {
-            gatewayAuthTransport = parseCodexLbGatewayAuthTransport(normalizeGatewayAuthChoice((await ask('4. Gateway key transport? [custom-header/bearer-compat] (custom-header)\n> ')).trim()));
+            gatewayAuthTransport = parseCodexLbGatewayAuthTransport(normalizeGatewayAuthChoice((await ask('4. Gateway key transport? [bearer-compat/custom-header] (bearer-compat)\n> ')).trim()));
         }
         else {
-            gatewayAuthTransport = 'x-codex-lb-api-key';
+            gatewayAuthTransport = 'authorization-bearer-compat';
         }
         writeEnvFile = parseYesNo(await ask('5. Write shell env loader to ~/.codex/sks-codex-lb.env? [Y/n] '), true);
         keychain = false;

package/dist/commands/doctor.js

@@ -580,7 +580,7 @@ export async function codexLbRoutingTruthForStatus(status, deps = {}) {
         const baseUrl = loaded.base_url || status.base_url || null;
         const configuredHost = publicUrlHost(baseUrl);
         const authTransport = mode === 'cli-provider'
-            ? 'x-codex-lb-api-key'
+            ? 'authorization-bearer'
             : doctorBridgeRoutingTransport(status, receipt);
         const contextReceipt = await readCodexLbRoutingTruthReceipt({
             ...receiptOptions,
@@ -609,7 +609,7 @@ export async function codexLbRoutingTruthForStatus(status, deps = {}) {
             baseUrl: status.base_url || null,
             apiKey: null,
             authTransport: mode === 'cli-provider'
-                ? 'x-codex-lb-api-key'
+                ? 'authorization-bearer'
                 : doctorBridgeRoutingTransport(status, receipt),
             measure: false
         }, {
@@ -627,9 +627,9 @@ function doctorBridgeRoutingTransport(status, receipt) {
             || receipt.auth_transport === 'x-codex-lb-api-key')) {
         return receipt.auth_transport;
     }
-    return status?.gateway_auth_transport === 'authorization-bearer-compat'
-        ? 'authorization-bearer'
-        : 'x-codex-lb-api-key';
+    return status?.gateway_auth_transport === 'x-codex-lb-api-key'
+        ? 'x-codex-lb-api-key'
+        : 'authorization-bearer';
 }
 function publicUrlHost(value) {
     try {

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "8.1.0",
+  "package_version": "8.1.2",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-app.js

@@ -943,8 +943,8 @@ export async function codexProviderModelUiStatus(opts = {}) {
     const codexLbCliProviderContractOk = codexLbProviderPresent
         && hasTomlString(codexLbProvider, 'name', 'codex-lb')
         && hasTomlString(codexLbProvider, 'wire_api', 'responses')
-        && /"X-Codex-LB-API-Key"\s*=\s*"CODEX_LB_API_KEY"/.test(codexLbProvider)
-        && !/(?:^|\n)\s*env_key\s*=/.test(codexLbProvider)
+        && /(?:^|\n)\s*env_key\s*=\s*"CODEX_LB_API_KEY"\s*(?:#.*)?(?=\n|$)/.test(codexLbProvider)
+        && !/X-Codex-LB-API-Key/.test(codexLbProvider)
         && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
         && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', false);
     const codexLbSelectedDefault = /(?:^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(topLevelToml(globalConfig));
@@ -1185,9 +1185,9 @@ function inferCodexLbDesktopModeForUi(config) {
         : 'disabled';
 }
 function normalizeCodexLbGatewayAuthTransportForUi(value) {
-    return value === 'authorization-bearer-compat'
-        ? 'authorization-bearer-compat'
-        : 'x-codex-lb-api-key';
+    return value === 'x-codex-lb-api-key'
+        ? 'x-codex-lb-api-key'
+        : 'authorization-bearer-compat';
 }
 async function findDefaultPluginSource(plugin, { home, configText }) {
     const cached = await findPluginCache(plugin.name, { home });

package/dist/core/codex-control/codex-task-runner.js

@@ -595,7 +595,7 @@ async function ensurePythonCodexLbConfig(env, config) {
         'name = "codex-lb"',
         `base_url = ${tomlQuote(lbBaseUrl)}`,
         'wire_api = "responses"',
-        'env_http_headers = { "X-Codex-LB-API-Key" = "CODEX_LB_API_KEY" }',
+        'env_key = "CODEX_LB_API_KEY"',
         'supports_websockets = true',
         'requires_openai_auth = false',
         ''

package/dist/core/codex-lb/codex-lb-env.js

@@ -58,10 +58,10 @@ export async function readCodexLbModelCatalog(opts = {}) {
         };
     }
     const fetchImpl = opts.fetchImpl || fetch;
-    const gatewayAuthTransport = opts.gatewayAuthTransport || 'x-codex-lb-api-key';
-    const gatewayHeaders = gatewayAuthTransport === 'authorization-bearer-compat'
-        ? { Authorization: `Bearer ${loaded.secret_api_key}` }
-        : { 'X-Codex-LB-API-Key': loaded.secret_api_key };
+    const gatewayAuthTransport = opts.gatewayAuthTransport || DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT;
+    const gatewayHeaders = gatewayAuthTransport === 'x-codex-lb-api-key'
+        ? { 'X-Codex-LB-API-Key': loaded.secret_api_key }
+        : { Authorization: `Bearer ${loaded.secret_api_key}` };
     try {
         const response = await fetchImpl(`${loaded.base_url}/models`, {
             headers: gatewayHeaders,

