sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-control/codex-sdk-adapter.js

@@ -1,4 +1,3 @@
-import os from 'node:os';
 import path from 'node:path';
 import { appendJsonlBounded } from '../fsx.js';
 import { buildCodexExecutionPolicy, buildCodexSdkConfig } from './codex-sdk-config-policy.js';
@@ -6,7 +5,6 @@ import { buildCodexSdkEnv } from './codex-sdk-env-policy.js';
 import { translateCodexSdkEvent } from './codex-event-translator.js';
 import { codexTimeoutClassForRoute } from './codex-reliability-shield.js';
 import { resolveOfficialCodexPackageRuntime } from '../codex-runtime/resolve-codex-runtime.js';
-import { codexLbToolCatalogPath, ensureCodexLbToolCatalog, isCodexLbGpt56Model } from '../codex-lb/codex-lb-tool-catalog.js';
 export async function runRealCodexSdkTask(input, policy) {
     if (codexSdkTurnTimeoutMs(input) <= 0) {
         return {
@@ -31,30 +29,11 @@ export async function runRealCodexSdkTask(input, policy) {
     const Codex = mod.Codex || mod.default?.Codex || mod.default;
     if (typeof Codex !== 'function')
         throw new Error('Codex SDK export Codex not found');
-    const toolCatalog = await prepareCodexLbToolCatalog(input, policy);
-    if (toolCatalog.required && !toolCatalog.ok) {
-        return {
-            ok: false,
-            sdkThreadId: '',
-            sdkRunId: null,
-            events: [],
-            finalResponse: '',
-            structuredOutput: null,
-            blockers: [...new Set(['codex_lb_gpt56_tool_catalog_unavailable', ...(toolCatalog.blockers || [])])],
-            liveEventsWritten: false,
-            runtimeIdentity: runtime.identity,
-            executionPolicy: buildCodexExecutionPolicy(input),
-            raw: { tool_catalog: toolCatalog }
-        };
-    }
     const executionPolicy = buildCodexExecutionPolicy(input);
-    const runtimeConfig = toolCatalog.ok && toolCatalog.path
-        ? { ...policy.config, model_catalog_json: toolCatalog.path }
-        : policy.config;
     const codex = new Codex({
         codexPathOverride: runtime.identity.realpath,
         env: policy.env,
-        config: runtimeConfig
+        config: policy.config
     });
     const threadOptions = {
         workingDirectory: input.cwd,
@@ -85,7 +64,7 @@ export async function runRealCodexSdkTask(input, policy) {
             liveEventsWritten,
             runtimeIdentity: runtime.identity,
             executionPolicy,
-            raw: { aborted: true, hard_deadline_exceeded: true, tool_catalog: toolCatalog }
+            raw: { aborted: true, hard_deadline_exceeded: true }
         };
     }
     const controller = new AbortController();
@@ -121,7 +100,7 @@ export async function runRealCodexSdkTask(input, policy) {
             liveEventsWritten,
             runtimeIdentity: runtime.identity,
             executionPolicy,
-            raw: { timeout_ms: timeoutMs, aborted: true, tool_catalog: toolCatalog }
+            raw: { timeout_ms: timeoutMs, aborted: true }
         };
     }
     finally {
@@ -140,7 +119,7 @@ export async function runRealCodexSdkTask(input, policy) {
             liveEventsWritten,
             runtimeIdentity: runtime.identity,
             executionPolicy,
-            raw: { failed_event: failed, tool_catalog: toolCatalog }
+            raw: { failed_event: failed }
         };
     }
     const structuredOutput = parseStructuredOutput(finalResponse, Boolean(input.outputSchema));
@@ -155,7 +134,7 @@ export async function runRealCodexSdkTask(input, policy) {
         runtimeIdentity: runtime.identity,
         executionPolicy,
         liveEventsWritten,
-        raw: { item_count: events.filter((event) => String(event?.type || '').startsWith('item.')).length, tool_catalog: toolCatalog }
+        raw: { item_count: events.filter((event) => String(event?.type || '').startsWith('item.')).length }
     };
 }
 export async function resolveCodexSdkRuntime(_input) {
