sneakoscope 8.1.2 → 8.2.0

package/dist/scripts/{codex-lb-desktop-bridge-check.js → desktop-bridge-transport-check.js}

@@ -2,14 +2,21 @@
 import { createHash } from 'node:crypto';
 import fs from 'node:fs/promises';
 import http, {} from 'node:http';
-import net, {} from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
-import { DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, desktopBridgeStatePath, selectAvailableDesktopBridgePort, startDesktopBridge, stopDesktopBridge } from '../core/codex-lb/desktop-bridge/index.js';
+import { DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, desktopBridgeClientPath, desktopBridgeStatePath, selectAvailableDesktopBridgePort, startDesktopBridge, stopDesktopBridge } from '../core/codex-lb/desktop-bridge/index.js';
+import { closeServer, listen, request, websocketRoundTrip } from './desktop-bridge-transport-client.js';
 import { assertGate, emitGate } from './gate-lib.js';
-const gatewayKey = 'desktop-bridge-gateway-secret';
+const providerSecret = 'desktop-bridge-provider-secret';
+const publicModel = 'desktop-bridge-check-model';
+const catalogGeneration = 'desktop-bridge-check-catalog';
+const policyGeneration = 'desktop-bridge-check-policy';
+const credentialGeneration = 'desktop-bridge-check-credential';
+const credentialFingerprint = 'desktop-bridge-check-fingerprint';
 const desktopAuthorization = 'Bearer desktop-oauth-secret';
 const desktopCookie = 'desktop=session-secret';
+const clientCapability = Buffer.alloc(32, 0x48).toString('base64url');
+const clientCapabilitySha256 = createHash('sha256').update(clientCapability).digest('hex');
 const upstreamObservations = {};
 let sseRequestBody = Buffer.alloc(0);
 let multipartRequestBody = Buffer.alloc(0);
@@ -51,7 +58,7 @@ const upstream = http.createServer((request, response) => {
         });
         return;
     }
-    if (request.url === '/v1/responses') {
+    if (request.url === '/backend-api/codex/responses') {
         upstreamObservations.http = request.headers;
         request.resume();
         request.once('end', () => {
@@ -61,7 +68,7 @@ const upstream = http.createServer((request, response) => {
                 'set-cookie': 'remote=session-secret',
                 'x-codex-lb-api-key': 'response-secret'
             });
-            response.end('{"transport":"compat"}');
+            response.end('{"transport":"authorization-bearer"}');
         });
         return;
     }
@@ -101,11 +108,11 @@ upstream.on('upgrade', (request, socket, head) => {
     socket.on('data', consume);
 });
 const upstreamPort = await listen(upstream);
-const temporaryRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-desktop-bridge-gate-'));
+const temporaryRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-desktop-bridge-gate-'));
 const home = path.join(temporaryRoot, 'home');
 await fs.mkdir(path.join(home, '.codex'), { recursive: true });
 let preferredBridge = null;
-let compatBridge = null;
+let bearerBridge = null;
 let preferredPort = 0;
 let stateSecretSafe = false;
 let stateRemovedOnStop = false;
@@ -119,18 +126,19 @@ try {
     const statePath = desktopBridgeStatePath(home);
     preferredBridge = await startDesktopBridge(bridgeConfig(preferredPort, upstreamPort, 'x-codex-lb-api-key'), { statePath });
     const stateText = await fs.readFile(statePath, 'utf8');
-    stateSecretSafe = !stateText.includes(gatewayKey)
+    stateSecretSafe = !stateText.includes(providerSecret)
         && !stateText.includes(desktopAuthorization)
-        && !stateText.includes(desktopCookie);
+        && !stateText.includes(desktopCookie)
+        && !stateText.includes(clientCapability);
     sseResult = await request({
         port: preferredPort,
-        path: '/backend-api/codex/responses?stream=1',
+        path: desktopBridgeClientPath(clientCapability, '/backend-api/codex/responses?stream=1'),
         method: 'POST',
         headers: clientHeaders({
             'content-type': 'application/json',
             origin: 'app://codex'
         }),
-        chunks: [Buffer.from('{"stream":true}')],
+        chunks: [Buffer.from(JSON.stringify({ model: publicModel, stream: true }))],
         onData: () => {
             if (!sseEnded)
                 firstSseChunkBeforeEnd = true;
@@ -143,7 +151,7 @@ try {
     ]);
     multipartResult = await request({
         port: preferredPort,
-        path: '/backend-api/files',
+        path: desktopBridgeClientPath(clientCapability, '/backend-api/files'),
         method: 'POST',
         headers: clientHeaders({
             'content-type': 'multipart/form-data; boundary=boundary',
