@bryanhu/codexly 0.1.0

package/dist/cli.js

@@ -0,0 +1,889 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { createCodexlyServer, SqliteStateRepository, normalizeAllowedHost } from './chunk-K63YBMTG.js';
+import './chunk-TEPSAXZZ.js';
+import { startCodexAppServer, locateCodexBinary, createCodexRuntimeProvider, CodexProjectRepository, checkCodexVersion } from './chunk-42AR5IS7.js';
+import './chunk-3OBVX5TN.js';
+import './chunk-MH54VCZJ.js';
+import './chunk-K6J42667.js';
+import { mkdir, lstat, chmod, realpath } from 'fs/promises';
+import { networkInterfaces, homedir } from 'os';
+import { join, win32 } from 'path';
+import { fileURLToPath } from 'url';
+import { spawn, execFile } from 'child_process';
+import { createInterface } from 'readline/promises';
+import { randomBytes } from 'crypto';
+import { isIP } from 'net';
+
+createRequire(import.meta.url);
+
+// package.json
+var package_default = {
+  version: "0.1.0"};
+var PACKAGE_NAME = "@bryanhu/codexly";
+var INITIAL_APP_VERSION = "0.1.0";
+var CHANGELOG_URL_PREFIX = "https://raw.githubusercontent.com/BryanHoo/Codexly/v";
+var REGISTRY_TIMEOUT_MS = 1e4;
+var MAX_RELEASE_NOTES_BYTES = 32 * 1024;
+var INSTALL_TIMEOUT_MS = 2 * 6e4;
+var SEMANTIC_VERSION_PATTERN = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-((?:(?:0|[1-9][0-9]*)|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:(?:0|[1-9][0-9]*)|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+var AppUpdateError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "AppUpdateError";
+  }
+  code;
+};
+var UnpublishedPackageError = class extends Error {
+};
+function parseSemanticVersion(version) {
+  const match = SEMANTIC_VERSION_PATTERN.exec(version);
+  if (match === null) return void 0;
+  return {
+    core: [match[1] ?? "0", match[2] ?? "0", match[3] ?? "0"],
+    prerelease: match[4]?.split(".") ?? []
+  };
+}
+function compareNumericIdentifiers(left, right) {
+  if (left.length !== right.length) return left.length - right.length;
+  return left === right ? 0 : left < right ? -1 : 1;
+}
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) {
+    return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  }
+  for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
+    const leftPart = left[index];
+    const rightPart = right[index];
+    if (leftPart === void 0 || rightPart === void 0) {
+      return leftPart === rightPart ? 0 : leftPart === void 0 ? -1 : 1;
+    }
+    if (leftPart === rightPart) continue;
+    const leftIsNumeric = /^\d+$/u.test(leftPart);
+    const rightIsNumeric = /^\d+$/u.test(rightPart);
+    if (leftIsNumeric && rightIsNumeric) {
+      return compareNumericIdentifiers(leftPart, rightPart);
+    }
+    if (leftIsNumeric) return -1;
+    if (rightIsNumeric) return 1;
+    return leftPart < rightPart ? -1 : 1;
+  }
+  return 0;
+}
+function truncateUtf8(value, maxBytes) {
+  const bytes = Buffer.from(value, "utf8");
+  if (bytes.byteLength <= maxBytes) return value;
+  return new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, maxBytes)).trimEnd();
+}
+function extractVersionReleaseNotes(changelog, version) {
+  const lines = changelog.split(/\r?\n/u);
+  const start = lines.findIndex((line) => line.startsWith(`## [${version}]`));
+  if (start < 0) return void 0;
+  const nextVersionOffset = lines.slice(start + 1).findIndex((line) => /^## \[[^\]]+\]/u.test(line));
+  const end = nextVersionOffset < 0 ? lines.length : start + 1 + nextVersionOffset;
+  const releaseNotes = lines.slice(start + 1, end).join("\n").trim();
+  return releaseNotes === "" ? void 0 : truncateUtf8(releaseNotes, MAX_RELEASE_NOTES_BYTES);
+}
+function resolveNpmInstallInvocation(version, platform = process.platform, execPath = process.execPath) {
+  const packageSpec = `${PACKAGE_NAME}@${version}`;
+  if (platform !== "win32") {
+    return { args: ["install", "--global", packageSpec], command: "npm" };
+  }
+  const npmCliPath = win32.join(
+    win32.dirname(execPath),
+    "node_modules",
+    "npm",
+    "bin",
+    "npm-cli.js"
+  );
+  return {
+    args: [npmCliPath, "install", "--global", packageSpec],
+    command: execPath
+  };
+}
+function isNewerVersion(candidate, current) {
+  const candidateVersion = parseSemanticVersion(candidate);
+  const currentVersion = parseSemanticVersion(current);
+  if (candidateVersion === void 0 || currentVersion === void 0) return false;
+  for (let index = 0; index < candidateVersion.core.length; index += 1) {
+    const candidatePart = candidateVersion.core[index];
+    const currentPart = currentVersion.core[index];
+    if (candidatePart === void 0 || currentPart === void 0) return false;
+    const difference = compareNumericIdentifiers(candidatePart, currentPart);
