sneakoscope 8.1.2 → 8.2.0

package/dist/scripts/codex-lb-catalog-passthrough-check.js

@@ -1,120 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import http, {} from 'node:http';
-import os from 'node:os';
-import path from 'node:path';
-import { ensureCodexLbToolCatalog, normalizeCodexLbToolCatalog } from '../core/codex-lb/codex-lb-tool-catalog.js';
-import { assertGate, emitGate } from './gate-lib.js';
-const gatewayKey = 'catalog-gate-secret';
-const sensitiveEcho = 'Bearer catalog-gate-secret-must-not-persist';
-const model = {
-    id: 'future-codex-model',
-    display_name: 'Future Codex',
-    supported_reasoning_levels: [{ effort: 'high', future_effort_field: true }],
-    truncation_policy: { mode: 'tokens', future_policy_field: 17 },
-    use_responses_lite: true,
-    future_unknown_field: {
-        nested: ['preserve', { exactly: true }]
-    },
-    debug_echoed_authorization: sensitiveEcho
-};
-const payload = { models: [model] };
-const normalized = normalizeCodexLbToolCatalog(payload);
-const normalizedRow = normalized.catalog.models[0];
-let observedAuthorization = '';
-let observedPath = '';
-const upstream = http.createServer((request, response) => {
-    observedAuthorization = String(request.headers.authorization || '');
-    observedPath = String(request.url || '');
-    response.writeHead(200, {
-        'content-type': 'application/json',
-        etag: '"catalog-gate-v2"'
-    });
-    response.end(JSON.stringify(payload));
-});
-const upstreamPort = await listen(upstream);
-const temporaryRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-catalog-gate-'));
-let ensured = null;
-let persisted = null;
-let metadata = null;
-try {
-    const home = path.join(temporaryRoot, 'home');
-    const codexHome = path.join(home, '.codex');
-    await fs.mkdir(codexHome, { recursive: true });
-    ensured = await ensureCodexLbToolCatalog({
-        codexHome,
-        baseUrl: `http://127.0.0.1:${upstreamPort}/backend-api/codex`,
-        apiKey: gatewayKey,
-        clientVersion: '0.145.0'
-    });
-    if (ensured.ok) {
-        persisted = JSON.parse(await fs.readFile(ensured.path, 'utf8'));
-        metadata = JSON.parse(await fs.readFile(`${ensured.path}.meta.json`, 'utf8'));
-    }
-}
-finally {
-    await close(upstream);
-    await fs.rm(temporaryRoot, { recursive: true, force: true });
-}
-const persistedRow = Array.isArray(persisted?.models)
-    ? persisted.models[0]
-    : undefined;
-const idToSlug = normalized.ok === true
-    && normalizedRow?.id === model.id
-    && normalizedRow?.slug === model.id;
-const unknownFieldPassthrough = JSON.stringify(normalizedRow?.future_unknown_field) === JSON.stringify(model.future_unknown_field)
-    && JSON.stringify(persistedRow?.future_unknown_field) === JSON.stringify(model.future_unknown_field);
-const fullResponses = normalized.tools_transport === 'full_responses'
-    && normalizedRow?.use_responses_lite === false
-    && persistedRow?.use_responses_lite === false;
-const secretSafe = normalizedRow?.debug_echoed_authorization === undefined
-    && persistedRow?.debug_echoed_authorization === undefined
-    && !JSON.stringify(persisted || {}).includes(gatewayKey)
-    && !JSON.stringify(persisted || {}).includes(sensitiveEcho);
-const fetchedAndBound = ensured?.ok === true
-    && ensured.status === 'repaired'
-    && ensured.identity_verified === true
-    && observedAuthorization === `Bearer ${gatewayKey}`
-    && observedPath === '/backend-api/codex/models'
-    && metadata?.identity?.contract === 'codex-model-catalog-pass-through.v2'
-    && metadata?.unknown_fields_preserved === true
-    && metadata?.upstream_etag === '"catalog-gate-v2"';
-const report = {
-    schema: 'sks.codex-lb-catalog-passthrough-check.v1',
