sneakoscope 8.1.2 → 8.2.0

package/dist/core/architecture-hardening/state/state-service.js

@@ -1,8 +1,9 @@
 import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { writeJsonAtomic } from '../../fsx.js';
-import { validateArchitectureConfiguration } from '../contracts/contracts.js';
 export const ARCHITECTURE_STATE_SCHEMA = 'sks.architecture-state.v1';
+export const APPLY_RECEIPTS_SCHEMA = 'sks.apply-receipts.v1';
+export const APPLY_STAGE_RECEIPT_SCHEMA = 'sks.apply-stage-receipt.v1';
 export const APPLY_STAGE_ORDER = [
     'config_saved',
     'proxy_applied',
@@ -21,18 +22,18 @@ export class ArchitectureStateService {
         this.receiptPath = path.join(this.root, 'apply-receipt.json');
     }
     async stage(configuration) {
-        const validated = validateArchitectureConfiguration(configuration);
+        const validated = cloneJsonState(configuration);
         await fsp.mkdir(this.root, { recursive: true, mode: 0o700 });
         await writeJsonAtomic(this.draftPath, validated, { mode: 0o600 });
         return validated;
     }
     async commit(ports, now = () => new Date()) {
-        const draft = await readConfiguration(this.draftPath);
+        const draft = await readState(this.draftPath);
         if (!draft)
             return { ok: false, status: 'failed', receipts: [], blocker: 'state_draft_missing' };
         const receipts = APPLY_STAGE_ORDER.map((stage) => receipt(stage, 'pending', null, now));
         const persist = async () => {
-            await writeJsonAtomic(this.receiptPath, { schema: 'sks.apply-receipts.v1', stages: receipts }, { mode: 0o600 });
+            await writeJsonAtomic(this.receiptPath, { schema: APPLY_RECEIPTS_SCHEMA, stages: receipts }, { mode: 0o600 });
         };
         await persist();
         const runStage = async (stage, action) => {
@@ -76,10 +77,10 @@ export class ArchitectureStateService {
             throw error;
         }
     }
-    async read(existingSession = null) {
+    async read() {
         const [draft, lastKnownGood, receipts] = await Promise.all([
-            readConfiguration(this.draftPath),
-            readConfiguration(this.lastKnownGoodPath),
+            readState(this.draftPath),
+            readState(this.lastKnownGoodPath),
             readReceipts(this.receiptPath)
         ]);
         return {
@@ -87,7 +88,6 @@ export class ArchitectureStateService {
             draft,
             last_known_good: lastKnownGood,
             receipts,
-            existing_session: existingSession,
             new_session_default: lastKnownGood
         };
     }
@@ -99,7 +99,7 @@ class StateApplyError extends Error {
         this.code = code;
     }
 }
-async function readConfiguration(file) {
+async function readState(file) {
     let raw;
     try {
         raw = await fsp.readFile(file, 'utf8');
@@ -109,12 +109,12 @@ async function readConfiguration(file) {
             return null;
         throw error;
     }
-    return validateArchitectureConfiguration(JSON.parse(raw));
+    return cloneJsonState(JSON.parse(raw));
 }
 async function readReceipts(file) {
     try {
         const parsed = JSON.parse(await fsp.readFile(file, 'utf8'));
-        if (parsed.schema !== 'sks.apply-receipts.v1' || !Array.isArray(parsed.stages))
+        if (parsed.schema !== APPLY_RECEIPTS_SCHEMA || !Array.isArray(parsed.stages))
             return [];
         return parsed.stages.filter(isReceipt);
     }
@@ -126,7 +126,7 @@ async function readReceipts(file) {
 }
 function receipt(stage, status, reasonCode, now) {
     return {
-        schema: 'sks.apply-stage-receipt.v1',
+        schema: APPLY_STAGE_RECEIPT_SCHEMA,
         stage,
         status,
         reason_code: reasonCode,
@@ -143,12 +143,48 @@ function isReceipt(value) {
     if (!value || typeof value !== 'object')
         return false;
     const row = value;
-    return row.schema === 'sks.apply-stage-receipt.v1'
+    return row.schema === APPLY_STAGE_RECEIPT_SCHEMA
         && APPLY_STAGE_ORDER.includes(row.stage)
         && ['pending', 'running', 'succeeded', 'failed'].includes(String(row.status))
         && (row.reason_code === null || typeof row.reason_code === 'string')
         && typeof row.updated_at === 'string';
 }
+function cloneJsonState(value) {
+    validateJsonValue(value, true, new Set());
+    return JSON.parse(JSON.stringify(value));
+}
+function validateJsonValue(value, root, ancestors) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return;
+    if (typeof value === 'number') {
+        if (Number.isFinite(value))
+            return;
+        throw new StateApplyError('state_configuration_not_json_safe');
+    }
+    if (typeof value !== 'object')
+        throw new StateApplyError('state_configuration_not_json_safe');
+    if (root && Array.isArray(value))
+        throw new StateApplyError('state_configuration_not_json_object');
+    if (ancestors.has(value))
+        throw new StateApplyError('state_configuration_not_json_safe');
+    ancestors.add(value);
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            validateJsonValue(entry, false, ancestors);
+    }
+    else {
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new StateApplyError('state_configuration_not_json_safe');
+        }
+        if (Reflect.ownKeys(value).some((key) => typeof key === 'symbol')) {
+            throw new StateApplyError('state_configuration_not_json_safe');
+        }
+        for (const entry of Object.values(value))
+            validateJsonValue(entry, false, ancestors);
+    }
+    ancestors.delete(value);
+}
 function safeFailureCode(error) {
     const candidate = error instanceof Error ? error.message : '';
     return /^[a-z][a-z0-9_]{2,99}$/.test(candidate) ? candidate : 'state_apply_failed';

