@tuannvm/ccodex 0.1.1 → 0.2.9

package/dist/proxy.js

@@ -1,28 +1,88 @@
-import { join } from 'path';
-import { hasCommand, execCommand, httpGet, sleep, ensureDir, safeJsonParse, debugLog } from './utils.js';
+import { join, delimiter, normalize, sep, resolve, dirname, isAbsolute } from 'path';
+import { homedir } from 'os';
+import { createHash, randomUUID } from 'crypto';
+import chalk from 'chalk';
+import { hasCommand, getCommandPath, execCommand, httpGet, sleep, ensureDir, fileExists, safeJsonParse, debugLog, runCmdBounded, requireTrustedCommand, withInstallLock } from './utils.js';
 import { CONFIG, getProxyUrl, getAuthDir, getLogFilePath } from './config.js';
+// Track installed proxy binary path for this process
+let installedProxyPath = null;
+/**
+ * Get allowed installation directories for proxy binary
+ * Returns paths that are considered safe sources for CLIProxyAPI
+ */
+function getAllowedInstallDirs() {
+    const home = homedir();
+    const allowed = [
+        join(home, '.local', 'bin'), // User local bin
+        '/usr/local/bin', // System local bin
+        '/opt/homebrew/bin', // Homebrew Apple Silicon
+        '/usr/local/bin', // Homebrew Intel
+        join(home, 'go', 'bin'), // Go user bin
+    ];
+    // Add common Windows paths if on Windows
+    if (process.platform === 'win32') {
+        allowed.push(join(process.env.LOCALAPPDATA || '', 'Programs'), join(process.env.APPDATA || '', 'Programs'));
+    }
+    return allowed;
+}
+/**
+ * Validate that a proxy binary path is from a trusted location
+ * Throws if path is not absolute or not from allowed directory
+ */
+function validateProxyPath(proxyPath) {
+    if (!isAbsolute(proxyPath)) {
+        throw new Error(`Proxy binary path is not absolute: ${proxyPath}`);
+    }
+    const realPath = resolve(proxyPath);
+    const allowedDirs = getAllowedInstallDirs();
+    const isAllowed = allowedDirs.some(allowedDir => {
+        const resolvedAllowed = resolve(allowedDir);
+        return realPath.startsWith(resolvedAllowed + sep) || realPath === resolvedAllowed;
+    });
+    if (!isAllowed) {
+        throw new Error(`Proxy binary not from trusted location.\n` +
+            `Path: ${realPath}\n` +
+            `Allowed directories: ${allowedDirs.join(', ')}\n\n` +
+            `For security, only proxy binaries from trusted locations are executed.\n` +
+            `If you installed CLIProxyAPI manually, move it to ~/.local/bin or install via Homebrew.`);
+    }
+}
+/**
+ * Get trusted proxy command path
+ * Validates that the proxy binary is from a trusted location before execution
+ */
+export async function requireTrustedProxyCommand() {
+    const cmdResult = await detectProxyCommand();
+    // Prefer installed path from this process
+    if (installedProxyPath && fileExists(installedProxyPath)) {
+        validateProxyPath(installedProxyPath);
+        return installedProxyPath;
+    }
+    // Use detected path
+    if (!cmdResult.path) {
+        throw new Error('CLIProxyAPI not found. Install it first:\n' +
+            '  1. Run: npx -y @tuannvm/ccodex\n' +
+            '  2. Or install manually: brew install cliproxyapi');
+    }
+    validateProxyPath(cmdResult.path);
+    return cmdResult.path;
+}
 /**
  * Detect CLIProxyAPI command
+ * Prefers locally installed binary from this process if available
  */
 export async function detectProxyCommand() {
+    // Prefer locally installed binary from this process
+    if (installedProxyPath && fileExists(installedProxyPath)) {
+        return { cmd: 'cliproxyapi', path: installedProxyPath };
+    }
     if (await hasCommand('cliproxyapi')) {
-        try {
-            const path = await execCommand('which', ['cliproxyapi']);
-            return { cmd: 'cliproxyapi', path };
-        }
-        catch {
-            // which might fail, continue anyway
-            return { cmd: 'cliproxyapi', path: null };
-        }
+        const resolved = await getCommandPath('cliproxyapi');
+        return { cmd: 'cliproxyapi', path: resolved };
     }
     if (await hasCommand('cliproxy')) {
-        try {
-            const path = await execCommand('which', ['cliproxy']);
-            return { cmd: 'cliproxy', path };
-        }
-        catch {
-            return { cmd: 'cliproxy', path: null };
-        }
+        const resolved = await getCommandPath('cliproxy');
+        return { cmd: 'cliproxy', path: resolved };
     }
     return { cmd: null, path: null };
 }