@@ -166,28 +145,6 @@ export function codexSdkRuntimePolicies(input) {
     const config = buildCodexSdkConfig(input);
     return { env, config };
 }
-async function prepareCodexLbToolCatalog(input, policy) {
-    const provider = String(policy.config.model_provider || '');
-    const model = String(policy.config.model || input.model || '');
-    if (provider !== 'codex-lb' || !isCodexLbGpt56Model(model)) {
-        return { schema: 'sks.codex-lb-tool-catalog.v1', ok: true, required: false, status: 'not_required', path: null, blockers: [] };
-    }
-    const providers = policy.config.model_providers;
-    const baseUrl = String(providers?.['codex-lb']?.base_url || policy.env.CODEX_LB_BASE_URL || '');
-    const apiKey = String(policy.env.CODEX_LB_API_KEY || '');
-    const isolatedCodexHome = String(policy.env.CODEX_HOME || '');
-    if (!isolatedCodexHome) {
-        return { schema: 'sks.codex-lb-tool-catalog.v1', ok: false, required: true, status: 'blocked', path: null, blockers: ['codex_sdk_isolated_codex_home_missing'] };
-    }
-    const sharedCodexHome = String(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'));
-    return ensureCodexLbToolCatalog({
-        codexHome: isolatedCodexHome,
-        outputPath: codexLbToolCatalogPath(sharedCodexHome),
-        baseUrl,
-        apiKey,
-        timeoutMs: 5000
-    });
-}
 export function codexSdkTurnTimeoutMs(input, nowMs = Date.now()) {
     const explicit = Number(process.env.SKS_CODEX_SDK_TURN_TIMEOUT_MS);
     const timeoutClass = codexTimeoutClassForRoute(input.route, input.reliabilityPolicy?.timeoutClass || (input.tier === 'orchestrator' ? 'long' : 'standard'));

package/dist/core/codex-control/codex-task-runner.js

@@ -1,7 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { appendJsonlBounded, ensureDir, nowIso, packageRoot, writeJsonAtomic } from '../fsx.js';
-import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
 import { validateJsonSchemaRecursive } from '../json-schema-validator.js';
 import { resolveCodexOutputSchema } from './codex-output-schemas.js';
 import { detectCodexSdkCapability } from './codex-sdk-capability.js';
@@ -18,7 +17,7 @@ import { readLocalModelConfig } from '../agents/ollama-worker-config.js';
 import { runLocalLlmTask } from '../local-llm/local-llm-control-adapter.js';
 import { detectPythonCodexSdkCapability, runPythonCodexSdkTask } from './python-codex-sdk-adapter.js';
 import { defaultModelCallBudget, withModelCallSlot } from './model-call-concurrency.js';
-import { inspectCodexLbSdkLaunchRecovery } from './codex-lb-launch-recovery.js';
+import { inspectDesktopBridgeSdkLaunchGuard, stripRetiredDirectProviderEnv } from './desktop-bridge-launch-guard.js';
 import { prepareNativeCodexAuthBridge } from './codex-sdk-env-policy.js';
 export async function runCodexTask(input) {
     const root = path.resolve(input.mutationLedgerRoot);
@@ -35,6 +34,7 @@ export async function runCodexTask(input) {
     const capability = await detectCodexSdkCapability();
     const sandbox = mapCodexSdkSandboxPolicy(task);
     const runtime = codexSdkRuntimePolicies(task);
+    runtime.env.env = stripRetiredDirectProviderEnv(runtime.env.env);
     const bundledCodex = resolveBundledCodexBinary();
     if (bundledCodex && !runtime.env.env.SKS_PYTHON_CODEX_SDK_CODEX_BIN)
         runtime.env.env.SKS_PYTHON_CODEX_SDK_CODEX_BIN = bundledCodex;
@@ -48,18 +48,15 @@ export async function runCodexTask(input) {
         runtime.env.proof.home = runtime.env.env.HOME;
         runtime.env.proof.codex_home = runtime.env.env.CODEX_HOME;
     }
-    const codexLbToolOutputRecovery = await inspectCodexLbSdkLaunchRecovery({
+    const desktopBridgeLaunchGuard = inspectDesktopBridgeSdkLaunchGuard({
         config: runtime.config,
-        env: runtime.env.env,
-        overrideEnv: process.env
+        env: runtime.env.env
     });
-    if (codexLbToolOutputRecovery.ok)
-        await ensurePythonCodexLbConfig(runtime.env.env, runtime.config);
     const blockers = [
