sneakoscope 8.1.2 → 8.2.0

package/dist/cli/install-helpers-codex-lb-config.js

@@ -1,51 +1,75 @@
 import path from 'node:path';
-import os from 'node:os';
-import { constants as fsConstants } from 'node:fs';
-import fsp from 'node:fs/promises';
-import { randomBytes } from 'node:crypto';
-import { assertTestHomeWriteAllowed, ensureDir, readText, writeBinaryAtomic } from '../core/fsx.js';
-import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_52_OPENROUTER_MODEL, OPENROUTER_AUTH_COMMAND, OPENROUTER_AUTH_REFRESH_INTERVAL_MS, OPENROUTER_AUTH_TIMEOUT_MS, openRouterAuthCommandArgs, OPENROUTER_DEFAULT_PROFILE_ID, RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS } from '../core/codex-app/openrouter-provider.js';
-import { openRouterSecretPaths, resolveOpenRouterApiKey } from '../core/providers/openrouter/openrouter-secret-store.js';
-import { reconcileRetiredSksConfigText } from '../core/auto-review.js';
-import { ensureTrailingNewline, removeTopLevelTomlKeyIfValue, safeWriteCodexConfigToml, upsertTopLevelTomlString, upsertTomlTable } from '../core/codex-runtime/codex-desktop-config-policy.js';
-import { codexLbConfigPath, normalizeCodexLbBaseUrl } from './install-helpers-codex-lb-shared.js';
+import { ensureTrailingNewline, upsertTopLevelTomlString } from '../core/codex-runtime/codex-desktop-config-policy.js';
 import { escapeRegExp } from '../core/text/regex.js';
-import { upsertExplicitCodexProviderMode } from '../core/codex-app/provider-mode.js';
-export const CODEX_LB_DESKTOP_BRIDGE_MARKER = '# sks-codex-lb-managed-desktop-bridge';
-export const CODEX_LB_DESKTOP_COMPAT_MARKER = '# sks-codex-lb-managed-desktop-compat';
-export const CODEX_LB_MODEL_CATALOG_MARKER = '# sks-codex-lb-managed-model-catalog';
-export const CODEX_LB_PROVIDER_SELECTION_MARKER = '# sks-codex-lb-managed-provider-selection';
-export const CODEX_LB_OAUTH_SELECTION_MARKER = '# sks-codex-lb-managed-oauth-selection';
-export const LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
-const SKS_SWITCHABLE_THIRD_PARTY_PROVIDER_IDS = ['openrouter', 'sks-router'];
-const SKS_THIRD_PARTY_CATALOG_BASENAMES = ['sks-openrouter-catalog.json', 'opencodex-catalog.json'];
-export function releaseSksManagedThirdPartySelection(text) {
-    let next = String(text || '');
-    const selected = topLevelTomlString(next, 'model_provider');
-    if (!selected || !SKS_SWITCHABLE_THIRD_PARTY_PROVIDER_IDS.includes(selected)) {
-        return next;
+export const DESKTOP_BRIDGE_MANAGED_MARKER = '# sks-desktop-bridge-managed';
+export const DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER = '# sks-desktop-bridge-managed-base-url';
+export const DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER = '# sks-desktop-bridge-managed-model-catalog';
+export function upsertDesktopBridgeManagedConfig(text, input) {
+    const bridgeBaseUrl = normalizeManagedBridgeBaseUrl(input.bridgeBaseUrl);
+    const combinedCatalogPath = String(input.combinedCatalogPath || '').trim();
+    if (!combinedCatalogPath || !path.isAbsolute(combinedCatalogPath)) {
+        throw new Error('desktop_bridge_combined_catalog_path_invalid');
+    }
+    if (path.basename(combinedCatalogPath) !== 'sks-bridge-catalog.json') {
+        throw new Error('desktop_bridge_combined_catalog_path_invalid');
+    }
+    const orphanCleanup = removeDesktopBridgeOrphanManagedMarkers(String(text || ''));
+    let next = orphanCleanup.text;
+    const selectedProvider = topLevelTomlString(next, 'model_provider');
+    if (selectedProvider && (selectedProvider !== 'openai'
+        || !topLevelHasLine(next, DESKTOP_BRIDGE_MANAGED_MARKER))) {
+        throw new Error('historical_user_owned_config_conflict:model_provider');
+    }
+    const existingBaseUrl = topLevelTomlString(next, 'openai_base_url');
+    const baseUrlOwned = topLevelHasLine(next, DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER);
+    if (existingBaseUrl && !baseUrlOwned) {
+        throw new Error('historical_user_owned_config_conflict:openai_base_url');
     }
-    if (!new RegExp(`(^|\\n)\\[model_providers\\.${escapeRegExp(selected)}\\]`).test(next))
-        return next;
-    next = removeTopLevelTomlKeyIfValue(next, 'model_provider', selected);
+    const existingCatalog = topLevelTomlString(next, 'model_catalog_json');
+    const catalogOwned = topLevelHasLine(next, DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER);
+    if (existingCatalog && !catalogOwned) {
+        throw new Error('historical_user_owned_config_conflict:model_catalog_json');
+    }
+    next = removeManagedBridgeTopLevelBindings(next);
+    next = upsertTopLevelTomlString(next, 'model_provider', 'openai');
+    next = addTopLevelMarkerBeforeKey(next, 'model_provider', DESKTOP_BRIDGE_MANAGED_MARKER);
+    next = upsertTopLevelTomlString(next, 'openai_base_url', bridgeBaseUrl);
+    next = addTopLevelMarkerBeforeKey(next, 'openai_base_url', DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER);
+    next = upsertTopLevelTomlString(next, 'model_catalog_json', combinedCatalogPath);
+    next = addTopLevelMarkerBeforeKey(next, 'model_catalog_json', DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER);
+    return ensureTrailingNewline(next);
+}
+export function removeDesktopBridgeManagedConfig(text) {
+    let next = String(text || '');
+    const selectedProvider = topLevelTomlString(next, 'model_provider');
+    const baseUrl = topLevelTomlString(next, 'openai_base_url');
     const catalog = topLevelTomlString(next, 'model_catalog_json');
-    if (catalog
-        && !topLevelHasLine(next, CODEX_LB_MODEL_CATALOG_MARKER)
-        && SKS_THIRD_PARTY_CATALOG_BASENAMES.some((name) => catalog.endsWith(`/${name}`) || catalog === name)) {
-        next = removeTopLevelTomlKey(next, 'model_catalog_json');
+    const owned = [
+        [DESKTOP_BRIDGE_MANAGED_MARKER, 'model_provider', selectedProvider === 'openai'],
+        [DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, 'openai_base_url', Boolean(baseUrl)],
+        [DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER, 'model_catalog_json', Boolean(catalog)]
+    ];
+    for (const [marker, key, valid] of owned) {
+        if (!topLevelHasLine(next, marker)) {
