sneakoscope 8.1.2 → 8.2.0

package/dist/scripts/codex-lb-desktop-real-evidence-check.js

@@ -1,123 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { writeJsonAtomic } from '../core/fsx.js';
-import { codexLbDesktopStatusV2, readCodexLbDesktopDeepEvidence, readCodexLbDesktopDeepEvidenceTrustAnchors } from '../core/codex-lb/desktop-controller.js';
-import { CODEX_LB_DESKTOP_REAL_EVIDENCE_CHECK_SCHEMA, validateCodexLbDesktopRealEvidence } from '../core/codex-lb/desktop-real-evidence.js';
-import { uniqueValues as unique } from '../core/text/strings.js';
-const args = process.argv.slice(2);
-const evidencePath = readArg('--evidence')
-    || process.env.SKS_CODEX_LB_DESKTOP_REAL_EVIDENCE_PATH
-    || null;
-const trustAnchorsPath = readArg('--trust-anchors')
-    || process.env.SKS_CODEX_LB_DESKTOP_REAL_EVIDENCE_TRUST_ANCHORS_PATH
-    || null;
-const home = readArg('--home') || process.env.HOME || null;
-const maxAgeMs = positiveNumber(readArg('--max-age-ms') || process.env.SKS_CODEX_LB_DESKTOP_REAL_EVIDENCE_MAX_AGE_MS);
-const reportPath = path.join(process.cwd(), '.sneakoscope', 'reports', 'codex-lb-desktop-real-evidence-check.json');
-const blockers = [];
-let status = null;
-let result;
-try {
-    status = await codexLbDesktopStatusV2({
-        ...(home ? { home } : {}),
-        networkProbes: false
-    });
-    const mode = String(status.mode || 'disabled');
-    const bridge = asRecord(status.bridge);
-    const endpoint = loopbackCodexEndpoint(bridge.listen_origin);
-    if (mode !== 'desktop-native-bridge')
-        blockers.push('codex_lb_desktop_real_evidence_native_mode_required');
-    if (!endpoint)
-        blockers.push('codex_lb_desktop_real_evidence_loopback_endpoint_missing');
-    if (!evidencePath)
-        blockers.push('codex_lb_desktop_real_evidence_path_missing');
-    if (!trustAnchorsPath)
-        blockers.push('codex_lb_desktop_real_evidence_trust_anchors_path_missing');
-    if (blockers.length || !evidencePath || !trustAnchorsPath || !endpoint) {
-        result = missingResult(mode, endpoint, blockers);
-    }
-    else {
-        const [evidence, trustAnchors] = await Promise.all([
-            readCodexLbDesktopDeepEvidence(evidencePath),
-            readCodexLbDesktopDeepEvidenceTrustAnchors(trustAnchorsPath)
-        ]);
-        result = validateCodexLbDesktopRealEvidence(evidence, {
-            expectedMode: 'desktop-native-bridge',
-            expectedEndpoint: endpoint,
-            trustAnchors,
-            ...(maxAgeMs ? { maxAgeMs } : {})
-        });
-    }
-}
-catch (error) {
-    result = missingResult(String(status?.mode || 'disabled'), loopbackCodexEndpoint(asRecord(status?.bridge).listen_origin), [safeError(error)]);
-}
-const report = {
-    ...result,
-    evidence_path: evidencePath ? path.resolve(evidencePath) : null,
-    trust_anchors_path: trustAnchorsPath ? path.resolve(trustAnchorsPath) : null,
-    actual_status: {
-        mode: status?.mode || null,
-        bridge_running: asRecord(status?.bridge).running === true,
-        oauth_present: asRecord(status?.oauth).present === true,
-        built_in_provider_retained: asRecord(status?.provider).built_in === true
-    },
-    report_path: path.relative(process.cwd(), reportPath).split(path.sep).join('/')
-};
-await writeJsonAtomic(reportPath, report);
-console.log(JSON.stringify(report, null, 2));
-if (report.ok !== true)
-    process.exitCode = 1;
-function missingResult(mode, endpoint, reasons) {
-    return {
-        schema: CODEX_LB_DESKTOP_REAL_EVIDENCE_CHECK_SCHEMA,
-        ok: false,
-        status: 'real_required_missing',
-        release_authorizing: false,
-        mode,
-        endpoint,
-        producer_id: null,
-        deep_evidence_validation: null,