         ...(capability.ok || fakeAllowed ? [] : capability.blockers),
         ...(sandbox.ok ? [] : sandbox.blockers),
         ...(nativeCodexAuthBridge.ok ? [] : nativeCodexAuthBridge.blockers),
-        ...(codexLbToolOutputRecovery.ok ? [] : codexLbToolOutputRecovery.blockers)
+        ...(desktopBridgeLaunchGuard.ok ? [] : desktopBridgeLaunchGuard.blockers)
     ];
     let adapterResult = null;
     let nativeAuthCleanupBlockers = [];
@@ -149,7 +146,7 @@ export async function runCodexTask(input) {
         workerResultPath,
         patchEnvelopePath,
         blockers: finalBlockers,
-        codexLbToolOutputRecovery,
+        desktop_bridge_launch_guard: desktopBridgeLaunchGuard,
         reliabilityShield: adapterResult?.reliabilityShield || null,
         capacityFallback: adapterResult?.reliabilityShield?.selected_model_capacity_fallback === true,
         modelCapacityRetryCount: Number(adapterResult?.reliabilityShield?.model_capacity_retry_count || 0),
@@ -185,7 +182,7 @@ export async function runCodexTask(input) {
             capacity_fallback_selected: result.capacityFallback === true,
             model_capacity_retry_count: result.modelCapacityRetryCount,
             native_codex_auth_bridge: nativeCodexAuthBridge.proof,
-            codex_lb_tool_output_recovery: codexLbToolOutputRecovery
+            desktop_bridge_launch_guard: desktopBridgeLaunchGuard
         },
         config: runtime.config,
         reliabilityShield: adapterResult?.reliabilityShield || null,
@@ -197,6 +194,7 @@ export async function runCodexTask(input) {
 async function runPythonControlTask(root, task, schema, routerDecision) {
     const capability = await detectPythonCodexSdkCapability();
     const runtime = codexSdkRuntimePolicies(task);
+    runtime.env.env = stripRetiredDirectProviderEnv(runtime.env.env);
     if (runtime.env.env.HOME)
         await ensureDir(runtime.env.env.HOME);
     if (runtime.env.env.CODEX_HOME)
@@ -207,15 +205,14 @@ async function runPythonControlTask(root, task, schema, routerDecision) {
         runtime.env.proof.home = runtime.env.env.HOME;
         runtime.env.proof.codex_home = runtime.env.env.CODEX_HOME;
     }
-    const codexLbToolOutputRecovery = await inspectCodexLbSdkLaunchRecovery({
+    const desktopBridgeLaunchGuard = inspectDesktopBridgeSdkLaunchGuard({
         config: runtime.config,
-        env: runtime.env.env,
-        overrideEnv: process.env
+        env: runtime.env.env
     });
     let adapterResult;
     let nativeAuthCleanupBlockers = [];
     try {
-        adapterResult = codexLbToolOutputRecovery.ok && nativeCodexAuthBridge.ok && (capability.ok || fakeAllowed)
+        adapterResult = desktopBridgeLaunchGuard.ok && nativeCodexAuthBridge.ok && (capability.ok || fakeAllowed)
             ? await withModelCallSlot({
                 root,
                 missionId: task.missionId,
@@ -234,7 +231,7 @@ async function runPythonControlTask(root, task, schema, routerDecision) {
                 threadId: '',
                 turnId: '',
                 blockers: [
-                    ...(codexLbToolOutputRecovery.ok ? [] : codexLbToolOutputRecovery.blockers),
+                    ...(desktopBridgeLaunchGuard.ok ? [] : desktopBridgeLaunchGuard.blockers),
                     ...(nativeCodexAuthBridge.ok ? [] : nativeCodexAuthBridge.blockers),
                     ...(capability.ok || fakeAllowed ? [] : capability.blockers)
                 ],
@@ -294,7 +291,7 @@ async function runPythonControlTask(root, task, schema, routerDecision) {
         structured_output_valid: validation.ok,
         worker_result_path: workerResultPath,
         native_codex_auth_bridge: nativeCodexAuthBridge.proof,
-        codex_lb_tool_output_recovery: codexLbToolOutputRecovery,
+        desktop_bridge_launch_guard: desktopBridgeLaunchGuard,
         blockers: finalBlockers
     });
     const result = {
@@ -309,7 +306,7 @@ async function runPythonControlTask(root, task, schema, routerDecision) {
