sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/desktop-controller-v3/lifecycle-commands.js

@@ -0,0 +1,203 @@
+import path from 'node:path';
+import { removeDesktopBridgeManagedConfig } from '../../../cli/install-helpers-codex-lb-config.js';
+import { safeWriteCodexConfigToml } from '../../codex-runtime/codex-desktop-config-policy.js';
+import { exists, readText } from '../../fsx.js';
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServiceStatus, installAndStartDesktopBridgeService, stopDesktopBridgeService } from '../desktop-service.js';
+import { rollbackDesktopBridgeUnificationReceipt } from '../migration-receipt.js';
+import { resolveBridgeRequestRoute } from '../request-route-resolver.js';
+import { setBridgeRoutingDefault, writeBridgeRoutingPolicy } from '../provider-route-policy.js';
+import { syncCatalogInternal } from './catalog.js';
+import { commandResult, controllerPaths, nowIso, persistRuntimeSettings, providerCode, providerRegistrySnapshot, stringArray } from './shared.js';
+import { desktopBridgeStatusV3, loadCore, statusFromCore } from './status.js';
+import { verifyDesktopBridgeV3 } from './verification.js';
+export async function ensureDesktopBridge(options, operation) {
+    const sync = await syncCatalogInternal(options);
+    let core = await loadCore(options);
+    if (!core.activeCatalog.ok || !core.policy) {
+        return commandResult(operation, true, statusFromCore(core, options), { catalog_sync: sync }, syncResultBlockers(sync), options);
+    }
+    const service = await (options.installServiceImpl || installAndStartDesktopBridgeService)({
+        ...options,
+        home: core.paths.home,
+        providerRegistry: providerRegistrySnapshot(core.registry, core.activeCatalog.route_index),
+        routePolicy: core.policy
+    });
+    core = await loadCore(options);
+    let report = null;
+    if (service.running)
+        report = await verifyDesktopBridgeV3('shallow', options);
+    const status = await desktopBridgeStatusV3(options);
+    return commandResult(operation, true, status, { service, catalog_sync: sync, capabilities: report }, [], options);
+}
+export async function repairDesktopBridge(options) {
+    let core = await loadCore(options);
+    if (!core.activeCatalog.ok || !core.policy)
+        return ensureDesktopBridge(options, 'repair');
+    await persistRuntimeSettings(core, options);
+    const service = await (options.installServiceImpl || installAndStartDesktopBridgeService)({
+        ...options,
+        home: core.paths.home,
+        providerRegistry: providerRegistrySnapshot(core.registry, core.activeCatalog.route_index),
+        routePolicy: core.policy
+    });
+    core = await loadCore(options);
+    const report = service.running ? await verifyDesktopBridgeV3('shallow', options) : null;
+    const status = await desktopBridgeStatusV3(options);
+    return commandResult('repair', true, status, { service, capabilities: report }, [], options);
+}
+export async function setDefaultProvider(providerId, options) {
+    const core = await loadCore(options);
+    if (!core.policy || !core.activeCatalog.ok)
+        throw new Error('bridge_route_policy_missing');
+    if (!core.registry.profiles[providerId].enabled)
+        throw new Error(`${providerCode(providerId)}_provider_disabled`);
+    if (!Object.values(core.policy.model_routes).some((route) => route.provider_id === providerId)) {
+        throw new Error(`${providerCode(providerId)}_catalog_route_not_ready`);
+    }
+    const policy = setBridgeRoutingDefault(core.policy, providerId, nowIso(options));
+    await writeBridgeRoutingPolicy(core.paths.routePolicyPath, policy, core.activeCatalog.route_index);
+    await persistRuntimeSettings({ ...core, policy, policyBlockers: [] }, options);
+    const status = await desktopBridgeStatusV3(options);
+    return commandResult('route.set-default', true, status, { provider_id: providerId, policy_generation: policy.policy_generation }, [], options);
+}
+export async function explainRoute(model, options) {
+    const core = await loadCore(options);
+    if (!core.policy || !core.activeCatalog.ok)
+        throw new Error('bridge_route_policy_missing');
+    const explanation = resolveBridgeRequestRoute({ model }, core.policy, {
