sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/desktop-bridge-migration/historical-config.js

@@ -0,0 +1,245 @@
+import path from 'node:path';
+import { DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, DESKTOP_BRIDGE_MANAGED_MARKER, DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER } from '../../../cli/install-helpers-codex-lb-config.js';
+import { escapeRegExp } from '../../text/regex.js';
+import { CANONICAL_OPENROUTER_ENDPOINT, HISTORICAL_DESKTOP_BRIDGE_MARKER, HISTORICAL_DESKTOP_COMPAT_MARKER, HISTORICAL_MODEL_CATALOG_MARKER, HISTORICAL_OAUTH_SELECTION_MARKER, HISTORICAL_OPENAI_ROUTING_MARKER, HISTORICAL_PROVIDER_MODE_MARKER, HISTORICAL_PROVIDER_SELECTION_MARKER, hasTomlTable, hasTopLevelMarker, isHistoricalProviderMode, secretFreeProviderEndpoint, tomlTableBoolean, tomlTableContainsCustomHeader, tomlTableString, topLevelTomlString } from './historical-toml.js';
+export function inspectHistoricalDesktopBridgeIntent(configText) {
+    const source = String(configText || '');
+    const topLevel = source.split(/\n\s*\[/)[0] || '';
+    const markerValues = topLevel
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(HISTORICAL_PROVIDER_MODE_MARKER))
+        .map((line) => line.slice(HISTORICAL_PROVIDER_MODE_MARKER.length).trim());
+    const providerMode = markerValues.length === 1 && isHistoricalProviderMode(markerValues[0])
+        ? markerValues[0]
+        : null;
+    const selectedProvider = topLevelTomlString(source, 'model_provider') || null;
+    const nativeBridge = hasTopLevelMarker(source, HISTORICAL_DESKTOP_BRIDGE_MARKER);
+    const compatBridge = hasTopLevelMarker(source, HISTORICAL_DESKTOP_COMPAT_MARKER);
+    const managedCodexLbSelection = hasTopLevelMarker(source, HISTORICAL_PROVIDER_SELECTION_MARKER);
+    const managedOAuthSelection = hasTopLevelMarker(source, HISTORICAL_OAUTH_SELECTION_MARKER);
+    const codexLbPresent = hasTomlTable(source, 'model_providers.codex-lb');
+    const openRouterPresent = hasTomlTable(source, 'model_providers.openrouter');
+    const combinedRouterPresent = hasTomlTable(source, 'model_providers.sks-router');
+    const blockers = [];
+    if (markerValues.length > 1)
+        blockers.push('historical_provider_marker_conflict');
+    else if (markerValues.length === 1 && !providerMode)
+        blockers.push('historical_provider_marker_invalid');
+    if (nativeBridge && compatBridge)
+        blockers.push('historical_desktop_marker_conflict');
+    if (nativeBridge && selectedProvider !== 'openai')
+        blockers.push('historical_native_bridge_selection_mismatch');
+    if (compatBridge && selectedProvider !== 'codex-lb')
+        blockers.push('historical_compat_bridge_selection_mismatch');
+    if (managedCodexLbSelection && selectedProvider !== 'codex-lb') {
+        blockers.push('historical_codex_lb_selection_marker_mismatch');
+    }
+    if (managedOAuthSelection && selectedProvider !== 'openai') {
+        blockers.push('historical_oauth_selection_marker_mismatch');
+    }
+    const knownSelections = new Set(['openai', 'codex-lb', 'openrouter', 'sks-router']);
+    if (selectedProvider && !knownSelections.has(selectedProvider)) {
+        blockers.push('historical_user_owned_provider_selection_conflict');
+    }
+    else if (selectedProvider === 'codex-lb'
+        && !compatBridge
+        && !managedCodexLbSelection
+        && providerMode !== 'codex-lb') {
+        blockers.push('historical_user_owned_provider_selection_conflict');
+    }
+    else if (selectedProvider === 'openrouter' && !openRouterPresent) {
+        blockers.push('historical_openrouter_selection_table_missing');
+    }
+    else if (selectedProvider === 'sks-router' && !combinedRouterPresent) {
+        blockers.push('historical_combined_router_table_missing');