         patchEnvelopePath,
         pythonSdkProofPath,
         blockers: finalBlockers,
-        codexLbToolOutputRecovery,
+        desktop_bridge_launch_guard: desktopBridgeLaunchGuard,
         reliabilityShield: {},
         ultraRouterDecision: routerDecision,
         outputSchemaId: task.outputSchemaId,
@@ -343,7 +340,7 @@ async function runPythonControlTask(root, task, schema, routerDecision) {
             python_bin: capability.python_bin,
             python_version: capability.python_version,
             native_codex_auth_bridge: nativeCodexAuthBridge.proof,
-            codex_lb_tool_output_recovery: codexLbToolOutputRecovery
+            desktop_bridge_launch_guard: desktopBridgeLaunchGuard
         },
         config: { ...runtime.config, backend: 'python-codex-sdk', package_name: capability.package_name, import_name: capability.import_name },
         reliabilityShield: null,
@@ -536,7 +533,7 @@ function isRunFailureBlocker(blockers) {
             || text.startsWith('native_codex_auth_cleanup_failed')
             || text.startsWith('local_llm_generate_failed')
             || text.startsWith('local_llm_eligibility_blocked')
-            || text.startsWith('codex_lb_tool_output_recovery_')
+            || text.startsWith('desktop_bridge_launch_')
             || text.endsWith('_adapter_reported_failure')
             || text === 'codex_reliability_shield_failed'
             || text === 'codex_reliability_fatal_error_no_retry'
@@ -578,47 +575,6 @@ function parseStructuredOutput(text) {
         return null;
     }
 }
-async function ensurePythonCodexLbConfig(env, config) {
-    const codexHome = env.CODEX_HOME;
-    const lbBaseUrl = normalizeCodexLbBaseUrl(env.CODEX_LB_BASE_URL);
-    if (!codexHome || !lbBaseUrl || !env.CODEX_LB_API_KEY)
-        return;
-    const model = String(config.model || env.SKS_CODEX_MODEL || env.CODEX_MODEL || '').trim();
-    const text = [
-        ...(model ? [`model = ${tomlQuote(model)}`] : []),
-        'model_provider = "codex-lb"',
-        'service_tier = "fast"',
-        `model_reasoning_effort = ${tomlQuote(String(config.model_reasoning_effort || env.SKS_CODEX_REASONING || env.CODEX_MODEL_REASONING_EFFORT || 'minimal'))}`,
-        'approval_policy = "never"',
-        '',
-        '[model_providers.codex-lb]',
-        'name = "codex-lb"',
-        `base_url = ${tomlQuote(lbBaseUrl)}`,
-        'wire_api = "responses"',
-        'env_key = "CODEX_LB_API_KEY"',
-        'supports_websockets = true',
-        'requires_openai_auth = false',
-        ''
-    ].join('\n');
-    const configPath = path.join(codexHome, 'config.toml');
-    await writeCodexConfigGuarded({
-        configPath,
-        cause: 'python-codex-lb-config',
-        mutate: () => text
-    });
-}
-function normalizeCodexLbBaseUrl(value) {
-    let host = String(value || '').trim();
-    if (!host)
-        return '';
-    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(host))
-        host = `https://${host}`;
-    host = host.replace(/\/+$/, '');
-    return /\/backend-api\/codex$/i.test(host) ? host : `${host}/backend-api/codex`;
-}
-function tomlQuote(value) {
-    return JSON.stringify(value);
-}
 function resolveBundledCodexBinary() {
     const platform = process.platform;
     const arch = process.arch;

package/dist/core/codex-control/desktop-bridge-launch-guard.js

@@ -0,0 +1,227 @@
+import os from 'node:os';
+import path from 'node:path';
+import { parseCodexConfigToml } from '../codex/codex-config-toml.js';
+import { readText } from '../fsx.js';
+export const DESKTOP_BRIDGE_LAUNCH_GUARD_SCHEMA = 'sks.desktop-bridge-launch-guard.v1';
+export const DESKTOP_BRIDGE_DIRECT_PROVIDER_SELECTION_RETIRED = 'desktop_bridge_direct_provider_selection_retired';
+export function inspectDesktopBridgeSdkLaunchGuard(input) {
+    return guardForSelectedProvider(stringValue(input.config.model_provider));
+}
