sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-app/provider-mode.js

@@ -1,91 +0,0 @@
-import { normalizeCodexModelId, readTopLevelTomlString } from './codex-model-catalog.js';
-export const CODEX_PROVIDER_MODE_MARKER_PREFIX = '# sks-managed-provider-mode:';
-export const CODEX_NATIVE_PROVIDER_ID = 'openai';
-const MODES = new Set(['chatgpt-oauth', 'codex-lb', 'openrouter']);
-export function isCodexProviderMode(value) {
-    return MODES.has(String(value || '').trim());
-}
-export function readExplicitCodexProviderMode(configText) {
-    const values = String(configText || '')
-        .split('\n')
-        .map((line) => line.trim())
-        .filter((line) => line.startsWith(CODEX_PROVIDER_MODE_MARKER_PREFIX))
-        .map((line) => line.slice(CODEX_PROVIDER_MODE_MARKER_PREFIX.length).trim());
-    if (!values.length)
-        return { mode: null, blockers: ['provider_mode_not_explicit'] };
-    if (values.length !== 1)
-        return { mode: null, blockers: ['provider_mode_marker_conflict'] };
-    const mode = values[0];
-    if (!isCodexProviderMode(mode))
-        return { mode: null, blockers: ['provider_mode_marker_invalid'] };
-    return { mode, blockers: [] };
-}
-export function upsertExplicitCodexProviderMode(configText, mode) {
-    const lines = String(configText || '').split('\n');
-    const filtered = lines.filter((line) => !line.trim().startsWith(CODEX_PROVIDER_MODE_MARKER_PREFIX));
-    const marker = `${CODEX_PROVIDER_MODE_MARKER_PREFIX}${mode}`;
-    const firstContent = filtered.findIndex((line) => line.trim().length > 0);
-    if (firstContent < 0)
-        return `${marker}\n`;
-    filtered.splice(firstContent, 0, marker);
-    return `${filtered.join('\n').replace(/^\n+|\n+$/g, '')}\n`;
-}
-export function codexProviderModeState(configText) {
-    const explicit = readExplicitCodexProviderMode(configText);
-    const selectedProvider = readTopLevelTomlString(configText, 'model_provider');
-    const openAiBaseUrl = readTopLevelTomlString(configText, 'openai_base_url');
-    const loopbackConfigured = isLoopbackHttpUrl(openAiBaseUrl);
-    const loopbackRequired = explicit.mode === 'codex-lb' || explicit.mode === 'openrouter';
-    const blockers = [...explicit.blockers];
-    if (explicit.mode && selectedProvider !== CODEX_NATIVE_PROVIDER_ID) {
-        blockers.push('provider_mode_requires_builtin_openai');
-    }
-    if (loopbackRequired && !loopbackConfigured)
-        blockers.push('provider_mode_loopback_missing');
-    if (explicit.mode === 'chatgpt-oauth' && openAiBaseUrl) {
-        blockers.push('chatgpt_oauth_mode_loopback_still_configured');
-    }
-    return {
-        schema: 'sks.codex-provider-mode-state.v1',
-        mode: explicit.mode,
-        explicit: explicit.blockers.length === 0,
-        native_provider_selected: selectedProvider === CODEX_NATIVE_PROVIDER_ID,
-        loopback_required: loopbackRequired,
-        loopback_configured: loopbackConfigured,
-        auxiliary_oauth_required: loopbackRequired,
-        blockers: [...new Set(blockers)]
-    };
-}
-export function providerModeOwnsModel(mode, model) {
-    const normalized = normalizeCodexModelId(model);
-    if (!normalized)
-        return false;
-    if (mode === 'openrouter')
-        return normalized.includes('/');
-    return !normalized.includes('/');
-}
-export function assertProviderModeModel(mode, model, allowedModels) {
-    const normalized = normalizeCodexModelId(model);
-    if (!normalized)
-        throw new Error('provider_mode_model_invalid');
-    if (!providerModeOwnsModel(mode, normalized))
-        throw new Error('provider_mode_model_family_mismatch');
-    const allowed = new Set(allowedModels.map(normalizeCodexModelId).filter((entry) => Boolean(entry)));
-    if (!allowed.size)
-        throw new Error('provider_mode_model_catalog_empty');
-    if (!allowed.has(normalized))
-        throw new Error('provider_mode_model_not_allowed');
-    return normalized;
-}
-function isLoopbackHttpUrl(value) {
-    if (!value)
-        return false;
-    try {
-        const parsed = new URL(value);
-        const host = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
-        return parsed.protocol === 'http:' && (host === '127.0.0.1' || host === '::1' || host === 'localhost');
