sneakoscope 8.1.2 → 8.2.0

package/dist/core/hooks-runtime.js

@@ -13,7 +13,7 @@ import { localizedFinalizationReason } from './language-preference.js';
 import { classifyToolError } from './evaluation.js';
 import { dollarCommand, managedSkillNamesForPrompt, stripVisibleDecisionAnswerBlocks } from './routes.js';
 import { coreEngineeringDirectiveReferenceText } from './lean-engineering-policy.js';
-import { scanAgentTextForRecursion } from './agents/agent-recursion-guard.js';
+import { agentWorkerHookContext, agentWorkerHookRecursionDecision } from './agents/agent-recursion-guard.js';
 import { evaluateLoopContinuation } from './loops/loop-continuation-enforcer.js';
 import { diagnosticPromptAllowedDuringNoQuestions } from './routes/diagnostic-allowlist.js';
 import { maybeReconcileProjectSkillsPreflight } from './hooks-runtime/skill-reconcile-preflight.js';
@@ -45,7 +45,7 @@ import { loadHookPayload, normalizeHookResult, visibleHookMessage } from './hook
 import { codexGitActionMetadataSignal, codexGitActionMetadataText, compactAnswerContext, conversationId, explicitConversationId, extractCommand, extractLastMessage, extractUserPrompt, hookTurnId, looksLikeCodexGitAction, looksLikeCodexGitActionStopCompletion, looksLikeCodexUiSettingsEvent, looksLikeMadSksConfirmationPrompt, observedParentModel, toolFailed } from './hooks-runtime/payload-signals.js';
 import { interruptedToolOutputRecoveryBlockReason, missingToolOutputCallId, missingToolOutputCallIdFromPayload, quarantineMissingToolOutput, readToolOutputQuarantine } from './hooks-runtime/tool-output-quarantine.js';
 import { activeAuthoritativeSksSkillRefresh, activeGoalOverlayContext, attachAuthoritativeSksSkillContext, attachOfficialSubagentSpawnCompatibilityContext, authoritativeSksSkillAdmission, hookActiveSkillContextRefresh, isBlockingClarificationAwaiting, looksLikeExplicitActiveWorkflowReplacementPrompt, looksLikeClarificationCancel, routeBypassesActiveContext, routeIsGitOnly, selectedSksSkillNamesForActiveState, shouldPrepareFreshRouteOnActivePrompt, standaloneParentManagedSkillNames } from './hooks-runtime/hook-context.js';
-import { sealedSubagentRoutingContext, subagentRouteContext } from './hooks-runtime/subagent-context.js';
+import { officialSubagentSkillGuardBinding, sealedSubagentRoutingContext, subagentRouteContext } from './hooks-runtime/subagent-context.js';
 export { loadHookPayload, normalizeHookResult };
 export { refreshOfficialSubagentCompletionArtifacts };
 export { honestModeGapLines, honestModeLoopbackBudgetExhausted } from './hooks-runtime/stop-finalization.js';
@@ -141,29 +141,36 @@ export async function evaluateHookPayload(name, payload = {}, opts = {}) {
 async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
     const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
     const sessionArtifactDir = officialSubagentArtifactDir(root, {}, sessionKey);
+    const skillGuardBinding = officialSubagentSkillGuardBinding(state);
+    const bindingIncomplete = Boolean(skillGuardBinding && (!String(skillGuardBinding.missionId || '').trim()
+        || !String(skillGuardBinding.workflowRunId || '').trim()));
     const artifactDirBlockers = [];
-    const artifactDirSafe = await ensureOfficialSubagentArtifactDirConfined(root, artifactDir)
-        .then(() => true)
-        .catch(() => false);
-    if (!artifactDirSafe)
+    const artifactDirSafe = skillGuardBinding
+        ? await ensureOfficialSubagentArtifactDirConfined(root, artifactDir)
+            .then(() => true)
+            .catch(() => false)
+        : true;
+    if (skillGuardBinding && !artifactDirSafe) {
         artifactDirBlockers.push('subagent_skill_availability_artifact_dir_unsafe');
-    await clearSubagentSkillAvailabilityGuards(root, payload, artifactDir, {
-        missionId: state?.mission_id,
-        workflowRunId: state?.official_subagent_run_id
-    }).catch(() => null);
+    }
+    if (skillGuardBinding) {
+        await clearSubagentSkillAvailabilityGuards(root, payload, artifactDir, skillGuardBinding).catch(() => null);
+    }
     const config = await readOfficialSubagentConfig(root);
     const budget = resolveSubagentThreadBudget({ configuredMaxThreads: config.maxThreads });
     const active = subagentRouteContext(state);
-    const routingContext = artifactDirSafe ? await sealedSubagentRoutingContext(artifactDir, payload) : '';
-    const resourceGuard = [
+    const routingContext = skillGuardBinding && artifactDirSafe
+        ? await sealedSubagentRoutingContext(artifactDir, payload)
+        : '';
+    const resourceGuard = skillGuardBinding ? [
         `SKS Naruto policy: max_threads frame budget is ${budget.maxThreads} (cap, not a spawn target).`,
         'GPT-5.6 four profiles are routing lanes, not an agent-count cap.',
         'Use max_depth=1. Naruto children must not spawn children.',
         'Do not duplicate an already assigned slice.',
         'Parallel writes require disjoint paths; serialize overlapping paths.',
         'Finish only your assigned slice, return a concise result, then stop so the Naruto parent can close this thread.'
