@roamcode.ai/server 1.0.19 → 1.0.21

package/dist/index.d.ts

@@ -2466,12 +2466,12 @@ type CodexExecutableProbe = {
     state: "failed";
 };
 interface CodexExecutableResolution {
-    /** Executable used by every Codex terminal and auxiliary service for this server process. */
+    /** Stable user-selected command used by Codex terminals and auxiliary services. */
     executable: string;
-    /** User-selected executable before a managed macOS recovery copy is considered. */
+    /** Resolved source installation inspected during boot. */
     sourceExecutable: string;
     provenance: CodexInstallProvenance;
-    /** True only when the verified private copy is active. The source installation is never modified. */
+    /** True only when a blocked OpenAI-signed Homebrew executable was atomically repaired in place. */
     recovered: boolean;
 }
 interface CodexExecutableDeps {
@@ -2489,10 +2489,9 @@ interface ResolveCodexExecutableOptions {
 }
 declare function defaultProbeCodexExecutable(executable: string, env: NodeJS.ProcessEnv): Promise<CodexExecutableProbe>;
 /**
- * macOS 26 can indefinitely block a valid OpenAI-signed Codex Homebrew Cask binary in `_dyld_start`.
- * A byte-identical executable at a fresh, non-quarantined path starts normally. On an observed timeout,
- * this resolver creates that private copy only after checking the embedded official OpenAI signature.
- * It never modifies the user's Codex installation and never applies the workaround to an unsigned binary.
+ * Probe the configured Codex CLI once at boot. Only a timed-out, officially signed Homebrew installation is
+ * repaired, and the configured command remains the stable launch path so future Homebrew upgrades are not pinned
+ * to an old Caskroom version.
  */
 declare function resolveCodexExecutable(options: ResolveCodexExecutableOptions): Promise<CodexExecutableResolution>;
 

package/dist/index.js

@@ -2268,16 +2268,16 @@ async function smokeServer(serverEntry, dataDir, nodePath, log) {
     void dataDir;
   }
 }
-function replaceSymlink(link, target) {
-  const temp = `${link}.${process.pid}.${randomUUID2()}.new`;
+function replaceSymlink(link2, target) {
+  const temp = `${link2}.${process.pid}.${randomUUID2()}.new`;
   try {
     unlinkSync(temp);
   } catch {
   }
-  const parent = realpathSync(dirname2(link));
+  const parent = realpathSync(dirname2(link2));
   const canonicalTarget = realpathSync(target);
   symlinkSync(relative(parent, canonicalTarget), temp, "dir");
-  renameSync(temp, link);
+  renameSync(temp, link2);
 }
 function trimLog(log) {
   return log.split("\n").slice(-20).join("\n").slice(-8e3);
@@ -2429,7 +2429,7 @@ async function installManagedRelease(opts) {
 }
 
 // src/updater.ts
-var RUNNING_VERSION = "1.0.19" ? "1.0.19".replace(/^v/, "") : packageVersion();
+var RUNNING_VERSION = "1.0.21" ? "1.0.21".replace(/^v/, "") : packageVersion();
 var RUNNING_BUILD = RUNNING_VERSION;
 var RELEASES_API = "https://api.github.com/repos/burakgon/roamcode/releases?per_page=100";
 var RELEASE_MANIFEST_ASSET = "roamcode-release.json";
@@ -8588,29 +8588,16 @@ var CodexLatestService = class {
 // src/providers/codex-executable.ts
 import { execFile } from "child_process";
 import { constants as constants2 } from "fs";
-import {
-  access,
-  chmod,
-  copyFile,
-  lstat as lstat2,
-  mkdir as mkdir2,
-  readFile as readFile3,
-  realpath as realpath3,
-  rename as rename2,
-  rm,
-  stat as stat3,
-  writeFile
-} from "fs/promises";
+import { access, chmod, copyFile, link, realpath as realpath3, rename as rename2, rm, rmdir as rmdir2, stat as stat3 } from "fs/promises";
 import { randomUUID as randomUUID7 } from "crypto";
-import { delimiter, isAbsolute as isAbsolute5, join as join12, sep as sep5 } from "path";
+import { basename as basename3, delimiter, dirname as dirname5, isAbsolute as isAbsolute5, join as join12, sep as sep5 } from "path";