+export async function inspectDesktopBridgeCliLaunchGuard(input) {
+    const env = input.env || process.env;
+    const args = (input.cliArgs || []).map((arg) => String(arg));
+    if (args.includes('--oss'))
+        return allowedGuard(null);
+    const effectiveRoot = effectiveCodexWorkingRoot(input.root, args);
+    if (!effectiveRoot.ok) {
+        return blockedGuard('working_root_blocked', null, effectiveRoot.blockers);
+    }
+    const codexHome = path.resolve(String(env.CODEX_HOME || path.join(env.HOME || os.homedir(), '.codex')));
+    const ignoreUserConfig = args.includes('--ignore-user-config');
+    const profileName = ignoreUserConfig ? null : cliOptionValue(args, ['--profile', '-p', '-P']);
+    const profileConfigPath = profileName && safeProfileName(profileName)
+        ? path.join(codexHome, `${profileName}.config.toml`)
+        : null;
+    const userConfig = ignoreUserConfig
+        ? configLayer('', 'user')
+        : configLayer(await readText(path.join(codexHome, 'config.toml'), '').catch(() => ''), 'user');
+    const profileConfig = profileConfigPath
+        ? configLayer(await readText(profileConfigPath, '').catch(() => ''), 'profile')
+        : configLayer('', 'profile');
+    const projectConfigPath = path.join(effectiveRoot.root, '.codex', 'config.toml');
+    const projectConfig = path.resolve(projectConfigPath) === path.resolve(path.join(codexHome, 'config.toml'))
+        ? configLayer('', 'project')
+        : configLayer(await readText(projectConfigPath, '').catch(() => ''), 'project');
+    const override = cliModelProviderOverride(args);
+    const layers = [userConfig, profileConfig, projectConfig];
+    const selectedProvider = projectConfig.modelProvider
+        ?? profileConfig.modelProvider
+        ?? userConfig.modelProvider
+        ?? null;
+    const parseBlockers = layers
+        .filter((layer) => layer.parseFailed && layer.rawSelectsRetiredProvider)
+        .map((layer) => `desktop_bridge_launch_config_parse_failed:${layer.source}`);
+    if (parseBlockers.length > 0) {
+        return blockedGuard('config_parse_blocked', selectedProvider, parseBlockers);
+    }
+    const historicalSelection = layers
+        .map((layer) => layer.modelProvider)
+        .find((provider) => provider === 'codex-lb' || provider === 'openrouter');
+    if (historicalSelection)
+        return guardForSelectedProvider(historicalSelection);
+    return guardForSelectedProvider(override ?? selectedProvider);
+}
+export async function withDesktopBridgeCliLaunchGuard(input, launch) {
+    const sanitizedEnv = stripRetiredDirectProviderEnv(input.env || process.env);
+    const desktopBridgeLaunchGuard = await inspectDesktopBridgeCliLaunchGuard({
+        ...input,
+        env: sanitizedEnv
+    });
+    if (!desktopBridgeLaunchGuard.ok) {
+        return { launched: false, desktopBridgeLaunchGuard, value: null };
+    }
+    return {
+        launched: true,
+        desktopBridgeLaunchGuard,
+        value: await launch(sanitizedEnv)
+    };
+}
+export function stripRetiredDirectProviderEnv(env) {
+    const sanitized = { ...env };
+    for (const key of Object.keys(sanitized)) {
+        if (/^CODEX_LB_/i.test(key))
+            delete sanitized[key];
+    }
+    return sanitized;
+}
+export function desktopBridgeLaunchBlockedProcessResult(guard) {
+    const stderr = desktopBridgeLaunchBlockedMessage(guard);
+    return {
+        code: 78,
+        stdout: '',
+        stderr,
+        stdoutBytes: 0,
+        stderrBytes: Buffer.byteLength(stderr),
+        truncated: false,
+        timedOut: false,
+        desktop_bridge_launch_guard: guard
+    };
+}
+export function desktopBridgeLaunchBlockedMessage(guard) {
+    return [
+        'Codex launch blocked: direct provider selection is retired; managed routing must use Desktop Bridge.',
+        ...guard.blockers.map((blocker) => `blocker: ${blocker}`),
+        ...guard.operator_actions
+    ].join('\n');
+}