-    ok: idToSlug && unknownFieldPassthrough && fullResponses && secretSafe && fetchedAndBound,
-    id_to_slug: idToSlug,
-    unknown_field_passthrough: unknownFieldPassthrough,
-    full_responses: fullResponses,
-    secret_safe: secretSafe,
-    localhost_fetch_verified: fetchedAndBound,
-    contract: normalized.contract,
-    blockers: [
-        ...(idToSlug ? [] : ['catalog_id_to_slug_failed']),
-        ...(unknownFieldPassthrough ? [] : ['catalog_unknown_field_changed']),
-        ...(fullResponses ? [] : ['catalog_full_responses_not_enforced']),
-        ...(secretSafe ? [] : ['catalog_secret_persisted']),
-        ...(fetchedAndBound ? [] : ['catalog_localhost_fetch_unverified'])
-    ]
-};
-assertGate(report.ok, 'codex-lb catalog pass-through gate failed', report);
-emitGate('codex-lb:catalog-passthrough', {
-    contract: report.contract,
-    id_to_slug: report.id_to_slug,
-    unknown_field_passthrough: report.unknown_field_passthrough,
-    full_responses: report.full_responses,
-    localhost_fetch_verified: report.localhost_fetch_verified
-});
-async function listen(server) {
-    await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', resolve);
-    });
-    return server.address().port;
-}
-async function close(server) {
-    if (!server.listening)
-        return;
-    await new Promise((resolve, reject) => {
-        server.close((error) => error ? reject(error) : resolve());
-    });
-}

package/dist/scripts/codex-lb-desktop-auth-invariant-check.js

@@ -1,169 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { configureCodexLbDesktopRouting } from '../cli/install-helpers.js';
-import { assertDesktopAuthUnchangedBySks, captureCodexAuthSnapshot } from '../core/codex-lb/desktop-auth-invariant.js';
-import { safeWriteCodexConfigToml } from '../core/codex-runtime/codex-desktop-config-policy.js';
-import { assertGate, emitGate } from './gate-lib.js';
-const temporaryRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-desktop-auth-gate-'));
-let report;
-try {
-    report = await runCheck(temporaryRoot);
-}
-finally {
-    await fs.rm(temporaryRoot, { recursive: true, force: true });
-}
-assertGate(report.ok, 'codex-lb Desktop auth invariant gate failed', report);
-emitGate('codex-lb:desktop-auth-invariant', {
-    auth_byte_invariant: report.auth_byte_invariant,
-    auth_invariant_rollback: report.auth_invariant_rollback,
-    conflict_rejected_without_mutation: report.conflict_rejected_without_mutation,
-    rollback_conflict_preserved: report.rollback_conflict_preserved
-});
-async function runCheck(root) {
-    const home = path.join(root, 'home');
-    const codexHome = path.join(home, '.codex');
-    const configPath = path.join(codexHome, 'config.toml');
-    const authPath = path.join(codexHome, 'auth.json');
-    await fs.mkdir(codexHome, { recursive: true });
-    const initialConfig = [
-        'model = "user-owned-model"',
-        'model_reasoning_effort = "high"',
-        'service_tier = "standard"',
-        '',
-        '[features]',
-        'fast_mode = false',
-        ''
-    ].join('\n');
-    const authBytes = Buffer.from([
-        '{',
-        '  "auth_mode": "chatgpt",',
-        '  "account_id": "acct-auth-gate",',
-        '  "tokens": {',
-        '    "access_token": "desktop-oauth-access",',
-        '    "refresh_token": "desktop-oauth-refresh"',
-        '  }',
-        '}',
-        ''
-    ].join('\n'));
-    await fs.writeFile(configPath, initialConfig, { mode: 0o600 });
-    await fs.writeFile(authPath, authBytes, { mode: 0o600 });
-    const before = await captureCodexAuthSnapshot({ home });
-    const configured = await configureCodexLbDesktopRouting({
-        mode: 'desktop-native-bridge',
-        home,
-        bridgeBaseUrl: 'http://127.0.0.1:52145/backend-api/codex',