-        required_true_fields: [],
-        required_string_fields: [],
-        required_array_fields: [],
-        verified_fields: [],
-        blockers: unique(reasons.length ? reasons : ['codex_lb_desktop_real_evidence_missing']),
-        warnings: []
-    };
-}
-function loopbackCodexEndpoint(value) {
-    try {
-        const origin = new URL(String(value || ''));
-        if (origin.protocol !== 'http:'
-            || !['127.0.0.1', '::1'].includes(origin.hostname)
-            || origin.username
-            || origin.password
-            || origin.search
-            || origin.hash)
-            return null;
-        return new URL('/backend-api/codex', origin).toString().replace(/\/+$/, '');
-    }
-    catch {
-        return null;
-    }
-}
-function readArg(name) {
-    const index = args.indexOf(name);
-    return index >= 0 && args[index + 1] ? String(args[index + 1]) : null;
-}
-function positiveNumber(value) {
-    const parsed = Number(value);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
-}
-function asRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
-}
-function safeError(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return /^[a-z0-9_:-]+$/i.test(message)
-        ? message
-        : 'codex_lb_desktop_real_evidence_check_failed';
-}

package/dist/scripts/codex-lb-fast-mode-truth-check.js

@@ -1,114 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { run } from '../commands/codex-lb.js';
-import { CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
-const calls = [];
-const home = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-fast-truth-'));
-await fs.mkdir(path.join(home, '.codex'), { recursive: true });
-await fs.writeFile(path.join(home, '.codex', 'config.toml'), [
-    'model = "gpt-5.6-sol"',
-    'model_provider = "codex-lb"',
-    'service_tier = "fast"',
-    '',
-    '[model_providers.codex-lb]',
-    'name = "codex-lb"',
-    'base_url = "https://lb.example.test/backend-api/codex"',
-    'wire_api = "responses"',
-    'env_key = "CODEX_LB_API_KEY"',
-    'supports_websockets = true',
-    'requires_openai_auth = false',
-    ''
-].join('\n'));
-await fs.writeFile(path.join(home, '.codex', 'auth.json'), `${JSON.stringify({
-    auth_mode: 'chatgpt',
-    account_id: 'acct-fast-truth',
-    tokens: {
-        access_token: 'oauth-fast-truth',
-        refresh_token: 'refresh-fast-truth'
-    }
-})}\n`);
-await fs.writeFile(path.join(home, '.codex', 'sks-codex-lb.env'), "export CODEX_LB_BASE_URL='https://lb.example.test/backend-api/codex'\nexport CODEX_LB_API_KEY='sk-fixture'\n", { mode: 0o600 });
-const chain = await runFastCheck({
-    HOME: home,
-    CODEX_LB_API_KEY: 'sk-fixture',
-    CODEX_LB_BASE_URL: 'https://lb.example.test/backend-api/codex'
-});
-const requestedOnly = await runFastCheck({
-    HOME: home,
-    CODEX_LB_API_KEY: 'sk-fixture',
-    CODEX_LB_BASE_URL: 'https://lb.example.test/backend-api/codex',
-    SKS_TEST_FAST_ACTUAL_DEFAULT: '1'
-});
-const ok = chain.ok === true
-    && chain.status === 'fast_verified'
-    && calls[0]?.body?.service_tier === 'priority'
-    && calls.every((call) => call.authorization === 'Bearer sk-fixture' && call.gatewayKey === null)
-    && requestedOnly.ok === false
-    && requestedOnly.status === 'fast_requested_but_actual_unverified'
-    && requestedOnly.blockers.includes('codex_lb_actual_fast_service_tier_unverified');
-console.log(JSON.stringify({
-    schema: 'sks.codex-lb-fast-mode-truth-check.v1',
-    ok,
-    priority_request_sent: calls[0]?.body?.service_tier === 'priority',
-    bearer_transport_verified: calls.every((call) => call.authorization === 'Bearer sk-fixture' && call.gatewayKey === null),
-    verified_case: chain,