@@ -57,21 +117,19 @@ export async function checkAuthConfigured() {
     }
     // Check auth via proxy status
     let hasAuthEntries = false;
-    const cmdResult = await detectProxyCommand();
-    if (cmdResult.cmd) {
-        try {
-            const output = await execCommand(cmdResult.cmd, ['status']);
-            // Match "N auth entries" or "N auth files" where N > 0
-            const match = output.match(/(\d+)\s+(auth entries|auth files)/);
-            if (match) {
-                const count = parseInt(match[1], 10);
-                hasAuthEntries = count > 0;
-            }
-        }
-        catch (error) {
-            debugLog('Failed to check proxy status:', error);
+    try {
+        const proxyExe = await requireTrustedProxyCommand();
+        const output = await execCommand(proxyExe, ['status']);
+        // Match "N auth entries" or "N auth files" where N > 0
+        const match = output.match(/(\d+)\s+(auth entries|auth files)/);
+        if (match) {
+            const count = parseInt(match[1], 10);
+            hasAuthEntries = count > 0;
         }
     }
+    catch (error) {
+        debugLog('Failed to check proxy status:', error);
+    }
     // Check via API
     let hasModels = false;
     try {
@@ -96,36 +154,661 @@ export async function checkAuthConfigured() {
     };
 }
 /**
- * Install CLIProxyAPI via Homebrew (macOS/Linux only)
+ * Compute SHA-256 hash of binary data
+ */
+function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/**
+ * Parse checksum file to find expected hash for a specific file
+ * Supports common checksum formats:
+ * - SHA256SUMS: "a1b2c3...  filename" or "a1b2c3... *filename"
+ * - checksums.txt: "a1b2c3... filename"
+ * Handles path prefixes: "./filename", "subdir/filename", "subdir\filename" (Windows)
+ * Prefers exact filename match over basename match to avoid collisions
+ */
+function parseExpectedSha256(content, fileName) {
+    // First pass: try exact filename match (with or without path separators)
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        // Match: hash followed by whitespace and filename (with optional * prefix)
+        const match = trimmed.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+        if (match) {
+            const [, hash, name] = match;
+            const normalizedName = name.trim();
+            // Normalize path separators to / and strip any path prefix
+            const normalizedBase = normalizedName.replace(/\\/g, '/').replace(/^.*\//, '');
+            if (normalizedBase === fileName) {
+                // Found exact basename match
+                return hash.toLowerCase();
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Fetch latest release info from GitHub API
+ * Returns the exact tag name to avoid moving 'latest' redirects
+ */
+async function getLatestReleaseTag() {
+    const apiUrl = 'https://api.github.com/repos/router-for-me/CLIProxyAPI/releases/latest';
+    try {
+        const response = await fetch(apiUrl, {
+            headers: {
+                'Accept': 'application/vnd.github.v3+json',
+                'User-Agent': '@tuannvm/ccodex',
+            },
+            signal: AbortSignal.timeout(10000), // 10 second timeout
+        });
+        if (!response.ok) {
+            throw new Error(`GitHub API returned ${response.status}`);
+        }
+        const data = await safeJsonParse(await response.text());
+        if (!data?.tag_name) {
+            throw new Error('Invalid GitHub API response');
+        }
+        return data.tag_name;
+    }
+    catch (error) {
+        debugLog('Failed to fetch latest release tag:', error);
+        throw new Error(`Failed to resolve latest release tag from GitHub API: ${error instanceof Error ? error.message : String(error)}\n\n` +
+            'Please check your internet connection or install CLIProxyAPI manually.');
+    }
+}
+/**
+ * Check if an archive entry path is unsafe (contains path traversal or absolute paths)
+ */
+function isUnsafeArchivePath(raw) {
+    if (!raw)
+        return true;
+    // Normalize zip/tar separators and strip leading "./"
+    const p = raw.replace(/\\/g, '/').replace(/^\.\/+/, '');
+    if (!p)
+        return true;
+    // Reject absolute, drive-letter, UNC-like
+    if (p.startsWith('/') || /^[a-zA-Z]:\//.test(p) || p.startsWith('//'))
+        return true;
+    // Reject traversal segments
+    const parts = p.split('/').filter(Boolean);
+    if (parts.some(seg => seg === '..'))
