sneakoscope 8.1.2 → 8.2.0

package/dist/core/init.js

@@ -670,7 +670,6 @@ export async function initProject(root, opts = {}) {
         return `${next.trim()}\n`;
     }
     async function mergeGlobalCodexConfigIfAvailable(configText = '', configPath = '', opts = {}) {
-        const selectedRe = /(^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/;
         const home = opts.home || process.env.HOME || '';
         if (!home)
             return configText;
@@ -681,49 +680,8 @@ export async function initProject(root, opts = {}) {
         const globalConfig = await readText(globalConfigPath, '');
         let next = mergeGlobalMcpServers(configText, globalConfig);
         next = mergeGlobalCodexAppRuntimeTables(next, globalConfig);
-        if (selectedRe.test(next) && /\[model_providers\.codex-lb\]/.test(next)) {
-            return `${next.trim()}\n`;
-        }
-        const envPath = path.join(codexHome, 'sks-codex-lb.env');
-        if (!(await exists(envPath)))
-            return next;
-        const envText = await readText(envPath, '');
-        const baseUrl = globalConfig.match(/(^|\n)\[model_providers\.codex-lb\][\s\S]*?\n\s*base_url\s*=\s*"([^"]+)"/)?.[2] || parseCodexLbEnvBaseUrl(envText);
-        if (!parseCodexLbEnvKey(envText) || !baseUrl)
-            return next;
-        const shouldSelectCodexLb = selectedRe.test(next) || selectedRe.test(globalConfig);
-        next = shouldSelectCodexLb
-            ? upsertTopLevelTomlString(next, 'model_provider', 'codex-lb')
-            : removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
-        next = upsertTomlTable(next, 'model_providers.codex-lb', `[model_providers.codex-lb]\nname = "codex-lb"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = false`);
         return `${next.trim()}\n`;
     }
-    function parseCodexLbEnvKey(text = '') {
-        return parseShellEnvValue(text, 'CODEX_LB_API_KEY');
-    }
-    function parseCodexLbEnvBaseUrl(text = '') {
-        const value = parseShellEnvValue(text, 'CODEX_LB_BASE_URL');
-        if (!value)
-            return '';
-        let host = value.trim();
-        if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(host))
-            host = `https://${host}`;
-        host = host.replace(/\/+$/, '');
-        return /\/backend-api\/codex$/i.test(host) ? host : `${host}/backend-api/codex`;
-    }
-    function parseShellEnvValue(text = '', key = '') {
-        const re = new RegExp(`^\\s*(?:export\\s+)?${escapeRegExp(key)}\\s*=\\s*(.+?)\\s*$`, 'm');
-        const raw = String(text || '').match(re)?.[1]?.trim() || '';
-        if (!raw)
-            return '';
-        if (raw.startsWith("'"))
-            return raw.endsWith("'") && raw.length > 1 ? raw.slice(1, -1).replace(/'\\''/g, "'") : '';
-        if (raw.startsWith('"'))
-            return raw.endsWith('"') && raw.length > 1 ? raw.slice(1, -1).replace(/\\"/g, '"') : '';
-        if (raw.includes("'") || raw.includes('"') || /\s/.test(raw))
-            return '';
-        return raw;
-    }
     function mergeGlobalMcpServers(configText = '', globalConfig = '') {
         let next = configText;
         const re = /(?:^|\n)(\[(mcp_servers\.[^\]\r\n]+)\][\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/g;
@@ -762,27 +720,6 @@ export async function initProject(root, opts = {}) {
         }
         return lines.filter((_, index) => index < start || index >= end).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
     }
-    function removeTopLevelTomlKeyIfValue(text = '', key = '', value = '') {
-        const lines = String(text || '').split('\n');
-        const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-        const end = firstTable === -1 ? lines.length : firstTable;
-        const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"${escapeRegExp(value)}"\\s*(?:#.*)?$`);
-        return lines.filter((line, index) => index >= end || !keyPattern.test(line)).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-    }
-    function upsertTopLevelTomlString(text, key, value) {
-        const line = `${key} = "${value}"`;
-        const lines = String(text || '').split('\n');
-        const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
-        const end = firstTable === -1 ? lines.length : firstTable;
-        for (let i = 0; i < end; i += 1) {
-            if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[i] || '')) {
-                lines[i] = line;
-                return lines.join('\n').replace(/\n{3,}/g, '\n\n');
-            }
-        }
-        lines.splice(end, 0, line);
-        return lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
-    }
     function upsertTopLevelTomlBoolean(text, key, value) {
         const line = `${key} = ${value ? 'true' : 'false'}`;
         const lines = String(text || '').split('\n');