+    }
+    if (providerMode === 'chatgpt-oauth' && selectedProvider !== null && selectedProvider !== 'openai') {
+        blockers.push('historical_provider_mode_selection_mismatch');
+    }
+    if (providerMode === 'codex-lb'
+        && selectedProvider !== null
+        && selectedProvider !== 'openai'
+        && selectedProvider !== 'codex-lb')
+        blockers.push('historical_provider_mode_selection_mismatch');
+    if (providerMode === 'openrouter'
+        && selectedProvider !== null
+        && selectedProvider !== 'openai'
+        && selectedProvider !== 'openrouter')
+        blockers.push('historical_provider_mode_selection_mismatch');
+    const rawCodexLbEndpoint = tomlTableString(source, 'model_providers.codex-lb', 'base_url');
+    const codexLbEndpoint = codexLbPresent ? secretFreeProviderEndpoint(rawCodexLbEndpoint) : null;
+    if (codexLbPresent && !codexLbEndpoint)
+        blockers.push('historical_codex_lb_endpoint_invalid');
+    const rawOpenRouterEndpoint = tomlTableString(source, 'model_providers.openrouter', 'base_url');
+    const openRouterEndpoint = rawOpenRouterEndpoint === CANONICAL_OPENROUTER_ENDPOINT
+        ? CANONICAL_OPENROUTER_ENDPOINT
+        : null;
+    if (openRouterPresent && !openRouterEndpoint)
+        blockers.push('historical_openrouter_endpoint_not_canonical');
+    if ((nativeBridge || compatBridge || managedCodexLbSelection || providerMode === 'codex-lb') && !codexLbPresent) {
+        blockers.push('historical_codex_lb_table_missing');
+    }
+    if ((selectedProvider === 'openrouter' || providerMode === 'openrouter') && !openRouterPresent) {
+        blockers.push('historical_openrouter_table_missing');
+    }
+    const codexLbTransport = codexLbPresent
+        ? compatBridge
+            || tomlTableBoolean(source, 'model_providers.codex-lb', 'requires_openai_auth') === true
+            || tomlTableContainsCustomHeader(source, 'model_providers.codex-lb')
+            ? 'x-codex-lb-api-key'
+            : 'authorization-bearer'
+        : null;
+    let defaultProvider = null;
+    if (providerMode === 'codex-lb' || nativeBridge || compatBridge || selectedProvider === 'codex-lb') {
+        defaultProvider = 'codex-lb';
+    }
+    else if (providerMode === 'openrouter' || selectedProvider === 'openrouter') {
+        defaultProvider = 'openrouter';
+    }
+    const uniqueBlockers = [...new Set(blockers)];
+    const usable = uniqueBlockers.length === 0;
+    return {
+        schema: 'sks.desktop-bridge-historical-intent.v1',
+        blockers: uniqueBlockers,
+        providers: {
+            'codex-lb': {
+                present: codexLbPresent,
+                enabled: usable && codexLbPresent,
+                endpoint_url: codexLbEndpoint,
+                auth_transport: codexLbTransport
+            },
+            openrouter: {
+                present: openRouterPresent,
+                enabled: usable && openRouterPresent,
+                endpoint_url: openRouterEndpoint,
+                auth_transport: openRouterPresent ? 'openrouter-bearer' : null
+            }
+        },
+        default_provider_id: usable ? defaultProvider : null
+    };
+}
+export function prepareHistoricalConfigForDesktopBridgeWriter(text, state) {
+    const source = String(text || '');
+    if ([
+        DESKTOP_BRIDGE_MANAGED_MARKER,
+        DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER,
+        DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER
+    ].every((marker) => hasTopLevelMarker(source, marker)))
+        return source;
+    const historicalMarkers = historicalManagedMarkers();
+    const hasHistoricalMarker = historicalMarkers.some((marker) => hasTopLevelMarker(source, marker));