-    requested_only_case: requestedOnly,
-    blockers: ok ? [] : ['codex_lb_fast_mode_truth_check_failed']
-}, null, 2));
-if (!ok)
-    process.exitCode = 1;
-async function runFastCheck(env) {
-    const originalFetch = globalThis.fetch;
-    const originalEnv = { ...process.env };
-    const outputs = [];
-    const originalWrite = process.stdout.write.bind(process.stdout);
-    const originalExitCode = process.exitCode;
-    try {
-        Object.assign(process.env, env);
-        process.exitCode = 0;
-        globalThis.fetch = async (url, init = {}) => {
-            if (new URL(String(url)).pathname === '/health') {
-                return new Response('{}', {
-                    status: 200,
-                    headers: {
-                        'content-type': 'application/json',
-                        'x-app-version': CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION
-                    }
-                });
-            }
-            const body = JSON.parse(String(init.body || '{}'));
-            const headers = new Headers(init.headers);
-            calls.push({
-                body,
-                authorization: headers.get('authorization'),
-                gatewayKey: headers.get('x-codex-lb-api-key')
-            });
-            const id = calls.length % 2 === 1 ? 'resp_fast_1' : 'resp_fast_2';
-            const actual = env.SKS_TEST_FAST_ACTUAL_DEFAULT === '1' ? 'default' : 'priority';
-            return new Response(JSON.stringify({
-                id,
-                requestedServiceTier: 'priority',
-                actualServiceTier: actual,
-                serviceTier: actual
-            }), { status: 200, headers: { 'content-type': 'application/json' } });
-        };
-        process.stdout.write = (chunk) => {
-            outputs.push(String(chunk));
-            return true;
-        };
-        await run(null, ['fast-check', '--json']);
-        return JSON.parse(outputs.join('') || '{}');
-    }
-    finally {
-        globalThis.fetch = originalFetch;
-        process.stdout.write = originalWrite;
-        process.exitCode = originalExitCode;
-        for (const key of Object.keys(process.env)) {
-            if (!(key in originalEnv))
-                delete process.env[key];
-        }
-        Object.assign(process.env, originalEnv);
-    }
-}

package/dist/scripts/codex-lb-fast-ui-preservation-check.js

@@ -1,152 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { codexLbConfigPath, codexLbEnvPath, configureCodexLbDesktopRouting, ensureGlobalCodexFastModeDuringInstall, repairCodexLbAuth } from '../cli/install-helpers.js';
-import { escapeRegExp } from '../core/text/regex.js';
-const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-fast-ui-'));
-const home = path.join(tmp, 'home');
-const codexHome = path.join(home, '.codex');
-const configPath = codexLbConfigPath(home);
-const envPath = codexLbEnvPath(home);
-const authPath = path.join(codexHome, 'auth.json');
-const remoteBaseUrl = 'https://lb.example.test/backend-api/codex';
-const bridgeBaseUrl = 'http://127.0.0.1:54321/backend-api/codex';
-await fs.mkdir(codexHome, { recursive: true });
-const oauthAuth = `${JSON.stringify({
-    auth_mode: 'chatgpt',
-    tokens: {
-        id_token: 'oauth-id',
-        access_token: 'oauth-access',
-        refresh_token: 'oauth-refresh'
-    },
-    account_id: 'acct-fast-ui-fixture'
-}, null, 2)}\n`;
-await fs.writeFile(configPath, [
-    'model = "future-codex-model"',
-    'model_reasoning_effort = "low"',
-    'service_tier = "fast"',
-    '# sks-codex-lb-managed-desktop-bridge',
-    `openai_base_url = "${bridgeBaseUrl}"`,
-    '',
-    '[features]',
-    'fast_mode = true',
-    'fast_mode_ui = true',
