sneakoscope 8.1.2 → 8.2.0

package/dist/commands/codex-app.js

@@ -2,7 +2,7 @@ import { flag, readOption } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
 import { codexAccessTokenStatus, codexAppIntegrationStatus, codexChromeExtensionStatus, codexProductDesignPluginStatus, formatCodexAppStatus, formatCodexProductDesignPluginStatus } from '../core/codex-app.js';
 import { codexAppRemoteControlCommand } from '../cli/codex-app-command.js';
-import { readStdin, sksRoot } from '../core/fsx.js';
+import { sksRoot } from '../core/fsx.js';
 import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
 import { syncCodexSksSkills } from '../core/codex-app/codex-skill-sync.js';
 import { syncCodexAgentRoles } from '../core/codex-app/codex-agent-role-sync.js';
@@ -10,14 +10,8 @@ import { runCodexInitDeep } from '../core/codex-app/codex-init-deep.js';
 import { buildCodexHookLifecycle } from '../core/codex-app/codex-hook-lifecycle.js';
 import { resolveCodexAppExecutionProfile } from '../core/codex-app/codex-app-execution-profile.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
-import { doctorCodexAppGlmProfile, installCodexAppGlmProfile } from '../core/codex-app/glm-profile-installer.js';
-import { openRouterStatus, restoreDesktopRoutingSnapshot, useOpenRouter } from '../core/codex-app/openrouter-activate.js';
-import { promptForOpenRouterKeyHidden, writeStoredOpenRouterKey } from '../core/providers/openrouter/openrouter-secret-store.js';
-import { compactOpenRouterModelsResult, listOpenRouterModels, testOpenRouterConnection } from '../core/providers/openrouter/openrouter-account.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
-import { MULTI_PROVIDER_ROUTER_DEFAULT_BASE_URL, multiProviderRouterStatus, testMultiProviderRouter, useMultiProviderRouter } from '../core/codex-app/multi-provider-router.js';
 import { resetRoleModelPreference, roleModelPreferencesStatus, setRoleModelPreference } from '../core/subagents/role-model-preferences.js';
-import { codexLbDesktopStatusV2 } from '../core/codex-lb/desktop-controller.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
     if (action === 'restart')
@@ -38,96 +32,6 @@ export async function run(_command, args = []) {
         return printCodexAppResult(args, await buildCodexHookLifecycle({ root: await sksRoot(), apply: flag(args, '--apply') || flag(args, '--fix') }));
     if (action === 'execution-profile')
         return printCodexAppResult(args, await resolveCodexAppExecutionProfile({ root: await sksRoot() }));
-    if (action === 'glm-profile') {
-        const subcommand = args[1] || 'doctor';
-        const root = await sksRoot();
-        const result = subcommand === 'install' || subcommand === 'repair' || subcommand === 'remove'
-            ? await installCodexAppGlmProfile({ root, apply: true })
-            : await doctorCodexAppGlmProfile({ root });
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'set-openrouter-key' || action === 'openrouter-key') {
-        const root = await sksRoot();
-        const key = await readOpenRouterKeyFromArgs(args.slice(1));
-        if (!key) {
-            const result = { schema: 'sks.codex-app-openrouter-key.v1', ok: false, status: 'missing_key', blockers: ['openrouter_key_missing'], warnings: [] };
-            return printCodexAppResult(args, result);
-        }
-        const record = await writeStoredOpenRouterKey(key);
-        const profile = await installCodexAppGlmProfile({ root, apply: true });
-        const restart = await restartCodexApp({ enabled: flag(args, '--restart-app') || flag(args, '--restart') });
-        const result = {
-            schema: 'sks.codex-app-openrouter-key.v1',
-            ok: Boolean(profile.ok && restart.ok),
-            status: !profile.ok ? 'stored_profile_blocked' : restart.ok ? 'stored' : 'stored_restart_blocked',
-            key_preview: record.key_preview,
-            raw_key_recorded: false,
-            secret_store: 'sks-openrouter-secret-store',
-            selected: false,
-            glm_profile: profile,
-            restart_app: restart,
-            blockers: [...(profile.blockers || []), ...(restart.blockers || [])],
-            warnings: profile.warnings || []
-        };
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'use-openrouter' || action === 'use-or') {
-        const root = await sksRoot();
-        const model = readOption(args, '--model', '');