package/dist/core/codex-lb/desktop-controller.js

@@ -119,11 +119,11 @@ export async function codexLbDesktopStatusV2(options = {}) {
     const routingActive = configuredRoutingActive
         && codexLbRoutingTruthIsActive(routingTruth);
     const diagnosticOk = uniqueBlockers.length === 0 && !overallBlocked;
-    const effectiveGatewayAuthTransport = context.mode === 'cli-provider'
-        ? 'x-codex-lb-api-key'
-        : context.mode === 'desktop-native-bridge' || context.mode === 'desktop-dual-auth-compat'
-            ? context.gatewayAuthTransport
-            : null;
+    const effectiveGatewayAuthTransport = context.mode === 'disabled'
+        ? null
+        : context.mode === 'cli-provider'
+            ? 'authorization-bearer-compat'
+            : context.gatewayAuthTransport;
     return {
         schema: CODEX_LB_STATUS_SCHEMA_V2,
         ok: diagnosticOk && routingActive,
@@ -194,7 +194,8 @@ export async function activateCodexLbDesktopMode(input) {
             mode: input.mode,
             identity_plane: 'unchanged',
             routing_plane: 'unchanged',
-            gateway_auth_transport: 'x-codex-lb-api-key',
+            gateway_auth_transport: input.gatewayAuthTransport
+                || DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT,
             oauth_preserved: true,
             bridge_started: false,
             config_committed: false,
@@ -538,12 +539,13 @@ export async function disableCodexLbDesktopRouting(input = {}) {
 export async function configureCodexLbCliMode(input = {}) {
     const context = await loadDesktopContext(input);
     const selectedBefore = topLevelTomlString(context.config, 'model_provider') === 'codex-lb';
+    const cliAuthTransport = routingTruthAuthTransport('cli-provider', context.gatewayAuthTransport);
     const routingTruth = await measureAndWriteCodexLbRoutingTruth({
         mode: 'cli-provider',
         selected: true,
         baseUrl: context.loadedEnv.base_url,
         apiKey: context.loadedEnv.secret_api_key,
-        authTransport: 'x-codex-lb-api-key',
+        authTransport: cliAuthTransport,
         ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}),
         ...(input.capabilityTimeoutMs ? { timeoutMs: input.capabilityTimeoutMs } : {})
     }, {
@@ -725,6 +727,7 @@ export async function buildCodexLbDesktopCapabilities(input = {}) {
             baseUrl: target.baseUrl,
             apiKey: context.loadedEnv.secret_api_key || '',
             model,
+            gatewayAuthTransport: target.effectiveTransport,
             fetchImpl: input.fetchImpl || globalThis.fetch,
             ...(envTimeout > 0 ? { timeoutMs: envTimeout } : {})
         });
@@ -752,11 +755,11 @@ export async function buildCodexLbDesktopCapabilities(input = {}) {
         oauthPreserved: context.oauthPresent,
         manifest,
         gatewayAuth: {
-            transport: cliPlane ? 'x-codex-lb-api-key' : context.gatewayAuthTransport,
+            transport: cliPlane ? 'authorization-bearer-compat' : context.gatewayAuthTransport,
             configured: context.loadedEnv.configured,
             observed: gatewayObserved,
             fixture,
-            legacyCompatibilityExplicit: context.gatewayAuthTransport === 'authorization-bearer-compat',
+            legacyCompatibilityExplicit: false,
             blockers: [
                 ...(gatewayAuthRejected
                     ? [`codex_lb_gateway_auth_rejected_for_transport:${target?.effectiveTransport || context.gatewayAuthTransport}`]
@@ -1189,8 +1192,8 @@ function providerStatus(config, mode) {
     const cliContractOk = Boolean(provider)
         && hasTomlString(provider, 'name', 'codex-lb')
         && hasTomlString(provider, 'wire_api', 'responses')
-        && /"X-Codex-LB-API-Key"\s*=\s*"CODEX_LB_API_KEY"/.test(provider)
-        && !/(?:^|\n)\s*env_key\s*=/.test(provider)
+        && /(?:^|\n)\s*env_key\s*=\s*"CODEX_LB_API_KEY"\s*$/m.test(provider)
+        && !/"X-Codex-LB-API-Key"\s*=\s*"CODEX_LB_API_KEY"/.test(provider)
         && hasTomlBoolean(provider, 'requires_openai_auth', false)
         && hasTomlBoolean(provider, 'supports_websockets', true);
     if (mode === 'cli-provider') {
@@ -1477,9 +1480,10 @@ function capabilityTarget(context) {
             effectiveTransport: context.gatewayAuthTransport
         };
     }
-    const effectiveTransport = context.mode === 'cli-provider'
+    const effectiveTransport = context.mode !== 'cli-provider'
+        && context.gatewayAuthTransport === 'x-codex-lb-api-key'
         ? 'x-codex-lb-api-key'
-        : context.gatewayAuthTransport;
+        : 'authorization-bearer-compat';
     const headers = effectiveTransport === 'x-codex-lb-api-key'
         ? { 'X-Codex-LB-API-Key': context.loadedEnv.secret_api_key }
         : { Authorization: `Bearer ${context.loadedEnv.secret_api_key}` };
@@ -1651,7 +1655,20 @@ function statusGuidance(mode, configured, blockers) {
             `The gateway rejected the configured auth transport (${rejectedTransport}).`,
             rejectedTransport === 'x-codex-lb-api-key'
                 ? 'If the gateway expects an Authorization header, re-run setup with: --gateway-auth bearer-compat'
-                : 'If the gateway expects the custom header, re-run setup with: --gateway-auth custom-header'
+                : 'If the gateway expects the custom header, use Desktop Bridge mode with: --gateway-auth custom-header (the atomic CLI provider is always Authorization: Bearer)'
+        ];
+    }
+    if (blockers.includes('codex_lb_auth_rejected')) {
+        return [
+            'The gateway rejected the API key (HTTP 401/403) over Authorization: Bearer.',
+            'Reconnect the Codex LB credential in Center, or re-run: sks codex-lb setup --host <domain> --api-key-stdin --yes',
+            'Then re-verify with: sks codex-lb connect-test'
+        ];
+    }
+    if (blockers.includes('codex_lb_endpoint_unreachable')) {
+        return [
+            'The gateway host could not be reached (network, DNS, or TLS).',
+            'Verify the host, then re-run: sks codex-lb connect-test'
         ];
     }
     if (mode === 'desktop-native-bridge') {
@@ -1697,11 +1714,11 @@ function desktopCompatModeUnavailable(mode) {
     return mode === 'desktop-dual-auth-compat';
 }
 function routingTruthAuthTransport(mode, gatewayAuthTransport) {
-    if (mode === 'cli-provider'
-        || (mode === 'desktop-native-bridge' && gatewayAuthTransport === 'x-codex-lb-api-key')) {
-        return 'x-codex-lb-api-key';
-    }
-    return 'authorization-bearer';
+    if (mode !== 'desktop-native-bridge')
+        return 'authorization-bearer';
+    return gatewayAuthTransport === 'x-codex-lb-api-key'
+        ? 'x-codex-lb-api-key'
+        : 'authorization-bearer';
 }
 function publicHost(baseUrl) {
     try {

package/dist/core/codex-lb/desktop-mode.js

@@ -9,7 +9,7 @@ export const CODEX_LB_GATEWAY_AUTH_TRANSPORTS = [
     'authorization-bearer-compat'
 ];
 export const DEFAULT_CODEX_LB_DESKTOP_MODE = 'desktop-native-bridge';
-export const DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT = 'x-codex-lb-api-key';
+export const DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT = 'authorization-bearer-compat';
 export function parseCodexLbDesktopMode(value) {
     const normalized = String(value ?? '').trim();
     if (CODEX_LB_DESKTOP_MODES.includes(normalized)) {

