sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/probes/image-generation-probe.js

@@ -1,44 +1,40 @@
-import { probeEvidence } from './probe-evidence.js';
-export function runImageGenerationProbe(input) {
-    const outputEventSeen = (input.events || []).some(isImageOutputEvent);
-    const attempted = input.attempted === true || Boolean(input.events?.length);
-    const cliTransportVerified = input.cliTransportAccepted === true
-        && outputEventSeen
-        && input.artifactMaterialized === true;
-    const blockers = [
-        ...(input.blockers || []),
-        ...(attempted && input.toolAdvertised === false ? ['image_tool_not_advertised'] : []),
-        ...(attempted && input.requestToolsPresent === false ? ['image_tools_omitted_by_responses_lite'] : []),
-        ...(attempted && !outputEventSeen ? ['image_output_event_filtered'] : []),
-        ...((input.level === 'deep' || input.cliTransportAccepted === true)
-            && outputEventSeen && input.artifactMaterialized !== true
-            ? ['image_artifact_not_materialized']
-            : [])
-    ];
-    return probeEvidence({
-        advertised: input.manifestRouteAdvertised === true || input.toolAdvertised === true,
-        attempted,
-        verified: (input.level === 'deep'
-            && outputEventSeen
-            && input.artifactMaterialized === true)
-            || cliTransportVerified,
-        fixture: input.fixture,
-        source: input.level === 'deep' ? 'deep_probe' : attempted ? 'transport' : 'manifest',
-        unsupported: input.manifestRouteAdvertised === false && input.toolAdvertised === false,
-        blockers,
-        warnings: outputEventSeen && input.level !== 'deep' && !cliTransportVerified
-            ? ['image_event_transport_seen_without_real_desktop_artifact']
-            : [],
-        evidence: {
-            route: input.route || null,
-            tool_advertised: input.toolAdvertised === true,
-            request_tools_present: input.requestToolsPresent === true,
-            output_image_event_seen: outputEventSeen,
-            artifact_materialized: input.artifactMaterialized === true,
-            cli_transport_accepted: input.cliTransportAccepted === true,
-            fixture: input.fixture === true
-        }
-    }, input.checkedAt);
+import { readFileSync, statSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+import { sha256 } from '../../fsx.js';
+import { capabilityProbeResultV3 } from './probe-evidence.js';
+export function runImageGenerationProbeV3(input) {
+    if (input.requestedLevel !== 'deep' || input.attempted !== true || input.fixture === true) {
+        return capabilityProbeResultV3({
+            ...input,
+            capability: 'image_generation',
+            scope: `provider:${input.providerId}`,
+            stage: 'preflight',
+            state: 'not_attempted',
+            source: input.advertised ? 'manifest' : 'config',
+            warnings: input.fixture ? ['image_fixture_not_live_evidence'] : [],
+            recoveryAction: 'run_deep_verification',
+            evidence: {
+                advertised: input.advertised === true,
+                fixture: input.fixture === true,
+                reason: input.fixture ? 'fixture_not_live_evidence' : 'deep_verification_not_run'
+            }
+        });
+    }
+    if (input.outputEventSeen !== true) {
+        return imageFailure(input, 'feature_response', 'image_output_event_filtered');
+    }
+    const artifact = validateImageArtifact(input.artifactPath, input.artifactSha256);