+            const value = key === 'model_provider' ? selectedProvider : key === 'openai_base_url' ? baseUrl : catalog;
+            if (value)
+                throw new Error(`desktop_bridge_unmanage_ownership_missing:${key}`);
+            continue;
+        }
+        if (!valid)
+            throw new Error(`desktop_bridge_unmanage_owned_value_invalid:${key}`);
+        next = removeTopLevelTomlKey(next, key);
+        next = removeTopLevelLine(next, marker);
     }
-    return next;
+    return ensureTrailingNewline(next);
 }
-export function removeCodexLbOrphanManagedMarkers(text) {
+export function removeDesktopBridgeOrphanManagedMarkers(text) {
     const source = String(text || '');
     const selectedProvider = topLevelTomlString(source, 'model_provider');
     const markerTargets = [
-        [CODEX_LB_DESKTOP_BRIDGE_MARKER, Boolean(topLevelTomlString(source, 'openai_base_url'))],
-        [LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER, Boolean(topLevelTomlString(source, 'openai_base_url'))],
-        [CODEX_LB_DESKTOP_COMPAT_MARKER, selectedProvider === 'codex-lb'],
-        [CODEX_LB_MODEL_CATALOG_MARKER, Boolean(topLevelTomlString(source, 'model_catalog_json'))],
-        [CODEX_LB_PROVIDER_SELECTION_MARKER, selectedProvider === 'codex-lb'],
-        [CODEX_LB_OAUTH_SELECTION_MARKER, selectedProvider === 'openai']
+        [DESKTOP_BRIDGE_MANAGED_MARKER, selectedProvider === 'openai'],
+        [DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, Boolean(topLevelTomlString(source, 'openai_base_url'))],
+        [DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER, Boolean(topLevelTomlString(source, 'model_catalog_json'))]
     ];
     const orphanMarkers = markerTargets
         .filter(([marker, hasManagedContent]) => topLevelHasLine(source, marker) && !hasManagedContent)
@@ -54,891 +78,21 @@ export function removeCodexLbOrphanManagedMarkers(text) {
     for (const marker of orphanMarkers)
         next = removeTopLevelLine(next, marker);
     return {
-        schema: 'sks.codex-lb-orphan-managed-marker-cleanup.v1',
+        schema: 'sks.desktop-bridge-orphan-managed-marker-cleanup.v1',
         changed: orphanMarkers.length > 0,
         orphan_markers: orphanMarkers,
         text: next
     };
 }
-export function upsertCodexLbNativeDesktopConfig(text, input) {
-    let next = releaseSksManagedThirdPartySelection(removeCodexLbOrphanManagedMarkers(String(text || '')).text);
-    const selectedProvider = topLevelTomlString(next, 'model_provider');
-    if (selectedProvider && selectedProvider !== 'openai' && selectedProvider !== 'codex-lb') {
-        throw new Error('codex_lb_user_owned_model_provider_conflict');
-    }
-    if (selectedProvider === 'codex-lb'
-        && !topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)
-        && !topLevelHasLine(next, CODEX_LB_PROVIDER_SELECTION_MARKER)) {
-        throw new Error('codex_lb_legacy_desktop_config_requires_migration');
-    }
-    if (topLevelHasLine(next, LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER)
-        && !topLevelHasLine(next, CODEX_LB_DESKTOP_BRIDGE_MARKER)) {
-        throw new Error('codex_lb_legacy_desktop_config_requires_migration');
-    }
-    const modelCatalog = topLevelTomlString(next, 'model_catalog_json');
-    if (modelCatalog && !topLevelHasLine(next, CODEX_LB_MODEL_CATALOG_MARKER)) {
-        throw new Error('codex_lb_user_owned_model_catalog_json_conflict');
-    }
-    next = removeManagedCodexLbSelection(next);
-    next = removeTopLevelLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER);
-    next = removeManagedModelCatalogJson(next);
-    next = upsertManagedTopLevelTomlString(next, 'openai_base_url', input.bridgeBaseUrl, CODEX_LB_DESKTOP_BRIDGE_MARKER, [LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER]);
-    next = upsertTopLevelTomlString(next, 'model_provider', 'openai');
-    next = upsertTomlTable(next, 'model_providers.codex-lb', cliProviderBlock(input.remoteBaseUrl));
-    return ensureTrailingNewline(upsertExplicitCodexProviderMode(next, 'codex-lb'));
-}
-export function upsertCodexLbCompatDesktopConfig(text, input) {
-    let next = removeManagedDesktopBridgeRouting(String(text || ''));
-    next = removeManagedModelCatalogJson(next);
-    next = upsertManagedTopLevelTomlString(next, 'model_provider', 'codex-lb', CODEX_LB_DESKTOP_COMPAT_MARKER);
-    const block = [
-        '[model_providers.codex-lb]',
-        'name = "OpenAI"',
-        `base_url = ${JSON.stringify(input.remoteBaseUrl)}`,
-        'wire_api = "responses"',
-        'requires_openai_auth = true',
-        'supports_websockets = true',
-        'env_http_headers = { "X-Codex-LB-API-Key" = "CODEX_LB_API_KEY" }'
-    ].join('\n');
-    next = upsertTomlTable(next, 'model_providers.codex-lb', block);
-    return ensureTrailingNewline(next);
-}
-export function upsertCodexLbCliProviderConfig(text, input) {
-    const cleaned = removeCodexLbOrphanManagedMarkers(String(text || '')).text;
-    if (topLevelHasLine(cleaned, LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER)) {
-        throw new Error('codex_lb_legacy_desktop_config_requires_migration');
-    }
-    const cliBase = input.selectGlobally === true
-        ? releaseSksManagedThirdPartySelection(removeCodexLbManagedDesktopConfig(cleaned))
-        : removeCodexLbManagedDesktopConfig(cleaned);
-    const claimedSelection = input.selectGlobally === true
-        && topLevelTomlString(cliBase, 'model_provider') === 'codex-lb'
-        && !topLevelHasLine(cliBase, CODEX_LB_PROVIDER_SELECTION_MARKER)
-        ? addTopLevelMarkerBeforeKey(cliBase, 'model_provider', CODEX_LB_PROVIDER_SELECTION_MARKER)
-        : cliBase;
-    let next = input.selectGlobally === true
-        ? upsertManagedTopLevelTomlString(removeTopLevelTomlKeyIfValue(removeManagedOAuthSelection(claimedSelection), 'model_provider', 'openai'), 'model_provider', 'codex-lb', CODEX_LB_PROVIDER_SELECTION_MARKER)
-        : removeManagedCodexLbSelection(cliBase);
-    next = upsertTomlTable(next, 'model_providers.codex-lb', cliProviderBlock(input.remoteBaseUrl));
-    return ensureTrailingNewline(next);
-}
-export function restoreCodexLbOAuthSelectionConfig(text) {
-    let next = removeManagedCodexLbSelection(String(text || ''));
