@ccpocket/bridge 1.81.2 → 1.81.4

package/README.md

@@ -42,6 +42,7 @@ ccpocket-bridge --version
 | `BRIDGE_HOST` | `0.0.0.0` | Bind address |
 | `BRIDGE_API_KEY` | (none) | API key authentication (enabled when set) |
 | `BRIDGE_ALLOWED_DIRS` | `$HOME` | Comma-separated list of project directories the Bridge may access; set exactly to `*` to allow any directory |
+| `BRIDGE_FILE_DOWNLOAD_ALLOW_ALL_PATHS` | unset (project only) | Set exactly to `1` to allow sharing/downloading any regular file readable by the Bridge process, including paths outside `BRIDGE_ALLOWED_DIRS`. Absolute and relative paths within the selected project work by default. |
 | `BRIDGE_PUBLIC_WS_URL` | (none) | Public `ws://` / `wss://` URL used for startup deep link and QR code |
 | `BRIDGE_CODEX_APP_SERVER_MODE` | `private` | Experimental Codex app-server mode: `private`, `managed`, or `external` |
 | `BRIDGE_CODEX_SHARED_APP_SERVER_URL` | `ws://127.0.0.1:8767` in `managed` mode | Experimental shared Codex app-server URL for Codex CLI co-presence |
@@ -224,6 +225,7 @@ that affect startup:
 - `BRIDGE_HOST` / `--host`
 - `BRIDGE_API_KEY` / `--api-key`
 - `BRIDGE_ALLOWED_DIRS`
+- `BRIDGE_FILE_DOWNLOAD_ALLOW_ALL_PATHS`
 - `BRIDGE_PUBLIC_WS_URL` / `--public-ws-url`
 - `BRIDGE_DISABLE_MDNS` / `--no-mdns`
 - `BRIDGE_ALLOW_CLAUDE_OAUTH`
@@ -325,3 +327,22 @@ The bridge server spawns and manages Claude Code CLI processes, translating WebS
 
 This package is MIT licensed as part of CC Pocket. See [LICENSE](./LICENSE) and
 the repository root [LICENSE](../../LICENSE).
+
+### Sharing files by absolute path
+
+Sharing accepts both project-relative and absolute file paths. By default, the
+resolved file (including symlink targets) must stay inside the selected project
+and `BRIDGE_ALLOWED_DIRS`.
+
+To explicitly allow sharing files from any location:
+
+```bash
+BRIDGE_FILE_DOWNLOAD_ALLOW_ALL_PATHS=1 npx @ccpocket/bridge@latest
+```
+
+This opt-in grants connected clients download access to all regular files readable
+by the Bridge process. The selected project must still be an allowed, existing
+directory. Authentication, download size limits, and capability URLs remain in
+place. Uploads and other file access operations retain their existing rules.
+Set the variable when running `setup` to persist it in launchd/systemd, or update
+the service environment and restart the Bridge. No mobile app update is needed.

package/dist/codex-process.d.ts

@@ -1,6 +1,7 @@
 import { EventEmitter } from "node:events";
 import type { CodexGoal, CodexGoalStatus, ServerMessage, ProcessStatus } from "./parser.js";
 import { buildCodexSpawnSpec } from "./codex-transport.js";
+import type { CodexRateLimitsResponse } from "./usage.js";
 export { buildCodexSpawnSpec };
 export interface CodexStartOptions {
     threadId?: string;
@@ -245,7 +246,8 @@ export declare class CodexProcess extends EventEmitter<CodexProcessEvents> {
     listAvailableModels(): Promise<string[]>;
     listAvailableModelMetadata(): Promise<CodexModelMetadata[]>;
     start(projectPath: string, options?: CodexStartOptions): void;
-    initializeOnly(projectPath: string): Promise<void>;
+    initializeOnly(projectPath: string, timeoutMs?: number): Promise<void>;
+    readRateLimits(timeoutMs?: number): Promise<CodexRateLimitsResponse>;
     waitUntilReady(): Promise<void>;
     stop(): void;
     private prepareLaunch;

package/dist/codex-process.js

@@ -415,7 +415,7 @@ export class CodexProcess extends EventEmitter {
         this.launchAppServer(projectPath, options);
         void this.bootstrap(projectPath, options);
     }
-    async initializeOnly(projectPath) {
+    async initializeOnly(projectPath, timeoutMs) {
         if (this.transport) {
             this.stop();
         }
@@ -423,7 +423,7 @@ export class CodexProcess extends EventEmitter {
         try {
             this.prepareLaunch(projectPath);
             this.launchAppServer(projectPath);
-            await this.initializeRpcConnection();
+            await this.initializeRpcConnection(timeoutMs);
             this.setStatus("idle");
             this.resolveReadiness();
         }
@@ -432,6 +432,9 @@ export class CodexProcess extends EventEmitter {
             throw error;
         }
     }
+    async readRateLimits(timeoutMs = 10_000) {
+        return (await this.request("account/rateLimits/read", undefined, timeoutMs));
+    }
     waitUntilReady() {
         if (this.readiness === "ready")
             return Promise.resolve();
@@ -1175,7 +1178,7 @@ export class CodexProcess extends EventEmitter {
         });
         return extractPermissionsFromConfigRead(response, projectLookupPaths, this.platform, profile);
     }
-    async initializeRpcConnection() {
+    async initializeRpcConnection(timeoutMs) {
         await this.request("initialize", {
             clientInfo: {
                 name: "ccpocket_bridge",
@@ -1185,7 +1188,7 @@ export class CodexProcess extends EventEmitter {
             capabilities: {
                 experimentalApi: true,
             },
-        });
+        }, timeoutMs);
         this.notify("initialized", {});
     }
     async readProfileConfig(cwd) {