-        const result = await useOpenRouter({
-            root,
-            model,
-            restartApp: flag(args, '--restart-app') || flag(args, '--restart') || !flag(args, '--no-restart-app'),
-            preserveThreadSidebar: !flag(args, '--no-preserve-thread-sidebar')
-        });
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'restore-desktop-routing' || action === 'restore-previous-provider') {
-        const result = await restoreDesktopRoutingSnapshot({
-            restartApp: flag(args, '--restart-app') || flag(args, '--restart') || !flag(args, '--no-restart-app'),
-            restartImpl: restartCodexApp
-        });
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'openrouter-status') {
-        const result = await openRouterStatus({});
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'openrouter-models') {
-        const models = await listOpenRouterModels({});
-        const result = flag(args, '--ids-only') ? compactOpenRouterModelsResult(models) : models;
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'openrouter-test') {
-        const result = await testOpenRouterConnection({ model: readOption(args, '--model', '') });
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'router-status' || action === 'multi-provider-status' || action === 'opencodex-status') {
-        const result = await multiProviderRouterStatus({
-            baseUrl: readOption(args, '--base-url', ''),
-            catalogPath: readOption(args, '--catalog', '')
-        });
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'router-test' || action === 'multi-provider-test' || action === 'opencodex-test') {
-        const result = await testMultiProviderRouter({
-            baseUrl: readOption(args, '--base-url', MULTI_PROVIDER_ROUTER_DEFAULT_BASE_URL),
-            catalogPath: readOption(args, '--catalog', ''),
-            model: readOption(args, '--model', '')
-        });
-        return printCodexAppResult(args, result);
-    }
-    if (action === 'use-router' || action === 'use-multi-provider' || action === 'use-opencodex') {
-        const result = await useMultiProviderRouter({
-            model: readOption(args, '--model', ''),
-            baseUrl: readOption(args, '--base-url', MULTI_PROVIDER_ROUTER_DEFAULT_BASE_URL),
-            catalogPath: readOption(args, '--catalog', ''),
-            replaceCatalog: flag(args, '--replace-catalog'),
-            forceRoutingOverride: flag(args, '--force-routing-override'),
-            restartApp: flag(args, '--restart-app') || flag(args, '--restart') || !flag(args, '--no-restart-app')
-        });
-        return printCodexAppResult(args, result);
-    }
     if (action === 'role-models') {
         return printCodexAppResult(args, await roleModelPreferencesStatus());
     }
@@ -190,7 +94,7 @@ export async function run(_command, args = []) {
         return;
     }
     if (action === 'check' || action === 'status') {
-        const status = await codexAppStatusWithCodexLbCapabilities({
+        const status = await codexAppStatusWithDesktopBridgeCapabilities({
             autoInstallProductDesign: flag(args, '--install-product-design') || flag(args, '--auto-install-product-design')
         });
         if (flag(args, '--json')) {
@@ -204,38 +108,58 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|set-openrouter-key [--api-key-stdin]|use-openrouter --model <id>|restore-desktop-routing|openrouter-status|openrouter-models [--ids-only]|openrouter-test [--model <id>]|router-status [--base-url <loopback-url>] [--catalog <path>]|router-test --model <provider/model> [--base-url <loopback-url>] [--catalog <path>]|use-router --model <provider/model> [--base-url <loopback-url>] [--catalog <path>] [--replace-catalog] [--force-routing-override]|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
-    console.error('Note: glm-profile is retired (strips leftover Desktop GLM profiles); use set-openrouter-key / use-openrouter.');
+    console.error('Usage: sks codex-app check|status|restart|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Provider routing moved to: sks bridge provider configure|validate|enable; sks bridge catalog sync; sks bridge route set-default.');
     process.exitCode = 1;
 }
-export async function codexAppStatusWithCodexLbCapabilities(opts = {}) {
-    const { codexAppStatusImpl = codexAppIntegrationStatus, codexLbStatusImpl = codexLbDesktopStatusV2, codexLbStatusOptions, ...integrationOptions } = opts;