-    next = upsertManagedTopLevelTomlString(next, 'model_provider', 'openai', CODEX_LB_OAUTH_SELECTION_MARKER);
-    return ensureTrailingNewline(upsertExplicitCodexProviderMode(next, 'chatgpt-oauth'));
-}
-export function removeManagedCodexLbSelection(text) {
-    let next = removeTopLevelTomlKeyIfValue(String(text || ''), 'model_provider', 'codex-lb');
-    next = removeTopLevelLine(next, CODEX_LB_PROVIDER_SELECTION_MARKER);
-    return next;
-}
-function removeManagedOAuthSelection(text) {
-    let next = String(text || '');
-    if (topLevelHasLine(next, CODEX_LB_OAUTH_SELECTION_MARKER)) {
-        next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'openai');
-        next = removeTopLevelLine(next, CODEX_LB_OAUTH_SELECTION_MARKER);
-    }
-    return next;
-}
-export function removeCodexLbManagedDesktopConfig(text) {
-    let next = removeManagedDesktopBridgeRouting(removeCodexLbOrphanManagedMarkers(String(text || '')).text);
-    if (topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)) {
-        next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
-        next = removeTopLevelLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER);
-    }
-    next = removeManagedModelCatalogJson(next);
-    if (topLevelTomlString(next, 'model_provider') === 'codex-lb') {
-        next = restoreCodexLbOAuthSelectionConfig(next);
-    }
-    return ensureTrailingNewline(next);
-}
-export function removeManagedModelCatalogJson(text) {
-    if (!topLevelHasLine(text, CODEX_LB_MODEL_CATALOG_MARKER))
-        return text;
-    const withoutKey = removeTopLevelTomlKey(text, 'model_catalog_json');
-    return removeTopLevelLine(withoutKey, CODEX_LB_MODEL_CATALOG_MARKER);
-}
-export function removeManagedDesktopBridgeRouting(text) {
-    const markers = [
-        CODEX_LB_DESKTOP_BRIDGE_MARKER,
-        LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER
-    ].filter((marker) => topLevelHasLine(text, marker));
-    if (markers.length === 0)
-        return text;
-    let next = removeTopLevelTomlKey(text, 'openai_base_url');
-    for (const marker of markers)
-        next = removeTopLevelLine(next, marker);
-    return next;
-}
-export function upsertCodexLbConfig(text = '', baseUrl, selectDefault = true) {
-    return upsertCodexLbCliProviderConfig(text, {
-        remoteBaseUrl: String(baseUrl || ''),
-        selectGlobally: selectDefault === true
-    });
-}
-function cliProviderBlock(remoteBaseUrl) {
-    return [
-        '[model_providers.codex-lb]',
-        'name = "codex-lb"',
-        `base_url = ${JSON.stringify(remoteBaseUrl)}`,
-        'wire_api = "responses"',
-        'env_key = "CODEX_LB_API_KEY"',
-        'supports_websockets = true',
-        'requires_openai_auth = false'
-    ].join('\n');
-}
-function upsertManagedTopLevelTomlString(text, key, value, marker, legacyMarkers = []) {
-    const acceptedMarkers = [marker, ...legacyMarkers];
-    const existing = topLevelTomlString(text, key);
-    const ownedMarker = acceptedMarkers.find((candidate) => topLevelHasLine(text, candidate));
-    if (existing && !ownedMarker) {
-        if (existing === value)
-            return text;
-        throw new Error(`codex_lb_user_owned_${key}_conflict`);
-    }
-    let next = text;
-    for (const candidate of acceptedMarkers)
-        next = removeTopLevelLine(next, candidate);
-    next = upsertTopLevelTomlString(next, key, value);
-    return addTopLevelMarkerBeforeKey(next, key, marker);
-}
-function removeTopLevelTomlKey(text, key) {
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
-    const end = firstTable === -1 ? lines.length : firstTable;
-    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
-    return lines
-        .filter((line, index) => index >= end || !keyPattern.test(line))
-        .join('\n')
-        .replace(/^\n+/, '')
-        .replace(/\n{3,}/g, '\n\n');
-}
-const CODEX_LB_SHARED_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
-export function codexLbSharedOpenAiRoutingState(text = '', baseUrl = '') {
-    const expectedBaseUrl = normalizeCodexLbBaseUrl(baseUrl);
-    const configuredBaseUrl = topLevelTomlString(text, 'openai_base_url');
-    return {
-        status: !configuredBaseUrl ? 'missing' : configuredBaseUrl === expectedBaseUrl ? 'matched' : 'conflict',
-        expected_base_url: expectedBaseUrl,
-        configured_base_url: configuredBaseUrl || null,
-        managed: topLevelHasLine(text, CODEX_LB_SHARED_OPENAI_ROUTING_MARKER)
-    };
-}
-export function upsertCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
-    const state = codexLbSharedOpenAiRoutingState(text, baseUrl);
-    if (!state.expected_base_url)
-        return { ...state, routing_status: state.status, ok: false, status: 'missing_base_url', text: String(text || '') };
-    if (state.status === 'conflict')
-        return { ...state, routing_status: state.status, ok: false, status: 'conflicting_user_openai_base_url', text: String(text || '') };
-    if (state.status === 'matched' && state.managed) {
-        return { ...state, routing_status: state.status, ok: true, status: 'present', text: String(text || '') };
-    }
-    const withValue = state.status === 'matched'
-        ? String(text || '')
-        : upsertTopLevelTomlString(text, 'openai_base_url', state.expected_base_url);
-    const next = addTopLevelMarkerBeforeKey(withValue, 'openai_base_url', CODEX_LB_SHARED_OPENAI_ROUTING_MARKER);
-    return { ...state, routing_status: state.status, ok: true, status: 'added', text: `${next.trim()}\n`, managed: true };
-}
-export function removeCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
-    const state = codexLbSharedOpenAiRoutingState(text, baseUrl);
-    if (state.status === 'missing' && state.managed) {
-        return {
-            ...state,
-            changed: true,
-            text: removeTopLevelLine(String(text || ''), CODEX_LB_SHARED_OPENAI_ROUTING_MARKER)
-        };
-    }
-    if (state.status !== 'matched' || !state.managed)
-        return { ...state, changed: false, text: String(text || '') };
-    const withoutValue = removeTopLevelTomlKeyIfValue(text, 'openai_base_url', state.expected_base_url);
-    return {
-        ...state,
-        changed: true,
-        text: removeTopLevelLine(withoutValue, CODEX_LB_SHARED_OPENAI_ROUTING_MARKER)