package/dist/core/codex-lb/probes/bridge-probe.js

@@ -48,28 +48,23 @@ export function runBridgeProbe(input) {
 }
 export function gatewayAuthTransportEvidence(input) {
     const transport = input.transport || 'unknown';
-    const preferred = transport === 'x-codex-lb-api-key';
-    const standardBearer = transport === 'authorization-bearer';
-    const legacyExplicit = transport === 'authorization-bearer-compat'
-        && input.legacyCompatibilityExplicit === true;
+    const preferredBearer = transport === 'authorization-bearer-compat'
+        || transport === 'authorization-bearer';
+    const customHeader = transport === 'x-codex-lb-api-key';
     return probeEvidence({
         configured: input.configured,
         attempted: input.observed,
-        verified: input.observed === true && (preferred || standardBearer || legacyExplicit),
+        verified: input.observed === true && (preferredBearer || customHeader),
         fixture: input.fixture,
         source: input.observed ? 'transport' : 'config',
-        blockers: [
-            ...(input.blockers || []),
-            ...(transport === 'authorization-bearer-compat' && !input.legacyCompatibilityExplicit
-                ? ['legacy_gateway_auth_compatibility_not_explicit']
-                : [])
-        ],
-        warnings: legacyExplicit ? ['legacy_authorization_bearer_compatibility_active'] : [],
+        blockers: [...(input.blockers || [])],
+        warnings: customHeader ? ['custom_x_codex_lb_api_key_transport_active'] : [],
         evidence: {
             configured_gateway_auth_transport: transport,
-            preferred_custom_header: preferred,
-            standard_authorization_bearer: standardBearer,
-            legacy_authorization_bearer_compatibility: legacyExplicit,
+            preferred_custom_header: customHeader,
+            preferred_authorization_bearer: preferredBearer,
+            standard_authorization_bearer: transport === 'authorization-bearer',
+            legacy_authorization_bearer_compatibility: false,
             silent_fallback: false,
             observed: input.observed === true
         }

package/dist/core/codex-lb/probes/cli-image-tool-probe.js

@@ -18,10 +18,13 @@ export async function probeCodexLbCliImageGeneration(input) {
     }
     const endpoint = `${String(input.baseUrl || '').replace(/\/+$/, '')}/responses`;
     const timeoutMs = input.timeoutMs || DEFAULT_CLI_IMAGE_PROBE_TIMEOUT_MS;
-    const forced = await postImageProbe(fetchImpl, endpoint, input.apiKey, input.model, timeoutMs, true);
+    const authHeaders = input.gatewayAuthTransport === 'x-codex-lb-api-key'
+        ? { 'X-Codex-LB-API-Key': input.apiKey }
+        : { authorization: `Bearer ${input.apiKey}` };
+    const forced = await postImageProbe(fetchImpl, endpoint, authHeaders, input.model, timeoutMs, true);
     const forcedToolChoiceRejected = !forced.ok && /tool_choice/.test(String(forced.errorText || ''));
     const attempt = forcedToolChoiceRejected
-        ? await postImageProbe(fetchImpl, endpoint, input.apiKey, input.model, timeoutMs, false)
+        ? await postImageProbe(fetchImpl, endpoint, authHeaders, input.model, timeoutMs, false)
         : forced;
     if (attempt.timedOut) {
         return result({
@@ -69,14 +72,14 @@ export async function probeCodexLbCliImageGeneration(input) {
         error: null
     });
 }
-async function postImageProbe(fetchImpl, endpoint, apiKey, model, timeoutMs, forceTool) {
+async function postImageProbe(fetchImpl, endpoint, authHeaders, model, timeoutMs, forceTool) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
         const response = await fetchImpl(endpoint, {
             method: 'POST',
             headers: {
-                'X-Codex-LB-API-Key': apiKey,
+                ...authHeaders,
                 'content-type': 'application/json'
             },
             body: JSON.stringify({

package/dist/core/image-ux-review/imagegen-adapter.js

@@ -599,7 +599,7 @@ export async function generateGptImage2CalloutReview(input, opts = {}) {
         codexLb: allowCodexLbApiFallback ? opts.openai?.codexLb || capability?.codex_lb || null : null,
         codexLbTarget,
         codexLbAuthTransport: capability?.codex_lb?.cli_contract === true
-            ? 'x-codex-lb-api-key'
+            ? 'authorization-bearer'
             : codexLbTarget?.auth_transport,
         allowCodexLbApiFallback
     };
@@ -689,9 +689,7 @@ function codexLbImagesApiAuth(opts, codexLb, target) {
     return {
         apiKey: codexLbKey || null,
         auth_source: envKey,
-        auth_transport: opts.codexLbAuthTransport || target?.auth_transport || (codexLb?.cli_contract === true
-            ? 'x-codex-lb-api-key'
-            : 'authorization-bearer'),
+        auth_transport: opts.codexLbAuthTransport || target?.auth_transport || 'authorization-bearer',
         api_key_source: target?.api_key_source || null,
         responses_model: responsesImagegenModel(opts) || target?.model || '',
         responses_model_source: responsesImagegenModel(opts) ? 'explicit' : target?.model_source || null,

package/dist/core/imagegen/imagegen-capability.js

@@ -109,12 +109,12 @@ async function detectCodexLbImagegenAuth(opts = {}, env = process.env) {
     const requiresOpenAiAuth = tomlBoolean(block, 'requires_openai_auth');
     const bearerEnvKey = tomlString(block, 'env_key');
     const gatewayHeaderEnvKey = tomlEnvHttpHeader(block, 'X-Codex-LB-API-Key');
-    const envKey = gatewayHeaderEnvKey || bearerEnvKey;
+    const envKey = bearerEnvKey || gatewayHeaderEnvKey;
     const cliContract = providerConfigured
         && tomlString(block, 'name') === 'codex-lb'
         && tomlString(block, 'wire_api') === 'responses'
-        && gatewayHeaderEnvKey === 'CODEX_LB_API_KEY'
-        && !bearerEnvKey
+        && bearerEnvKey === 'CODEX_LB_API_KEY'
+        && !gatewayHeaderEnvKey
         && requiresOpenAiAuth === false;
     const baseUrl = tomlString(block, 'base_url') || String(env.CODEX_LB_BASE_URL || '').trim();
     const envPath = opts.codexLbEnvPath || path.join(codexHome, 'sks-codex-lb.env');
@@ -147,9 +147,7 @@ async function detectCodexLbImagegenAuth(opts = {}, env = process.env) {
         receiptPath: routingTruthReceiptPath
     }).catch(() => null);
     const configuredHost = publicUrlHost(baseUrl);
-    const routingAuthTransport = cliContract
-        ? 'x-codex-lb-api-key'
-        : 'authorization-bearer';
+    const routingAuthTransport = 'authorization-bearer';
     const routingTruthContextMatches = routingTruth?.selected === selected
         && routingTruth?.configured_host === configuredHost
         && routingTruth?.auth_transport === routingAuthTransport;