-    ].join(' ');
-    const skillNames = selectedSksSkillNamesForActiveState(state);
+    ].join(' ') : '';
+    const skillNames = skillGuardBinding ? selectedSksSkillNamesForActiveState(state) : [];
     const resolution = skillNames.length
         ? await resolveManagedSkillSourcesForAdmission({
             root,
@@ -172,33 +179,12 @@ async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
         }).catch(() => null)
         : null;
     const skillBlockers = [
+        ...(bindingIncomplete ? ['subagent_skill_availability_guard_invalid'] : []),
         ...artifactDirBlockers,
         ...(skillNames.length ? authoritativeSksSkillResolutionBlockers(resolution) : [])
     ];
-    try {
-        await persistSubagentSkillAvailabilityBlocker({
-            root,
-            artifactDir,
-            sessionArtifactDir,
-            state,
-            payload,
-            blockers: skillBlockers
-        });
-    }
-    catch (error) {
-        const blocker = error instanceof Error
-            && error.message === 'subagent_skill_availability_blocker_artifact_write_failed'
-            ? 'subagent_skill_availability_blocker_artifact_write_failed'
-            : 'subagent_skill_availability_guard_persistence_failed';
-        skillBlockers.push(blocker);
-    }
-    if (artifactDirSafe) {
+    if (skillGuardBinding) {
         try {
-            await recordAndRefreshSubagentEvidence(root, state, payload, 'SubagentStart', sessionKey);
-        }
-        catch {
-            const lifecycleBlocker = await recordOfficialSubagentLifecycleCaptureFailure(artifactDir, state, payload, 'SubagentStart').catch(() => 'official_subagent_lifecycle_capture_failure_unpersisted');
-            skillBlockers.push(lifecycleBlocker);
             await persistSubagentSkillAvailabilityBlocker({
                 root,
                 artifactDir,
@@ -206,10 +192,36 @@ async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
                 state,
                 payload,
                 blockers: skillBlockers
-            }).catch(() => {
-                skillBlockers.push('subagent_skill_availability_guard_persistence_failed');
             });
         }
+        catch (error) {
+            const blocker = error instanceof Error
+                && error.message === 'subagent_skill_availability_blocker_artifact_write_failed'
+                ? 'subagent_skill_availability_blocker_artifact_write_failed'
+                : 'subagent_skill_availability_guard_persistence_failed';
+            skillBlockers.push(blocker);
+        }
+    }
+    if (skillGuardBinding && artifactDirSafe) {
+        try {
+            await recordAndRefreshSubagentEvidence(root, state, payload, 'SubagentStart', sessionKey);
+        }
+        catch {
+            const lifecycleBlocker = await recordOfficialSubagentLifecycleCaptureFailure(artifactDir, state, payload, 'SubagentStart').catch(() => 'official_subagent_lifecycle_capture_failure_unpersisted');
+            skillBlockers.push(lifecycleBlocker);
+            if (skillGuardBinding) {
+                await persistSubagentSkillAvailabilityBlocker({
+                    root,
+                    artifactDir,
+                    sessionArtifactDir,
+                    state,
+                    payload,
+                    blockers: skillBlockers
+                }).catch(() => {
+                    skillBlockers.push('subagent_skill_availability_guard_persistence_failed');
+                });
+            }
+        }
     }
     const skillContext = skillBlockers.length
         ? renderSubagentSkillAvailabilityHandoff(skillBlockers)
@@ -559,28 +571,28 @@ async function consumeActiveOfficialWorkflowQueue(root, missionId, workflowRunId
 }
 async function hookPreTool(root, state, payload, noQuestion, sessionKey = null) {
     const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
-    const activeBinding = {
-        missionId: state?.mission_id,
-        workflowRunId: state?.official_subagent_run_id
-    };
-    const evaluateSkillAvailabilityBlock = () => subagentSkillAvailabilityPreToolBlockReason(root, payload, artifactDir, activeBinding).catch((error) => {
-        const code = error instanceof Error && error.message === 'subagent_skill_availability_guard_invalid'
-            ? 'subagent_skill_availability_guard_invalid'
-            : 'subagent_skill_availability_guard_check_failed';
-        return `SKS blocked this child tool call because managed skill availability failed (${code}). Return the blocker to the root parent without using tools.`;
-    });
-    let skillAvailabilityBlock = await evaluateSkillAvailabilityBlock();