+        return true;
+    return false;
+}
+// Resource limits for archive extraction (prevent tar/zip bombs)
+const MAX_ENTRIES = 1000;
+const MAX_ARCHIVE_BYTES = 100 * 1024 * 1024; // 100 MB compressed
+const MAX_EXTRACTED_BYTES = 500 * 1024 * 1024; // 500 MB uncompressed
+/**
+ * Parse tar verbose output line to extract path and type
+ * Handles GNU/BSD tar verbose output with special bits and spaces in filenames
+ * Returns null for lines that don't match expected tar verbose format (treated as suspicious)
+ */
+function parseTarVerboseLine(line) {
+    // Tar verbose format typically:
+    // permissions owner/group size date time... path
+    // Or with links: permissions ... path -> target
+    //
+    // We parse by:
+    // 1. Finding the path segment (everything after the date/time)
+    // 2. Checking the first character for file type
+    //
+    // Handle special bits that may appear: s/S (setuid/setgid), t/T (sticky), + (ACL), @ (extended attributes)
+    // The first character indicates type: - (file), d (dir), l (symlink), h (hardlink), c (char), b (block), p (fifo)
+    if (!line || line.length === 0)
+        return null;
+    const firstChar = line.charAt(0);
+    const fileTypeMap = {
+        '-': 'file',
+        'd': 'dir',
+        'l': 'symlink',
+        'h': 'hardlink',
+        'c': 'char',
+        'b': 'block',
+        'p': 'fifo',
+    };
+    const type = fileTypeMap[firstChar];
+    if (!type) {
+        // Unknown file type character - treat as suspicious
+        return null;
+    }
+    // Find the path by splitting on whitespace
+    // Tar verbose format fields are separated by whitespace
+    // The path is typically the last field (or second-to-last before "-> target")
+    const parts = line.split(/\s+/);
+    // For very long lines with many fields, the path might be split further
+    // Find the part that looks like a path (contains '/', or ends with ' -> ', or is just a name)
+    let pathWithTarget = '';
+    let foundPath = false;
+    // Iterate from the end to find the path
+    for (let i = parts.length - 1; i >= 0; i--) {
+        const part = parts[i];
+        if (part.includes('/') || part.includes(' -> ') || (part.length > 0 && !foundPath)) {
+            pathWithTarget = part + (pathWithTarget ? ' ' + pathWithTarget : '');
+            foundPath = true;
+        }
+        else if (foundPath) {
+            // We've collected all path parts
+            break;
+        }
+    }
+    if (!pathWithTarget)
+        return null;
+    // Extract just the path (before " -> " for symlinks)
+    const arrowIndex = pathWithTarget.indexOf(' -> ');
+    const path = arrowIndex >= 0 ? pathWithTarget.substring(0, arrowIndex).trim() : pathWithTarget.trim();
+    if (!path)
+        return null;
+    return { path, type };
+}
+/**
+ * List entries in a tar archive with resource limits and link type validation
+ */
+async function listTarEntries(archivePath) {
+    const fs = await import('fs/promises');
+    // Check archive file size before extraction
+    const archiveStat = await fs.stat(archivePath);
+    if (archiveStat.size > MAX_ARCHIVE_BYTES) {
+        throw new Error(`Archive file is too large (${(archiveStat.size / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
+            'This may be a tar bomb.');
+    }
+    // Use verbose mode with -z to explicitly handle gzip compression
+    // Some tar versions auto-detect compression, but -z ensures consistency
+    // Use trusted tar path to avoid PATH hijacking
+    const tarPath = await requireTrustedCommand('tar');
+    const result = await runCmdBounded(tarPath, ['-ztvf', archivePath], 30000); // 30 second timeout
+    if (result.code !== 0) {
+        throw new Error(`tar list failed with code ${result.code}`);
+    }
+    const lines = result.stdout.split('\n').map(s => s.trim()).filter(Boolean);
+    const entries = [];
+    // Resource limits: prevent tar/zip bombs
+    if (lines.length > MAX_ENTRIES) {
+        throw new Error(`Archive has too many entries (${lines.length} > ${MAX_ENTRIES}). This may be a tar bomb.`);
+    }
+    // Parse and validate each entry
+    for (const line of lines) {
+        const parsed = parseTarVerboseLine(line);
+        // Treat unparsable lines as suspicious - fail closed instead of skipping
+        if (!parsed) {
+            throw new Error(`Unrecognized tar output format (possible archive corruption): ${line.substring(0, 100)}`);
+        }
+        // Check for unsafe paths
+        if (isUnsafeArchivePath(parsed.path)) {
+            throw new Error(`Unsafe archive path: ${parsed.path}`);
+        }
+        // Reject symlinks and hardlinks for security
+        if (parsed.type === 'symlink' || parsed.type === 'hardlink') {
+            throw new Error(`Archive contains forbidden link entry: ${parsed.path} (${parsed.type})`);
+        }
+        // Reject character/block devices, fifos (unusual in CLIProxyAPI archives)
+        if (parsed.type === 'char' || parsed.type === 'block' || parsed.type === 'fifo') {
+            throw new Error(`Archive contains unusual entry type: ${parsed.path} (${parsed.type})`);
+        }
+        entries.push(parsed.path);
+    }
+    if (entries.length === 0) {
+        throw new Error('Archive is empty or contains no valid entries');
+    }
+    return entries;
+}
+/**