+export function effectiveCodexWorkingRoot(fallbackRoot, args) {
+    const base = path.resolve(fallbackRoot);
+    let selected = null;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] || '';
+        if (arg === '--')
+            break;
+        if (arg === '-C' || arg === '--cd') {
+            const next = String(args[index + 1] || '').trim();
+            if (!next || next.startsWith('-')) {
+                return { ok: false, root: base, blockers: ['desktop_bridge_launch_working_root_value_missing'] };
+            }
+            selected = next;
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('--cd=') || arg.startsWith('-C=')) {
+            const value = arg.slice(arg.indexOf('=') + 1).trim();
+            if (!value) {
+                return { ok: false, root: base, blockers: ['desktop_bridge_launch_working_root_value_missing'] };
+            }
+            selected = value;
+        }
+    }
+    return { ok: true, root: selected ? path.resolve(base, selected) : base, blockers: [] };
+}
+function configLayer(text, source) {
+    const raw = String(text || '');
+    if (!raw.trim()) {
+        return { source, modelProvider: null, parseFailed: false, rawSelectsRetiredProvider: false };
+    }
+    try {
+        const parsed = parseCodexConfigToml(raw);
+        return {
+            source,
+            modelProvider: stringValue(parsed.model_provider),
+            parseFailed: false,
+            rawSelectsRetiredProvider: false
+        };
+    }
+    catch {
+        return {
+            source,
+            modelProvider: null,
+            parseFailed: true,
+            rawSelectsRetiredProvider: /^\s*model_provider\s*=\s*(?:"(?:codex-lb|openrouter)"|'(?:codex-lb|openrouter)'|(?:codex-lb|openrouter))\s*(?:#.*)?$/mi.test(raw)
+        };
+    }
+}
+function cliModelProviderOverride(args) {
+    let modelProvider = null;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] || '';
+        let override = null;
+        if (arg === '-c' || arg === '--config') {
+            override = args[index + 1] || '';
+            index += 1;
+        }
+        else if (arg.startsWith('--config='))
+            override = arg.slice('--config='.length);
+        else if (arg.startsWith('-c='))
+            override = arg.slice(3);
+        if (!override)
+            continue;
+        const equals = override.indexOf('=');
+        if (equals < 1 || normalizeDottedKey(override.slice(0, equals)) !== 'model_provider')
+            continue;
+        modelProvider = stringValue(parseCliTomlValue(override.slice(equals + 1)));
+    }
+    return modelProvider;
+}
+function parseCliTomlValue(raw) {
+    try {
+        return parseCodexConfigToml(`value = ${raw}\n`).value;
+    }
+    catch {
+        return String(raw || '').trim();
+    }
+}
+function guardForSelectedProvider(selectedProvider) {
+    if (selectedProvider !== 'codex-lb' && selectedProvider !== 'openrouter') {
+        return allowedGuard(selectedProvider);
+    }
+    return blockedGuard('direct_provider_selection_retired', selectedProvider, [DESKTOP_BRIDGE_DIRECT_PROVIDER_SELECTION_RETIRED]);
+}
+function allowedGuard(selectedProvider) {
+    return {
+        schema: DESKTOP_BRIDGE_LAUNCH_GUARD_SCHEMA,
+        ok: true,
+        status: 'allowed',
+        selected_provider: selectedProvider,
+        blockers: [],
+        warnings: [],
+        operator_actions: []
+    };
+}
+function blockedGuard(status, selectedProvider, blockers) {
+    return {
+        schema: DESKTOP_BRIDGE_LAUNCH_GUARD_SCHEMA,
+        ok: false,
+        status,
+        selected_provider: selectedProvider,
+        blockers,
+        warnings: ['historical_direct_provider_selection_requires_bridge_migration'],
+        operator_actions: [
+            'Run `sks bridge ensure --json` to migrate SKS-owned routing to the managed Desktop Bridge.',
+            'If the direct provider selection is user-owned, review and remove it manually before retrying.'