package/dist/core/install/installed-package-smoke.js

@@ -316,7 +316,7 @@ async function readReceiptBinding(receipt, tarball) {
         const blockers = [];
         const sha256 = normalizeSha256(parsed.sha256);
         const version = typeof parsed.package_version === 'string' ? parsed.package_version : null;
-        if (parsed.schema !== 'sks.release-pack-receipt.v1' || parsed.ok !== true)
+        if (parsed.schema !== 'sks.release-pack-receipt.v2' || parsed.ok !== true)
             blockers.push('pack_receipt_invalid');
         if (!sha256)
             blockers.push('pack_receipt_sha256_invalid');

package/dist/core/managed-assets/managed-assets-manifest.js

@@ -447,7 +447,6 @@ Return the measurement method, observed result, uncertainty, and next cheapest e
     })
 ]);
 export const MANAGED_SKILLS = Object.freeze([
-    'loop',
     'naruto',
     'qa-loop',
     'research',

package/dist/core/policy/latest-version-guidance.js

@@ -50,8 +50,21 @@ const WINDOW_CHARS = 90;
 function containsTrigger(haystack) {
     const lower = haystack.toLowerCase();
     for (const trigger of GUIDANCE_TRIGGERS) {
-        if (lower.includes(trigger.toLowerCase()))
-            return trigger;
+        const needle = trigger.toLowerCase();
+        let fromIndex = 0;
+        while (fromIndex <= lower.length - needle.length) {
+            const index = lower.indexOf(needle, fromIndex);
+            if (index < 0)
+                break;
+            const before = index > 0 ? (lower[index - 1] ?? '') : '';
+            const afterIndex = index + needle.length;
+            const after = afterIndex < lower.length ? (lower[afterIndex] ?? '') : '';
+            const englishTrigger = /[a-z]/.test(needle);
+            const hasWordBoundaries = !englishTrigger || (!/[a-z0-9_]/.test(before) && !/[a-z0-9_]/.test(after));
+            if (hasWordBoundaries)
+                return trigger;
+            fromIndex = index + 1;
+        }
     }
     return null;
 }

