@roamcode.ai/server 1.0.18 → 1.0.20

package/dist/index.d.ts

@@ -2455,6 +2455,46 @@ type CodexAttachContext = Pick<AttachSpawnOptions, "baseUrl" | "token" | "mcpScr
 declare function buildCodexArgs(context: ProviderProcessContext, attach?: CodexAttachContext): string[];
 declare function createCodexProvider(options: CreateCodexProviderOptions): AgentProvider;
 
+declare const CODEX_EXECUTABLE_PROBE_TIMEOUT_MS = 5000;
+declare const OPENAI_CODE_SIGNING_TEAM_ID = "2DC432GLL2";
+type CodexExecutableProbe = {
+    state: "ready";
+    version: string;
+} | {
+    state: "timeout";
+} | {
+    state: "failed";
+};
+interface CodexExecutableResolution {
+    /** Stable user-selected command used by Codex terminals and auxiliary services. */
+    executable: string;
+    /** Resolved source installation inspected during boot. */
+    sourceExecutable: string;
+    provenance: CodexInstallProvenance;
+    /** True only when a blocked OpenAI-signed Homebrew executable was atomically repaired in place. */
+    recovered: boolean;
+}
+interface CodexExecutableDeps {
+    platform: NodeJS.Platform;
+    resolveExecutable(command: string, env: NodeJS.ProcessEnv): Promise<string | undefined>;
+    probe(executable: string, env: NodeJS.ProcessEnv): Promise<CodexExecutableProbe>;
+    verifyOfficialSignature(executable: string): Promise<boolean>;
+    clearExtendedAttributes(executable: string): Promise<boolean>;
+}
+interface ResolveCodexExecutableOptions {
+    codexBin: string;
+    dataDir: string;
+    env?: NodeJS.ProcessEnv;
+    deps?: Partial<CodexExecutableDeps>;
+}
+declare function defaultProbeCodexExecutable(executable: string, env: NodeJS.ProcessEnv): Promise<CodexExecutableProbe>;
+/**
+ * Probe the configured Codex CLI once at boot. Only a timed-out, officially signed Homebrew installation is
+ * repaired, and the configured command remains the stable launch path so future Homebrew upgrades are not pinned
+ * to an old Caskroom version.
+ */
+declare function resolveCodexExecutable(options: ResolveCodexExecutableOptions): Promise<CodexExecutableResolution>;
+
 declare const CODEX_OSC_MAX_CARRY: number;
 declare const CODEX_CLASSIFIER_TESTED_UP_TO = "0.144";
 interface CodexOscParser extends ProviderRuntimeSignalParser {
@@ -2467,4 +2507,4 @@ declare function codexClassifierVersionWarning(codexVersion: string | undefined)
 
 declare const SERVER_PACKAGE = "@roamcode.ai/server";
 