+    if (difference !== 0) return difference > 0;
+  }
+  return comparePrerelease(candidateVersion.prerelease, currentVersion.prerelease) > 0;
+}
+async function fetchLatestPackageVersion() {
+  const response = await fetch(
+    `https://registry.npmjs.org/-/package/${encodeURIComponent(PACKAGE_NAME)}/dist-tags`,
+    {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS)
+    }
+  );
+  if (response.status === 401 || response.status === 404) {
+    throw new UnpublishedPackageError("Package has not been published");
+  }
+  if (!response.ok) throw new Error(`Registry returned ${String(response.status)}`);
+  const payload = await response.json();
+  if (typeof payload !== "object" || payload === null || !("latest" in payload) || typeof payload.latest !== "string" || parseSemanticVersion(payload.latest) === void 0) {
+    throw new Error("Registry returned an invalid latest version");
+  }
+  return payload.latest;
+}
+async function fetchTaggedChangelog(version) {
+  const response = await fetch(`${CHANGELOG_URL_PREFIX}${version}/CHANGELOG.md`, {
+    headers: { accept: "text/markdown" },
+    signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS)
+  });
+  if (!response.ok) throw new Error(`GitHub returned ${String(response.status)}`);
+  return response.text();
+}
+async function installGlobalPackage(version) {
+  const invocation = resolveNpmInstallInvocation(version);
+  await new Promise((resolve, reject) => {
+    execFile(
+      invocation.command,
+      invocation.args,
+      { shell: false, timeout: INSTALL_TIMEOUT_MS, windowsHide: true },
+      (error) => {
+        if (error === null) resolve();
+        else reject(new Error("npm install failed", { cause: error }));
+      }
+    );
+  });
+}
+function createAppUpdateService(options) {
+  const fetchChangelog = options.fetchChangelog ?? fetchTaggedChangelog;
+  const fetchLatestVersion = options.fetchLatestVersion ?? fetchLatestPackageVersion;
+  const runNpmInstall = options.runNpmInstall ?? installGlobalPackage;
+  let installedVersion;
+  const readLatest = async () => {
+    try {
+      const latestVersion = await fetchLatestVersion();
+      if (parseSemanticVersion(latestVersion) === void 0) throw new Error("Invalid version");
+      return latestVersion;
+    } catch (error) {
+      if (error instanceof UnpublishedPackageError && options.appVersion === INITIAL_APP_VERSION) {
+        return options.appVersion;
+      }
+      throw new AppUpdateError("UPDATE_CHECK_FAILED", "Failed to check for Codexly updates");
+    }
+  };
+  return {
+    async install(version) {
+      const latestVersion = await readLatest();
+      if (version !== latestVersion || !isNewerVersion(latestVersion, options.appVersion)) {
+        throw new AppUpdateError("UPDATE_NOT_AVAILABLE", "The requested update is not available");
+      }
+      try {
+        await runNpmInstall(latestVersion);
+      } catch {
+        throw new AppUpdateError("UPDATE_INSTALL_FAILED", "Failed to install the Codexly update");
+      }
+      installedVersion = latestVersion;
+      return {
+        appVersion: options.appVersion,
+        codexVersion: options.codexVersion,
+        latestVersion,
+        releaseNotes: null,
+        status: "restart-required",
+        updateAvailable: false
+      };
+    },
+    async read() {
+      let latestVersion;
+      try {
+        latestVersion = await readLatest();
+      } catch {
+        return {
+          appVersion: options.appVersion,
+          codexVersion: options.codexVersion,
+          latestVersion: null,
+          releaseNotes: null,
+          status: "check-failed",
+          updateAvailable: false
+        };
+      }
+      if (installedVersion === latestVersion) {
+        return {
+          appVersion: options.appVersion,
+          codexVersion: options.codexVersion,
+          latestVersion,
+          releaseNotes: null,
+          status: "restart-required",
+          updateAvailable: false
+        };
+      }
+      const updateAvailable = isNewerVersion(latestVersion, options.appVersion);
+      let releaseNotes = null;
+      if (updateAvailable) {
+        try {
+          releaseNotes = extractVersionReleaseNotes(await fetchChangelog(latestVersion), latestVersion) ?? null;
+        } catch {
+          releaseNotes = null;
+        }
+      }
+      return {
+        appVersion: options.appVersion,
+        codexVersion: options.codexVersion,
+        latestVersion,
+        releaseNotes,
+        status: updateAvailable ? "available" : "current",
+        updateAvailable
+      };
+    }
+  };
+}
+
+// src/cli-command-options.ts
+var CLI_HELP = `Usage: codexly [command] [options]
+
+Commands:
+  start    Start the Codexly server and open the Web interface.