-    '',
-    '[user.fast_mode]',
-    'visible = true',
-    'enabled = true',
-    '',
-    '[model_providers.codex-lb]',
-    'name = "codex-lb"',
-    `base_url = "${remoteBaseUrl}"`,
-    'wire_api = "responses"',
-    'env_key = "CODEX_LB_API_KEY"',
-    'supports_websockets = true',
-    'requires_openai_auth = false',
-    ''
-].join('\n'));
-await fs.writeFile(envPath, `export CODEX_LB_BASE_URL="${remoteBaseUrl}"\nexport CODEX_LB_API_KEY="sk-test-fast-ui"\n`, { mode: 0o600 });
-await fs.writeFile(authPath, oauthAuth);
-const install = await ensureGlobalCodexFastModeDuringInstall({
-    home,
-    configPath,
-    forceFastMode: true
-});
-const firstRepair = await repairCodexLbAuth({
-    home,
-    configPath,
-    envPath,
-    forceCodexLbApiKeyAuth: true,
-    forceFastMode: true,
-    authMode: 'codex-lb'
-});
-const firstConfig = await fs.readFile(configPath, 'utf8');
-const firstAuth = await fs.readFile(authPath, 'utf8');
-const firstAssert = assertConfig(firstConfig, 'native_repair');
-const disabled = await configureCodexLbDesktopRouting({
-    mode: 'disabled',
-    home,
-    configPath,
-    authPath
-});
-const disabledConfig = await fs.readFile(configPath, 'utf8');
-const disabledAuth = await fs.readFile(authPath, 'utf8');
-const disableAssert = assertConfig(disabledConfig, 'routing_disabled', {
-    expectBridge: false
-});
-const reenabled = await configureCodexLbDesktopRouting({
-    mode: 'desktop-native-bridge',
-    home,
-    configPath,
-    authPath,
-    bridgeBaseUrl,
-    remoteBaseUrl,
-    gatewayAuthTransport: 'x-codex-lb-api-key'
-});
-const reenabledConfig = await fs.readFile(configPath, 'utf8');
-const reenabledAuth = await fs.readFile(authPath, 'utf8');
-const reenableAssert = assertConfig(reenabledConfig, 'native_reenabled');
-const authPreserved = [firstAuth, disabledAuth, reenabledAuth]
-    .every((value) => value === oauthAuth);
-const report = {
-    schema: 'sks.codex-lb-fast-ui-preservation-check.v2',
-    ok: firstRepair.ok === true
-        && disabled.ok === true
-        && reenabled.ok === true
-        && authPreserved
-        && firstAssert.ok
-        && disableAssert.ok
-        && reenableAssert.ok,
-    install_status: install.status,
-    first_repair_status: firstRepair.status,
-    disable_status: disabled.status,
-    reenable_status: reenabled.status,
-    oauth_preserved: authPreserved,
-    assertions: [firstAssert, disableAssert, reenableAssert],
-    config_path: configPath,
-    blockers: [
-        ...(authPreserved ? [] : ['chatgpt_oauth_changed_during_routing_or_fast_repair']),
-        ...firstAssert.blockers,
-        ...disableAssert.blockers,
-        ...reenableAssert.blockers
-    ]
-};
-console.log(JSON.stringify(report, null, 2));
-if (!report.ok)
-    process.exitCode = 1;
-function assertConfig(text, label, options = {}) {
-    const expectBridge = options.expectBridge !== false;
-    const blockers = [
-        ...(hasLegacyFastModeTables(text) ? ['legacy_fast_mode_tables_present'] : []),
-        ...(tableKey(text, 'features', 'fast_mode') === 'true' ? [] : ['features_fast_mode_not_true']),
-        ...(tableKey(text, 'features', 'fast_mode_ui') ? ['features_fast_mode_ui_legacy_flag_present'] : []),
-        ...(hasTable(text, 'model_providers.codex-lb') ? [] : ['codex_lb_provider_table_missing']),
-        ...(tableKey(text, 'model_providers.codex-lb', 'name') === 'codex-lb' ? [] : ['cli_provider_name_not_codex_lb']),
-        ...(tableKey(text, 'model_providers.codex-lb', 'requires_openai_auth') === 'false' ? [] : ['cli_provider_requires_openai_auth_not_false']),
-        ...(tableKey(text, 'model_providers.codex-lb', 'env_key') === 'CODEX_LB_API_KEY'
-            ? []