-    if (isSubagentSkillAvailabilityAdmissionMissingReason(skillAvailabilityBlock)) {
-        const recovered = await recoverResumedOfficialSubagentSkillAvailabilityAdmission({
-            root,
-            payload,
-            artifactDir,
-            sessionArtifactDir: officialSubagentArtifactDir(root, {}, sessionKey),
-            activeBinding,
-            skillNames: selectedSksSkillNamesForActiveState(state)
-        }).catch(() => false);
-        if (recovered)
-            skillAvailabilityBlock = await evaluateSkillAvailabilityBlock();
+    const activeBinding = officialSubagentSkillGuardBinding(state, { allowClosedOfficialChild: true });
+    let skillAvailabilityBlock = null;
+    if (activeBinding) {
+        const evaluateSkillAvailabilityBlock = () => subagentSkillAvailabilityPreToolBlockReason(root, payload, artifactDir, activeBinding).catch((error) => {
+            const code = error instanceof Error && error.message === 'subagent_skill_availability_guard_invalid'
+                ? 'subagent_skill_availability_guard_invalid'
+                : 'subagent_skill_availability_guard_check_failed';
+            return `SKS blocked this child tool call because managed skill availability failed (${code}). Return the blocker to the root parent without using tools.`;
+        });
+        skillAvailabilityBlock = await evaluateSkillAvailabilityBlock();
+        if (isSubagentSkillAvailabilityAdmissionMissingReason(skillAvailabilityBlock)) {
+            const recovered = await recoverResumedOfficialSubagentSkillAvailabilityAdmission({
+                root,
+                payload,
+                artifactDir,
+                sessionArtifactDir: officialSubagentArtifactDir(root, {}, sessionKey),
+                activeBinding,
+                skillNames: selectedSksSkillNamesForActiveState(state)
+            }).catch(() => false);
+            if (recovered)
+                skillAvailabilityBlock = await evaluateSkillAvailabilityBlock();
+        }
     }
     if (skillAvailabilityBlock) {
         return { decision: 'block', permissionDecision: 'deny', reason: skillAvailabilityBlock };
@@ -653,32 +665,6 @@ async function parentWaveGuidanceContext(root, state = {}, sessionKey = null) {
         return '';
     return renderWaveParentGuidance(guidance);
 }
-function agentWorkerHookRecursionDecision(state = {}, payload = {}, command = '') {
-    if (!agentWorkerHookContext(state, payload))
-        return null;
-    const guard = scanAgentTextForRecursion(command);
-    if (guard.ok)
-        return null;
-    return {
-        decision: 'block',
-        permissionDecision: 'deny',
-        reason: `Agent command recursion guard blocked nested SKS route command in Codex PreToolUse hook: ${guard.violations.join(', ')}`
-    };
-}
-function agentWorkerHookContext(state = {}, payload = {}) {
-    const env = {
-        ...(payload.env || {}),
-        ...(payload.tool_input?.env || {}),
-        ...(payload.toolInput?.env || {}),
-        ...(payload.input?.env || {}),
-        ...(payload.tool?.input?.env || {})
-    };
-    void state;
-    return Boolean(String(env.SKS_AGENT_WORKER || '') === '1'
-        || String(env.SKS_DISABLE_ROUTE_RECURSION || '') === '1'
-        || payload.agent_worker === true
-        || payload.agentWorker === true);
-}
 async function hookPostTool(root, state, payload, noQuestion, sessionKey = null) {
     state = { ...state, _session_key: state?._session_key || sessionKey };
     await Promise.all([

package/dist/core/image-ux-review/imagegen-adapter.js

@@ -3,8 +3,8 @@ import fsp from 'node:fs/promises';
 import { ensureDir, exists, nowIso, projectRoot, readJson, writeJsonAtomic } from '../fsx.js';
 import { sha256File, imageDimensions } from '../wiki-image/image-hash.js';
 import { detectImagegenCapability } from '../imagegen/imagegen-capability.js';
-import { resolveCodexLbImagegenTarget } from '../imagegen/codex-lb-imagegen-target.js';
-import { CODEX_LB_PROVIDER_IMAGEGEN_EVIDENCE_CLASS, CODEX_LB_PROVIDER_OUTPUT_SOURCE, NON_CODEX_API_FALLBACK_EVIDENCE_CLASS } from '../imagegen/imagegen-evidence.js';
+import { DESKTOP_BRIDGE_IMAGEGEN_RECOVERY_GUIDANCE, resolveDesktopBridgeImagegenTarget } from '../imagegen/desktop-bridge-imagegen-target.js';
+import { CODEX_LB_PROVIDER_IMAGEGEN_EVIDENCE_CLASS, CODEX_LB_PROVIDER_OUTPUT_SOURCE, MOCK_FIXTURE_EVIDENCE_CLASS, NON_CODEX_API_FALLBACK_EVIDENCE_CLASS } from '../imagegen/imagegen-evidence.js';
 import { validateGptImage2Request } from '../imagegen/gpt-image-2-request-validator.js';
 import { parseResponsesSsePayload } from '../responses-stream.js';
 import { withResponsesRetry } from '../responses-retry-policy.js';
