@tuannvm/ccodex 0.1.9 → 0.2.9

package/dist/proxy.js

@@ -1,10 +1,72 @@
-import { join } from 'path';
-import { createHash } from 'crypto';
+import { join, delimiter, normalize, sep, resolve, dirname, isAbsolute } from 'path';
+import { homedir } from 'os';
+import { createHash, randomUUID } from 'crypto';
 import chalk from 'chalk';
-import { hasCommand, getCommandPath, execCommand, httpGet, sleep, ensureDir, fileExists, safeJsonParse, debugLog } from './utils.js';
+import { hasCommand, getCommandPath, execCommand, httpGet, sleep, ensureDir, fileExists, safeJsonParse, debugLog, runCmdBounded, requireTrustedCommand, withInstallLock } from './utils.js';
 import { CONFIG, getProxyUrl, getAuthDir, getLogFilePath } from './config.js';
 // Track installed proxy binary path for this process
 let installedProxyPath = null;
+/**
+ * Get allowed installation directories for proxy binary
+ * Returns paths that are considered safe sources for CLIProxyAPI
+ */
+function getAllowedInstallDirs() {
+    const home = homedir();
+    const allowed = [
+        join(home, '.local', 'bin'), // User local bin
+        '/usr/local/bin', // System local bin
+        '/opt/homebrew/bin', // Homebrew Apple Silicon
+        '/usr/local/bin', // Homebrew Intel
+        join(home, 'go', 'bin'), // Go user bin
+    ];
+    // Add common Windows paths if on Windows
+    if (process.platform === 'win32') {
+        allowed.push(join(process.env.LOCALAPPDATA || '', 'Programs'), join(process.env.APPDATA || '', 'Programs'));
+    }
+    return allowed;
+}
+/**
+ * Validate that a proxy binary path is from a trusted location
+ * Throws if path is not absolute or not from allowed directory
+ */
+function validateProxyPath(proxyPath) {
+    if (!isAbsolute(proxyPath)) {
+        throw new Error(`Proxy binary path is not absolute: ${proxyPath}`);
+    }
+    const realPath = resolve(proxyPath);
+    const allowedDirs = getAllowedInstallDirs();
+    const isAllowed = allowedDirs.some(allowedDir => {
+        const resolvedAllowed = resolve(allowedDir);
+        return realPath.startsWith(resolvedAllowed + sep) || realPath === resolvedAllowed;
+    });
+    if (!isAllowed) {
+        throw new Error(`Proxy binary not from trusted location.\n` +
+            `Path: ${realPath}\n` +
+            `Allowed directories: ${allowedDirs.join(', ')}\n\n` +
+            `For security, only proxy binaries from trusted locations are executed.\n` +
+            `If you installed CLIProxyAPI manually, move it to ~/.local/bin or install via Homebrew.`);
+    }
+}
+/**
+ * Get trusted proxy command path
+ * Validates that the proxy binary is from a trusted location before execution
+ */
+export async function requireTrustedProxyCommand() {
+    const cmdResult = await detectProxyCommand();
+    // Prefer installed path from this process
+    if (installedProxyPath && fileExists(installedProxyPath)) {
+        validateProxyPath(installedProxyPath);
+        return installedProxyPath;
+    }
+    // Use detected path
+    if (!cmdResult.path) {
+        throw new Error('CLIProxyAPI not found. Install it first:\n' +
+            '  1. Run: npx -y @tuannvm/ccodex\n' +
+            '  2. Or install manually: brew install cliproxyapi');
+    }
+    validateProxyPath(cmdResult.path);
+    return cmdResult.path;
+}
 /**
  * Detect CLIProxyAPI command
  * Prefers locally installed binary from this process if available
@@ -55,23 +117,19 @@ export async function checkAuthConfigured() {
     }
     // Check auth via proxy status
     let hasAuthEntries = false;
-    const cmdResult = await detectProxyCommand();
-    if (cmdResult.cmd) {
-        try {
-            // Use absolute path if available, otherwise command name
-            const proxyExe = cmdResult.path || cmdResult.cmd;
-            const output = await execCommand(proxyExe, ['status']);
-            // Match "N auth entries" or "N auth files" where N > 0
-            const match = output.match(/(\d+)\s+(auth entries|auth files)/);
-            if (match) {
-                const count = parseInt(match[1], 10);
-                hasAuthEntries = count > 0;
-            }
-        }
-        catch (error) {
-            debugLog('Failed to check proxy status:', error);
+    try {
+        const proxyExe = await requireTrustedProxyCommand();
+        const output = await execCommand(proxyExe, ['status']);
+        // Match "N auth entries" or "N auth files" where N > 0
+        const match = output.match(/(\d+)\s+(auth entries|auth files)/);
+        if (match) {
+            const count = parseInt(match[1], 10);
+            hasAuthEntries = count > 0;
         }
     }
+    catch (error) {
+        debugLog('Failed to check proxy status:', error);
+    }
     // Check via API
     let hasModels = false;
     try {
@@ -106,8 +164,11 @@ function sha256Hex(data) {
  * Supports common checksum formats:
  * - SHA256SUMS: "a1b2c3...  filename" or "a1b2c3... *filename"
  * - checksums.txt: "a1b2c3... filename"
+ * Handles path prefixes: "./filename", "subdir/filename", "subdir\filename" (Windows)
+ * Prefers exact filename match over basename match to avoid collisions
  */
 function parseExpectedSha256(content, fileName) {
+    // First pass: try exact filename match (with or without path separators)
     for (const line of content.split('\n')) {
         const trimmed = line.trim();
         if (!trimmed)
@@ -116,7 +177,11 @@ function parseExpectedSha256(content, fileName) {
         const match = trimmed.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
         if (match) {
             const [, hash, name] = match;
-            if (name.trim() === fileName) {
+            const normalizedName = name.trim();
+            // Normalize path separators to / and strip any path prefix
+            const normalizedBase = normalizedName.replace(/\\/g, '/').replace(/^.*\//, '');
+            if (normalizedBase === fileName) {
+                // Found exact basename match
                 return hash.toLowerCase();
             }
         }
@@ -152,6 +217,181 @@ async function getLatestReleaseTag() {
             'Please check your internet connection or install CLIProxyAPI manually.');
     }
 }
+/**
+ * Check if an archive entry path is unsafe (contains path traversal or absolute paths)
+ */
+function isUnsafeArchivePath(raw) {
+    if (!raw)
+        return true;
+    // Normalize zip/tar separators and strip leading "./"
+    const p = raw.replace(/\\/g, '/').replace(/^\.\/+/, '');
+    if (!p)
+        return true;
+    // Reject absolute, drive-letter, UNC-like
+    if (p.startsWith('/') || /^[a-zA-Z]:\//.test(p) || p.startsWith('//'))
+        return true;
+    // Reject traversal segments
+    const parts = p.split('/').filter(Boolean);
+    if (parts.some(seg => seg === '..'))
