@tuannvm/ccodex 0.3.0 → 0.3.2

package/dist/proxy.js

@@ -1,9 +1,9 @@
-import { join, delimiter, normalize, sep, resolve, dirname, isAbsolute } from 'path';
-import { homedir } from 'os';
-import { createHash, randomUUID } from 'crypto';
-import chalk from 'chalk';
-import { hasCommand, getCommandPath, execCommand, httpGet, sleep, ensureDir, fileExists, safeJsonParse, debugLog, runCmdBounded, requireTrustedCommand, withInstallLock } from './utils.js';
-import { CONFIG, getProxyUrl, getAuthDir, getLogFilePath } from './config.js';
+import { join, delimiter, normalize, sep, resolve, dirname, isAbsolute } from "path";
+import { homedir } from "os";
+import { createHash, randomUUID } from "crypto";
+import chalk from "chalk";
+import { hasCommand, getCommandPath, execCommand, httpGet, sleep, ensureDir, fileExists, safeJsonParse, debugLog, runCmdBounded, requireTrustedCommand, withInstallLock, } from "./utils.js";
+import { CONFIG, getProxyUrl, getAuthDir, getLogFilePath } from "./config.js";
 // Track installed proxy binary path for this process
 let installedProxyPath = null;
 /**
@@ -13,15 +13,15 @@ let installedProxyPath = null;
 function getAllowedInstallDirs() {
     const home = homedir();
     const allowed = [
-        join(home, '.local', 'bin'), // User local bin
-        '/usr/local/bin', // System local bin
-        '/opt/homebrew/bin', // Homebrew Apple Silicon
-        '/usr/local/bin', // Homebrew Intel
-        join(home, 'go', 'bin'), // Go user bin
+        join(home, ".local", "bin"), // User local bin
+        "/usr/local/bin", // System local bin
+        "/opt/homebrew/bin", // Homebrew Apple Silicon
+        "/usr/local/bin", // Homebrew Intel
+        join(home, "go", "bin"), // Go user bin
     ];
     // Add common Windows paths if on Windows
-    if (process.platform === 'win32') {
-        allowed.push(join(process.env.LOCALAPPDATA || '', 'Programs'), join(process.env.APPDATA || '', 'Programs'));
+    if (process.platform === "win32") {
+        allowed.push(join(process.env.LOCALAPPDATA || "", "Programs"), join(process.env.APPDATA || "", "Programs"));
     }
     return allowed;
 }
@@ -34,18 +34,18 @@ async function validateProxyPath(proxyPath) {
     if (!isAbsolute(proxyPath)) {
         throw new Error(`Proxy binary path is not absolute: ${proxyPath}`);
     }
-    const fs = await import('fs/promises');
+    const fs = await import("fs/promises");
     // Use realpath to resolve symlinks and get the actual file location
     const realPath = await fs.realpath(proxyPath);
     const allowedDirs = getAllowedInstallDirs();
-    const isAllowed = allowedDirs.some(allowedDir => {
+    const isAllowed = allowedDirs.some((allowedDir) => {
         const resolvedAllowed = resolve(allowedDir);
         return realPath.startsWith(resolvedAllowed + sep) || realPath === resolvedAllowed;
     });
     if (!isAllowed) {
         throw new Error(`Proxy binary not from trusted location.\n` +
             `Path: ${realPath}\n` +
-            `Allowed directories: ${allowedDirs.join(', ')}\n\n` +
+            `Allowed directories: ${allowedDirs.join(", ")}\n\n` +
             `For security, only proxy binaries from trusted locations are executed.\n` +
             `If you installed CLIProxyAPI manually, move it to ~/.local/bin or install via Homebrew.`);
     }
@@ -63,9 +63,9 @@ export async function requireTrustedProxyCommand() {
     }
     // Use detected path
     if (!cmdResult.path) {
-        throw new Error('CLIProxyAPI not found. Install it first:\n' +
-            '  1. Run: npx -y @tuannvm/ccodex\n' +
-            '  2. Or install manually: brew install cli-proxy-api');
+        throw new Error("CLIProxyAPI not found. Install it first:\n" +
+            "  1. Run: npx -y @tuannvm/ccodex\n" +
+            "  2. Or install manually: brew install cli-proxy-api");
     }
     await validateProxyPath(cmdResult.path);
     return cmdResult.path;
@@ -78,10 +78,14 @@ export async function requireTrustedProxyCommand() {
 export async function detectProxyCommand() {
     // Prefer locally installed binary from this process
     if (installedProxyPath && fileExists(installedProxyPath)) {
-        return { cmd: 'cli-proxy-api', path: installedProxyPath };
+        return { cmd: "cli-proxy-api", path: installedProxyPath };
     }
     // Try new name first, then legacy names
-    const commandNames = ['cli-proxy-api', 'CLIProxyAPI', 'cliproxy'];