-    }
-    catch {
-        return false;
-    }
-}

package/dist/core/codex-app/provider-session-policy.js

@@ -1,85 +0,0 @@
-import { assertProviderModeModel } from './provider-mode.js';
-export const PROVIDER_SESSION_SCHEMA = 'sks.provider-session.v1';
-export function createProviderSessionPin(input) {
-    const sessionId = validSessionId(input.sessionId);
-    if (!sessionId)
-        throw new Error('provider_session_id_invalid');
-    if (input.parent) {
-        if (input.mode !== input.parent.mode)
-            throw new Error('provider_session_fork_mode_mismatch');
-        if (input.model !== input.parent.model)
-            throw new Error('provider_session_fork_model_mismatch');
-        if (stableModels(input.allowedModels).join('\0') !== stableModels(input.parent.allowed_models).join('\0')) {
-            throw new Error('provider_session_fork_catalog_mismatch');
-        }
-    }
-    const allowedModels = stableModels(input.allowedModels);
-    if (input.mode === 'chatgpt-oauth') {
-        if (!allowedModels.includes(input.model))
-            throw new Error('provider_session_model_not_allowed');
-    }
-    else {
-        assertProviderModeModel(input.mode, input.model, allowedModels);
-    }
-    return {
-        schema: PROVIDER_SESSION_SCHEMA,
-        session_id: sessionId,
-        mode: input.mode,
-        model: input.model,
-        allowed_models: allowedModels,
-        created_at: input.createdAt || new Date().toISOString(),
-        parent_session_id: input.parent?.session_id || null
-    };
-}
-export function providerSessionStatus(input) {
-    if (!input.pin) {
-        return {
-            schema: 'sks.provider-session-status.v1',
-            ok: false,
-            status: 'migration_required',
-            session_mode: null,
-            new_session_default_mode: input.globalDefaultMode,
-            mode_changed_since_creation: null,
-            blockers: ['legacy_session_provider_mode_selection_required'],
-            action: 'Choose a mode explicitly, then start a new session.'
-        };
-    }
-    const modeChanged = input.pin.mode !== input.globalDefaultMode;
-    return {
-        schema: 'sks.provider-session-status.v1',
-        ok: true,
-        status: modeChanged ? 'pinned_while_default_changed' : 'pinned',
-        session_mode: input.pin.mode,
-        new_session_default_mode: input.globalDefaultMode,
-        mode_changed_since_creation: modeChanged,
-        blockers: [],
-        action: modeChanged
-            ? `This session continues in ${input.pin.mode}; start a new session to use ${input.globalDefaultMode}.`
-            : `This session is pinned to ${input.pin.mode}.`
-    };
-}
-export function assertProviderSessionRequest(pin, input) {
-    if (pin.mode !== input.mode)
-        throw new Error('provider_session_mode_switch_forbidden');
-    if (!pin.allowed_models.includes(input.model))
-        throw new Error('provider_session_model_switch_forbidden');
-}
-export function classifyPinnedProviderFailure(status) {
-    if (status === 401 || status === 403) {
-        return { retry_allowed: false, stop_session: true, blocker: 'provider_session_authentication_failed', action: 'Verify this mode credential, then start a new session.' };
-    }
-    if (status === 402 || status === 429) {
-        return { retry_allowed: false, stop_session: true, blocker: 'provider_session_quota_or_rate_limit', action: 'Do not fail over accounts; resolve quota or start a new session explicitly.' };
-    }
-    if (status >= 500) {
-        return { retry_allowed: false, stop_session: true, blocker: 'provider_session_upstream_failed', action: 'Keep the pinned account and retry only after explicit user action.' };
-    }
-    return { retry_allowed: true, stop_session: false, blocker: null, action: null };
-}
-function stableModels(models) {
-    return [...new Set(models.map((model) => String(model || '').trim()).filter(Boolean))].sort();
-}
-function validSessionId(value) {
-    const id = String(value || '').trim();
-    return /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(id) ? id : null;
-}

package/dist/core/codex-app/session-policy/session-pinning.js

@@ -1,68 +0,0 @@