+        return true;
+    return false;
+}
+// Resource limits for archive extraction (prevent tar/zip bombs)
+const MAX_ENTRIES = 1000;
+const MAX_ARCHIVE_BYTES = 100 * 1024 * 1024; // 100 MB compressed
+const MAX_EXTRACTED_BYTES = 500 * 1024 * 1024; // 500 MB uncompressed
+/**
+ * Parse tar verbose output line to extract path and type
+ * Handles GNU/BSD tar verbose output with special bits and spaces in filenames
+ * Returns null for lines that don't match expected tar verbose format (treated as suspicious)
+ */
+function parseTarVerboseLine(line) {
+    // Tar verbose format typically:
+    // permissions owner/group size date time... path
+    // Or with links: permissions ... path -> target
+    //
+    // We parse by:
+    // 1. Finding the path segment (everything after the date/time)
+    // 2. Checking the first character for file type
+    //
+    // Handle special bits that may appear: s/S (setuid/setgid), t/T (sticky), + (ACL), @ (extended attributes)
+    // The first character indicates type: - (file), d (dir), l (symlink), h (hardlink), c (char), b (block), p (fifo)
+    if (!line || line.length === 0)
+        return null;
+    const firstChar = line.charAt(0);
+    const fileTypeMap = {
+        '-': 'file',
+        'd': 'dir',
+        'l': 'symlink',
+        'h': 'hardlink',
+        'c': 'char',
+        'b': 'block',
+        'p': 'fifo',
+    };
+    const type = fileTypeMap[firstChar];
+    if (!type) {
+        // Unknown file type character - treat as suspicious
+        return null;
+    }
+    // Find the path by splitting on whitespace
+    // Tar verbose format fields are separated by whitespace
+    // The path is typically the last field (or second-to-last before "-> target")
+    const parts = line.split(/\s+/);
+    // For very long lines with many fields, the path might be split further
+    // Find the part that looks like a path (contains '/', or ends with ' -> ', or is just a name)
+    let pathWithTarget = '';
+    let foundPath = false;
+    // Iterate from the end to find the path
+    for (let i = parts.length - 1; i >= 0; i--) {
+        const part = parts[i];
+        if (part.includes('/') || part.includes(' -> ') || (part.length > 0 && !foundPath)) {
+            pathWithTarget = part + (pathWithTarget ? ' ' + pathWithTarget : '');
+            foundPath = true;
+        }
+        else if (foundPath) {
+            // We've collected all path parts
+            break;
+        }
+    }
+    if (!pathWithTarget)
+        return null;
+    // Extract just the path (before " -> " for symlinks)
+    const arrowIndex = pathWithTarget.indexOf(' -> ');
+    const path = arrowIndex >= 0 ? pathWithTarget.substring(0, arrowIndex).trim() : pathWithTarget.trim();
+    if (!path)
+        return null;
+    return { path, type };
+}
+/**
+ * List entries in a tar archive with resource limits and link type validation
+ */
+async function listTarEntries(archivePath) {
+    const fs = await import('fs/promises');
+    // Check archive file size before extraction
+    const archiveStat = await fs.stat(archivePath);
+    if (archiveStat.size > MAX_ARCHIVE_BYTES) {
+        throw new Error(`Archive file is too large (${(archiveStat.size / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
+            'This may be a tar bomb.');
+    }
+    // Use verbose mode with -z to explicitly handle gzip compression
+    // Some tar versions auto-detect compression, but -z ensures consistency
+    // Use trusted tar path to avoid PATH hijacking
+    const tarPath = await requireTrustedCommand('tar');
+    const result = await runCmdBounded(tarPath, ['-ztvf', archivePath], 30000); // 30 second timeout
+    if (result.code !== 0) {
+        throw new Error(`tar list failed with code ${result.code}`);
+    }
+    const lines = result.stdout.split('\n').map(s => s.trim()).filter(Boolean);
+    const entries = [];
+    // Resource limits: prevent tar/zip bombs
+    if (lines.length > MAX_ENTRIES) {
+        throw new Error(`Archive has too many entries (${lines.length} > ${MAX_ENTRIES}). This may be a tar bomb.`);
+    }
+    // Parse and validate each entry
+    for (const line of lines) {
+        const parsed = parseTarVerboseLine(line);
+        // Treat unparsable lines as suspicious - fail closed instead of skipping
+        if (!parsed) {
+            throw new Error(`Unrecognized tar output format (possible archive corruption): ${line.substring(0, 100)}`);
+        }
+        // Check for unsafe paths
+        if (isUnsafeArchivePath(parsed.path)) {
+            throw new Error(`Unsafe archive path: ${parsed.path}`);
+        }
+        // Reject symlinks and hardlinks for security
+        if (parsed.type === 'symlink' || parsed.type === 'hardlink') {
+            throw new Error(`Archive contains forbidden link entry: ${parsed.path} (${parsed.type})`);
+        }
+        // Reject character/block devices, fifos (unusual in CLIProxyAPI archives)
+        if (parsed.type === 'char' || parsed.type === 'block' || parsed.type === 'fifo') {
+            throw new Error(`Archive contains unusual entry type: ${parsed.path} (${parsed.type})`);
+        }
+        entries.push(parsed.path);
+    }
+    if (entries.length === 0) {
+        throw new Error('Archive is empty or contains no valid entries');
+    }
+    return entries;
+}
+/**
+ * Validate archive listing for unsafe paths and link types
+ * Note: Windows installation is not currently supported (throws early in installProxyApi)
+ */
+async function validateArchiveListing(archivePath) {
+    // listTarEntries now does all the validation (path safety, link rejection, resource limits)
+    await listTarEntries(archivePath);
+}
+/**
+ * Assert that all extracted files are confined within the target directory
+ * Validates that realpath of all files stays within the target directory
+ * Symlinks and hardlinks are already rejected during tar parsing
+ */
+async function assertRealpathConfinement(rootDir) {
+    const fs = await import('fs/promises');