package/dist/core/preflight/parallel-preflight-engine.js

@@ -4,8 +4,7 @@ import { buildCodexExecArgs } from '../codex/codex-cli-syntax-builder.js';
 import { inspectCodexConfigReadability } from '../codex/codex-config-readability.js';
 import { repairCodexConfigEperm } from '../codex/codex-config-eperm-repair.js';
 import { splitCodexProjectConfigPolicy } from '../codex/codex-project-config-policy.js';
-import { codexLbStatus } from '../../cli/install-helpers.js';
-import { codexLbToolOutputRecoveryOverrideAcknowledged } from '../codex-lb/codex-lb-tool-output-recovery.js';
+import { desktopBridgeStatusV3 } from '../codex-lb/desktop-controller-v3.js';
 export const PARALLEL_PREFLIGHT_SCHEMA = 'sks.parallel-preflight.v1';
 export async function runParallelPreflight(checks) {
     const startedAt = nowIso();
@@ -34,7 +33,7 @@ export async function runCodexLaunchPreflight(rootInput = process.cwd(), opts =
     const readonly = await runParallelPreflight([
         { id: 'codex_config_readability', run: () => inspectCodexConfigReadability(root, { ...opts, codexProbe: probeCodex, actualCodex: probeCodex, writeReport: false }) },
         { id: 'codex_project_config_policy', run: () => splitCodexProjectConfigPolicy(root, { ...opts, writeReport: false }) },
-        { id: 'codex_lb_tool_output_recovery', run: () => inspectCodexLbToolOutputRecoveryForLaunch(opts) }
+        { id: 'desktop_bridge_status', run: () => inspectDesktopBridgeForLaunch(opts) }
     ]);
     const repair = opts.fix === true
         ? await repairCodexConfigEperm(root, { ...opts, codexProbe: probeCodex, actualCodex: probeCodex, fix: true, writeReport: false })
@@ -59,7 +58,7 @@ export async function runCodexLaunchPreflight(rootInput = process.cwd(), opts =
     };
     const blockers = [...new Set([...(readonly.blockers || []), ...(repair?.blockers || []), ...(fastTierProof.ok ? [] : ['service_tier_not_passed_to_codex'])])];
     const operatorActions = [...new Set([...(readonly.operator_actions || []), ...(repair?.operator_actions || [])])];
-    const codexLbToolOutputRecovery = readonly.results.find((result) => result.id === 'codex_lb_tool_output_recovery')?.value || null;
+    const desktopBridgeStatus = readonly.results.find((result) => result.id === 'desktop_bridge_status')?.value || null;
     const report = {
         schema: 'sks.mad-launch-preflight.v1',
         generated_at: nowIso(),
@@ -67,7 +66,7 @@ export async function runCodexLaunchPreflight(rootInput = process.cwd(), opts =
         ok: blockers.length === 0,
         readonly,
         repair,
-        codex_lb_tool_output_recovery: codexLbToolOutputRecovery,
+        desktop_bridge_status: desktopBridgeStatus,
         fast_tier_proof: fastTierProof,
         blockers,
         operator_actions: operatorActions
@@ -76,61 +75,38 @@ export async function runCodexLaunchPreflight(rootInput = process.cwd(), opts =
         await writeJsonAtomic(reportPath, { ...report, report_path: reportPath });
     return report;
 }
-export async function inspectCodexLbToolOutputRecoveryForLaunch(opts = {}) {
-    if (opts.skipCodexLbToolOutputRecovery === true) {
+export async function inspectDesktopBridgeForLaunch(opts = {}) {
+    if (opts.skipDesktopBridgeStatus === true) {
         return {
-            schema: 'sks.codex-lb-launch-recovery-preflight.v1',
+            schema: 'sks.desktop-bridge-launch-preflight.v1',