+ * Validate archive listing for unsafe paths and link types
+ * Note: Windows installation is not currently supported (throws early in installProxyApi)
+ */
+async function validateArchiveListing(archivePath) {
+    // listTarEntries now does all the validation (path safety, link rejection, resource limits)
+    await listTarEntries(archivePath);
+}
+/**
+ * Assert that all extracted files are confined within the target directory
+ * Validates that realpath of all files stays within the target directory
+ * Symlinks and hardlinks are already rejected during tar parsing
+ */
+async function assertRealpathConfinement(rootDir) {
+    const fs = await import('fs/promises');
+    const rootReal = await fs.realpath(rootDir);
+    const stack = [rootDir];
+    while (stack.length > 0) {
+        const cur = stack.pop();
+        const entries = await fs.readdir(cur, { withFileTypes: true });
+        for (const ent of entries) {
+            const full = join(cur, ent.name);
+            // Double-check for symlinks (defensive: should have been caught during tar parsing)
+            const lst = await fs.lstat(full);
+            if (lst.isSymbolicLink()) {
+                throw new Error(`Symlink not allowed in extracted archive: ${full}`);
+            }
+            // Verify realpath stays within target directory
+            const rp = await fs.realpath(full);
+            const confined = rp === rootReal || rp.startsWith(rootReal + sep);
+            if (!confined) {
+                throw new Error(`Extracted path escapes target directory: ${full}`);
+            }
+            if (ent.isDirectory()) {
+                stack.push(full);
+            }
+        }
+    }
+}
+/**
+ * Install CLIProxyAPI via Homebrew or Go binary fallback
  */
 export async function installProxyApi() {
+    const { homedir } = await import('os');
+    const home = homedir();
+    if (!home) {
+        throw new Error('Cannot determine home directory. Please set HOME environment variable.');
+    }
+    // Install lock file path (in the target install directory)
+    const lockPath = join(home, '.local', 'bin', '.cliproxyapi.install.lock');
     // Check platform
     const platform = process.platform;
+    const arch = process.arch;
     if (platform === 'win32') {
         throw new Error('CLIProxyAPI installation on Windows requires manual setup.\n' +
             'Please install CLIProxyAPI manually and ensure it\'s in your PATH.\n' +
             'See CLIProxyAPI documentation for Windows installation instructions.');
     }
-    if (!(await hasCommand('brew'))) {
-        throw new Error('Homebrew not found. CLIProxyAPI requires Homebrew for installation on macOS/Linux.\n' +
-            'Install Homebrew from https://brew.sh/ or install CLIProxyAPI manually.');
-    }
-    console.log('Installing CLIProxyAPI via Homebrew...');
-    const spawnCmd = (await import('cross-spawn')).default;
-    return new Promise((resolve, reject) => {
-        const child = spawnCmd('brew', ['install', 'cliproxyapi'], {
-            stdio: 'inherit',
-        });
-        child.on('close', (code) => {
-            if (code === 0) {
-                console.log('CLIProxyAPI installed successfully');
-                resolve();
+    // Wrap entire installation process (both Homebrew and Go binary paths) in lock
+    await withInstallLock(lockPath, async () => {
+        // Try Homebrew first (preferred)
+        if (await hasCommand('brew')) {
+            console.log('Installing CLIProxyAPI via Homebrew...');
+            const brewPath = await requireTrustedCommand('brew');
+            const spawnCmd = (await import('cross-spawn')).default;
+            try {
+                await new Promise((resolve, reject) => {
+                    const child = spawnCmd(brewPath, ['install', 'cliproxyapi'], {
+                        stdio: 'inherit',
+                    });
+                    child.on('close', (code) => {
+                        if (code === 0) {
+                            console.log('CLIProxyAPI installed successfully via Homebrew');
+                            resolve();
+                        }
+                        else {
+                            reject(new Error('Failed to install CLIProxyAPI via Homebrew'));
+                        }
+                    });
+                    child.on('error', (error) => reject(error));
+                });
+                return;
             }
-            else {
-                reject(new Error('Failed to install CLIProxyAPI via Homebrew'));
+            catch (error) {
+                debugLog('Homebrew installation failed, falling back to Go binary:', error);
+                // Fall through to Go binary installation
             }
-        });
-        child.on('error', (error) => reject(error));
+        }
+        // Fallback: Install Go binary directly
+        console.log('Installing CLIProxyAPI via Go binary...');
+        // Determine platform/arch for CLIProxyAPI release asset format
+        // CLIProxyAPI uses: CLIProxyAPI_{version}_{platform}_{arch}.{ext}
+        const platformMap = { darwin: 'darwin', linux: 'linux', win32: 'windows' };
+        const archMap = { arm64: 'arm64', x64: 'amd64' };
+        const cliPlatform = platformMap[platform];
+        const cliArch = archMap[arch];
+        if (!cliPlatform) {