-    };
-}
-export function upsertCodexAppGlmConfig(text = '', input = {}) {
-    let next = String(text || '');
-    const authEnv = { ...(input.env || process.env), ...(input.home ? { HOME: input.home } : {}) };
-    const authArgs = openRouterAuthCommandArgs(openRouterSecretPaths(authEnv).keyPath);
-    const providerBlock = [
-        `[model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}]`,
-        'name = "OpenRouter"',
-        'base_url = "https://openrouter.ai/api/v1"',
-        'wire_api = "responses"',
-        'requires_openai_auth = false'
-    ].join('\n');
-    next = upsertTomlTable(next, `model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}`, providerBlock);
-    const authBlock = [
-        `[model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}.auth]`,
-        `command = ${JSON.stringify(OPENROUTER_AUTH_COMMAND)}`,
-        `args = [${authArgs.map((value) => JSON.stringify(value)).join(', ')}]`,
-        `timeout_ms = ${OPENROUTER_AUTH_TIMEOUT_MS}`,
-        `refresh_interval_ms = ${OPENROUTER_AUTH_REFRESH_INTERVAL_MS}`
-    ].join('\n');
-    next = upsertTomlTable(next, `model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}.auth`, authBlock);
-    next = next.replace(new RegExp(`\\n+\\[model_providers\\.${GLM_CODEX_CONFIG_PROVIDER_ID}\\.auth\\]`), `\n\n[model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}.auth]`);
-    next = reconcileRetiredSksConfigText(next).text;
-    return `${next.trim()}\n`;
-}
-export async function ensureGlobalCodexAppGlmProfile(opts = {}) {
-    const env = opts.env || process.env;
-    if (env.SKS_SKIP_CODEX_GLM_PROFILE_REPAIR === '1' && opts.force !== true) {
-        return { ok: true, status: 'skipped', reason: 'SKS_SKIP_CODEX_GLM_PROFILE_REPAIR=1' };
-    }
-    const home = opts.home || env.HOME || os.homedir();
-    const configPath = opts.configPath || codexLbConfigPath(home);
-    try {
-        await ensureDir(path.dirname(configPath));
-        const current = await readText(configPath, '');
-        const next = upsertCodexAppGlmConfig(current, { home, env: opts.env });
-        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'openrouter-provider');
-        return {
-            ...safeWrite,
-            status: safeWrite.status === 'written' ? 'updated' : safeWrite.status,
-            provider: GLM_CODEX_CONFIG_PROVIDER_ID,
-            model: GLM_52_OPENROUTER_MODEL,
-            codex_config_profile: OPENROUTER_DEFAULT_PROFILE_ID,
-            reasoning_profiles: [],
-            retired_glm_profiles: [...RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS]
-        };
-    }
-    catch (err) {
-        return {
-            ok: false,
-            status: 'failed',
-            config_path: configPath,
-            error: err.message,
-            provider: GLM_CODEX_CONFIG_PROVIDER_ID,
-            model: GLM_52_OPENROUTER_MODEL,
-            codex_config_profile: OPENROUTER_DEFAULT_PROFILE_ID,
-            reasoning_profiles: [],
-            retired_glm_profiles: [...RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS]
-        };
-    }
-}
-export async function ensureStoredOpenRouterProviderDuringInstall(opts = {}) {
-    const home = opts.home || opts.env?.HOME || process.env.HOME || os.homedir();
-    const env = { ...(opts.env || process.env), HOME: home };
-    const key = await resolveOpenRouterApiKey({ env });
-    if (!key.key) {
-        return {
-            schema: 'sks.openrouter-provider-upgrade-repair.v1',
-            ok: true,
-            status: 'skipped',
-            reason: 'openrouter_key_missing',
-            key_present: false,
-            key_source: null,
-            blockers: [],
-            warnings: key.warnings
-        };
-    }
-    const repair = await ensureGlobalCodexAppGlmProfile({
-        ...opts,
-        home,
-        env
-    });
-    const configPath = repair?.config_path || opts.configPath || codexLbConfigPath(home);
-    const { ensureOpenRouterModelCatalog } = await import('../core/codex-app/openrouter-model-catalog.js');
-    const catalogRepair = await ensureOpenRouterModelCatalog({ configPath, home, env })
-        .catch((err) => ({ ok: false, status: 'failed', error: err?.message || String(err) }));
-    const ok = repair?.ok !== false && catalogRepair?.ok !== false;
-    return {
-        schema: 'sks.openrouter-provider-upgrade-repair.v1',
-        ok,
-        status: ok ? repair?.status || 'present' : 'failed',
-        reason: ok ? 'stored_openrouter_key_provider_reconciled' : 'stored_openrouter_key_provider_repair_failed',
-        key_present: true,
-        key_source: key.source,
-        config_path: configPath,
-        provider: GLM_CODEX_CONFIG_PROVIDER_ID,
-        blockers: ok ? [] : ['openrouter_provider_repair_failed'],
-        warnings: key.warnings,
-        repair,
-        model_catalog_repair: catalogRepair
-    };
-}
-export function detectCodexLbSetupDrift(state = {}) {
-    const drift = [];
-    if (state.useDefaultProvider && state.selected !== true)
-        drift.push('default_provider_not_selected');
-    if (!state.useDefaultProvider && state.selected === true)
-        drift.push('default_provider_selected_despite_no_default_provider');
-    if (state.writeEnvFile && state.envFile !== true)
-        drift.push('env_file_not_written');
-    if (!state.writeEnvFile && state.beforeState && state.afterState && state.beforeState.envHash !== state.afterState.envHash)
-        drift.push('env_file_changed_despite_no_env_file');
-    if (!state.writeEnvFile && !state.beforeState && state.envFile === true)
-        drift.push('env_file_written_despite_no_env_file');
-    if (!state.storeKeychain && state.keychain?.status && state.keychain.status !== 'skipped')
-        drift.push('keychain_touched_despite_no_keychain');
-    if (!state.syncLaunchctl && state.codexEnvironment?.launch_environment?.status === 'synced')
-        drift.push('launchctl_base_url_synced_despite_no_launchctl');
-    if (state.codexEnvironment?.launch_environment?.secret_env_cleanup?.status === 'partial')
-        drift.push('launchctl_secret_env_cleanup_incomplete');
-    if (state.shellProfile === 'skip' && state.shellProfileResult?.status === 'installed')