             ok: true,
-            status: 'not_applicable',
-            selected: false,
+            status: 'skipped',
+            managed: false,
             blockers: [],
             operator_actions: []
         };
     }
-    const allowUnverifiedToolOutputRecovery = opts.allowUnverifiedToolOutputRecovery === true
-        || codexLbToolOutputRecoveryOverrideAcknowledged({ env: opts.env || process.env });
-    const status = await codexLbStatus({
+    const status = await (opts.desktopBridgeStatusImpl || desktopBridgeStatusV3)({
         ...opts,
-        ...(opts.home || opts.codexHome ? { home: opts.home || opts.codexHome } : {}),
-        ...(opts.codexLbConfigPath ? { configPath: opts.codexLbConfigPath } : {}),
-        ...(opts.codexLbEnvPath ? { envPath: opts.codexLbEnvPath } : {}),
-        ...(typeof opts.codexLbToolOutputRecoveryFetch === 'function'
-            ? { toolOutputRecoveryFetch: opts.codexLbToolOutputRecoveryFetch }
-            : {}),
-        ...(opts.codexLbToolOutputRecoveryTimeoutMs
-            ? { toolOutputRecoveryTimeoutMs: opts.codexLbToolOutputRecoveryTimeoutMs }
-            : {}),
-        probeToolOutputRecovery: true,
-        allowUnverifiedToolOutputRecovery
+        ...(opts.home || opts.codexHome ? { home: opts.home || opts.codexHome } : {})
     });
-    const recovery = status.tool_output_recovery;
-    const required = status.selected === true;
-    const providerReady = status.provider_ready === true;
-    const providerBlockers = Array.isArray(status.blockers)
-        ? status.blockers.map(String).filter(Boolean)
+    const managed = status.management?.managed === true;
+    const ready = status.readiness?.ready === true;
+    const blockers = managed && !ready
+        ? Array.isArray(status.readiness?.blockers)
+            ? status.readiness.blockers.map(String).filter(Boolean)
+            : ['desktop_bridge_not_ready']
         : [];
-    const ok = !required || (providerReady && recovery?.ok === true);
     return {
-        schema: 'sks.codex-lb-launch-recovery-preflight.v1',
-        ok,
-        status: !required
-            ? 'not_selected'
-            : !providerReady
-                ? providerBlockers[0] || 'provider_not_ready'
-                : recovery?.status || 'version_unverified',
-        selected: required,
-        provider_ready: providerReady,
-        base_url: status.base_url || null,
-        tool_output_recovery: recovery || null,
-        blockers: ok
-            ? []
-            : !providerReady
-                ? providerBlockers.length > 0
-                    ? providerBlockers
-                    : ['codex_lb_provider_not_ready']
-                : recovery?.blockers || ['codex_lb_tool_output_recovery_version_unverified'],
-        operator_actions: ok ? [] : recovery?.operator_actions || [
-            'Upgrade codex-lb, or run `sks codex-lb disable`; SKS will not change routing or authentication silently.'
-        ]
+        schema: 'sks.desktop-bridge-launch-preflight.v1',
+        ok: !managed || ready,
+        status: !managed ? 'not_managed' : ready ? 'ready' : 'blocked',
+        managed,
+        ready,
+        correlation_id: status.correlation_id || null,
+        blockers,
+        operator_actions: managed && !ready && Array.isArray(status.recovery_actions)
+            ? status.recovery_actions.map(String).filter(Boolean)
+            : []
     };
 }