@@ -14,6 +14,7 @@ import { registerImageArtifact } from '../image/image-artifact-registry.js';
 const DEFAULT_OPENAI_IMAGE_EDITS_ENDPOINT = 'https://api.openai.com/v1/images/edits';
 export const DEFAULT_IMAGEGEN_FETCH_TIMEOUT_MS = 180000;
 const responseDeadlines = new WeakMap();
+const runtimeDesktopBridgeTargets = new WeakSet();
 export function buildCalloutPrompt(sourceScreenId, context = {}) {
     return [
         'Review this UI screenshot as a senior Toss UI/UX product designer.',
@@ -298,12 +299,11 @@ export function createFakeImagegenAdapter(opts = {}) {
 }
 export function createOpenAIImagesApiAdapter(opts = {}) {
     const apiKey = opts.apiKey || process.env.OPENAI_API_KEY || null;
-    const allowCodexLbApiFallback = opts.allowCodexLbApiFallback === true || process.env.SKS_IMAGEGEN_ALLOW_CODEX_LB_API_FALLBACK === '1';
-    const codexLb = allowCodexLbApiFallback && opts.codexLb?.available === true ? opts.codexLb : null;
+    const desktopBridgeTarget = trustedDesktopBridgeTarget(opts.desktopBridgeTarget);
     return {
         surface: 'openai_images_api',
         model: 'gpt-image-2',
-        available: Boolean(apiKey || codexLb),
+        available: Boolean(apiKey || desktopBridgeTarget?.selected || desktopBridgeTarget?.model),
         async generateCalloutReview(input) {
             const started = Date.now();
             await ensureDir(input.output_dir);
@@ -311,15 +311,19 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
             const responseArtifact = path.join(input.output_dir, 'image-ux-gpt-image-2-response.json');
             const sourcePath = path.resolve(input.source_image_path);
             const sourceSha = await sha256File(sourcePath);
-            const auth = await resolveImagesApiAuth({ ...opts, apiKey, codexLb });
-            const useResponsesImageTool = auth.auth_source === 'CODEX_LB_API_KEY' && Boolean(auth.responses_endpoint);
+            const auth = await resolveImagesApiAuth({ ...opts, apiKey, desktopBridgeTarget });
+            const useResponsesImageTool = auth.auth_source === 'DESKTOP_BRIDGE_LOOPBACK' && Boolean(auth.responses_endpoint);
             const effectiveEndpoint = useResponsesImageTool ? auth.responses_endpoint : auth.endpoint;
             const responsesModel = String(auth.responses_model || '');
-            const codexLbProviderSelected = useResponsesImageTool && (opts.codexLbTarget?.selected === true || codexLb?.selected === true);
-            const responsesEvidenceClass = codexLbProviderSelected
-                ? CODEX_LB_PROVIDER_IMAGEGEN_EVIDENCE_CLASS
+            const desktopBridgeSelected = useResponsesImageTool && auth.desktop_bridge_selected === true;
+            const responsesEvidenceClass = desktopBridgeSelected
+                ? auth.live_evidence_allowed === true
+                    ? CODEX_LB_PROVIDER_IMAGEGEN_EVIDENCE_CLASS
+                    : MOCK_FIXTURE_EVIDENCE_CLASS
                 : NON_CODEX_API_FALLBACK_EVIDENCE_CLASS;
-            const responsesOutputSource = codexLbProviderSelected ? CODEX_LB_PROVIDER_OUTPUT_SOURCE : null;
+            const responsesOutputSource = desktopBridgeSelected && auth.live_evidence_allowed === true
+                ? CODEX_LB_PROVIDER_OUTPUT_SOURCE
+                : null;
             const validation = await validateGptImage2Request({
                 provider: 'openai_images_api',
                 endpoint: String(effectiveEndpoint || ''),
@@ -333,7 +337,7 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
             await writeJsonAtomic(requestArtifact, {
                 schema: 'sks.image-ux-gpt-image-2-request.v1',
                 created_at: nowIso(),
-                provider: useResponsesImageTool ? 'openai_responses_image_generation' : 'openai_images_api',
+                provider: useResponsesImageTool ? 'desktop_bridge_responses_image_generation' : 'openai_images_api',
                 endpoint: effectiveEndpoint,
                 auth_source: auth.auth_source,
                 auth_transport: auth.auth_transport,
@@ -363,7 +367,7 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                 });
                 return { ok: false, status: 'blocked', generated_image_path: null, output_id: null, blocker: 'gpt_image_2_request_validation_failed', provider: 'openai_images_api', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
             }
-            if (auth.blocker || !auth.apiKey) {
+            if (auth.blocker || (!useResponsesImageTool && !auth.apiKey)) {
                 const blocked = {
                     schema: 'sks.image-ux-gpt-image-2-response.v1',
                     created_at: nowIso(),