@@ -155,29 +163,37 @@ try {
             multipartPayload.subarray(77_777)
         ]
     });
-    webSocketResult = await websocketRoundTrip(preferredPort);
+    webSocketResult = await websocketRoundTrip({
+        port: preferredPort,
+        clientCapability,
+        publicModel,
+        desktopAuthorization,
+        desktopCookie,
+        maskedClientFrame,
+        expectedResponseFrameBytes: serverBinaryFrame.length + serverCloseFrame.length
+    });
     await stopDesktopBridge(preferredBridge);
     preferredBridge = null;
     stateRemovedOnStop = await fs.access(statePath).then(() => false, () => true);
-    const compatPort = await selectAvailableDesktopBridgePort('127.0.0.1');
-    compatBridge = await startDesktopBridge(bridgeConfig(compatPort, upstreamPort, 'authorization-bearer-compat'), { writeState: false });
+    const bearerPort = await selectAvailableDesktopBridgePort('127.0.0.1');
+    bearerBridge = await startDesktopBridge(bridgeConfig(bearerPort, upstreamPort, 'authorization-bearer'), { writeState: false });
     httpResult = await request({
-        port: compatPort,
-        path: '/v1/responses',
+        port: bearerPort,
+        path: desktopBridgeClientPath(clientCapability, '/backend-api/codex/responses'),
         method: 'POST',
         headers: clientHeaders({
             'content-type': 'application/json',
             origin: 'app://codex'
         }),
-        chunks: [Buffer.from('{"input":"hello"}')]
+        chunks: [Buffer.from(JSON.stringify({ model: publicModel, input: 'hello' }))]
     });
 }
 finally {
     if (preferredBridge)
         await stopDesktopBridge(preferredBridge).catch(() => undefined);
-    if (compatBridge)
-        await stopDesktopBridge(compatBridge).catch(() => undefined);
-    await close(upstream).catch(() => undefined);
+    if (bearerBridge)
+        await stopDesktopBridge(bearerBridge).catch(() => undefined);
+    await closeServer(upstream).catch(() => undefined);
     await fs.rm(temporaryRoot, { recursive: true, force: true });
 }
 const sseHeaders = upstreamObservations.sse || {};
@@ -187,8 +203,8 @@ const websocketHeaders = upstreamObservations.websocket || {};
 const sseVerified = sseResult?.status === 200
     && sseResult.body.toString('utf8') === 'data: first\n\ndata: second\n\n'
     && firstSseChunkBeforeEnd
-    && sseRequestBody.toString('utf8') === '{"stream":true}'
-    && sseResult.headers.location === `ws://127.0.0.1:${preferredPort}/backend-api/codex/call-1?token=opaque`;
+    && sseRequestBody.toString('utf8') === JSON.stringify({ model: publicModel, stream: true })
+    && sseResult.headers.location === `ws://127.0.0.1:${preferredPort}${desktopBridgeClientPath(clientCapability, '/backend-api/codex/call-1?token=opaque')}`;
 const multipartVerified = multipartResult?.status === 200
     && multipartResult.body.toString('utf8') === '{"ok":true}'
     && createHash('sha256').update(multipartRequestBody).digest('hex') === multipartResult.requestBodySha256;
@@ -198,18 +214,18 @@ const webSocketVerified = Boolean(webSocketResult
     && !/Set-Cookie|X-Codex-LB-Api-Key/i.test(webSocketResult.responseHead)
     && webSocketResult.frames.equals(Buffer.concat([serverBinaryFrame, serverCloseFrame]))
     && receivedClientFrame.subarray(0, maskedClientFrame.length).equals(maskedClientFrame));
-const preferredAuthVerified = sseHeaders['x-codex-lb-api-key'] === gatewayKey
+const preferredAuthVerified = sseHeaders['x-codex-lb-api-key'] === providerSecret
     && sseHeaders.authorization === undefined
     && sseHeaders.cookie === undefined
-    && multipartHeaders['x-codex-lb-api-key'] === gatewayKey
+    && multipartHeaders['x-codex-lb-api-key'] === providerSecret
     && multipartHeaders.authorization === undefined
     && multipartHeaders.cookie === undefined
-    && websocketHeaders['x-codex-lb-api-key'] === gatewayKey
+    && websocketHeaders['x-codex-lb-api-key'] === providerSecret
     && websocketHeaders.authorization === undefined
     && websocketHeaders.cookie === undefined;
-const compatAuthVerified = httpResult?.status === 200
-    && httpResult.body.toString('utf8') === '{"transport":"compat"}'
-    && httpHeaders.authorization === `Bearer ${gatewayKey}`
+const bearerAuthVerified = httpResult?.status === 200
+    && httpResult.body.toString('utf8') === '{"transport":"authorization-bearer"}'
+    && httpHeaders.authorization === `Bearer ${providerSecret}`
     && httpHeaders['x-codex-lb-api-key'] === undefined
     && httpHeaders.cookie === undefined;
 const responseHeadersRedacted = [sseResult, multipartResult, httpResult].every((result) => (result !== null