-        remoteBaseUrl: 'https://lb.example.test/backend-api/codex',
-        gatewayAuthTransport: 'x-codex-lb-api-key'
-    });
-    const after = await captureCodexAuthSnapshot({ home });
-    await assertDesktopAuthUnchangedBySks(before, after);
-    const authAfterBytes = await fs.readFile(authPath);
-    const configuredText = await fs.readFile(configPath, 'utf8');
-    const conflictConfigPath = path.join(codexHome, 'conflict-config.toml');
-    const conflictConfig = [
-        'model_provider = "user-provider"',
-        '',
-        '[model_providers.user-provider]',
-        'name = "user-provider"',
-        'base_url = "https://user.example.test/v1"',
-        'wire_api = "responses"',
-        ''
-    ].join('\n');
-    await fs.writeFile(conflictConfigPath, conflictConfig, { mode: 0o600 });
-    const conflictBeforeAuth = await fs.readFile(authPath);
-    const conflict = await configureCodexLbDesktopRouting({
-        mode: 'desktop-native-bridge',
-        home,
-        configPath: conflictConfigPath,
-        authPath,
-        bridgeBaseUrl: 'http://127.0.0.1:52145/backend-api/codex',
-        remoteBaseUrl: 'https://lb.example.test/backend-api/codex',
-        gatewayAuthTransport: 'x-codex-lb-api-key'
-    });
-    const conflictAfterAuth = await fs.readFile(authPath);
-    const conflictAfterConfig = await fs.readFile(conflictConfigPath, 'utf8');
-    const rollbackHome = path.join(root, 'rollback-home');
-    const rollbackCodexHome = path.join(rollbackHome, '.codex');
-    const rollbackConfigPath = path.join(rollbackCodexHome, 'config.toml');
-    const rollbackAuthPath = path.join(rollbackCodexHome, 'auth.json');
-    const rollbackInitialConfig = 'service_tier = "standard"\n';
-    const rollbackInitialAuth = '{"auth_mode":"chatgpt","account_id":"acct-rollback","tokens":{"access_token":"before"}}\n';
-    const rollbackRotatedAuth = '{"auth_mode":"chatgpt","account_id":"acct-rollback","tokens":{"access_token":"after"}}\n';
-    await fs.mkdir(rollbackCodexHome, { recursive: true });
-    await fs.writeFile(rollbackConfigPath, rollbackInitialConfig, { mode: 0o600 });
-    await fs.writeFile(rollbackAuthPath, rollbackInitialAuth, { mode: 0o600 });
-    const originalReadFile = fs.readFile.bind(fs);
-    const originalWriteFile = fs.writeFile.bind(fs);
-    let rollbackAuthReads = 0;
-    fs.readFile = async (file, ...args) => {
-        if (path.resolve(String(file)) === path.resolve(rollbackAuthPath)) {
-            rollbackAuthReads += 1;
-            if (rollbackAuthReads === 2) {
-                await originalWriteFile(rollbackAuthPath, rollbackRotatedAuth, { mode: 0o600 });
-            }
-        }
-        return originalReadFile(file, ...args);
-    };
-    let invariantRollback;
-    try {
-        invariantRollback = await configureCodexLbDesktopRouting({
-            mode: 'desktop-native-bridge',
-            home: rollbackHome,
-            bridgeBaseUrl: 'http://127.0.0.1:52146/backend-api/codex',
-            remoteBaseUrl: 'https://lb.example.test/backend-api/codex',
-            gatewayAuthTransport: 'x-codex-lb-api-key'
-        });
-    }
-    finally {
-        ;
-        fs.readFile = originalReadFile;
-        fs.writeFile = originalWriteFile;
-    }
-    const invariantRollbackConfig = await fs.readFile(rollbackConfigPath, 'utf8');
-    const invariantRollbackAuth = await fs.readFile(rollbackAuthPath, 'utf8');
-    const concurrentUserEdit = `${configuredText.trimEnd()}\n# concurrent user edit retained\n`;
-    await fs.writeFile(configPath, concurrentUserEdit, { mode: 0o600 });
-    const rollback = await safeWriteCodexConfigToml(configPath, configuredText, initialConfig, 'codex-lb-desktop-routing-auth-invariant-rollback-gate', { verifyUnchangedBeforeWrite: true });