+    const rootReal = await fs.realpath(rootDir);
+    const stack = [rootDir];
+    while (stack.length > 0) {
+        const cur = stack.pop();
+        const entries = await fs.readdir(cur, { withFileTypes: true });
+        for (const ent of entries) {
+            const full = join(cur, ent.name);
+            // Double-check for symlinks (defensive: should have been caught during tar parsing)
+            const lst = await fs.lstat(full);
+            if (lst.isSymbolicLink()) {
+                throw new Error(`Symlink not allowed in extracted archive: ${full}`);
+            }
+            // Verify realpath stays within target directory
+            const rp = await fs.realpath(full);
+            const confined = rp === rootReal || rp.startsWith(rootReal + sep);
+            if (!confined) {
+                throw new Error(`Extracted path escapes target directory: ${full}`);
+            }
+            if (ent.isDirectory()) {
+                stack.push(full);
+            }
+        }
+    }
+}
 /**
  * Install CLIProxyAPI via Homebrew or Go binary fallback
  */
@@ -161,6 +401,8 @@ export async function installProxyApi() {
     if (!home) {
         throw new Error('Cannot determine home directory. Please set HOME environment variable.');
     }
+    // Install lock file path (in the target install directory)
+    const lockPath = join(home, '.local', 'bin', '.cliproxyapi.install.lock');
     // Check platform
     const platform = process.platform;
     const arch = process.arch;
@@ -169,238 +411,405 @@ export async function installProxyApi() {
             'Please install CLIProxyAPI manually and ensure it\'s in your PATH.\n' +
             'See CLIProxyAPI documentation for Windows installation instructions.');
     }
-    // Try Homebrew first (preferred)
-    if (await hasCommand('brew')) {
-        console.log('Installing CLIProxyAPI via Homebrew...');
-        const spawnCmd = (await import('cross-spawn')).default;
-        try {
-            await new Promise((resolve, reject) => {
-                const child = spawnCmd('brew', ['install', 'cliproxyapi'], {
-                    stdio: 'inherit',
-                });
-                child.on('close', (code) => {
-                    if (code === 0) {
-                        console.log('CLIProxyAPI installed successfully via Homebrew');
-                        resolve();
-                    }
-                    else {
-                        reject(new Error('Failed to install CLIProxyAPI via Homebrew'));
-                    }
+    // Wrap entire installation process (both Homebrew and Go binary paths) in lock
+    await withInstallLock(lockPath, async () => {
+        // Try Homebrew first (preferred)
+        if (await hasCommand('brew')) {
+            console.log('Installing CLIProxyAPI via Homebrew...');
+            const brewPath = await requireTrustedCommand('brew');
+            const spawnCmd = (await import('cross-spawn')).default;
+            try {
+                await new Promise((resolve, reject) => {
+                    const child = spawnCmd(brewPath, ['install', 'cliproxyapi'], {
+                        stdio: 'inherit',
+                    });
+                    child.on('close', (code) => {
+                        if (code === 0) {
+                            console.log('CLIProxyAPI installed successfully via Homebrew');
+                            resolve();
+                        }
+                        else {
+                            reject(new Error('Failed to install CLIProxyAPI via Homebrew'));
+                        }
+                    });
+                    child.on('error', (error) => reject(error));
                 });
-                child.on('error', (error) => reject(error));
-            });
-            return;
-        }
-        catch (error) {
-            debugLog('Homebrew installation failed, falling back to Go binary:', error);
-            // Fall through to Go binary installation
-        }
-    }
-    // Fallback: Install Go binary directly
-    console.log('Installing CLIProxyAPI via Go binary...');
-    // Validate and determine platform suffix
-    const supportedPlatforms = ['darwin', 'linux'];
-    const supportedArches = ['arm64', 'x64'];
-    if (!supportedPlatforms.includes(platform)) {
-        throw new Error(`Unsupported platform: ${platform}\n` +
-            `Supported platforms: ${supportedPlatforms.join(', ')}`);
-    }
-    if (!supportedArches.includes(arch)) {
-        throw new Error(`Unsupported architecture: ${arch}\n` +
-            `Supported architectures: ${supportedArches.join(', ')}`);
-    }
-    const platformSuffix = `${platform}-${arch === 'arm64' ? 'arm64' : 'amd64'}`;
-    const binaryFileName = `cliproxyapi-${platformSuffix}`;
-    const installDir = join(home, '.local', 'bin');
-    const binaryPath = join(installDir, 'cliproxyapi');
-    const tempPath = join(installDir, `cliproxyapi.tmp.${Date.now()}`);
-    // Ensure install directory exists
-    await ensureDir(installDir);
-    // Resolve exact release tag first for security (avoid moving 'latest' redirects)
-    console.log('Resolving latest release tag from GitHub API...');
-    const releaseTag = await getLatestReleaseTag();
-    console.log(`Latest release: ${releaseTag}`);
-    const baseUrl = `https://github.com/router-for-me/CLIProxyAPI/releases/download/${releaseTag}`;
-    const binaryUrl = `${baseUrl}/${binaryFileName}`;
-    console.log(`Downloading ${binaryFileName} from GitHub releases...`);
-    const fs = await import('fs/promises');
-    try {
-        // Download binary with timeout
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 60000); // 60 second timeout
-        let response;
-        try {
-            response = await fetch(binaryUrl, { signal: controller.signal });
+                return;
+            }
+            catch (error) {
+                debugLog('Homebrew installation failed, falling back to Go binary:', error);
+                // Fall through to Go binary installation
