sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/provider-routing/provider-router.js

@@ -1,58 +0,0 @@
-import { credentialClassForMode, parseProviderPolicySnapshot } from '../../architecture-hardening/contracts/contracts.js';
-export function decideProviderRoute(input) {
-    const policy = parseProviderPolicySnapshot(input.policy);
-    const base = {
-        schema: 'sks.provider-route-decision.v1',
-        mode: policy.mode,
-        credential_class: policy.credential_class,
-        failover_allowed: false
-    };
-    if (input.requestedMode !== policy.mode)
-        return blocked(base, 'provider_route_cross_mode_forbidden');
-    if (input.credential.status !== 'ready')
-        return blocked(base, `provider_route_credential_${input.credential.status}`);
-    const model = String(input.model || '').trim();
-    if (!model)
-        return blocked(base, 'provider_route_model_invalid');
-    const isOpenRouterModel = model.includes('/');
-    if ((policy.mode === 'openrouter') !== isOpenRouterModel)
-        return blocked(base, 'provider_route_model_family_mismatch');
-    if (!policy.allowed_models.includes(model))
-        return blocked(base, 'provider_route_model_not_allowed');
-    return {
-        ...base,
-        ok: true,
-        upstream: policy.mode,
-        model,
-        source_label: policy.mode === 'chatgpt-oauth' ? 'ChatGPT OAuth' : policy.mode === 'codex-lb' ? 'Codex LB' : 'OpenRouter',
-        blockers: []
-    };
-}
-export async function resolveCredentialForRoute(decision, port) {
-    if (!decision.ok)
-        throw new Error(decision.blockers[0] || 'provider_route_blocked');
-    const credential = await port.readCredential(decision.credential_class);
-    if (!credential)
-        throw new Error('provider_route_credential_unavailable');
-    return credential;
-}
-export function classifyProviderRouteFailure(status) {
-    if (status === 401 || status === 403)
-        return { retry_allowed: false, failover_allowed: false, reason_code: 'provider_route_auth_failed' };
-    if (status === 402 || status === 429)
-        return { retry_allowed: false, failover_allowed: false, reason_code: 'provider_route_quota_or_rate_limit' };
-    if (status >= 500)
-        return { retry_allowed: false, failover_allowed: false, reason_code: 'provider_route_upstream_failed' };
-    return { retry_allowed: true, failover_allowed: false, reason_code: 'provider_route_request_failed' };
-}
-export function emptyProviderCatalogForCredential(input) {
-    if (input.credential.status !== 'ready')
-        return [];
-    return input.models.filter((model) => (input.mode === 'openrouter') === model.includes('/'));
-}
-function blocked(base, blocker) {
-    return { ...base, ok: false, upstream: null, model: null, source_label: null, blockers: [blocker] };
-}
-export function expectedCredentialClass(mode) {
-    return credentialClassForMode(mode);
-}

package/dist/core/codex-lb/routing-truth.js

@@ -1,327 +0,0 @@
-import os from 'node:os';
-import path from 'node:path';
-import { readJson, writeJsonAtomic } from '../fsx.js';
-import { uniqueTruthyStrings as uniqueStrings } from '../text/strings.js';
-import { codexLbBaseUrlSecurityBlocker, normalizeCodexLbBaseUrl } from './codex-lb-env.js';
-export const CODEX_LB_ROUTING_TRUTH_SCHEMA = 'sks.codex-lb-routing-truth.v1';
-export const CODEX_LB_ROUTING_TRUTH_RECEIPT = 'sks-codex-lb-routing-truth.json';
-export const CODEX_LB_ROUTING_TRUTH_STAMP = CODEX_LB_ROUTING_TRUTH_RECEIPT;
-export const CODEX_LB_ROUTING_TRUTH_STALE_AFTER_MS = 5 * 60 * 1_000;
-export function codexLbRoutingTruthReceiptPath(home = process.env.HOME || os.homedir()) {
-    return path.join(home, '.codex', CODEX_LB_ROUTING_TRUTH_RECEIPT);
-}
-export const codexLbRoutingTruthStampPath = codexLbRoutingTruthReceiptPath;
-export async function measureCodexLbRoutingTruth(options) {
-    const now = options.now || Date.now;
-    const measuredAt = options.nowIso?.() || new Date(now()).toISOString();
-    const baseUrl = normalizeCodexLbBaseUrl(options.baseUrl || '');