-    const afterRollbackAttempt = await fs.readFile(configPath, 'utf8');
-    const authByteInvariant = configured.ok === true
-        && configured.oauth_preserved === true
-        && configured.auth_mutated === false
-        && before.sha256 !== null
-        && before.sha256 === after.sha256
-        && authAfterBytes.equals(authBytes);
-    const conflictRejectedWithoutMutation = conflict.ok === false
-        && conflict.status === 'failed'
-        && conflict.blockers.includes('desktop_config_conflict')
-        && conflictAfterConfig === conflictConfig
-        && conflictAfterAuth.equals(conflictBeforeAuth);
-    const authInvariantRollback = invariantRollback.ok === false
-        && invariantRollback.blockers.includes('desktop_auth_byte_invariant_failed')
-        && invariantRollback.rollback?.config_restored === true
-        && invariantRollbackConfig === rollbackInitialConfig
-        && invariantRollbackAuth === rollbackRotatedAuth;
-    const rollbackConflictPreserved = rollback.ok === false
-        && rollback.status === 'concurrent_change_detected'
-        && afterRollbackAttempt === concurrentUserEdit;
-    return {
-        schema: 'sks.codex-lb-desktop-auth-invariant-check.v1',
-        ok: authByteInvariant
-            && authInvariantRollback
-            && conflictRejectedWithoutMutation
-            && rollbackConflictPreserved,
-        auth_byte_invariant: authByteInvariant,
-        auth_invariant_rollback: authInvariantRollback,
-        conflict_rejected_without_mutation: conflictRejectedWithoutMutation,
-        rollback_conflict_preserved: rollbackConflictPreserved,
-        routing_status: configured.status,
-        conflict_status: conflict.status,
-        rollback_status: rollback.status,
-        blockers: [
-            ...(authByteInvariant ? [] : ['desktop_auth_bytes_changed']),
-            ...(authInvariantRollback ? [] : ['desktop_auth_invariant_rollback_failed']),
-            ...(conflictRejectedWithoutMutation ? [] : ['desktop_config_conflict_mutated_state']),
-            ...(rollbackConflictPreserved ? [] : ['desktop_rollback_overwrote_concurrent_edit'])
-        ]
-    };
-}

package/dist/scripts/codex-lb-desktop-capabilities-check.js

@@ -1,287 +0,0 @@
-#!/usr/bin/env node
-import { runCodexLbDesktopCapabilityReport, shapeCodexLbDesktopCapabilityStatus } from '../core/codex-lb/capability-runner.js';
-import { assertGate, emitGate } from './gate-lib.js';
-const checkedAt = '2026-07-28T00:00:00.000Z';
-const manifest = {
-    schema_version: 'codex-lb.desktop-capabilities.v1',
-    routes: {
-        responses_http: true,
-        models: true,
-        images_generations: true,
-        realtime_calls: true,
-        files: true,
-        transcribe: true,
-        images_edits: true,
-        thread_goal: true,
-        memories_trace_summarize: true,
-        safety_arc: true,
-        agent_identities_jwks: true
-    },
-    tools: {
-        image_generation: true,
-        computer_use_passthrough: true,
-        web_search: true
-    }
-};
-const catalog = {
-    models: [{
-            id: 'future-codex-model',
-            display_name: 'Future Codex',
-            supported_reasoning_levels: [{ effort: 'high' }],
-            truncation_policy: { mode: 'tokens' },
-            additional_speed_tiers: ['fast'],
-            service_tiers: [{ id: 'priority' }],
-            use_responses_lite: false,
-            future_catalog_field: true
-        }]
-};
-const advertisedOnly = runCodexLbDesktopCapabilityReport({
-    mode: 'desktop-native-bridge',
-    level: 'shallow',
-    configured: true,
-    oauthPreserved: true,
-    checkedAt,
-    manifest,
-    gatewayAuth: {
-        transport: 'x-codex-lb-api-key',
-        configured: true,
-        observed: false