package/dist/core/auto-review.js

@@ -1,10 +1,10 @@
 import os from 'node:os';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { ensureDir, exists, readText, writeTextAtomic } from './fsx.js';
 import { writeCodexConfigGuarded } from './codex/codex-config-guard.js';
 import { inspectConfinedPath, removeManagedPathVerified } from './managed-path-safety.js';
 import { RETIRED_AUTO_REVIEW_POLICY_TEXTS, RETIRED_SKS_CONFIG_PROFILE_NAMES } from './doctor/retired-auto-review-config.js';
-import { retiredGlmDesktopProfileBody } from './codex-app/openrouter-provider.js';
 import { escapeRegExp } from './text/regex.js';
 export { RETIRED_SKS_CONFIG_PROFILE_NAMES } from './doctor/retired-auto-review-config.js';
 export const AUTO_REVIEW_REVIEWER = 'auto_review';
@@ -201,7 +201,8 @@ export function reconcileRetiredSksConfigText(text) {
 }
 export function isSksGeneratedRetiredProfileText(text) {
     const normalized = normalizeGeneratedProfileText(text);
-    return managedRetiredProfileBodies().has(normalized);
+    return managedRetiredProfileBodies().has(normalized)
+        || HISTORICAL_OPENROUTER_PROFILE_SHA256.has(sha256(normalized));
 }
 export function buildMadHighLaunchProfileNoWrite(opts = {}) {
     const env = opts.env || process.env;
@@ -461,12 +462,17 @@ function managedRetiredProfileBodies() {
             'approval_policy = "on-request"',
             'sandbox_mode = "workspace-write"',
             'model_reasoning_effort = "medium"'
-        ].join('\n'),
-        retiredGlmDesktopProfileBody('none'),
-        retiredGlmDesktopProfileBody('minimal'),
-        retiredGlmDesktopProfileBody('low'),
-        retiredGlmDesktopProfileBody('medium'),
-        retiredGlmDesktopProfileBody('high'),
-        retiredGlmDesktopProfileBody('xhigh')
+        ].join('\n')
     ].map(normalizeGeneratedProfileText));
 }
+const HISTORICAL_OPENROUTER_PROFILE_SHA256 = new Set([
+    '8405d346127e87805f284caa6c2f20a67cbd96595c4f3b194a46212c650837c4',
+    'ff97ebf844785bdd21e5b28dd109ec5684873fe52e75386c1bd1bd19c7cedcc8',
+    'be337e958e9379e72ccf8dd5576c1e4d8d348c338cebc4d68690bfb9d94a3048',
+    'feb9f6be9e4596a2a897f3c6b5b735fa838e64227a0fba1051d1ac93c0613e8c',
+    '0a482903a52392434f3746451166ad54e95053e6777c5013edf9fec2da23692e',
+    '364fbce652087e4ae8284bdb51e664e9c4e37eafee146123c68d5a6fb036c347'
+]);
+function sha256(text) {
+    return createHash('sha256').update(text).digest('hex');
+}