 var CODEX_EXECUTABLE_PROBE_TIMEOUT_MS = 5e3;
 var OPENAI_CODE_SIGNING_TEAM_ID = "2DC432GLL2";
-var STATE_SCHEMA_VERSION = 1;
-var MAX_MANAGED_CODEX_BYTES = 1024 * 1024 * 1024;
-var MANAGED_DIRECTORY = "provider-bin";
-var MANAGED_EXECUTABLE = "codex-macos";
-var STATE_FILE = "codex-macos-source.json";
+var MAX_CODEX_BYTES = 1024 * 1024 * 1024;
 var MAX_PROCESS_OUTPUT_BYTES = 16 * 1024;
+var LEGACY_MANAGED_DIRECTORY = "provider-bin";
+var LEGACY_MANAGED_EXECUTABLE = "codex-macos";
+var LEGACY_MANAGED_STATE = "codex-macos-source.json";
 function runBounded(executable, args, options) {
   return new Promise((resolve7) => {
     execFile(
@@ -8696,37 +8683,60 @@ function provenanceFor(executable) {
   if (/\/node_modules\/(?:@openai\/codex|@openai\/codex-[^/]+)\//i.test(normalized)) return "npm";
   return "unknown";
 }
-function identityFor(sourcePath, sourceStat) {
-  return {
-    sourcePath,
-    device: String(sourceStat.dev),
-    inode: String(sourceStat.ino),
-    size: sourceStat.size,
-    modifiedAtMs: sourceStat.mtimeMs
-  };
+function validSource(sourceStat) {
+  return sourceStat.isFile() && sourceStat.size > 0 && sourceStat.size <= MAX_CODEX_BYTES;
 }
-function parseManagedState(raw) {
-  try {
-    const value = JSON.parse(raw);
-    if (value.schemaVersion !== STATE_SCHEMA_VERSION || typeof value.sourcePath !== "string" || typeof value.device !== "string" || typeof value.inode !== "string" || typeof value.size !== "number" || !Number.isSafeInteger(value.size) || typeof value.modifiedAtMs !== "number" || !Number.isFinite(value.modifiedAtMs)) {
-      return void 0;
-    }
-    return value;
-  } catch {
-    return void 0;
-  }
+function sameSource(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
 }
-function stateMatches(state, identity) {
-  return state.sourcePath === identity.sourcePath && state.device === identity.device && state.inode === identity.inode && state.size === identity.size && state.modifiedAtMs === identity.modifiedAtMs;
+async function removeLegacyManagedCopy(dataDir) {
+  const directory = join12(dataDir, LEGACY_MANAGED_DIRECTORY);
+  await Promise.all([
+    rm(join12(directory, LEGACY_MANAGED_EXECUTABLE), { force: true }).catch(() => void 0),
+    rm(join12(directory, LEGACY_MANAGED_STATE), { force: true }).catch(() => void 0)
+  ]);
+  await rmdir2(directory).catch(() => void 0);
 }
-async function usableManagedExecutable(target, env, deps) {
+async function repairHomebrewExecutable(source, sourceStat, env, deps) {
+  if (!await deps.verifyOfficialSignature(source)) return false;
+  const nonce = randomUUID7();
+  const directory = dirname5(source);
+  const name = basename3(source);
+  const temporary = join12(directory, `.${name}.roamcode-repair-${nonce}`);
+  const backup = join12(directory, `.${name}.roamcode-backup-${nonce}`);
+  let backupCreated = false;
+  let sourceReplaced = false;
+  let committed = false;
+  let preserveBackup = false;
   try {
-    const targetStat = await lstat2(target);
-    if (!targetStat.isFile() || targetStat.isSymbolicLink()) return false;
-    if (!await deps.verifyOfficialSignature(target)) return false;
-    return (await deps.probe(target, env)).state === "ready";
+    await copyFile(source, temporary, constants2.COPYFILE_EXCL);
+    await chmod(temporary, sourceStat.mode & 511);
+    if (!await deps.clearExtendedAttributes(temporary)) return false;
+    if (!await deps.verifyOfficialSignature(temporary)) return false;
+    if ((await deps.probe(temporary, env)).state !== "ready") return false;
+    const currentStat = await stat3(source);
+    if (!sameSource(sourceStat, currentStat)) return false;
+    await link(source, backup);
+    backupCreated = true;
+    await rename2(temporary, source);
+    sourceReplaced = true;
+    if (!await deps.verifyOfficialSignature(source)) return false;
+    if ((await deps.probe(source, env)).state !== "ready") return false;