+    const commandNames = [
+        "cli-proxy-api",
+        "CLIProxyAPI",
+        "cliproxy",
+    ];
     for (const name of commandNames) {
         if (await hasCommand(name)) {
             const resolved = await getCommandPath(name);
@@ -109,21 +113,21 @@ export async function isProxyRunning() {
 export async function checkAuthConfigured() {
     const authDir = getAuthDir();
     // Check for auth files
-    const fs = await import('fs/promises');
+    const fs = await import("fs/promises");
     let hasAuthFiles = false;
     try {
         const files = await fs.readdir(authDir);
-        hasAuthFiles = files.some(f => f.startsWith('codex-') && f.endsWith('.json'));
+        hasAuthFiles = files.some((f) => f.startsWith("codex-") && f.endsWith(".json"));
     }
     catch {
         // Directory doesn't exist
-        debugLog('Auth directory does not exist:', authDir);
+        debugLog("Auth directory does not exist:", authDir);
     }
     // Check auth via proxy status
     let hasAuthEntries = false;
     try {
         const proxyExe = await requireTrustedProxyCommand();
-        const output = await execCommand(proxyExe, ['status']);
+        const output = await execCommand(proxyExe, ["status"]);
         // Match "N auth entries" or "N auth files" where N > 0
         const match = output.match(/(\d+)\s+(auth entries|auth files)/);
         if (match) {
@@ -132,7 +136,7 @@ export async function checkAuthConfigured() {
         }
     }
     catch (error) {
-        debugLog('Failed to check proxy status:', error);
+        debugLog("Failed to check proxy status:", error);
     }
     // Check via API
     let hasModels = false;
@@ -141,12 +145,12 @@ export async function checkAuthConfigured() {
         const response = await httpGet(`${proxyUrl}/v1/models`);
         if (response.status === 200) {
             const data = safeJsonParse(response.body);
-            hasModels = data?.object === 'list' && Array.isArray(data.data) && data.data.length > 0;
+            hasModels = data?.object === "list" && Array.isArray(data.data) && data.data.length > 0;
         }
     }
     catch {
         // Proxy not running or not authenticated
-        debugLog('Failed to check models via API');
+        debugLog("Failed to check models via API");
     }
     return {
         hasAuthFiles,
@@ -157,12 +161,6 @@ export async function checkAuthConfigured() {
         configured: hasModels || (hasAuthEntries && hasAuthFiles),
     };
 }
-/**
- * Compute SHA-256 hash of binary data
- */
-function sha256Hex(data) {
-    return createHash('sha256').update(data).digest('hex');
-}
 /**
  * Parse checksum file to find expected hash for a specific file
  * Supports common checksum formats:
@@ -173,7 +171,7 @@ function sha256Hex(data) {
  */
 function parseExpectedSha256(content, fileName) {
     // First pass: try exact filename match (with or without path separators)
-    for (const line of content.split('\n')) {
+    for (const line of content.split("\n")) {
         const trimmed = line.trim();
         if (!trimmed)
             continue;
@@ -183,7 +181,7 @@ function parseExpectedSha256(content, fileName) {
             const [, hash, name] = match;
             const normalizedName = name.trim();
             // Normalize path separators to / and strip any path prefix
-            const normalizedBase = normalizedName.replace(/\\/g, '/').replace(/^.*\//, '');
+            const normalizedBase = normalizedName.replace(/\\/g, "/").replace(/^.*\//, "");
             if (normalizedBase === fileName) {
                 // Found exact basename match
                 return hash.toLowerCase();
@@ -197,12 +195,12 @@ function parseExpectedSha256(content, fileName) {
  * Returns the exact tag name to avoid moving 'latest' redirects
  */
 async function getLatestReleaseTag() {
-    const apiUrl = 'https://api.github.com/repos/router-for-me/CLIProxyAPI/releases/latest';
+    const apiUrl = "https://api.github.com/repos/router-for-me/CLIProxyAPI/releases/latest";
     try {
         const response = await fetch(apiUrl, {
             headers: {
-                'Accept': 'application/vnd.github.v3+json',
-                'User-Agent': '@tuannvm/ccodex',
+                Accept: "application/vnd.github.v3+json",
+                "User-Agent": "@tuannvm/ccodex",
             },
             signal: AbortSignal.timeout(10000), // 10 second timeout