+            throw new Error(`Unsupported platform: ${platform}\n` +
+                `Supported platforms: ${Object.keys(platformMap).join(', ')}`);
+        }
+        if (!cliArch) {
+            throw new Error(`Unsupported architecture: ${arch}\n` +
+                `Supported architectures: ${Object.keys(archMap).join(', ')}`);
+        }
+        // Resolve exact release tag first for security (avoid moving 'latest' redirects)
+        console.log('Resolving latest release tag from GitHub API...');
+        const releaseTag = await getLatestReleaseTag();
+        console.log(`Latest release: ${releaseTag}`);
+        // Strip 'v' prefix from tag for version (e.g., v6.9.5 -> 6.9.5)
+        const version = releaseTag.startsWith('v') ? releaseTag.slice(1) : releaseTag;
+        // Determine archive extension
+        const isWindows = platform === 'win32';
+        const archiveExt = isWindows ? 'zip' : 'tar.gz';
+        const archiveFileName = `CLIProxyAPI_${version}_${cliPlatform}_${cliArch}.${archiveExt}`;
+        const installDir = join(home, '.local', 'bin');
+        const binaryPath = join(installDir, isWindows ? 'cliproxyapi.exe' : 'cliproxyapi');
+        // Use crypto.randomUUID() for temp files to avoid collision in concurrent installs
+        const randomSuffix = randomUUID();
+        const archivePath = join(installDir, `cliproxyapi-${randomSuffix}.${archiveExt}`);
+        const extractDir = join(installDir, `cliproxyapi-extract-${randomSuffix}`);
+        // Ensure install directory exists
+        await ensureDir(installDir);
+        const baseUrl = `https://github.com/router-for-me/CLIProxyAPI/releases/download/${releaseTag}`;
+        const archiveUrl = `${baseUrl}/${archiveFileName}`;
+        console.log(`Downloading ${archiveFileName} from GitHub releases...`);
+        const fs = await import('fs/promises');
+        try {
+            // Download archive with streaming and byte limits
+            console.log(`Downloading ${archiveFileName} from GitHub releases...`);
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 120000); // 120 second timeout
+            let response;
+            try {
+                response = await fetch(archiveUrl, { signal: controller.signal });
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+            if (!response.ok) {
+                if (response.status === 404) {
+                    // 404 means the archive doesn't exist for this platform/arch in this release
+                    throw new Error(`Archive not found for ${cliPlatform}_${cliArch}\n` +
+                        `URL: ${archiveUrl}\n\n` +
+                        `This could mean:\n` +
+                        `  - ${cliPlatform}_${cliArch} archives are not available in release ${releaseTag}\n` +
+                        `  - Check the CLIProxyAPI releases page for available platforms\n\n` +
+                        `Suggested alternatives:\n` +
+                        `  1. Try Homebrew installation: brew install cliproxyapi\n` +
+                        `  2. Check available releases: ${baseUrl}\n` +
+                        `  3. Download manually from: https://github.com/router-for-me/CLIProxyAPI/releases\n\n` +
+                        `Available platforms for CLIProxyAPI may vary by release.`);
+                }
+                throw new Error(`HTTP ${response.status} ${response.statusText}\n` +
+                    `URL: ${archiveUrl}\n` +
+                    `Platform/Arch: ${cliPlatform}_${cliArch}`);
+            }
+            // Pre-check content-length if available
+            const contentLength = Number(response.headers.get('content-length') || 0);
+            if (contentLength > MAX_ARCHIVE_BYTES) {
+                throw new Error(`Archive too large (Content-Length: ${(contentLength / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
+                    'This may be a tar bomb.');
+            }
+            // Stream download with byte limit and incremental hash
+            if (!response.body) {
+                throw new Error('Response body is null');
+            }
+            const fileHandle = await fs.open(archivePath, 'w');
+            const hash = createHash('sha256');
+            let downloadedBytes = 0;
+            try {
+                for await (const chunk of response.body) {
+                    downloadedBytes += chunk.byteLength;
+                    if (downloadedBytes > MAX_ARCHIVE_BYTES) {
+                        throw new Error(`Archive exceeded size limit during download (${(downloadedBytes / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
+                            'This may be a tar bomb.');
+                    }
+                    hash.update(chunk);
+                    await fileHandle.write(chunk);
+                }
+            }
+            finally {
+                await fileHandle.close();
+            }
+            console.log(`Downloaded ${(downloadedBytes / 1024 / 1024).toFixed(1)} MB`);
+            // Get the calculated hash
+            const actualHash = hash.digest('hex');
+            // Try to download and verify checksums file
+            let checksumVerified = false;
+            let checksumMismatchError = null;
+            const checksumUrls = [
+                `${baseUrl}/SHA256SUMS`,
+                `${baseUrl}/checksums.txt`,