-export { API_PATH_DENYLIST, type AgentProvider, type AttachSpawnOptions, type AuthCheckResult, AuthGate, type AuthGateOptions, type Bar, CHECK_CACHE_MS, CLASSIFIER_TESTED_UP_TO, CLAUDE_LATEST_CACHE_MS, CLAUDE_VERSION_CACHE_MS, CLAUDE_VERSION_TIMEOUT_MS, CODEX_CLASSIFIER_TESTED_UP_TO, CODEX_OSC_MAX_CARRY, type CaptureOptions, type ChangelogEntry, type ClaudeAuthDeps, ClaudeAuthService, type ClaudeAuthStatus, type ClaudeAvailability, type ClaudeLatestDeps, ClaudeLatestService, type ClaudeMetadataRunner, ClaudeMetadataService, type ClaudeModelCatalogItem, type ClaudeSessionOptions, type ClaudeVersionProbe, type CodexAccount, CodexAppServerClient, type CodexAppServerClientOptions, type CodexDeviceLogin, type CodexInstallProvenance, CodexLatestService, type CodexLoginCompletion, type CodexLoginStatus, type CodexMetadataDiagnostics, type CodexMetadataRpc, CodexMetadataService, type CodexMetadataServiceOptions, type CodexModel, type CodexOscParser, type CodexProfileClientLifecycle, type CodexSessionOptions, type CodexSpawnLease, type CodexThreadInventoryEntry, type CodexThreadPersistence, CodexThreadResolver, type CodexThreadResolverOptions, type CodexUsage, type CodexVersionInfo, type CreateClaudeProviderOptions, type CreateCodexProfileClientLifecycleOptions, type CreateCodexProviderOptions, type CreatePushDispatcherDeps, type CreateServerDeps, type CreateServerResult, type CreateWebPushSendOptions, type DirEntry, type DirListing, type DirSearchResult, FETCH_TIMEOUT_MS, type FetchLatest, type FetchManifest, type FetchReleases, FsError, type FsErrorCode, FsService, type FsServiceOptions, type GitHubRelease, type HooksSettingsDocument, type IPty, type InstallServiceContext, type InstallServiceResult, type InstallationKind, type LaunchIntent, type ManagedInstallOptions, type ManagedInstallResult, type ManagedInstallStatus, type ManagedPaths, type McpConfigDocument, type ModelWeekBar, type OpenPushStoreOptions, type OpenSessionStoreOptions, type OriginCheckOptions, type PaneStatus, type ProcessSpec, type ProviderAvailability, ProviderError, type ProviderId, ProviderOptionsError, type ProviderProcessContext, ProviderRegistry, type ProviderRuntimeSignal, type ProviderRuntimeSignalParser, type ProviderSessionOptions, type PtySpawn, type PushDispatcher, type PushEvent, type PushEventKind, type PushPayload, type PushRecipient, type PushSendFn, type PushStore, type PushSubscriptionRecord, RUNNING_BUILD, RUNNING_VERSION, type RateLimitDecision, RateLimiter, type RateLimiterOptions, type RegisterStaticOptions, type ReleaseRecord, type RenderLaunchdOptions, type RenderSystemdOptions, type ResolveAccessTokenOptions, type ResolveCodexThreadOptions, type ResolveVapidKeysOptions, type RunClaudeVersion, type RunUsage, SEARCH_MAX_DEPTH, SEARCH_MAX_DIRS, SEARCH_MAX_RESULTS, SERVER_PACKAGE, SHELL_PATH_ALLOWLIST, type ServerConfig, type ServerRuntimeConfig, type ServiceRecord, type SessionDefaults, SessionDefaultsConflictError, type SessionFileDirection, type SessionFileKind, type SessionFileStorage, type SessionStore, type StoreMode, type StoredSession, type StoredSessionDefaults, type StoredSessionFile, type StoredStatus, TerminalManager, type TerminalManagerDeps, type TerminalMeta, TerminalProcess, type TerminalProcessOptions, type TerminalSub, USAGE_CACHE_MS, USAGE_TIMEOUT_MS, type UpdateAction, type UpdateState, type UpdateStatus, Updater, type UpdaterDeps, type UpdaterFs, type UsageInfo, UsageService, type UsageServiceDeps, type VapidKeys, type VersionInfo, WS_TICKET_TTL_MS, WsTicketStore, type WsTicketStoreOptions, assertConfigAllowsStart, buildCodexArgs, buildHooksSettingsDocument, buildMcpConfigDocument, buildPushPayload, buildServicePath, capturePane, classifierVersionWarning, classifyCodexPane, classifyPaneStatus, claudePreflightWarning, codexClassifierVersionWarning, compareVersions, computeBuildDrift, computeInstallDrift, createClaudeAuthService, createClaudeLatestService, createClaudeMetadataRunner, createClaudeProvider, createClaudeVersionProbe, createCodexOscParser, createCodexProfileClientLifecycle, createCodexProvider, createCodexThreadInventory, createCodexThreadPersistence, createPushDispatcher, createServer, createUpdater, createUsageRunner, createUsageService, createWebPushSend, defaultFetchManifest, defaultFetchReleases, defaultRunClaudeVersion, defaultUpdaterFs, detectTerminalSupport, enableService, ensureDataDir, extractBearerToken, extractLoginUrl, generateAccessToken, hasEncodedSep, hookAuthFileContent, hookAuthPathFor, hooksSettingsPathFor, installManagedRelease, installService, isCodexProfileClientLifecycle, isLoopbackAddress, isNewerMajorMinor, isOriginAllowed, isPublicForRequest, isPublicPath, isShellPath, isStableVersion, listTmuxSessions, loadConfig, loadServerConfig, looksLikeAssetRequest, managedPaths, mcpConfigPathFor, migrateServiceToLauncher, normalizeOrigin, normalizeProviderAvailability, normalizeRelease, normalizeSessionDefaults, openPushStore, openSessionStore, parseAllowedOrigins, parseAuthStatus, parseClaudeVersion, parseCodexOscNotifications, parseCodexVersion, parseLegacyClaudeArgs, parseNpmLatest, parseProviderOptions, parseReleaseNotes, parseUsage, pathForGate, persistAccessToken, providerPreflightWarning, readActiveVersion, readPreviousVersion, readServiceRecord, registerStatic, relativeWhen, renderLaunchdPlist, renderManagedLauncher, renderSystemdUnit, resetCodexThreadResolutionCoordinatorForTests, resolveAccessToken, resolveDataDir, resolveInstallRoot, resolveVapidKeys, restartService, runClaudePreflight, runProviderPreflight, stableReleases, startServer, tmuxSessionName, writeManagedLauncher };