-        drift.push('shell_profile_written_despite_skip');
-    if (state.shellProfile === 'skip' && state.beforeState && state.afterState && state.beforeState.profileHash !== state.afterState.profileHash)
-        drift.push('shell_profile_changed_despite_skip');
-    return drift;
-}
-export async function captureCodexLbSetupWriteState({ home, configPath, envPath, metadataPath, shellProfile } = {}) {
-    const profileFiles = profileFilesForDrift(home, shellProfile);
-    const paths = [configPath, envPath, metadataPath, ...profileFiles].filter(Boolean);
-    const files = await Promise.all(paths.map(captureSetupFile));
-    const hashesByPath = new Map(await Promise.all(files.map(async (file) => [file.path, await capturedSetupFileHash(file)])));
-    const hashForPath = (file) => file ? hashesByPath.get(file) || 'missing' : 'missing';
-    return {
-        configHash: hashForPath(configPath),
-        envHash: hashForPath(envPath),
-        metadataHash: hashForPath(metadataPath),
-        profileHash: profileFiles.map(hashForPath).join('|'),
-        files,
-        stateHash: await sha256Text(JSON.stringify(files))
-    };
-}
-export async function writeCodexLbSetupFileIfUnchanged(input) {
-    const file = path.resolve(input.file);
-    if (path.resolve(String(input.expected.path || '')) !== file) {
-        return {
-            ok: false,
-            status: 'write_failed',
-            installed: false,
-            expected_after: {
-                path: file,
-                existed: true,
-                kind: 'regular',
-                bytes_base64: Buffer.from(input.text).toString('base64'),
-                mode: Number(input.mode) & 0o777
-            },
-            error: 'setup_snapshot_path_mismatch'
-        };
-    }
-    const expected = { ...input.expected, path: file };
-    const mode = Number(input.mode) & 0o777;
-    const expectedAfter = {
-        path: file,
-        existed: true,
-        kind: 'regular',
-        bytes_base64: Buffer.from(input.text).toString('base64'),
-        mode
-    };
-    if (expected.existed === true && expected.kind !== 'regular') {
-        return {
-            ok: false,
-            status: 'unsafe_setup_write_target',
-            installed: false,
-            expected_after: expectedAfter
-        };
-    }
-    assertTestHomeWriteAllowed(file);
-    await ensureDir(path.dirname(file));
-    const token = `${Date.now().toString(36)}-${process.pid}-${randomBytes(6).toString('hex')}`;
-    const claimedPath = `${file}.sks-setup-claimed-${token}`;
-    const candidatePath = `${file}.sks-setup-candidate-${token}`;
-    let claimed = false;
-    let installed = false;
-    try {
-        await writeBinaryAtomic(candidatePath, Buffer.from(input.text), { mode });
-        const observed = await captureSetupFile(file);
-        if (!setupFileStatesEqual(observed, expected)) {
-            return {
-                ok: false,
-                status: 'concurrent_change_detected',
-                installed: false,
-                expected_after: expectedAfter
-            };
-        }
-        if (setupFileStatesEqual(expected, expectedAfter)) {
-            return {
-                ok: true,
-                status: 'present',
-                installed: false,
-                expected_after: expectedAfter
-            };
-        }
-        if (expected.existed === true) {
-            try {
-                await fsp.rename(file, claimedPath);
-                claimed = true;
-            }
-            catch {
-                return {
-                    ok: false,
-                    status: 'concurrent_change_detected',
-                    installed: false,
-                    expected_after: expectedAfter
-                };
-            }
-            const claimedState = await captureSetupFile(claimedPath);
-            if (!setupFileStatesEqual(claimedState, { ...expected, path: claimedPath })) {
-                const recovered = await restoreClaimedSetupPathIfAbsent(claimedPath, file, claimedState);
-                claimed = !recovered;
-                const hardened = !claimed || await hardenCodexLbSetupRecoveryPath(claimedPath);
-                return {
-                    ok: false,
-                    status: hardened ? 'concurrent_change_detected' : 'write_failed',
-                    installed: false,
-                    expected_after: expectedAfter,
-                    ...(claimed ? { recovery_path: claimedPath } : {}),
-                    ...(hardened ? {} : { error: 'setup_recovery_mode_hardening_failed' })
-                };
-            }
-        }
-        await input.beforeReplacement?.({ path: file });
-        try {
-            await fsp.link(candidatePath, file);
-            installed = true;
-        }
-        catch {
-            if (claimed) {
-                const claimedState = await captureSetupFile(claimedPath).catch(() => null);
-                const recovered = claimedState
-                    ? await restoreClaimedSetupPathIfAbsent(claimedPath, file, claimedState)
-                    : false;
-                claimed = !recovered;
-            }
-            const hardened = !claimed || await hardenCodexLbSetupRecoveryPath(claimedPath);
-            return {
-                ok: false,
-                status: hardened ? 'concurrent_change_detected' : 'write_failed',
-                installed: false,
-                expected_after: expectedAfter,
-                ...(claimed ? { recovery_path: claimedPath } : {}),
-                ...(hardened ? {} : { error: 'setup_recovery_mode_hardening_failed' })
-            };
-        }
-        const committed = await captureSetupFile(file);
-        if (!setupFileStatesEqual(committed, expectedAfter)) {
-            const hardened = !claimed || await hardenCodexLbSetupRecoveryPath(claimedPath);
-            return {
-                ok: false,
-                status: hardened ? 'concurrent_change_detected' : 'write_failed',
-                installed: true,
-                expected_after: expectedAfter,
-                ...(claimed ? { recovery_path: claimedPath } : {}),
-                ...(hardened ? {} : { error: 'setup_recovery_mode_hardening_failed' })
-            };
-        }