@@ -217,21 +233,21 @@ const responseHeadersRedacted = [sseResult, multipartResult, httpResult].every((
     && result.headers['set-cookie'] === undefined
     && result.headers['x-codex-lb-api-key'] === undefined));
 const report = {
-    schema: 'sks.codex-lb-desktop-bridge-check.v1',
+    schema: 'sks.desktop-bridge-transport-check.v1',
     ok: sseVerified
         && multipartVerified
         && webSocketVerified
         && preferredAuthVerified
-        && compatAuthVerified
+        && bearerAuthVerified
         && responseHeadersRedacted
         && stateSecretSafe
         && stateRemovedOnStop,
-    http: compatAuthVerified,
+    http: bearerAuthVerified,
     sse: sseVerified,
     multipart: multipartVerified,
     websocket: webSocketVerified,
-    preferred_gateway_auth_transport: preferredAuthVerified,
-    explicit_legacy_gateway_auth_transport: compatAuthVerified,
+    x_codex_lb_api_key_transport: preferredAuthVerified,
+    authorization_bearer_transport: bearerAuthVerified,
     response_headers_redacted: responseHeadersRedacted,
     public_state_secret_safe: stateSecretSafe,
     public_state_removed_on_stop: stateRemovedOnStop,
@@ -240,32 +256,64 @@ const report = {
         ...(multipartVerified ? [] : ['desktop_bridge_multipart_round_trip_failed']),
         ...(webSocketVerified ? [] : ['desktop_bridge_websocket_round_trip_failed']),
         ...(preferredAuthVerified ? [] : ['desktop_bridge_preferred_auth_transport_failed']),
-        ...(compatAuthVerified ? [] : ['desktop_bridge_compat_auth_transport_failed']),
+        ...(bearerAuthVerified ? [] : ['desktop_bridge_authorization_bearer_transport_failed']),
         ...(responseHeadersRedacted ? [] : ['desktop_bridge_response_secret_header_leaked']),
         ...(stateSecretSafe ? [] : ['desktop_bridge_public_state_contains_secret']),
         ...(stateRemovedOnStop ? [] : ['desktop_bridge_state_not_removed_on_stop'])
     ]
 };
-assertGate(report.ok, 'codex-lb Desktop bridge gate failed', report);
-emitGate('codex-lb:desktop-bridge', {
+assertGate(report.ok, 'Desktop Bridge transport gate failed', report);
+emitGate('desktop-bridge:transport', {
     http: report.http,
     sse: report.sse,
     multipart: report.multipart,
     websocket: report.websocket,
-    gateway_auth_transports: [
+    provider_auth_transports: [
         'x-codex-lb-api-key',
-        'authorization-bearer-compat'
+        'authorization-bearer'
     ],
     response_headers_redacted: report.response_headers_redacted,
     public_state_secret_safe: report.public_state_secret_safe
 });
-function bridgeConfig(listenPort, remotePort, gatewayAuthTransport) {
+function bridgeConfig(listenPort, remotePort, authTransport) {
+    const baseUrl = `http://127.0.0.1:${remotePort}/backend-api/codex`;
     return {
         listenHost: '127.0.0.1',
         listenPort,
-        remoteBaseUrl: `http://127.0.0.1:${remotePort}/backend-api/codex`,
-        gatewayKey,
-        gatewayAuthTransport,
+        providerRegistry: {
+            schema: 'sks.desktop-bridge-provider-registry.v1',
+            generation: 'desktop-bridge-check-registry',
+            created_at: '2026-08-05T00:00:00.000Z',
+            providers: {
+                'codex-lb': {
+                    provider_id: 'codex-lb', enabled: true, base_url: baseUrl,
+                    allowed_origins: [new URL(baseUrl).origin], auth_transport: authTransport,
+                    credential_state: 'ready', credential_fingerprint: credentialFingerprint,
+                    credential_generation: credentialGeneration, source_catalog_generation: catalogGeneration
+                },
+                openrouter: {
+                    provider_id: 'openrouter', enabled: false, base_url: 'https://openrouter.ai/api/v1',
+                    allowed_origins: ['https://openrouter.ai'], auth_transport: 'openrouter-bearer',
+                    credential_state: 'not_configured', credential_fingerprint: null,
+                    credential_generation: 'desktop-bridge-check-openrouter-credential', source_catalog_generation: null
+                }
+            }
+        },
+        routePolicy: {
+            schema: 'sks.bridge-routing-policy.v1', default_provider_id: 'codex-lb', fallback: 'none',
+            model_routes: { [publicModel]: { provider_id: 'codex-lb', upstream_model: publicModel } },
+            catalog_generation: catalogGeneration, policy_generation: policyGeneration,
+            changed_at: '2026-08-05T00:00:00.000Z'
+        },