+        ]
+    };
+}
+function cliOptionValue(args, names) {
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] || '';
+        if (names.includes(arg))
+            return String(args[index + 1] || '').trim() || null;
+        for (const name of names) {
+            if (arg.startsWith(`${name}=`))
+                return arg.slice(name.length + 1).trim() || null;
+        }
+    }
+    return null;
+}
+function safeProfileName(value) {
+    return /^[A-Za-z0-9_.-]{1,128}$/.test(value);
+}
+function normalizeDottedKey(value) {
+    return String(value || '').trim().replace(/["']/g, '').replace(/\s+/g, '');
+}
+function stringValue(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : null;
+}

package/dist/core/codex-exec-output-schema.js

@@ -3,7 +3,7 @@ import fsp from 'node:fs/promises';
 import { ensureDir, exists, packageRoot, readJson, runProcess, which } from './fsx.js';
 import { codexVersionPolicy, compareSemverLike, parseCodexVersionText } from './codex-compat/codex-version-policy.js';
 import { validateJsonSchemaRecursive } from './json-schema-validator.js';
-import { inspectCodexLbCliLaunchRecovery } from './codex-control/codex-lb-launch-recovery.js';
+import { inspectDesktopBridgeCliLaunchGuard, stripRetiredDirectProviderEnv } from './codex-control/desktop-bridge-launch-guard.js';
 import { prepareCodexAppServerRuntimeEnv } from './codex-control/codex-app-server-runtime-env.js';
 export async function detectCodexExecOutputSchemaSyntax(opts = {}) {
     const codexBin = opts.codexBin || await which('codex').catch(() => null);
@@ -170,17 +170,15 @@ export async function buildCodexExecResumeOutputSchemaArgs(input) {
 }
 export async function runCodexExecResumeWithOutputSchema(input, opts = {}) {
     const root = opts.cwd || packageRoot();
-    const env = await (opts.prepareCodexRuntimeEnvImpl || prepareCodexAppServerRuntimeEnv)({
+    const env = stripRetiredDirectProviderEnv(await (opts.prepareCodexRuntimeEnvImpl || prepareCodexAppServerRuntimeEnv)({
         env: opts.env || process.env
-    });
-    const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery({
+    }));
+    const launchGuard = await inspectDesktopBridgeCliLaunchGuard({
         root,
         env,
-        cliArgs: input.extraArgs || [],
-        ...(opts.recoveryFetch ? { fetchImpl: opts.recoveryFetch } : {}),
-        ...(opts.recoveryTimeoutMs === undefined ? {} : { timeoutMs: opts.recoveryTimeoutMs })
+        cliArgs: input.extraArgs || []
     });
-    if (!toolOutputRecovery.ok) {
+    if (!launchGuard.ok) {
         return {
             schema: 'sks.codex-exec-output-schema-run.v1',
             ok: false,
@@ -189,13 +187,13 @@ export async function runCodexExecResumeWithOutputSchema(input, opts = {}) {
             codex_bin: opts.codexBin || null,
             output_file: null,
             parsed_json: null,
-            blocker: structuredOutputBlocker('codex_lb_tool_output_recovery_blocked', toolOutputRecovery.blockers.join(', ')),
-            validation: { ok: false, issues: ['codex_lb_tool_output_recovery_blocked'] },
+            blocker: structuredOutputBlocker('desktop_bridge_launch_guard_blocked', launchGuard.blockers.join(', ')),
+            validation: { ok: false, issues: ['desktop_bridge_launch_guard_blocked'] },
             stdout_tail: '',
             stderr_tail: '',
             timed_out: false,
             exit_code: null,
-            codex_lb_tool_output_recovery: toolOutputRecovery
+            desktop_bridge_launch_guard: launchGuard
         };
     }
     const availability = await detectCodexExecResumeOutputSchema({ codexBin: opts.codexBin || undefined });
@@ -215,7 +213,7 @@ export async function runCodexExecResumeWithOutputSchema(input, opts = {}) {
             stderr_tail: '',
             timed_out: false,
             exit_code: null,
-            codex_lb_tool_output_recovery: toolOutputRecovery
+            desktop_bridge_launch_guard: launchGuard
         };
     }
     const outputFile = input.outputFile
@@ -253,7 +251,7 @@ export async function runCodexExecResumeWithOutputSchema(input, opts = {}) {
         stderr_tail: redactCodexOutput(result.stderr).slice(-12_000),
         timed_out: result.timedOut,
         exit_code: result.code,
-        codex_lb_tool_output_recovery: toolOutputRecovery
+        desktop_bridge_launch_guard: launchGuard
     };
 }
 export function parseStructuredCodexOutput(text) {

package/dist/core/codex-lb/bridge-contracts.js

@@ -0,0 +1,2 @@
+export const MANAGED_ROUTING_RUNTIME = 'desktop-bridge';
+export const BRIDGE_PROVIDER_IDS = ['codex-lb', 'openrouter'];