package/dist/core/codex/codex-config-guard.js

@@ -5,6 +5,7 @@ import { appendJsonl, ensureDir, nowIso, readText, sha256, writeTextAtomic } fro
 import { diffCodexAppUiSnapshots, snapshotCodexAppUiState } from '../codex-app/codex-app-ui-state-snapshot.js';
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from './codex-config-toml.js';
 import { escapeRegExp } from '../text/regex.js';
+import { withFileLock } from '../locks/file-lock.js';
 export const SKS_MANAGED_CODEX_CONFIG_MARKER = '# SKS-MANAGED-CODEX-CONFIG';
 const FAST_FEATURE_KEYS = [
     'fast_mode',
@@ -21,6 +22,13 @@ const FAST_FEATURE_KEYS = [
 ];
 export async function writeCodexConfigGuarded(input) {
     const configPath = path.resolve(input.configPath);
+    return withFileLock({
+        lockPath: `${configPath}.lock`,
+        timeoutMs: 10_000,
+        staleMs: 60_000
+    }, () => writeCodexConfigGuardedUnlocked(input, configPath));
+}
+async function writeCodexConfigGuardedUnlocked(input, configPath) {
     const root = path.resolve(input.root || process.cwd());
     const cause = input.cause || 'codex-config';
     const before = input.before === undefined ? String(await readText(configPath, '')) : String(input.before || '');

package/dist/core/codex-adapter.js

@@ -3,7 +3,7 @@ import { runProcess } from './fsx.js';
 import { preserveCodexModelArgs } from './codex-model-guard.js';
 import { managedProxyEnvForChild } from './codex/managed-proxy-env.js';
 import { resolveCodexRuntime } from './codex-runtime/resolve-codex-runtime.js';
-import { codexLbRecoveryBlockedProcessResult, withCodexLbCliLaunchRecovery } from './codex-control/codex-lb-launch-recovery.js';
+import { desktopBridgeLaunchBlockedProcessResult, withDesktopBridgeCliLaunchGuard } from './codex-control/desktop-bridge-launch-guard.js';
 import { prepareCodexAppServerRuntimeEnv } from './codex-control/codex-app-server-runtime-env.js';
 export async function findCodexBinary() {
     const resolved = await resolveCodexRuntime({
@@ -41,18 +41,16 @@ export function buildCodexExecArgs({ root, prompt, outputFile, json = true, prof
     args.push(prompt);
     return args;
 }
-export async function runCodexExec({ root, recoveryRoot = root, prompt, outputFile, json = true, profile = null, extraArgs = [], onStdout, onStderr, logDir = null, stdoutFile = null, stderrFile = null, maxBufferBytes = 256 * 1024, timeoutMs = null, env = process.env, codexBin = null, findCodexBinaryImpl = findCodexBinary, runProcessImpl = runProcess, prepareCodexRuntimeEnvImpl = prepareCodexAppServerRuntimeEnv, recoveryFetch = undefined, recoveryTimeoutMs = undefined }) {
+export async function runCodexExec({ root, recoveryRoot = root, prompt, outputFile, json = true, profile = null, extraArgs = [], onStdout, onStderr, logDir = null, stdoutFile = null, stderrFile = null, maxBufferBytes = 256 * 1024, timeoutMs = null, env = process.env, codexBin = null, findCodexBinaryImpl = findCodexBinary, runProcessImpl = runProcess, prepareCodexRuntimeEnvImpl = prepareCodexAppServerRuntimeEnv }) {
     const args = buildCodexExecArgs({ root, prompt, outputFile, json, profile, extraArgs });
     const effectiveTimeoutMs = Number(timeoutMs || process.env.SKS_CODEX_TIMEOUT_MS || process.env.DCODEX_CODEX_TIMEOUT_MS || 30 * 60 * 1000);
     const recoveryArgs = args.slice(1, -1);
     const runtimeEnv = await prepareCodexRuntimeEnvImpl({ env });
-    const guarded = await withCodexLbCliLaunchRecovery({
+    const guarded = await withDesktopBridgeCliLaunchGuard({
         root: recoveryRoot,
         env: runtimeEnv,
-        cliArgs: recoveryArgs,
-        ...(typeof recoveryFetch === 'function' ? { fetchImpl: recoveryFetch } : {}),
-        ...(recoveryTimeoutMs === undefined ? {} : { timeoutMs: recoveryTimeoutMs })
-    }, async () => {
+        cliArgs: recoveryArgs
+    }, async (sanitizedEnv) => {
         const bin = codexBin || await findCodexBinaryImpl();
         if (!bin) {
             return {
@@ -67,7 +65,7 @@ export async function runCodexExec({ root, recoveryRoot = root, prompt, outputFi
         }
         return runProcessImpl(bin, args, {
             cwd: root,
-            env: { ...runtimeEnv, ...managedProxyEnvForChild(runtimeEnv) },
+            env: { ...sanitizedEnv, ...managedProxyEnvForChild(sanitizedEnv) },
             onStdout,
             onStderr,
             timeoutMs: effectiveTimeoutMs,
@@ -77,6 +75,6 @@ export async function runCodexExec({ root, recoveryRoot = root, prompt, outputFi
         });
     });
     return guarded.launched
-        ? guarded.value
-        : codexLbRecoveryBlockedProcessResult(guarded.toolOutputRecovery);
+        ? { ...guarded.value, desktop_bridge_launch_guard: guarded.desktopBridgeLaunchGuard }
+        : desktopBridgeLaunchBlockedProcessResult(guarded.desktopBridgeLaunchGuard);
 }