-    const configured = safePublicUrl(baseUrl);
-    const mode = options.mode || 'cli-provider';
-    const probeBaseUrl = normalizeCodexLbBaseUrl(options.probeBaseUrl || '');
-    const bridgeLoopbackProbe = Boolean(probeBaseUrl);
-    const authTransport = options.authTransport || (mode === 'cli-provider'
-        ? 'x-codex-lb-api-key'
-        : 'authorization-bearer');
-    const base = {
-        schema: CODEX_LB_ROUTING_TRUTH_SCHEMA,
-        mode,
-        selected: options.selected,
-        fresh: false,
-        stale_after_ms: CODEX_LB_ROUTING_TRUTH_STALE_AFTER_MS,
-        age_ms: 0,
-        configured_base_url: configured?.url || null,
-        configured_host: configured?.host || null,
-        actual_url: null,
-        actual_host: null,
-        measurement_path: bridgeLoopbackProbe ? 'bridge-loopback' : 'direct',
-        auth_transport: authTransport,
-        http_status: null,
-        measured_at: measuredAt,
-        checked_at: measuredAt,
-        latency_ms: null
-    };
-    if (!baseUrl) {
-        return {
-            ...base,
-            ok: false,
-            status: 'missing_base_url',
-            measured: false,
-            auth_outcome: 'not_attempted',
-            blockers: ['codex_lb_missing:CODEX_LB_BASE_URL']
-        };
-    }
-    const transportBlocker = codexLbBaseUrlSecurityBlocker(baseUrl);
-    if (transportBlocker) {
-        return {
-            ...base,
-            ok: false,
-            status: 'transport_blocked',
-            measured: false,
-            auth_outcome: 'not_attempted',
-            blockers: [transportBlocker]
-        };
-    }
-    if (bridgeLoopbackProbe && (mode !== 'bridge' || !isHttpLoopbackUrl(probeBaseUrl))) {
-        return {
-            ...base,
-            ok: false,
-            status: 'transport_blocked',
-            measured: false,
-            auth_outcome: 'not_attempted',
-            blockers: ['codex_lb_bridge_probe_target_not_loopback']
-        };
-    }
-    const apiKey = String(options.apiKey || '').trim();
-    if (!apiKey) {
-        return {
-            ...base,
-            ok: false,
-            status: 'missing_api_key',
-            measured: false,
-            auth_outcome: 'not_attempted',
-            blockers: ['codex_lb_missing:CODEX_LB_API_KEY']
-        };
-    }
-    if (options.measure === false) {
-        return {
-            ...base,
-            ok: !options.selected,
-            status: options.selected ? 'selected_unmeasured' : 'ready_unselected',
-            measured: false,
-            auth_outcome: 'not_attempted',
-            blockers: options.selected ? ['codex_lb_routing_truth_unmeasured'] : []
-        };
-    }
-    if (!options.selected) {
-        return {
-            ...base,
-            ok: true,
-            status: 'ready_unselected',
-            measured: false,
-            auth_outcome: 'not_attempted',
-            blockers: []
-        };
-    }
-    const measurementBaseUrl = bridgeLoopbackProbe ? probeBaseUrl : baseUrl;
-    const measurementTarget = safePublicUrl(measurementBaseUrl);
-    const endpoint = `${measurementBaseUrl.replace(/\/+$/, '')}/models`;
-    const startedAt = now();
-    try {
-        const headers = authTransport === 'x-codex-lb-api-key'
-            ? { 'X-Codex-LB-API-Key': apiKey }
-            : { Authorization: `Bearer ${apiKey}` };
-        const response = await (options.fetchImpl || globalThis.fetch)(endpoint, {
-            method: 'GET',
-            headers,
-            redirect: 'error',
-            signal: AbortSignal.timeout(Math.max(250, Number(options.timeoutMs || 8_000)))
-        });
-        const finishedAt = now();
-        const actual = safePublicUrl(response.url || endpoint);
-        const authRejected = response.status === 401 || response.status === 403;
-        const ok = response.ok && !authRejected && actual?.host === measurementTarget?.host;
-        const status = authRejected
-            ? 'auth_rejected'
-            : response.ok && actual?.host !== measurementTarget?.host