+    committed = true;
+    return true;
   } catch {
     return false;
+  } finally {
+    if (sourceReplaced && !committed && backupCreated) {
+      try {
+        await rename2(backup, source);
+        backupCreated = false;
+      } catch {
+        preserveBackup = true;
+      }
+    }
+    await rm(temporary, { force: true }).catch(() => void 0);
+    if (!preserveBackup) await rm(backup, { force: true }).catch(() => void 0);
   }
 }
 async function resolveCodexExecutable(options) {
@@ -8743,7 +8753,7 @@ async function resolveCodexExecutable(options) {
   if (!source) return unresolved;
   const provenance = provenanceFor(source);
   const ordinary = {
-    executable: source,
+    executable: options.codexBin,
     sourceExecutable: source,
     provenance,
     recovered: false
@@ -8754,47 +8764,16 @@ async function resolveCodexExecutable(options) {
   } catch {
     return ordinary;
   }
-  if (!sourceStat.isFile() || sourceStat.size <= 0 || sourceStat.size > MAX_MANAGED_CODEX_BYTES) return ordinary;
-  const identity = identityFor(source, sourceStat);
-  const managedDir = join12(options.dataDir, MANAGED_DIRECTORY);
-  const target = join12(managedDir, MANAGED_EXECUTABLE);
-  const statePath = join12(managedDir, STATE_FILE);
-  try {
-    const state = parseManagedState(await readFile3(statePath, "utf8"));
-    if (state && stateMatches(state, identity) && await usableManagedExecutable(target, env, deps)) {
-      return { executable: target, sourceExecutable: source, provenance, recovered: true };
-    }
-  } catch {
-  }
+  if (!validSource(sourceStat)) return ordinary;
   const sourceProbe = await deps.probe(source, env);
-  if (sourceProbe.state !== "timeout") return ordinary;
-  if (!await deps.verifyOfficialSignature(source)) return ordinary;
-  const nonce = randomUUID7();
-  const temporaryExecutable = join12(managedDir, `.codex-${nonce}.tmp`);
-  const temporaryState = join12(managedDir, `.codex-state-${nonce}.tmp`);
-  try {
-    await mkdir2(managedDir, { recursive: true, mode: 448 });
-    await chmod(managedDir, 448);
-    await copyFile(source, temporaryExecutable, constants2.COPYFILE_EXCL);
-    await chmod(temporaryExecutable, 448);
-    if (!await deps.clearExtendedAttributes(temporaryExecutable)) return ordinary;
-    if (!await deps.verifyOfficialSignature(temporaryExecutable)) return ordinary;
-    if ((await deps.probe(temporaryExecutable, env)).state !== "ready") return ordinary;
-    await rename2(temporaryExecutable, target);
-    if (!await usableManagedExecutable(target, env, deps)) return ordinary;
-    const state = { schemaVersion: STATE_SCHEMA_VERSION, ...identity };
-    await writeFile(temporaryState, `${JSON.stringify(state)}
-`, { encoding: "utf8", mode: 384, flag: "wx" });
-    await rename2(temporaryState, statePath);
-    return { executable: target, sourceExecutable: source, provenance, recovered: true };
-  } catch {
+  if (sourceProbe.state === "ready") {
+    await removeLegacyManagedCopy(options.dataDir);
     return ordinary;
-  } finally {
-    await Promise.all([
-      rm(temporaryExecutable, { force: true }).catch(() => void 0),
-      rm(temporaryState, { force: true }).catch(() => void 0)
-    ]);
   }
+  if (sourceProbe.state !== "timeout" || provenance !== "homebrew") return ordinary;
+  if (!await repairHomebrewExecutable(source, sourceStat, env, deps)) return ordinary;
+  await removeLegacyManagedCopy(options.dataDir);
+  return { ...ordinary, recovered: true };
 }
 
 // src/start.ts
@@ -8857,7 +8836,7 @@ async function startServer(env = process.env) {
   const codexBin = codexExecutable.executable;
   if (codexExecutable.recovered) {
     console.warn(
-      "[roamcode] Recovered a macOS-blocked Codex CLI using a private verified copy of the official OpenAI-signed binary; the original installation was left unchanged."