package/dist/core/provider/provider-badge.js

@@ -1,9 +1,10 @@
 export const PROVIDER_BADGE_SCHEMA = 'sks.provider-badge.v1';
 export function providerBadgeText(context) {
+    const bridgeProvider = context.signals.desktop_bridge_provider;
     const providerText = context.provider === 'openai'
-        ? 'OpenAI'
-        : context.provider === 'codex-lb'
-            ? 'codex-lb'
+        ? 'OpenAI API'
+        : context.provider === 'desktop-bridge'
+            ? `Desktop Bridge${bridgeProvider ? ` → ${bridgeProvider}` : ''}`
             : context.provider === 'codex-app'
                 ? 'Codex App OAuth'
                 : 'Unknown';
@@ -15,7 +16,11 @@ export function providerBadgeText(context) {
     return `Provider: ${providerText} · ${tierText}`;
 }
 export function providerPaneLabel(context) {
-    const provider = context.provider === 'unknown' ? 'provider-unknown' : context.provider;
+    const provider = context.provider === 'unknown'
+        ? 'provider-unknown'
+        : context.provider === 'desktop-bridge' && context.signals.desktop_bridge_provider
+            ? `desktop-bridge/${context.signals.desktop_bridge_provider}`
+            : context.provider;
     const tier = context.service_tier === 'unknown' ? 'tier-unknown' : context.service_tier;
     return `${tier} · ${provider}`;
 }