         });
@@ -211,14 +209,14 @@ async function getLatestReleaseTag() {
         }
         const data = await safeJsonParse(await response.text());
         if (!data?.tag_name) {
-            throw new Error('Invalid GitHub API response');
+            throw new Error("Invalid GitHub API response");
         }
         return data.tag_name;
     }
     catch (error) {
-        debugLog('Failed to fetch latest release tag:', error);
+        debugLog("Failed to fetch latest release tag:", error);
         throw new Error(`Failed to resolve latest release tag from GitHub API: ${error instanceof Error ? error.message : String(error)}\n\n` +
-            'Please check your internet connection or install CLIProxyAPI manually.');
+            "Please check your internet connection or install CLIProxyAPI manually.");
     }
 }
 /**
@@ -228,15 +226,15 @@ function isUnsafeArchivePath(raw) {
     if (!raw)
         return true;
     // Normalize zip/tar separators and strip leading "./"
-    const p = raw.replace(/\\/g, '/').replace(/^\.\/+/, '');
+    const p = raw.replace(/\\/g, "/").replace(/^\.\/+/, "");
     if (!p)
         return true;
     // Reject absolute, drive-letter, UNC-like
-    if (p.startsWith('/') || /^[a-zA-Z]:\//.test(p) || p.startsWith('//'))
+    if (p.startsWith("/") || /^[a-zA-Z]:\//.test(p) || p.startsWith("//"))
         return true;
     // Reject traversal segments
-    const parts = p.split('/').filter(Boolean);
-    if (parts.some(seg => seg === '..'))
+    const parts = p.split("/").filter(Boolean);
+    if (parts.some((seg) => seg === ".."))
         return true;
     return false;
 }
@@ -264,13 +262,13 @@ function parseTarVerboseLine(line) {
         return null;
     const firstChar = line.charAt(0);
     const fileTypeMap = {
-        '-': 'file',
-        'd': 'dir',
-        'l': 'symlink',
-        'h': 'hardlink',
-        'c': 'char',
-        'b': 'block',
-        'p': 'fifo',
+        "-": "file",
+        d: "dir",
+        l: "symlink",
+        h: "hardlink",
+        c: "char",
+        b: "block",
+        p: "fifo",
     };
     const type = fileTypeMap[firstChar];
     if (!type) {
@@ -283,13 +281,13 @@ function parseTarVerboseLine(line) {
     const parts = line.split(/\s+/);
     // For very long lines with many fields, the path might be split further
     // Find the part that looks like a path (contains '/', or ends with ' -> ', or is just a name)
-    let pathWithTarget = '';
+    let pathWithTarget = "";
     let foundPath = false;
     // Iterate from the end to find the path
     for (let i = parts.length - 1; i >= 0; i--) {
         const part = parts[i];
-        if (part.includes('/') || part.includes(' -> ') || (part.length > 0 && !foundPath)) {
-            pathWithTarget = part + (pathWithTarget ? ' ' + pathWithTarget : '');
+        if (part.includes("/") || part.includes(" -> ") || (part.length > 0 && !foundPath)) {
+            pathWithTarget = part + (pathWithTarget ? " " + pathWithTarget : "");
             foundPath = true;
         }
         else if (foundPath) {
@@ -300,7 +298,7 @@ function parseTarVerboseLine(line) {
     if (!pathWithTarget)
         return null;
     // Extract just the path (before " -> " for symlinks)
-    const arrowIndex = pathWithTarget.indexOf(' -> ');
+    const arrowIndex = pathWithTarget.indexOf(" -> ");
     const path = arrowIndex >= 0 ? pathWithTarget.substring(0, arrowIndex).trim() : pathWithTarget.trim();
     if (!path)
         return null;
@@ -310,22 +308,25 @@ function parseTarVerboseLine(line) {
  * List entries in a tar archive with resource limits and link type validation
  */
 async function listTarEntries(archivePath) {
-    const fs = await import('fs/promises');
+    const fs = await import("fs/promises");
     // Check archive file size before extraction
     const archiveStat = await fs.stat(archivePath);
     if (archiveStat.size > MAX_ARCHIVE_BYTES) {
         throw new Error(`Archive file is too large (${(archiveStat.size / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
-            'This may be a tar bomb.');
+            "This may be a tar bomb.");
     }
     // Use verbose mode with -z to explicitly handle gzip compression
     // Some tar versions auto-detect compression, but -z ensures consistency
     // Use trusted tar path to avoid PATH hijacking
-    const tarPath = await requireTrustedCommand('tar');