@@ -373,8 +377,8 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                     ok: false,
                     status: 'blocked',
                     blocker: auth.blocker,
-                    setup_guidance: auth.auth_source === 'CODEX_LB_API_KEY'
-                        ? 'Repair the selected codex-lb credential binding. Completed output from a selected provider can satisfy full evidence; codex-lb used only as a fallback while another provider is selected cannot.'
+                    setup_guidance: auth.auth_source === 'DESKTOP_BRIDGE_LOOPBACK'
+                        ? auth.setup_guidance || DESKTOP_BRIDGE_IMAGEGEN_RECOVERY_GUIDANCE
                         : 'Set OPENAI_API_KEY only for an explicit non-Codex Images API fallback, or attach a real Codex App $imagegen output image for full SKS verification.',
                     local_only: true
                 };
@@ -386,16 +390,16 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                 await writeJsonAtomic(responseArtifact, {
                     schema: 'sks.image-ux-gpt-image-2-response.v1',
                     created_at: nowIso(),
-                    provider: 'openai_responses_image_generation',
+                    provider: 'desktop_bridge_responses_image_generation',
                     evidence_class: 'non_codex_api_fallback',
                     model: 'gpt-image-2',
                     ok: false,
                     status: 'blocked',
                     blocker,
-                    setup_guidance: 'Set SKS_IMAGEGEN_RESPONSES_MODEL to a model available through the configured Responses provider; SKS does not hardcode a text model.',
+                    setup_guidance: DESKTOP_BRIDGE_IMAGEGEN_RECOVERY_GUIDANCE,
                     local_only: true
                 });
-                return { ok: false, status: 'blocked', generated_image_path: null, output_id: null, blocker, provider: 'openai_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
+                return { ok: false, status: 'blocked', generated_image_path: null, output_id: null, blocker, provider: 'desktop_bridge_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
             }
             try {
                 if (useResponsesImageTool) {
@@ -404,9 +408,7 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                         const response = await fetchWithTimeout(effectiveEndpoint, {
                             method: 'POST',
                             headers: {
-                                ...(auth.auth_transport === 'x-codex-lb-api-key'
-                                    ? { 'X-Codex-LB-API-Key': auth.apiKey }
-                                    : { authorization: `Bearer ${auth.apiKey}` }),
+                                'x-sks-model': responsesModel,
                                 'content-type': 'application/json'
                             },
                             body: JSON.stringify({
@@ -427,40 +429,41 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                     }, imagegenRetryOptions(opts));
                     const { response, payload } = attemptResult;
                     if (!response.ok) {
-                        await writeJsonAtomic(responseArtifact, redactedImagegenResponse(payload, false, Date.now() - started, 'openai_responses_image_generation', { attempts, retry_log }));
-                        return { ok: false, status: 'blocked', generated_image_path: null, output_id: null, blocker: imagegenErrorKind(payload), provider: 'openai_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
+                        await writeJsonAtomic(responseArtifact, redactedImagegenResponse(payload, false, Date.now() - started, 'desktop_bridge_responses_image_generation', { attempts, retry_log }));
+                        return { ok: false, status: 'blocked', generated_image_path: null, output_id: null, blocker: imagegenErrorKind(payload), provider: 'desktop_bridge_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
                     }
                     if (payload?.error) {
-                        await writeJsonAtomic(responseArtifact, redactedImagegenResponse(payload, false, Date.now() - started, 'openai_responses_image_generation'));
-                        return { ok: false, status: 'blocked', generated_image_path: null, output_id: null, blocker: imagegenErrorKind(payload), provider: 'openai_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
+                        await writeJsonAtomic(responseArtifact, redactedImagegenResponse(payload, false, Date.now() - started, 'desktop_bridge_responses_image_generation'));