-            : ['cli_provider_env_key_missing']),
-        ...(topLevelKey(text, 'model_provider') === 'openai' ? [] : ['desktop_model_provider_must_be_openai']),
-        ...(expectBridge && topLevelKey(text, 'openai_base_url') !== bridgeBaseUrl ? ['native_bridge_base_url_missing'] : []),
-        ...(!expectBridge && topLevelKey(text, 'openai_base_url') ? ['disabled_routing_still_has_openai_base_url'] : []),
-        ...(topLevelKey(text, 'model') === 'future-codex-model' ? [] : ['user_model_not_preserved']),
-        ...(topLevelKey(text, 'model_reasoning_effort') === 'low' ? [] : ['user_reasoning_effort_not_preserved'])
-    ];
-    return { label, ok: blockers.length === 0, blockers };
-}
-function hasLegacyFastModeTables(text) {
-    return hasTable(text, 'user.fast_mode') || hasTable(text, 'profiles.sks-fast-high');
-}
-function hasTable(text, table) {
-    return new RegExp(`(^|\\n)\\[${escapeRegExp(table)}\\](?=\\n|$)`).test(text);
-}
-function tableKey(text, table, key) {
-    const match = text.match(new RegExp(`(^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`));
-    const block = match?.[2] || '';
-    return block.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*([^\\n#]+)`))?.[2]?.trim().replace(/^"|"$/g, '') || '';
-}
-function topLevelKey(text, key) {
-    const top = text.split(/\n\s*\[/)[0] || '';
-    return top.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*([^\\n#]+)`))?.[2]?.trim().replace(/^"|"$/g, '') || '';
-}

package/dist/scripts/codex-lb-gpt56-fast-profile-check.js

@@ -1,231 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { codexFastModeDesktopStatus, codexLbConfigPath, configureCodexLb, configureCodexLbDesktopRouting, ensureGlobalCodexFastModeDuringInstall, repairCodexLbAuth } from '../cli/install-helpers.js';
-import { repairCodexConfigStructure, splitCodexProjectConfigPolicy } from '../core/codex/codex-project-config-policy.js';
-import { parseCodexConfigToml, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
-import { CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
-import { normalizeCodexLbToolCatalog } from '../core/codex-lb/codex-lb-tool-catalog.js';
-const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-gpt56-fast-'));
-const home = path.join(tmp, 'home');
-const root = path.join(tmp, 'project');
-const codexHome = path.join(home, '.codex');
-const configPath = codexLbConfigPath(home);
-const envPath = path.join(codexHome, 'sks-codex-lb.env');
-const authPath = path.join(codexHome, 'auth.json');
-const projectConfig = path.join(root, '.codex', 'config.toml');
-const remoteBaseUrl = 'https://lb.example.test/backend-api/codex';
-const bridgeBaseUrl = 'http://127.0.0.1:54321/backend-api/codex';
-await fs.mkdir(path.dirname(projectConfig), { recursive: true });
-await fs.mkdir(codexHome, { recursive: true });
-const oauth = `${JSON.stringify({
-    auth_mode: 'chatgpt',
-    account_id: 'acct-fast-profile',
-    tokens: {
-        access_token: 'oauth-access',
-        refresh_token: 'oauth-refresh'
-    }
-}, null, 2)}\n`;
-await fs.writeFile(authPath, oauth);
-const setup = await configureCodexLb({
-    home,
-    configPath,
-    envPath,
-    host: remoteBaseUrl,
-    apiKey: 'fixture-codex-lb-fast-key',
-    writeEnvFile: true,
-    shellProfile: 'skip',
-    gatewayAuthTransport: 'x-codex-lb-api-key',
-    toolOutputRecoveryFetch
-});
-const native = await configureCodexLbDesktopRouting({
-    mode: 'desktop-native-bridge',
-    home,
-    configPath,
-    authPath,
-    bridgeBaseUrl,
-    remoteBaseUrl,
-    gatewayAuthTransport: 'x-codex-lb-api-key'
-});
-const fastOn = await ensureGlobalCodexFastModeDuringInstall({
-    home,
-    configPath,
-    forceFastMode: true
-});