+        providerSessionPins: [],
+        resolveProviderCredential: async (providerId, expectedGeneration) => ({
+            provider_id: providerId,
+            value: providerId === 'codex-lb' ? providerSecret : 'unused-openrouter-secret',
+            source: 'release-check',
+            fingerprint: providerId === 'codex-lb' ? credentialFingerprint : 'unused-openrouter-fingerprint',
+            generation: expectedGeneration
+        }),
+        clientCapabilitySha256,
         allowedPathPrefixes: DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES,
         allowedOrigins: ['app://codex'],
         connectTimeoutMs: 2_000,
@@ -277,118 +325,7 @@ function clientHeaders(additional = {}) {
         authorization: desktopAuthorization,
         cookie: desktopCookie,
         'x-codex-lb-api-key': 'client-forged-key',
+        'x-sks-model': publicModel,
         ...additional
     };
 }
-async function listen(server) {
-    await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', resolve);
-    });
-    return server.address().port;
-}
-async function close(server) {
-    if (!server.listening)
-        return;
-    await new Promise((resolve, reject) => {
-        server.close((error) => error ? reject(error) : resolve());
-    });
-}
-async function request(input) {
-    const requestBody = Buffer.concat([...(input.chunks || [])]);
-    return new Promise((resolve, reject) => {
-        const client = http.request({
-            host: '127.0.0.1',
-            port: input.port,
-            path: input.path,
-            method: input.method || 'GET',
-            headers: input.headers
-        }, (response) => {
-            const chunks = [];
-            response.on('data', (chunk) => {
-                chunks.push(chunk);
-                input.onData?.(chunk);
-            });
-            response.once('end', () => resolve({
-                status: response.statusCode || 0,
-                headers: response.headers,
-                body: Buffer.concat(chunks),
-                requestBodySha256: createHash('sha256').update(requestBody).digest('hex')
-            }));
-        });
-        client.once('error', reject);
-        for (const chunk of input.chunks || [])
-            client.write(chunk);
-        client.end();
-    });
-}
-async function websocketRoundTrip(port) {
-    const holder = { socket: null };
-    try {
-        return await new Promise((resolve, reject) => {
-            const client = net.connect({ host: '127.0.0.1', port });
-            holder.socket = client;
-            const chunks = [];
-            let sentFrame = false;
-            let settled = false;
-            const timer = setTimeout(() => {
-                if (settled)
-                    return;
-                settled = true;
-                reject(new Error('desktop_bridge_websocket_timeout'));
-                client?.destroy();
-            }, 5_000);
-            timer.unref();
-            client.once('connect', () => {
-                client?.write('GET /backend-api/codex/realtime/call-1?token=opaque HTTP/1.1\r\n'
-                    + `Host: 127.0.0.1:${port}\r\n`
-                    + 'Connection: Upgrade\r\n'
-                    + 'Upgrade: websocket\r\n'
-                    + 'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n'
-                    + 'Sec-WebSocket-Version: 13\r\n'
-                    + 'Sec-WebSocket-Protocol: codex.realtime.v1\r\n'
-                    + 'Origin: app://codex\r\n'
-                    + `Authorization: ${desktopAuthorization}\r\n`
-                    + `Cookie: ${desktopCookie}\r\n`
-                    + 'X-Codex-LB-Api-Key: client-forged-key\r\n'
-                    + '\r\n');
-            });
-            client.on('data', (chunk) => {
-                chunks.push(chunk);
-                const all = Buffer.concat(chunks);
-                const boundary = all.indexOf('\r\n\r\n');
-                if (boundary >= 0 && !sentFrame) {
-                    sentFrame = true;
-                    client?.write(maskedClientFrame);
-                }
-                const expectedLength = boundary + 4 + serverBinaryFrame.length + serverCloseFrame.length;
-                if (boundary < 0 || all.length < expectedLength || settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                resolve({
-                    responseHead: all.subarray(0, boundary).toString('latin1'),
-                    frames: all.subarray(boundary + 4)
-                });
-                client?.destroy();
-            });