+        route_index: core.activeCatalog.route_index,
+        registry: core.registry,
+        active_catalog_generation: core.activeCatalog.catalog.generation
+    });
+    return commandResult('route.explain', true, statusFromCore(core, options), { explanation }, [], options);
+}
+export async function unmanageDesktopBridge(options) {
+    const paths = controllerPaths(options);
+    const current = await readText(paths.configPath, '');
+    const next = removeDesktopBridgeManagedConfig(current);
+    const serviceBefore = await currentServiceStatus(options, paths.home);
+    const stopped = await (options.stopServiceImpl || stopDesktopBridgeService)({
+        ...options,
+        home: paths.home
+    });
+    requireStopped(stopped, 'unmanage');
+    let write;
+    try {
+        write = await (options.safeWriteConfigImpl || safeWriteCodexConfigToml)(paths.configPath, current, next, 'desktop-bridge-unmanage', { verifyUnchangedBeforeWrite: true });
+    }
+    catch (error) {
+        await restartPreservedService(serviceBefore, error, options, paths.home);
+        throw error;
+    }
+    if (!write.ok) {
+        const error = new Error(`desktop_bridge_unmanage_config_${write.status}`);
+        const recovery = await restartPreservedService(serviceBefore, error, options, paths.home);
+        const status = await desktopBridgeStatusV3(options);
+        return commandResult('unmanage', false, status, { write, service: stopped, recovery }, [error.message], options);
+    }
+    const cleaned = await removePreservedServiceArtifacts(options, paths.home, 'unmanage');
+    const status = await desktopBridgeStatusV3(options);
+    requireUnmanaged(status.management.managed, 'unmanage');
+    return commandResult('unmanage', true, status, {
+        unmanaged: true,
+        credentials_deleted: false,
+        service: cleaned,
+        stopped_service: stopped,
+        config_backup_path: write.backup_path || null
+    }, [], options);
+}
+export async function rollbackDesktopBridge(receiptId, options) {
+    if (!/^[A-Za-z0-9._-]{1,160}$/.test(receiptId))
+        throw new Error('desktop_bridge_receipt_id_invalid');
+    const paths = controllerPaths(options);
+    const receiptPath = path.resolve(paths.receiptDir, `${receiptId.replace(/\.json$/i, '')}.json`);
+    if (!receiptPath.startsWith(`${path.resolve(paths.receiptDir)}${path.sep}`)) {
+        throw new Error('desktop_bridge_receipt_path_invalid');
+    }
+    const serviceBefore = await currentServiceStatus(options, paths.home);
+    const stopped = await (options.stopServiceImpl || stopDesktopBridgeService)({
+        ...options,
+        home: paths.home
+    });
+    requireStopped(stopped, 'rollback');
+    let rollback;
+    try {
+        rollback = await (options.rollbackReceiptImpl || rollbackDesktopBridgeUnificationReceipt)({ receiptPath });
+    }
+    catch (error) {
+        await restartPreservedService(serviceBefore, error, options, paths.home);
+        throw error;
+    }
+    if (!rollback.ok) {
+        const error = new Error(`desktop_bridge_rollback_${rollback.status}`);
+        const recovery = await restartPreservedService(serviceBefore, error, options, paths.home);
+        const status = await desktopBridgeStatusV3(options);
+        return commandResult('rollback', false, status, { rollback, service: stopped, recovery }, [rollback.status], options);
+    }
+    const cleaned = await removePreservedServiceArtifacts(options, paths.home, 'rollback');
+    const observed = await desktopBridgeStatusV3(options);
+    if (observed.management.managed)
+        throw new Error('desktop_bridge_rollback_final_state_managed');
+    const status = {
+        ...observed,
+        management: {
+            ...observed.management,
+            reason: 'rollback_complete'
+        }
+    };
+    return commandResult('rollback', true, status, { rollback, service: cleaned, stopped_service: stopped }, [], options);
+}
+async function currentServiceStatus(options, home) {
+    return (options.serviceStatusImpl || desktopBridgeServiceStatus)({ ...options, home });
+}
+function requireStopped(service, operation) {
+    if (service.running)
+        throw new Error(`desktop_bridge_${operation}_service_stop_failed`);