-const first = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'native_fast_on');
-const disabled = await configureCodexLbDesktopRouting({
-    mode: 'disabled',
-    home,
-    configPath,
-    authPath
-});
-const afterDisable = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'routing_disabled', false);
-const reenabled = await configureCodexLbDesktopRouting({
-    mode: 'desktop-native-bridge',
-    home,
-    configPath,
-    authPath,
-    bridgeBaseUrl,
-    remoteBaseUrl,
-    gatewayAuthTransport: 'x-codex-lb-api-key'
-});
-const repair = await repairCodexLbAuth({
-    home,
-    configPath,
-    envPath,
-    forceCodexLbApiKeyAuth: true,
-    forceFastMode: true,
-    authMode: 'codex-lb'
-});
-await fs.writeFile(projectConfig, [
-    '# SKS managed fixture',
-    'default_profile = "sks-fast-high"',
-    'service_tier = "fast"',
-    '',
-    '[user.fast_mode]',
-    'visible = true',
-    'enabled = true',
-    '',
-    '[profiles.sks-fast-high]',
-    'model = "future-codex-model"',
-    'service_tier = "fast"',
-    ''
-].join('\n'));
-const split = await splitCodexProjectConfigPolicy(root, {
-    apply: true,
-    codexHome,
-    configPath: projectConfig,
-    writeReport: false
-});
-const structure = await repairCodexConfigStructure(configPath, { apply: true });
-const final = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'after_rewriters');
-const toolCatalog = assertGpt56ToolCatalogContract();
-const authPreserved = await fs.readFile(authPath, 'utf8') === oauth;
-const ok = setup.ok === true
-    && native.ok === true
-    && disabled.ok === true
-    && reenabled.ok === true
-    && !['failed', 'skipped_unsafe_rewrite', 'unparseable_config_preserved'].includes(String(fastOn.status))
-    && repair.ok === true
-    && split.ok === true
-    && structure.ok === true
-    && authPreserved
-    && first.ok
-    && afterDisable.ok
-    && final.ok
-    && toolCatalog.ok;
-const report = {
-    schema: 'sks.codex-lb-gpt56-fast-profile-check.v2',
-    ok,
-    setup_status: setup.status,
-    native_status: native.status,
-    fast_on_status: fastOn.status,
-    disable_status: disabled.status,
-    reenable_status: reenabled.status,
-    repair_status: repair.status,
-    split_status: split.status || null,
-    structure_status: structure.status,
-    oauth_preserved: authPreserved,
-    assertions: [first, afterDisable, final],
-    tool_catalog: toolCatalog,
-    blockers: [
-        ...(authPreserved ? [] : ['chatgpt_oauth_changed']),
-        ...[first, afterDisable, final].flatMap((item) => item.blockers),
-        ...toolCatalog.blockers
-    ]
-};
-console.log(JSON.stringify(report, null, 2));
-if (!report.ok)
-    process.exitCode = 1;
-function assertFastProfile(text, label, expectBridge = true) {
-    const validation = validateCodexConfigRoundTrip(text);
-    const parsed = validation.ok ? parseCodexConfigToml(text) : {};
-    const provider = parsed.model_providers?.['codex-lb'] || {};
-    const desktop = codexFastModeDesktopStatus(text);
-    const blockers = [
-        ...validation.blockers,
-        ...(parsed.default_profile === undefined ? [] : ['default_profile_legacy_key_present']),
-        ...(parsed.user?.fast_mode === undefined ? [] : ['user_fast_mode_legacy_table_present']),
-        ...(parsed.profiles?.['sks-fast-high'] === undefined ? [] : ['sks_fast_high_legacy_profile_present']),
-        ...(parsed.model === undefined ? [] : ['codex_app_model_was_injected']),
-        ...(parsed.model_provider === 'openai' ? [] : ['desktop_model_provider_must_be_openai']),
-        ...(provider.name === 'codex-lb' ? [] : ['codex_lb_cli_provider_name_mismatch']),
-        ...(provider.requires_openai_auth === false ? [] : ['codex_lb_cli_requires_openai_auth_not_false']),