-import { createHash } from 'node:crypto';
-import { assertProviderPolicyCompatible, stableArchitectureHash } from '../../architecture-hardening/contracts/contracts.js';
-export function createSessionPin(input) {
-    if (!validId(input.sessionId))
-        throw new Error('session_pin_id_invalid');
-    const model = String(input.model || '').trim();
-    if (!input.policy.allowed_models.includes(model))
-        throw new Error('session_pin_model_not_allowed');
-    if ((input.policy.mode === 'openrouter') !== model.includes('/'))
-        throw new Error('session_pin_model_family_mismatch');
-    if (input.policy.mode === 'codex-lb' && !input.lbAffinityToken)
-        throw new Error('session_pin_lb_affinity_required');
-    if (input.policy.mode !== 'codex-lb' && input.lbAffinityToken)
-        throw new Error('session_pin_lb_affinity_forbidden');
-    return Object.freeze({
-        schema: 'sks.session-pin.v1',
-        session_id: input.sessionId,
-        mode: input.policy.mode,
-        model,
-        credential_class: input.policy.credential_class,
-        allowed_models: Object.freeze([...input.policy.allowed_models]),
-        lb_affinity_token_hash: input.lbAffinityToken ? createHash('sha256').update(input.lbAffinityToken).digest('hex') : null,
-        child_policy_hash: input.policy.child_policy_hash,
-        catalog_version: input.policy.catalog_version,
-        parent_session_id: input.parentSessionId || null
-    });
-}
-export function forkSessionPin(parent, sessionId) {
-    if (!validId(sessionId))
-        throw new Error('session_pin_id_invalid');
-    return Object.freeze({ ...parent, session_id: sessionId, parent_session_id: parent.session_id, allowed_models: Object.freeze([...parent.allowed_models]) });
-}
-export function resumeSessionPin(pin, policy) {
-    if (!pin)
-        return { schema: 'sks.session-resume-decision.v1', ok: false, status: 'migration_required', pin: null, blocker: 'session_pin_metadata_missing' };
-    const pinnedPolicy = {
-        schema: 'sks.provider-policy-snapshot.v1',
-        contract_version: policy.contract_version,
-        mode: pin.mode,
-        credential_class: pin.credential_class,
-        allowed_models: pin.allowed_models,
-        child_policy_hash: pin.child_policy_hash,
-        catalog_version: pin.catalog_version
-    };
-    try {
-        assertProviderPolicyCompatible(pinnedPolicy, policy);
-    }
-    catch (error) {
-        return { schema: 'sks.session-resume-decision.v1', ok: false, status: 'blocked', pin, blocker: error.message };
-    }
-    if (!pin.allowed_models.includes(pin.model))
-        return { schema: 'sks.session-resume-decision.v1', ok: false, status: 'blocked', pin, blocker: 'session_pin_model_restore_mismatch' };
-    return { schema: 'sks.session-resume-decision.v1', ok: true, status: 'resumable', pin, blocker: null };
-}
-export function sessionPinHash(pin) {
-    return stableArchitectureHash(pin);
-}
-export function assertSessionRequest(pin, input) {
-    if (pin.mode !== input.mode)
-        throw new Error('session_pin_mode_switch_forbidden');
-    if (pin.model !== input.model)
-        throw new Error('session_pin_model_switch_forbidden');
-    if (pin.child_policy_hash !== input.childPolicyHash)
-        throw new Error('session_pin_child_policy_mismatch');
-}
-function validId(value) {
-    return /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(String(value || ''));
-}

package/dist/core/codex-control/codex-lb-launch-recovery.js

@@ -1,319 +0,0 @@
-import os from 'node:os';
-import path from 'node:path';
-import { parseCodexConfigToml } from '../codex/codex-config-toml.js';
-import { readText } from '../fsx.js';
-import { codexLbToolOutputRecoveryNotChecked, codexLbToolOutputRecoveryNotSelected, codexLbToolOutputRecoveryOverrideAcknowledged, probeCodexLbToolOutputRecovery } from '../codex-lb/codex-lb-tool-output-recovery.js';
-import { normalizeCodexLbBaseUrl } from '../codex-lb/codex-lb-env.js';
-export async function inspectCodexLbSdkLaunchRecovery(input) {
-    if (String(input.config.model_provider || '') !== 'codex-lb') {
-        return codexLbToolOutputRecoveryNotSelected();
-    }
-    const providers = input.config.model_providers;