package/dist/core/provider/provider-context.js

@@ -1,58 +1,48 @@
 import path from 'node:path';
-import { exists, nowIso, readJson, readText, writeJsonAtomic } from '../fsx.js';
-import { escapeRegExp } from '../text/regex.js';
-export const PROVIDER_CONTEXT_SCHEMA = 'sks.provider-context.v1';
+import { exists, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+export const PROVIDER_CONTEXT_SCHEMA = 'sks.provider-context.v2';
 export async function resolveProviderContext(input = {}) {
     const env = input.env || process.env;
     const root = path.resolve(input.root || process.cwd());
-    const codexHome = path.resolve(String(input.codexHome || env.CODEX_HOME || path.join(env.HOME || '', '.codex')));
-    const configText = await readText(path.join(codexHome, 'config.toml'), '').catch(() => '');
-    const configModelProvider = readTopLevelTomlString(configText, 'model_provider');
-    const codexLbProviderBlockPresent = hasCodexLbProviderBlock(configText);
-    const codexLbBearerEnvKey = codexLbProviderBearerEnvKey(configText);
-    const codexLbGatewayHeaderEnvKey = codexLbProviderGatewayHeaderEnvKey(configText);
-    const codexLbEnvKey = codexLbGatewayHeaderEnvKey || codexLbBearerEnvKey;
-    const codexLbRequiresOpenAiAuth = codexLbProviderRequiresOpenAiAuth(configText);
-    const codexLbProviderValid = codexLbProviderBlockPresent
-        && codexLbBearerEnvKey === 'CODEX_LB_API_KEY'
-        && codexLbGatewayHeaderEnvKey === null
-        && codexLbRequiresOpenAiAuth === false;
-    const openaiKey = Boolean(String(env.OPENAI_API_KEY || '').trim());
-    const lbKey = Boolean(String((codexLbEnvKey ? env[codexLbEnvKey] : env.CODEX_LB_API_KEY) || env.CODEX_LB_API_KEY || '').trim());
-    const envProvider = String(env.SKS_MODEL_PROVIDER || env.CODEX_MODEL_PROVIDER || env.OPENAI_MODEL_PROVIDER || '').trim();
-    const modelProvider = String(input.modelProvider || envProvider || configModelProvider || '').trim() || null;
-    const envLbExplicit = env.SKS_PROVIDER === 'codex-lb' || env.SKS_USE_CODEX_LB === '1';
-    const lbExplicit = modelProvider === 'codex-lb' || envLbExplicit;
+    const codexHome = path.resolve(String(input.codexHome || env.CODEX_HOME || path.join(env.HOME || root, '.codex')));
     const auth = await readJson(path.join(codexHome, 'auth.json'), null).catch(() => null);
     const appAuthPresent = Boolean(auth) || await exists(path.join(codexHome, 'auth.json'));
-    const conflict = (lbKey && openaiKey && !lbExplicit && !modelProvider) || (modelProvider === 'codex-lb' && !lbKey && openaiKey);
+    const openaiKeyPresent = Boolean(String(env.OPENAI_API_KEY || '').trim());
+    let bridgeStatus = null;
+    let bridgeStatusAvailable = false;
+    try {
+        bridgeStatus = Object.prototype.hasOwnProperty.call(input, 'desktopBridgeStatus')
+            ? input.desktopBridgeStatus || null
+            : await (input.desktopBridgeStatusImpl || currentDesktopBridgeStatus)(input.desktopBridgeStatusOptions || {});
+        bridgeStatusAvailable = bridgeStatus?.schema === 'sks.desktop-bridge-status.v3';
+        if (!bridgeStatusAvailable)
+            bridgeStatus = null;
+    }
+    catch {
+        bridgeStatus = null;
+    }
+    const bridgeManaged = bridgeStatus?.management.managed === true;
+    const bridgeReady = bridgeStatus?.readiness.ready === true;
+    const bridgeProvider = selectedBridgeProvider(bridgeStatus);
+    const nativeIdentityConfigured = bridgeStatus?.native_identity.configured === true || appAuthPresent;
+    const credentialState = bridgeProvider && bridgeStatus
+        ? bridgeStatus.providers[bridgeProvider].credential.state
+        : null;
     let provider = 'unknown';
     let authMode = 'unknown';
     let source = 'unknown';
     let confidence = 'low';
-    if (envLbExplicit && lbKey) {
-        provider = 'codex-lb';
-        authMode = 'codex_lb_key';
-        source = 'codex_lb';
-        confidence = 'high';
-    }
-    else if (modelProvider === 'codex-lb' && codexLbProviderValid && lbKey) {
-        provider = 'codex-lb';
-        authMode = 'codex_lb_key';
-        source = 'config';
-        confidence = 'high';
+    if (bridgeManaged) {
+        provider = 'desktop-bridge';
+        authMode = nativeIdentityConfigured ? 'chatgpt_oauth' : 'unknown';
+        source = 'desktop_bridge';
+        confidence = bridgeReady && nativeIdentityConfigured ? 'high' : 'medium';
     }
-    else if (modelProvider === 'codex-lb' && codexLbProviderValid) {
-        provider = 'codex-lb';
-        authMode = 'unknown';
-        source = 'config';
-        confidence = 'low';
-    }
-    else if (openaiKey) {
+    else if (openaiKeyPresent) {
         provider = 'openai';
         authMode = 'api_key';
         source = 'env';
-        confidence = conflict ? 'medium' : 'high';
+        confidence = 'high';
     }
     else if (appAuthPresent) {
         provider = 'codex-app';
@@ -60,11 +50,12 @@ export async function resolveProviderContext(input = {}) {
         source = 'codex_app';
         confidence = 'medium';
     }
-    const warnings = [