+            }
         }
-        finally {
-            clearTimeout(timeout);
+        // Fallback: Install Go binary directly
+        console.log('Installing CLIProxyAPI via Go binary...');
+        // Determine platform/arch for CLIProxyAPI release asset format
+        // CLIProxyAPI uses: CLIProxyAPI_{version}_{platform}_{arch}.{ext}
+        const platformMap = { darwin: 'darwin', linux: 'linux', win32: 'windows' };
+        const archMap = { arm64: 'arm64', x64: 'amd64' };
+        const cliPlatform = platformMap[platform];
+        const cliArch = archMap[arch];
+        if (!cliPlatform) {
+            throw new Error(`Unsupported platform: ${platform}\n` +
+                `Supported platforms: ${Object.keys(platformMap).join(', ')}`);
         }
-        if (!response.ok) {
-            throw new Error(`HTTP ${response.status} ${response.statusText}\n` +
-                `URL: ${binaryUrl}\n` +
-                `Platform/Arch: ${platformSuffix}`);
+        if (!cliArch) {
+            throw new Error(`Unsupported architecture: ${arch}\n` +
+                `Supported architectures: ${Object.keys(archMap).join(', ')}`);
         }
-        const buffer = await response.arrayBuffer();
-        const uint8Array = new Uint8Array(buffer);
-        // Calculate SHA-256 checksum of downloaded binary
-        console.log('Calculating SHA-256 checksum...');
-        const actualHash = sha256Hex(uint8Array);
-        // Try to download and verify checksums file
-        let checksumVerified = false;
-        let checksumMismatchError = null;
-        const checksumUrls = [
-            `${baseUrl}/SHA256SUMS`,
-            `${baseUrl}/checksums.txt`,
-            `${baseUrl}/checksums.sha256`,
-        ];
-        for (const checksumUrl of checksumUrls) {
+        // Resolve exact release tag first for security (avoid moving 'latest' redirects)
+        console.log('Resolving latest release tag from GitHub API...');
+        const releaseTag = await getLatestReleaseTag();
+        console.log(`Latest release: ${releaseTag}`);
+        // Strip 'v' prefix from tag for version (e.g., v6.9.5 -> 6.9.5)
+        const version = releaseTag.startsWith('v') ? releaseTag.slice(1) : releaseTag;
+        // Determine archive extension
+        const isWindows = platform === 'win32';
+        const archiveExt = isWindows ? 'zip' : 'tar.gz';
+        const archiveFileName = `CLIProxyAPI_${version}_${cliPlatform}_${cliArch}.${archiveExt}`;
+        const installDir = join(home, '.local', 'bin');
+        const binaryPath = join(installDir, isWindows ? 'cliproxyapi.exe' : 'cliproxyapi');
+        // Use crypto.randomUUID() for temp files to avoid collision in concurrent installs
+        const randomSuffix = randomUUID();
+        const archivePath = join(installDir, `cliproxyapi-${randomSuffix}.${archiveExt}`);
+        const extractDir = join(installDir, `cliproxyapi-extract-${randomSuffix}`);
+        // Ensure install directory exists
+        await ensureDir(installDir);
+        const baseUrl = `https://github.com/router-for-me/CLIProxyAPI/releases/download/${releaseTag}`;
+        const archiveUrl = `${baseUrl}/${archiveFileName}`;
+        console.log(`Downloading ${archiveFileName} from GitHub releases...`);
+        const fs = await import('fs/promises');
+        try {
+            // Download archive with streaming and byte limits
+            console.log(`Downloading ${archiveFileName} from GitHub releases...`);
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 120000); // 120 second timeout
+            let response;
             try {
-                console.log(`Attempting checksum verification from: ${new URL(checksumUrl).pathname}`);
-                const checksumResponse = await fetch(checksumUrl, { signal: AbortSignal.timeout(10000) });
-                if (checksumResponse.ok) {
-                    const checksumContent = await checksumResponse.text();
-                    const expectedHash = parseExpectedSha256(checksumContent, binaryFileName);
-                    if (expectedHash) {
-                        if (actualHash === expectedHash) {
-                            console.log(chalk.green('✓ Checksum verification passed'));
-                            checksumVerified = true;
-                            break;
-                        }
-                        else {
-                            // Checksum mismatch - this is FATAL, do not continue
-                            await fs.unlink(tempPath).catch(() => { });
-                            checksumMismatchError = new Error(`Checksum verification failed!\n` +
-                                `Expected: ${expectedHash}\n` +
-                                `Actual:   ${actualHash}\n\n` +
-                                `The downloaded binary may be corrupted or tampered with.\n` +
-                                `Please try again or install CLIProxyAPI manually.`);
-                            break; // Exit loop immediately on mismatch
+                response = await fetch(archiveUrl, { signal: controller.signal });
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+            if (!response.ok) {
+                if (response.status === 404) {
+                    // 404 means the archive doesn't exist for this platform/arch in this release
+                    throw new Error(`Archive not found for ${cliPlatform}_${cliArch}\n` +
+                        `URL: ${archiveUrl}\n\n` +
+                        `This could mean:\n` +
+                        `  - ${cliPlatform}_${cliArch} archives are not available in release ${releaseTag}\n` +
+                        `  - Check the CLIProxyAPI releases page for available platforms\n\n` +
+                        `Suggested alternatives:\n` +
+                        `  1. Try Homebrew installation: brew install cliproxyapi\n` +
+                        `  2. Check available releases: ${baseUrl}\n` +
+                        `  3. Download manually from: https://github.com/router-for-me/CLIProxyAPI/releases\n\n` +
