sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-app/menubar/installer.js

@@ -1,33 +1,25 @@
-import os from 'node:os';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { ensureDir, exists, PACKAGE_VERSION, readJson, readText, runProcess, sha256, which, writeJsonAtomic, writeTextAtomic } from '../../fsx.js';
 import { actionScriptSource } from './action-runner.js';
 import { buildMenuBarAppStaging, MenuBarBuildError } from './app-bundle.js';
 import { aggregateFileHashes, createSksMenuBarBuildStamp, menuBarBuildStampsEqual } from './build-stamp.js';
-import { MENU_ITEMS, SKS_MENUBAR_LABEL } from './constants.js';
+import { SKS_MENUBAR_LABEL } from './constants.js';
 import { resolveCodexBundleId, writeDefaultMenuBarConfig } from './config.js';
 import { applyMenuBarGenerationTransaction, commitMenuBarGenerationTransaction, installGenerationPairs, MenuBarGenerationTransactionError, recoverMenuBarGenerationTransaction, rollbackGenerationPairs } from './generation-transaction.js';
 import { launchAgentSource, launchMenuBar, inspectRunningMenuBarProcess, seedMenuBarPreferredPosition, stopMenuBarForReplacement, terminateMenuBarProcesses } from './launch-agent.js';
 import { cleanupProjectMenuBarDuplicates, verifiedProjectMenuBarDuplicateExecutablePaths } from './global-install.js';
-import { cleanupMacLaunchSecretEnvironment, cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings } from './migration.js';
+import { cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings } from './migration.js';
 import { sksMenuBarPaths } from './paths.js';
 import { infoPlistSource, inspectInstalledResources, loadNativeMenuBarSources, nativeResourceHashes } from './resources.js';
 import { inspectMenuBarArtifactSet, normalizeLegacyMenuBarBuildStamp, rollbackSksMenuBar } from './rollback.js';
 import { inspectSignature } from './signature.js';
-import { defaultNextActions, inspectSksMenuBarStatus, isMenuBarInstallPathUnderTempDir } from './status.js';
+import { inspectSksMenuBarStatus, isMenuBarInstallPathUnderTempDir } from './status.js';
+import { baseResult, writeReport } from './installer/result.js';
+import { realUserHome, resolveSksEntryForInstall, toolVersion } from './installer/runtime.js';
 export function sksMenuBarRestartDeferred(env = process.env) {
     return env.SKS_UPDATE_DEFER_MENUBAR_RESTART === '1'
         || env.SKS_SKIP_SKS_MENUBAR_LAUNCH === '1';
 }
-export function menuBarCredentialEnvironmentBlocker(input) {
-    if (!input.cleanupOk)
-        return 'launch_secret_env_cleanup_incomplete';
-    if (input.compatibilityConfigured && input.compatibilityRestored !== true) {
-        return 'desktop_compat_launch_env_restore_incomplete';
-    }
-    return null;
-}
 export async function installSksMenuBar(opts = {}) {
     const apply = opts.apply === true;
     const env = opts.env || process.env;
@@ -36,7 +28,6 @@ export async function installSksMenuBar(opts = {}) {
     const warnings = [];
     let targetCheck;
     let codexBundleId = null;
-    let cleanup;
     let transaction = null;
     if (process.platform !== 'darwin') {
         const result = baseResult(paths, apply, 'unsupported_platform', true, actions, ['sks_menubar_requires_macos']);
@@ -104,42 +95,6 @@ export async function installSksMenuBar(opts = {}) {
     if (retiredBindings.status === 'quarantined') {
         actions.push(`quarantined ${retiredBindings.retired_binding_count} retired remote bridge binding(s)`);
     }
-    const injectedTestLaunchctl = (env.SKS_TEST_FORBID_REAL_HOME === '1'
-        || env.SKS_TEST_ISOLATION === '1')
-        ? env.SKS_MENUBAR_LAUNCHCTL
-        : undefined;
-    cleanup = await cleanupMacLaunchSecretEnvironment({
-        env,
-        ...(injectedTestLaunchctl ? { launchctlBin: injectedTestLaunchctl } : {})
-    });