-    const result = await runCmdBounded(tarPath, ['-ztvf', archivePath], 30000); // 30 second timeout
+    const tarPath = await requireTrustedCommand("tar");
+    const result = await runCmdBounded(tarPath, ["-ztvf", archivePath], 30000); // 30 second timeout
     if (result.code !== 0) {
         throw new Error(`tar list failed with code ${result.code}`);
     }
-    const lines = result.stdout.split('\n').map(s => s.trim()).filter(Boolean);
+    const lines = result.stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean);
     const entries = [];
     // Resource limits: prevent tar/zip bombs
     if (lines.length > MAX_ENTRIES) {
@@ -343,20 +344,38 @@ async function listTarEntries(archivePath) {
             throw new Error(`Unsafe archive path: ${parsed.path}`);
         }
         // Reject symlinks and hardlinks for security
-        if (parsed.type === 'symlink' || parsed.type === 'hardlink') {
+        if (parsed.type === "symlink" || parsed.type === "hardlink") {
             throw new Error(`Archive contains forbidden link entry: ${parsed.path} (${parsed.type})`);
         }
         // Reject character/block devices, fifos (unusual in CLIProxyAPI archives)
-        if (parsed.type === 'char' || parsed.type === 'block' || parsed.type === 'fifo') {
+        if (parsed.type === "char" || parsed.type === "block" || parsed.type === "fifo") {
             throw new Error(`Archive contains unusual entry type: ${parsed.path} (${parsed.type})`);
         }
         entries.push(parsed.path);
     }
     if (entries.length === 0) {
-        throw new Error('Archive is empty or contains no valid entries');
+        throw new Error("Archive is empty or contains no valid entries");
     }
     return entries;
 }
+/**
+ * Compute directory size recursively
+ */
+async function getDirSize(dir, fs) {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    let size = 0;
+    for (const ent of entries) {
+        const full = join(dir, ent.name);
+        const stat = await fs.stat(full);
+        if (ent.isDirectory()) {
+            size += await getDirSize(full, fs);
+        }
+        else {
+            size += stat.size;
+        }
+    }
+    return size;
+}
 /**
  * Validate archive listing for unsafe paths and link types
  * Note: Windows installation is not currently supported (throws early in installProxyApi)
@@ -371,7 +390,7 @@ async function validateArchiveListing(archivePath) {
  * Symlinks and hardlinks are already rejected during tar parsing
  */
 async function assertRealpathConfinement(rootDir) {
-    const fs = await import('fs/promises');
+    const fs = await import("fs/promises");
     const rootReal = await fs.realpath(rootDir);
     const stack = [rootDir];
     while (stack.length > 0) {
@@ -400,82 +419,86 @@ async function assertRealpathConfinement(rootDir) {
  * Install CLIProxyAPI via Homebrew or Go binary fallback
  */
 export async function installProxyApi() {
-    const { homedir } = await import('os');
+    const { homedir } = await import("os");
     const home = homedir();
     if (!home) {
-        throw new Error('Cannot determine home directory. Please set HOME environment variable.');
+        throw new Error("Cannot determine home directory. Please set HOME environment variable.");
     }
     // Install lock file path (in the target install directory)
-    const lockPath = join(home, '.local', 'bin', '.cli-proxy-api.install.lock');
+    const lockPath = join(home, ".local", "bin", ".cli-proxy-api.install.lock");
     // Check platform
     const platform = process.platform;
     const arch = process.arch;
-    if (platform === 'win32') {
-        throw new Error('CLIProxyAPI installation on Windows requires manual setup.\n' +
-            'Please install CLIProxyAPI manually and ensure it\'s in your PATH.\n' +
-            'See CLIProxyAPI documentation for Windows installation instructions.');
+    if (platform === "win32") {
+        throw new Error("CLIProxyAPI installation on Windows requires manual setup.\n" +
+            "Please install CLIProxyAPI manually and ensure it's in your PATH.\n" +
+            "See CLIProxyAPI documentation for Windows installation instructions.");
     }
     // Ensure lock directory exists before acquiring lock
-    const installDir = join(home, '.local', 'bin');
+    const installDir = join(home, ".local", "bin");
     await ensureDir(installDir);