-    let codexLbCapabilityReport;
+export async function codexAppStatusWithDesktopBridgeCapabilities(opts = {}) {
+    const { codexAppStatusImpl = codexAppIntegrationStatus, desktopBridgeStatusImpl = currentDesktopBridgeStatus, desktopBridgeStatusOptions, ...integrationOptions } = opts;
+    let desktopBridgeStatus = null;
+    let desktopBridgeCapabilityReport;
     try {
-        const status = await codexLbStatusImpl(codexLbStatusOptions || {});
+        const status = await desktopBridgeStatusImpl(desktopBridgeStatusOptions || {});
+        desktopBridgeStatus = status;
+        const statusRecord = status;
         const capabilities = status?.capabilities;
-        codexLbCapabilityReport = capabilities && typeof capabilities === 'object' && !Array.isArray(capabilities)
+        const report = capabilities && typeof capabilities === 'object' && !Array.isArray(capabilities)
+            ? capabilities
+            : null;
+        const summary = report?.summary && typeof report.summary === 'object' && !Array.isArray(report.summary)
+            ? report.summary
+            : null;
+        desktopBridgeCapabilityReport = report
             ? {
-                ...capabilities,
+                ...report,
                 availability: 'reported',
-                mode: status.mode || null,
-                overall: status.overall || capabilities.state || 'available_unverified',
-                full_capability_verified: status.full_capability_verified === true,
-                deep_evidence_validation: status.deep_evidence_validation || null
+                runtime: status.management && typeof status.management === 'object'
+                    ? status.management.runtime || null
+                    : null,
+                overall: summary
+                    ? summary.level_satisfied === true ? 'verified' : 'available_unverified'
+                    : statusRecord.overall || report.state || 'available_unverified',
+                full_capability_verified: summary
+                    ? summary.full_feature_verified === true
+                    : statusRecord.full_capability_verified === true,
+                deep_evidence_validation: statusRecord.deep_evidence_validation || null
             }
-            : unavailableCodexLbCapabilityReport('codex_lb_capability_report_missing');
+            : unavailableDesktopBridgeCapabilityReport('desktop_bridge_capability_report_missing');
     }
     catch {
-        codexLbCapabilityReport = unavailableCodexLbCapabilityReport('codex_lb_capability_report_unavailable');
+        desktopBridgeCapabilityReport = unavailableDesktopBridgeCapabilityReport('desktop_bridge_capability_report_unavailable');
     }
     return codexAppStatusImpl({
         ...integrationOptions,
-        codexLbCapabilityReport
+        desktopBridgeStatus,
+        desktopBridgeCapabilityReport
     });
 }
-function unavailableCodexLbCapabilityReport(blocker) {
+async function currentDesktopBridgeStatus(options) {
+    const controller = await import('../core/codex-lb/desktop-controller.js');
+    return controller.desktopBridgeStatusV3(options);
+}
+function unavailableDesktopBridgeCapabilityReport(blocker) {
     return {
-        schema: 'sks.codex-lb-desktop-capability-status.v2',
+        schema: 'sks.desktop-bridge-capability-status.v3',
         availability: 'unavailable',
         ready: false,
         state: 'available_unverified',
@@ -243,14 +167,6 @@ function unavailableCodexLbCapabilityReport(blocker) {
         blockers: [blocker]
     };
 }
-async function readOpenRouterKeyFromArgs(args = []) {
-    const key = readOption(args, '--api-key', readOption(args, '--key', ''));
-    if (key)
-        return String(key).trim();
-    if (flag(args, '--api-key-stdin') || flag(args, '--key-stdin'))
-        return String(await readStdin()).trim();
-    return await promptForOpenRouterKeyHidden() || '';
-}
 function printCodexAppResult(args = [], result) {
     if (flag(args, '--json')) {
         printJson(result);

package/dist/commands/doctor-helpers.js

@@ -0,0 +1,380 @@
+import { flag } from '../cli/args.js';
+import { projectRoot, exists, nowIso } from '../core/fsx.js';
+import { normalizeInstallScope } from '../core/init.js';
+import { appendMigrationEvents, hashConfigText } from '../core/migration/migration-transaction-journal.js';