+export { API_PATH_DENYLIST, type AgentProvider, type AttachSpawnOptions, type AuthCheckResult, AuthGate, type AuthGateOptions, type Bar, CHECK_CACHE_MS, CLASSIFIER_TESTED_UP_TO, CLAUDE_LATEST_CACHE_MS, CLAUDE_VERSION_CACHE_MS, CLAUDE_VERSION_TIMEOUT_MS, CODEX_CLASSIFIER_TESTED_UP_TO, CODEX_EXECUTABLE_PROBE_TIMEOUT_MS, CODEX_OSC_MAX_CARRY, type CaptureOptions, type ChangelogEntry, type ClaudeAuthDeps, ClaudeAuthService, type ClaudeAuthStatus, type ClaudeAvailability, type ClaudeLatestDeps, ClaudeLatestService, type ClaudeMetadataRunner, ClaudeMetadataService, type ClaudeModelCatalogItem, type ClaudeSessionOptions, type ClaudeVersionProbe, type CodexAccount, CodexAppServerClient, type CodexAppServerClientOptions, type CodexDeviceLogin, type CodexExecutableDeps, type CodexExecutableProbe, type CodexExecutableResolution, type CodexInstallProvenance, CodexLatestService, type CodexLoginCompletion, type CodexLoginStatus, type CodexMetadataDiagnostics, type CodexMetadataRpc, CodexMetadataService, type CodexMetadataServiceOptions, type CodexModel, type CodexOscParser, type CodexProfileClientLifecycle, type CodexSessionOptions, type CodexSpawnLease, type CodexThreadInventoryEntry, type CodexThreadPersistence, CodexThreadResolver, type CodexThreadResolverOptions, type CodexUsage, type CodexVersionInfo, type CreateClaudeProviderOptions, type CreateCodexProfileClientLifecycleOptions, type CreateCodexProviderOptions, type CreatePushDispatcherDeps, type CreateServerDeps, type CreateServerResult, type CreateWebPushSendOptions, type DirEntry, type DirListing, type DirSearchResult, FETCH_TIMEOUT_MS, type FetchLatest, type FetchManifest, type FetchReleases, FsError, type FsErrorCode, FsService, type FsServiceOptions, type GitHubRelease, type HooksSettingsDocument, type IPty, type InstallServiceContext, type InstallServiceResult, type InstallationKind, type LaunchIntent, type ManagedInstallOptions, type ManagedInstallResult, type ManagedInstallStatus, type ManagedPaths, type McpConfigDocument, type ModelWeekBar, OPENAI_CODE_SIGNING_TEAM_ID, type OpenPushStoreOptions, type OpenSessionStoreOptions, type OriginCheckOptions, type PaneStatus, type ProcessSpec, type ProviderAvailability, ProviderError, type ProviderId, ProviderOptionsError, type ProviderProcessContext, ProviderRegistry, type ProviderRuntimeSignal, type ProviderRuntimeSignalParser, type ProviderSessionOptions, type PtySpawn, type PushDispatcher, type PushEvent, type PushEventKind, type PushPayload, type PushRecipient, type PushSendFn, type PushStore, type PushSubscriptionRecord, RUNNING_BUILD, RUNNING_VERSION, type RateLimitDecision, RateLimiter, type RateLimiterOptions, type RegisterStaticOptions, type ReleaseRecord, type RenderLaunchdOptions, type RenderSystemdOptions, type ResolveAccessTokenOptions, type ResolveCodexExecutableOptions, type ResolveCodexThreadOptions, type ResolveVapidKeysOptions, type RunClaudeVersion, type RunUsage, SEARCH_MAX_DEPTH, SEARCH_MAX_DIRS, SEARCH_MAX_RESULTS, SERVER_PACKAGE, SHELL_PATH_ALLOWLIST, type ServerConfig, type ServerRuntimeConfig, type ServiceRecord, type SessionDefaults, SessionDefaultsConflictError, type SessionFileDirection, type SessionFileKind, type SessionFileStorage, type SessionStore, type StoreMode, type StoredSession, type StoredSessionDefaults, type StoredSessionFile, type StoredStatus, TerminalManager, type TerminalManagerDeps, type TerminalMeta, TerminalProcess, type TerminalProcessOptions, type TerminalSub, USAGE_CACHE_MS, USAGE_TIMEOUT_MS, type UpdateAction, type UpdateState, type UpdateStatus, Updater, type UpdaterDeps, type UpdaterFs, type UsageInfo, UsageService, type UsageServiceDeps, type VapidKeys, type VersionInfo, WS_TICKET_TTL_MS, WsTicketStore, type WsTicketStoreOptions, assertConfigAllowsStart, buildCodexArgs, buildHooksSettingsDocument, buildMcpConfigDocument, buildPushPayload, buildServicePath, capturePane, classifierVersionWarning, classifyCodexPane, classifyPaneStatus, claudePreflightWarning, codexClassifierVersionWarning, compareVersions, computeBuildDrift, computeInstallDrift, createClaudeAuthService, createClaudeLatestService, createClaudeMetadataRunner, createClaudeProvider, createClaudeVersionProbe, createCodexOscParser, createCodexProfileClientLifecycle, createCodexProvider, createCodexThreadInventory, createCodexThreadPersistence, createPushDispatcher, createServer, createUpdater, createUsageRunner, createUsageService, createWebPushSend, defaultFetchManifest, defaultFetchReleases, defaultProbeCodexExecutable, defaultRunClaudeVersion, defaultUpdaterFs, detectTerminalSupport, enableService, ensureDataDir, extractBearerToken, extractLoginUrl, generateAccessToken, hasEncodedSep, hookAuthFileContent, hookAuthPathFor, hooksSettingsPathFor, installManagedRelease, installService, isCodexProfileClientLifecycle, isLoopbackAddress, isNewerMajorMinor, isOriginAllowed, isPublicForRequest, isPublicPath, isShellPath, isStableVersion, listTmuxSessions, loadConfig, loadServerConfig, looksLikeAssetRequest, managedPaths, mcpConfigPathFor, migrateServiceToLauncher, normalizeOrigin, normalizeProviderAvailability, normalizeRelease, normalizeSessionDefaults, openPushStore, openSessionStore, parseAllowedOrigins, parseAuthStatus, parseClaudeVersion, parseCodexOscNotifications, parseCodexVersion, parseLegacyClaudeArgs, parseNpmLatest, parseProviderOptions, parseReleaseNotes, parseUsage, pathForGate, persistAccessToken, providerPreflightWarning, readActiveVersion, readPreviousVersion, readServiceRecord, registerStatic, relativeWhen, renderLaunchdPlist, renderManagedLauncher, renderSystemdUnit, resetCodexThreadResolutionCoordinatorForTests, resolveAccessToken, resolveCodexExecutable, resolveDataDir, resolveInstallRoot, resolveVapidKeys, restartService, runClaudePreflight, runProviderPreflight, stableReleases, startServer, tmuxSessionName, writeManagedLauncher };