package/dist/core/init.js

@@ -695,7 +695,7 @@ export async function initProject(root, opts = {}) {
         next = shouldSelectCodexLb
             ? upsertTopLevelTomlString(next, 'model_provider', 'codex-lb')
             : removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
-        next = upsertTomlTable(next, 'model_providers.codex-lb', `[model_providers.codex-lb]\nname = "codex-lb"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nenv_http_headers = { "X-Codex-LB-API-Key" = "CODEX_LB_API_KEY" }\nsupports_websockets = true\nrequires_openai_auth = false`);
+        next = upsertTomlTable(next, 'model_providers.codex-lb', `[model_providers.codex-lb]\nname = "codex-lb"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = false`);
         return `${next.trim()}\n`;
     }
     function parseCodexLbEnvKey(text = '') {

package/dist/core/provider/provider-context.js

@@ -14,8 +14,8 @@ export async function resolveProviderContext(input = {}) {
     const codexLbEnvKey = codexLbGatewayHeaderEnvKey || codexLbBearerEnvKey;
     const codexLbRequiresOpenAiAuth = codexLbProviderRequiresOpenAiAuth(configText);
     const codexLbProviderValid = codexLbProviderBlockPresent
-        && codexLbGatewayHeaderEnvKey === 'CODEX_LB_API_KEY'
-        && codexLbBearerEnvKey === null
+        && codexLbBearerEnvKey === 'CODEX_LB_API_KEY'
+        && codexLbGatewayHeaderEnvKey === null
         && codexLbRequiresOpenAiAuth === false;
     const openaiKey = Boolean(String(env.OPENAI_API_KEY || '').trim());
     const lbKey = Boolean(String((codexLbEnvKey ? env[codexLbEnvKey] : env.CODEX_LB_API_KEY) || env.CODEX_LB_API_KEY || '').trim());

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.1.0';
+export const PACKAGE_VERSION = '8.1.2';

package/dist/native/sks-menubar/Sources/ProvidersConnectTest.swift

@@ -79,6 +79,7 @@ extension ProvidersViewController {
             _ = self.operations.update(snapshot, state: proved ? .succeeded : .failed, stage: "complete", progress: 1, summary: proved ? "Codex LB connection proved" : "Codex LB connection proof failed")
             if let proof = proof, result.code == 0 {
                 self.codexLbSelectedNow = true
+                self.codexLbProvedNow = true
                 self.cliProviderStatus.stringValue = "Codex LB mode selected · connection proved by one live response."
                 ControlKit.setBadge(self.activeProviderBadge, text: "Codex LB · active · model \(proof.model) · \(proof.latencyMs) ms", tone: .ok)
                 self.renderCliConnectStages(
@@ -91,14 +92,16 @@ extension ProvidersViewController {
                 )
                 return
             }
+            self.codexLbProvedNow = false
             let selected = self.codexLbSelectedNow
+            let code = self.publicFailureCode(parsed)
             let failure = parsed.map(CodexLbConnectTestTruth.validationFailure(from:))
                 ?? "structured connect-test JSON was not returned"
             self.cliProviderStatus.stringValue = selected
-                ? "Codex LB mode is selected, but connection proof failed · \(failure)."
-                : "Codex LB connection proof failed and provider selection is unconfirmed · \(failure)."
+                ? "Codex LB mode is selected, but connection proof failed · \(code) · \(failure)."
+                : "Codex LB connection proof failed and provider selection is unconfirmed · \(code) · \(failure)."
             if selected {
-                ControlKit.setBadge(self.activeProviderBadge, text: "Codex LB · selected · connection proof failed", tone: .warning)
+                ControlKit.setBadge(self.activeProviderBadge, text: "Codex LB · selected · \(code) · connection proof failed", tone: .warning)
             }
             self.renderCliConnectStages(
                 progress: 3,
@@ -106,8 +109,8 @@ extension ProvidersViewController {
                 request: "completed without valid proof",
                 response: "failed",
                 result: selected
-                    ? "Mode is selected, but connection proof failed · \(failure). Use Run Connect Test to retry."
-                    : "Connection proof failed · \(failure). Confirm the provider, then retry.",
+                    ? "\(code) · Mode is selected, but connection proof failed · \(failure). Use Run Connect Test to retry."
+                    : "\(code) · Connection proof failed · \(failure). Confirm the provider, then retry.",
                 tone: .systemRed
             )
         }