-        if (claimed && !await hardenCodexLbSetupRecoveryPath(claimedPath)) {
-            return {
-                ok: false,
-                status: 'write_failed',
-                installed: true,
-                expected_after: expectedAfter,
-                recovery_path: claimedPath,
-                error: 'setup_recovery_mode_hardening_failed'
-            };
-        }
-        return {
-            ok: true,
-            status: 'written',
-            installed: true,
-            expected_after: expectedAfter,
-            ...(claimed ? { recovery_path: claimedPath } : {})
-        };
-    }
-    catch (error) {
-        if (claimed && !installed) {
-            const claimedState = await captureSetupFile(claimedPath).catch(() => null);
-            const recovered = claimedState
-                ? await restoreClaimedSetupPathIfAbsent(claimedPath, file, claimedState)
-                : false;
-            claimed = !recovered;
-        }
-        const hardened = !claimed || await hardenCodexLbSetupRecoveryPath(claimedPath);
-        return {
-            ok: false,
-            status: 'write_failed',
-            installed,
-            expected_after: expectedAfter,
-            ...(claimed ? { recovery_path: claimedPath } : {}),
-            error: [
-                error instanceof Error ? error.message : String(error),
-                ...(hardened ? [] : ['setup_recovery_mode_hardening_failed'])
-            ].join(':')
-        };
-    }
-    finally {
-        await fsp.rm(candidatePath, { force: true }).catch(() => undefined);
-    }
-}
-export async function hardenCodexLbSetupRecoveryPath(file) {
-    let handle = null;
-    try {
-        handle = await fsp.open(file, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-        const before = await handle.stat();
-        if (!before.isFile())
-            return false;
-        await handle.chmod(0o600);
-        const hardened = await handle.stat();
-        const pathStat = await fsp.lstat(file);
-        return hardened.isFile()
-            && (hardened.mode & 0o777) === 0o600
-            && pathStat.isFile()
-            && !pathStat.isSymbolicLink()
-            && pathStat.dev === hardened.dev
-            && pathStat.ino === hardened.ino;
-    }
-    catch {
-        return false;
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-}
-export async function removeCodexLbSetupRecoveryPath(file) {
-    if (!path.basename(file).includes('.sks-setup-claimed-'))
-        return false;
-    let handle = null;
-    try {
-        handle = await fsp.open(file, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-        const opened = await handle.stat();
-        const pathStat = await fsp.lstat(file);
-        if (!opened.isFile()
-            || !pathStat.isFile()
-            || pathStat.isSymbolicLink()
-            || pathStat.dev !== opened.dev
-            || pathStat.ino !== opened.ino)
-            return false;
-        await fsp.unlink(file);
-        return await fsp.lstat(file).then(() => false, (error) => error.code === 'ENOENT');
-    }
-    catch {
-        return false;
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-}
-export async function restoreCodexLbSetupWriteState(state, expectedCurrentState, opts = {}) {
-    const restored = [];
-    const removed = [];
-    const blockers = [];
-    const recovery = [];
-    const expectedByPath = new Map((Array.isArray(expectedCurrentState?.files) ? expectedCurrentState.files : [])
-        .map((entry) => [String(entry?.path || ''), entry]));
-    for (const entry of Array.isArray(state?.files) ? [...state.files].reverse() : []) {
-        const file = String(entry?.path || '');
-        if (!file)
-            continue;
-        try {
-            const expected = expectedByPath.get(file);
-            if (!expected) {
-                blockers.push(`setup_rollback_missing_expected_state:${file}`);
-                continue;
-            }
-            if (expected && setupFileStatesEqual(entry, expected))
-                continue;
-            const commit = await commitSetupRollbackIfUnchanged({
-                file,
-                before: entry,
-                expected,
-                ...(opts.beforeReplacement ? { beforeReplacement: opts.beforeReplacement } : {})
-            });
-            if (commit.recoveryPath)
-                recovery.push(commit.recoveryPath);
-            if (!commit.ok) {
-                blockers.push(`${commit.failed ? 'setup_rollback_failed' : 'setup_rollback_conflict'}:${file}`);
-                continue;
-            }
-            if (commit.restored)
-                restored.push(file);
-            if (commit.removed)
-                removed.push(file);
-        }
-        catch {
-            blockers.push(`setup_rollback_failed:${file}`);
-        }
-    }
-    return { ok: blockers.length === 0, restored, removed, blockers, recovery };
-}
-function setupFileStatesEqual(left, right) {
-    return left?.existed === right?.existed
-        && String(left?.kind || (left?.existed ? 'regular' : 'missing')) === String(right?.kind || (right?.existed ? 'regular' : 'missing'))
-        && String(left?.bytes_base64 || '') === String(right?.bytes_base64 || '')
-        && (left?.existed !== true || Number(left?.mode) === Number(right?.mode));
-}
-async function captureSetupFile(file) {
-    let pathStat;
-    try {
-        pathStat = await fsp.lstat(file);
-    }
-    catch (error) {
-        if (error?.code === 'ENOENT') {
-            return { path: file, existed: false, kind: 'missing', bytes_base64: '', mode: null };
-        }
-        throw error;
-    }
-    if (pathStat.isSymbolicLink()) {
-        return { path: file, existed: true, kind: 'symlink', bytes_base64: '', mode: pathStat.mode & 0o777 };
-    }
-    if (!pathStat.isFile()) {
-        return { path: file, existed: true, kind: 'non_regular', bytes_base64: '', mode: pathStat.mode & 0o777 };
-    }
-    let handle = null;
-    try {
-        handle = await fsp.open(file, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-        const stat = await handle.stat();
-        if (!stat.isFile()) {
-            return { path: file, existed: true, kind: 'non_regular', bytes_base64: '', mode: stat.mode & 0o777 };