-    const baseUrl = String(providers?.['codex-lb']?.base_url
-        || input.env.CODEX_LB_BASE_URL
-        || '');
-    return probeCodexLbToolOutputRecovery({
-        baseUrl,
-        ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}),
-        ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),
-        allowUnverified: codexLbToolOutputRecoveryOverrideAcknowledged({
-            env: input.overrideEnv || input.env
-        })
-    });
-}
-export async function inspectCodexLbCliLaunchRecovery(input) {
-    const env = input.env || process.env;
-    const args = (input.cliArgs || []).map((arg) => String(arg));
-    const codexHome = path.resolve(String(env.CODEX_HOME || path.join(env.HOME || os.homedir(), '.codex')));
-    const userConfigPath = path.join(codexHome, 'config.toml');
-    const effectiveRoot = effectiveCodexWorkingRoot(input.root, args);
-    if (!effectiveRoot.ok)
-        return configParseBlocked(effectiveRoot.blockers);
-    const projectConfigPath = path.join(effectiveRoot.root, '.codex', 'config.toml');
-    const ignoreUserConfig = args.includes('--ignore-user-config');
-    const profileName = ignoreUserConfig ? null : cliOptionValue(args, ['--profile', '-p', '-P']);
-    const profileConfigPath = profileName && safeProfileName(profileName)
-        ? path.join(codexHome, `${profileName}.config.toml`)
-        : null;
-    const userConfig = ignoreUserConfig
-        ? configLayer('', 'user')
-        : configLayer(await readText(userConfigPath, '').catch(() => ''), 'user');
-    const profileConfig = profileConfigPath
-        ? configLayer(await readText(profileConfigPath, '').catch(() => ''), 'profile')
-        : configLayer('', 'profile');
-    const projectConfig = path.resolve(projectConfigPath) === path.resolve(userConfigPath)
-        ? configLayer('', 'project')
-        : configLayer(await readText(projectConfigPath, '').catch(() => ''), 'project');
-    const overrides = cliConfigOverrides(args);
-    const environmentSelectsCodexLb = env.SKS_PROVIDER === 'codex-lb' || env.SKS_USE_CODEX_LB === '1';
-    if (cliSelectsLocalProvider(args)) {
-        return codexLbToolOutputRecoveryNotSelected();
-    }
-    const loadedLayers = [userConfig, profileConfig, projectConfig];
-    const parseBlockers = loadedLayers
-        .filter((layer) => layer.parseFailed && layer.rawSelectsCodexLb)
-        .map((layer) => `codex_lb_launch_config_parse_failed:${layer.source}`);
-    if (parseBlockers.length > 0)
-        return configParseBlocked(parseBlockers);
-    if (projectConfig.hasMachineLocalProviderConfig) {
-        return projectProviderConfigBlocked();
-    }
-    if (overrides.modelProvider && overrides.modelProvider !== 'codex-lb') {
-        return codexLbToolOutputRecoveryNotSelected();
-    }
-    const selectedProvider = overrides.modelProvider
-        ?? (environmentSelectsCodexLb ? 'codex-lb' : null)
-        ?? profileConfig.modelProvider
-        ?? userConfig.modelProvider
-        ?? '';
-    if (selectedProvider !== 'codex-lb') {
-        return codexLbToolOutputRecoveryNotSelected();
-    }
-    const codexProcessSelectsCodexLb = overrides.modelProvider === 'codex-lb'
-        || profileConfig.modelProvider === 'codex-lb'
-        || userConfig.modelProvider === 'codex-lb';
-    if (environmentSelectsCodexLb && !codexProcessSelectsCodexLb) {
-        return environmentSelectionNotForwardedBlocked();
-    }
-    const baseUrl = overrides.baseUrl
-        ?? profileConfig.baseUrl
-        ?? userConfig.baseUrl
-        ?? String(env.CODEX_LB_BASE_URL || '');
-    const verifiedProbe = reusableVerifiedProbeForBase(input.verifiedProbe, baseUrl);
-    if (verifiedProbe)
-        return verifiedProbe;
-    return probeCodexLbToolOutputRecovery({
-        baseUrl,
-        ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}),
-        ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),
-        allowUnverified: input.allowUnverified === true
-            || codexLbToolOutputRecoveryOverrideAcknowledged({ args, env })
-    });
-}
-function reusableVerifiedProbeForBase(value, selectedBaseUrl) {
-    if (!value || value.schema !== 'sks.codex-lb-tool-output-recovery.v1')
-        return null;