package/dist/native/sks-menubar/Sources/ProvidersOpenRouter.swift

@@ -4,7 +4,7 @@ extension ProvidersViewController {
     func makeActiveProviderCard() -> NSBox {
         NativeView.card(
             title: "Active Provider",
-            subtitle: "Shows the live Desktop mode: Codex LB, ChatGPT OAuth, OpenRouter, or Multi-Provider Router. Switch with Use Codex LB or Use ChatGPT OAuth Only below.",
+            subtitle: "Live provider path. Codex LB uses Authorization: Bearer. Switch with Use Codex LB, OpenRouter Activate, or Advanced · Use ChatGPT OAuth Only.",
             views: [activeProviderBadge, oauthCredentialStatus]
         )
     }
@@ -22,12 +22,17 @@ extension ProvidersViewController {
             ControlKit.setBadge(
                 activeProviderBadge,
                 text: chatgptOauthPresentNow
-                    ? "Codex LB mode · ChatGPT OAuth + built-in OpenAI via bridge"
-                    : "Codex LB mode enabled · ChatGPT OAuth missing — run codex login",
+                    ? "Codex LB · Desktop Bridge · ChatGPT OAuth + built-in OpenAI"
+                    : "Codex LB · Desktop Bridge · ChatGPT OAuth missing — run codex login",
                 tone: chatgptOauthPresentNow ? .ok : .warning
             )
         } else if codexLbSelectedNow {
-            ControlKit.setBadge(activeProviderBadge, text: "Legacy Codex LB provider selection · migration required", tone: .warning)
+            // Measured CLI selection is not legacy migration (that badge comes only from refresh snapshot markers).
+            if codexLbProvedNow {
+                ControlKit.setBadge(activeProviderBadge, text: "Codex LB · CLI · verified", tone: .ok)
+            } else {
+                ControlKit.setBadge(activeProviderBadge, text: "Codex LB · CLI · selected · connection unproved", tone: .warning)
+            }
         } else if chatgptOauthPresentNow {
             ControlKit.setBadge(activeProviderBadge, text: "ChatGPT OAuth mode · built-in OpenAI models", tone: .neutral)
         } else {
@@ -129,7 +134,7 @@ extension ProvidersViewController {
                 let summary = self.describeOpenRouterStatus(json)
                 self.openRouterStatus.stringValue = result.code == 0
                     ? summary
-                    : "\(summary) \(self.structuredPublicDetail(json, fallback: result.output))"
+                    : "\(summary) \(self.structuredPublicDetail(json, fallback: result.output, codePrefix: "E-OR"))"
             }
             self.openRouterCredentialStatus.textColor = keyValidated ? .secondaryLabelColor : .systemOrange
             if !keyValidated { self.clearOpenRouterModels(reason: "Credential not validated · model and child-agent lists are hidden. Choose Reconnect, then Refresh Models.") }
@@ -170,7 +175,7 @@ extension ProvidersViewController {
                 return
             }
             guard result.code == 0, json["ok"] as? Bool == true else {
-                self.clearOpenRouterModels(reason: "Catalog unavailable · \(self.structuredPublicDetail(json, fallback: result.output)) No model list is exposed.")
+                self.clearOpenRouterModels(reason: "Catalog unavailable · \(self.structuredPublicDetail(json, fallback: result.output, codePrefix: "E-OR")) No model list is exposed.")
                 return
             }
             guard json["authenticated"] as? Bool == true else {
@@ -264,7 +269,8 @@ extension ProvidersViewController {
             credential: .openRouterApiKey,
             statusLabel: openRouterStatus,
             successSummary: "OpenRouter key saved",
-            failSummary: "OpenRouter key save failed"
+            failSummary: "OpenRouter key save failed",
+            codePrefix: "E-OR"
         )
     }
 
@@ -289,7 +295,7 @@ extension ProvidersViewController {
             let json = self.json(result.output)
             let ok = result.code == 0 && json?["ok"] as? Bool == true
             let status = json?["status"] as? String ?? (ok ? "connected" : "failed")
-            let detail = self.structuredPublicDetail(json, fallback: result.output)
+            let detail = self.structuredPublicDetail(json, fallback: result.output, codePrefix: "E-OR")
             _ = self.operations.update(snapshot, state: ok ? .succeeded : .failed, stage: "complete", progress: 1, summary: ok ? "OpenRouter connection ready" : "OpenRouter connection needs action")
             self.openRouterStatus.stringValue = ok
                 ? "Connection test passed · \(model) · \(status). Next: activate it if you want it as the main model."
@@ -347,7 +353,7 @@ extension ProvidersViewController {
             let json = self.json(result.output)
             let ok = result.code == 0 && json?["ok"] as? Bool == true
             let status = json?["status"] as? String ?? (ok ? "restored" : "failed")
-            let detail = self.structuredPublicDetail(json, fallback: result.output)
+            let detail = self.structuredPublicDetail(json, fallback: result.output, codePrefix: "E-OR")
             // Routing rolls back before the sidebar retag, so a blocked retag is
             // partial success: the snapshot is kept and re-running finishes it.
             let sidebarBlocked = status.hasPrefix("restored_sidebar")
@@ -415,7 +421,7 @@ extension ProvidersViewController {
                 } else if configApplied {
                     self.openRouterStatus.stringValue = "Configuration saved · main model \(model) is selected, but Codex App did not restart. Next: reopen Codex App, then verify status."
                 } else {
-                    self.openRouterStatus.stringValue = "Activation incomplete · requested \(model), observed \(activeModel ?? "unknown") · \(self.structuredPublicDetail(activationJson, fallback: activation.output))"
+                    self.openRouterStatus.stringValue = "Activation incomplete · requested \(model), observed \(activeModel ?? "unknown") · \(self.structuredPublicDetail(activationJson, fallback: activation.output, codePrefix: "E-OR"))"
                 }
                 self.refreshOpenRouterStatus()
             }
@@ -426,14 +432,60 @@ extension ProvidersViewController {
         openRouterModelField.stringValue.trimmingCharacters(in: .whitespacesAndNewlines)
     }
 
-    func structuredPublicDetail(_ json: [String: Any]?, fallback: String) -> String {
+    /// One shared failure format: stable code · HTTP · transport · public message · Next: one action.
+    /// `codePrefix` keeps codes honest per surface (E-LB / E-OR); the neutral default next-step keeps OpenRouter failures from advertising Codex LB recovery actions.
+    func structuredPublicDetail(_ json: [String: Any]?, fallback: String, codePrefix: String = "E-LB", fallbackNext: String = "review the key, model id, and network, then retry") -> String {
+        let code = publicFailureCode(json, codePrefix: codePrefix)
+        let http = publicHttpStatus(json).map { "HTTP \($0)" }
+        let transport = publicAuthTransport(json)
+        let error = publicError(json)
+        var parts: [String] = [code]
+        if let http { parts.append(http) }
+        if let transport { parts.append("transport \(transport)") }
+        if let error, !error.isEmpty { parts.append(error) }
         if let blockers = json?["blockers"] as? [String], !blockers.isEmpty {
-            let error = publicError(json).map { " · \($0)" } ?? ""
-            return "Reason: \(blockers.joined(separator: ", ").replacingOccurrences(of: "_", with: " "))\(error). Next: \((json?["hint"] as? String) ?? "review the key, model id, and network, then retry")."
+            parts.append(blockers.prefix(2).joined(separator: ", "))
+        }
+        let next = firstGuidance(json) ?? (json?["hint"] as? String) ?? fallbackNext
+        return "\(parts.joined(separator: " · ")). Next: \(next)."
+    }
+
+    func publicFailureCode(_ json: [String: Any]?, codePrefix: String = "E-LB") -> String {
+        let blockers = json?["blockers"] as? [String] ?? []
+        let truth = json?["routing_truth"] as? [String: Any]
+        let truthBlockers = truth?["blockers"] as? [String] ?? []
+        let all = blockers + truthBlockers
+        if all.contains(where: { $0.contains("auth_rejected") || $0.contains("gateway_auth_rejected") }) {
+            return "\(codePrefix)-AUTH"
+        }
+        if all.contains(where: { $0.contains("unreachable") }) { return "\(codePrefix)-UNREACHABLE" }
+        if all.contains(where: { $0.contains("legacy") && $0.contains("migration") }) { return "\(codePrefix)-LEGACY-MIGRATE" }
+        if let http = publicHttpStatus(json), http >= 400 { return "\(codePrefix)-HTTP-\(http)" }
+        if json == nil || json?["ok"] as? Bool == false { return "\(codePrefix)-FAILED" }
+        return "\(codePrefix)-INFO"
+    }
+
+    func publicHttpStatus(_ json: [String: Any]?) -> Int? {
+        if let value = json?["http_status"] as? Int { return value }
+        if let value = (json?["http_status"] as? NSNumber)?.intValue { return value }
+        let truth = json?["routing_truth"] as? [String: Any]
+        if let value = truth?["http_status"] as? Int { return value }
+        return (truth?["http_status"] as? NSNumber)?.intValue
+    }
+
+    func publicAuthTransport(_ json: [String: Any]?) -> String? {
+        if let value = json?["gateway_auth_transport"] as? String, !value.isEmpty { return value }
+        if let value = json?["auth_transport"] as? String, !value.isEmpty { return value }
+        let truth = json?["routing_truth"] as? [String: Any]
+        if let value = truth?["auth_transport"] as? String, !value.isEmpty { return value }
+        return nil
+    }
+
+    func firstGuidance(_ json: [String: Any]?) -> String? {
+        if let rows = json?["guidance"] as? [String] {
+            return rows.first { !$0.isEmpty }
         }
-        if let error = publicError(json), !error.isEmpty { return "Reason: \(error). Next: review the key, model id, and network, then retry." }
-        if let hint = json?["hint"] as? String, !hint.isEmpty { return "Next: \(hint)." }
-        return "Next: \(NativeView.redactPreview(fallback))"
+        return nil
     }
 