+    if (!artifact.ok)
+        return imageFailure(input, 'artifact_validation', artifact.blocker, artifact.evidence);
+    return capabilityProbeResultV3({
+        ...input,
+        capability: 'image_generation',
+        scope: `provider:${input.providerId}`,
+        stage: 'complete',
+        state: 'verified',
+        source: 'artifact',
+        evidence: { output_event_seen: true, ...artifact.evidence }
+    });
 }
 export function isImageOutputEvent(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -51,3 +47,64 @@ export function isImageOutputEvent(value) {
     return Boolean(item && typeof item === 'object' && !Array.isArray(item)
         && /image_generation|output_image/i.test(String(item.type || '')));
 }
+function imageFailure(input, stage, blocker, evidence = {}) {
+    return capabilityProbeResultV3({
+        ...input,
+        capability: 'image_generation',
+        scope: `provider:${input.providerId}`,
+        stage,
+        state: 'blocked',
+        terminal: true,
+        rootCause: blocker,
+        blockers: [blocker],
+        retryable: true,
+        recoveryAction: 'run_deep_verification',
+        source: stage === 'artifact_validation' ? 'artifact' : 'deep_probe',
+        evidence: { output_event_seen: input.outputEventSeen === true, ...evidence }
+    });
+}
+function validateImageArtifact(artifactPath, expectedSha256) {
+    if (!artifactPath || !isAbsolute(artifactPath)) {
+        return { ok: false, blocker: 'image_artifact_path_invalid', evidence: { artifact_path: artifactPath || null } };
+    }
+    if (!expectedSha256 || !/^[a-f0-9]{64}$/i.test(expectedSha256)) {
+        return { ok: false, blocker: 'image_artifact_digest_invalid', evidence: { artifact_path: artifactPath } };
+    }
+    try {
+        const stat = statSync(artifactPath);
+        if (!stat.isFile() || stat.size <= 0) {
+            return { ok: false, blocker: 'image_artifact_not_materialized', evidence: { artifact_path: artifactPath } };
+        }
+        const bytes = readFileSync(artifactPath);
+        const format = imageArtifactFormat(bytes);
+        if (!format) {
+            return { ok: false, blocker: 'image_artifact_format_invalid', evidence: { artifact_path: artifactPath } };
+        }
+        const actualSha256 = sha256(bytes);
+        if (actualSha256 !== expectedSha256.toLowerCase()) {
+            return {
+                ok: false,
+                blocker: 'image_artifact_digest_mismatch',
+                evidence: { artifact_path: artifactPath, artifact_sha256: actualSha256, artifact_bytes: stat.size, artifact_format: format }
+            };
+        }
+        return {
+            ok: true,
+            evidence: { artifact_path: artifactPath, artifact_sha256: actualSha256, artifact_bytes: stat.size, artifact_format: format }
+        };
+    }
+    catch {
+        return { ok: false, blocker: 'image_artifact_not_materialized', evidence: { artifact_path: artifactPath } };
+    }
+}
+function imageArtifactFormat(bytes) {
+    if (bytes.length >= 8 && bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        return 'png';
+    if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff)
+        return 'jpeg';
+    if (bytes.length >= 6 && ['GIF87a', 'GIF89a'].includes(bytes.subarray(0, 6).toString('ascii')))
+        return 'gif';
+    if (bytes.length >= 12 && bytes.subarray(0, 4).toString('ascii') === 'RIFF' && bytes.subarray(8, 12).toString('ascii') === 'WEBP')
+        return 'webp';
+    return null;
+}