package/dist/index.js

@@ -2268,16 +2268,16 @@ async function smokeServer(serverEntry, dataDir, nodePath, log) {
     void dataDir;
   }
 }
-function replaceSymlink(link, target) {
-  const temp = `${link}.${process.pid}.${randomUUID2()}.new`;
+function replaceSymlink(link2, target) {
+  const temp = `${link2}.${process.pid}.${randomUUID2()}.new`;
   try {
     unlinkSync(temp);
   } catch {
   }
-  const parent = realpathSync(dirname2(link));
+  const parent = realpathSync(dirname2(link2));
   const canonicalTarget = realpathSync(target);
   symlinkSync(relative(parent, canonicalTarget), temp, "dir");
-  renameSync(temp, link);
+  renameSync(temp, link2);
 }
 function trimLog(log) {
   return log.split("\n").slice(-20).join("\n").slice(-8e3);
@@ -2429,7 +2429,7 @@ async function installManagedRelease(opts) {
 }
 
 // src/updater.ts
-var RUNNING_VERSION = "1.0.18" ? "1.0.18".replace(/^v/, "") : packageVersion();
+var RUNNING_VERSION = "1.0.20" ? "1.0.20".replace(/^v/, "") : packageVersion();
 var RUNNING_BUILD = RUNNING_VERSION;
 var RELEASES_API = "https://api.github.com/repos/burakgon/roamcode/releases?per_page=100";
 var RELEASE_MANIFEST_ASSET = "roamcode-release.json";
@@ -5828,7 +5828,7 @@ function createServer(config, deps = {}) {
           availability = { terminalAvailable: false, metadataAvailable: false };
         }
         availability = normalizeProviderAvailability(terminalAvailable, availability);
-        if (provider.id === "codex") {
+        if (provider.id === "codex" && availability.terminalAvailable) {
           let metadataAvailable = false;
           try {
             metadataAvailable = Boolean(
@@ -6386,7 +6386,7 @@ function contentDisposition(filename, disposition = "attachment") {
 
 // src/start.ts
 import { pathToFileURL, fileURLToPath as fileURLToPath2 } from "url";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { existsSync as existsSync6 } from "fs";
 