-        ...(provider.env_key === 'CODEX_LB_API_KEY'
-            ? []
-            : ['codex_lb_cli_env_key_missing']),
-        ...(provider.wire_api === 'responses' ? [] : ['codex_lb_wire_api_not_responses']),
-        ...(expectBridge && parsed.openai_base_url === bridgeBaseUrl ? [] : expectBridge ? ['native_bridge_base_url_missing'] : []),
-        ...(!expectBridge && parsed.openai_base_url !== undefined ? ['disabled_routing_still_has_openai_base_url'] : []),
-        ...(parsed.model_catalog_json === undefined ? [] : ['native_local_catalog_must_not_be_bound']),
-        ...(desktop.on ? [] : ['desktop_fast_status_off'])
-    ];
-    return {
-        label,
-        ok: blockers.length === 0,
-        default_profile: parsed.default_profile || null,
-        model: parsed.model || null,
-        model_provider: parsed.model_provider || null,
-        openai_base_url: parsed.openai_base_url || null,
-        legacy_keys: validation.legacy_keys,
-        service_tier: parsed.service_tier || null,
-        provider_name: provider.name || null,
-        provider_wire_api: provider.wire_api || null,
-        provider_requires_openai_auth: provider.requires_openai_auth ?? null,
-        blockers
-    };
-}
-function assertGpt56ToolCatalogContract() {
-    const normalized = normalizeCodexLbToolCatalog({
-        models: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'].map(codexModel)
-    });
-    const models = normalized.catalog.models.filter((model) => String(model.slug).startsWith('gpt-5.6-'));
-    const blockers = [
-        ...normalized.blockers,
-        ...(normalized.schema === 'sks.codex-lb-tool-catalog.v1' ? [] : ['codex_lb_gpt56_catalog_schema_mismatch']),
-        ...(normalized.contract === 'codex-model-catalog-pass-through.v2' ? [] : ['codex_lb_catalog_contract_not_v2']),
-        ...(normalized.tools_transport === 'full_responses' ? [] : ['codex_lb_gpt56_native_tool_transport_not_full_responses']),
-        ...(normalized.patched_models.join(',') === 'gpt-5.6-luna,gpt-5.6-sol,gpt-5.6-terra' ? [] : ['codex_lb_gpt56_catalog_patch_set_incomplete']),
-        ...(models.length === 3 ? [] : ['codex_lb_gpt56_catalog_model_set_incomplete']),
-        ...(models.every((model) => model.use_responses_lite === false) ? [] : ['codex_lb_gpt56_responses_lite_not_disabled']),
-        ...(models.every((model) => model.future_unknown_field === 'preserved') ? [] : ['codex_lb_unknown_catalog_field_lost'])
-    ];
-    return {
-        ok: blockers.length === 0,
-        contract: normalized.contract,
-        tools_transport: normalized.tools_transport,
-        patched_models: normalized.patched_models,
-        blockers
-    };
-}
-function codexModel(slug) {
-    return {
-        slug,
-        display_name: slug,
-        supported_reasoning_levels: [{ effort: 'medium', description: 'Balanced' }],
-        shell_type: 'shell_command',
-        visibility: 'list',
-        supported_in_api: true,
-        priority: 1,
-        base_instructions: 'You are Codex.',
-        supports_reasoning_summaries: true,
-        support_verbosity: true,
-        truncation_policy: { mode: 'tokens', limit: 10_000 },
-        supports_parallel_tool_calls: true,
-        experimental_supported_tools: [],
-        tool_mode: 'code_mode_only',
-        use_responses_lite: true,
-        minimal_client_version: 'runtime',
-        future_unknown_field: 'preserved'
-    };
-}
-async function toolOutputRecoveryFetch() {
-    return new Response('{}', {
-        status: 200,
-        headers: {
-            'content-type': 'application/json',
-            'x-app-version': CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION
-        }
-    });
-}