-    const cleanupBlocker = menuBarCredentialEnvironmentBlocker({ cleanupOk: cleanup.ok });
-    if (cleanupBlocker) {
-        return blocked(cleanupBlocker, 'Global GUI secret environment cleanup could not be verified.');
-    }
-    try {
-        const { syncDesktopCenterLaunchCredentials } = await import('../../codex-lb/desktop-center-credentials.js');
-        const { CODEX_LB_DESKTOP_COMPAT_MARKER } = await import('../../../cli/install-helpers-codex-lb-config.js');
-        const { readText } = await import('../../fsx.js');
-        const configText = await readText(path.join(paths.home, '.codex', 'config.toml'), '');
-        if (configText.includes(CODEX_LB_DESKTOP_COMPAT_MARKER)) {
-            const restored = await syncDesktopCenterLaunchCredentials({
-                mode: 'desktop-dual-auth-compat',
-                home: paths.home,
-                ...(injectedTestLaunchctl ? { launchctlBin: injectedTestLaunchctl } : {})
-            });
-            const restoreBlocker = menuBarCredentialEnvironmentBlocker({
-                cleanupOk: true,
-                compatibilityConfigured: true,
-                compatibilityRestored: restored.ok
-            });
-            if (restoreBlocker) {
-                return blocked(restored.blockers[0] || restoreBlocker, 'Desktop compatibility cannot be restored without exposing a global GUI secret; use the local bridge.');
-            }
-        }
-    }
-    catch (error) {
-        return blocked('desktop_compat_launch_env_restore_failed', error instanceof Error ? error.message : String(error));
-    }
     const swiftc = env.SKS_MENUBAR_SWIFTC || await which('swiftc').catch(() => null) || '/usr/bin/swiftc';
     const codesign = env.SKS_MENUBAR_CODESIGN || await which('codesign').catch(() => null) || '/usr/bin/codesign';
     const launchctl = env.SKS_MENUBAR_LAUNCHCTL || await which('launchctl').catch(() => null) || '/bin/launchctl';
@@ -420,7 +375,6 @@ export async function installSksMenuBar(opts = {}) {
     result.build_stamp = rollback?.ok
         ? await readJson(paths.build_stamp_path, null)
         : stamp;
-    result.secret_env_cleanup = cleanup;
     result.launch = launch;
     result.installed_version = result.build_stamp?.package_version || null;
     if (launch.version_probe) {
@@ -441,8 +395,6 @@ export async function installSksMenuBar(opts = {}) {
         result.codex_bundle_id = codexBundleId;
         if (targetCheck)
             result.target_check = targetCheck;
-        if (cleanup)
-            result.secret_env_cleanup = cleanup;
         result.rollback = rollback;
         result.transaction = failedTransaction;
         result.blockers = [reason, ...(rollback && !rollback.ok ? rollback.blockers : [])];
@@ -457,46 +409,3 @@ export function shouldAutoRollbackMenuBarLaunch(input) {
         && !input.upToDate
         && input.rollbackCandidateExists;
 }
-function baseResult(paths, apply, status, ok, actions, warnings) {
-    return {
-        schema: 'sks.codex-app-sks-menubar.v1', ok, apply, status, platform: process.platform,
-        app_path: paths.app_path, executable_path: paths.executable_path,
-        launch_agent_path: paths.launch_agent_path, action_script_path: paths.action_script_path,
-        build_stamp_path: paths.build_stamp_path, config_path: paths.config_path,
-        report_path: paths.report_path, menu_items: [...MENU_ITEMS], actions,
-        tcc_automation_status: 'unknown', next_actions: defaultNextActions(), blockers: [], warnings
-    };
-}
-async function resolveSksEntryForInstall(explicit, root) {
-    const packaged = fileURLToPath(new URL('../../../bin/sks.js', import.meta.url));
-    const requested = explicit ? path.resolve(explicit) : null;
-    const candidate = requested || packaged;
-    const found = await exists(candidate);