package/dist/core/codex-app/codex-app-fast-ui-repair.js

@@ -74,6 +74,12 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
         home: path.dirname(home),
         configPath: path.join(home, 'config.toml'),
         codexLbEnvPath: path.join(home, 'sks-codex-lb.env'),
+        desktopBridgeStatusOptions: {
+            home: path.dirname(home),
+            env: input.env || process.env,
+            configPath: path.join(home, 'config.toml'),
+            authPath: path.join(home, 'auth.json')
+        },
         ...(input.codexLbModelCatalog ? { codexLbModelCatalog: input.codexLbModelCatalog } : {}),
         ...(input.desktopPickerEvidence ? { desktopPickerEvidence: input.desktopPickerEvidence } : {})
     });
@@ -122,7 +128,7 @@ export async function repairCodexAppFastUi(root = process.cwd(), input = {}) {
         auth_mode: after.indicators.auth_mode,
         chat_surface: after.indicators.chat_surface,
         chatgpt_oauth_backup_available: after.indicators.chatgpt_oauth_backup_available,
-        next_action: requiresConfirmation ? 'Run `sks doctor --fix --repair-codex-app-ui` after reviewing the repair plan.' : manual && safeAutoApply ? 'Run `sks doctor --fix` to apply the safe Codex App UI repair.' : manual ? 'Run `sks doctor --fix --repair-codex-app-ui` after reviewing the repair plan.' : chatgptOauthInactive ? 'Run `sks codex-lb migrate-legacy-desktop --restart-app`; if no valid OAuth backup exists, run `codex login` first. Ordinary codex-lb routing commands never replace ChatGPT OAuth.' : changed ? 'Restart Codex App if the selector was already hidden.' : 'No Codex App UI repair needed.',
+        next_action: requiresConfirmation ? 'Run `sks doctor --fix --repair-codex-app-ui` after reviewing the repair plan.' : manual && safeAutoApply ? 'Run `sks doctor --fix` to apply the safe Codex App UI repair.' : manual ? 'Run `sks doctor --fix --repair-codex-app-ui` after reviewing the repair plan.' : chatgptOauthInactive ? 'Run `codex login` if ChatGPT OAuth is unavailable, then run `sks bridge ensure`; Desktop Bridge provider commands do not replace ChatGPT OAuth.' : changed ? 'Restart Codex App if the selector was already hidden.' : 'No Codex App UI repair needed.',
         blockers
     };
     if (input.reportPath)
@@ -173,42 +179,14 @@ function stripProjectLocalForbiddenKeys(text) {
 }
 function stripSksCausedHostOwnedLines(text) {
     const sourceLines = String(text || '').split(/\r?\n/);
-    const preserveCodexLbSelection = hasActiveCodexLbProviderSelection(text);