-                ? 'endpoint_unreachable'
-                : response.ok
-                    ? 'verified'
-                    : 'http_error';
-        return {
-            ...base,
-            ok,
-            status,
-            measured: true,
-            fresh: true,
-            actual_url: actual?.url || null,
-            actual_host: actual?.host || null,
-            auth_outcome: authRejected ? 'rejected' : response.ok ? 'accepted' : 'indeterminate',
-            http_status: response.status,
-            latency_ms: Math.max(0, finishedAt - startedAt),
-            blockers: ok
-                ? []
-                : [authRejected
-                        ? 'codex_lb_auth_rejected'
-                        : response.ok
-                            ? 'codex_lb_actual_host_mismatch'
-                            : `codex_lb_models_http_${response.status}`]
-        };
-    }
-    catch {
-        const finishedAt = now();
-        return {
-            ...base,
-            ok: false,
-            status: 'endpoint_unreachable',
-            measured: true,
-            fresh: true,
-            auth_outcome: 'indeterminate',
-            latency_ms: Math.max(0, finishedAt - startedAt),
-            blockers: ['codex_lb_endpoint_unreachable']
-        };
-    }
-}
-export async function writeCodexLbRoutingTruthReceipt(truth, options = {}) {
-    const receiptPath = options.receiptPath || codexLbRoutingTruthReceiptPath(options.home);
-    const canonical = parseReceipt(truth);
-    if (!canonical)
-        throw new Error('codex_lb_routing_truth_invalid');
-    await writeJsonAtomic(receiptPath, canonical, { mode: 0o600 });
-    return canonical;
-}
-export async function readCodexLbRoutingTruthReceipt(options = {}) {
-    const receiptPath = options.receiptPath || codexLbRoutingTruthReceiptPath(options.home);
-    const parsed = parseReceipt(await readJson(receiptPath, null));
-    if (!parsed)
-        return null;
-    if (options.expectedMode !== undefined && parsed.mode !== options.expectedMode)
-        return null;
-    if (options.expectedSelected !== undefined && parsed.selected !== options.expectedSelected)
-        return null;
-    if (options.expectedConfiguredHost !== undefined
-        && parsed.configured_host !== options.expectedConfiguredHost)
-        return null;
-    if (options.expectedAuthTransport !== undefined
-        && parsed.auth_transport !== options.expectedAuthTransport)
-        return null;
-    return withFreshness(parsed, options);
-}
-export async function readFreshCodexLbRoutingTruthStamp(options = {}) {
-    const truth = await readCodexLbRoutingTruthReceipt(options);
-    return truth?.measured === true && truth.fresh === true ? truth : null;
-}
-export const writeCodexLbRoutingTruthStamp = writeCodexLbRoutingTruthReceipt;
-export const readCodexLbRoutingTruthStamp = readCodexLbRoutingTruthReceipt;
-export async function measureAndWriteCodexLbRoutingTruth(measureOptions, receiptOptions = {}) {
-    const truth = await measureCodexLbRoutingTruth(measureOptions);
-    try {
-        return await writeCodexLbRoutingTruthReceipt(truth, receiptOptions);
-    }
-    catch {
-        if (!truth.selected)
-            return truth;
-        return {
-            ...truth,
-            ok: false,
-            status: 'receipt_write_failed',
-            observed_status: truth.status,
-            blockers: uniqueStrings([...truth.blockers, 'codex_lb_routing_truth_receipt_write_failed'])
-        };
-    }
-}
-export function codexLbRoutingTruthIsActive(truth) {
-    return truth?.selected === true
-        && truth.measured === true
-        && truth.fresh === true
-        && truth.ok === true
-        && truth.status === 'verified';
-}
-function withFreshness(truth, options) {
-    const nowMs = (options.now || Date.now)();
-    const measuredMs = Date.parse(truth.measured_at);
-    const staleAfterMs = Math.max(1_000, Number(options.staleAfterMs || CODEX_LB_ROUTING_TRUTH_STALE_AFTER_MS));
-    const ageMs = Number.isFinite(measuredMs) ? Math.max(0, nowMs - measuredMs) : Number.POSITIVE_INFINITY;