     // Wrap entire installation process (both Homebrew and Go binary paths) in lock
     await withInstallLock(lockPath, async () => {
         // Try Homebrew first (preferred)
-        if (await hasCommand('brew')) {
-            console.log('Installing CLIProxyAPI via Homebrew...');
-            const brewPath = await requireTrustedCommand('brew');
-            const spawnCmd = (await import('cross-spawn')).default;
+        if (await hasCommand("brew")) {
+            console.log("Installing CLIProxyAPI via Homebrew...");
+            const brewPath = await requireTrustedCommand("brew");
+            const spawnCmd = (await import("cross-spawn")).default;
             try {
                 await new Promise((resolve, reject) => {
-                    const child = spawnCmd(brewPath, ['install', 'cli-proxy-api'], {
-                        stdio: 'inherit',
+                    const child = spawnCmd(brewPath, ["install", "cli-proxy-api"], {
+                        stdio: "inherit",
                     });
-                    child.on('close', (code) => {
+                    child.on("close", (code) => {
                         if (code === 0) {
-                            console.log('CLIProxyAPI installed successfully via Homebrew');
+                            console.log("CLIProxyAPI installed successfully via Homebrew");
                             resolve();
                         }
                         else {
-                            reject(new Error('Failed to install CLIProxyAPI via Homebrew'));
+                            reject(new Error("Failed to install CLIProxyAPI via Homebrew"));
                         }
                     });
-                    child.on('error', (error) => reject(error));
+                    child.on("error", (error) => reject(error));
                 });
                 return;
             }
             catch (error) {
-                debugLog('Homebrew installation failed, falling back to Go binary:', error);
+                debugLog("Homebrew installation failed, falling back to Go binary:", error);
                 // Fall through to Go binary installation
             }
         }
         // Fallback: Install Go binary directly
-        console.log('Installing CLIProxyAPI via Go binary...');
+        console.log("Installing CLIProxyAPI via Go binary...");
         // Determine platform/arch for CLIProxyAPI release asset format
         // CLIProxyAPI uses: CLIProxyAPI_{version}_{platform}_{arch}.{ext}
-        const platformMap = { darwin: 'darwin', linux: 'linux', win32: 'windows' };
-        const archMap = { arm64: 'arm64', x64: 'amd64' };
+        const platformMap = {
+            darwin: "darwin",
+            linux: "linux",
+            win32: "windows",
+        };
+        const archMap = { arm64: "arm64", x64: "amd64" };
         const cliPlatform = platformMap[platform];
         const cliArch = archMap[arch];
         if (!cliPlatform) {
             throw new Error(`Unsupported platform: ${platform}\n` +
-                `Supported platforms: ${Object.keys(platformMap).join(', ')}`);
+                `Supported platforms: ${Object.keys(platformMap).join(", ")}`);
         }
         if (!cliArch) {
             throw new Error(`Unsupported architecture: ${arch}\n` +
-                `Supported architectures: ${Object.keys(archMap).join(', ')}`);
+                `Supported architectures: ${Object.keys(archMap).join(", ")}`);
         }
         // Resolve exact release tag first for security (avoid moving 'latest' redirects)
-        console.log('Resolving latest release tag from GitHub API...');
+        console.log("Resolving latest release tag from GitHub API...");
         const releaseTag = await getLatestReleaseTag();
         console.log(`Latest release: ${releaseTag}`);
         // Strip 'v' prefix from tag for version (e.g., v6.9.5 -> 6.9.5)
-        const version = releaseTag.startsWith('v') ? releaseTag.slice(1) : releaseTag;
+        const version = releaseTag.startsWith("v") ? releaseTag.slice(1) : releaseTag;
         // Determine archive extension
-        const isWindows = platform === 'win32';
-        const archiveExt = isWindows ? 'zip' : 'tar.gz';
+        const isWindows = platform === "win32";
+        const archiveExt = isWindows ? "zip" : "tar.gz";
         const archiveFileName = `CLIProxyAPI_${version}_${cliPlatform}_${cliArch}.${archiveExt}`;