-    const preserveOpenRouterSelection = hasActiveOpenRouterProviderSelection(text);
     const stripped = stripMatchingLines(text, (line, table, _previous, _next, index) => {
         const isLegacyFastTable = table ? FAST_UI_LEGACY_TABLES.has(table) : false;
         if (isLegacyFastTable)
             return true;
-        if (!table && preserveCodexLbSelection && /^\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?$/.test(line))
-            return false;
-        if (!table && preserveOpenRouterSelection && /^\s*(?:model_provider\s*=\s*"openrouter"|model\s*=)/.test(line))
-            return false;
         return !table && FAST_UI_TOP_LEVEL_RE.test(line) && isSksOwnedGlobalUiLock(sourceLines, index);
     });
     return stripped;
 }
-function hasActiveOpenRouterProviderSelection(text) {
-    const source = String(text || '');
-    if (!/(?:^|\n)\s*model_provider\s*=\s*"openrouter"\s*(?:#.*)?(?=\n|$)/.test(source))
-        return false;
-    const body = source.match(/(?:^|\n)\[model_providers\.openrouter\]([^\n]*(?:\n(?!\s*\[)[^\n]*)*)/)?.[1] || '';
-    return /(?:^|\n)\s*base_url\s*=\s*"https:\/\/openrouter\.ai\/api\/v1"\s*(?:#.*)?(?=\n|$)/.test(body)
-        && /(?:^|\n)\s*wire_api\s*=\s*"responses"\s*(?:#.*)?(?=\n|$)/.test(body);
-}
-function hasActiveCodexLbProviderSelection(text) {
-    const source = String(text || '');
-    if (!/(?:^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(source))
-        return false;
-    const body = source.match(/(?:^|\n)\[model_providers\.codex-lb\]([^\n]*(?:\n(?!\s*\[)[^\n]*)*)/)?.[1] || '';
-    const providerIdentity = /(?:^|\n)\s*name\s*=\s*"(?:openai|codex-lb)"\s*(?:#.*)?(?=\n|$)/i.test(body);
-    const baseUrl = /(?:^|\n)\s*base_url\s*=\s*"https?:\/\/[^"]+"\s*(?:#.*)?(?=\n|$)/.test(body);
-    const responsesWire = /(?:^|\n)\s*wire_api\s*=\s*"responses"\s*(?:#.*)?(?=\n|$)/.test(body);
-    const cliProviderAuth = /(?:^|\n)\s*env_key\s*=\s*"CODEX_LB_API_KEY"\s*(?:#.*)?(?=\n|$)/.test(body)
-        && /(?:^|\n)\s*requires_openai_auth\s*=\s*false\s*(?:#.*)?(?=\n|$)/.test(body);
-    const desktopCompatAuth = /(?:^|\n)\s*env_http_headers\s*=\s*\{[^}\n]*"X-Codex-LB-API-Key"\s*=\s*"CODEX_LB_API_KEY"[^}\n]*\}\s*(?:#.*)?(?=\n|$)/.test(body)
-        && /(?:^|\n)\s*requires_openai_auth\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(body);
-    return providerIdentity && baseUrl && responsesWire && (cliProviderAuth || desktopCompatAuth);
-}
 function stripMatchingLines(text, shouldRemove) {
     const lines = text.split(/\r?\n/);
     let table = null;