+      "[roamcode] Repaired a macOS-blocked Homebrew Codex CLI in place using a verified, byte-identical OpenAI-signed replacement; no private binary was retained."
     );
   }
   const store = openSessionStore({ dbPath: join13(config.dataDir, "sessions.db") });

package/dist/start.js

@@ -871,7 +871,7 @@ function readPreviousVersion(root) {
 }
 
 // src/updater.ts
-var RUNNING_VERSION = "1.0.19" ? "1.0.19".replace(/^v/, "") : packageVersion();
+var RUNNING_VERSION = "1.0.21" ? "1.0.21".replace(/^v/, "") : packageVersion();
 var RELEASES_API = "https://api.github.com/repos/burakgon/roamcode/releases?per_page=100";
 var RELEASE_MANIFEST_ASSET = "roamcode-release.json";
 var CHECK_CACHE_MS = 15 * 6e4;
@@ -8049,29 +8049,16 @@ var CodexLatestService = class {
 // src/providers/codex-executable.ts
 import { execFile } from "child_process";
 import { constants as constants2 } from "fs";
-import {
-  access,
-  chmod,
-  copyFile,
-  lstat as lstat2,
-  mkdir as mkdir2,
-  readFile as readFile3,
-  realpath as realpath3,
-  rename as rename2,
-  rm,
-  stat as stat3,
-  writeFile
-} from "fs/promises";
+import { access, chmod, copyFile, link, realpath as realpath3, rename as rename2, rm, rmdir as rmdir2, stat as stat3 } from "fs/promises";
 import { randomUUID as randomUUID7 } from "crypto";
-import { delimiter, isAbsolute as isAbsolute5, join as join12, sep as sep5 } from "path";
+import { basename as basename3, delimiter, dirname as dirname5, isAbsolute as isAbsolute5, join as join12, sep as sep5 } from "path";
 var CODEX_EXECUTABLE_PROBE_TIMEOUT_MS = 5e3;
 var OPENAI_CODE_SIGNING_TEAM_ID = "2DC432GLL2";
-var STATE_SCHEMA_VERSION = 1;
-var MAX_MANAGED_CODEX_BYTES = 1024 * 1024 * 1024;
-var MANAGED_DIRECTORY = "provider-bin";
-var MANAGED_EXECUTABLE = "codex-macos";
-var STATE_FILE = "codex-macos-source.json";
+var MAX_CODEX_BYTES = 1024 * 1024 * 1024;
 var MAX_PROCESS_OUTPUT_BYTES = 16 * 1024;
+var LEGACY_MANAGED_DIRECTORY = "provider-bin";
+var LEGACY_MANAGED_EXECUTABLE = "codex-macos";
+var LEGACY_MANAGED_STATE = "codex-macos-source.json";
 function runBounded(executable, args, options) {
   return new Promise((resolve7) => {
     execFile(
@@ -8157,37 +8144,60 @@ function provenanceFor(executable) {
   if (/\/node_modules\/(?:@openai\/codex|@openai\/codex-[^/]+)\//i.test(normalized)) return "npm";
   return "unknown";
 }
-function identityFor(sourcePath, sourceStat) {
-  return {
-    sourcePath,
-    device: String(sourceStat.dev),
-    inode: String(sourceStat.ino),
-    size: sourceStat.size,
-    modifiedAtMs: sourceStat.mtimeMs
-  };
+function validSource(sourceStat) {
+  return sourceStat.isFile() && sourceStat.size > 0 && sourceStat.size <= MAX_CODEX_BYTES;
 }
-function parseManagedState(raw) {
-  try {
-    const value = JSON.parse(raw);
-    if (value.schemaVersion !== STATE_SCHEMA_VERSION || typeof value.sourcePath !== "string" || typeof value.device !== "string" || typeof value.inode !== "string" || typeof value.size !== "number" || !Number.isSafeInteger(value.size) || typeof value.modifiedAtMs !== "number" || !Number.isFinite(value.modifiedAtMs)) {
-      return void 0;
-    }
-    return value;
-  } catch {
-    return void 0;
-  }
+function sameSource(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
 }
-function stateMatches(state, identity) {