         // installDir is already defined and ensured at function start
-        const binaryName = isWindows ? 'cli-proxy-api.exe' : 'cli-proxy-api';
+        const binaryName = isWindows ? "cli-proxy-api.exe" : "cli-proxy-api";
         const binaryPath = join(installDir, binaryName);
         // Use crypto.randomUUID() for temp files to avoid collision in concurrent installs
         const randomSuffix = randomUUID();
@@ -484,7 +507,7 @@ export async function installProxyApi() {
         const baseUrl = `https://github.com/router-for-me/CLIProxyAPI/releases/download/${releaseTag}`;
         const archiveUrl = `${baseUrl}/${archiveFileName}`;
         console.log(`Downloading ${archiveFileName} from GitHub releases...`);
-        const fs = await import('fs/promises');
+        const fs = await import("fs/promises");
         try {
             // Download archive with streaming and byte limits
             console.log(`Downloading ${archiveFileName} from GitHub releases...`);
@@ -516,24 +539,24 @@ export async function installProxyApi() {
                     `Platform/Arch: ${cliPlatform}_${cliArch}`);
             }
             // Pre-check content-length if available
-            const contentLength = Number(response.headers.get('content-length') || 0);
+            const contentLength = Number(response.headers.get("content-length") || 0);
             if (contentLength > MAX_ARCHIVE_BYTES) {
                 throw new Error(`Archive too large (Content-Length: ${(contentLength / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
-                    'This may be a tar bomb.');
+                    "This may be a tar bomb.");
             }
             // Stream download with byte limit and incremental hash
             if (!response.body) {
-                throw new Error('Response body is null');
+                throw new Error("Response body is null");
             }
-            const fileHandle = await fs.open(archivePath, 'w');
-            const hash = createHash('sha256');
+            const fileHandle = await fs.open(archivePath, "w");
+            const hash = createHash("sha256");
             let downloadedBytes = 0;
             try {
                 for await (const chunk of response.body) {
                     downloadedBytes += chunk.byteLength;
                     if (downloadedBytes > MAX_ARCHIVE_BYTES) {
                         throw new Error(`Archive exceeded size limit during download (${(downloadedBytes / 1024 / 1024).toFixed(1)} MB > ${MAX_ARCHIVE_BYTES / 1024 / 1024} MB). ` +
-                            'This may be a tar bomb.');
+                            "This may be a tar bomb.");
                     }
                     hash.update(chunk);
                     await fileHandle.write(chunk);
@@ -544,7 +567,7 @@ export async function installProxyApi() {
             }
             console.log(`Downloaded ${(downloadedBytes / 1024 / 1024).toFixed(1)} MB`);
             // Get the calculated hash
-            const actualHash = hash.digest('hex');
+            const actualHash = hash.digest("hex");
             // Try to download and verify checksums file
             let checksumVerified = false;
             let checksumMismatchError = null;
@@ -562,7 +585,7 @@ export async function installProxyApi() {
                         const expectedHash = parseExpectedSha256(checksumContent, archiveFileName);
                         if (expectedHash) {
                             if (actualHash === expectedHash) {
-                                console.log(chalk.green('✓ Checksum verification passed'));
+                                console.log(chalk.green("✓ Checksum verification passed"));
                                 checksumVerified = true;
                                 break;
                             }
@@ -582,7 +605,7 @@ export async function installProxyApi() {
                 catch (checksumError) {
                     // Only catch network/parsing errors - let checksum mismatches fail hard
                     const errorMsg = checksumError instanceof Error ? checksumError.message : String(checksumError);
-                    if (errorMsg.includes('Checksum verification failed')) {
+                    if (errorMsg.includes("Checksum verification failed")) {
                         // Re-throw checksum mismatch errors
                         throw checksumError;
                     }