     func publicError(_ json: [String: Any]?) -> String? {

package/dist/native/sks-menubar/Sources/ProvidersReliability.swift

@@ -198,7 +198,7 @@ extension ProvidersViewController {
         }
     }
 
-    func promptForSecretKey(window: NSWindow, sheetTitle: String, sheetMessage: String, placeholder: String, args: [String], kind: String, title: String, credential: SKSKeychainCredential, statusLabel: NSTextField, successSummary: String, failSummary: String) {
+    func promptForSecretKey(window: NSWindow, sheetTitle: String, sheetMessage: String, placeholder: String, args: [String], kind: String, title: String, credential: SKSKeychainCredential, statusLabel: NSTextField, successSummary: String, failSummary: String, codePrefix: String = "E-LB") {
         AlertFactory.textSheet(window: window, title: sheetTitle, message: sheetMessage, secure: true, placeholder: placeholder) { [weak self] key in
             guard let self = self, let key = key else { return }
             guard !self.busy else { statusLabel.stringValue = "Another provider action is already running."; return }
@@ -229,7 +229,7 @@ extension ProvidersViewController {
                     }
                     statusLabel.stringValue = "Configuration saved, but Keychain was not applied · \(reason). Authentication Required: choose Reconnect after repairing Keychain."
                 } else {
-                    statusLabel.stringValue = "\(failSummary) · \(self.structuredPublicDetail(parsed, fallback: result.output))"
+                    statusLabel.stringValue = "\(failSummary) · \(self.structuredPublicDetail(parsed, fallback: result.output, codePrefix: codePrefix))"
                 }
                 self.refresh()
             }
@@ -288,6 +288,7 @@ extension ProvidersViewController {
             let bridgeSelected = expectedMode == "desktop-native-bridge"
             self.desktopFullRoutingNow = false
             self.codexLbSelectedNow = false
+            self.codexLbProvedNow = false
             self.chatgptOauthPresentNow = routing?.chatgptOauthPresent ?? self.chatgptOauthPresentNow
             self.renderActiveProviderSummary()
             if bridgeSelected { self.renderMeasuredRoutingBadge(nil, routeExpected: true) }