+    const hasHistoricalMode = topLevelLines(source).some((line) => line.startsWith(HISTORICAL_PROVIDER_MODE_MARKER));
+    const codexLbSelectionOwned = state.model_provider === 'codex-lb'
+        && (hasHistoricalMarker || state.provider_mode === 'codex-lb');
+    const knownThirdPartySelection = state.model_provider === 'openrouter' || state.model_provider === 'sks-router';
+    const historicalOpenAiSelection = state.model_provider === 'openai' && (hasHistoricalMarker || hasHistoricalMode);
+    let next = source;
+    if (codexLbSelectionOwned || knownThirdPartySelection || historicalOpenAiSelection) {
+        next = removeTopLevelKey(next, 'model_provider');
+    }
+    if (hasTopLevelMarker(source, HISTORICAL_DESKTOP_BRIDGE_MARKER)
+        || hasTopLevelMarker(source, HISTORICAL_OPENAI_ROUTING_MARKER))
+        next = removeTopLevelKey(next, 'openai_base_url');
+    const historicalCatalog = state.catalog_path || '';
+    const historicalCatalogOwned = hasTopLevelMarker(source, HISTORICAL_MODEL_CATALOG_MARKER)
+        || ['sks-codex-lb-tool-catalog.json', 'sks-openrouter-catalog.json', 'opencodex-catalog.json']
+            .includes(path.basename(historicalCatalog));
+    if (historicalCatalogOwned)
+        next = removeTopLevelKey(next, 'model_catalog_json');
+    for (const marker of historicalMarkers)
+        next = removeTopLevelExactLine(next, marker);
+    return removeTopLevelLinesWithPrefix(next, HISTORICAL_PROVIDER_MODE_MARKER);
+}
+export function parseHistoricalProviderConfig(text) {
+    const source = String(text || '');
+    const topLevel = source.split(/\n\s*\[/)[0] || '';
+    const markerValues = topLevel
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(HISTORICAL_PROVIDER_MODE_MARKER))
+        .map((line) => line.slice(HISTORICAL_PROVIDER_MODE_MARKER.length).trim());
+    const providerMode = markerValues.length === 1 && isHistoricalProviderMode(markerValues[0])
+        ? markerValues[0]
+        : null;
+    const modelProvider = topLevelTomlString(source, 'model_provider') || null;
+    const catalogPath = topLevelTomlString(source, 'model_catalog_json') || null;
+    const markers = historicalManagedMarkers().filter((marker) => hasTopLevelMarker(source, marker));
+    const migratedProfiles = new Set();
+    if (providerMode === 'codex-lb'
+        || modelProvider === 'codex-lb'
+        || hasTomlTable(source, 'model_providers.codex-lb')
+        || markers.includes(HISTORICAL_DESKTOP_COMPAT_MARKER))
+        migratedProfiles.add('codex-lb');
+    if (providerMode === 'openrouter'
+        || modelProvider === 'openrouter'
+        || hasTomlTable(source, 'model_providers.openrouter'))
+        migratedProfiles.add('openrouter');
+    if (modelProvider === 'sks-router' || hasTomlTable(source, 'model_providers.sks-router')) {
+        if (hasTomlTable(source, 'model_providers.codex-lb'))
+            migratedProfiles.add('codex-lb');
+        if (hasTomlTable(source, 'model_providers.openrouter'))
+            migratedProfiles.add('openrouter');
+    }
+    const blockers = [];
+    if (markerValues.length > 1)
+        blockers.push('historical_provider_marker_conflict');
+    else if (markerValues.length === 1 && !providerMode)
+        blockers.push('historical_provider_marker_invalid');
+    const desktopMode = markers.includes(HISTORICAL_DESKTOP_COMPAT_MARKER)
+        ? 'desktop-dual-auth-compat'
+        : markers.includes(HISTORICAL_DESKTOP_BRIDGE_MARKER)
+            ? 'desktop-native-bridge'
+            : modelProvider === 'codex-lb'
+                ? 'cli-provider'
+                : null;
+    const gatewayAuthTransport = markers.includes(HISTORICAL_DESKTOP_COMPAT_MARKER)
+        || tomlTableBoolean(source, 'model_providers.codex-lb', 'requires_openai_auth') === true