@@ -598,41 +621,36 @@ export async function installProxyApi() {
             // This prevents installation of potentially tampered binaries
             if (!checksumVerified) {
                 await fs.unlink(archivePath).catch(() => { });
-                throw new Error(chalk.red('Checksum verification required but failed.\n\n') +
-                    'The downloaded archive could not be verified against a checksum file.\n' +
-                    'This is a security requirement to prevent installation of tampered binaries.\n\n' +
-                    'Possible reasons:\n' +
-                    '  - Network issues prevented checksum file download\n' +
-                    '  - Checksum files are not published for this release\n' +
-                    '  - GitHub releases are temporarily unavailable\n\n' +
-                    'To install CLIProxyAPI safely:\n' +
+                throw new Error(chalk.red("Checksum verification required but failed.\n\n") +
+                    "The downloaded archive could not be verified against a checksum file.\n" +
+                    "This is a security requirement to prevent installation of tampered binaries.\n\n" +
+                    "Possible reasons:\n" +
+                    "  - Network issues prevented checksum file download\n" +
+                    "  - Checksum files are not published for this release\n" +
+                    "  - GitHub releases are temporarily unavailable\n\n" +
+                    "To install CLIProxyAPI safely:\n" +
                     `  1. Visit ${baseUrl}/\n` +
-                    '  2. Download the archive and checksum files manually\n' +
-                    '  3. Verify the checksums match\n' +
-                    '  4. Extract the archive\n' +
-                    '  5. Place the binary in a directory in your PATH\n' +
-                    '  6. Make it executable: chmod +x cli-proxy-api\n\n' +
-                    'Then run ccodex again.');
+                    "  2. Download the archive and checksum files manually\n" +
+                    "  3. Verify the checksums match\n" +
+                    "  4. Extract the archive\n" +
+                    "  5. Place the binary in a directory in your PATH\n" +
+                    "  6. Make it executable: chmod +x cli-proxy-api\n\n" +
+                    "Then run ccodex again.");
             }
             // Archive was already written to disk during streaming download
             // Extract archive using hardened extraction strategy
             console.log(`Extracting ${archiveExt} archive...`);
             await ensureDir(extractDir);
             // Preflight: validate archive listing before extraction
-            console.log('Validating archive contents...');
+            console.log("Validating archive contents...");
             await validateArchiveListing(archivePath);
             try {
                 // Unix/macOS: use tar with portable hardened flags
                 // Note: --no-same-owner and --no-same-permissions are supported by both GNU and BSD tar
                 // We avoid GNU-specific flags like --delay-directory-restore for macOS compatibility
                 // Use bounded execution with timeout (60 seconds for extraction) and trusted tar path
-                const tarPath = await requireTrustedCommand('tar');
-                const result = await runCmdBounded(tarPath, [
-                    '-xzf', archivePath,
-                    '-C', extractDir,
-                    '--no-same-owner',
-                    '--no-same-permissions',
-                ], 60000);
+                const tarPath = await requireTrustedCommand("tar");
+                const result = await runCmdBounded(tarPath, ["-xzf", archivePath, "-C", extractDir, "--no-same-owner", "--no-same-permissions"], 60000);
                 if (result.code !== 0) {
                     throw new Error(`tar extraction failed with code ${result.code}`);
                 }
@@ -642,31 +660,16 @@ export async function installProxyApi() {
                 await fs.unlink(archivePath).catch(() => { });
                 await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
                 throw new Error(`Failed to extract archive: ${extractError instanceof Error ? extractError.message : String(extractError)}\n\n` +
-                    'The archive may be corrupted or incompatible with your system.');