+}
+async function removePreservedServiceArtifacts(options, home, operation) {
+    const cleaned = await (options.stopServiceImpl || stopDesktopBridgeService)({
+        ...options,
+        home,
+        removePlist: true,
+        removeSettings: true
+    });
+    const artifactsRemain = await Promise.all([
+        exists(cleaned.paths.launch_agent_path),
+        exists(cleaned.paths.settings_path)
+    ]);
+    if (cleaned.running || cleaned.installed || cleaned.settings || artifactsRemain.some(Boolean)) {
+        throw new Error(`desktop_bridge_${operation}_service_cleanup_failed`);
+    }
+    return cleaned;
+}
+async function restartPreservedService(serviceBefore, originalError, options, home) {
+    if (!serviceBefore.running)
+        return null;
+    try {
+        const recovery = await (options.bootstrapServiceImpl || bootstrapExistingDesktopBridgeService)({
+            ...options,
+            home
+        });
+        if (!recovery.running) {
+            throw new Error(`desktop_bridge_lifecycle_recovery_not_running:${recovery.blockers.join(',')}`);
+        }
+        return recovery;
+    }
+    catch (recoveryError) {
+        const message = originalError instanceof Error ? originalError.message : String(originalError || 'desktop_bridge_lifecycle_failed');
+        throw new Error(message, { cause: recoveryError });
+    }
+}
+function requireUnmanaged(managed, operation) {
+    if (managed)
+        throw new Error(`desktop_bridge_${operation}_final_state_managed`);
+}
+function syncResultBlockers(result) {
+    if (result.ok === true)
+        return [];
+    const activation = result.activation && typeof result.activation === 'object' && !Array.isArray(result.activation)
+        ? result.activation
+        : {};
+    const blockers = stringArray(activation.blockers);
+    return blockers.length > 0 ? blockers : ['combined_catalog_sync_failed'];
+}

package/dist/core/codex-lb/desktop-controller-v3/live-probes.js

@@ -0,0 +1,293 @@
+import { DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, probeDesktopBridgeWebSocket } from '../desktop-bridge/index.js';
+import { runImageGenerationProbeV3 } from '../probes/image-generation-probe.js';
+import { runComputerUseProbeV3 } from '../probes/computer-use-probe.js';
+import { runVoiceRealtimeProbeV3 } from '../probes/voice-realtime-probe.js';
+import { runAuxiliarySurfacesProbeV3 } from '../probes/auxiliary-surfaces-probe.js';
+import { capabilityProbeResultV3 } from '../probes/probe-evidence.js';
+import { validateCapabilityDeepEvidenceV2 } from '../trusted-deep-evidence.js';
+import { bridgeClientUrl, providerCode, safeCode, timeoutMs, unique } from './shared.js';
+export async function probeProviderText(core, providerId, loopbackOrigin, context, options) {
+    const route = core.policy
+        ? Object.entries(core.policy.model_routes).find(([, target]) => target.provider_id === providerId)
+        : null;
+    if (!loopbackOrigin || !route) {
+        return capabilityProbeResultV3({
+            ...context,
+            capability: 'text_responses',
+            scope: `provider:${providerId}`,
+            stage: 'feature_request',
+            state: 'not_attempted',
+            retryable: true,
+            recoveryAction: 'repair_bridge_service',
+            source: 'transport',
+            evidence: { provider_id: providerId, reason: 'bridge_or_route_unavailable' }
+        });
+    }
+    const publicModel = route[0];
+    const request = options.fetchImpl || globalThis.fetch;
+    let endpoint;
+    try {
+        endpoint = await bridgeClientUrl(loopbackOrigin, '/backend-api/codex/responses', options);
+    }
+    catch (error) {
+        const root = safeCode(error, 'desktop_bridge_client_capability_invalid');
+        return capabilityProbeResultV3({
+            ...context,
+            capability: 'text_responses',
+            scope: `provider:${providerId}`,
+            stage: 'feature_request',
+            state: 'blocked',
+            terminal: true,
+            rootCause: root,
+            blockers: [root],
+            retryable: true,
+            recoveryAction: 'repair_bridge_service',
+            source: 'transport',