package/dist/core/codex-lb/probes/probe-evidence.js

@@ -1,39 +1,38 @@
-export function probeEvidence(input, checkedAt) {
-    const blockers = uniqueStrings(input.blockers);
-    const warnings = uniqueStrings(input.warnings);
-    const source = input.source || inferSource(input);
-    return {
-        state: signalState(input, blockers),
-        checked_at: checkedAt,
-        source,
-        evidence: { ...(input.evidence || {}) },
-        blockers,
-        warnings
-    };
-}
-export function signalState(input, blockers = uniqueStrings(input.blockers)) {
-    if (input.skipped === true)
-        return 'skipped';
-    if (input.unsupported === true)
-        return 'unsupported';
-    if (blockers.length > 0)
-        return 'blocked';
-    if (input.verified === true && input.fixture !== true && input.source !== 'config' && input.source !== 'manifest') {
-        return 'verified';
-    }
-    return 'available_unverified';
-}
 export function uniqueStrings(values = []) {
     return [...new Set((Array.isArray(values) ? values : [values])
             .map((value) => String(value || '').trim())
             .filter(Boolean))];
 }
-function inferSource(input) {
-    if (input.verified === true)
-        return 'deep_probe';
-    if (input.attempted === true)
-        return 'transport';
-    if (input.advertised === true)
-        return 'manifest';
-    return 'config';
+export function capabilityProbeResultV3(input) {
+    const rootCause = input.rootCause ? String(input.rootCause) : null;
+    const blockers = uniqueStrings(input.blockers)
+        .filter((blocker) => blocker !== 'desktop_bridge_websocket_transport_failed');
+    const terminalBlockers = input.terminal === true && rootCause ? [rootCause] : blockers;
+    const secondary = input.terminal === true && rootCause
+        ? blockers.filter((blocker) => blocker !== rootCause)
+        : [];
+    return {
+        schema: 'sks.capability-probe.v3',
+        capability: input.capability,
+        scope: input.scope,
+        requested_level: input.requestedLevel,
+        stage: input.stage,
+        state: input.state,
+        checked_at: input.checkedAt,
+        report_id: input.reportId,
+        correlation_id: input.correlationId,
+        session_id: input.sessionId,
+        attempt_id: input.attemptId || 1,
+        terminal: input.terminal === true,
+        root_cause: rootCause,
+        blockers: terminalBlockers,
+        warnings: uniqueStrings([
+            ...(input.warnings || []),
+            ...secondary.map((blocker) => `secondary_diagnostic:${blocker}`)
+        ]),
+        retryable: input.retryable === true,
+        recovery_action: input.recoveryAction || null,
+        source: input.source,
+        evidence: { ...(input.evidence || {}) }
+    };
 }