-        ...(conflict ? ['provider_conflict'] : []),
-        ...(modelProvider === 'codex-lb' && !codexLbProviderValid && !envLbExplicit ? ['codex_lb_provider_config_missing_or_invalid'] : []),
-        ...(provider === 'codex-lb' && !lbKey ? ['codex_lb_selected_without_key'] : [])
-    ];
+    const warnings = unique([
+        ...(!bridgeStatusAvailable ? ['desktop_bridge_status_unavailable'] : []),
+        ...(bridgeManaged ? bridgeStatus?.readiness.blockers || [] : []),
+        ...(bridgeManaged ? bridgeStatus?.routing.blockers || [] : []),
+        ...(bridgeManaged && !nativeIdentityConfigured ? ['desktop_bridge_native_identity_required'] : [])
+    ]);
     return {
         schema: PROVIDER_CONTEXT_SCHEMA,
         generated_at: nowIso(),
@@ -74,19 +65,17 @@ export async function resolveProviderContext(input = {}) {
         service_tier: normalizeServiceTier(input.serviceTier || env.SKS_SERVICE_TIER),
         source,
         confidence,
-        conflict,
+        conflict: false,
         warnings,
         signals: {
-            openai_api_key_present: openaiKey,
-            codex_lb_key_present: lbKey,
-            codex_lb_explicit: lbExplicit,
+            openai_api_key_present: openaiKeyPresent,
             codex_app_auth_present: appAuthPresent,
-            model_provider: modelProvider,
-            codex_lb_provider_block_present: codexLbProviderBlockPresent,
-            codex_lb_env_key: codexLbEnvKey,
-            codex_lb_gateway_header_env_key: codexLbGatewayHeaderEnvKey,
-            codex_lb_requires_openai_auth: codexLbRequiresOpenAiAuth,
-            codex_lb_available: codexLbProviderValid && lbKey
+            desktop_bridge_status_available: bridgeStatusAvailable,
+            desktop_bridge_managed: bridgeManaged,
+            desktop_bridge_ready: bridgeReady,
+            desktop_bridge_provider: bridgeProvider,
+            desktop_bridge_native_identity_configured: nativeIdentityConfigured,
+            desktop_bridge_credential_state: credentialState
         }
     };
 }
@@ -96,6 +85,16 @@ export async function writeProviderContextReport(root = process.cwd(), input = {
     await writeJsonAtomic(reportPath, report);
     return { ...report, report_path: reportPath };
 }
+function selectedBridgeProvider(status) {
+    return status?.routing.selected_route?.provider_id
+        || status?.routing.policy?.default_provider_id
+        || status?.routing.session_pin?.provider_id
+        || null;
+}
+async function currentDesktopBridgeStatus(options) {
+    const controller = await import('../codex-lb/desktop-controller.js');
+    return controller.desktopBridgeStatusV3(options);
+}
 function normalizeServiceTier(value) {
     const text = String(value || '').toLowerCase();
     if (text === 'fast' || text === 'priority')
@@ -104,55 +103,6 @@ function normalizeServiceTier(value) {
         return 'standard';
     return 'unknown';
 }
-export function readTopLevelTomlString(text, key) {
-    const lines = String(text || '').split(/\r?\n/);
-    for (const line of lines) {
-        if (/^\s*\[/.test(line))
-            break;
-        const match = line.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*(?:#.*)?$`));
-        if (match?.[1] != null)
-            return match[1];
-    }
-    return null;
-}
-export function hasCodexLbProviderBlock(text) {
-    return codexLbProviderBody(text) != null;
-}
-export function codexLbProviderEnvKey(text) {
-    return codexLbProviderGatewayHeaderEnvKey(text) || codexLbProviderBearerEnvKey(text);
-}
-export function codexLbProviderGatewayHeaderEnvKey(text) {
-    const body = codexLbProviderBody(text);
-    if (body == null)
-        return null;
-    const inline = body.match(/(?:^|\n)\s*env_http_headers\s*=\s*\{([^}]*)\}/)?.[1] || '';
-    return inline.match(/"X-Codex-LB-API-Key"\s*=\s*"([^"]+)"/)?.[1] || null;
-}
-function codexLbProviderBearerEnvKey(text) {
-    const body = codexLbProviderBody(text);
-    return body == null ? null : readTopLevelTomlString(body, 'env_key');
-}
-export function codexLbProviderRequiresOpenAiAuth(text) {
-    const body = codexLbProviderBody(text);
-    if (body == null)
-        return null;
-    const match = body.match(/^\s*requires_openai_auth\s*=\s*(true|false)\s*(?:#.*)?$/m);
-    return match?.[1] === 'true' ? true : match?.[1] === 'false' ? false : null;
-}
-function codexLbProviderBody(text) {
-    const lines = String(text || '').split(/\r?\n/);
-    const out = [];
-    let inTable = false;
-    for (const line of lines) {
-        const table = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/)?.[1]?.trim();
-        if (table) {
-            if (inTable)
-                break;
-            inTable = table === 'model_providers.codex-lb' || table === 'model_providers."codex-lb"' || table === '"model_providers"."codex-lb"';
-            continue;
-        }
-        if (inTable)
-            out.push(line);
-    }
-    return inTable ? out.join('\n') : null;
+function unique(values) {
+    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
 }