+                `${baseUrl}/checksums.sha256`,
+            ];
+            for (const checksumUrl of checksumUrls) {
+                try {
+                    console.log(`Attempting checksum verification from: ${new URL(checksumUrl).pathname}`);
+                    const checksumResponse = await fetch(checksumUrl, { signal: AbortSignal.timeout(10000) });
+                    if (checksumResponse.ok) {
+                        const checksumContent = await checksumResponse.text();
+                        const expectedHash = parseExpectedSha256(checksumContent, archiveFileName);
+                        if (expectedHash) {
+                            if (actualHash === expectedHash) {
+                                console.log(chalk.green('✓ Checksum verification passed'));
+                                checksumVerified = true;
+                                break;
+                            }
+                            else {
+                                // Checksum mismatch - this is FATAL, do not continue
+                                await fs.unlink(archivePath).catch(() => { });
+                                checksumMismatchError = new Error(`Checksum verification failed!\n` +
+                                    `Expected: ${expectedHash}\n` +
+                                    `Actual:   ${actualHash}\n\n` +
+                                    `The downloaded archive may be corrupted or tampered with.\n` +
+                                    `Please try again or install CLIProxyAPI manually.`);
+                                break; // Exit loop immediately on mismatch
+                            }
+                        }
+                    }
+                }
+                catch (checksumError) {
+                    // Only catch network/parsing errors - let checksum mismatches fail hard
+                    const errorMsg = checksumError instanceof Error ? checksumError.message : String(checksumError);
+                    if (errorMsg.includes('Checksum verification failed')) {
+                        // Re-throw checksum mismatch errors
+                        throw checksumError;
+                    }
+                    debugLog(`Checksum verification failed for ${checksumUrl}:`, checksumError);
+                    // Try next checksum URL on network errors
+                }
+            }
+            // If we found a checksum mismatch, fail hard
+            if (checksumMismatchError) {
+                throw checksumMismatchError;
+            }
+            // SECURITY: Fail closed if checksum verification is not available
+            // This prevents installation of potentially tampered binaries
+            if (!checksumVerified) {
+                await fs.unlink(archivePath).catch(() => { });
+                throw new Error(chalk.red('Checksum verification required but failed.\n\n') +
+                    'The downloaded archive could not be verified against a checksum file.\n' +
+                    'This is a security requirement to prevent installation of tampered binaries.\n\n' +
+                    'Possible reasons:\n' +
+                    '  - Network issues prevented checksum file download\n' +
+                    '  - Checksum files are not published for this release\n' +
+                    '  - GitHub releases are temporarily unavailable\n\n' +
+                    'To install CLIProxyAPI safely:\n' +
+                    `  1. Visit ${baseUrl}/\n` +
+                    '  2. Download the archive and checksum files manually\n' +
+                    '  3. Verify the checksums match\n' +
+                    '  4. Extract the archive\n' +
+                    '  5. Place the binary in a directory in your PATH\n' +
+                    '  6. Make it executable: chmod +x cliproxyapi\n\n' +
+                    'Then run ccodex again.');
+            }
+            // Archive was already written to disk during streaming download
+            // Extract archive using hardened extraction strategy
+            console.log(`Extracting ${archiveExt} archive...`);
+            await ensureDir(extractDir);
+            // Preflight: validate archive listing before extraction
+            console.log('Validating archive contents...');
+            await validateArchiveListing(archivePath);
+            try {
+                // Unix/macOS: use tar with portable hardened flags
+                // Note: --no-same-owner and --no-same-permissions are supported by both GNU and BSD tar
+                // We avoid GNU-specific flags like --delay-directory-restore for macOS compatibility
+                // Use bounded execution with timeout (60 seconds for extraction) and trusted tar path
+                const tarPath = await requireTrustedCommand('tar');
+                const result = await runCmdBounded(tarPath, [
+                    '-xzf', archivePath,
+                    '-C', extractDir,
+                    '--no-same-owner',
+                    '--no-same-permissions',
+                ], 60000);
+                if (result.code !== 0) {
+                    throw new Error(`tar extraction failed with code ${result.code}`);
+                }
+            }
+            catch (extractError) {
+                // Clean up on extraction failure