-    if (value.ok !== true || value.required !== true || value.verified !== true || value.supports_interrupted_tool_output_recovery !== true)
-        return null;
-    const verifiedBaseUrl = normalizeCodexLbBaseUrl(value.base_url);
-    const effectiveBaseUrl = normalizeCodexLbBaseUrl(selectedBaseUrl);
-    if (!verifiedBaseUrl || !effectiveBaseUrl || verifiedBaseUrl !== effectiveBaseUrl)
-        return null;
-    return value;
-}
-export async function withCodexLbCliLaunchRecovery(input, launch) {
-    const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery(input);
-    if (!toolOutputRecovery.ok) {
-        return {
-            launched: false,
-            toolOutputRecovery,
-            value: null
-        };
-    }
-    return {
-        launched: true,
-        toolOutputRecovery,
-        value: await launch()
-    };
-}
-export function codexLbRecoveryBlockedProcessResult(probe) {
-    const stderr = codexLbRecoveryBlockedMessage(probe);
-    return {
-        code: 78,
-        stdout: '',
-        stderr,
-        stdoutBytes: 0,
-        stderrBytes: Buffer.byteLength(stderr),
-        truncated: false,
-        timedOut: false,
-        codexLbToolOutputRecovery: probe
-    };
-}
-export function codexLbRecoveryBlockedMessage(probe) {
-    if (probe.blockers.includes('codex_lb_launch_selection_not_forwarded')) {
-        return [
-            'Codex launch blocked: codex-lb was requested by the SKS environment but was not selected in the Codex process.',
-            ...probe.blockers.map((blocker) => `blocker: ${blocker}`),
-            ...probe.operator_actions
-        ].join('\n');
-    }
-    return [
-        'Codex launch blocked: selected codex-lb interrupted tool-output recovery is not verified.',
-        ...probe.blockers.map((blocker) => `blocker: ${blocker}`),
-        ...probe.operator_actions
-    ].join('\n');
-}
-function configLayer(text, source) {
-    const raw = String(text || '');
-    if (!raw.trim()) {
-        return {
-            source,
-            modelProvider: null,
-            baseUrl: null,
-            parseFailed: false,
-            rawSelectsCodexLb: false,
-            hasMachineLocalProviderConfig: false
-        };
-    }
-    try {
-        const parsed = parseCodexConfigToml(raw);
-        return {
-            source,
-            modelProvider: stringValue(parsed.model_provider),
-            baseUrl: stringValue(parsed.model_providers?.['codex-lb']?.base_url),
-            parseFailed: false,
-            rawSelectsCodexLb: false,
-            hasMachineLocalProviderConfig: source === 'project' && Boolean(stringValue(parsed.model_provider)
-                || (parsed.model_providers && typeof parsed.model_providers === 'object' && Object.keys(parsed.model_providers).length)
-                || stringValue(parsed.openai_base_url)
-                || stringValue(parsed.chatgpt_base_url))
-        };
-    }
-    catch {
-        return {
-            source,
-            modelProvider: null,
-            baseUrl: null,
-            parseFailed: true,
-            rawSelectsCodexLb: /^\s*model_provider\s*=\s*(?:"codex-lb"|'codex-lb'|codex-lb)\s*(?:#.*)?$/mi.test(raw),
-            hasMachineLocalProviderConfig: source === 'project' && /^\s*(?:model_provider|openai_base_url|chatgpt_base_url)\s*=|^\s*\[model_providers(?:\.|\])/mi.test(raw)
-        };
-    }
-}
-function cliConfigOverrides(args) {
-    let modelProvider = null;
-    let baseUrl = null;
-    for (let index = 0; index < args.length; index += 1) {
-        const arg = args[index] || '';
-        let override = null;
-        if (arg === '-c' || arg === '--config') {
-            override = args[index + 1] || '';
-            index += 1;
-        }
-        else if (arg.startsWith('--config=')) {
-            override = arg.slice('--config='.length);
-        }
-        else if (arg.startsWith('-c=')) {
-            override = arg.slice(3);
-        }
-        if (!override)
-            continue;
-        const equals = override.indexOf('=');
-        if (equals < 1)
-            continue;
-        const key = normalizeDottedKey(override.slice(0, equals));
-        const value = parseCliTomlValue(override.slice(equals + 1));
-        if (key === 'model_provider')
-            modelProvider = stringValue(value);