+        ? 'x-codex-lb-api-key'
+        : hasTomlTable(source, 'model_providers.codex-lb')
+            ? 'authorization-bearer'
+            : null;
+    return {
+        desktop_mode: desktopMode,
+        provider_mode: providerMode,
+        model_provider: modelProvider,
+        catalog_path: catalogPath,
+        migrated_profiles: [...migratedProfiles].sort(),
+        gateway_auth_transport: gatewayAuthTransport,
+        blockers
+    };
+}
+function historicalManagedMarkers() {
+    return [
+        HISTORICAL_DESKTOP_BRIDGE_MARKER,
+        HISTORICAL_DESKTOP_COMPAT_MARKER,
+        HISTORICAL_PROVIDER_SELECTION_MARKER,
+        HISTORICAL_OAUTH_SELECTION_MARKER,
+        HISTORICAL_OPENAI_ROUTING_MARKER,
+        HISTORICAL_MODEL_CATALOG_MARKER
+    ];
+}
+function topLevelLines(text) {
+    const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
+    return topLevel.split(/\r?\n/).map((line) => line.trim());
+}
+function removeTopLevelKey(text, key) {
+    const pattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    return filterTopLevelLines(text, (line) => !pattern.test(line));
+}
+function removeTopLevelExactLine(text, target) {
+    return filterTopLevelLines(text, (line) => line.trim() !== target);
+}
+function removeTopLevelLinesWithPrefix(text, prefix) {
+    return filterTopLevelLines(text, (line) => !line.trim().startsWith(prefix));
+}
+function filterTopLevelLines(text, keep) {
+    const lines = String(text || '').split('\n');
+    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+    const end = firstTable === -1 ? lines.length : firstTable;
+    return lines
+        .filter((line, index) => index >= end || keep(line))
+        .join('\n')
+        .replace(/^\n+/, '')
+        .replace(/\n{3,}/g, '\n\n');
+}

package/dist/core/codex-lb/desktop-bridge-migration/historical-toml.js

@@ -0,0 +1,56 @@
+import { escapeRegExp } from '../../text/regex.js';
+export const HISTORICAL_PROVIDER_MODE_MARKER = '# sks-managed-provider-mode:';
+export const HISTORICAL_DESKTOP_BRIDGE_MARKER = '# sks-codex-lb-managed-desktop-bridge';
+export const HISTORICAL_DESKTOP_COMPAT_MARKER = '# sks-codex-lb-managed-desktop-compat';
+export const HISTORICAL_PROVIDER_SELECTION_MARKER = '# sks-codex-lb-managed-provider-selection';
+export const HISTORICAL_OAUTH_SELECTION_MARKER = '# sks-codex-lb-managed-oauth-selection';
+export const HISTORICAL_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
+export const HISTORICAL_MODEL_CATALOG_MARKER = '# sks-codex-lb-managed-model-catalog';
+export const CANONICAL_OPENROUTER_ENDPOINT = 'https://openrouter.ai/api/v1';
+export function isHistoricalProviderMode(value) {
+    return value === 'chatgpt-oauth' || value === 'codex-lb' || value === 'openrouter';
+}
+export function topLevelTomlString(text, key) {
+    const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
+    return topLevel.match(new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[1] || '';
+}
+export function hasTopLevelMarker(text, marker) {
+    const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
+    return topLevel.split(/\r?\n/).some((line) => line.trim() === marker);
+}
+export function hasTomlTable(text, table) {
+    return new RegExp(`(?:^|\\n)\\s*\\[${escapeRegExp(table)}\\]\\s*(?=\\n|$)`).test(text);
+}
+export function tomlTableString(text, table, key) {
+    const block = tomlTableBlock(text, table);
+    return block.match(new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[1] || null;
+}
+export function tomlTableBoolean(text, table, key) {
+    const block = tomlTableBlock(text, table);
+    const value = block.match(new RegExp(`(?:^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*(true|false)\\s*(?:#.*)?(?=\\n|$)`))?.[1];