+  doctor   Check whether the local Codexly runtime is ready.
+  version  Print the installed Codexly version.
+
+Start options:
+  --port <port>              Start from the specified TCP port. Defaults to 3210.
+                             Automatically increases the port when it is occupied.
+  --lan                      Listen on all network interfaces for trusted LAN access.
+                             This disables automatic browser opening.
+  --lan-password <password>  Use a custom strong LAN access password instead of a random one.
+                             Requires 16-128 characters and all character types. Requires --lan.
+  --allowed-host <domain>    Allow an exact reverse proxy domain. May be repeated.
+  --session-ttl <duration>   Set the fixed LAN session lifetime using ms, s, m, h, or d.
+                             Sessions do not expire when omitted. Requires --lan.
+  --codex-bin <path>         Use the Codex executable at the specified path.
+  --codex-home <path>        Use a custom Codex home directory instead of CODEX_HOME
+                             or the default ~/.codex directory.
+
+Doctor options:
+  --codex-bin <path>         Check the Codex executable at the specified path.
+  --codex-home <path>        Check the state database in the specified Codex home.
+
+Global options:
+  -h, --help                 Display all commands, options, and usage details.
+
+Examples:
+  codexly
+  codexly start --port 4567
+  codexly start --lan --lan-password 'Strong-Lan_Pass9!'
+  codexly start --allowed-host code.example.com
+  codexly start --lan --session-ttl 12h
+  codexly doctor --codex-bin /path/to/codex
+  codexly version
+
+Running codexly without a command is equivalent to codexly start.
+`;
+function parseCommandOptions(args, valueOptions, flagOptions = /* @__PURE__ */ new Set()) {
+  const parsed = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (let index = 0; index < args.length; index += 1) {
+    const option = args[index];
+    if (!option || !valueOptions.has(option) && !flagOptions.has(option)) {
+      throw new Error(`\u672A\u77E5\u9009\u9879: ${option ?? "<empty>"}`);
+    }
+    const repeatable = option === "--allowed-host";
+    if (seen.has(option) && !repeatable) {
+      throw new Error(`\u9009\u9879\u91CD\u590D: ${option}`);
+    }
+    seen.add(option);
+    if (flagOptions.has(option)) {
+      if (option === "--lan") {
+        parsed.lan = true;
+      }
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+      throw new Error(`\u9009\u9879\u7F3A\u5C11\u503C: ${option}`);
+    }
+    if (option === "--codex-bin") {
+      parsed.codexBin = value;
+    } else if (option === "--codex-home") {
+      parsed.codexHome = value;
+    } else if (option === "--lan-password") {
+      parsed.lanPassword = value;
+    } else if (option === "--allowed-host") {
+      parsed.allowedHosts = [...parsed.allowedHosts ?? [], value];
+    } else if (option === "--port") {
+      if (!/^\d+$/u.test(value)) {
+        throw new Error("--port \u5FC5\u987B\u662F 1 \u5230 65535 \u4E4B\u95F4\u7684\u6574\u6570");
+      }
+      const port = Number(value);
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error("--port \u5FC5\u987B\u662F 1 \u5230 65535 \u4E4B\u95F4\u7684\u6574\u6570");
+      }
+      parsed.port = port;
+    } else if (option === "--session-ttl") {
+      parsed.sessionTtl = value;
+    }
+    index += 1;
+  }
+  return parsed;
+}
+
+// src/cli-server-listen.ts
+var MAX_TCP_PORT = 65535;
+function isAddressInUseError(error) {
+  return error instanceof Error && "code" in error && error.code === "EADDRINUSE";
+}
+async function listenOnAvailablePort(server, host, initialPort) {
+  for (let port = initialPort; port <= MAX_TCP_PORT; port += 1) {
+    try {
+      await server.listen({ host, port });
+      return port;
+    } catch (error) {
+      if (!isAddressInUseError(error) || port === MAX_TCP_PORT) {
+        throw error;
+      }
+    }
+  }
+  throw new Error(`\u7AEF\u53E3 ${String(initialPort)} \u5230 ${String(MAX_TCP_PORT)} \u5747\u4E0D\u53EF\u7528`);
+}
+var STARTUP_UPDATE_APPLIED_ENV = "CODEXLY_STARTUP_UPDATE_APPLIED";