 // src/push-store.ts
@@ -7396,11 +7396,11 @@ async function resolveSecureCodexHome(configured) {
   if (!configured || !isAbsolute3(configured)) return void 0;
   try {
     if (await hasSymlinkComponent(configured)) return void 0;
-    const stat3 = await lstat(configured, { bigint: true });
-    if (!stat3.isDirectory() || stat3.isSymbolicLink()) return void 0;
+    const stat4 = await lstat(configured, { bigint: true });
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return void 0;
     const canonical = await realpath2(configured);
     const after = await lstat(configured, { bigint: true });
-    return canonical === resolve6(configured) && after.isDirectory() && !after.isSymbolicLink() && stat3.dev === after.dev && stat3.ino === after.ino ? canonical : void 0;
+    return canonical === resolve6(configured) && after.isDirectory() && !after.isSymbolicLink() && stat4.dev === after.dev && stat4.ino === after.ino ? canonical : void 0;
   } catch {
     return void 0;
   }
@@ -7429,23 +7429,23 @@ async function captureProfileFingerprint(codexHome, profile) {
 async function captureConfigFileFingerprint(codexHome, path) {
   try {
     if (relative2(codexHome, path).startsWith("..")) return void 0;
-    const stat3 = await lstat(path, { bigint: true });
-    if (!stat3.isFile() || stat3.isSymbolicLink()) return void 0;
-    if (stat3.size > BigInt(MAX_CONFIG_BYTES)) return void 0;
+    const stat4 = await lstat(path, { bigint: true });
+    if (!stat4.isFile() || stat4.isSymbolicLink()) return void 0;
+    if (stat4.size > BigInt(MAX_CONFIG_BYTES)) return void 0;
     const realPath = await realpath2(path);
     if (realPath !== path) return void 0;
     const contents = await readFile2(path);
     const after = await lstat(path, { bigint: true });
-    if (!after.isFile() || after.isSymbolicLink() || stat3.dev !== after.dev || stat3.ino !== after.ino || stat3.size !== after.size || stat3.mtimeNs !== after.mtimeNs) {
+    if (!after.isFile() || after.isSymbolicLink() || stat4.dev !== after.dev || stat4.ino !== after.ino || stat4.size !== after.size || stat4.mtimeNs !== after.mtimeNs) {
       return void 0;
     }
     return {
       path,
       realPath,
-      dev: stat3.dev,
-      ino: stat3.ino,
-      size: stat3.size,
-      mtimeNs: stat3.mtimeNs,
+      dev: stat4.dev,
+      ino: stat4.ino,
+      size: stat4.size,
+      mtimeNs: stat4.mtimeNs,
       digest: createHash("sha256").update(contents).digest("hex")
     };
   } catch {
@@ -8585,8 +8585,199 @@ var CodexLatestService = class {
   }
 };
 