+    return value === 'true' ? true : value === 'false' ? false : null;
+}
+export function tomlTableContainsCustomHeader(text, table) {
+    return /(?:^|[\s"'{,])x-codex-lb-api-key(?:[\s"'}=,]|$)/i.test(tomlTableBlock(text, table));
+}
+function tomlTableBlock(text, table) {
+    return String(text || '').match(new RegExp(`(?:^|\\n)\\s*\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\s*\\[[^\\]]+\\]|\\s*$)`))?.[1] || '';
+}
+export function secretFreeProviderEndpoint(value) {
+    if (!value)
+        return null;
+    try {
+        const parsed = new URL(value);
+        if ((parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+            || !parsed.hostname
+            || parsed.username
+            || parsed.password
+            || parsed.search
+            || parsed.hash)
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/core/codex-lb/desktop-bridge-migration/metadata.js

@@ -0,0 +1,73 @@
+import { createHash } from 'node:crypto';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir } from '../../fsx.js';
+export function validateMetadataUpdates(updates, protectedPaths) {
+    const seen = new Set();
+    for (const update of updates) {
+        const filePath = path.resolve(String(update.path || ''));
+        if (!update.path || !path.isAbsolute(update.path)) {
+            throw new Error('desktop_bridge_metadata_path_invalid');
+        }
+        if (filePath === path.resolve(protectedPaths.configPath)) {
+            throw new Error('desktop_bridge_metadata_config_path_forbidden');
+        }
+        if (filePath === path.resolve(protectedPaths.authPath) || metadataPathLooksSecret(filePath)) {
+            throw new Error('desktop_bridge_metadata_secret_path_forbidden');
+        }
+        const expectedPath = canonicalMetadataPath(protectedPaths.home, update.kind);
+        if (filePath !== expectedPath) {
+            throw new Error(`desktop_bridge_metadata_path_not_canonical:${update.kind}`);
+        }
+        if (seen.has(filePath))
+            throw new Error('desktop_bridge_metadata_path_duplicate');
+        seen.add(filePath);
+        if (!['bridge_settings', 'provider_registry', 'catalog_binding', 'route_policy', 'launchd_state'].includes(update.kind)) {
+            throw new Error('desktop_bridge_metadata_kind_invalid');
+        }
+        if (typeof update.text !== 'string')
+            throw new Error('desktop_bridge_metadata_text_invalid');
+    }
+}
+export function normalizedMetadataUpdates(updates) {
+    return updates.map((update) => ({ ...update, path: path.resolve(update.path) }));
+}
+export function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+export async function writeBufferAtomic(filePath, bytes) {
+    await ensureDir(path.dirname(filePath));
+    const tempPath = `${filePath}.${process.pid}.${Date.now().toString(36)}.tmp`;
+    try {
+        await fsp.writeFile(tempPath, bytes, { mode: 0o600, flag: 'wx' });
+        await fsp.rename(tempPath, filePath);
+        await fsp.chmod(filePath, 0o600);
+    }
+    catch (error) {
+        await fsp.rm(tempPath, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
+function canonicalMetadataPath(home, kind) {
+    const resolvedHome = path.resolve(home);
+    if (kind === 'bridge_settings') {
+        return path.join(resolvedHome, '.codex', 'sks', 'desktop-bridge-settings.json');
+    }
+    if (kind === 'provider_registry') {
+        return path.join(resolvedHome, '.codex', 'sks', 'sks-bridge-provider-registry.json');
+    }
+    if (kind === 'catalog_binding') {
+        return path.join(resolvedHome, '.codex', 'sks', 'sks-bridge-active-generation.json');
+    }
+    if (kind === 'route_policy') {
+        return path.join(resolvedHome, '.codex', 'sks', 'sks-bridge-route-policy.json');