+import { inspectSksMenuBarStatus, sksMenuBarPaths, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
+import { restartLaunchAgent } from '../core/codex-app/menubar/launch-agent.js';
+export function buildRuntimeReadiness(matrix) {
+    const defaults = matrix?.invocation_defaults || {};
+    const hookPolicy = defaults.hook_evidence_policy || 'unknown-do-not-count';
+    const agentStrategy = defaults.loop_worker_role_strategy || 'message-role';
+    const multiAgentMode = defaults.multi_agent_mode || 'none';
+    const rolloutBudget = defaults.rollout_budget_strategy || 'sks-local-only';
+    const researchSource = defaults.research_source_strategy || 'local-files';
+    const codexNative = matrix?.ok === true ? 'ok' : matrix?.codex_cli?.available ? 'degraded' : 'blocked';
+    const repairActions = [];
+    if (codexNative !== 'ok') {
+        repairActions.push([
+            'Codex Native managed assets: sks doctor',
+            '--fix',
+            '--repair-codex-native',
+            '--yes'
+        ].join(' '));
+    }
+    if (matrix?.features?.project_memory?.ok !== true)
+        repairActions.push('Project memory: sks codex-native init-deep --apply --directory-local');
+    return {
+        schema: 'sks.runtime-readiness-story.v1',
+        codex_native: codexNative,
+        loop_mesh: agentStrategy === 'agent_type' ? 'ok' : 'fallback',
+        qa_visual: defaults.qa_visual_review_strategy || 'blocked',
+        research_sources: researchSource,
+        image_followup: defaults.image_followup_strategy || 'blocked',
+        hook_evidence_policy: hookPolicy,
+        agent_role_strategy: agentStrategy,
+        multi_agent_mode: multiAgentMode,
+        rollout_budget_strategy: rolloutBudget,
+        current_time_source: defaults.current_time_source || 'external-clock',
+        overload_retry_policy: defaults.overload_retry_policy || 'generic',
+        notes: [
+            ...(hookPolicy !== 'approved-only' ? ['hook-derived evidence will not count'] : []),
+            ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : []),
+            ...(multiAgentMode === 'proactive' ? ['Proactive multi-agent mode is available for Naruto-style routes'] : []),
+            ...(rolloutBudget === 'codex-current-shared' ? ['Shared rollout budgeting is available for route proof'] : []),
+            ...(researchSource === 'indexed-web-search' ? ['Indexed web search is selected for source-intelligence routes'] : [])
+        ],
+        repair_actions: [...new Set(repairActions)]
+    };
+}
+export function deferredNativeRepair(schema, doctorFix, nextActions) {
+    return {
+        schema,
+        generated_at: nowIso(),
+        ok: true,
+        skipped: true,
+        status: 'deferred_to_explicit_native_capability_probe',
+        attempted: false,
+        apply: doctorFix,
+        recovered: false,
+        blockers: [],
+        next_actions: nextActions,
+        manual_actions: nextActions
+    };
+}
+export function fallbackCodexNativeFeatureMatrix(codex, blockers = [], warnings = []) {
+    return {
+        schema: 'sks.codex-native-feature-matrix.v1',
+        ok: blockers.length === 0,
+        skipped: blockers.length === 0,
+        codex_cli: { available: Boolean(codex?.bin || codex?.available), version: codex?.version || null, bin: codex?.bin || null },
+        features: {},
+        invocation_defaults: {
+            loop_worker_role_strategy: 'message-role',
+            multi_agent_mode: 'none',
+            rollout_budget_strategy: 'sks-local-only',
+            qa_visual_review_strategy: 'route-gated',
+            research_source_strategy: 'local-files',
+            image_followup_strategy: 'artifact-path',
+            hook_evidence_policy: 'unknown-do-not-count',
+            skill_bridge_strategy: 'cli-only',
+            current_time_source: 'external-clock',
+            overload_retry_policy: 'generic'
+        },
+        blockers,
+        warnings
+    };
+}
+export async function writeJsonReportFile(file, value) {
+    const fsp = await import('node:fs/promises');
+    const path = await import('node:path');
+    await fsp.mkdir(path.dirname(file), { recursive: true });
+    await fsp.writeFile(file, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+}
+export function nativeCapabilityStatus(rows, id, fallback) {