+function createStartupAppUpdateOperations(appVersion) {
+  const service = createAppUpdateService({
+    appVersion,
+    // 启动前 Codex 尚未运行，此服务只消费版本检查和安装结果。
+    codexVersion: "not-started"
+  });
+  return {
+    check: async () => {
+      const info = await service.read();
+      return {
+        latestVersion: info.latestVersion,
+        status: info.status === "available" ? "available" : info.status === "check-failed" ? "check-failed" : "current"
+      };
+    },
+    install: async (version) => {
+      await service.install(version);
+    }
+  };
+}
+async function confirmTerminalAppUpdate(currentVersion, latestVersion) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const terminal = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await terminal.question(
+      `\u53D1\u73B0 Codexly \u65B0\u7248\u672C ${latestVersion}\uFF08\u5F53\u524D ${currentVersion}\uFF09\uFF0C\u662F\u5426\u66F4\u65B0\u540E\u542F\u52A8\uFF1F[y/N] `
+    );
+    const normalizedAnswer = answer.trim().toLocaleLowerCase();
+    return normalizedAnswer === "y" || normalizedAnswer === "yes";
+  } finally {
+    terminal.close();
+  }
+}
+async function restartCliAfterUpdate(args) {
+  const cliEntry = process.argv[1];
+  if (cliEntry === void 0) throw new Error("\u65E0\u6CD5\u786E\u5B9A Codexly CLI \u5165\u53E3");
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [cliEntry, ...args], {
+      env: { ...process.env, [STARTUP_UPDATE_APPLIED_ENV]: "1" },
+      shell: false,
+      stdio: "inherit",
+      windowsHide: true
+    });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (signal !== null) {
+        reject(new Error(`\u66F4\u65B0\u540E\u7684 Codexly \u542F\u52A8\u8FDB\u7A0B\u88AB\u4FE1\u53F7 ${signal} \u7EC8\u6B62`));
+        return;
+      }
+      resolve(code ?? 1);
+    });
+  });
+}
+var LAUNCH_CONFIRMATION_MS = 500;
+function browserCommands(url, platform) {
+  if (platform === "darwin") {
+    return [{ args: [url], executable: "open" }];
+  }
+  if (platform === "win32") {
+    return [{ args: ["/c", "start", "", url], executable: "cmd.exe" }];
+  }
+  return [
+    { args: [url], executable: "xdg-open" },
+    { args: ["open", url], executable: "gio" },
+    { args: [url], executable: "sensible-browser" }
+  ];
+}
+function launchBrowserCommand(command) {
+  return new Promise((resolveOpen, reject) => {
+    const child = spawn(command.executable, [...command.args], {
+      detached: true,
+      shell: false,
+      stdio: "ignore"
+    });
+    let settled = false;
+    let confirmationTimer;
+    const settle = (action) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (confirmationTimer !== void 0) {
+        clearTimeout(confirmationTimer);
+      }
+      action();
+    };
+    child.once("error", (error) => {
+      settle(() => {
+        reject(error);
+      });
+    });
+    child.once("spawn", () => {
+      confirmationTimer = setTimeout(() => {
+        settle(() => {
+          child.unref();
+          resolveOpen();
+        });
+      }, LAUNCH_CONFIRMATION_MS);
+    });
+    child.once("exit", (exitCode, signal) => {
+      if (exitCode === 0) {
+        settle(resolveOpen);
+        return;
+      }
+      const reason = signal ? `signal ${signal}` : `code ${String(exitCode)}`;
+      settle(() => {
+        reject(
+          Object.assign(new Error(`${command.executable} exited with ${reason}`), {
+            code: "LAUNCHER_EXIT"
+          })
+        );
+      });
+    });
+  });
+}
+async function openSystemBrowser(url, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const commands = browserCommands(url, platform);
+  const launch = options.launch ?? launchBrowserCommand;
+  let lastLauncherError;
+  for (const command of commands) {
+    try {
+      await launch(command);
+      return;
+    } catch (error) {
+      if (platform !== "linux" && error.code !== "ENOENT") {
+        throw error;
+      }
+      lastLauncherError = error;
+    }
+  }
+  throw new Error("No supported browser launcher is installed", { cause: lastLauncherError });
+}
+
+// src/terminal-output.ts
+var ANSI_COLORS = {