+            evidence: { provider_id: providerId, public_model: publicModel, fallback: 'none' }
+        });
+    }
+    const body = {
+        model: publicModel,
+        input: 'Reply with OK.',
+        max_output_tokens: 1,
+        store: false,
+        ...(providerId === 'openrouter' ? { provider: { allow_fallbacks: false } } : {})
+    };
+    try {
+        const response = await request(endpoint, {
+            method: 'POST',
+            redirect: 'error',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'application/json',
+                origin: 'app://codex',
+                'x-sks-model': publicModel
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(timeoutMs(options))
+        });
+        const text = await response.text();
+        if (Buffer.byteLength(text) > 4 * 1024 * 1024)
+            throw new Error('provider_text_response_too_large');
+        let payload = null;
+        try {
+            payload = text ? JSON.parse(text) : null;
+        }
+        catch {
+            payload = null;
+        }
+        const valid = response.ok && payload !== null && typeof payload === 'object';
+        const root = valid ? null : `${providerCode(providerId)}_text_response_failed`;
+        return capabilityProbeResultV3({
+            ...context,
+            capability: 'text_responses',
+            scope: `provider:${providerId}`,
+            stage: valid ? 'complete' : 'feature_response',
+            state: valid ? 'verified' : 'blocked',
+            terminal: !valid,
+            rootCause: root,
+            blockers: root ? [root] : [],
+            retryable: !valid,
+            recoveryAction: valid ? null : 'retry_provider_transport_probe',
+            source: 'transport',
+            evidence: {
+                provider_id: providerId,
+                public_model: publicModel,
+                http_status: response.status,
+                response_object: valid,
+                fallback: 'none'
+            }
+        });
+    }
+    catch {
+        const root = `${providerCode(providerId)}_text_response_failed`;
+        return capabilityProbeResultV3({
+            ...context,
+            capability: 'text_responses',
+            scope: `provider:${providerId}`,
+            stage: 'feature_request',
+            state: 'failed',
+            terminal: true,
+            rootCause: root,
+            blockers: [root],
+            retryable: true,
+            recoveryAction: 'retry_provider_transport_probe',
+            source: 'transport',
+            evidence: { provider_id: providerId, public_model: publicModel, fallback: 'none' }
+        });
+    }
+}
+export async function probeProviderDeep(core, providerId, context, options) {
+    const endpoint = core.registry.profiles[providerId].endpoint.url || '';
+    const catalogGeneration = core.activeCatalog.ok ? core.activeCatalog.catalog.generation : '';
+    return runDesktopBridgeDeepProviderProbesV3(providerId, context, endpoint, catalogGeneration, options.deepProbeImpl);
+}
+export async function runDesktopBridgeDeepProviderProbesV3(providerId, context, endpoint, catalogGeneration, probeImpl) {
+    let evidence = null;
+    let adapterFailed = false;
+    if (probeImpl && endpoint && catalogGeneration) {
+        try {
+            evidence = await probeImpl({
+                provider_id: providerId,
+                report_id: context.reportId,
+                correlation_id: context.correlationId,
+                session_id: context.sessionId,
+                checked_at: context.checkedAt,
+                catalog_generation: catalogGeneration,
+                endpoint
+            });
+        }
+        catch {
+            adapterFailed = true;
+        }
+    }
+    const providerContext = { ...context, providerId };
+    const results = [
+        runImageGenerationProbeV3({ ...providerContext, ...(evidence?.image_generation || {}) }),
+        runComputerUseProbeV3({ ...providerContext, ...(evidence?.computer_use || {}) }),
+        runVoiceRealtimeProbeV3({ ...providerContext, ...(evidence?.voice_mode || {}) }),
+        runAuxiliarySurfacesProbeV3({ ...providerContext, ...(evidence?.auxiliary_surfaces || {}) })
+    ];
+    if (adapterFailed) {
+        for (const result of results)