+                        `Available platforms for CLIProxyAPI may vary by release.`);
+                }
+                throw new Error(`HTTP ${response.status} ${response.statusText}\n` +
+                    `URL: ${archiveUrl}\n` +
+                    `Platform/Arch: ${cliPlatform}_${cliArch}`);
+            }
+            // Pre-check content-length if available
+            const contentLength = Number(response.headers.get('content-length') || 0);
+            if (contentLength > MAX_ARCHIVE_BYTES) {
+                throw new Error(`Archive too large (Content-Length: ${(contentLength / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
+                    'This may be a tar bomb.');
+            }
+            // Stream download with byte limit and incremental hash
+            if (!response.body) {
+                throw new Error('Response body is null');
+            }
+            const fileHandle = await fs.open(archivePath, 'w');
+            const hash = createHash('sha256');
+            let downloadedBytes = 0;
+            try {
+                for await (const chunk of response.body) {
+                    downloadedBytes += chunk.byteLength;
+                    if (downloadedBytes > MAX_ARCHIVE_BYTES) {
+                        throw new Error(`Archive exceeded size limit during download (${(downloadedBytes / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
+                            'This may be a tar bomb.');
+                    }
+                    hash.update(chunk);
+                    await fileHandle.write(chunk);
+                }
+            }
+            finally {
+                await fileHandle.close();
+            }
+            console.log(`Downloaded ${(downloadedBytes / 1024 / 1024).toFixed(1)} MB`);
+            // Get the calculated hash
+            const actualHash = hash.digest('hex');
+            // Try to download and verify checksums file
+            let checksumVerified = false;
+            let checksumMismatchError = null;
+            const checksumUrls = [
+                `${baseUrl}/SHA256SUMS`,
+                `${baseUrl}/checksums.txt`,
+                `${baseUrl}/checksums.sha256`,
+            ];
+            for (const checksumUrl of checksumUrls) {
+                try {
+                    console.log(`Attempting checksum verification from: ${new URL(checksumUrl).pathname}`);
+                    const checksumResponse = await fetch(checksumUrl, { signal: AbortSignal.timeout(10000) });
+                    if (checksumResponse.ok) {
+                        const checksumContent = await checksumResponse.text();
+                        const expectedHash = parseExpectedSha256(checksumContent, archiveFileName);
+                        if (expectedHash) {
+                            if (actualHash === expectedHash) {
+                                console.log(chalk.green('✓ Checksum verification passed'));
+                                checksumVerified = true;
+                                break;
+                            }
+                            else {
+                                // Checksum mismatch - this is FATAL, do not continue
+                                await fs.unlink(archivePath).catch(() => { });
+                                checksumMismatchError = new Error(`Checksum verification failed!\n` +
+                                    `Expected: ${expectedHash}\n` +
+                                    `Actual:   ${actualHash}\n\n` +
+                                    `The downloaded archive may be corrupted or tampered with.\n` +
+                                    `Please try again or install CLIProxyAPI manually.`);
+                                break; // Exit loop immediately on mismatch
+                            }
                         }
                     }
                 }
+                catch (checksumError) {
+                    // Only catch network/parsing errors - let checksum mismatches fail hard
+                    const errorMsg = checksumError instanceof Error ? checksumError.message : String(checksumError);
+                    if (errorMsg.includes('Checksum verification failed')) {
+                        // Re-throw checksum mismatch errors
+                        throw checksumError;
+                    }
+                    debugLog(`Checksum verification failed for ${checksumUrl}:`, checksumError);
+                    // Try next checksum URL on network errors
+                }
+            }
+            // If we found a checksum mismatch, fail hard
+            if (checksumMismatchError) {
+                throw checksumMismatchError;
+            }
+            // SECURITY: Fail closed if checksum verification is not available
+            // This prevents installation of potentially tampered binaries
+            if (!checksumVerified) {
+                await fs.unlink(archivePath).catch(() => { });
+                throw new Error(chalk.red('Checksum verification required but failed.\n\n') +
+                    'The downloaded archive could not be verified against a checksum file.\n' +
+                    'This is a security requirement to prevent installation of tampered binaries.\n\n' +
+                    'Possible reasons:\n' +
+                    '  - Network issues prevented checksum file download\n' +
+                    '  - Checksum files are not published for this release\n' +
+                    '  - GitHub releases are temporarily unavailable\n\n' +
+                    'To install CLIProxyAPI safely:\n' +
+                    `  1. Visit ${baseUrl}/\n` +
+                    '  2. Download the archive and checksum files manually\n' +
+                    '  3. Verify the checksums match\n' +
+                    '  4. Extract the archive\n' +
+                    '  5. Place the binary in a directory in your PATH\n' +
+                    '  6. Make it executable: chmod +x cliproxyapi\n\n' +