package/dist/core/codex-lb/probes/voice-realtime-probe.js

@@ -1,44 +1,70 @@
-import { probeEvidence } from './probe-evidence.js';
-export function runVoiceRealtimeProbe(input) {
-    const attempted = input.attempted === true
-        || input.createRouteVerified !== undefined
-        || input.websocketUpgraded !== undefined;
-    const transportComplete = input.createRouteVerified === true
-        && input.locationReceived === true
-        && input.locationRewritten === true
-        && input.websocketUpgraded === true
-        && input.serverEventSeen === true
-        && input.cleanClose === true
-        && input.ownerBindingVerified === true;
-    const blockers = [
-        ...(input.blockers || []),
-        ...(attempted && input.createRouteVerified !== true ? ['realtime_create_unauthorized'] : []),
-        ...(attempted && input.locationReceived !== true ? ['realtime_location_missing'] : []),
-        ...(attempted && input.locationReceived === true && input.locationRewritten !== true ? ['realtime_location_not_rewritten'] : []),
-        ...(attempted && input.websocketUpgraded !== true ? ['realtime_websocket_upgrade_failed'] : []),
-        ...(attempted && input.websocketUpgraded === true && input.serverEventSeen !== true ? ['realtime_sideband_event_missing'] : []),
-        ...(attempted && input.ownerBindingVerified !== true ? ['realtime_call_owner_binding_failed'] : [])
-    ];
-    return probeEvidence({
-        advertised: input.routeAdvertised === true,
-        attempted,
-        verified: input.level === 'deep' && transportComplete,
-        fixture: input.fixture,
-        source: input.level === 'deep' ? 'deep_probe' : attempted ? 'transport' : 'manifest',
-        unsupported: input.routeAdvertised === false && !attempted,
-        blockers,
-        warnings: transportComplete && input.level !== 'deep'
-            ? ['realtime_transport_verified_without_real_voice_session']
-            : [],
-        evidence: {
-            create_route_verified: input.createRouteVerified === true,
-            location_received: input.locationReceived === true,
-            location_rewritten: input.locationRewritten === true,
-            websocket_upgraded: input.websocketUpgraded === true,
-            server_event_seen: input.serverEventSeen === true,
-            clean_close: input.cleanClose === true,
-            owner_binding_verified: input.ownerBindingVerified === true,
-            fixture: input.fixture === true
-        }
-    }, input.checkedAt);
+import { capabilityProbeResultV3 } from './probe-evidence.js';
+export function runVoiceRealtimeProbeV3(input) {
+    if (input.requestedLevel !== 'deep' || input.attempted !== true || input.fixture === true) {
+        return capabilityProbeResultV3({
+            ...input,
+            capability: 'voice_mode',
+            scope: `provider:${input.providerId}`,
+            stage: 'preflight',
+            state: 'not_attempted',
+            source: input.advertised ? 'manifest' : 'config',
+            warnings: input.fixture ? ['voice_fixture_not_live_evidence'] : [],
+            recoveryAction: 'run_deep_verification',
+            evidence: { advertised: input.advertised === true, fixture: input.fixture === true }
+        });
+    }
+    const failure = firstVoiceFailure(input);
+    if (failure) {
+        return capabilityProbeResultV3({
+            ...input,
+            capability: 'voice_mode',
+            scope: `provider:${input.providerId}`,
+            stage: failure.stage,
+            state: 'blocked',
+            terminal: true,
+            rootCause: failure.blocker,
+            blockers: [failure.blocker],
+            retryable: true,
+            recoveryAction: 'run_deep_verification',
+            source: 'deep_probe',
+            evidence: voiceEvidence(input)
+        });
+    }
+    return capabilityProbeResultV3({
+        ...input,
+        capability: 'voice_mode',
+        scope: `provider:${input.providerId}`,
+        stage: 'complete',
+        state: 'verified',
+        source: 'deep_probe',
+        evidence: voiceEvidence(input)
+    });
+}
+function firstVoiceFailure(input) {
+    if (input.createRouteVerified !== true)
+        return { stage: 'feature_request', blocker: 'realtime_create_unauthorized' };
+    if (input.locationReceived !== true)
+        return { stage: 'feature_response', blocker: 'realtime_location_missing' };
+    if (input.locationRewritten !== true)
+        return { stage: 'feature_response', blocker: 'realtime_location_not_rewritten' };
+    if (input.websocketUpgraded !== true)
+        return { stage: 'websocket_upgrade', blocker: 'realtime_websocket_upgrade_failed' };
+    if (input.serverEventSeen !== true)
+        return { stage: 'websocket_protocol', blocker: 'realtime_sideband_event_missing' };
+    if (input.cleanClose !== true)
+        return { stage: 'websocket_protocol', blocker: 'realtime_clean_close_failed' };
+    if (input.ownerBindingVerified !== true)
+        return { stage: 'feature_response', blocker: 'realtime_call_owner_binding_failed' };
+    return null;
+}
+function voiceEvidence(input) {
+    return {
+        create_route_verified: input.createRouteVerified === true,
+        location_received: input.locationReceived === true,
+        location_rewritten: input.locationRewritten === true,
+        websocket_upgraded: input.websocketUpgraded === true,
+        server_event_seen: input.serverEventSeen === true,
+        clean_close: input.cleanClose === true,
+        owner_binding_verified: input.ownerBindingVerified === true
+    };
 }