-    const fresh = truth.measured && Number.isFinite(ageMs) && ageMs <= staleAfterMs;
-    if (fresh || !truth.selected) {
-        return { ...truth, fresh, stale_after_ms: staleAfterMs, age_ms: Number.isFinite(ageMs) ? ageMs : null };
-    }
-    return {
-        ...truth,
-        ok: false,
-        status: 'stale',
-        observed_status: truth.status,
-        fresh: false,
-        stale_after_ms: staleAfterMs,
-        age_ms: Number.isFinite(ageMs) ? ageMs : null,
-        blockers: uniqueStrings([...truth.blockers, 'codex_lb_routing_truth_stale'])
-    };
-}
-function parseReceipt(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return null;
-    const input = value;
-    if (input.schema !== CODEX_LB_ROUTING_TRUTH_SCHEMA)
-        return null;
-    const status = String(input.status || '');
-    const statuses = [
-        'verified', 'selected_unmeasured', 'ready_unselected', 'missing_base_url', 'missing_api_key',
-        'transport_blocked', 'endpoint_unreachable', 'auth_rejected', 'http_error', 'stale',
-        'receipt_write_failed'
-    ];
-    const authTransport = String(input.auth_transport || '');
-    const mode = String(input.mode || 'cli-provider');
-    const authOutcome = String(input.auth_outcome || '');
-    const measuredAt = stringOrNull(input.measured_at) || stringOrNull(input.checked_at);
-    if (!statuses.includes(status)
-        || !['bridge', 'cli-provider'].includes(mode)
-        || !['authorization-bearer', 'x-codex-lb-api-key'].includes(authTransport)
-        || !['accepted', 'rejected', 'not_attempted', 'indeterminate'].includes(authOutcome)
-        || !measuredAt
-        || !Array.isArray(input.blockers))
-        return null;
-    return {
-        schema: CODEX_LB_ROUTING_TRUTH_SCHEMA,
-        ok: input.ok === true,
-        status,
-        ...(typeof input.observed_status === 'string'
-            ? { observed_status: input.observed_status }
-            : {}),
-        mode,
-        selected: input.selected === true,
-        measured: input.measured === true,
-        fresh: input.fresh === true,
-        stale_after_ms: finiteNumberOrNull(input.stale_after_ms) || CODEX_LB_ROUTING_TRUTH_STALE_AFTER_MS,
-        age_ms: finiteNumberOrNull(input.age_ms),
-        configured_base_url: safeReceiptUrl(input.configured_base_url),
-        configured_host: stringOrNull(input.configured_host),
-        actual_url: safeReceiptUrl(input.actual_url),
-        actual_host: stringOrNull(input.actual_host),
-        measurement_path: input.measurement_path === 'bridge-loopback'
-            ? 'bridge-loopback'
-            : 'direct',
-        auth_transport: authTransport,
-        auth_outcome: authOutcome,
-        http_status: finiteNumberOrNull(input.http_status),
-        measured_at: measuredAt,
-        checked_at: measuredAt,
-        latency_ms: finiteNumberOrNull(input.latency_ms),
-        blockers: uniqueStrings(input.blockers.map(String))
-    };
-}
-function safeReceiptUrl(input) {
-    if (typeof input !== 'string')
-        return null;
-    return safePublicUrl(input)?.url || null;
-}
-function stringOrNull(input) {
-    return typeof input === 'string' && input ? input : null;
-}
-function finiteNumberOrNull(input) {
-    return typeof input === 'number' && Number.isFinite(input) && input >= 0 ? input : null;
-}
-function safePublicUrl(input) {
-    try {
-        const parsed = new URL(input);
-        parsed.username = '';
-        parsed.password = '';
-        parsed.search = '';
-        parsed.hash = '';
-        return {
-            url: parsed.toString().replace(/\/$/, ''),
-            host: parsed.host
-        };
-    }
-    catch {
-        return null;
-    }
-}
-function isHttpLoopbackUrl(input) {
-    try {
-        const parsed = new URL(input);
-        return parsed.protocol === 'http:'
-            && (parsed.hostname === '127.0.0.1' || parsed.hostname === '::1');
-    }
-    catch {
-        return false;
-    }
-}

package/dist/core/imagegen/codex-lb-imagegen-target.js