+                    'Then run ccodex again.');
             }
-            catch (checksumError) {
-                // Only catch network/parsing errors - let checksum mismatches fail hard
-                const errorMsg = checksumError instanceof Error ? checksumError.message : String(checksumError);
-                if (errorMsg.includes('Checksum verification failed')) {
-                    // Re-throw checksum mismatch errors
-                    throw checksumError;
+            // Archive was already written to disk during streaming download
+            // Extract archive using hardened extraction strategy
+            console.log(`Extracting ${archiveExt} archive...`);
+            await ensureDir(extractDir);
+            // Preflight: validate archive listing before extraction
+            console.log('Validating archive contents...');
+            await validateArchiveListing(archivePath);
+            try {
+                // Unix/macOS: use tar with portable hardened flags
+                // Note: --no-same-owner and --no-same-permissions are supported by both GNU and BSD tar
+                // We avoid GNU-specific flags like --delay-directory-restore for macOS compatibility
+                // Use bounded execution with timeout (60 seconds for extraction) and trusted tar path
+                const tarPath = await requireTrustedCommand('tar');
+                const result = await runCmdBounded(tarPath, [
+                    '-xzf', archivePath,
+                    '-C', extractDir,
+                    '--no-same-owner',
+                    '--no-same-permissions',
+                ], 60000);
+                if (result.code !== 0) {
+                    throw new Error(`tar extraction failed with code ${result.code}`);
                 }
-                debugLog(`Checksum verification failed for ${checksumUrl}:`, checksumError);
-                // Try next checksum URL on network errors
             }
-        }
-        // If we found a checksum mismatch, fail hard
-        if (checksumMismatchError) {
-            throw checksumMismatchError;
-        }
-        // SECURITY: Fail closed if checksum verification is not available
-        // This prevents installation of potentially tampered binaries
-        if (!checksumVerified) {
-            await fs.unlink(tempPath).catch(() => { });
-            throw new Error(chalk.red('Checksum verification required but failed.\n\n') +
-                'The downloaded binary could not be verified against a checksum file.\n' +
-                'This is a security requirement to prevent installation of tampered binaries.\n\n' +
-                'Possible reasons:\n' +
-                '  - Network issues prevented checksum file download\n' +
-                '  - Checksum files are not published for this release\n' +
-                '  - GitHub releases are temporarily unavailable\n\n' +
-                'To install CLIProxyAPI safely:\n' +
-                `  1. Visit ${baseUrl}/\n` +
-                '  2. Download the binary and checksum files manually\n' +
-                '  3. Verify the checksums match\n' +
-                '  4. Place the binary in a directory in your PATH\n' +
-                '  5. Make it executable: chmod +x cliproxyapi\n\n' +
-                'Then run ccodex again.');
-        }
-        // Atomic write: download to temp file first
-        await fs.writeFile(tempPath, uint8Array, { mode: 0o755 });
-        // Sync to disk
-        const fileHandle = await fs.open(tempPath, 'r');
-        try {
-            await fileHandle.sync();
-        }
-        finally {
-            await fileHandle.close();
-        }
-        // Validate the binary works by running it
-        try {
-            const { spawnSync } = await import('child_process');
-            const testResult = spawnSync(tempPath, ['--version'], { timeout: 5000 });
-            // Fail on any error, signal termination, or non-zero exit
-            if (testResult.error || testResult.signal !== null || testResult.status !== 0) {
-                const reason = testResult.error?.message ||
-                    (testResult.signal ? `killed by signal ${testResult.signal}` : null) ||
-                    (testResult.status ? `exited with code ${testResult.status}` : 'unknown error');
-                throw new Error(`Binary validation failed: ${reason}`);
+            catch (extractError) {
+                // Clean up on extraction failure
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw new Error(`Failed to extract archive: ${extractError instanceof Error ? extractError.message : String(extractError)}\n\n` +
+                    'The archive may be corrupted or incompatible with your system.');
             }
-        }
-        catch (validationError) {
-            // Clean up invalid binary
-            await fs.unlink(tempPath).catch(() => { });
-            throw new Error(`Downloaded binary failed validation: ${validationError instanceof Error ? validationError.message : String(validationError)}\n\n` +
-                'The binary may be corrupted or incompatible with your system.');
-        }
-        // Backup existing binary if present, but be ready to rollback
-        let backupPath = null;
-        let didBackup = false;
-        if (await fileExists(binaryPath)) {
-            backupPath = `${binaryPath}.backup.${Date.now()}`;
-            await fs.rename(binaryPath, backupPath);
-            didBackup = true;
-        }
-        // Move temp file to final location (atomic on most filesystems)
-        try {
-            await fs.rename(tempPath, binaryPath);
-            // Store the installed path for this process
-            installedProxyPath = binaryPath;
-        }
-        catch (renameError) {
-            // Rollback: restore backup if we had one
-            if (didBackup && backupPath) {
+            // Post-extraction: validate extracted size (prevent zip bomb)
+            console.log('Validating extracted size...');
+            let extractedBytes = 0;