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  red: "\x1B[31m",
+  reset: "\x1B[0m",
+  yellow: "\x1B[33m"
+};
+function createTerminalOutput(stdout, stderr, colorEnabled) {
+  const label = (text, color) => colorEnabled ? `${color}[${text}]${ANSI_COLORS.reset}` : `[${text}]`;
+  return {
+    error: (message) => {
+      stderr(`${label("\u9519\u8BEF", ANSI_COLORS.red)} ${message}
+`);
+    },
+    info: (message) => {
+      stdout(`${label("\u4FE1\u606F", ANSI_COLORS.cyan)} ${message}
+`);
+    },
+    plain: stdout,
+    success: (message) => {
+      stdout(`${label("\u6210\u529F", ANSI_COLORS.green)} ${message}
+`);
+    },
+    warning: (message) => {
+      stderr(`${label("\u8B66\u544A", ANSI_COLORS.yellow)} ${message}
+`);
+    }
+  };
+}
+var MIN_LAN_PASSWORD_LENGTH = 16;
+var MAX_LAN_PASSWORD_LENGTH = 128;
+var UNIT_MS = {
+  d: 24 * 60 * 60 * 1e3,
+  h: 60 * 60 * 1e3,
+  m: 6e4,
+  ms: 1,
+  s: 1e3
+};
+var VIRTUAL_INTERFACE_PATTERN = /^(?:awdl|br|bridge|docker|ham|llw|lo|tap|tun|utun|vboxnet|veth|virbr|wg|zt)(?:\d|[-_.]|$)|(?:openvpn|tailscale|vethernet|virtualbox|vmnet|zerotier)/iu;
+function parseSessionTtl(value) {
+  const match = /^(\d+)(ms|[smhd])$/u.exec(value);
+  if (match === null) {
+    throw new Error("Invalid session TTL; use a positive integer followed by ms, s, m, h, or d");
+  }
+  const amount = BigInt(match[1] ?? "0");
+  const unit = match[2];
+  const milliseconds = amount * BigInt(UNIT_MS[unit]);
+  if (milliseconds <= 0n || milliseconds > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error(
+      "Invalid session TTL; duration must be a positive safe integer in milliseconds"
+    );
+  }
+  return Number(milliseconds);
+}
+function validateLanPassword(value) {
+  const hasRequiredStrength = value.length >= MIN_LAN_PASSWORD_LENGTH && value.length <= MAX_LAN_PASSWORD_LENGTH && /[A-Z]/u.test(value) && /[a-z]/u.test(value) && /[0-9]/u.test(value) && /[^A-Za-z0-9]/u.test(value);
+  if (!hasRequiredStrength) {
+    throw new Error(
+      "Invalid LAN password; expected 16 to 128 characters with uppercase, lowercase, number, and symbol"
+    );
+  }
+}
+function generateLanPairingCode() {
+  return randomBytes(16).toString("base64url");
+}
+function isPrivateIpv4(address) {
+  if (isIP(address) !== 4) {
+    return false;
+  }
+  const [first = -1, second = -1] = address.split(".").map(Number);
+  return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+}
+function isVirtualNetworkInterface(name) {
+  return VIRTUAL_INTERFACE_PATTERN.test(name);
+}
+function listLanAccessUrls(port, interfaces = networkInterfaces()) {
+  const addresses = Object.entries(interfaces).filter(([name]) => !isVirtualNetworkInterface(name)).flatMap(([, entries]) => entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && isPrivateIpv4(entry.address)).map((entry) => entry.address);
+  return [...new Set(addresses)].sort((left, right) => left.localeCompare(right, "en", { numeric: true })).map((address) => `http://${address}:${String(port)}`);
+}
+
+// src/cli-command.ts
+var startupAppUpdate = createStartupAppUpdateOperations(package_default.version);
+var defaultDependencies = {
+  appVersion: package_default.version,
+  checkAppUpdate: startupAppUpdate.check,
+  checkCodexVersion,
+  confirmAppUpdate: confirmTerminalAppUpdate,
+  createProjectRepository: ({ client, projection }) => new CodexProjectRepository(client, projection),
+  createStateRepository: (databasePath) => SqliteStateRepository.open(databasePath),
+  createRuntimeProvider: createCodexRuntimeProvider,
+  createServer: async (input) => {
+    const server = await createCodexlyServer({
+      ...input
+    });
+    return {
+      close: () => server.close(),
+      listen: (options) => server.listen(options)
+    };
+  },
+  ensureTemporaryWorkspace,
+  generateLanPairingCode,
+  listLanAccessUrls,
+  locateCodexBinary,
+  nodeVersion: process.versions.node,
+  openBrowser: openSystemBrowser,
+  installAppUpdate: startupAppUpdate.install,
+  restartAfterUpdate: restartCliAfterUpdate,
+  startCodexAppServer,
+  webRoot: fileURLToPath(new URL("../dist/web", import.meta.url))