-    },
-    providerIdentity: {
-        configured: true,
-        source: 'config'
-    },
-    browserUse: {
-        advertised: true,
-        source: 'manifest'
-    },
-    plugins: {
-        advertised: true,
-        source: 'manifest'
-    }
-});
-const advertisedStatus = shapeCodexLbDesktopCapabilityStatus(advertisedOnly);
-const fixtureOnly = runCodexLbDesktopCapabilityReport({
-    mode: 'desktop-native-bridge',
-    level: 'deep',
-    configured: true,
-    oauthPreserved: true,
-    checkedAt,
-    manifest,
-    gatewayAuth: {
-        transport: 'x-codex-lb-api-key',
-        configured: true,
-        observed: true,
-        fixture: true
-    },
-    providerIdentity: {
-        verified: true,
-        fixture: true,
-        source: 'transport'
-    },
-    bridge: {
-        configured: true,
-        processRunning: true,
-        transportAttempted: true,
-        httpRoundTrip: true,
-        websocketRoundTrip: true,
-        fixture: true
-    },
-    catalog: {
-        catalog,
-        configuredServiceTier: 'fast',
-        pickerControlVisible: true,
-        pickerSelectedModel: 'future-codex-model',
-        requestServiceTier: 'fast',
-        responseActualServiceTier: 'priority',
-        fixture: true
-    },
-    imageGeneration: {
-        attempted: true,
-        requestToolsPresent: true,
-        events: [{ type: 'response.image_generation_call.completed' }],
-        artifactMaterialized: true,
-        fixture: true
-    },
-    computerUse: {
-        attempted: true,
-        events: [{ type: 'response.computer_call.created' }],
-        localExecutorCompleted: true,
-        outputSubmitted: true,
-        followUpCompleted: true,
-        sessionAffinityPreserved: true,
-        fixture: true
-    },
-    browserUse: {
-        verified: true,
-        fixture: true,
-        source: 'deep_probe'
-    },
-    voiceMode: {
-        attempted: true,
-        createRouteVerified: true,
-        locationReceived: true,
-        locationRewritten: true,
-        websocketUpgraded: true,
-        serverEventSeen: true,
-        cleanClose: true,
-        ownerBindingVerified: true,
-        fixture: true
-    },
-    plugins: {
-        verified: true,
-        fixture: true,
-        source: 'deep_probe'
-    },
-    auxiliarySurfaces: {
-        attempted: true,
-        inputEvents: [{ type: 'future.desktop.event', payload: { keep: true } }],
-        outputEvents: [{ type: 'future.desktop.event', payload: { keep: true } }],
-        requestBodyHashPreserved: true,
-        sessionAffinityPreserved: true,
-        fixture: true
-    }
-});
-const fixtureStatus = shapeCodexLbDesktopCapabilityStatus(fixtureOnly);
-const textOnly = runCodexLbDesktopCapabilityReport({
-    mode: 'cli-provider',
-    level: 'transport',
-    configured: true,
-    oauthPreserved: false,
-    checkedAt,
-    manifest,
-    textResponses: {
-        attempted: true,
-        verified: true,
-        source: 'transport',
-        evidence: { response_completed: true }
-    },
-    browserUse: {
-        advertised: true,
-        source: 'manifest'
-    },
-    plugins: {
-        advertised: true,
-        source: 'manifest'
-    }
-});
-const authIndependentBase = {
-    mode: 'cli-provider',
-    level: 'shallow',
-    configured: true,
-    checkedAt,
-    manifest,
-    gatewayAuth: {
-        transport: 'x-codex-lb-api-key',
-        configured: true,
-        observed: false
-    },
-    providerIdentity: {
-        requiresOauth: true,
-        configured: true
-    },
-    catalog: {
-        catalog,
-        configuredServiceTier: 'fast'
-    },
-    browserUse: {
-        advertised: true,
-        source: 'manifest'
-    },
-    plugins: {
-        advertised: true,