+                        return { ok: false, status: 'blocked', generated_image_path: null, output_id: null, blocker: imagegenErrorKind(payload), provider: 'desktop_bridge_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
                     }
                     const generated = findResponsesImageGenerationOutput(payload);
                     if (!generated?.b64) {
-                        await writeJsonAtomic(responseArtifact, redactedImagegenResponse({ ...payload, blocker: 'missing_b64_image_output' }, false, Date.now() - started, 'openai_responses_image_generation'));
-                        return { ok: false, status: 'blocked', generated_image_path: null, output_id: generated?.id || null, blocker: 'missing_b64_image_output', provider: 'openai_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
+                        await writeJsonAtomic(responseArtifact, redactedImagegenResponse({ ...payload, blocker: 'missing_b64_image_output' }, false, Date.now() - started, 'desktop_bridge_responses_image_generation'));
+                        return { ok: false, status: 'blocked', generated_image_path: null, output_id: generated?.id || null, blocker: 'missing_b64_image_output', provider: 'desktop_bridge_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
                     }
                     const out = path.join(input.output_dir, `gpt-image-2-callout-${Date.now()}.png`);
                     await fsp.writeFile(out, Buffer.from(String(generated.b64), 'base64'));
                     const meta = await generatedImageMetadata(process.cwd(), out, {
                         source_screen_id: input.source_screen_id,
-                        provider_surface: 'openai_responses_image_generation',
+                        provider_surface: 'desktop_bridge_responses_image_generation',
                         output_id: generated.id || payload?.id || null,
                         evidence_class: responsesEvidenceClass,
                         output_source: responsesOutputSource,
-                        real_generated: true
+                        real_generated: auth.live_evidence_allowed === true,
+                        mock: auth.live_evidence_allowed !== true
                     });
-                    const imageContract = await writeGeneratedImagePathContract(input, out, 'openai_responses_image_generation').catch(() => null);
+                    const imageContract = await writeGeneratedImagePathContract(input, out, 'desktop_bridge_responses_image_generation').catch(() => null);
                     await writeJsonAtomic(responseArtifact, {
                         schema: 'sks.image-ux-gpt-image-2-response.v1',
                         created_at: nowIso(),
-                        provider: 'openai_responses_image_generation',
+                        provider: 'desktop_bridge_responses_image_generation',
                         evidence_class: responsesEvidenceClass,
                         model: 'gpt-image-2',
                         responses_model: responsesModel,
                         responses_model_source: auth.responses_model_source || null,
                         auth_source: auth.auth_source,
-                        api_key_source: auth.api_key_source || null,
-                        codex_lb_provider_selected: codexLbProviderSelected,
+                        desktop_bridge_selected: desktopBridgeSelected,
+                        desktop_bridge_route_provider: auth.route_provider_id || null,
                         ok: true,
                         status: 'generated',
                         output_image_path: out,
@@ -477,7 +480,7 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                         token_cost_metadata: payload?.usage || null,
                         local_only: true
                     });
-                    return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'openai_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, image_artifact_path_contract: imageContract?.artifact_path || null, latency_ms: Date.now() - started };
+                    return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'desktop_bridge_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, image_artifact_path_contract: imageContract?.artifact_path || null, latency_ms: Date.now() - started };
                 }
                 const sourceBytes = await fsp.readFile(sourcePath);
                 const qualityParam = imagegenQualityParam(opts);
@@ -538,7 +541,7 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                 return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'openai_images_api', request_artifact: requestArtifact, response_artifact: responseArtifact, image_artifact_path_contract: imageContract?.artifact_path || null, latency_ms: Date.now() - started };