+};
+async function ensureTemporaryWorkspace(path) {
+  await mkdir(path, { mode: 448, recursive: true });
+  const metadata = await lstat(path);
+  if (metadata.isSymbolicLink()) {
+    throw new Error("Temporary workspace must not be a symbolic link");
+  }
+  if (!metadata.isDirectory()) {
+    throw new Error("Temporary workspace path must be a directory");
+  }
+  await chmod(path, 448);
+  return realpath(path);
+}
+function assertSupportedNodeVersion(version) {
+  const [major = Number.NaN, minor = Number.NaN] = version.split(".").map(Number);
+  if (!(major > 22 || major === 22 && minor >= 14)) {
+    throw new Error(`\u9700\u8981 Node.js 22.14.0 \u6216\u66F4\u9AD8\u7248\u672C\uFF0C\u5F53\u524D\u7248\u672C\u4E3A ${version}`);
+  }
+}
+function resolveCodexHome(options) {
+  return options.codexHome ?? process.env["CODEX_HOME"] ?? join(homedir(), ".codex");
+}
+function assertDatabaseDiagnostics(diagnostics) {
+  if (!diagnostics.writable) {
+    throw new Error("SQLite database is not writable");
+  }
+  if (diagnostics.migrationVersion < 1) {
+    throw new Error("SQLite migrations are not applied");
+  }
+  if (diagnostics.integrityCheck !== "ok") {
+    throw new Error(`SQLite integrity_check failed: ${diagnostics.integrityCheck}`);
+  }
+  if (diagnostics.journalMode.toLocaleLowerCase() !== "wal") {
+    throw new Error(`SQLite journal_mode must be WAL; found ${diagnostics.journalMode}`);
+  }
+  if (!diagnostics.foreignKeys || diagnostics.synchronous !== "normal" || diagnostics.busyTimeout !== 5e3) {
+    throw new Error("SQLite PRAGMA configuration is invalid");
+  }
+}
+function createProcessShutdownSignal() {
+  const controller = new AbortController();
+  const abort = () => {
+    controller.abort();
+  };
+  process.once("SIGINT", abort);
+  process.once("SIGTERM", abort);
+  return {
+    cleanup: () => {
+      process.off("SIGINT", abort);
+      process.off("SIGTERM", abort);
+    },
+    signal: controller.signal
+  };
+}
+async function waitForAbort(signal) {
+  if (signal.aborted) {
+    return;
+  }
+  await new Promise((resolve) => {
+    signal.addEventListener(
+      "abort",
+      () => {
+        resolve();
+      },
+      { once: true }
+    );
+  });
+}
+async function runDoctor(args, dependencies, output) {
+  const options = parseCommandOptions(args, /* @__PURE__ */ new Set(["--codex-bin", "--codex-home"]));
+  assertSupportedNodeVersion(dependencies.nodeVersion);
+  output.success(`Node.js ${dependencies.nodeVersion}`);
+  const binary = await dependencies.locateCodexBinary(
+    options.codexBin ? { explicitPath: options.codexBin } : {}
+  );
+  const version = await dependencies.checkCodexVersion(binary.path);
+  output.success(`Codex ${version.version} (${binary.path})`);
+  const codexHome = resolveCodexHome(options);
+  const stateRepository = await dependencies.createStateRepository(
+    join(codexHome, "codexly", "state.sqlite3")
+  );
+  try {
+    const diagnostics = await stateRepository.diagnose();
+    assertDatabaseDiagnostics(diagnostics);
+    output.success(`SQLite \u53EF\u5199 (${join(codexHome, "codexly", "state.sqlite3")})`);
+    output.success(`SQLite migration ${String(diagnostics.migrationVersion)}`);
+    output.success(`SQLite integrity_check ${diagnostics.integrityCheck}`);
+    output.success(`SQLite journal_mode ${diagnostics.journalMode}`);
+    output.success(
+      `SQLite PRAGMA foreign_keys=ON synchronous=NORMAL busy_timeout=${String(diagnostics.busyTimeout)}`
+    );
+  } finally {
+    await stateRepository.close();
+  }
+  return 0;
+}
+async function runStart(args, dependencies, signal, output) {
+  const options = parseCommandOptions(
+    args,
+    /* @__PURE__ */ new Set([
+      "--allowed-host",
+      "--codex-bin",
+      "--codex-home",
+      "--lan-password",
+      "--port",
+      "--session-ttl"
+    ]),
+    /* @__PURE__ */ new Set(["--lan"])
+  );
+  if (options.sessionTtl !== void 0 && options.lan !== true) {
+    throw new Error("--session-ttl \u53EA\u80FD\u4E0E --lan \u4E00\u8D77\u4F7F\u7528");
+  }
+  if (options.lanPassword !== void 0 && options.lan !== true) {