package/dist/core/codex-lb/provider-credentials/configuration.js

@@ -0,0 +1,127 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { codexLbBaseUrlSecurityBlocker, codexLbEnvPath, codexLbMetadataPath, normalizeCodexLbBaseUrl } from '../codex-lb-env.js';
+import { openRouterSecretPaths, writeStoredOpenRouterKey } from '../../providers/openrouter/openrouter-secret-store.js';
+import { writePrivateTextAtomic } from '../../security/private-credential-file.js';
+import { restorePrivateCredential, snapshotPrivateCredential } from './private-snapshot.js';
+import { resolveProviderCredential } from './resolution.js';
+import { fingerprint, fingerprintFull, providerCode, providerCredentialStatus } from './runtime.js';
+import { withProviderCredentialLock } from './locks.js';
+export async function configureProviderCredential(input) {
+    const apiKey = String(input.api_key || '').trim();
+    if (!apiKey)
+        throw new Error(`${providerCode(input.provider_id)}_credential_empty`);
+    const home = path.resolve(input.home || process.env.HOME || os.homedir());
+    return withProviderCredentialLock(home, input.provider_id, () => input.provider_id === 'openrouter'
+        ? configureOpenRouterCredential(input, apiKey, home)
+        : configureCodexLbCredential(input, apiKey, home));
+}
+async function configureOpenRouterCredential(input, apiKey, home) {
+    const env = { ...(input.processEnv || process.env), HOME: home };
+    const paths = input.openRouterPaths || openRouterSecretPaths(env);
+    const secretDir = path.resolve(paths.secretDir);
+    const keyPath = path.resolve(paths.keyPath);
+    const metadataPath = path.resolve(paths.metadataPath);
+    if (keyPath === secretDir
+        || metadataPath === secretDir
+        || !keyPath.startsWith(`${secretDir}${path.sep}`)
+        || !metadataPath.startsWith(`${secretDir}${path.sep}`)) {
+        throw new Error('openrouter_credential_path_outside_secret_store');
+    }
+    await fs.mkdir(secretDir, { recursive: true, mode: 0o700 });
+    await fs.chmod(secretDir, 0o700);
+    const snapshots = await Promise.all([
+        snapshotPrivateCredential(secretDir, keyPath, 'openrouter_api_key'),
+        snapshotPrivateCredential(secretDir, metadataPath, 'openrouter_api_key_metadata')
+    ]);
+    try {
+        await writeStoredOpenRouterKey(apiKey, { paths });
+        const verificationEnv = { ...env, OPENROUTER_API_KEY: '', SKS_OPENROUTER_API_KEY: '' };
+        const credential = await resolveProviderCredential('openrouter', {
+            home,
+            processEnv: verificationEnv,
+            openRouterPaths: paths
+        });
+        if (!credential.secret || credential.fingerprint !== fingerprint(apiKey)) {
+            throw new Error('openrouter_credential_write_verification_failed');
+        }
+        return {
+            schema: 'sks.provider-credential-configuration.v1',
+            provider_id: input.provider_id,
+            configured: true,
+            credential: providerCredentialStatus(credential),
+            blockers: []
+        };
+    }
+    catch (error) {
+        await rollbackCredentialSnapshots(secretDir, snapshots);
+        throw error;
+    }
+}
+async function configureCodexLbCredential(input, apiKey, home) {
+    const baseUrl = normalizeCodexLbBaseUrl(input.host || '');
+    const endpointBlocker = codexLbBaseUrlSecurityBlocker(baseUrl);
+    if (!baseUrl || endpointBlocker)
+        throw new Error(endpointBlocker || 'codex_lb_base_url_missing');
+    const codexHome = path.join(home, '.codex');
+    const envPath = path.resolve(input.codexLbEnvPath || codexLbEnvPath(home));
+    const metadataPath = path.resolve(input.codexLbMetadataPath || codexLbMetadataPath(home));
+    if (![envPath, metadataPath].every((file) => file.startsWith(`${codexHome}${path.sep}`))) {
+        throw new Error('codex_lb_credential_path_outside_codex_home');
+    }
+    const snapshots = await Promise.all([
+        snapshotPrivateCredential(codexHome, envPath, 'codex_lb_env_file'),
+        snapshotPrivateCredential(codexHome, metadataPath, 'codex_lb_metadata_file')
+    ]);
+    const keyHash = fingerprintFull(apiKey);
+    const envText = `export CODEX_LB_BASE_URL=${shellSingleQuote(baseUrl)}\nexport CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`;
+    const metadataText = `${JSON.stringify({
+        schema: 'sks.codex-lb-metadata.v1',
+        base_url: baseUrl,
+        updated_at: new Date().toISOString(),
+        source: 'bridge-provider-configure',
+        gateway_auth_transport: 'authorization-bearer',
+        api_key: { redacted: true, sha256: keyHash }
+    }, null, 2)}\n`;
+    try {
+        await writePrivateTextAtomic(codexHome, metadataPath, metadataText, 'codex_lb_metadata_file');
+        await writePrivateTextAtomic(codexHome, envPath, envText, 'codex_lb_env_file');
+        const credential = await resolveProviderCredential('codex-lb', {
+            home,
+            processEnv: input.processEnv || {},
+            codexLbEnvPath: envPath,
+            codexLbMetadataPath: metadataPath
+        });
+        if (!credential.secret || credential.fingerprint !== keyHash.slice(0, 16)) {
+            throw new Error('codex_lb_credential_write_verification_failed');
+        }
+        return {
+            schema: 'sks.provider-credential-configuration.v1',
+            provider_id: input.provider_id,
+            configured: true,
+            credential: providerCredentialStatus(credential),
+            blockers: []
+        };
+    }
+    catch (error) {
+        await rollbackCredentialSnapshots(codexHome, snapshots);
+        throw error;
+    }
+}
+async function rollbackCredentialSnapshots(boundary, snapshots) {
+    const rollbackErrors = [];
+    for (const snapshot of snapshots.reverse()) {
+        try {
+            await restorePrivateCredential(boundary, snapshot);
+        }
+        catch {
+            rollbackErrors.push(`credential_configuration_rollback_failed:${snapshot.file}`);
+        }
+    }
+    if (rollbackErrors.length > 0)
+        throw new Error(rollbackErrors[0]);
+}
+function shellSingleQuote(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}