-        source: 'manifest'
-    }
-};
-const oauthAvailable = runCodexLbDesktopCapabilityReport({
-    ...authIndependentBase,
-    oauthPreserved: true
-});
-const oauthMissing = runCodexLbDesktopCapabilityReport({
-    ...authIndependentBase,
-    oauthPreserved: false
-});
-const fixtureVerifiableKeys = [
-    'gateway_auth_transport',
-    'provider_identity',
-    'bridge',
-    'catalog',
-    'model_picker',
-    'fast_mode',
-    'image_generation',
-    'computer_use',
-    'browser_use',
-    'voice_mode',
-    'plugins',
-    'auxiliary_surfaces'
-];
-const authIndependentKeys = [
-    'gateway_auth_transport',
-    'catalog',
-    'model_picker',
-    'fast_mode',
-    'image_generation',
-    'computer_use',
-    'browser_use',
-    'voice_mode',
-    'plugins',
-    'auxiliary_surfaces'
-];
-const textIndependentKeys = [
-    'image_generation',
-    'computer_use',
-    'browser_use',
-    'voice_mode',
-    'plugins',
-    'auxiliary_surfaces'
-];
-const advertisedNotVerified = advertisedStatus.ready === false
-    && advertisedOnly.overall === 'available_unverified'
-    && capabilityEntries(advertisedOnly).every(([, evidence]) => evidence.state !== 'verified');
-const fixtureNotVerified = fixtureStatus.ready === false
-    && fixtureOnly.overall === 'available_unverified'
-    && fixtureVerifiableKeys.every((key) => fixtureOnly[key].state === 'available_unverified');
-const textDoesNotPromoteOtherCapabilities = textOnly.text_responses.state === 'verified'
-    && textIndependentKeys.every((key) => textOnly[key].state !== 'verified');
-const independentFromAuthMode = oauthAvailable.provider_identity.state === 'available_unverified'
-    && oauthMissing.provider_identity.state === 'blocked'
-    && authIndependentKeys.every((key) => (oauthAvailable[key].state === oauthMissing[key].state
-        && JSON.stringify(oauthAvailable[key].blockers) === JSON.stringify(oauthMissing[key].blockers)));
-const report = {
-    schema: 'sks.codex-lb-desktop-capabilities-check.v1',
-    ok: advertisedNotVerified
-        && fixtureNotVerified
-        && textDoesNotPromoteOtherCapabilities
-        && independentFromAuthMode,
-    advertised_not_verified: advertisedNotVerified,
-    fixture_not_verified: fixtureNotVerified,
-    text_does_not_promote_other_capabilities: textDoesNotPromoteOtherCapabilities,
-    independent_from_auth_mode: independentFromAuthMode,
-    states: {
-        advertised_only: advertisedOnly.overall,
-        fixture_only: fixtureOnly.overall,
-        text_only: textOnly.overall,
-        oauth_available_provider_identity: oauthAvailable.provider_identity.state,
-        oauth_missing_provider_identity: oauthMissing.provider_identity.state
-    },
-    blockers: [
-        ...(advertisedNotVerified ? [] : ['manifest_or_config_promoted_to_verified']),
-        ...(fixtureNotVerified ? [] : ['fixture_evidence_promoted_to_verified']),
-        ...(textDoesNotPromoteOtherCapabilities ? [] : ['text_response_evidence_promoted_other_capability']),
-        ...(independentFromAuthMode ? [] : ['independent_capability_changed_with_auth_mode'])
-    ]
-};
-assertGate(report.ok, 'codex-lb Desktop capability evidence gate failed', report);
-emitGate('codex-lb:desktop-capabilities', {
-    advertised_not_verified: report.advertised_not_verified,
-    fixture_not_verified: report.fixture_not_verified,
-    text_does_not_promote_other_capabilities: report.text_does_not_promote_other_capabilities,
-    independent_from_auth_mode: report.independent_from_auth_mode
-});
-function capabilityEntries(report) {
-    return Object.entries(report)
-        .filter((entry) => {
-        const value = entry[1];
-        return Boolean(value && typeof value === 'object' && 'state' in value && 'evidence' in value);
-    });
-}