-// src/start.ts
+// src/providers/codex-executable.ts
 import { execFile } from "child_process";
+import { constants as constants2 } from "fs";
+import { access, chmod, copyFile, link, realpath as realpath3, rename as rename2, rm, rmdir as rmdir2, stat as stat3 } from "fs/promises";
+import { randomUUID as randomUUID7 } from "crypto";
+import { basename as basename3, delimiter, dirname as dirname5, isAbsolute as isAbsolute5, join as join12, sep as sep5 } from "path";
+var CODEX_EXECUTABLE_PROBE_TIMEOUT_MS = 5e3;
+var OPENAI_CODE_SIGNING_TEAM_ID = "2DC432GLL2";
+var MAX_CODEX_BYTES = 1024 * 1024 * 1024;
+var MAX_PROCESS_OUTPUT_BYTES = 16 * 1024;
+var LEGACY_MANAGED_DIRECTORY = "provider-bin";
+var LEGACY_MANAGED_EXECUTABLE = "codex-macos";
+var LEGACY_MANAGED_STATE = "codex-macos-source.json";
+function runBounded(executable, args, options) {
+  return new Promise((resolve7) => {
+    execFile(
+      executable,
+      [...args],
+      {
+        ...options.env ? { env: options.env } : {},
+        timeout: options.timeoutMs,
+        maxBuffer: options.maxOutputBytes,
+        windowsHide: true,
+        encoding: "utf8"
+      },
+      (error, stdout, stderr) => {
+        resolve7({
+          ...error ? { error } : {},
+          stdout: String(stdout),
+          stderr: String(stderr)
+        });
+      }
+    );
+  });
+}
+async function defaultProbeCodexExecutable(executable, env) {
+  const result = await runBounded(executable, ["--version"], {
+    env,
+    timeoutMs: CODEX_EXECUTABLE_PROBE_TIMEOUT_MS,
+    maxOutputBytes: 1024
+  });
+  if (result.error) {
+    if (result.error.killed || result.error.signal === "SIGTERM" || result.error.signal === "SIGKILL") {
+      return { state: "timeout" };
+    }
+    return { state: "failed" };
+  }
+  try {
+    return { state: "ready", version: parseCodexVersion(result.stdout) };
+  } catch {
+    return { state: "failed" };
+  }
+}
+async function defaultResolveExecutable(command, env) {
+  const candidates = isAbsolute5(command) || command.includes(sep5) ? [command] : (env.PATH ?? process.env.PATH ?? "").split(delimiter).filter(Boolean).map((entry) => join12(entry, command));
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants2.X_OK);
+      return await realpath3(candidate);
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function defaultVerifyOfficialSignature(executable) {
+  const verified = await runBounded("/usr/bin/codesign", ["--verify", "--strict", executable], {
+    timeoutMs: 5e3,
+    maxOutputBytes: MAX_PROCESS_OUTPUT_BYTES
+  });
+  if (verified.error) return false;
+  const details = await runBounded("/usr/bin/codesign", ["-d", "--verbose=4", executable], {
+    timeoutMs: 5e3,
+    maxOutputBytes: MAX_PROCESS_OUTPUT_BYTES
+  });
+  if (details.error) return false;
+  return new RegExp(`^TeamIdentifier=${OPENAI_CODE_SIGNING_TEAM_ID}$`, "m").test(details.stderr) && /^Identifier=codex$/m.test(details.stderr);
+}
+async function defaultClearExtendedAttributes(executable) {
+  const result = await runBounded("/usr/bin/xattr", ["-c", executable], {
+    timeoutMs: 5e3,
+    maxOutputBytes: MAX_PROCESS_OUTPUT_BYTES
+  });
+  return !result.error;
+}
+var defaultDeps = {
+  platform: process.platform,
+  resolveExecutable: defaultResolveExecutable,
+  probe: defaultProbeCodexExecutable,
+  verifyOfficialSignature: defaultVerifyOfficialSignature,
+  clearExtendedAttributes: defaultClearExtendedAttributes
+};
+function provenanceFor(executable) {
+  const normalized = executable.replaceAll("\\", "/");
+  if (/\/Caskroom\/codex\//i.test(normalized)) return "homebrew";
+  if (/\/Applications\/Codex\.app\//i.test(normalized)) return "chatgpt";
+  if (/\/node_modules\/(?:@openai\/codex|@openai\/codex-[^/]+)\//i.test(normalized)) return "npm";
+  return "unknown";
+}
+function validSource(sourceStat) {
+  return sourceStat.isFile() && sourceStat.size > 0 && sourceStat.size <= MAX_CODEX_BYTES;
+}
+function sameSource(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
+}
+async function removeLegacyManagedCopy(dataDir) {
+  const directory = join12(dataDir, LEGACY_MANAGED_DIRECTORY);
+  await Promise.all([
+    rm(join12(directory, LEGACY_MANAGED_EXECUTABLE), { force: true }).catch(() => void 0),
+    rm(join12(directory, LEGACY_MANAGED_STATE), { force: true }).catch(() => void 0)
+  ]);
+  await rmdir2(directory).catch(() => void 0);
+}
+async function repairHomebrewExecutable(source, sourceStat, env, deps) {
+  if (!await deps.verifyOfficialSignature(source)) return false;
+  const nonce = randomUUID7();
+  const directory = dirname5(source);
+  const name = basename3(source);
+  const temporary = join12(directory, `.${name}.roamcode-repair-${nonce}`);
+  const backup = join12(directory, `.${name}.roamcode-backup-${nonce}`);
+  let backupCreated = false;
+  let sourceReplaced = false;
+  let committed = false;
+  let preserveBackup = false;
+  try {
+    await copyFile(source, temporary, constants2.COPYFILE_EXCL);
+    await chmod(temporary, sourceStat.mode & 511);
+    if (!await deps.clearExtendedAttributes(temporary)) return false;
+    if (!await deps.verifyOfficialSignature(temporary)) return false;
+    if ((await deps.probe(temporary, env)).state !== "ready") return false;
+    const currentStat = await stat3(source);
+    if (!sameSource(sourceStat, currentStat)) return false;
+    await link(source, backup);
+    backupCreated = true;
+    await rename2(temporary, source);
+    sourceReplaced = true;
+    if (!await deps.verifyOfficialSignature(source)) return false;
+    if ((await deps.probe(source, env)).state !== "ready") return false;
+    committed = true;
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (sourceReplaced && !committed && backupCreated) {
+      try {
+        await rename2(backup, source);
+        backupCreated = false;
+      } catch {
+        preserveBackup = true;
+      }
+    }
+    await rm(temporary, { force: true }).catch(() => void 0);
+    if (!preserveBackup) await rm(backup, { force: true }).catch(() => void 0);
+  }
+}
+async function resolveCodexExecutable(options) {
+  const env = options.env ?? process.env;
+  const deps = { ...defaultDeps, ...options.deps };
+  const unresolved = {
+    executable: options.codexBin,
+    sourceExecutable: options.codexBin,
+    provenance: "unknown",
+    recovered: false
+  };
+  if (deps.platform !== "darwin") return unresolved;
+  const source = await deps.resolveExecutable(options.codexBin, env);
+  if (!source) return unresolved;
+  const provenance = provenanceFor(source);
+  const ordinary = {
+    executable: options.codexBin,
+    sourceExecutable: source,
+    provenance,
+    recovered: false
+  };
+  let sourceStat;
+  try {
+    sourceStat = await stat3(source);
+  } catch {
+    return ordinary;
+  }
+  if (!validSource(sourceStat)) return ordinary;
+  const sourceProbe = await deps.probe(source, env);
+  if (sourceProbe.state === "ready") {
+    await removeLegacyManagedCopy(options.dataDir);
+    return ordinary;
+  }
+  if (sourceProbe.state !== "timeout" || provenance !== "homebrew") return ordinary;
+  if (!await repairHomebrewExecutable(source, sourceStat, env, deps)) return ordinary;
+  await removeLegacyManagedCopy(options.dataDir);
+  return { ...ordinary, recovered: true };
+}
+
+// src/start.ts
+import { execFile as execFile2 } from "child_process";
 function providerPreflightWarning(name, availability) {
   if (availability.terminalAvailable) return void 0;
   return `
@@ -8637,7 +8828,18 @@ async function startServer(env = process.env) {
     config.accessToken = token;
   }
   assertConfigAllowsStart(config);
-  const store = openSessionStore({ dbPath: join12(config.dataDir, "sessions.db") });
+  const codexExecutable = await resolveCodexExecutable({
+    codexBin: config.codexBin,
+    dataDir: config.dataDir,
+    env
+  });
+  const codexBin = codexExecutable.executable;
+  if (codexExecutable.recovered) {
+    console.warn(
+      "[roamcode] Repaired a macOS-blocked Homebrew Codex CLI in place using a verified, byte-identical OpenAI-signed replacement; no private binary was retained."
+    );
+  }
+  const store = openSessionStore({ dbPath: join13(config.dataDir, "sessions.db") });
   const storeMode = store.mode;
   if (storeMode === "memory-fallback") {
     console.warn(
@@ -8653,7 +8855,7 @@ async function startServer(env = process.env) {
   }).catch(() => {
   });
   const vapid = resolveVapidKeys({ dataDir: config.dataDir });
-  const pushStore = openPushStore({ dbPath: join12(config.dataDir, "push.db") });
+  const pushStore = openPushStore({ dbPath: join13(config.dataDir, "push.db") });
   const vapidSubject = (env.ROAMCODE_VAPID_SUBJECT ?? env.REMOTE_CODER_VAPID_SUBJECT)?.trim() || "mailto:roamcode@localhost";
   let pushDispatcher;
   try {
@@ -8677,7 +8879,7 @@ async function startServer(env = process.env) {
       env
     })
   );
-  const codexClient = new CodexAppServerClient({ codexBin: config.codexBin, env });
+  const codexClient = new CodexAppServerClient({ codexBin, env });
   const codexRpc = {
     request: async (method, params, schema) => {
       await codexClient.start();
@@ -8685,7 +8887,7 @@ async function startServer(env = process.env) {
     },
     onNotification: (listener) => codexClient.onNotification(listener)
   };
-  const profileClient = createCodexProfileClientLifecycle({ codexBin: config.codexBin, env });
+  const profileClient = createCodexProfileClientLifecycle({ codexBin, env });
   const codexMetadata = new CodexMetadataService(codexRpc, {
     ...env.CODEX_HOME ? { codexHome: env.CODEX_HOME } : {},
     profileClient
@@ -8696,8 +8898,8 @@ async function startServer(env = process.env) {
   };
   const codexLatest = new CodexLatestService({
     runVersion: (args, options) => new Promise((resolve7, reject) => {
-      execFile(
-        config.codexBin,
+      execFile2(
+        codexBin,
         [...args],
         { env, timeout: options.timeoutMs, maxBuffer: options.maxOutputBytes, windowsHide: true },
         (error, stdout, stderr) => {
@@ -8714,7 +8916,7 @@ async function startServer(env = process.env) {
         }
       );
     }),
-    detectProvenance: () => "unknown",
+    detectProvenance: () => codexExecutable.provenance,
     fetchNpmLatest: async (_packageName, options) => {
       const response = await fetch("https://registry.npmjs.org/@openai%2Fcodex/latest", {
         signal: AbortSignal.timeout(options.timeoutMs)
@@ -8740,7 +8942,7 @@ async function startServer(env = process.env) {
       }
     }),
     createCodexProvider({
-      codexBin: config.codexBin,
+      codexBin,
       env,
       validateProfile: codexMetadata.validateProfile,
       probe: async () => {
@@ -8809,7 +9011,7 @@ async function startServer(env = process.env) {
 }
 function defaultWebDir() {
   const here = fileURLToPath2(new URL(".", import.meta.url));
-  return join12(here, "..", "..", "web", "dist");
+  return join13(here, "..", "..", "web", "dist");
 }
 function installCrashGuards() {
   process.on("unhandledRejection", (reason) => {
@@ -8858,6 +9060,7 @@ export {
   CLAUDE_VERSION_CACHE_MS,
   CLAUDE_VERSION_TIMEOUT_MS,
   CODEX_CLASSIFIER_TESTED_UP_TO,
+  CODEX_EXECUTABLE_PROBE_TIMEOUT_MS,
   CODEX_OSC_MAX_CARRY,
   ClaudeAuthService,
   ClaudeLatestService,
@@ -8869,6 +9072,7 @@ export {
   FETCH_TIMEOUT_MS,
   FsError,
   FsService,
+  OPENAI_CODE_SIGNING_TEAM_ID,
   ProviderError,
   ProviderOptionsError,
   ProviderRegistry,
@@ -8922,6 +9126,7 @@ export {
   createWebPushSend,
   defaultFetchManifest,
   defaultFetchReleases,
+  defaultProbeCodexExecutable,
   defaultRunClaudeVersion,
   defaultUpdaterFs,
   detectTerminalSupport,
@@ -8980,6 +9185,7 @@ export {
   renderSystemdUnit,
   resetCodexThreadResolutionCoordinatorForTests,
   resolveAccessToken,
+  resolveCodexExecutable,
   resolveDataDir,
   resolveInstallRoot,
   resolveVapidKeys,