-        }
-        const bytes = await handle.readFile();
-        return {
-            path: file,
-            existed: true,
-            kind: 'regular',
-            bytes_base64: bytes.toString('base64'),
-            mode: stat.mode & 0o777
-        };
-    }
-    catch (error) {
-        if (error?.code === 'ENOENT') {
-            return { path: file, existed: false, kind: 'missing', bytes_base64: '', mode: null };
-        }
-        if (error?.code === 'ELOOP') {
-            const stat = await fsp.lstat(file).catch(() => null);
-            return {
-                path: file,
-                existed: true,
-                kind: 'symlink',
-                bytes_base64: '',
-                mode: stat ? stat.mode & 0o777 : null
-            };
-        }
-        throw error;
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-}
-async function commitSetupRollbackIfUnchanged(input) {
-    const { file, before, expected } = input;
-    await ensureDir(path.dirname(file));
-    const token = `${Date.now().toString(36)}-${process.pid}-${randomBytes(6).toString('hex')}`;
-    const claimedPath = `${file}.sks-rollback-claimed-${token}`;
-    const candidatePath = `${file}.sks-rollback-candidate-${token}`;
-    let claimed = false;
-    try {
-        if (expected.existed === true) {
-            const currentStat = await fsp.lstat(file).catch((error) => {
-                if (error.code === 'ENOENT')
-                    return null;
-                throw error;
-            });
-            if (!currentStat || currentStat.isSymbolicLink() || !currentStat.isFile()) {
-                return { ok: false, restored: false, removed: false };
-            }
-            try {
-                await fsp.rename(file, claimedPath);
-                claimed = true;
-            }
-            catch {
-                return { ok: false, restored: false, removed: false };
-            }
-            const claimedState = await captureSetupFile(claimedPath);
-            if (!setupFileStatesEqual(claimedState, { ...expected, path: claimedPath })) {
-                const recovered = await restoreClaimedSetupPathIfAbsent(claimedPath, file, claimedState);
-                claimed = !recovered;
-                return {
-                    ok: false,
-                    restored: false,
-                    removed: false,
-                    ...(claimed ? { recoveryPath: claimedPath } : {})
-                };
-            }
-        }
-        else {
-            const current = await captureSetupFile(file);
-            if (!setupFileStatesEqual(current, expected)) {
-                return { ok: false, restored: false, removed: false };
-            }
-        }
-        await input.beforeReplacement?.({ path: file });
-        if (before.existed === true) {
-            if (String(before.kind || 'regular') !== 'regular') {
-                if (claimed) {
-                    const claimedState = await captureSetupFile(claimedPath);
-                    const recovered = await restoreClaimedSetupPathIfAbsent(claimedPath, file, claimedState);
-                    claimed = !recovered;
-                }
-                return {
-                    ok: false,
-                    restored: false,
-                    removed: false,
-                    failed: true,
-                    ...(claimed ? { recoveryPath: claimedPath } : {})
-                };
-            }
-            const bytes = Buffer.from(String(before.bytes_base64 || ''), 'base64');
-            await writeBinaryAtomic(candidatePath, bytes, { mode: Number(before.mode || 0o600) });
-            try {
-                await fsp.link(candidatePath, file);
-            }
-            catch {
-                return {
-                    ok: false,
-                    restored: false,
-                    removed: false,
-                    ...(claimed ? { recoveryPath: claimedPath } : {})
-                };
-            }
-            const committed = await captureSetupFile(file);
-            if (!setupFileStatesEqual(committed, before)) {
-                return {
-                    ok: false,
-                    restored: false,
-                    removed: false,
-                    ...(claimed ? { recoveryPath: claimedPath } : {})
-                };
-            }
-            return {
-                ok: true,
-                restored: true,
-                removed: false,
-                ...(claimed ? { recoveryPath: claimedPath } : {})
-            };
-        }
-        const committed = await captureSetupFile(file);
-        if (!setupFileStatesEqual(committed, before)) {
-            return {
-                ok: false,
-                restored: false,
-                removed: false,
-                ...(claimed ? { recoveryPath: claimedPath } : {})
-            };
-        }
-        return {
-            ok: true,
-            restored: false,
-            removed: true,
-            ...(claimed ? { recoveryPath: claimedPath } : {})
-        };
-    }
-    catch {
-        if (claimed) {
-            const claimedState = await captureSetupFile(claimedPath).catch(() => null);
-            const recovered = claimedState
-                ? await restoreClaimedSetupPathIfAbsent(claimedPath, file, claimedState)
-                : false;
-            claimed = !recovered;
-        }
-        return {
-            ok: false,
-            restored: false,
-            removed: false,
-            failed: true,
-            ...(claimed ? { recoveryPath: claimedPath } : {})
-        };
-    }
-    finally {
-        await fsp.rm(candidatePath, { force: true }).catch(() => undefined);
-    }
-}
-async function restoreClaimedSetupPathIfAbsent(claimedPath, file, claimedState) {
-    try {
-        if (claimedState?.kind === 'regular') {
-            await fsp.link(claimedPath, file);
-        }
-        else if (claimedState?.kind === 'symlink') {
-            await fsp.symlink(await fsp.readlink(claimedPath), file);
-        }
-        else {
-            return false;
-        }
-        await fsp.unlink(claimedPath);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function capturedSetupFileHash(file) {
-    if (file.kind !== 'regular')
-        return 'missing';