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw new Error(`Failed to extract archive: ${extractError instanceof Error ? extractError.message : String(extractError)}\n\n` +
+                    'The archive may be corrupted or incompatible with your system.');
+            }
+            // Post-extraction: validate extracted size (prevent zip bomb)
+            console.log('Validating extracted size...');
+            let extractedBytes = 0;
+            async function getDirSize(dir) {
+                const entries = await fs.readdir(dir, { withFileTypes: true });
+                let size = 0;
+                for (const ent of entries) {
+                    const full = join(dir, ent.name);
+                    const stat = await fs.stat(full);
+                    if (ent.isDirectory()) {
+                        size += await getDirSize(full);
+                    }
+                    else {
+                        size += stat.size;
+                    }
+                }
+                return size;
+            }
+            try {
+                extractedBytes = await getDirSize(extractDir);
+                if (extractedBytes > MAX_EXTRACTED_BYTES) {
+                    throw new Error(`Extracted content is too large (${(extractedBytes / 1024 / 1024).toFixed(1)} MB > ${MAX_EXTRACTED_BYTES / 1024 / 1024} MB). ` +
+                        'This may be a zip bomb.');
+                }
+            }
+            catch (sizeError) {
+                // Clean up on size check failure
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw sizeError;
+            }
+            // Post-extraction: validate realpath confinement
+            // This detects path traversal via symlinks, hardlinks, or other escape mechanisms
+            console.log('Validating extraction safety...');
+            try {
+                await assertRealpathConfinement(extractDir);
+            }
+            catch (confinementError) {
+                // Clean up on confinement failure
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw confinementError;
+            }
+            // Find the extracted binary
+            // CLIProxyAPI archives contain a single binary named 'CLIProxyAPI' (or 'CLIProxyAPI.exe')
+            const extractedFiles = await fs.readdir(extractDir);
+            const extractedBinary = extractedFiles.find(f => isWindows ? f === 'CLIProxyAPI.exe' : f === 'CLIProxyAPI');
+            if (!extractedBinary) {
+                // Clean up
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw new Error(`Could not find CLIProxyAPI binary in extracted archive.\n` +
+                    `Files found: ${extractedFiles.join(', ')}\n\n` +
+                    'The archive format may have changed. Please report this issue.');
+            }
+            const extractedBinaryPath = join(extractDir, extractedBinary);
+            // Set executable permission on extracted binary before validation (Unix/macOS only)
+            if (!isWindows) {
+                try {
+                    await fs.chmod(extractedBinaryPath, 0o755);
+                }
+                catch (chmodError) {
+                    debugLog('Warning: Could not set executable permission on extracted binary:', chmodError);
+                    // Continue anyway - the archive may already have execute bits set
+                }
+            }
+            // Validate the extracted binary works by running it
+            console.log('Validating extracted binary...');
+            try {
+                const testResult = await runCmdBounded(extractedBinaryPath, ['--version'], 5000);
+                // Fail on non-zero exit
+                if (testResult.code !== 0) {
+                    throw new Error(`Binary validation failed: exited with code ${testResult.code}`);
+                }
+            }
+            catch (validationError) {
+                // Clean up invalid binary
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw new Error(`Extracted binary failed validation: ${validationError instanceof Error ? validationError.message : String(validationError)}\n\n` +
+                    'The binary may be corrupted or incompatible with your system.');
+            }
+            // Backup existing binary if present, but be ready to rollback
+            let backupPath = null;
+            let didBackup = false;
+            if (await fileExists(binaryPath)) {
+                backupPath = `${binaryPath}.backup.${randomUUID()}`;
+                await fs.rename(binaryPath, backupPath);
+                didBackup = true;
+            }
+            // Copy extracted binary to final location
+            try {
+                await fs.copyFile(extractedBinaryPath, binaryPath);
+                // Set executable permission on Unix/macOS
+                if (!isWindows) {
+                    await fs.chmod(binaryPath, 0o755);
+                }
+                // Store the installed path for this process
+                installedProxyPath = binaryPath;
+            }
+            catch (copyError) {
+                // Rollback: restore backup if we had one
+                if (didBackup && backupPath) {
+                    try {
+                        await fs.rename(backupPath, binaryPath);
+                    }
+                    catch (rollbackError) {
+                        debugLog('Failed to rollback after copy failure:', rollbackError);