package/dist/start.js

@@ -2,7 +2,7 @@
 
 // src/start.ts
 import { pathToFileURL, fileURLToPath as fileURLToPath2 } from "url";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { existsSync as existsSync6 } from "fs";
 
 // src/transport.ts
@@ -871,7 +871,7 @@ function readPreviousVersion(root) {
 }
 
 // src/updater.ts
-var RUNNING_VERSION = "1.0.18" ? "1.0.18".replace(/^v/, "") : packageVersion();
+var RUNNING_VERSION = "1.0.20" ? "1.0.20".replace(/^v/, "") : packageVersion();
 var RELEASES_API = "https://api.github.com/repos/burakgon/roamcode/releases?per_page=100";
 var RELEASE_MANIFEST_ASSET = "roamcode-release.json";
 var CHECK_CACHE_MS = 15 * 6e4;
@@ -5215,7 +5215,7 @@ function createServer(config, deps = {}) {
           availability = { terminalAvailable: false, metadataAvailable: false };
         }
         availability = normalizeProviderAvailability(terminalAvailable, availability);
-        if (provider.id === "codex") {
+        if (provider.id === "codex" && availability.terminalAvailable) {
           let metadataAvailable = false;
           try {
             metadataAvailable = Boolean(
@@ -6857,11 +6857,11 @@ async function resolveSecureCodexHome(configured) {
   if (!configured || !isAbsolute3(configured)) return void 0;
   try {
     if (await hasSymlinkComponent(configured)) return void 0;
-    const stat3 = await lstat(configured, { bigint: true });
-    if (!stat3.isDirectory() || stat3.isSymbolicLink()) return void 0;
+    const stat4 = await lstat(configured, { bigint: true });
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return void 0;
     const canonical = await realpath2(configured);
     const after = await lstat(configured, { bigint: true });
-    return canonical === resolve6(configured) && after.isDirectory() && !after.isSymbolicLink() && stat3.dev === after.dev && stat3.ino === after.ino ? canonical : void 0;
+    return canonical === resolve6(configured) && after.isDirectory() && !after.isSymbolicLink() && stat4.dev === after.dev && stat4.ino === after.ino ? canonical : void 0;
   } catch {
     return void 0;
   }
@@ -6890,23 +6890,23 @@ async function captureProfileFingerprint(codexHome, profile) {
 async function captureConfigFileFingerprint(codexHome, path) {
   try {
     if (relative2(codexHome, path).startsWith("..")) return void 0;
-    const stat3 = await lstat(path, { bigint: true });
-    if (!stat3.isFile() || stat3.isSymbolicLink()) return void 0;
-    if (stat3.size > BigInt(MAX_CONFIG_BYTES)) return void 0;
+    const stat4 = await lstat(path, { bigint: true });
+    if (!stat4.isFile() || stat4.isSymbolicLink()) return void 0;
+    if (stat4.size > BigInt(MAX_CONFIG_BYTES)) return void 0;
     const realPath = await realpath2(path);
     if (realPath !== path) return void 0;
     const contents = await readFile2(path);
     const after = await lstat(path, { bigint: true });
-    if (!after.isFile() || after.isSymbolicLink() || stat3.dev !== after.dev || stat3.ino !== after.ino || stat3.size !== after.size || stat3.mtimeNs !== after.mtimeNs) {
+    if (!after.isFile() || after.isSymbolicLink() || stat4.dev !== after.dev || stat4.ino !== after.ino || stat4.size !== after.size || stat4.mtimeNs !== after.mtimeNs) {
       return void 0;
     }
     return {
       path,
       realPath,
-      dev: stat3.dev,
-      ino: stat3.ino,
-      size: stat3.size,
-      mtimeNs: stat3.mtimeNs,
+      dev: stat4.dev,
+      ino: stat4.ino,
+      size: stat4.size,
+      mtimeNs: stat4.mtimeNs,
       digest: createHash("sha256").update(contents).digest("hex")
     };
   } catch {
@@ -8046,8 +8046,199 @@ var CodexLatestService = class {
   }
 };
 