             }
             catch (err) {
-                const provider = useResponsesImageTool ? 'openai_responses_image_generation' : 'openai_images_api';
+                const provider = useResponsesImageTool ? 'desktop_bridge_responses_image_generation' : 'openai_images_api';
                 const payload = { error: { message: err instanceof Error ? err.message : String(err) } };
                 const response = redactedImagegenResponse(payload, false, Date.now() - started, provider);
                 await writeJsonAtomic(responseArtifact, response);
@@ -586,22 +589,20 @@ export async function generateGptImage2CalloutReview(input, opts = {}) {
         return createFakeImagegenAdapter({ ...(opts.fakeAdapter || {}), mockContext: true }).generateCalloutReview(input);
     }
     const capability = await detectImagegenCapability(opts.capability || {}).catch(() => null);
-    const codexLbTarget = opts.codexLbTarget || await resolveCodexLbImagegenTarget(codexLbTargetInputs(opts.capability)).catch(() => null);
-    const explicitDisableCodexLbFallback = opts.allowCodexLbApiFallback === false || process.env.SKS_IMAGEGEN_ALLOW_CODEX_LB_API_FALLBACK === '0';
-    const allowCodexLbApiFallback = !explicitDisableCodexLbFallback && (opts.allowCodexLbApiFallback === true
-        || process.env.SKS_IMAGEGEN_ALLOW_CODEX_LB_API_FALLBACK === '1'
-        || codexLbTarget?.selected === true);
+    const suppliedTarget = opts.desktopBridgeTarget
+        ? trustedDesktopBridgeTarget(opts.desktopBridgeTarget)
+        : null;
+    const desktopBridgeTarget = suppliedTarget || await resolveDesktopBridgeImagegenTarget(desktopBridgeTargetInputs(opts.capability, opts.openai || opts)).catch(() => null);
+    if (!suppliedTarget && desktopBridgeTarget?.status_source === 'runtime') {
+        runtimeDesktopBridgeTargets.add(desktopBridgeTarget);
+    }
+    const managedBridgeRequested = Boolean(desktopBridgeTarget?.selected || desktopBridgeTarget?.model);
     const allowApiFallback = (opts.allowApiFallback === true
         || process.env.SKS_IMAGEGEN_ALLOW_API_FALLBACK === '1'
-        || allowCodexLbApiFallback);
+        || managedBridgeRequested);
     const openaiOptions = {
         ...(opts.openai || {}),
-        codexLb: allowCodexLbApiFallback ? opts.openai?.codexLb || capability?.codex_lb || null : null,
-        codexLbTarget,
-        codexLbAuthTransport: capability?.codex_lb?.cli_contract === true
-            ? 'authorization-bearer'
-            : codexLbTarget?.auth_transport,
-        allowCodexLbApiFallback
+        desktopBridgeTarget
     };
     const codexAdapter = createCodexAppImagegenAdapter({
         ...(opts.codexApp || {}),
@@ -612,16 +613,18 @@ export async function generateGptImage2CalloutReview(input, opts = {}) {
         return codexResult;
     return createOpenAIImagesApiAdapter(openaiOptions).generateCalloutReview(input);
 }
-function codexLbTargetInputs(source = {}) {
-    const inputs = {};
+function desktopBridgeTargetInputs(source = {}, request = {}) {
+    const inputs = {
+        explicitModel: String(request.responsesModel || source?.env?.SKS_IMAGEGEN_RESPONSES_MODEL || '').trim() || null
+    };
     if (source?.home)
         inputs.home = source.home;
-    if (source?.codexHome)
-        inputs.codexHome = source.codexHome;
     if (source?.env)
         inputs.env = source.env;
-    if (typeof source?.configText === 'string')
-        inputs.configText = source.configText;
+    if (source?.desktopBridgeStatus !== undefined)
+        inputs.desktopBridgeStatus = source.desktopBridgeStatus;
+    if (source?.desktopBridgeStatusImpl)
+        inputs.desktopBridgeStatusImpl = source.desktopBridgeStatusImpl;
     return inputs;
 }
 function imagegenMockContext(opts = {}) {
@@ -638,64 +641,75 @@ export function imagegenCapabilityBlocker(surface = 'Codex App $imagegen') {
         blocker: 'imagegen_capability_missing',
         surface,
         model: 'gpt-image-2',
-        guidance: 'Run the request with gpt-image-2 through Codex App $imagegen or a selected, ready codex-lb provider and bind the completed generated image path. OPENAI_API_KEY, or codex-lb used while another provider is selected, remains non-Codex fallback evidence. SKS must not fabricate or substitute a text-only review.'
+        guidance: 'Run the request with gpt-image-2 through Codex App $imagegen, or provide an explicit model routed by the verified managed Desktop Bridge. Direct provider credentials remain non-Codex fallback evidence. SKS must not fabricate or substitute a text-only review.'