+            async function getDirSize(dir) {
+                const entries = await fs.readdir(dir, { withFileTypes: true });
+                let size = 0;
+                for (const ent of entries) {
+                    const full = join(dir, ent.name);
+                    const stat = await fs.stat(full);
+                    if (ent.isDirectory()) {
+                        size += await getDirSize(full);
+                    }
+                    else {
+                        size += stat.size;
+                    }
+                }
+                return size;
+            }
+            try {
+                extractedBytes = await getDirSize(extractDir);
+                if (extractedBytes > MAX_EXTRACTED_BYTES) {
+                    throw new Error(`Extracted content is too large (${(extractedBytes / 1024 / 1024).toFixed(1)} MB > ${MAX_EXTRACTED_BYTES / 1024 / 1024} MB). ` +
+                        'This may be a zip bomb.');
+                }
+            }
+            catch (sizeError) {
+                // Clean up on size check failure
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw sizeError;
+            }
+            // Post-extraction: validate realpath confinement
+            // This detects path traversal via symlinks, hardlinks, or other escape mechanisms
+            console.log('Validating extraction safety...');
+            try {
+                await assertRealpathConfinement(extractDir);
+            }
+            catch (confinementError) {
+                // Clean up on confinement failure
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw confinementError;
+            }
+            // Find the extracted binary
+            // CLIProxyAPI archives contain a single binary named 'CLIProxyAPI' (or 'CLIProxyAPI.exe')
+            const extractedFiles = await fs.readdir(extractDir);
+            const extractedBinary = extractedFiles.find(f => isWindows ? f === 'CLIProxyAPI.exe' : f === 'CLIProxyAPI');
+            if (!extractedBinary) {
+                // Clean up
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw new Error(`Could not find CLIProxyAPI binary in extracted archive.\n` +
+                    `Files found: ${extractedFiles.join(', ')}\n\n` +
+                    'The archive format may have changed. Please report this issue.');
+            }
+            const extractedBinaryPath = join(extractDir, extractedBinary);
+            // Set executable permission on extracted binary before validation (Unix/macOS only)
+            if (!isWindows) {
                 try {
-                    await fs.rename(backupPath, binaryPath);
+                    await fs.chmod(extractedBinaryPath, 0o755);
                 }
-                catch (rollbackError) {
-                    debugLog('Failed to rollback after rename failure:', rollbackError);
+                catch (chmodError) {
+                    debugLog('Warning: Could not set executable permission on extracted binary:', chmodError);
+                    // Continue anyway - the archive may already have execute bits set
                 }
             }
-            throw new Error(`Failed to move binary to final location: ${renameError instanceof Error ? renameError.message : String(renameError)}`);
-        }
-        // Clean up backup on success
-        if (backupPath) {
-            fs.unlink(backupPath).catch(() => { });
+            // Validate the extracted binary works by running it
+            console.log('Validating extracted binary...');
+            try {
+                const testResult = await runCmdBounded(extractedBinaryPath, ['--version'], 5000);
+                // Fail on non-zero exit
+                if (testResult.code !== 0) {
+                    throw new Error(`Binary validation failed: exited with code ${testResult.code}`);
+                }
+            }
+            catch (validationError) {
+                // Clean up invalid binary
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw new Error(`Extracted binary failed validation: ${validationError instanceof Error ? validationError.message : String(validationError)}\n\n` +
+                    'The binary may be corrupted or incompatible with your system.');
+            }
+            // Backup existing binary if present, but be ready to rollback
+            let backupPath = null;
+            let didBackup = false;
+            if (await fileExists(binaryPath)) {
+                backupPath = `${binaryPath}.backup.${randomUUID()}`;
+                await fs.rename(binaryPath, backupPath);
+                didBackup = true;
+            }
+            // Copy extracted binary to final location
+            try {
+                await fs.copyFile(extractedBinaryPath, binaryPath);
+                // Set executable permission on Unix/macOS
+                if (!isWindows) {
+                    await fs.chmod(binaryPath, 0o755);
+                }
+                // Store the installed path for this process
+                installedProxyPath = binaryPath;
+            }
+            catch (copyError) {
+                // Rollback: restore backup if we had one
+                if (didBackup && backupPath) {
+                    try {
+                        await fs.rename(backupPath, binaryPath);
+                    }
+                    catch (rollbackError) {
+                        debugLog('Failed to rollback after copy failure:', rollbackError);
+                    }
+                }
+                // Clean up
+                await fs.unlink(archivePath).catch(() => { });
+                await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+                throw new Error(`Failed to copy binary to final location: ${copyError instanceof Error ? copyError.message : String(copyError)}`);
+            }
+            // Clean up on success
+            await fs.unlink(archivePath).catch((err) => {
+                debugLog('Warning: Failed to cleanup archive file:', err);
+            });