package/dist/core/codex-lb/provider-credentials/locks.js

@@ -0,0 +1,11 @@
+import os from 'node:os';
+import path from 'node:path';
+import { withFileLock } from '../../locks/file-lock.js';
+export function withProviderCredentialLock(home, providerId, action) {
+    const resolvedHome = path.resolve(home || process.env.HOME || os.homedir());
+    return withFileLock({
+        lockPath: path.join(resolvedHome, '.codex', 'sks', 'locks', `provider-credential-${providerId}.lock`),
+        timeoutMs: 10_000,
+        staleMs: 60_000,
+    }, action);
+}

package/dist/core/codex-lb/provider-credentials/private-snapshot.js

@@ -0,0 +1,28 @@
+import fs from 'node:fs/promises';
+import { PrivateCredentialFileError, readPrivateCredentialFile, writePrivateTextAtomic } from '../../security/private-credential-file.js';
+export async function snapshotPrivateCredential(boundary, file, label) {
+    try {
+        const snapshot = await readPrivateCredentialFile(boundary, file, label, { maxBytes: 1024 * 1024 });
+        return { file, label, existed: true, text: snapshot.bytes.toString('utf8') };
+    }
+    catch (error) {
+        if (error instanceof PrivateCredentialFileError && error.code === 'missing') {
+            return { file, label, existed: false, text: '' };
+        }
+        throw error;
+    }
+}
+export async function restorePrivateCredential(boundary, snapshot) {
+    if (snapshot.existed) {
+        await writePrivateTextAtomic(boundary, snapshot.file, snapshot.text, snapshot.label);
+        return;
+    }
+    const stat = await fs.lstat(snapshot.file).catch(() => null);
+    if (!stat)
+        return;
+    const expectedUid = typeof process.getuid === 'function' ? process.getuid() : null;
+    if (!stat.isFile() || stat.isSymbolicLink() || (expectedUid !== null && stat.uid !== expectedUid)) {
+        throw new Error(`${snapshot.label}_rollback_target_invalid`);
+    }
+    await fs.unlink(snapshot.file);
+}

package/dist/core/codex-lb/provider-credentials/removal.js

@@ -0,0 +1,33 @@
+import { removeStoredCodexLbCredential } from '../codex-lb-env.js';
+import { removeStoredOpenRouterKey } from '../../providers/openrouter/openrouter-secret-store.js';
+import { withProviderCredentialLock } from './locks.js';
+export async function removeProviderCredential(input) {
+    return withProviderCredentialLock(input.home, input.provider_id, async () => {
+        if (input.provider_id === 'codex-lb') {
+            const result = await removeStoredCodexLbCredential({
+                confirmed: input.confirmed,
+                ...(input.home ? { home: input.home } : {}),
+                ...(input.codexLbEnvPath ? { envPath: input.codexLbEnvPath } : {}),
+                ...(input.codexLbMetadataPath ? { metadataPath: input.codexLbMetadataPath } : {})
+            });
+            return {
+                schema: 'sks.provider-credential-removal.v1',
+                provider_id: input.provider_id,
+                removed: result.removed,
+                removed_paths: result.removed_paths,
+                blockers: result.blockers
+            };
+        }
+        const result = await removeStoredOpenRouterKey({
+            confirmed: input.confirmed,
+            ...(input.openRouterPaths ? { paths: input.openRouterPaths } : {})
+        });
+        return {
+            schema: 'sks.provider-credential-removal.v1',
+            provider_id: input.provider_id,
+            removed: result.removed,
+            removed_paths: result.removed_paths,
+            blockers: result.blockers
+        };
+    });
+}