-        if (key === 'model_providers.codex-lb.base_url')
-            baseUrl = stringValue(value);
-        if (key === 'model_providers.codex-lb' && value && typeof value === 'object') {
-            baseUrl = stringValue(value.base_url) ?? baseUrl;
-        }
-        if (key === 'model_providers' && value && typeof value === 'object') {
-            baseUrl = stringValue(value?.['codex-lb']?.base_url) ?? baseUrl;
-        }
-    }
-    return { modelProvider, baseUrl };
-}
-function parseCliTomlValue(raw) {
-    try {
-        return parseCodexConfigToml(`value = ${raw}\n`).value;
-    }
-    catch {
-        return String(raw || '').trim();
-    }
-}
-function cliOptionValue(args, names) {
-    for (let index = 0; index < args.length; index += 1) {
-        const arg = args[index] || '';
-        if (names.includes(arg))
-            return String(args[index + 1] || '').trim() || null;
-        for (const name of names) {
-            if (arg.startsWith(`${name}=`))
-                return arg.slice(name.length + 1).trim() || null;
-        }
-    }
-    return null;
-}
-function cliSelectsLocalProvider(args) {
-    return args.includes('--oss');
-}
-export function effectiveCodexWorkingRoot(fallbackRoot, args) {
-    const base = path.resolve(fallbackRoot);
-    let selected = null;
-    for (let index = 0; index < args.length; index += 1) {
-        const arg = args[index] || '';
-        if (arg === '--')
-            break;
-        if (arg === '-C' || arg === '--cd') {
-            const next = String(args[index + 1] || '').trim();
-            if (!next || next.startsWith('-')) {
-                return { ok: false, root: base, blockers: ['codex_lb_launch_working_root_value_missing'] };
-            }
-            selected = next;
-            index += 1;
-            continue;
-        }
-        if (arg.startsWith('--cd=') || arg.startsWith('-C=')) {
-            const value = arg.slice(arg.indexOf('=') + 1).trim();
-            if (!value)
-                return { ok: false, root: base, blockers: ['codex_lb_launch_working_root_value_missing'] };
-            selected = value;
-        }
-    }
-    return {
-        ok: true,
-        root: selected ? path.resolve(base, selected) : base,
-        blockers: []
-    };
-}
-function safeProfileName(value) {
-    return /^[A-Za-z0-9_.-]{1,128}$/.test(value);
-}
-function normalizeDottedKey(value) {
-    return String(value || '').trim().replace(/["']/g, '').replace(/\s+/g, '');
-}
-function stringValue(value) {
-    return typeof value === 'string' && value.trim() ? value.trim() : null;
-}
-function configParseBlocked(blockers) {
-    const base = codexLbToolOutputRecoveryNotChecked(true);
-    return {
-        ...base,
-        status: 'version_unverified',
-        blockers,
-        warnings: ['selected_codex_lb_config_could_not_be_parsed_safely'],
-        operator_actions: [
-            'Repair the selected Codex config TOML, then rerun `sks codex-lb status`.',
-            ...base.operator_actions
-        ]
-    };
-}
-function projectProviderConfigBlocked() {
-    const base = codexLbToolOutputRecoveryNotChecked(true);
-    return {
-        ...base,
-        status: 'version_unverified',
-        blockers: ['codex_lb_launch_project_provider_config_forbidden'],
-        warnings: ['machine_local_provider_config_must_live_in_codex_home'],
-        operator_actions: [
-            'Run `sks doctor --fix` to move or remove machine-local provider settings from the project `.codex/config.toml`.',
-            'Rerun `sks codex-lb status` before launching Codex.',
-            ...base.operator_actions
-        ]
-    };
-}
-function environmentSelectionNotForwardedBlocked() {
-    const base = codexLbToolOutputRecoveryNotChecked(true);
-    return {
-        ...base,
-        status: 'version_unverified',
-        blockers: ['codex_lb_launch_selection_not_forwarded'],
-        warnings: ['sks_provider_environment_does_not_select_the_codex_process_provider'],
-        operator_actions: [
-            `Launch Codex with \`--config model_provider='"codex-lb"'\`, or select codex-lb in the active Codex profile.`,
-            'Rerun `sks codex-lb status` before launching Codex.'
-        ]
-    };
-}