-// src/start.ts
+// src/providers/codex-executable.ts
 import { execFile } from "child_process";
+import { constants as constants2 } from "fs";
+import { access, chmod, copyFile, link, realpath as realpath3, rename as rename2, rm, rmdir as rmdir2, stat as stat3 } from "fs/promises";
+import { randomUUID as randomUUID7 } from "crypto";
+import { basename as basename3, delimiter, dirname as dirname5, isAbsolute as isAbsolute5, join as join12, sep as sep5 } from "path";
+var CODEX_EXECUTABLE_PROBE_TIMEOUT_MS = 5e3;
+var OPENAI_CODE_SIGNING_TEAM_ID = "2DC432GLL2";
+var MAX_CODEX_BYTES = 1024 * 1024 * 1024;
+var MAX_PROCESS_OUTPUT_BYTES = 16 * 1024;
+var LEGACY_MANAGED_DIRECTORY = "provider-bin";
+var LEGACY_MANAGED_EXECUTABLE = "codex-macos";
+var LEGACY_MANAGED_STATE = "codex-macos-source.json";
+function runBounded(executable, args, options) {
+  return new Promise((resolve7) => {
+    execFile(
+      executable,
+      [...args],
+      {
+        ...options.env ? { env: options.env } : {},
+        timeout: options.timeoutMs,
+        maxBuffer: options.maxOutputBytes,
+        windowsHide: true,
+        encoding: "utf8"
+      },
+      (error, stdout, stderr) => {
+        resolve7({
+          ...error ? { error } : {},
+          stdout: String(stdout),
+          stderr: String(stderr)
+        });
+      }
+    );
+  });
+}
+async function defaultProbeCodexExecutable(executable, env) {
+  const result = await runBounded(executable, ["--version"], {
+    env,
+    timeoutMs: CODEX_EXECUTABLE_PROBE_TIMEOUT_MS,
+    maxOutputBytes: 1024
+  });
+  if (result.error) {
+    if (result.error.killed || result.error.signal === "SIGTERM" || result.error.signal === "SIGKILL") {
+      return { state: "timeout" };
+    }
+    return { state: "failed" };
+  }
+  try {
+    return { state: "ready", version: parseCodexVersion(result.stdout) };
+  } catch {
+    return { state: "failed" };
+  }
+}
+async function defaultResolveExecutable(command, env) {
+  const candidates = isAbsolute5(command) || command.includes(sep5) ? [command] : (env.PATH ?? process.env.PATH ?? "").split(delimiter).filter(Boolean).map((entry) => join12(entry, command));
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants2.X_OK);
+      return await realpath3(candidate);
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function defaultVerifyOfficialSignature(executable) {
+  const verified = await runBounded("/usr/bin/codesign", ["--verify", "--strict", executable], {
+    timeoutMs: 5e3,
+    maxOutputBytes: MAX_PROCESS_OUTPUT_BYTES
+  });
+  if (verified.error) return false;
+  const details = await runBounded("/usr/bin/codesign", ["-d", "--verbose=4", executable], {
+    timeoutMs: 5e3,
+    maxOutputBytes: MAX_PROCESS_OUTPUT_BYTES
+  });
+  if (details.error) return false;
+  return new RegExp(`^TeamIdentifier=${OPENAI_CODE_SIGNING_TEAM_ID}$`, "m").test(details.stderr) && /^Identifier=codex$/m.test(details.stderr);
+}
+async function defaultClearExtendedAttributes(executable) {
+  const result = await runBounded("/usr/bin/xattr", ["-c", executable], {
+    timeoutMs: 5e3,
+    maxOutputBytes: MAX_PROCESS_OUTPUT_BYTES
+  });
+  return !result.error;
+}
+var defaultDeps = {
+  platform: process.platform,
+  resolveExecutable: defaultResolveExecutable,
+  probe: defaultProbeCodexExecutable,
+  verifyOfficialSignature: defaultVerifyOfficialSignature,
+  clearExtendedAttributes: defaultClearExtendedAttributes
+};
+function provenanceFor(executable) {
+  const normalized = executable.replaceAll("\\", "/");
+  if (/\/Caskroom\/codex\//i.test(normalized)) return "homebrew";
+  if (/\/Applications\/Codex\.app\//i.test(normalized)) return "chatgpt";
+  if (/\/node_modules\/(?:@openai\/codex|@openai\/codex-[^/]+)\//i.test(normalized)) return "npm";
+  return "unknown";
+}
+function validSource(sourceStat) {
+  return sourceStat.isFile() && sourceStat.size > 0 && sourceStat.size <= MAX_CODEX_BYTES;
+}
+function sameSource(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
+}
+async function removeLegacyManagedCopy(dataDir) {
+  const directory = join12(dataDir, LEGACY_MANAGED_DIRECTORY);
+  await Promise.all([
+    rm(join12(directory, LEGACY_MANAGED_EXECUTABLE), { force: true }).catch(() => void 0),
+    rm(join12(directory, LEGACY_MANAGED_STATE), { force: true }).catch(() => void 0)
+  ]);
+  await rmdir2(directory).catch(() => void 0);
+}
+async function repairHomebrewExecutable(source, sourceStat, env, deps) {
+  if (!await deps.verifyOfficialSignature(source)) return false;
+  const nonce = randomUUID7();
+  const directory = dirname5(source);
+  const name = basename3(source);
+  const temporary = join12(directory, `.${name}.roamcode-repair-${nonce}`);
+  const backup = join12(directory, `.${name}.roamcode-backup-${nonce}`);
+  let backupCreated = false;
+  let sourceReplaced = false;
+  let committed = false;
+  let preserveBackup = false;
+  try {
+    await copyFile(source, temporary, constants2.COPYFILE_EXCL);
+    await chmod(temporary, sourceStat.mode & 511);
+    if (!await deps.clearExtendedAttributes(temporary)) return false;
+    if (!await deps.verifyOfficialSignature(temporary)) return false;
+    if ((await deps.probe(temporary, env)).state !== "ready") return false;
+    const currentStat = await stat3(source);
+    if (!sameSource(sourceStat, currentStat)) return false;
+    await link(source, backup);
+    backupCreated = true;
+    await rename2(temporary, source);
+    sourceReplaced = true;
+    if (!await deps.verifyOfficialSignature(source)) return false;
+    if ((await deps.probe(source, env)).state !== "ready") return false;
+    committed = true;
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (sourceReplaced && !committed && backupCreated) {
+      try {
+        await rename2(backup, source);
+        backupCreated = false;
+      } catch {
+        preserveBackup = true;
+      }
+    }
+    await rm(temporary, { force: true }).catch(() => void 0);
+    if (!preserveBackup) await rm(backup, { force: true }).catch(() => void 0);
+  }
+}
+async function resolveCodexExecutable(options) {
+  const env = options.env ?? process.env;
+  const deps = { ...defaultDeps, ...options.deps };
+  const unresolved = {
+    executable: options.codexBin,
+    sourceExecutable: options.codexBin,
+    provenance: "unknown",
+    recovered: false
+  };
+  if (deps.platform !== "darwin") return unresolved;
+  const source = await deps.resolveExecutable(options.codexBin, env);
+  if (!source) return unresolved;
+  const provenance = provenanceFor(source);
+  const ordinary = {
+    executable: options.codexBin,
+    sourceExecutable: source,
+    provenance,
+    recovered: false
+  };
+  let sourceStat;
+  try {
+    sourceStat = await stat3(source);
+  } catch {
+    return ordinary;
+  }
+  if (!validSource(sourceStat)) return ordinary;
+  const sourceProbe = await deps.probe(source, env);
+  if (sourceProbe.state === "ready") {
+    await removeLegacyManagedCopy(options.dataDir);
+    return ordinary;
+  }
+  if (sourceProbe.state !== "timeout" || provenance !== "homebrew") return ordinary;
+  if (!await repairHomebrewExecutable(source, sourceStat, env, deps)) return ordinary;
+  await removeLegacyManagedCopy(options.dataDir);
+  return { ...ordinary, recovered: true };
+}
+
+// src/start.ts
+import { execFile as execFile2 } from "child_process";
 function providerPreflightWarning(name, availability) {
   if (availability.terminalAvailable) return void 0;
   return `
@@ -8098,7 +8289,18 @@ async function startServer(env = process.env) {
     config.accessToken = token;
   }
   assertConfigAllowsStart(config);
-  const store = openSessionStore({ dbPath: join12(config.dataDir, "sessions.db") });
+  const codexExecutable = await resolveCodexExecutable({
+    codexBin: config.codexBin,
+    dataDir: config.dataDir,
+    env
+  });
+  const codexBin = codexExecutable.executable;
+  if (codexExecutable.recovered) {
+    console.warn(
+      "[roamcode] Repaired a macOS-blocked Homebrew Codex CLI in place using a verified, byte-identical OpenAI-signed replacement; no private binary was retained."
+    );
+  }
+  const store = openSessionStore({ dbPath: join13(config.dataDir, "sessions.db") });
   const storeMode = store.mode;
   if (storeMode === "memory-fallback") {
     console.warn(
@@ -8114,7 +8316,7 @@ async function startServer(env = process.env) {
   }).catch(() => {
   });
   const vapid = resolveVapidKeys({ dataDir: config.dataDir });
-  const pushStore = openPushStore({ dbPath: join12(config.dataDir, "push.db") });
+  const pushStore = openPushStore({ dbPath: join13(config.dataDir, "push.db") });
   const vapidSubject = (env.ROAMCODE_VAPID_SUBJECT ?? env.REMOTE_CODER_VAPID_SUBJECT)?.trim() || "mailto:roamcode@localhost";
   let pushDispatcher;
   try {
@@ -8138,7 +8340,7 @@ async function startServer(env = process.env) {
       env
     })
   );
-  const codexClient = new CodexAppServerClient({ codexBin: config.codexBin, env });
+  const codexClient = new CodexAppServerClient({ codexBin, env });
   const codexRpc = {
     request: async (method, params, schema) => {
       await codexClient.start();
@@ -8146,7 +8348,7 @@ async function startServer(env = process.env) {
     },
     onNotification: (listener) => codexClient.onNotification(listener)
   };
-  const profileClient = createCodexProfileClientLifecycle({ codexBin: config.codexBin, env });
+  const profileClient = createCodexProfileClientLifecycle({ codexBin, env });
   const codexMetadata = new CodexMetadataService(codexRpc, {
     ...env.CODEX_HOME ? { codexHome: env.CODEX_HOME } : {},
     profileClient
@@ -8157,8 +8359,8 @@ async function startServer(env = process.env) {
   };
   const codexLatest = new CodexLatestService({
     runVersion: (args, options) => new Promise((resolve7, reject) => {
-      execFile(
-        config.codexBin,
+      execFile2(
+        codexBin,
         [...args],
         { env, timeout: options.timeoutMs, maxBuffer: options.maxOutputBytes, windowsHide: true },
         (error, stdout, stderr) => {
@@ -8175,7 +8377,7 @@ async function startServer(env = process.env) {
         }
       );
     }),
-    detectProvenance: () => "unknown",
+    detectProvenance: () => codexExecutable.provenance,
     fetchNpmLatest: async (_packageName, options) => {
       const response = await fetch("https://registry.npmjs.org/@openai%2Fcodex/latest", {
         signal: AbortSignal.timeout(options.timeoutMs)
@@ -8201,7 +8403,7 @@ async function startServer(env = process.env) {
       }
     }),
     createCodexProvider({
-      codexBin: config.codexBin,
+      codexBin,
       env,
       validateProfile: codexMetadata.validateProfile,
       probe: async () => {
@@ -8270,7 +8472,7 @@ async function startServer(env = process.env) {
 }
 function defaultWebDir() {
   const here = fileURLToPath2(new URL(".", import.meta.url));
-  return join12(here, "..", "..", "web", "dist");
+  return join13(here, "..", "..", "web", "dist");
 }
 function installCrashGuards() {
   process.on("unhandledRejection", (reason) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roamcode.ai/server",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "description": "Host-native server for RoamCode",
   "homepage": "https://roamcode.ai",
   "bugs": "https://github.com/burakgon/roamcode/issues",
@@ -40,7 +40,7 @@
     "node-pty": "1.1.0",
     "web-push": "^3.6.7",
     "zod": "^4.4.3",
-    "@roamcode.ai/web": "1.0.18"
+    "@roamcode.ai/web": "1.0.20"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",