+    }
+    return path.join(resolvedHome, 'Library', 'LaunchAgents', 'com.sneakoscope.desktop-bridge.plist');
+}
+function metadataPathLooksSecret(filePath) {
+    const basename = path.basename(filePath).toLowerCase();
+    const segments = filePath.toLowerCase().split(path.sep);
+    return segments.includes('secrets')
+        || ['auth.json', 'sks-codex-lb.env', 'openrouter-api-key', 'openrouter-api-key.json'].includes(basename)
+        || /(?:credential|api-key|secret)/i.test(basename);
+}

package/dist/core/codex-lb/desktop-bridge-migration/receipt.js

@@ -0,0 +1,52 @@
+export function authSemanticIdentityPreserved(before, after) {
+    if (before.path !== after.path || before.exists !== after.exists)
+        return false;
+    if (before.sha256 !== after.sha256)
+        return false;
+    const beforeIsOAuth = before.mode === 'chatgpt_oauth' || before.mode === 'mixed';
+    const afterIsOAuth = after.mode === 'chatgpt_oauth' || after.mode === 'mixed';
+    if (beforeIsOAuth || afterIsOAuth) {
+        return beforeIsOAuth
+            && afterIsOAuth
+            && before.semantic_fingerprint !== null
+            && before.semantic_fingerprint === after.semantic_fingerprint;
+    }
+    return true;
+}
+export function buildDesktopBridgeMigrationReceipt(input) {
+    const common = {
+        schema: 'sks.desktop-bridge-unification-receipt.v1',
+        receipt_id: input.receiptId,
+        created_at: input.createdAt,
+        baseline_version: '8.1.2',
+        target_version: '8.1.3',
+        config_before_sha256: input.configBeforeSha,
+        config_after_sha256: input.configAfterSha,
+        auth_before_sha256: input.authBeforeSha,
+        auth_after_sha256: input.authAfterSha,
+        auth_semantic_identity_preserved: input.authSemanticIdentityPreserved ?? true,
+        historical_state: {
+            desktop_mode: input.historicalState.desktop_mode,
+            historical_provider_selection: input.historicalState.provider_mode,
+            model_provider: input.historicalState.model_provider,
+            catalog_path: input.historicalState.catalog_path
+        },
+        migrated_profiles: input.historicalState.migrated_profiles,
+        credentials_deleted: false,
+        new_runtime: 'desktop-bridge',
+        new_catalog_generation: input.newCatalogGeneration,
+        backup_paths: input.rollbackFiles
+            .map((file) => file.backup_path)
+            .filter((entry) => Boolean(entry)),
+        blockers: input.blockers || [],
+        rollback_metadata: {
+            schema: 'sks.desktop-bridge-unification-rollback-metadata.v1',
+            files: input.rollbackFiles
+        }
+    };
+    return {
+        ...common,
+        rollback_supported: true,
+        migration_status: 'migrated'
+    };
+}

package/dist/core/codex-lb/desktop-bridge-migration/retired-runtime-cleanup.js

@@ -0,0 +1,106 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { runProcess } from '../../fsx.js';
+const RETIRED_LAUNCHD_LABEL = 'com.sneakoscope.codex-lb-desktop-bridge';
+const RETIRED_SETTINGS_SCHEMA = 'sks.codex-lb-desktop-bridge-settings.v2';
+const RETIRED_STATE_SCHEMA = 'sks.codex-lb-desktop-bridge.v2';
+const SETTINGS_KEYS = new Set([
+    'schema', 'listen_host', 'listen_port', 'provider_registry', 'route_policy',
+    'provider_session_pins', 'client_capability_sha256', 'allowed_origins',
+    'connect_timeout_ms', 'idle_timeout_ms',
+]);
+function retiredPaths(home) {
+    const resolvedHome = path.resolve(home);
+    const runtime = path.join(resolvedHome, '.codex', 'sks');
+    return {
+        settings: path.join(runtime, 'codex-lb-desktop-bridge-settings.json'),
+        state: path.join(runtime, 'codex-lb-desktop-bridge.json'),