-    return await sha256Text(Buffer.from(file.bytes_base64, 'base64').toString('utf8'));
-}
-function profileFilesForDrift(home, shellProfile) {
-    const targets = {
-        zsh: path.join(home, '.zshrc'),
-        bash: path.join(home, '.bashrc'),
-        fish: path.join(home, '.config', 'fish', 'config.fish')
-    };
-    if (shellProfile === 'zsh')
-        return [targets.zsh];
-    if (shellProfile === 'bash')
-        return [targets.bash];
-    if (shellProfile === 'fish')
-        return [targets.fish];
-    if (shellProfile === 'all')
-        return [targets.zsh, targets.bash, targets.fish];
-    return [targets.zsh, targets.bash, targets.fish];
-}
-export function appliedCodexLbPersistenceModes(state = {}) {
-    const modes = [];
-    if (state.writeEnvFile && state.envFile === true)
-        modes.push('durable_env_file');
-    if (state.storeKeychain && state.keychain?.ok === true)
-        modes.push('durable_keychain');
-    if (state.syncLaunchctl && state.codexEnvironment?.launch_environment?.status === 'synced')
-        modes.push('process_only_ephemeral');
-    if (state.shellProfile !== 'skip' && state.shellProfileResult?.status === 'installed')
-        modes.push('shell_profile');
-    if (!modes.length && state.apiKeySource === 'process.env')
-        modes.push('process_only_ephemeral');
-    if (!modes.length)
-        modes.push('none');
-    return modes;
-}
-export function shellSingleQuote(value) {
-    return `'${String(value).replace(/'/g, `'\\''`)}'`;
-}
-export function parseCodexLbEnvBaseUrl(text = '') {
-    const value = parseShellEnvValue(text, 'CODEX_LB_BASE_URL');
-    return value ? normalizeCodexLbBaseUrl(value) : '';
-}
-export function parseCodexSharedLoginApiKey(text = '') {
-    try {
-        const parsed = JSON.parse(String(text || ''));
-        const authMode = String(parsed?.auth_mode || parsed?.authMode || parsed?.mode || '').toLowerCase();
-        const key = parsed?.key || parsed?.api_key || parsed?.apiKey || parsed?.openai_api_key || parsed?.OPENAI_API_KEY;
-        if (!key || typeof key !== 'string')
-            return '';
-        if (authMode && !/api[-_]?key|apikey/.test(authMode))
-            return '';
-        return key.trim();
-    }
-    catch {
-        return '';
-    }
-}
-function parseShellEnvValue(text = '', key = '') {
-    const re = new RegExp(`^\\s*(?:export\\s+)?${escapeRegExp(key)}\\s*=\\s*(.+?)\\s*$`, 'm');
-    const envMatch = String(text || '').match(re);
-    const raw = envMatch?.[1]?.trim() || '';
-    if (!raw)
-        return '';
-    if (raw.startsWith("'"))
-        return raw.endsWith("'") && raw.length > 1 ? raw.slice(1, -1).replace(/'\\''/g, "'") : '';
-    if (raw.startsWith('"'))
-        return raw.endsWith('"') && raw.length > 1 ? raw.slice(1, -1).replace(/\\"/g, '"') : '';
-    if (raw.includes("'") || raw.includes('"') || /\s/.test(raw))
-        return '';
-    return raw;
-}
-export async function sha256Text(value = '') {
-    const { createHash } = await import('node:crypto');
-    return createHash('sha256').update(String(value || '')).digest('hex');
-}
-function topLevelTomlString(text = '', key) {
+function topLevelTomlString(text, key) {
     const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
     return topLevel.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[2] || '';
 }
-function topLevelHasLine(text = '', line) {
+function topLevelHasLine(text, line) {
     const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
     return topLevel.split(/\r?\n/).some((candidate) => candidate.trim() === line);
 }
-function addTopLevelMarkerBeforeKey(text = '', key, marker) {
+function addTopLevelMarkerBeforeKey(text, key, marker) {
     const lines = String(text || '').split('\n');
     const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
     const end = firstTable === -1 ? lines.length : firstTable;
@@ -947,7 +101,7 @@ function addTopLevelMarkerBeforeKey(text = '', key, marker) {
         lines.splice(keyIndex, 0, marker);
     return lines.join('\n');
 }
-function removeTopLevelLine(text = '', target) {
+function removeTopLevelLine(text, target) {
     const lines = String(text || '').split('\n');
     const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
     const end = firstTable === -1 ? lines.length : firstTable;
@@ -957,3 +111,47 @@ function removeTopLevelLine(text = '', target) {
     }
     return lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
 }
+function removeTopLevelTomlKey(text, key) {
+    const lines = String(text || '').split('\n');
+    const firstTable = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
+    const end = firstTable === -1 ? lines.length : firstTable;
+    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    return lines
+        .filter((line, index) => index >= end || !keyPattern.test(line))
+        .join('\n')
+        .replace(/^\n+/, '')
+        .replace(/\n{3,}/g, '\n\n');
+}
+function removeManagedBridgeTopLevelBindings(text) {
+    let next = String(text || '');
+    next = removeTopLevelTomlKey(next, 'model_provider');
+    next = removeTopLevelTomlKey(next, 'openai_base_url');
+    next = removeTopLevelTomlKey(next, 'model_catalog_json');
+    for (const marker of [
+        DESKTOP_BRIDGE_MANAGED_MARKER,
+        DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER,
+        DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER
+    ])
+        next = removeTopLevelLine(next, marker);
+    return next;
+}
+function normalizeManagedBridgeBaseUrl(value) {
+    const normalized = String(value || '').trim().replace(/\/+$/, '');
+    let parsed;
+    try {
+        parsed = new URL(normalized);
+    }
+    catch {
+        throw new Error('desktop_bridge_loopback_base_url_required');
+    }
+    const hostname = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (parsed.protocol !== 'http:'
+        || !['127.0.0.1', 'localhost', '::1'].includes(hostname)
+        || parsed.username
+        || parsed.password
+        || parsed.search
+        || parsed.hash
+        || !/^\/__sks\/client\/[A-Za-z0-9_-]{43}\/backend-api\/codex$/.test(parsed.pathname.replace(/\/+$/, '')))
+        throw new Error('desktop_bridge_loopback_base_url_required');
+    return normalized;
+}