package/dist/core/codex-app/codex-app-launcher.js

@@ -1,6 +1,6 @@
 import { findCodexBinary } from '../codex-adapter.js';
 import { runProcess } from '../fsx.js';
-import { inspectCodexLbCliLaunchRecovery } from '../codex-control/codex-lb-launch-recovery.js';
+import { inspectDesktopBridgeCliLaunchGuard, stripRetiredDirectProviderEnv } from '../codex-control/desktop-bridge-launch-guard.js';
 export async function attemptCodexAppLaunch(input) {
     const platform = input.platform || process.platform;
     const timeoutMs = Math.max(1, Math.min(Number(input.timeoutMs || 3000), 3000));
@@ -46,16 +46,14 @@ export async function attemptCodexAppLaunch(input) {
             blockers: launched ? [] : ['codex_app_launch_failed']
         });
     }
-    const env = input.env || process.env;
+    const env = stripRetiredDirectProviderEnv(input.env || process.env);
     const execute = input.runProcessImpl || runProcess;
-    const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery({
+    const launchGuard = await inspectDesktopBridgeCliLaunchGuard({
         root: input.cwd,
         env,
-        cliArgs: ['/app'],
-        ...(input.recoveryFetch ? { fetchImpl: input.recoveryFetch } : {}),
-        ...(input.recoveryTimeoutMs === undefined ? {} : { timeoutMs: input.recoveryTimeoutMs })
+        cliArgs: ['/app']
     });
-    if (!toolOutputRecovery.ok) {
+    if (!launchGuard.ok) {
         return launchAttempt({
             attempted: false,
             launched: false,
@@ -63,9 +61,9 @@ export async function attemptCodexAppLaunch(input) {
             mode: input.mode,
             command_line: commandLine,
             exit_code: null,
-            fallback_reason: 'codex_lb_tool_output_recovery_blocked',
-            blockers: toolOutputRecovery.blockers,
-            tool_output_recovery: toolOutputRecovery
+            fallback_reason: 'desktop_bridge_launch_guard_blocked',
+            blockers: launchGuard.blockers,
+            desktop_bridge_launch_guard: launchGuard
         });
     }
     codexBin ||= await (input.findCodexBinaryImpl || findCodexBinary)();
@@ -80,7 +78,7 @@ export async function attemptCodexAppLaunch(input) {
             exit_code: null,
             fallback_reason: 'codex_cli_missing_artifact_only_fallback',
             blockers: ['codex_cli_missing'],
-            tool_output_recovery: toolOutputRecovery
+            desktop_bridge_launch_guard: launchGuard
         });
     }
     const result = await execute(codexBin, ['/app'], {
@@ -120,7 +118,7 @@ export async function attemptCodexAppLaunch(input) {
         stderr_tail: stderr.slice(-4000),
         fallback_reason: fallbackReason,
         blockers: launched ? [] : [timedOut ? 'codex_app_launch_interactive_or_timeout' : 'codex_app_launch_failed'],
-        tool_output_recovery: toolOutputRecovery
+        desktop_bridge_launch_guard: launchGuard
     });
 }
 function launchAttempt(input) {