@@ -1,92 +0,0 @@
-import os from 'node:os';
-import path from 'node:path';
-import { readJson, readText } from '../fsx.js';
-import { loadCodexLbEnv } from '../codex-lb/codex-lb-env.js';
-export const CODEX_LB_IMAGEGEN_TARGET_SCHEMA = 'sks.codex-lb-imagegen-target.v1';
-export async function resolveCodexLbImagegenTarget(opts = {}) {
-    const env = opts.env || process.env;
-    const home = opts.home || env.HOME || os.homedir();
-    const codexHome = opts.codexHome || env.CODEX_HOME || path.join(home, '.codex');
-    const configText = typeof opts.configText === 'string'
-        ? opts.configText
-        : await readText(path.join(codexHome, 'config.toml'), '').catch(() => '');
-    const selected = topLevelTomlString(configText, 'model_provider') === 'codex-lb';
-    const authTransport = codexLbAuthTransport(configText);
-    const loaded = await loadCodexLbEnv({
-        home,
-        processEnv: {},
-        envPath: path.join(codexHome, 'sks-codex-lb.env'),
-        metadataPath: path.join(codexHome, 'sks-codex-lb.json')
-    }).catch(() => null);
-    const catalogModels = await readCatalogModels(configText, home, codexHome);
-    const explicit = String(opts.explicitModel || env.SKS_IMAGEGEN_RESPONSES_MODEL || '').trim();
-    const configuredModel = topLevelTomlString(configText, 'model');
-    const { model, model_source } = explicit
-        ? { model: explicit, model_source: 'explicit' }
-        : catalogModels.includes(configuredModel)
-            ? { model: configuredModel, model_source: 'configured_model_in_catalog' }
-            : catalogModels.length
-                ? { model: catalogModels[0], model_source: 'catalog_default' }
-                : { model: null, model_source: null };
-    return {
-        schema: CODEX_LB_IMAGEGEN_TARGET_SCHEMA,
-        selected,
-        base_url: loaded?.base_url || null,
-        api_key: loaded?.secret_api_key || null,
-        api_key_source: loaded?.api_key?.source || null,
-        auth_transport: authTransport,
-        model,
-        model_source,
-        catalog_models: catalogModels,
-        blocker: codexLbImagegenBlocker({ selected, loaded, model })
-    };
-}
-function codexLbAuthTransport(configText) {
-    const provider = String(configText || '').match(/(?:^|\n)\[model_providers\.codex-lb\]([\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/)?.[1] || '';
-    const customHeader = /(?:^|\n)\s*env_http_headers\s*=\s*\{[^}]*"X-Codex-LB-API-Key"\s*=\s*"CODEX_LB_API_KEY"[^}]*\}/.test(provider);
-    const bearerEnvKey = /(?:^|\n)\s*env_key\s*=/.test(provider);
-    return customHeader && !bearerEnvKey ? 'x-codex-lb-api-key' : 'authorization-bearer';
-}
-function codexLbImagegenBlocker(state) {
-    if (!state.selected)
-        return 'codex_lb_not_selected';
-    if (!state.loaded?.base_url)
-        return 'codex_lb_base_url_missing';
-    if (!state.loaded?.secret_api_key)
-        return state.loaded?.missing?.includes('CODEX_LB_CREDENTIAL_BINDING')
-            ? 'codex_lb_credential_binding_invalid'
-            : 'codex_lb_api_key_missing';
-    if (!state.model)
-        return 'codex_lb_imagegen_model_unresolved';
-    return null;
-}
-async function readCatalogModels(configText, home, codexHome) {
-    const configured = topLevelTomlString(configText, 'model_catalog_json');
-    const candidates = [
-        configured ? resolveCatalogPath(configured, home, codexHome) : '',
-        path.join(codexHome, 'sks-codex-lb-tool-catalog.json')
-    ].filter(Boolean);
-    for (const file of candidates) {
-        const payload = await readJson(file, null).catch(() => null);
-        const rows = Array.isArray(payload?.models) ? payload.models : Array.isArray(payload?.data) ? payload.data : [];
-        const slugs = rows
-            .filter((row) => row?.supported_in_api !== false && !hiddenCatalogRow(row))
-            .map((row) => String(row?.slug || row?.id || row?.model || '').trim())
-            .filter(Boolean);
-        if (slugs.length)
-            return [...new Set(slugs)];
-    }