-    const relative = path.relative(path.resolve(root), candidate);
-    return {
-        requested, resolved: found ? candidate : null, packaged, exists: found,
-        project_local: relative === '' || (Boolean(relative) && !relative.startsWith('..') && !path.isAbsolute(relative)),
-        used_previous_script: false
-    };
-}
-async function toolVersion(tool, args) {
-    const result = await runProcess(tool, args, { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => ({ code: 1, stdout: '', stderr: '' }));
-    return result.code === 0 ? String(result.stdout || result.stderr).trim().split(/\r?\n/)[0] || 'unknown' : 'unknown';
-}
-function realUserHome() {
-    try {
-        return path.resolve(os.userInfo().homedir);
-    }
-    catch {
-        return path.resolve(os.homedir());
-    }
-}
-async function writeReport(reportPath, result) {
-    try {
-        await writeJsonAtomic(reportPath, result);
-    }
-    catch {
-        result.report_write_failed = true;
-        result.warnings.push('menubar_report_write_failed');
-    }
-}

package/dist/core/codex-app/menubar/migration.js

@@ -1,8 +1,7 @@
 import os from 'node:os';
 import path from 'node:path';
-import { exists, nowIso, readText, runProcess, sha256, which, writeTextAtomic } from '../../fsx.js';
+import { nowIso, readText, runProcess, sha256, which, writeTextAtomic } from '../../fsx.js';
 import { ensureConfinedDirectory, inspectConfinedPath, removeManagedPathVerified } from '../../managed-path-safety.js';
-import { SECRET_LAUNCH_ENV_KEYS } from './constants.js';
 const RETIRED_REMOTE_BRIDGE_LABEL = 'com.sneakoscope.telegram-hub';
 export async function cleanupRetiredRemoteBridgeLaunchAgent(opts = {}) {
     const env = opts.env || process.env;
@@ -226,46 +225,6 @@ export function isManagedRetiredRemoteBridgeLaunchAgent(source) {
         && /<string>\/usr\/bin\/caffeinate<\/string>/.test(source)
         && /<string>telegram<\/string>\s*<string>hub<\/string>\s*<string>run<\/string>/.test(source);
 }
-export async function cleanupMacLaunchSecretEnvironment(opts = {}) {
-    if (process.platform !== 'darwin' && !opts.force) {
-        return { ok: true, status: 'not_macos', variables: [...SECRET_LAUNCH_ENV_KEYS], cleaned: [], failed: [], next_actions: [] };
-    }
-    const env = opts.env || process.env;
-    const launchctl = opts.launchctlBin
-        || (await exists('/bin/launchctl') ? '/bin/launchctl' : null);
-    if (!launchctl) {
-        return {
-            ok: false, status: 'launchctl_missing', variables: [...SECRET_LAUNCH_ENV_KEYS], cleaned: [],
-            failed: SECRET_LAUNCH_ENV_KEYS.map((key) => ({ key, error: 'launchctl_missing' })),
-            next_actions: SECRET_LAUNCH_ENV_KEYS.map((key) => `Run: launchctl unsetenv ${key}`)
-        };
-    }
-    const cleaned = [];
-    const failed = [];
-    const childEnv = { ...env };
-    for (const key of SECRET_LAUNCH_ENV_KEYS)
-        delete childEnv[key];
-    const run = opts.runProcessImpl || runProcess;
-    for (const key of SECRET_LAUNCH_ENV_KEYS) {
-        const result = await run(launchctl, ['unsetenv', key], {
-            timeoutMs: 3_000,
-            maxOutputBytes: 8 * 1024,
-            env: childEnv,
-            envMode: 'replace'
-        })
-            .catch((error) => ({ code: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error) }));
-        if (result.code === 0)
-            cleaned.push(key);
-        else
-            failed.push({ key, error: String(result.stderr || result.stdout || 'launchctl unsetenv failed').trim() });
-    }
-    return {
-        ok: failed.length === 0,
-        status: failed.length === 0 ? 'cleaned' : 'partial',
-        variables: [...SECRET_LAUNCH_ENV_KEYS], cleaned, failed,
-        next_actions: ['Rotate credentials if they were previously exposed in the launchd environment.']