+                    }
+                }
+                // Clean up
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw new Error(`Failed to copy binary to final location: ${copyError instanceof Error ? copyError.message : String(copyError)}`);
+            }
+            // Clean up on success
+            await fs.unlink(archivePath).catch((err) => {
+                debugLog('Warning: Failed to cleanup archive file:', err);
+            });
+            await fs.rm(extractDir, { recursive: true, force: true }).catch((err) => {
+                debugLog('Warning: Failed to cleanup extract directory:', err);
+            });
+            // Clean up backup on success
+            if (backupPath) {
+                await fs.unlink(backupPath).catch((err) => {
+                    debugLog('Warning: Failed to cleanup backup file:', err);
+                });
+            }
+            console.log(`CLIProxyAPI installed successfully to: ${binaryPath}`);
+            // Check if install dir is in PATH (use platform-specific delimiter and case-insensitive on Windows)
+            const pathEnv = process.env.PATH || '';
+            // Filter empty segments to avoid false positives from '::' in PATH
+            const pathDirs = pathEnv.split(delimiter).filter(p => p.length > 0);
+            // Normalize paths for comparison: resolve to absolute paths, normalize separators, case-insensitive on Windows
+            const normalizePath = (p) => {
+                const resolved = resolve(p);
+                const normalized = normalize(resolved);
+                return isWindows ? normalized.toLowerCase() : normalized;
+            };
+            const binInPath = pathDirs.some(dir => normalizePath(dir) === normalizePath(installDir));
+            if (!binInPath) {
+                console.log('');
+                console.log('⚠️  WARNING: ~/.local/bin is not in your PATH');
+                console.log('');
+                console.log('To use ccodex, add ~/.local/bin to your PATH:');
+                console.log('');
+                console.log('  For bash (add to ~/.bashrc):');
+                console.log('    export PATH="$HOME/.local/bin:$PATH"');
+                console.log('');
+                console.log('  For zsh (add to ~/.zshrc):');
+                console.log('    export PATH="$HOME/.local/bin:$PATH"');
+                console.log('');
+                console.log('Then reload your shell: source ~/.bashrc (or ~/.zshrc)');
+            }
+        }
+        catch (error) {
+            // Clean up archive and extract dir on error
+            await fs.unlink(archivePath).catch((err) => {
+                debugLog('Warning: Failed to cleanup archive file during error handling:', err);
+            });
+            await fs.rm(extractDir, { recursive: true, force: true }).catch((err) => {
+                debugLog('Warning: Failed to cleanup extract directory during error handling:', err);
+            });
+            throw new Error(`Failed to install CLIProxyAPI: ${error instanceof Error ? error.message : String(error)}\n\n` +
+                'Please install CLIProxyAPI manually:\n' +
+                '  1. Visit https://github.com/router-for-me/CLIProxyAPI/releases\n' +
+                `  2. Download ${archiveFileName} for your system\n` +
+                '  3. Extract the archive\n' +
+                '  4. Place the binary in a directory in your PATH\n' +
+                '  5. Make it executable: chmod +x cliproxyapi');
+        }
     });
 }
 /**
@@ -135,14 +818,10 @@ export async function startProxy() {
     if (await isProxyRunning()) {
         return;
     }
-    const cmdResult = await detectProxyCommand();
-    const proxyCmd = cmdResult.cmd;
-    if (!proxyCmd) {
-        throw new Error('CLIProxyAPI not found. Run: npx -y @tuannvm/ccodex');
-    }
+    const proxyExe = await requireTrustedProxyCommand();
     console.log('Starting CLIProxyAPI in background...');
     const logFile = getLogFilePath();
-    await ensureDir(join(logFile, '..'));
+    await ensureDir(dirname(logFile));
     const { spawn } = await import('child_process');
     const fs = await import('fs/promises');
     let out = null;
@@ -159,7 +838,7 @@ export async function startProxy() {
                 debugLog('Warning: Could not set restrictive permissions on log file');
             }
         }
-        const child = spawn(proxyCmd, [], {
+        const child = spawn(proxyExe, [], {
             detached: true,
             stdio: ['ignore', out.fd, out.fd],
         });
@@ -191,15 +870,11 @@ export async function startProxy() {
  * Launch OAuth login
  */
 export async function launchLogin() {
-    const cmdResult = await detectProxyCommand();
-    const proxyCmd = cmdResult.cmd;
-    if (!proxyCmd) {
-        throw new Error('CLIProxyAPI not found. Run: npx -y @tuannvm/ccodex');
-    }
+    const proxyExe = await requireTrustedProxyCommand();
     console.log('Launching ChatGPT/Codex OAuth login in browser...');
     const spawnCmd = (await import('cross-spawn')).default;
     return new Promise((resolve, reject) => {
-        const child = spawnCmd(proxyCmd, ['-codex-login'], {
+        const child = spawnCmd(proxyExe, ['-codex-login'], {
             stdio: 'inherit',
         });
         child.on('close', (code) => {