-            client.once('error', (error) => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                reject(error);
-            });
-            client.once('close', () => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                reject(new Error('desktop_bridge_websocket_closed_before_complete'));
-            });
-        });
-    }
-    finally {
-        holder.socket?.destroy();
-    }
-}

package/dist/scripts/desktop-bridge-transport-client.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+import http, {} from 'node:http';
+import net, {} from 'node:net';
+export async function listen(server) {
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    return server.address().port;
+}
+export async function closeServer(server) {
+    if (!server.listening)
+        return;
+    await new Promise((resolve, reject) => {
+        server.close((error) => error ? reject(error) : resolve());
+    });
+}
+export async function request(input) {
+    const requestBody = Buffer.concat([...(input.chunks || [])]);
+    return new Promise((resolve, reject) => {
+        const client = http.request({
+            host: '127.0.0.1',
+            port: input.port,
+            path: input.path,
+            method: input.method || 'GET',
+            headers: input.headers
+        }, (response) => {
+            const chunks = [];
+            response.on('data', (chunk) => {
+                chunks.push(chunk);
+                input.onData?.(chunk);
+            });
+            response.once('end', () => resolve({
+                status: response.statusCode || 0,
+                headers: response.headers,
+                body: Buffer.concat(chunks),
+                requestBodySha256: createHash('sha256').update(requestBody).digest('hex')
+            }));
+        });
+        client.once('error', reject);
+        for (const chunk of input.chunks || [])
+            client.write(chunk);
+        client.end();
+    });
+}
+export async function websocketRoundTrip(input) {
+    const holder = { socket: null };
+    try {
+        return await new Promise((resolve, reject) => {
+            const client = net.connect({ host: '127.0.0.1', port: input.port });
+            holder.socket = client;
+            const chunks = [];
+            let sentFrame = false;
+            let settled = false;
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(new Error('desktop_bridge_websocket_timeout'));
+                client.destroy();
+            }, 5_000);
+            timer.unref();
+            client.once('connect', () => {
+                client.write(`GET /__sks/client/${input.clientCapability}/backend-api/codex/realtime/call-1?token=opaque HTTP/1.1\r\n`
+                    + `Host: 127.0.0.1:${input.port}\r\n`
+                    + 'Connection: Upgrade\r\n'
+                    + 'Upgrade: websocket\r\n'
+                    + 'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n'
+                    + 'Sec-WebSocket-Version: 13\r\n'
+                    + 'Sec-WebSocket-Protocol: codex.realtime.v1\r\n'
+                    + 'Origin: app://codex\r\n'
+                    + `X-SKS-Model: ${input.publicModel}\r\n`
+                    + `Authorization: ${input.desktopAuthorization}\r\n`
+                    + `Cookie: ${input.desktopCookie}\r\n`
+                    + 'X-Codex-LB-Api-Key: client-forged-key\r\n'
+                    + '\r\n');
+            });
+            client.on('data', (chunk) => {
+                chunks.push(chunk);
+                const all = Buffer.concat(chunks);
+                const boundary = all.indexOf('\r\n\r\n');
+                if (boundary >= 0 && !sentFrame) {
+                    sentFrame = true;
+                    client.write(input.maskedClientFrame);
+                }
+                const expectedLength = boundary + 4 + input.expectedResponseFrameBytes;
+                if (boundary < 0 || all.length < expectedLength || settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve({
+                    responseHead: all.subarray(0, boundary).toString('latin1'),
+                    frames: all.subarray(boundary + 4)
+                });
+                client.destroy();
+            });
+            client.once('error', (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                reject(error);
+            });
+            client.once('close', () => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                reject(new Error('desktop_bridge_websocket_closed_before_complete'));
+            });
+        });
+    }
+    finally {
+        holder.socket?.destroy();
+    }
+}