package/dist/core/codex-app/codex-app-restart.js

@@ -1,5 +1,5 @@
 import { exists, runProcess, which } from '../fsx.js';
-import { inspectCodexLbCliLaunchRecovery } from '../codex-control/codex-lb-launch-recovery.js';
+import { inspectDesktopBridgeCliLaunchGuard, stripRetiredDirectProviderEnv } from '../codex-control/desktop-bridge-launch-guard.js';
 export async function quitCodexApp(opts = {}) {
     const env = opts.env || process.env;
     const appName = String(opts.appName || env.SKS_CODEX_APP_NAME || 'ChatGPT');
@@ -73,7 +73,7 @@ export async function quitCodexApp(opts = {}) {
     };
 }
 export async function restartCodexApp(opts = {}) {
-    const env = opts.env || process.env;
+    const env = stripRetiredDirectProviderEnv(opts.env || process.env);
     const appName = String(opts.appName || env.SKS_CODEX_APP_NAME || 'ChatGPT');
     const bundleId = String(opts.bundleId || env.SKS_CODEX_APP_BUNDLE_ID || 'com.openai.codex');
     if (opts.enabled === false || env.SKS_SKIP_CODEX_APP_RESTART === '1') {
@@ -96,22 +96,20 @@ export async function restartCodexApp(opts = {}) {
             ]
         };
     }
-    const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery({
+    const launchGuard = await inspectDesktopBridgeCliLaunchGuard({
         root: opts.root || process.cwd(),
         env,
-        cliArgs: ['/app'],
-        ...(opts.recoveryFetch ? { fetchImpl: opts.recoveryFetch } : {}),
-        ...(opts.recoveryTimeoutMs === undefined ? {} : { timeoutMs: opts.recoveryTimeoutMs })
+        cliArgs: ['/app']
     });
-    if (!toolOutputRecovery.ok) {
+    if (!launchGuard.ok) {
         return {
             schema: 'sks.codex-app-restart.v1',
             ok: false,
-            status: 'tool_output_recovery_blocked',
+            status: 'desktop_bridge_launch_guard_blocked',
             app_name: appName,
             bundle_id: bundleId,
-            blockers: toolOutputRecovery.blockers,
-            tool_output_recovery: toolOutputRecovery
+            blockers: launchGuard.blockers,
+            desktop_bridge_launch_guard: launchGuard
         };
     }
     const appTarget = bundleId ? `application id ${JSON.stringify(bundleId)}` : `application ${JSON.stringify(appName)}`;
@@ -145,7 +143,7 @@ export async function restartCodexApp(opts = {}) {
             quit: { ok: true, code: quit.code, error: null },
             exit_wait: { ok: false, attempts, error: 'codex_app_exit_timeout' },
             blockers: ['codex_app_exit_timeout'],
-            tool_output_recovery: toolOutputRecovery
+            desktop_bridge_launch_guard: launchGuard
         };
     }
     await sleep(Number(opts.delayMs ?? env.SKS_CODEX_APP_RESTART_DELAY_MS ?? 150));
@@ -168,7 +166,7 @@ export async function restartCodexApp(opts = {}) {
             ...(quitOk ? [] : ['codex_app_quit_failed']),
             ...(openOk ? [] : ['codex_app_open_failed'])
         ],
-        tool_output_recovery: toolOutputRecovery
+        desktop_bridge_launch_guard: launchGuard
     };
 }
 function skipped(appName, reason) {

package/dist/core/codex-app/menubar/constants.js

@@ -1,7 +1,6 @@
 export const SKS_MENUBAR_LABEL = 'com.sneakoscope.sks-menubar';
 export const CONTROL_CENTER_DOMAIN = 'com.apple.controlcenter';
 export const CONTROL_CENTER_PREFERRED_POSITION = 360;
-export const SECRET_LAUNCH_ENV_KEYS = ['CODEX_LB_API_KEY', 'OPENROUTER_API_KEY'];
 export const MENU_ITEMS = [
     'Open SKS Control Center',
     'Pending approvals',
@@ -22,16 +21,14 @@ export const NATIVE_SOURCE_FILES = [
     'MCPServersViewController.swift',
     'ProvidersViewController.swift',
     'ProvidersReliability.swift',
-    'ProvidersConnectTest.swift',
     'ProvidersRoutingTruth.swift',
-    'ProvidersFastMode.swift',
     'ProvidersOpenRouter.swift',
-    'ProvidersRoleModels.swift',
-    'ProvidersMultiProvider.swift',
+    'ProvidersBridgeCatalog.swift',
     'RemoteCodingViewController.swift',
     'DiagnosticsViewController.swift',
     'SettingsViewController.swift',
     'OperationModels.swift',
+    'ProviderRouteExplanation.swift',
     'OperationCoordinator.swift',
     'ProcessClient.swift',
     'ProcessExecutionState.swift',