+            result.warnings = unique([...result.warnings, 'deep_probe_adapter_failed']);
+    }
+    for (const [capability, trusted] of Object.entries(evidence?.trusted || {})) {
+        if (!trusted || results.some((result) => result.capability === capability))
+            continue;
+        const validation = validateCapabilityDeepEvidenceV2(trusted.envelope, {
+            expectedProviderId: providerId,
+            expectedScope: `provider:${providerId}`,
+            expectedCapability: capability,
+            expectedReportId: context.reportId,
+            expectedCatalogGeneration: catalogGeneration,
+            expectedEndpoint: endpoint,
+            trustAnchors: trusted.trust_anchors,
+            now: context.checkedAt
+        });
+        const rootCause = validation.state === 'blocked'
+            ? validation.blockers[0] || 'capability_deep_evidence_invalid' : null;
+        results.push(capabilityProbeResultV3({
+            ...providerContext,
+            capability,
+            scope: `provider:${providerId}`,
+            stage: validation.state === 'verified' ? 'complete' : 'artifact_validation',
+            state: validation.state,
+            terminal: validation.state === 'blocked',
+            rootCause,
+            blockers: validation.blockers,
+            warnings: validation.warnings,
+            retryable: validation.state === 'blocked' || validation.state === 'stale',
+            recoveryAction: validation.state === 'verified' ? null : 'run_deep_verification',
+            source: validation.state === 'verified' ? 'deep_probe' : 'artifact',
+            evidence: {
+                ...(validation.evidence || {}),
+                producer_id: validation.producer_id,
+                trust_anchor_id: validation.trust_anchor_id,
+                content_sha256: validation.content_sha256
+            }
+        }));
+    }
+    return results;
+}
+export async function probeBridgeHttp(loopbackOrigin, options) {
+    const started = Date.now();
+    if (!loopbackOrigin)
+        return httpFailure('desktop_bridge_tcp_connect_failed', 'tcp_connect', null, started);
+    try {
+        const endpoint = await bridgeClientUrl(loopbackOrigin, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, options);
+        const response = await (options.fetchImpl || globalThis.fetch)(endpoint, {
+            method: 'GET',
+            redirect: 'error',
+            headers: { accept: 'application/json', origin: 'app://codex' },
+            signal: AbortSignal.timeout(timeoutMs(options))
+        });
+        const payload = await response.json().catch(() => null);
+        if (!response.ok)
+            return httpFailure('desktop_bridge_http_health_failed', 'http_health', response.status, started);
+        if (payload?.schema !== 'sks.desktop-bridge-health.v1' || payload.runtime !== 'desktop-bridge') {
+            return httpFailure('desktop_bridge_http_health_invalid', 'http_health', response.status, started);
+        }
+        return {
+            schema: 'sks.desktop-bridge-http-probe.v1',
+            state: 'verified',
+            terminal_stage: 'complete',
+            root_cause: null,
+            status_code: response.status,
+            latency_ms: Date.now() - started,
+            blockers: [],
+            warnings: []
+        };
+    }
+    catch (error) {
+        const capabilityBlocker = safeCode(error, '');
+        if (capabilityBlocker.startsWith('desktop_bridge_client_capability_')) {
+            return httpFailure(capabilityBlocker, 'http_health', null, started);
+        }
+        const timedOut = error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError');
+        return httpFailure(timedOut ? 'desktop_bridge_http_health_timeout' : 'desktop_bridge_tcp_connect_failed', timedOut ? 'http_health' : 'tcp_connect', null, started);
+    }
+}
+function httpFailure(rootCause, stage, statusCode, started) {
+    return {
+        schema: 'sks.desktop-bridge-http-probe.v1',
+        state: 'failed',
+        terminal_stage: stage,
+        root_cause: rootCause,
+        status_code: statusCode,
+        latency_ms: Date.now() - started,
+        blockers: [rootCause],
+        warnings: []
+    };
+}
+export async function probeBridgeWebSocket(loopbackOrigin, level, options) {