+        plist: path.join(resolvedHome, 'Library', 'LaunchAgents', `${RETIRED_LAUNCHD_LABEL}.plist`),
+        stdout: path.join(runtime, 'logs', 'codex-lb-desktop-bridge.out.log'),
+        stderr: path.join(runtime, 'logs', 'codex-lb-desktop-bridge.err.log'),
+    };
+}
+async function regularFileExists(file) {
+    try {
+        const stat = await fsp.lstat(file);
+        if (stat.isSymbolicLink() || !stat.isFile())
+            throw new Error('desktop_bridge_retired_runtime_path_unsafe');
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+async function readRetiredSettings(file) {
+    if (!(await regularFileExists(file)))
+        return null;
+    const stat = await fsp.stat(file);
+    if ((stat.mode & 0o077) !== 0 || stat.size > 256 * 1024) {
+        throw new Error('desktop_bridge_retired_settings_unsafe');
+    }
+    let value;
+    try {
+        value = JSON.parse(await fsp.readFile(file, 'utf8'));
+    }
+    catch {
+        throw new Error('desktop_bridge_retired_settings_invalid');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('desktop_bridge_retired_settings_invalid');
+    }
+    const row = value;
+    if (row.schema !== RETIRED_SETTINGS_SCHEMA || Object.keys(row).some((key) => !SETTINGS_KEYS.has(key))) {
+        throw new Error('desktop_bridge_retired_settings_invalid');
+    }
+    if (/"(?:api_?key|secret|authorization|cookie|access_token|refresh_token)"\s*:/i.test(JSON.stringify(row))) {
+        throw new Error('desktop_bridge_retired_settings_secret_forbidden');
+    }
+    const { schema: _schema, ...settings } = row;
+    return settings;
+}
+function launchDomain(uid = typeof process.getuid === 'function' ? process.getuid() : 0) {
+    return `gui/${uid}`;
+}
+export async function prepareRetiredDesktopBridgeRuntime(options) {
+    const paths = retiredPaths(options.home);
+    const present = (await Promise.all(Object.values(paths).map(regularFileExists))).some(Boolean);
+    if (!present)
+        return { present: false, settings: null, paths };
+    const run = options.run || runProcess;
+    const launchctl = options.launchctl || '/bin/launchctl';
+    const service = `${launchDomain(options.uid)}/${RETIRED_LAUNCHD_LABEL}`;
+    const before = await run(launchctl, ['print', service], {
+        timeoutMs: 3_000, maxOutputBytes: 16 * 1024,
+    }).catch(() => null);
+    if (before?.code === 0) {
+        await run(launchctl, ['bootout', service], {
+            timeoutMs: 8_000, maxOutputBytes: 32 * 1024,
+        }).catch(() => null);
+    }
+    const after = await run(launchctl, ['print', service], {
+        timeoutMs: 3_000, maxOutputBytes: 16 * 1024,
+    }).catch(() => null);
+    if (after?.code === 0)
+        throw new Error('desktop_bridge_retired_launchd_still_loaded');
+    return { present: true, settings: await readRetiredSettings(paths.settings), paths };
+}
+export async function cleanupRetiredDesktopBridgeRuntime(preparation) {
+    if (!preparation.present)
+        return;
+    if (await regularFileExists(preparation.paths.settings)) {
+        const raw = JSON.parse(await fsp.readFile(preparation.paths.settings, 'utf8'));
+        if (raw.schema !== RETIRED_SETTINGS_SCHEMA)
+            throw new Error('desktop_bridge_retired_settings_changed');
+    }
+    if (await regularFileExists(preparation.paths.state)) {
+        const raw = JSON.parse(await fsp.readFile(preparation.paths.state, 'utf8'));
+        if (raw.schema !== RETIRED_STATE_SCHEMA)
+            throw new Error('desktop_bridge_retired_state_changed');
+    }
+    for (const file of Object.values(preparation.paths)) {
+        if (await regularFileExists(file))
+            await fsp.unlink(file);
+    }
+}

package/dist/core/codex-lb/desktop-bridge-migration/types.js

@@ -0,0 +1 @@
+export {};