package/dist/native/sks-menubar/Sources/ProvidersViewController.swift

@@ -55,6 +55,9 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
     var capabilityRows: [String: NSTextField] = [:]
     var desktopFullRoutingNow = false
     var codexLbSelectedNow = false
+    // True only after a measured verified route or a live connection proof, so
+    // unrelated status probes never downgrade a proven badge to "unproved".
+    var codexLbProvedNow = false
     var chatgptOauthPresentNow = false
     var openRouterSelectedNow = false
     var openRouterCredentialValidatedNow = false
@@ -115,17 +118,11 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
         providerApplyStatus.setAccessibilityIdentifier("sks-center-provider-apply-status")
         providerApplyStatus.setAccessibilityLabel("Provider apply stage receipts")
         actionButtons = [enableDesktop, verifyDesktop, disableDesktop, configureCli, reconnectOpenRouter, openCodexSignIn, useCli, testCli, copyCli, fastOn, fastOff]
-        let desktop = NativeView.card(
-            title: "Advanced · Desktop Bridge / ChatGPT Identity Mode",
-            subtitle: "Optional bridge mode: keeps ChatGPT OAuth identity and the built-in OpenAI provider while routing model traffic through the local codex-lb bridge. Use ChatGPT OAuth Only removes bridge routing without touching login.",
-            views: [providerStatus, ControlKit.actionRow([enableDesktop, verifyDesktop], trailing: [disableDesktop])]
-        )
         let cli = NativeView.card(
             title: "Codex LB · Credentials & Primary Provider",
-            subtitle: "Saves the official Center Codex LB host and API key (sks-codex-lb store). Use Codex LB applies the atomic CLI provider path — no shell source or twin env files.",
+            subtitle: "Saves host + API key, then Use Codex LB selects the atomic CLI provider (Authorization: Bearer via CODEX_LB_API_KEY). No transport picker.",
             views: [
                 cliProviderStatus, codexLbKeychainStatus,
-                NativeView.detail("One-off command: \(cliLaunchCommand)"),
                 ControlKit.actionRow([configureCli, useCli]),
                 makeCliConnectProgressView(),
                 ControlKit.actionRow([testCli, copyCli])
@@ -142,19 +139,24 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
         )
         view = NativeView.page([
             NativeView.row([NativeView.title("Providers & Models"), globalSpinner]),
-            NativeView.detail("Codex always sees its native OpenAI identity through a local loopback proxy. SKS selects exactly one internal mode: Codex LB, OpenRouter, or ChatGPT OAuth. Secrets are sent through stdin and never written to operation logs."),
-            NativeView.card(
-                title: "Authentication Recovery",
-                subtitle: "Background refresh and menu restarts never open authentication UI. Missing, locked, damaged, or inaccessible credentials stay in an Authentication Required state until you choose a reconnect action.",
-                views: [codexLbKeychainStatus, openRouterKeychainStatus, oauthCredentialStatus, NativeView.row([configureCli, reconnectOpenRouter, openCodexSignIn])]
-            ),
+            NativeView.detail("SKS selects one provider path: Codex LB (Authorization: Bearer), OpenRouter, or ChatGPT OAuth. Secrets go through stdin and are never written to operation logs."),
+            makeActiveProviderCard(),
+            cli,
+            makeOpenRouterCard(),
             NativeView.card(
-                title: "Provider Apply Stages",
-                subtitle: "Configuration, proxy, catalog, and new-session readiness are independent. Existing sessions keep their pinned copy; a partial failure never appears as silent success.",
-                views: [providerApplyStatus]
+                title: "Advanced",
+                subtitle: "You rarely need this section. Desktop Bridge is only for keeping ChatGPT sign-in while routing through codex-lb (or a custom-header-only gateway) — if Use Codex LB above works, skip it.",
+                views: [
+                    oauthCredentialStatus,
+                    NativeView.row([openCodexSignIn]),
+                    providerStatus,
+                    ControlKit.actionRow([enableDesktop, verifyDesktop], trailing: [disableDesktop]),
+                    providerApplyStatus,
+                    makeCapabilityMatrixCard()
+                ]
             ),
-            makeActiveProviderCard(), cli, desktop, makeCapabilityMatrixCard(), makeOpenRouterCard(),
-            makeRoleModelsCard(), fast
+            makeRoleModelsCard(),
+            fast
         ])
     }
     func refreshOnAppear() { refresh() }
@@ -211,8 +213,20 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
                 : "Authentication Required: ChatGPT OAuth is not connected. Choose Open Codex sign-in; no login window was opened automatically."
             self.oauthCredentialStatus.textColor = snapshot.chatgptOauthPresent ? .secondaryLabelColor : .systemOrange
             self.renderCatalogSyncStatus(json)
-            self.renderActiveProviderSummary()
-            self.renderMeasuredRoutingBadge(measuredRoute, routeExpected: snapshot.desktopFullRouting || snapshot.legacyCodexLbSelected)
+            self.codexLbProvedNow = snapshot.mode == "cli-provider" && measuredRoute?.active == true
+            // Single decision ladder — exactly one badge writer per refresh.
+            if snapshot.legacyCodexLbSelected {
+                ControlKit.setBadge(self.activeProviderBadge, text: "E-LB-LEGACY-MIGRATE · run migrate-legacy-desktop", tone: .warning)
+            } else if snapshot.mode == "cli-provider", let route = measuredRoute, route.selected, !route.active {
+                let authFail = route.status == "auth_rejected" || route.blockers.contains(where: { $0.contains("auth") })
+                let code = authFail ? "E-LB-AUTH" : "E-LB-DEGRADED"
+                let http = route.httpStatus.map { "HTTP \($0)" } ?? route.status
+                ControlKit.setBadge(self.activeProviderBadge, text: "Codex LB · CLI · \(code) · \(http)", tone: .warning)
+            } else if snapshot.desktopFullRouting {
+                self.renderMeasuredRoutingBadge(measuredRoute, routeExpected: true)
+            } else {
+                self.renderActiveProviderSummary()
+            }
             if !self.busy {
                 self.providerStatus.stringValue = self.describeDesktopStatus(snapshot)
                 self.cliProviderStatus.stringValue = self.describeCliStatus(snapshot, measuredRoute: measuredRoute)
@@ -242,7 +256,10 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
             let oauth = snapshot.chatgptOauthPresent
                 ? "ChatGPT OAuth present"
                 : "ChatGPT OAuth missing — sign in with ChatGPT"
-            return "Codex LB mode: enabled · \(oauth) · built-in OpenAI via bridge. Run Verify Capabilities for evidence."
+            return "Desktop Bridge mode: enabled · \(oauth) · built-in OpenAI via bridge. Run Verify Capabilities for evidence."
+        }
+        if snapshot.mode == "cli-provider" {
+            return "Desktop Bridge: off · the Codex LB CLI provider path handles routing, so the bridge is not used. Desktop Bridge Mode stays an optional alternative."
         }
         if snapshot.mode == "disabled" {
             return snapshot.chatgptOauthPresent
@@ -357,23 +374,9 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
     }
     @objc private func setDomainAndKey() {
         guard let window = view.window else { return }
-        AlertFactory.textSheet(window: window, title: "Codex LB Domain", message: "Enter a hostname or full base URL. https:// is optional — SKS adds https:// and /backend-api/codex when missing.\nExamples: lb.example.com  or  https://lb.example.com", secure: false, placeholder: "https://lb.example.com") { [weak self] host in
+        AlertFactory.textSheet(window: window, title: "Codex LB Domain", message: "Enter a hostname or full base URL. https:// is optional — SKS adds https:// and /backend-api/codex when missing.\nExamples: lb.example.com  or  https://lb.example.com\n\nSKS always sends the API key as Authorization: Bearer (Codex env_key). There is no custom-header transport picker.", secure: false, placeholder: "https://lb.example.com") { [weak self] host in
             guard let self = self, let host = host else { return }
-            // The transport is an explicit operator choice, never guessed: a gateway
-            // that wants `Authorization: Bearer` rejects the custom header with 401,
-            // which Desktop surfaces as "codex-lb auth not recognized".
-            AlertFactory.choiceSheet(
-                window: window,
-                title: "Codex LB Gateway Key Transport",
-                message: "How does this codex-lb gateway expect the API key? Choose Authorization bearer if the gateway answers 401 \"Missing API key in Authorization header\" to the custom header.",
-                choices: [
-                    ("custom-header", "X-Codex-LB-API-Key custom header (default)"),
-                    ("bearer-compat", "Authorization: Bearer compatibility")
-                ]
-            ) { [weak self] transport in
-                guard let self = self, let transport = transport else { return }
-                self.promptForKey(window: window, args: ["codex-lb", "setup", "--host", host, "--gateway-auth", transport, "--api-key-stdin", "--yes", "--write-env-file", "--json"], kind: "codex-lb-center-setup", title: "Save Codex LB credentials")
-            }
+            self.promptForKey(window: window, args: ["codex-lb", "setup", "--host", host, "--gateway-auth", "bearer-compat", "--api-key-stdin", "--yes", "--write-env-file", "--json"], kind: "codex-lb-center-setup", title: "Save Codex LB credentials")
         }
     }
     private func promptForKey(window: NSWindow, args: [String], kind: String, title: String) {
@@ -448,20 +451,23 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
             _ = self.operations.update(snapshot, state: ok ? .succeeded : .failed, stage: "complete", progress: 1, summary: ok ? "CLI provider configured" : "CLI provider configuration needs action")
             guard ok else {
                 self.setBusy(false)
-                let detail = self.structuredPublicDetail(parsed, fallback: result.output)
+                // structuredPublicDetail already leads with the stable code.
+                let detail = self.structuredPublicDetail(parsed, fallback: result.output, fallbackNext: "Reconnect Codex LB credential, then Use Codex LB / Run Connect Test")
+                let code = self.publicFailureCode(parsed)
                 self.cliProviderStatus.stringValue = "CLI provider was not confirmed · \(detail)"
                 self.renderCliConnectStages(
                     progress: 1,
-                    configuration: "failed",
+                    configuration: "failed · \(code)",
                     request: "not run",
                     response: "not received",
-                    result: "Codex LB mode was not confirmed. Connection proof did not run.",
+                    result: detail,
                     tone: .systemRed
                 )
                 return
             }
             self.setBusy(false)
             self.codexLbSelectedNow = true
+            self.codexLbProvedNow = false
             self.desktopFullRoutingNow = false
             self.openRouterSelectedNow = false
             self.routerSelectedNow = false