     };
 }
 async function resolveImagesApiAuth(opts = {}) {
-    const codexLb = opts.codexLb?.available === true ? opts.codexLb : null;
-    const target = opts.codexLbTarget || (codexLb
-        ? await resolveCodexLbImagegenTarget(codexLbTargetInputs(opts)).catch(() => null)
-        : null);
-    if (target?.selected === true)
-        return codexLbImagesApiAuth(opts, codexLb, target);
+    const target = trustedDesktopBridgeTarget(opts.desktopBridgeTarget);
+    if (target && (target.selected || target.model))
+        return desktopBridgeImagesApiAuth(target);
     const openAiKey = String(opts.apiKey || process.env.OPENAI_API_KEY || '').trim();
     if (openAiKey) {
         return {
             apiKey: openAiKey,
             auth_source: 'OPENAI_API_KEY',
             auth_transport: 'authorization-bearer',
-            api_key_source: null,
             responses_model: responsesImagegenModel(opts),
             responses_model_source: responsesImagegenModel(opts) ? 'explicit' : null,
             endpoint: imageEditsEndpoint(opts.baseUrl || 'https://api.openai.com/v1'),
             responses_endpoint: responsesEndpoint(opts.baseUrl || 'https://api.openai.com/v1'),
-            blocker: null
-        };
-    }
-    if (!codexLb) {
-        return {
-            apiKey: null,
-            auth_source: null,
-            auth_transport: 'authorization-bearer',
-            api_key_source: null,
-            responses_model: responsesImagegenModel(opts),
-            responses_model_source: null,
-            endpoint: imageEditsEndpoint(opts.baseUrl || 'https://api.openai.com/v1'),
-            responses_endpoint: responsesEndpoint(opts.baseUrl || 'https://api.openai.com/v1'),
-            blocker: 'openai_api_key_missing'
+            blocker: null,
+            desktop_bridge_selected: false,
+            route_provider_id: null,
+            live_evidence_allowed: false,
+            setup_guidance: null
         };
     }
-    return codexLbImagesApiAuth(opts, codexLb, target);
+    return {
+        apiKey: null,
+        auth_source: null,
+        auth_transport: 'authorization-bearer',
+        responses_model: responsesImagegenModel(opts),
+        responses_model_source: null,
+        endpoint: imageEditsEndpoint(opts.baseUrl || 'https://api.openai.com/v1'),
+        responses_endpoint: responsesEndpoint(opts.baseUrl || 'https://api.openai.com/v1'),
+        blocker: 'openai_api_key_missing',
+        desktop_bridge_selected: false,
+        route_provider_id: null,
+        live_evidence_allowed: false,
+        setup_guidance: null
+    };
 }
-function codexLbImagesApiAuth(opts, codexLb, target) {
-    const envKey = codexLb?.env_key || 'CODEX_LB_API_KEY';
-    const codexLbKey = String(opts.codexLbApiKey || target?.api_key || '').trim();
-    const baseUrl = target?.base_url || codexLb?.base_url || opts.baseUrl || '';
-    const blocker = !baseUrl
-        ? 'codex_lb_base_url_missing'
-        : codexLbKey
-            ? null
-            : target?.blocker || 'codex_lb_api_key_missing';
+function desktopBridgeImagesApiAuth(target) {
+    return {
+        apiKey: null,
+        auth_source: 'DESKTOP_BRIDGE_LOOPBACK',
+        auth_transport: 'loopback-route',
+        responses_model: target.model || '',
+        responses_model_source: target.model_source,
+        endpoint: null,
+        responses_endpoint: target.endpoint,
+        blocker: target.blocker,
+        desktop_bridge_selected: target.selected,
+        route_provider_id: target.provider_id,
+        live_evidence_allowed: target.live_evidence_allowed,
+        setup_guidance: target.setup_guidance
+    };
+}
+function trustedDesktopBridgeTarget(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const target = value;
+    const runtimeTrusted = runtimeDesktopBridgeTargets.has(target);
+    if (runtimeTrusted
+        && target.status_source === 'runtime'
+        && target.bridge_verified === true
+        && target.live_evidence_allowed === true)
+        return target;
     return {
-        apiKey: codexLbKey || null,
-        auth_source: envKey,
-        auth_transport: opts.codexLbAuthTransport || target?.auth_transport || 'authorization-bearer',
-        api_key_source: target?.api_key_source || null,
-        responses_model: responsesImagegenModel(opts) || target?.model || '',
-        responses_model_source: responsesImagegenModel(opts) ? 'explicit' : target?.model_source || null,
-        endpoint: baseUrl ? imageEditsEndpoint(baseUrl) : null,
-        responses_endpoint: baseUrl ? responsesEndpoint(baseUrl) : null,
-        blocker
+        ...target,
+        status_source: 'injected_fixture',
+        live_evidence_allowed: false
     };
 }
 function imageEditsEndpoint(baseUrl = '') {