-  return state.sourcePath === identity.sourcePath && state.device === identity.device && state.inode === identity.inode && state.size === identity.size && state.modifiedAtMs === identity.modifiedAtMs;
+async function removeLegacyManagedCopy(dataDir) {
+  const directory = join12(dataDir, LEGACY_MANAGED_DIRECTORY);
+  await Promise.all([
+    rm(join12(directory, LEGACY_MANAGED_EXECUTABLE), { force: true }).catch(() => void 0),
+    rm(join12(directory, LEGACY_MANAGED_STATE), { force: true }).catch(() => void 0)
+  ]);
+  await rmdir2(directory).catch(() => void 0);
 }
-async function usableManagedExecutable(target, env, deps) {
+async function repairHomebrewExecutable(source, sourceStat, env, deps) {
+  if (!await deps.verifyOfficialSignature(source)) return false;
+  const nonce = randomUUID7();
+  const directory = dirname5(source);
+  const name = basename3(source);
+  const temporary = join12(directory, `.${name}.roamcode-repair-${nonce}`);
+  const backup = join12(directory, `.${name}.roamcode-backup-${nonce}`);
+  let backupCreated = false;
+  let sourceReplaced = false;
+  let committed = false;
+  let preserveBackup = false;
   try {
-    const targetStat = await lstat2(target);
-    if (!targetStat.isFile() || targetStat.isSymbolicLink()) return false;
-    if (!await deps.verifyOfficialSignature(target)) return false;
-    return (await deps.probe(target, env)).state === "ready";
+    await copyFile(source, temporary, constants2.COPYFILE_EXCL);
+    await chmod(temporary, sourceStat.mode & 511);
+    if (!await deps.clearExtendedAttributes(temporary)) return false;
+    if (!await deps.verifyOfficialSignature(temporary)) return false;
+    if ((await deps.probe(temporary, env)).state !== "ready") return false;
+    const currentStat = await stat3(source);
+    if (!sameSource(sourceStat, currentStat)) return false;
+    await link(source, backup);
+    backupCreated = true;
+    await rename2(temporary, source);
+    sourceReplaced = true;
+    if (!await deps.verifyOfficialSignature(source)) return false;
+    if ((await deps.probe(source, env)).state !== "ready") return false;
+    committed = true;
+    return true;
   } catch {
     return false;
+  } finally {
+    if (sourceReplaced && !committed && backupCreated) {
+      try {
+        await rename2(backup, source);
+        backupCreated = false;
+      } catch {
+        preserveBackup = true;
+      }
+    }
+    await rm(temporary, { force: true }).catch(() => void 0);
+    if (!preserveBackup) await rm(backup, { force: true }).catch(() => void 0);
   }
 }
 async function resolveCodexExecutable(options) {
@@ -8204,7 +8214,7 @@ async function resolveCodexExecutable(options) {
   if (!source) return unresolved;
   const provenance = provenanceFor(source);
   const ordinary = {
-    executable: source,
+    executable: options.codexBin,
     sourceExecutable: source,
     provenance,
     recovered: false
@@ -8215,47 +8225,16 @@ async function resolveCodexExecutable(options) {
   } catch {
     return ordinary;
   }
-  if (!sourceStat.isFile() || sourceStat.size <= 0 || sourceStat.size > MAX_MANAGED_CODEX_BYTES) return ordinary;
-  const identity = identityFor(source, sourceStat);
-  const managedDir = join12(options.dataDir, MANAGED_DIRECTORY);
-  const target = join12(managedDir, MANAGED_EXECUTABLE);
-  const statePath = join12(managedDir, STATE_FILE);