-    return [];
-}
-function resolveCatalogPath(configured, home, codexHome) {
-    const expanded = configured.replace(/^~(?=\/|$)/, home);
-    return path.isAbsolute(expanded) ? expanded : path.resolve(codexHome, expanded);
-}
-function hiddenCatalogRow(row) {
-    return ['hide', 'hidden', 'internal', 'none', 'unavailable'].includes(String(row?.visibility || '').trim().toLowerCase());
-}
-function topLevelTomlString(text, key) {
-    const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
-    const re = new RegExp(`(^|\\n)\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*"([^"]*)"\\s*(?:#.*)?(?=\\n|$)`);
-    return topLevel.match(re)?.[2] || '';
-}

package/dist/native/sks-menubar/Sources/ProvidersConnectTest.swift

@@ -1,118 +0,0 @@
-import Cocoa
-
-extension ProvidersViewController {
-    func makeCliConnectProgressView() -> NSStackView {
-        cliConnectConfigurationStage.setAccessibilityLabel("Codex LB configuration stage: waiting")
-        cliConnectConfigurationStage.setAccessibilityIdentifier("sks-center-codex-lb-configuration-stage")
-        cliConnectRequestStage.setAccessibilityLabel("Codex LB one-request low-token test stage: waiting")
-        cliConnectRequestStage.setAccessibilityIdentifier("sks-center-codex-lb-request-stage")
-        cliConnectResponseStage.setAccessibilityLabel("Codex LB response stage: not received")
-        cliConnectResponseStage.setAccessibilityIdentifier("sks-center-codex-lb-response-stage")
-        cliConnectResult.setAccessibilityLabel("Codex LB connection proof result: not run")
-        cliConnectResult.setAccessibilityIdentifier("sks-center-codex-lb-connect-result")
-        let title = NativeView.sectionTitle("Connection Proof")
-        title.setAccessibilityIdentifier("sks-center-codex-lb-connect-heading")
-        let stack = NSStackView(views: [title, cliConnectProgress, cliConnectConfigurationStage, cliConnectRequestStage, cliConnectResponseStage, cliConnectResult])
-        stack.orientation = .vertical
-        stack.alignment = .width
-        stack.spacing = 6
-        stack.setAccessibilityRole(.group)
-        stack.setAccessibilityLabel("Codex LB connection proof")
-        stack.setAccessibilityIdentifier("sks-center-codex-lb-connect-proof")
-        return stack
-    }
-
-    func renderCliConnectStages(
-        progress: Double,
-        configuration: String,
-        request: String,
-        response: String,
-        result: String,
-        tone: NSColor
-    ) {
-        cliConnectProgress.doubleValue = min(3, max(0, progress))
-        cliConnectProgress.setAccessibilityValue("Stage \(Int(cliConnectProgress.doubleValue)) of 3")
-        cliConnectConfigurationStage.stringValue = "1. Configuration · \(configuration)"
-        cliConnectConfigurationStage.setAccessibilityLabel("Codex LB configuration stage: \(configuration)")
-        cliConnectRequestStage.stringValue = "2. One-request low-token test · \(request)"
-        cliConnectRequestStage.setAccessibilityLabel("Codex LB one-request low-token test stage: \(request)")
-        cliConnectResponseStage.stringValue = "3. Response · \(response)"
-        cliConnectResponseStage.setAccessibilityLabel("Codex LB response stage: \(response)")
-        cliConnectResult.stringValue = result
-        cliConnectResult.textColor = tone
-        cliConnectResult.setAccessibilityLabel("Codex LB connection proof result: \(result)")
-    }
-
-    @objc func testConnection() {
-        runConnectTest()
-    }
-
-    func runConnectTest() {
-        guard !connectTestInFlight else {
-            cliProviderStatus.stringValue = "A Codex LB connection proof is already running."
-            return
-        }
-        guard !busy else { cliProviderStatus.stringValue = "Another provider action is already running."; return }
-        guard let snapshot = operations.begin(kind: "codex-lb-connect-test", mutationGroup: nil, summary: "Run Codex LB connect test") else {
-            cliProviderStatus.stringValue = "Another guarded operation is already running. Wait or open Diagnostics."