package/dist/scripts/codex-lb-fast-mode-truth-check.js

@@ -16,7 +16,7 @@ await fs.writeFile(path.join(home, '.codex', 'config.toml'), [
     'name = "codex-lb"',
     'base_url = "https://lb.example.test/backend-api/codex"',
     'wire_api = "responses"',
-    'env_http_headers = { "X-Codex-LB-API-Key" = "CODEX_LB_API_KEY" }',
+    'env_key = "CODEX_LB_API_KEY"',
     'supports_websockets = true',
     'requires_openai_auth = false',
     ''
@@ -44,7 +44,7 @@ const requestedOnly = await runFastCheck({
 const ok = chain.ok === true
     && chain.status === 'fast_verified'
     && calls[0]?.body?.service_tier === 'priority'
-    && calls.every((call) => call.authorization === null && call.gatewayKey === 'sk-fixture')
+    && calls.every((call) => call.authorization === 'Bearer sk-fixture' && call.gatewayKey === null)
     && requestedOnly.ok === false
     && requestedOnly.status === 'fast_requested_but_actual_unverified'
     && requestedOnly.blockers.includes('codex_lb_actual_fast_service_tier_unverified');
@@ -52,7 +52,7 @@ console.log(JSON.stringify({
     schema: 'sks.codex-lb-fast-mode-truth-check.v1',
     ok,
     priority_request_sent: calls[0]?.body?.service_tier === 'priority',
-    custom_header_transport_verified: calls.every((call) => call.authorization === null && call.gatewayKey === 'sk-fixture'),
+    bearer_transport_verified: calls.every((call) => call.authorization === 'Bearer sk-fixture' && call.gatewayKey === null),
     verified_case: chain,
     requested_only_case: requestedOnly,
     blockers: ok ? [] : ['codex_lb_fast_mode_truth_check_failed']

package/dist/scripts/codex-lb-fast-ui-preservation-check.js

@@ -124,9 +124,9 @@ function assertConfig(text, label, options = {}) {
         ...(hasTable(text, 'model_providers.codex-lb') ? [] : ['codex_lb_provider_table_missing']),
         ...(tableKey(text, 'model_providers.codex-lb', 'name') === 'codex-lb' ? [] : ['cli_provider_name_not_codex_lb']),
         ...(tableKey(text, 'model_providers.codex-lb', 'requires_openai_auth') === 'false' ? [] : ['cli_provider_requires_openai_auth_not_false']),
-        ...(tableEnvHttpHeader(text, 'model_providers.codex-lb', 'X-Codex-LB-API-Key') === 'CODEX_LB_API_KEY'
+        ...(tableKey(text, 'model_providers.codex-lb', 'env_key') === 'CODEX_LB_API_KEY'
             ? []
-            : ['cli_provider_gateway_header_env_missing']),
+            : ['cli_provider_env_key_missing']),
         ...(topLevelKey(text, 'model_provider') === 'openai' ? [] : ['desktop_model_provider_must_be_openai']),
         ...(expectBridge && topLevelKey(text, 'openai_base_url') !== bridgeBaseUrl ? ['native_bridge_base_url_missing'] : []),
         ...(!expectBridge && topLevelKey(text, 'openai_base_url') ? ['disabled_routing_still_has_openai_base_url'] : []),
@@ -141,13 +141,6 @@ function hasLegacyFastModeTables(text) {
 function hasTable(text, table) {
     return new RegExp(`(^|\\n)\\[${escapeRegExp(table)}\\](?=\\n|$)`).test(text);
 }
-function tableEnvHttpHeader(text, table, header) {
-    const tableMatch = text.match(new RegExp(`(^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`));
-    const body = tableMatch?.[2] || '';
-    const match = body.match(/(?:^|\n)\s*env_http_headers\s*=\s*\{([^}]*)\}/);
-    const entries = match?.[1] || '';
-    return entries.match(new RegExp(`"${escapeRegExp(header)}"\\s*=\\s*"([^"]+)"`))?.[1] || '';
-}
 function tableKey(text, table, key) {
     const match = text.match(new RegExp(`(^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`));
     const block = match?.[2] || '';

package/dist/scripts/codex-lb-gpt56-fast-profile-check.js

@@ -152,9 +152,9 @@ function assertFastProfile(text, label, expectBridge = true) {
         ...(parsed.model_provider === 'openai' ? [] : ['desktop_model_provider_must_be_openai']),
         ...(provider.name === 'codex-lb' ? [] : ['codex_lb_cli_provider_name_mismatch']),
         ...(provider.requires_openai_auth === false ? [] : ['codex_lb_cli_requires_openai_auth_not_false']),
-        ...(provider.env_http_headers?.['X-Codex-LB-API-Key'] === 'CODEX_LB_API_KEY'
+        ...(provider.env_key === 'CODEX_LB_API_KEY'
             ? []
-            : ['codex_lb_cli_gateway_header_env_missing']),
+            : ['codex_lb_cli_env_key_missing']),
         ...(provider.wire_api === 'responses' ? [] : ['codex_lb_wire_api_not_responses']),
         ...(expectBridge && parsed.openai_base_url === bridgeBaseUrl ? [] : expectBridge ? ['native_bridge_base_url_missing'] : []),
         ...(!expectBridge && parsed.openai_base_url !== undefined ? ['disabled_routing_still_has_openai_base_url'] : []),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.1.0",
+  "version": "8.1.2",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",