+    throw new Error("--lan-password \u53EA\u80FD\u4E0E --lan \u4E00\u8D77\u4F7F\u7528");
+  }
+  if (options.lanPassword !== void 0) {
+    validateLanPassword(options.lanPassword);
+  }
+  const allowedHosts = options.allowedHosts?.map(normalizeAllowedHost);
+  const port = options.port ?? 3210;
+  const sessionTtlMs = options.sessionTtl ? parseSessionTtl(options.sessionTtl) : void 0;
+  const access = options.lan !== true ? void 0 : {
+    pairingCode: options.lanPassword ?? dependencies.generateLanPairingCode(),
+    ...sessionTtlMs === void 0 ? {} : { sessionTtlMs }
+  };
+  if (process.env[STARTUP_UPDATE_APPLIED_ENV] !== "1") {
+    const update = await dependencies.checkAppUpdate();
+    if (update.status === "check-failed") {
+      output.warning("\u65E0\u6CD5\u68C0\u67E5 Codexly \u66F4\u65B0\uFF0C\u5C06\u7EE7\u7EED\u542F\u52A8\u5F53\u524D\u7248\u672C\u3002");
+    } else if (update.status === "available" && update.latestVersion !== null) {
+      const shouldUpdate = await dependencies.confirmAppUpdate(
+        dependencies.appVersion,
+        update.latestVersion
+      );
+      if (shouldUpdate) {
+        output.info(`\u6B63\u5728\u66F4\u65B0 Codexly \u5230 ${update.latestVersion}...`);
+        await dependencies.installAppUpdate(update.latestVersion);
+        output.success(`Codexly \u5DF2\u66F4\u65B0\u5230 ${update.latestVersion}\uFF0C\u6B63\u5728\u91CD\u65B0\u542F\u52A8\u3002`);
+        return dependencies.restartAfterUpdate(["start", ...args]);
+      }
+      output.info("\u5DF2\u8DF3\u8FC7\u66F4\u65B0\uFF0C\u7EE7\u7EED\u542F\u52A8\u5F53\u524D\u7248\u672C\u3002");
+    }
+  }
+  const ownedShutdown = signal ? null : createProcessShutdownSignal();
+  const shutdownSignal = signal ?? ownedShutdown?.signal;
+  if (!shutdownSignal) {
+    throw new Error("Shutdown signal is unavailable");
+  }
+  let runtime;
+  let server;
+  let stateRepository;
+  try {
+    const codexHome = resolveCodexHome(options);
+    const env = {
+      ...process.env,
+      ...options.codexHome ? { CODEX_HOME: options.codexHome } : {}
+    };
+    stateRepository = await dependencies.createStateRepository(
+      join(codexHome, "codexly", "state.sqlite3")
+    );
+    const temporaryWorkspace = await dependencies.ensureTemporaryWorkspace(
+      join(codexHome, "codexly", "temporary-workspace")
+    );
+    runtime = await dependencies.startCodexAppServer({
+      appVersion: dependencies.appVersion,
+      env,
+      ...options.codexBin ? { binaryPath: options.codexBin } : {}
+    });
+    const projectRepository = dependencies.createProjectRepository({
+      client: runtime.client,
+      projection: stateRepository
+    });
+    const projectSourceMigration = await stateRepository.readProjectSourceMigration();
+    if (!projectSourceMigration.completed) {
+      await projectRepository.migrateLegacyProjects({
+        recoverUnassigned: projectSourceMigration.recoverUnassigned
+      });
+    }
+    await projectRepository.synchronize();
+    if (!projectSourceMigration.completed) {
+      await stateRepository.completeProjectSourceMigration();
+    }
+    const provider = await dependencies.createRuntimeProvider({
+      client: runtime.client
+    });
+    const appUpdateService = createAppUpdateService({
+      appVersion: dependencies.appVersion,
+      codexVersion: runtime.version.version
+    });
+    server = await dependencies.createServer({
+      ...access === void 0 ? {} : { access },
+      ...allowedHosts === void 0 ? {} : { allowedHosts },
+      projectRepository,
+      providerConnectionRepository: stateRepository,
+      provider,
+      installAppUpdate: appUpdateService.install,
+      readAppInfo: appUpdateService.read,
+      settingsRepository: stateRepository,
+      staticRoot: dependencies.webRoot,
+      temporaryWorkspace
+    });
+    const host = options.lan === true ? "0.0.0.0" : "127.0.0.1";
+    const activePort = await listenOnAvailablePort(server, host, port);
+    if (activePort !== port) {
+      output.warning(`\u7AEF\u53E3 ${String(port)} \u5DF2\u88AB\u5360\u7528\uFF0C\u5DF2\u81EA\u52A8\u5207\u6362\u5230\u7AEF\u53E3 ${String(activePort)}\u3002`);