-    };
-}
 function processFailure(error) {
     return {
         code: 1,

package/dist/core/codex-app/openrouter-provider.js

@@ -1,73 +1,4 @@
-export const OPENROUTER_PROVIDER_ID = 'openrouter';
 export const OPENROUTER_DEFAULT_MODEL = 'z-ai/glm-5.2';
-export const OPENROUTER_DEFAULT_PROFILE_ID = 'sks-openrouter-default';
-export const OPENROUTER_DEFAULT_PROFILE_LABEL = 'OpenRouter (SKS)';
-export const OPENROUTER_AUTH_COMMAND = '/bin/sh';
-export const OPENROUTER_AUTH_SCRIPT = 'if [ -r "$1" ]; then exec /bin/cat "$1"; elif [ -n "${OPENROUTER_API_KEY:-}" ]; then exec /usr/bin/printf "%s\\n" "$OPENROUTER_API_KEY"; elif [ -n "${SKS_OPENROUTER_API_KEY:-}" ]; then exec /usr/bin/printf "%s\\n" "$SKS_OPENROUTER_API_KEY"; else exit 1; fi';
-export const OPENROUTER_AUTH_TIMEOUT_MS = 5_000;
-export const OPENROUTER_AUTH_REFRESH_INTERVAL_MS = 300_000;
-export function openRouterAuthCommandArgs(keyPath) {
-    return ['-c', OPENROUTER_AUTH_SCRIPT, 'sks-openrouter-auth', keyPath];
-}
-export const GLM_52_OPENROUTER_MODEL = OPENROUTER_DEFAULT_MODEL;
-export const GLM_CODEX_CONFIG_PROVIDER_ID = OPENROUTER_PROVIDER_ID;
-export const GLM_CODEX_CONFIG_PROFILE_ID = 'sks-glm-52-mad';
-export const GLM_CODEX_APP_PROFILE_ID = 'sks/glm-5.2-mad';
-export const GLM_CODEX_APP_PROFILE_LABEL = 'GLM 5.2 (OpenRouter)';
-export const RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS = [
-    'sks-glm-52-mad',
-    'sks-glm-52-minimal',
-    'sks-glm-52-low',
-    'sks-glm-52-medium',
-    'sks-glm-52-high',
-    'sks-glm-52-xhigh'
-];
-export const OPENROUTER_SELECTABLE_REASONING_EFFORTS = [
-    'none',
-    'minimal',
-    'low',
-    'medium',
-    'high',
-    'xhigh',
-];
-export const GLM_CODEX_SELECTABLE_REASONING_EFFORTS = OPENROUTER_SELECTABLE_REASONING_EFFORTS;
-export const OPENROUTER_CODEX_REASONING_PROFILES = [];
-export const GLM_CODEX_CONFIG_REASONING_PROFILES = OPENROUTER_CODEX_REASONING_PROFILES;
-export function buildGlmCodexAppModelProfile() {
-    return {
-        schema: 'sks.codex-app-model-profile.v1',
-        id: OPENROUTER_DEFAULT_PROFILE_ID,
-        label: OPENROUTER_DEFAULT_PROFILE_LABEL,
-        provider: 'openrouter',
-        model: OPENROUTER_DEFAULT_MODEL,
-        codexConfigProvider: OPENROUTER_PROVIDER_ID,
-        codexConfigProfile: OPENROUTER_DEFAULT_PROFILE_ID,
-        supportedReasoningEfforts: OPENROUTER_SELECTABLE_REASONING_EFFORTS,
-        reasoningProfiles: OPENROUTER_CODEX_REASONING_PROFILES,
-        mode: 'openrouter-desktop',
-        strictModelLock: false,
-        gptFallbackAllowed: false,
-        requiresSecret: 'openrouter-api-key',
-        defaultProfile: 'speed',
-        defaultSettings: {
-            temperature: 0.2,
-            top_p: 0.85,
-            reasoning_effort: null,
-            tool_choice: 'none',
-            parallel_tool_calls: false,
-            max_tokens: 4096,
-            provider_sort: 'throughput',
-            provider_allow_fallbacks: false,
-            provider_require_parameters: false,
-        },
-        codexCompatibility: {
-            target: 'rust-v0.146.0',
-            selectedExecutorPluginMcp: 'defer-to-codex-native',
-            duplicateAppMcpDeclarations: 'dedupe-by-codex',
-            cwdShellPathSemantics: 'preserve-codex-native',
-        },
-    };
-}
 export function normalizeOpenRouterModelId(value) {
     const model = String(value || '').trim();
     if (!model)
@@ -78,12 +9,3 @@ export function normalizeOpenRouterModelId(value) {
         return null;
     return model;
 }
-export function retiredGlmDesktopProfileBody(effort) {
-    return [
-        'model_provider = "openrouter"',
-        `model = "${OPENROUTER_DEFAULT_MODEL}"`,
-        `model_reasoning_effort = "${effort}"`,
-        'service_tier = "default"',
-        'approval_policy = "on-request"'
-    ].join('\n');
-}