+    if (!loopbackOrigin) {
+        return {
+            schema: 'sks.desktop-bridge-websocket-probe.v2',
+            state: 'failed',
+            terminal_stage: 'tcp_connect',
+            root_cause: 'desktop_bridge_tcp_connect_failed',
+            status_code: null,
+            negotiated_protocol: null,
+            upgrade_verified: false,
+            protocol_verified: false,
+            frame_round_trip_verified: false,
+            clean_close_verified: false,
+            latency_ms: null,
+            blockers: ['desktop_bridge_tcp_connect_failed'],
+            warnings: []
+        };
+    }
+    const websocketOrigin = loopbackOrigin.replace(/^http:/, 'ws:').replace(/^https:/, 'wss:');
+    let url;
+    try {
+        url = await bridgeClientUrl(websocketOrigin, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, options);
+    }
+    catch (error) {
+        return websocketFailure(safeCode(error, 'desktop_bridge_client_capability_invalid'));
+    }
+    return probeDesktopBridgeWebSocket({
+        url,
+        origin: 'app://codex',
+        requestedLevel: level,
+        maxRetries: 2,
+        totalTimeoutMs: timeoutMs(options)
+    });
+}
+function websocketFailure(rootCause) {
+    return {
+        schema: 'sks.desktop-bridge-websocket-probe.v2',
+        state: 'failed',
+        terminal_stage: 'tcp_connect',
+        root_cause: rootCause,
+        status_code: null,
+        negotiated_protocol: null,
+        upgrade_verified: false,
+        protocol_verified: false,
+        frame_round_trip_verified: false,
+        clean_close_verified: false,
+        latency_ms: null,
+        blockers: [rootCause],
+        warnings: []
+    };
+}

package/dist/core/codex-lb/desktop-controller-v3/preflight-probes.js

@@ -0,0 +1,144 @@
+import { capabilityProbeResultV3 } from '../probes/probe-evidence.js';
+import { activeProviderIds, providerCode } from './shared.js';
+export function nativeIdentityProbe(core, context) {
+    const oauth = core.auth.mode === 'chatgpt_oauth' || core.auth.mode === 'mixed';
+    return capabilityProbeResultV3({
+        ...context,
+        capability: 'oauth_identity',
+        scope: 'native-identity',
+        stage: 'preflight',
+        state: oauth ? 'verified' : 'blocked',
+        terminal: !oauth,
+        rootCause: oauth ? null : 'chatgpt_oauth_required_for_desktop',
+        blockers: oauth ? [] : ['chatgpt_oauth_required_for_desktop'],
+        retryable: false,
+        recoveryAction: oauth ? null : 'review_desktop_authentication',
+        source: 'config',
+        evidence: {
+            oauth_present: oauth,
+            semantic_identity_available: Boolean(core.auth.semantic_fingerprint),
+            oauth_requirement: 'required'
+        }
+    });
+}
+export function combinedRoutePolicyProbe(core, context) {
+    const verified = Boolean(core.policy && core.activeCatalog.ok
+        && core.policy.catalog_generation === core.activeCatalog.catalog.generation
+        && core.policyBlockers.length === 0);
+    return capabilityProbeResultV3({
+        ...context,
+        capability: 'route_policy',
+        scope: 'catalog:combined',
+        stage: verified ? 'complete' : 'model_route',
+        state: verified ? 'verified' : 'blocked',
+        terminal: !verified,
+        rootCause: verified ? null : String(core.policyBlockers[0] || 'bridge_route_policy_missing'),
+        blockers: verified ? [] : [...core.policyBlockers],
+        retryable: !verified,
+        recoveryAction: verified ? null : 'refresh_catalog_or_select_supported_model',
+        source: 'config',
+        evidence: {
+            catalog_generation: core.activeCatalog.ok ? core.activeCatalog.catalog.generation : null,
+            route_policy_generation: core.policy?.policy_generation || null,
+            fallback: 'none'
+        }
+    });
+}
+export function combinedModelRouteProbe(core, status, context) {
+    const active = activeProviderIds(core);
+    const verified = active.length > 0 && active.every((providerId) => Boolean(core.policy && Object.values(core.policy.model_routes).some((route) => route.provider_id === providerId)));
+    return capabilityProbeResultV3({
+        ...context,