-            return
-        }
-        connectTestInFlight = true
-        setBusy(true)
-        cliProviderStatus.stringValue = "Codex LB mode \(codexLbSelectedNow ? "selected" : "selection unconfirmed") · sending one bounded low-token request…"
-        renderCliConnectStages(
-            progress: 2,
-            configuration: codexLbSelectedNow ? "CLI provider selected" : "selection unconfirmed",
-            request: "sending one bounded request…",
-            response: "waiting",
-            result: "Waiting for structured proof. Connectivity has not been claimed.",
-            tone: .secondaryLabelColor
-        )
-        _ = operations.update(snapshot, state: .running, stage: "one-request-low-token-test", progress: 2.0 / 3.0, summary: "Run Codex LB connect test")
-        processClient.run(["codex-lb", "connect-test", "--json"], timeout: NativeView.mutationTimeout) { [weak self] result in
-            guard let self = self else { return }
-            self.connectTestInFlight = false
-            self.setBusy(false)
-            let parsed = self.json(result.output)
-            let proof = parsed.flatMap(CodexLbConnectTestTruth.success(from:))
-            let proved = result.code == 0 && proof != nil
-            _ = self.operations.update(snapshot, state: proved ? .succeeded : .failed, stage: "complete", progress: 1, summary: proved ? "Codex LB connection proved" : "Codex LB connection proof failed")
-            if let proof = proof, result.code == 0 {
-                self.codexLbSelectedNow = true
-                self.codexLbProvedNow = true
-                self.cliProviderStatus.stringValue = "Codex LB mode selected · connection proved by one live response."
-                ControlKit.setBadge(self.activeProviderBadge, text: "Codex LB · active · model \(proof.model) · \(proof.latencyMs) ms", tone: .ok)
-                self.renderCliConnectStages(
-                    progress: 3,
-                    configuration: "CLI provider selected",
-                    request: "completed · \(proof.outputTokens) output tokens",
-                    response: "received · id \(proof.responseId)",
-                    result: proof.renderedSummary,
-                    tone: .systemGreen
-                )
-                return
-            }
-            self.codexLbProvedNow = false
-            let selected = self.codexLbSelectedNow
-            let code = self.publicFailureCode(parsed)
-            let failure = parsed.map(CodexLbConnectTestTruth.validationFailure(from:))
-                ?? "structured connect-test JSON was not returned"
-            self.cliProviderStatus.stringValue = selected
-                ? "Codex LB mode is selected, but connection proof failed · \(code) · \(failure)."
-                : "Codex LB connection proof failed and provider selection is unconfirmed · \(code) · \(failure)."
-            if selected {
-                ControlKit.setBadge(self.activeProviderBadge, text: "Codex LB · selected · \(code) · connection proof failed", tone: .warning)
-            }
-            self.renderCliConnectStages(
-                progress: 3,
-                configuration: selected ? "CLI provider remains selected" : "selection unconfirmed",
-                request: "completed without valid proof",
-                response: "failed",
-                result: selected
-                    ? "\(code) · Mode is selected, but connection proof failed · \(failure). Use Run Connect Test to retry."
-                    : "\(code) · Connection proof failed · \(failure). Confirm the provider, then retry.",
-                tone: .systemRed
-            )
-        }
-    }
-}

package/dist/native/sks-menubar/Sources/ProvidersFastMode.swift

@@ -1,17 +0,0 @@
-import Cocoa
-
-extension ProvidersViewController {
-    func refreshFastStatus() {
-        if !busy { fastStatus.stringValue = "Codex Fast: checking the official service-tier setting…" }
-        processClient.run(["fast-mode", "status", "--json"], timeout: NativeView.statusTimeout) { [weak self] result in
-            guard let self = self else { return }
-            guard result.code == 0, let json = self.json(result.output),
-                  let global = json["global"] as? [String: Any], let on = global["on"] as? Bool else {
-                self.fastStatus.stringValue = "Codex Fast: unavailable — no state was assumed."
-                return
-            }
-            let tier = global["service_tier"] as? String ?? (on ? "fast" : "default")
-            self.fastStatus.stringValue = "Codex Fast: \(on ? "On" : "Off") · official service_tier=\(tier) · model and reasoning remain separate."
-        }
-    }
-}