+            await fs.rm(extractDir, { recursive: true, force: true }).catch((err) => {
+                debugLog('Warning: Failed to cleanup extract directory:', err);
+            });
+            // Clean up backup on success
+            if (backupPath) {
+                await fs.unlink(backupPath).catch((err) => {
+                    debugLog('Warning: Failed to cleanup backup file:', err);
+                });
+            }
+            console.log(`CLIProxyAPI installed successfully to: ${binaryPath}`);
+            // Check if install dir is in PATH (use platform-specific delimiter and case-insensitive on Windows)
+            const pathEnv = process.env.PATH || '';
+            // Filter empty segments to avoid false positives from '::' in PATH
+            const pathDirs = pathEnv.split(delimiter).filter(p => p.length > 0);
+            // Normalize paths for comparison: resolve to absolute paths, normalize separators, case-insensitive on Windows
+            const normalizePath = (p) => {
+                const resolved = resolve(p);
+                const normalized = normalize(resolved);
+                return isWindows ? normalized.toLowerCase() : normalized;
+            };
+            const binInPath = pathDirs.some(dir => normalizePath(dir) === normalizePath(installDir));
+            if (!binInPath) {
+                console.log('');
+                console.log('⚠️  WARNING: ~/.local/bin is not in your PATH');
+                console.log('');
+                console.log('To use ccodex, add ~/.local/bin to your PATH:');
+                console.log('');
+                console.log('  For bash (add to ~/.bashrc):');
+                console.log('    export PATH="$HOME/.local/bin:$PATH"');
+                console.log('');
+                console.log('  For zsh (add to ~/.zshrc):');
+                console.log('    export PATH="$HOME/.local/bin:$PATH"');
+                console.log('');
+                console.log('Then reload your shell: source ~/.bashrc (or ~/.zshrc)');
+            }
         }
-        console.log(`CLIProxyAPI installed successfully to: ${binaryPath}`);
-        // Check if install dir is in PATH
-        const pathEnv = process.env.PATH || '';
-        const pathDirs = pathEnv.split(':');
-        const binInPath = pathDirs.some(dir => dir === installDir);
-        if (!binInPath) {
-            console.log('');
-            console.log('⚠️  WARNING: ~/.local/bin is not in your PATH');
-            console.log('');
-            console.log('To use ccodex, add ~/.local/bin to your PATH:');
-            console.log('');
-            console.log('  For bash (add to ~/.bashrc):');
-            console.log('    export PATH="$HOME/.local/bin:$PATH"');
-            console.log('');
-            console.log('  For zsh (add to ~/.zshrc):');
-            console.log('    export PATH="$HOME/.local/bin:$PATH"');
-            console.log('');
-            console.log('Then reload your shell: source ~/.bashrc (or ~/.zshrc)');
+        catch (error) {
+            // Clean up archive and extract dir on error
+            await fs.unlink(archivePath).catch((err) => {
+                debugLog('Warning: Failed to cleanup archive file during error handling:', err);
+            });
+            await fs.rm(extractDir, { recursive: true, force: true }).catch((err) => {
+                debugLog('Warning: Failed to cleanup extract directory during error handling:', err);
+            });
+            throw new Error(`Failed to install CLIProxyAPI: ${error instanceof Error ? error.message : String(error)}\n\n` +
+                'Please install CLIProxyAPI manually:\n' +
+                '  1. Visit https://github.com/router-for-me/CLIProxyAPI/releases\n' +
+                `  2. Download ${archiveFileName} for your system\n` +
+                '  3. Extract the archive\n' +
+                '  4. Place the binary in a directory in your PATH\n' +
+                '  5. Make it executable: chmod +x cliproxyapi');
         }
-    }
-    catch (error) {
-        // Clean up temp file on error
-        fs.unlink(tempPath).catch(() => { });
-        throw new Error(`Failed to install CLIProxyAPI: ${error instanceof Error ? error.message : String(error)}\n\n` +
-            'Please install CLIProxyAPI manually:\n' +
-            '  1. Visit https://github.com/router-for-me/CLIProxyAPI/releases\n' +
-            `  2. Download ${binaryFileName} for your system\n` +
-            '  3. Place it in a directory in your PATH\n' +
-            '  4. Make it executable: chmod +x cliproxyapi');
-    }
+    });
 }
 /**
  * Start proxy in background
@@ -409,15 +818,10 @@ export async function startProxy() {
     if (await isProxyRunning()) {
         return;
     }
-    const cmdResult = await detectProxyCommand();
-    // Use absolute path if available, otherwise command name
-    const proxyExe = cmdResult.path || cmdResult.cmd;
-    if (!proxyExe) {
-        throw new Error('CLIProxyAPI not found. Run: npx -y @tuannvm/ccodex');
-    }
+    const proxyExe = await requireTrustedProxyCommand();
     console.log('Starting CLIProxyAPI in background...');
     const logFile = getLogFilePath();
-    await ensureDir(join(logFile, '..'));
+    await ensureDir(dirname(logFile));
     const { spawn } = await import('child_process');
     const fs = await import('fs/promises');
     let out = null;
@@ -466,12 +870,7 @@ export async function startProxy() {
  * Launch OAuth login
  */
 export async function launchLogin() {
-    const cmdResult = await detectProxyCommand();
-    // Use absolute path if available, otherwise command name
-    const proxyExe = cmdResult.path || cmdResult.cmd;
-    if (!proxyExe) {
-        throw new Error('CLIProxyAPI not found. Run: npx -y @tuannvm/ccodex');
-    }
+    const proxyExe = await requireTrustedProxyCommand();
     console.log('Launching ChatGPT/Codex OAuth login in browser...');
     const spawnCmd = (await import('cross-spawn')).default;
     return new Promise((resolve, reject) => {