package/dist/core/codex-lb/provider-credentials/resolution.js

@@ -0,0 +1,59 @@
+import { loadCodexLbEnv } from '../codex-lb-env.js';
+import { openRouterSecretPaths, resolveOpenRouterApiKey } from '../../providers/openrouter/openrouter-secret-store.js';
+import { fingerprint, runtimeCredential, unique } from './runtime.js';
+export async function resolveProviderCredential(providerId, options = {}) {
+    if (providerId === 'codex-lb') {
+        const loaded = await (options.loadCodexLbEnvImpl || loadCodexLbEnv)({
+            ...(options.home ? { home: options.home } : {}),
+            processEnv: options.processEnv || process.env,
+            ...(options.codexLbEnvPath ? { envPath: options.codexLbEnvPath } : {}),
+            ...(options.codexLbMetadataPath ? { metadataPath: options.codexLbMetadataPath } : {})
+        });
+        const secret = loaded.secret_api_key;
+        const present = loaded.api_key.present;
+        return runtimeCredential({
+            provider_id: providerId,
+            secret,
+            endpoint_url: loaded.base_url,
+            source: loaded.api_key.source || null,
+            fingerprint: loaded.api_key.fingerprint,
+            fallback_state: !present
+                ? 'not_configured'
+                : loaded.api_key.usable
+                    ? 'configured_unverified'
+                    : 'unavailable',
+            blockers: unique(loaded.blockers || loaded.credential_binding.blockers),
+            warnings: unique(loaded.guidance || []),
+            ...(options.validation === undefined ? {} : { validation: options.validation })
+        });
+    }
+    const env = options.processEnv || process.env;
+    const resolved = await (options.resolveOpenRouterApiKeyImpl || resolveOpenRouterApiKey)({
+        env,
+        paths: options.openRouterPaths || openRouterSecretPaths(env)
+    });
+    const secret = resolved.key;
+    return runtimeCredential({
+        provider_id: providerId,
+        secret,
+        endpoint_url: 'https://openrouter.ai/api/v1',
+        source: resolved.source,
+        fingerprint: secret ? fingerprint(secret) : null,
+        fallback_state: secret ? 'configured_unverified' : 'not_configured',
+        blockers: secret ? [] : normalizeOpenRouterCredentialBlockers(resolved.blockers),
+        warnings: unique(resolved.warnings),
+        ...(options.validation === undefined ? {} : { validation: options.validation })
+    });
+}
+export async function resolveAllProviderCredentials(options = {}) {
+    const [codexLb, openrouter] = await Promise.all([
+        resolveProviderCredential('codex-lb', options.codexLb || {}),
+        resolveProviderCredential('openrouter', options.openrouter || {})
+    ]);
+    return { 'codex-lb': codexLb, openrouter };
+}
+function normalizeOpenRouterCredentialBlockers(values) {
+    return unique(values.map((value) => value === 'glm_missing_openrouter_key'
+        ? 'openrouter_credential_missing'
+        : value));
+}

package/dist/core/codex-lb/provider-credentials/runtime.js

@@ -0,0 +1,55 @@
+import crypto from 'node:crypto';
+export function runtimeCredential(input) {
+    const validation = input.validation;
+    const state = validation && input.secret
+        ? validation.state
+        : input.fallback_state;
+    const value = {
+        schema: 'sks.provider-credential-status.v1',
+        provider_id: input.provider_id,
+        state,
+        source: input.source,
+        fingerprint: input.fingerprint,
+        checked_at: validation?.checked_at || null,
+        blockers: unique([
+            ...input.blockers,
+            ...(validation?.blockers || [])
+        ]),
+        warnings: unique([
+            ...input.warnings,
+            ...(validation?.warnings || [])
+        ]),
+        endpoint_url: input.endpoint_url
+    };
+    Object.defineProperty(value, 'secret', {
+        value: input.secret,
+        enumerable: false,
+        configurable: false,
+        writable: false
+    });
+    return value;
+}
+export function providerCredentialStatus(credential) {
+    return {
+        schema: 'sks.provider-credential-status.v1',
+        provider_id: credential.provider_id,
+        state: credential.state,
+        source: credential.source,
+        fingerprint: credential.fingerprint,
+        checked_at: credential.checked_at,
+        blockers: [...credential.blockers],
+        warnings: [...credential.warnings]
+    };
+}
+export function fingerprintFull(secret) {
+    return crypto.createHash('sha256').update(secret).digest('hex');
+}
+export function fingerprint(secret) {
+    return fingerprintFull(secret).slice(0, 16);
+}
+export function providerCode(providerId) {
+    return providerId === 'codex-lb' ? 'codex_lb' : 'openrouter';
+}
+export function unique(values) {
+    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
+}

package/dist/core/codex-lb/provider-credentials/types.js

@@ -0,0 +1 @@
+export {};