package/dist/core/codex-app/menubar/global-install.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { exists, nowIso, readJson, readText, runProcess, writeJsonAtomic } from '../../fsx.js';
 import { ensureConfinedDirectory, inspectConfinedPath, removeManagedPathVerified } from '../../managed-path-safety.js';
 const MENU_BAR_EXECUTABLE_SUFFIX = path.join('SKSMenuBar.app', 'Contents', 'MacOS', 'SKSMenuBar');
+const MENU_BAR_PROCESS_DISCOVERY_TIMEOUT_MS = 5_000;
 export function projectMenuBarDuplicateInstallDirs(input) {
     const root = path.resolve(input.root);
     const home = path.resolve(input.paths.home);
@@ -187,7 +188,7 @@ async function runningMenuBarDuplicateInstallDirs(canonicalInstallDir, env) {
         ...(uid === null ? [] : ['-U', String(uid)]),
         '-f',
         'SKSMenuBar\\.app/Contents/MacOS/SKSMenuBar'
-    ], { timeoutMs: 2_000, maxOutputBytes: 32 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
+    ], { timeoutMs: MENU_BAR_PROCESS_DISCOVERY_TIMEOUT_MS, maxOutputBytes: 32 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
     if (result.code !== 0)
         return [];
     const rows = String(result.stdout || '').split(/\r?\n/).filter(Boolean).map((line) => ({
@@ -208,7 +209,7 @@ async function runningMenuBarDuplicateInstallDirs(canonicalInstallDir, env) {
                 unresolvedPids.join(','),
                 '-o',
                 'pid=,command='
-            ], { timeoutMs: 2_000, maxOutputBytes: 64 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
+            ], { timeoutMs: MENU_BAR_PROCESS_DISCOVERY_TIMEOUT_MS, maxOutputBytes: 64 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
             if (processList.code === 0) {
                 executablePaths.push(...String(processList.stdout || '')
                     .split(/\r?\n/)

package/dist/core/codex-app/menubar/installer/result.js

@@ -0,0 +1,23 @@
+import { writeJsonAtomic } from '../../../fsx.js';
+import { MENU_ITEMS } from '../constants.js';
+import { sksMenuBarPaths } from '../paths.js';
+import { defaultNextActions } from '../status.js';
+export function baseResult(paths, apply, status, ok, actions, warnings) {
+    return {
+        schema: 'sks.codex-app-sks-menubar.v1', ok, apply, status, platform: process.platform,
+        app_path: paths.app_path, executable_path: paths.executable_path,
+        launch_agent_path: paths.launch_agent_path, action_script_path: paths.action_script_path,
+        build_stamp_path: paths.build_stamp_path, config_path: paths.config_path,
+        report_path: paths.report_path, menu_items: [...MENU_ITEMS], actions,
+        tcc_automation_status: 'unknown', next_actions: defaultNextActions(), blockers: [], warnings
+    };
+}
+export async function writeReport(reportPath, result) {
+    try {
+        await writeJsonAtomic(reportPath, result);
+    }
+    catch {
+        result.report_write_failed = true;
+        result.warnings.push('menubar_report_write_failed');
+    }
+}

package/dist/core/codex-app/menubar/installer/runtime.js

@@ -0,0 +1,28 @@
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { exists, runProcess } from '../../../fsx.js';
+export async function resolveSksEntryForInstall(explicit, root) {
+    const packaged = fileURLToPath(new URL('../../../../bin/sks.js', import.meta.url));
+    const requested = explicit ? path.resolve(explicit) : null;
+    const candidate = requested || packaged;
+    const found = await exists(candidate);
+    const relative = path.relative(path.resolve(root), candidate);
+    return {
+        requested, resolved: found ? candidate : null, packaged, exists: found,
+        project_local: relative === '' || (Boolean(relative) && !relative.startsWith('..') && !path.isAbsolute(relative)),
+        used_previous_script: false
+    };
+}
+export async function toolVersion(tool, args) {
+    const result = await runProcess(tool, args, { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => ({ code: 1, stdout: '', stderr: '' }));
+    return result.code === 0 ? String(result.stdout || result.stderr).trim().split(/\r?\n/)[0] || 'unknown' : 'unknown';
+}
+export function realUserHome() {
+    try {
+        return path.resolve(os.userInfo().homedir);
+    }
+    catch {
+        return path.resolve(os.homedir());
+    }
+}