+        capability: 'model_route',
+        scope: 'catalog:combined',
+        stage: verified ? 'complete' : 'model_route',
+        state: verified ? 'verified' : 'blocked',
+        terminal: !verified,
+        rootCause: verified ? null : 'catalog_model_route_missing',
+        blockers: verified ? [] : ['catalog_model_route_missing'],
+        retryable: !verified,
+        recoveryAction: verified ? null : 'refresh_catalog_or_select_supported_model',
+        source: 'config',
+        evidence: {
+            active_provider_ids: active,
+            route_count: status.catalog_sync.route_count,
+            fallback: 'none'
+        }
+    });
+}
+export function providerCredentialProbe(core, providerId, context) {
+    const profile = core.registry.profiles[providerId];
+    const ready = profile.credential.state === 'ready';
+    const blocked = ['rejected', 'unavailable', 'stale'].includes(profile.credential.state);
+    const root = blocked ? profile.credential.blockers[0] || `${providerCode(providerId)}_credential_unavailable` : null;
+    return capabilityProbeResultV3({
+        ...context,
+        capability: 'credential',
+        scope: `provider:${providerId}`,
+        stage: 'preflight',
+        state: ready ? 'verified' : blocked ? 'blocked' : 'not_attempted',
+        terminal: blocked,
+        rootCause: root,
+        blockers: root ? [root] : [],
+        warnings: profile.credential.warnings,
+        retryable: blocked,
+        recoveryAction: ready ? null : providerId === 'codex-lb'
+            ? 'configure_codex_lb_credential' : 'configure_openrouter_credential',
+        source: ready ? 'transport' : 'config',
+        evidence: {
+            provider_id: providerId,
+            credential_state: profile.credential.state,
+            credential_fingerprint: profile.credential.fingerprint,
+            route: providerId
+        }
+    });
+}
+export function providerAuthProbe(core, providerId, context) {
+    const profile = core.registry.profiles[providerId];
+    const verified = profile.credential.state === 'ready' && core.catalogSync.providers[providerId].state === 'verified';
+    const blocked = profile.enabled && ['rejected', 'unavailable', 'stale'].includes(profile.credential.state);
+    const root = blocked ? profile.credential.blockers[0] || `${providerCode(providerId)}_auth_rejected` : null;
+    return capabilityProbeResultV3({
+        ...context,
+        capability: 'provider_auth',
+        scope: `provider:${providerId}`,
+        stage: verified ? 'complete' : 'provider_auth',
+        state: verified ? 'verified' : blocked ? 'blocked' : 'not_attempted',
+        terminal: blocked,
+        rootCause: root,
+        blockers: root ? [root] : [],
+        retryable: blocked,
+        recoveryAction: verified ? null : providerId === 'codex-lb'
+            ? 'configure_codex_lb_credential' : 'configure_openrouter_credential',
+        source: verified || blocked ? 'transport' : 'config',
+        evidence: {
+            provider_id: providerId,
+            auth_transport: profile.endpoint.auth_transport,
+            credential_fingerprint: profile.credential.fingerprint,
+            oauth_forwarded: false
+        }
+    });
+}
+export function providerModelRouteProbe(core, providerId, context) {
+    const route = core.policy
+        ? Object.entries(core.policy.model_routes).find(([, target]) => target.provider_id === providerId)
+        : null;
+    const verified = Boolean(route && core.catalogSync.providers[providerId].state === 'verified');
+    return capabilityProbeResultV3({
+        ...context,
+        capability: 'model_route',
+        scope: `provider:${providerId}`,
+        stage: verified ? 'complete' : 'model_route',
+        state: verified ? 'verified' : 'not_attempted',
+        retryable: !verified,
+        recoveryAction: verified ? null : 'refresh_catalog_or_select_supported_model',
+        source: 'config',
+        evidence: {
+            provider_id: providerId,
+            public_model: route?.[0] || null,
+            upstream_model: route?.[1].upstream_model || null,
+            catalog_generation: core.policy?.catalog_generation || null,
+            fallback: 'none'
+        }
+    });
+}