package/dist/core/providers/openrouter/openrouter-account.js

@@ -96,7 +96,9 @@ export async function testOpenRouterConnection(input = {}) {
             warnings: []
         };
     }
-    const resolved = await resolveOpenRouterApiKey({ env: input.env || process.env });
+    const resolved = input.apiKey
+        ? { key: String(input.apiKey), source: 'explicit-validation-snapshot', warnings: [] }
+        : await resolveOpenRouterApiKey({ env: input.env || process.env });
     if (!resolved.key) {
         return {
             schema: 'sks.openrouter-test.v1',

package/dist/core/providers/openrouter/openrouter-secret-store.js

@@ -3,6 +3,8 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { redactOpenRouterKey } from '../../security/redact-secrets.js';
+import { readPrivateCredentialFile, writePrivateTextAtomic } from '../../security/private-credential-file.js';
+import { inspectConfinedPath, isLexicallyConfined, removeManagedPathVerified } from '../../managed-path-safety.js';
 export const OPENROUTER_KEY_ENV_NAMES = ['OPENROUTER_API_KEY', 'SKS_OPENROUTER_API_KEY'];
 export function openRouterSecretPaths(env = process.env) {
     const sksHome = path.resolve(env.SKS_HOME || path.join(env.HOME || os.homedir(), '.sneakoscope'));
@@ -49,7 +51,7 @@ export async function resolveOpenRouterApiKey(input = {}) {
 }
 export async function readStoredOpenRouterKey(paths) {
     try {
-        const text = await fs.readFile(paths.keyPath, 'utf8');
+        const text = (await readPrivateCredentialFile(paths.secretDir, paths.keyPath, 'openrouter_api_key')).bytes.toString('utf8');
         const key = text.trim();
         return key || null;
     }
@@ -66,24 +68,7 @@ export async function writeStoredOpenRouterKey(value, input = {}) {
     const timestamp = nowIso();
     const previous = input.previousRecord ?? await readOpenRouterKeyRecord(paths);
     await ensureSecretDir(paths.secretDir);
-    const tmp = `${paths.keyPath}.${process.pid}.${crypto.randomBytes(3).toString('hex')}.tmp`;
-    try {
-        const handle = await fs.open(tmp, 'w', 0o600);
-        try {
-            await handle.writeFile(`${key}\n`, 'utf8');
-            await handle.sync().catch(() => undefined);
-        }
-        finally {
-            await handle.close().catch(() => undefined);
-        }
-        await fs.chmod(tmp, 0o600).catch(() => undefined);
-        await fs.rename(tmp, paths.keyPath);
-        await fs.chmod(paths.keyPath, 0o600).catch(() => undefined);
-    }
-    catch (err) {
-        await fs.rm(tmp, { force: true }).catch(() => undefined);
-        throw err;
-    }
+    await writePrivateTextAtomic(paths.secretDir, paths.keyPath, `${key}\n`, 'openrouter_api_key');
     const record = {
         schema: 'sks.openrouter-key.v1',
         created_at: previous?.created_at || timestamp,
@@ -91,13 +76,13 @@ export async function writeStoredOpenRouterKey(value, input = {}) {
         key_hash: crypto.createHash('sha256').update(key).digest('hex'),
         key_preview: redactOpenRouterKey(key)
     };
-    await fs.writeFile(paths.metadataPath, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-    await fs.chmod(paths.metadataPath, 0o600).catch(() => undefined);
+    await writePrivateTextAtomic(paths.secretDir, paths.metadataPath, `${JSON.stringify(record, null, 2)}\n`, 'openrouter_api_key_metadata');
     return record;
 }
 export async function readOpenRouterKeyRecord(paths) {
     try {
-        const parsed = JSON.parse(await fs.readFile(paths.metadataPath, 'utf8'));
+        const text = (await readPrivateCredentialFile(paths.secretDir, paths.metadataPath, 'openrouter_api_key_metadata')).bytes.toString('utf8');
+        const parsed = JSON.parse(text);
         if (parsed.schema !== 'sks.openrouter-key.v1' || !parsed.key_hash || !parsed.key_preview)
             return null;
         return parsed;
@@ -106,6 +91,90 @@ export async function readOpenRouterKeyRecord(paths) {
         return null;
     }
 }
+export async function removeStoredOpenRouterKey(input) {
+    if (input.confirmed !== true) {
+        return {
+            schema: 'sks.openrouter-key-removal.v1',
+            removed: false,
+            removed_paths: [],
+            blockers: ['openrouter_credential_removal_confirmation_required']
+        };
+    }
+    const paths = input.paths || openRouterSecretPaths();
+    const secretDir = path.resolve(paths.secretDir);
+    const files = [path.resolve(paths.keyPath), path.resolve(paths.metadataPath)];
+    if (files.some((file) => file === secretDir || !isLexicallyConfined(secretDir, file))) {
+        return {
+            schema: 'sks.openrouter-key-removal.v1',
+            removed: false,
+            removed_paths: [],
+            blockers: ['openrouter_credential_path_outside_secret_store']
+        };
+    }
+    if (new Set(files).size !== files.length) {
+        return {
+            schema: 'sks.openrouter-key-removal.v1',
+            removed: false,
+            removed_paths: [],
+            blockers: ['openrouter_credential_path_collision']
+        };
+    }
+    const secretDirStat = await fs.lstat(secretDir).catch((error) => {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    });
+    if (!secretDirStat) {
+        return {
+            schema: 'sks.openrouter-key-removal.v1',
+            removed: false,
+            removed_paths: [],
+            blockers: []
+        };
+    }
+    if (!secretDirStat.isDirectory() || secretDirStat.isSymbolicLink()) {
+        return {
+            schema: 'sks.openrouter-key-removal.v1',
+            removed: false,
+            removed_paths: [],
+            blockers: ['openrouter_credential_secret_store_unsafe']
+        };
+    }
+    const existing = [];
+    for (const file of files) {
+        const inspected = await inspectConfinedPath(secretDir, file).catch(() => null);
+        if (!inspected) {
+            return {
+                schema: 'sks.openrouter-key-removal.v1',
+                removed: false,
+                removed_paths: [],
+                blockers: ['openrouter_credential_path_unsafe']
+            };
+        }
+        if (!inspected.exists)
+            continue;
+        if (inspected.leafSymlink || !inspected.stat?.isFile()) {
+            return {
+                schema: 'sks.openrouter-key-removal.v1',
+                removed: false,
+                removed_paths: [],
+                blockers: ['openrouter_credential_path_not_regular_file']
+            };
+        }
+        existing.push(file);
+    }
+    const removed = [];
+    for (const file of existing) {
+        await removeManagedPathVerified(secretDir, file);
+        removed.push(file);
+    }
+    return {
+        schema: 'sks.openrouter-key-removal.v1',
+        removed: removed.length > 0,
+        removed_paths: removed,
+        blockers: []
+    };
+}
 async function ensureSecretDir(secretDir) {
     await fs.mkdir(secretDir, { recursive: true, mode: 0o700 });
     await fs.chmod(secretDir, 0o700).catch(() => undefined);