+    const row = rows.find((entry) => entry?.id === id);
+    if (!row)
+        return fallback;
+    if (row.after === 'verified' || row.before === 'verified')
+        return 'verified';
+    if (id === 'image_path_exposure') {
+        if (row.before === 'degraded' || row.after === 'degraded' || row.repairability === 'doctor-fix')
+            return 'fallback';
+        return fallback;
+    }
+    if (id === 'app_handoff')
+        return 'unavailable';
+    if (row.repairability === 'manual-required')
+        return 'manual_required';
+    if (row.before === 'degraded' || row.after === 'degraded')
+        return 'degraded';
+    if (row.repairability === 'doctor-fix')
+        return row.after === 'blocked' ? 'blocked' : 'repair_required';
+    if (row.repairability === 'unavailable')
+        return 'unavailable';
+    return fallback;
+}
+export function uniqueNativeManualActions(rows) {
+    return [...new Set(rows
+            .filter((row) => row?.repairability === 'manual-required' && row?.after !== 'verified')
+            .flatMap((row) => Array.isArray(row.repair_actions) ? row.repair_actions : [])
+            .filter((action) => typeof action === 'string' && action.trim()))];
+}
+export function doctorSkillStatus(coreSkills) {
+    if (!coreSkills)
+        return 'drift_detected';
+    if (Array.isArray(coreSkills.restored) && coreSkills.restored.length)
+        return 'repaired';
+    if (Array.isArray(coreSkills.blockers) && coreSkills.blockers.length)
+        return 'drift_detected';
+    return 'current';
+}
+export function doctorDedupeStatus(skillDedupe) {
+    if (!skillDedupe)
+        return 'manual_required';
+    if (Array.isArray(skillDedupe.actions) && skillDedupe.actions.some((action) => action.action === 'quarantined'))
+        return 'repaired';
+    if (Array.isArray(skillDedupe.blockers) && skillDedupe.blockers.length)
+        return 'manual_required';
+    return 'none';
+}
+async function codexHomeConfigPath() {
+    const path = await import('node:path');
+    const os = await import('node:os');
+    const home = process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
+    return path.join(home, 'config.toml');
+}
+export async function captureCodexConfigSnapshot() {
+    const fsp = await import('node:fs/promises');
+    const path = await import('node:path');
+    const read = async (p) => {
+        if (!p)
+            return null;
+        try {
+            return await fsp.readFile(p, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    };
+    const root = await projectRoot();
+    const projectPath = root ? path.join(root, '.codex', 'config.toml') : null;
+    const homePath = await codexHomeConfigPath();
+    return {
+        project_path: projectPath,
+        project_text: await read(projectPath),
+        home_path: homePath,
+        home_text: await read(homePath)
+    };
+}
+export async function writeFixMigrationJournal(root, preFix, configRepair, setupRepair) {
+    if (!preFix)
+        return null;
+    const fsp = await import('node:fs/promises');
+    const read = async (p) => {
+        if (!p)
+            return null;
+        try {
+            return await fsp.readFile(p, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    };
+    const projectAfter = await read(preFix.project_path);
+    const homeAfter = await read(preFix.home_path);
+    const structureRepairs = Array.isArray(configRepair?.structure_repairs) ? configRepair.structure_repairs : [];
+    const projectStructure = structureRepairs.find((repair) => repair.scope === 'project');
+    const homeStructure = structureRepairs.find((repair) => repair.scope === 'codex_home');
+    const events = [
+        {
+            step: 'doctor_fix_project_config',
+            target: preFix.project_path || '.codex/config.toml',
+            beforeHash: preFix.project_text != null ? hashConfigText(preFix.project_text) : null,
+            afterHash: projectAfter != null ? hashConfigText(projectAfter) : null,
+            backupPath: setupRepair?.config_backup_path || projectStructure?.backup_path || configRepair?.policy?.backup_path || null
+        },
+        {
+            step: 'doctor_fix_codex_home_config',
+            target: preFix.home_path || '~/.codex/config.toml',
+            beforeHash: preFix.home_text != null ? hashConfigText(preFix.home_text) : null,
+            afterHash: homeAfter != null ? hashConfigText(homeAfter) : null,