-  try {
-    const state = parseManagedState(await readFile3(statePath, "utf8"));
-    if (state && stateMatches(state, identity) && await usableManagedExecutable(target, env, deps)) {
-      return { executable: target, sourceExecutable: source, provenance, recovered: true };
-    }
-  } catch {
-  }
+  if (!validSource(sourceStat)) return ordinary;
   const sourceProbe = await deps.probe(source, env);
-  if (sourceProbe.state !== "timeout") return ordinary;
-  if (!await deps.verifyOfficialSignature(source)) return ordinary;
-  const nonce = randomUUID7();
-  const temporaryExecutable = join12(managedDir, `.codex-${nonce}.tmp`);
-  const temporaryState = join12(managedDir, `.codex-state-${nonce}.tmp`);
-  try {
-    await mkdir2(managedDir, { recursive: true, mode: 448 });
-    await chmod(managedDir, 448);
-    await copyFile(source, temporaryExecutable, constants2.COPYFILE_EXCL);
-    await chmod(temporaryExecutable, 448);
-    if (!await deps.clearExtendedAttributes(temporaryExecutable)) return ordinary;
-    if (!await deps.verifyOfficialSignature(temporaryExecutable)) return ordinary;
-    if ((await deps.probe(temporaryExecutable, env)).state !== "ready") return ordinary;
-    await rename2(temporaryExecutable, target);
-    if (!await usableManagedExecutable(target, env, deps)) return ordinary;
-    const state = { schemaVersion: STATE_SCHEMA_VERSION, ...identity };
-    await writeFile(temporaryState, `${JSON.stringify(state)}
-`, { encoding: "utf8", mode: 384, flag: "wx" });
-    await rename2(temporaryState, statePath);
-    return { executable: target, sourceExecutable: source, provenance, recovered: true };
-  } catch {
+  if (sourceProbe.state === "ready") {
+    await removeLegacyManagedCopy(options.dataDir);
     return ordinary;
-  } finally {
-    await Promise.all([
-      rm(temporaryExecutable, { force: true }).catch(() => void 0),
-      rm(temporaryState, { force: true }).catch(() => void 0)
-    ]);
   }
+  if (sourceProbe.state !== "timeout" || provenance !== "homebrew") return ordinary;
+  if (!await repairHomebrewExecutable(source, sourceStat, env, deps)) return ordinary;
+  await removeLegacyManagedCopy(options.dataDir);
+  return { ...ordinary, recovered: true };
 }
 
 // src/start.ts
@@ -8318,7 +8297,7 @@ async function startServer(env = process.env) {
   const codexBin = codexExecutable.executable;
   if (codexExecutable.recovered) {
     console.warn(
-      "[roamcode] Recovered a macOS-blocked Codex CLI using a private verified copy of the official OpenAI-signed binary; the original installation was left unchanged."
+      "[roamcode] Repaired a macOS-blocked Homebrew Codex CLI in place using a verified, byte-identical OpenAI-signed replacement; no private binary was retained."
     );
   }
   const store = openSessionStore({ dbPath: join13(config.dataDir, "sessions.db") });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roamcode.ai/server",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "description": "Host-native server for RoamCode",
   "homepage": "https://roamcode.ai",
   "bugs": "https://github.com/burakgon/roamcode/issues",
@@ -40,7 +40,7 @@
     "node-pty": "1.1.0",
     "web-push": "^3.6.7",
     "zod": "^4.4.3",
-    "@roamcode.ai/web": "1.0.19"
+    "@roamcode.ai/web": "1.0.21"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",