+    }
+    output.success("Codexly \u5DF2\u542F\u52A8");
+    if (access !== void 0) {
+      const urls = dependencies.listLanAccessUrls(activePort);
+      output.warning("\u5C40\u57DF\u7F51\u6A21\u5F0F\u4F7F\u7528\u672A\u52A0\u5BC6\u7684 HTTP\uFF0C\u8BF7\u4EC5\u5728\u53EF\u4FE1\u7F51\u7EDC\u4E2D\u4F7F\u7528\u3002");
+      if (urls.length === 0) {
+        output.warning("\u672A\u627E\u5230\u53EF\u7528\u7684\u5C40\u57DF\u7F51 IPv4 \u5730\u5740\uFF0C\u670D\u52A1\u4ECD\u5728\u8FD0\u884C\u3002");
+      } else {
+        output.info(`\u5C40\u57DF\u7F51\u8BBF\u95EE\u5730\u5740:
+${urls.map((url) => `  ${url}`).join("\n")}`);
+      }
+      if (options.lanPassword === void 0) {
+        output.info(`\u914D\u5BF9\u7801: ${access.pairingCode}`);
+      } else {
+        output.info("\u5DF2\u4F7F\u7528\u81EA\u5B9A\u4E49\u8BBF\u95EE\u5BC6\u7801\uFF08\u4E0D\u4F1A\u5728\u7EC8\u7AEF\u56DE\u663E\uFF09\u3002");
+      }
+      output.info(
+        options.sessionTtl === void 0 ? "\u4F1A\u8BDD\u6709\u6548\u671F: \u6C38\u4E0D\u8FC7\u671F\uFF08\u4EC5\u5F53\u524D\u8FDB\u7A0B\uFF09" : `\u4F1A\u8BDD\u6709\u6548\u671F: ${options.sessionTtl}\uFF08\u56FA\u5B9A\u671F\u9650\uFF0C\u4E0D\u81EA\u52A8\u7EED\u671F\uFF09`
+      );
+      output.info("\u91CD\u542F Codexly \u540E\uFF0C\u5F53\u524D\u914D\u5BF9\u7801\u548C\u6240\u6709\u5C40\u57DF\u7F51\u4F1A\u8BDD\u5C06\u5931\u6548\u3002");
+    } else {
+      output.info(`\u8BBF\u95EE\u5730\u5740: http://127.0.0.1:${String(activePort)}`);
+    }
+    if (options.lan !== true) {
+      try {
+        await dependencies.openBrowser(`http://127.0.0.1:${String(activePort)}`);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        output.warning(`\u65E0\u6CD5\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u8BF7\u624B\u52A8\u8BBF\u95EE\u4E0A\u8FF0\u5730\u5740\u3002\u539F\u56E0: ${message}`);
+      }
+    }
+    const outcome = await Promise.race([
+      runtime.waitForExit().then((exit) => ({ exit, type: "process-exit" })),
+      waitForAbort(shutdownSignal).then(() => ({ type: "shutdown" }))
+    ]);
+    if (outcome.type === "process-exit") {
+      const reason = outcome.exit.signal ? `\u4FE1\u53F7 ${outcome.exit.signal}` : `\u9000\u51FA\u7801 ${String(outcome.exit.code)}`;
+      throw new Error(`Codex App Server \u5728 Codexly \u5173\u95ED\u524D\u610F\u5916\u9000\u51FA\uFF0C${reason}`);
+    }
+    return 0;
+  } finally {
+    try {
+      await server?.close();
+    } finally {
+      try {
+        await stateRepository?.close();
+      } finally {
+        try {
+          await runtime?.close();
+        } finally {
+          ownedShutdown?.cleanup();
+        }
+      }
+    }
+  }
+}
+async function runCli(argv, options = {}) {
+  const dependencies = options.dependencies ?? defaultDependencies;
+  const stdout = options.stdout ?? ((message) => process.stdout.write(message));
+  const stderr = options.stderr ?? ((message) => process.stderr.write(message));
+  const colorEnabled = options.color ?? (process.stdout.isTTY && process.env["NO_COLOR"] === void 0);
+  const output = createTerminalOutput(stdout, stderr, colorEnabled);
+  const [requestedCommand, ...rawArgs] = argv;
+  const command = requestedCommand ?? "start";
+  const args = rawArgs[0] === "--" ? rawArgs.slice(1) : rawArgs;
+  try {
+    if (command === "--help" || command === "-h") {
+      output.plain(CLI_HELP);
+      return 0;
+    }
+    if (command === "version") {
+      if (args.length > 0) {
+        throw new Error(`\u672A\u77E5\u9009\u9879: ${args[0] ?? "<empty>"}`);
+      }
+      output.plain(`codexly ${dependencies.appVersion}
+`);
+      return 0;
+    }
+    if (command === "doctor") {
+      return await runDoctor(args, dependencies, output);
+    }
+    if (command === "start") {
+      return await runStart(args, dependencies, options.signal, output);
+    }
+    throw new Error(`\u672A\u77E5\u547D\u4EE4: ${command}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    output.error(message);
+    return 1;
+  }
+}
+
+// src/cli.ts
+process.exitCode = await runCli(process.argv.slice(2));