+            backupPath: homeStructure?.backup_path || null
+        }
+    ].filter((event) => event.beforeHash != null || event.afterHash != null);
+    if (!events.length)
+        return null;
+    return appendMigrationEvents(root, events);
+}
+async function backupProjectConfigBeforeFix() {
+    try {
+        const fsp = await import('node:fs/promises');
+        const path = await import('node:path');
+        const root = await projectRoot();
+        if (!root)
+            return null;
+        const configPath = path.join(root, '.codex', 'config.toml');
+        if (!(await exists(configPath)))
+            return null;
+        const text = await fsp.readFile(configPath, 'utf8');
+        const backupPath = `${configPath}.doctor-pre-fix-${Date.now().toString(36)}.bak`;
+        await fsp.writeFile(backupPath, text);
+        return backupPath;
+    }
+    catch {
+        return null;
+    }
+}
+export function installScopeFromArgs(args = []) {
+    if (flag(args, '--project'))
+        return 'project';
+    if (flag(args, '--global'))
+        return 'global';
+    const index = args.indexOf('--install-scope');
+    return normalizeInstallScope(index >= 0 && args[index + 1] ? args[index + 1] : 'global');
+}
+export function isMigrationUserOwnedProjectConfigBlocker(blocker) {
+    const value = String(blocker || '').trim();
+    return value === 'user_owned_file_without_sks_marker'
+        || value.endsWith(':user_owned_file_without_sks_marker')
+        || value === 'config_write_guard:blocked_unmanaged_project_config'
+        || value.endsWith(':config_write_guard:blocked_unmanaged_project_config');
+}
+export function readOption(args = [], name, fallback = null) {
+    const index = args.indexOf(name);
+    return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
+}
+export function buildCodexAppUiDiagnosticFailure(apply, error) {
+    return {
+        schema: 'sks.codex-app-fast-ui-repair.v1',
+        ok: false,
+        apply,
+        safe_auto_apply: false,
+        requires_confirmation: true,
+        fast_selector: 'manual_action_required',
+        provider_selector: 'manual_action_required',
+        host_owned_config: 'diagnostic_failed',
+        next_action: 'Review Codex App UI config manually.',
+        actions: [],
+        blockers: [error instanceof Error ? error.message : String(error)]
+    };
+}
+export function formatCodexDoctorConsoleStatus(report) {
+    if (!report || report.available !== true)
+        return 'unavailable';
+    return report.disposition || (report.exit_code === 0 ? 'pass' : 'warn');
+}
+export function sksMenuBarRunningVersionConsoleLines(status) {
+    const runningVersion = status?.running_process?.package_version
+        || status?.menubar_version_probe?.running_version
+        || null;
+    const runningPid = status?.running_process?.pid ?? status?.menubar_version_probe?.pid ?? null;
+    if (typeof runningVersion !== 'string' || !runningVersion || !Number.isInteger(runningPid) || runningPid <= 0) {
+        return [];
+    }
+    const expectedVersion = status?.menubar_version_probe?.expected_version
+        || status?.action_target?.expected_version
+        || status?.package_version
+        || null;
+    const installedVersion = status?.installed_version || status?.build_stamp?.package_version || null;
+    return [
+        `  RUNNING: version ${runningVersion} (PID ${runningPid})`,
+        ...(typeof expectedVersion === 'string' && expectedVersion && expectedVersion !== runningVersion
+            ? [`  expected: version ${expectedVersion}`]
+            : []),
+        ...(typeof installedVersion === 'string' && installedVersion && installedVersion !== runningVersion
+            ? [`  installed: version ${installedVersion}`]
+            : [])
+    ];
+}
+export async function rebootstrapSksMenuBarLaunchdForDoctorFix(input, deps = {}) {
+    const env = input.env || process.env;
+    const status = input.status;
+    const expectedVersion = status?.menubar_version_probe?.expected_version
+        || status?.action_target?.expected_version
+        || status?.installed_version
+        || null;
+    const warningOnlyVerifiedProcess = input.fix
+        && !sksMenuBarRestartDeferred(env)
+        && status?.launchd?.checked === true
+        && status?.launchd?.ok === false
+        && Array.isArray(status?.warnings)
+        && status.warnings.includes('launchd_not_running_process_active')
+        && !(Array.isArray(status?.blockers) && status.blockers.includes('launchd_not_running'))
+        && status?.running_process?.ok === true
+        && typeof expectedVersion === 'string'
+        && status.running_process.package_version === expectedVersion;
+    if (!warningOnlyVerifiedProcess) {
+        return { attempted: false, ok: true, status, restart: null };
+    }
+    const paths = sksMenuBarPaths(input.home || env.HOME, input.root);
+    const restartImpl = deps.restartLaunchAgentImpl || restartLaunchAgent;
+    const inspectImpl = deps.inspectSksMenuBarStatusImpl || inspectSksMenuBarStatus;
+    const restart = await restartImpl(paths, env).catch((error) => ({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error)
+    }));
+    if (restart?.ok !== true) {
+        const detail = restart?.error ? `:${restart.error}` : '';
+        return {
+            attempted: true,
+            ok: false,
+            restart,
+            status: {
+                ...status,
+                ok: false,
+                blockers: [...new Set([...(status?.blockers || []), `launchd_rebootstrap_failed${detail}`])]
+            }
+        };
+    }
+    const refreshed = await inspectImpl({
+        root: input.root,
+        ...(input.home ? { home: input.home } : {}),
+        ...(input.env ? { env: input.env } : {})
+    }).catch((error) => ({
+        ...status,
+        ok: false,
+        blockers: [...new Set([
+                ...(status?.blockers || []),
+                `launchd_rebootstrap_status_failed:${error instanceof Error ? error.message : String(error)}`
+            ])]
+    }));
+    if (refreshed?.launchd?.checked !== true || refreshed?.launchd?.ok !== true) {
+        return {
+            attempted: true,
+            ok: false,
+            restart,
+            status: {
+                ...refreshed,
+                ok: false,
+                blockers: [...new Set([...(refreshed?.blockers || []), 'launchd_rebootstrap_not_confirmed'])]
+            }
+        };
+    }
+    return { attempted: true, ok: true, status: refreshed, restart };
+}
+export function mergeObservedCodexStartupWarnings(startupRepair, codexDoctor) {
+    const text = `${codexDoctor?.stdout_tail || ''}\n${codexDoctor?.stderr_tail || ''}`;
+    const manual = new Set(Array.isArray(startupRepair?.manual_actions) ? startupRepair.manual_actions : []);
+    const warnings = new Set(Array.isArray(startupRepair?.warnings) ? startupRepair.warnings : []);
+    const blockers = new Set(Array.isArray(startupRepair?.blockers) ? startupRepair.blockers : []);
+    if (/codex_apps[\s\S]{0,500}token_expired|token_expired[\s\S]{0,500}codex_apps/i.test(text)) {
+        manual.add('Codex Apps MCP token is expired; sign in to Codex App/CLI again so the connector can mint a fresh token.');
+        warnings.add('codex_apps_token_expired_observed');
+        blockers.add('codex_apps_token_expired_manual_reauth_required');
+    }
+    if (/SUPABASE_ACCESS_TOKEN[\s\S]{0,500}mcp server ['"`]?supabase['"`]?|mcp server ['"`]?supabase['"`]?[\s\S]{0,500}SUPABASE_ACCESS_TOKEN/i.test(text)) {
+        manual.add('Supabase MCP uses SUPABASE_ACCESS_TOKEN but the variable is unset; export the token or migrate that server to a read-only remote URL.');
+        warnings.add('supabase_access_token_missing_observed');
+        blockers.add('supabase_access_token_missing_manual_auth_required');
+    }
+    if (/node_repl[\s\S]{0,500}No such file or directory|No such file or directory[\s\S]{0,500}node_repl/i.test(text)) {
+        warnings.add('node_repl_missing_command_observed');
+    }
+    return {
+        ...startupRepair,
+        ok: blockers.size === 0 && startupRepair?.ok !== false,
+        manual_actions: [...manual],
+        warnings: [...warnings],
+        blockers: [...blockers]
+    };
+}

package/dist/commands/doctor-profile.js

@@ -48,6 +48,9 @@ export function doctorPhaseIdsForProfile(profile) {
         return ['setup', ...required, ...optional];
     return [...required, ...optional];
 }
+export function doctorProfileRequiresDesktopBridgeReadiness(profile) {
+    return profile !== 'migration';
+}
 function unknownDoctorFlags(args) {
     const knownBoolean = new Set([
         '--fix', '--yes', '-y', '--machine-only', '--actual-codex', '--require-actual-codex',