+                    "The archive may be corrupted or incompatible with your system.");
             }
             // Post-extraction: validate extracted size (prevent zip bomb)
-            console.log('Validating extracted size...');
+            console.log("Validating extracted size...");
             let extractedBytes = 0;
-            async function getDirSize(dir) {
-                const entries = await fs.readdir(dir, { withFileTypes: true });
-                let size = 0;
-                for (const ent of entries) {
-                    const full = join(dir, ent.name);
-                    const stat = await fs.stat(full);
-                    if (ent.isDirectory()) {
-                        size += await getDirSize(full);
-                    }
-                    else {
-                        size += stat.size;
-                    }
-                }
-                return size;
-            }
             try {
-                extractedBytes = await getDirSize(extractDir);
+                extractedBytes = await getDirSize(extractDir, fs);
                 if (extractedBytes > MAX_EXTRACTED_BYTES) {
                     throw new Error(`Extracted content is too large (${(extractedBytes / 1024 / 1024).toFixed(1)} MB > ${MAX_EXTRACTED_BYTES / 1024 / 1024} MB). ` +
-                        'This may be a zip bomb.');
+                        "This may be a zip bomb.");
                 }
             }
             catch (sizeError) {
@@ -677,7 +680,7 @@ export async function installProxyApi() {
             }
             // Post-extraction: validate realpath confinement
             // This detects path traversal via symlinks, hardlinks, or other escape mechanisms
-            console.log('Validating extraction safety...');
+            console.log("Validating extraction safety...");
             try {
                 await assertRealpathConfinement(extractDir);
             }
@@ -692,16 +695,16 @@ export async function installProxyApi() {
             // On Windows it may have .exe extension
             const extractedFiles = await fs.readdir(extractDir);
             const binaryNames = isWindows
-                ? ['cli-proxy-api.exe', 'CLIProxyAPI.exe']
-                : ['cli-proxy-api', 'CLIProxyAPI'];
-            const extractedBinary = extractedFiles.find(f => binaryNames.includes(f));
+                ? ["cli-proxy-api.exe", "CLIProxyAPI.exe"]
+                : ["cli-proxy-api", "CLIProxyAPI"];
+            const extractedBinary = extractedFiles.find((f) => binaryNames.includes(f));
             if (!extractedBinary) {
                 // Clean up
                 await fs.unlink(archivePath).catch(() => { });
                 await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
                 throw new Error(`Could not find CLIProxyAPI binary in extracted archive.\n` +
-                    `Files found: ${extractedFiles.join(', ')}\n\n` +
-                    'The archive format may have changed. Please report this issue.');
+                    `Files found: ${extractedFiles.join(", ")}\n\n` +
+                    "The archive format may have changed. Please report this issue.");
             }
             const extractedBinaryPath = join(extractDir, extractedBinary);
             // Set executable permission on extracted binary before validation (Unix/macOS only)
@@ -710,14 +713,14 @@ export async function installProxyApi() {
                     await fs.chmod(extractedBinaryPath, 0o755);
                 }
                 catch (chmodError) {
-                    debugLog('Warning: Could not set executable permission on extracted binary:', chmodError);
+                    debugLog("Warning: Could not set executable permission on extracted binary:", chmodError);
                     // Continue anyway - the archive may already have execute bits set
                 }
             }
             // Validate the extracted binary works by running it
-            console.log('Validating extracted binary...');
+            console.log("Validating extracted binary...");
             try {
-                const testResult = await runCmdBounded(extractedBinaryPath, ['--version'], 5000);
+                const testResult = await runCmdBounded(extractedBinaryPath, ["--version"], 5000);
                 // Fail on non-zero exit
                 if (testResult.code !== 0) {
                     throw new Error(`Binary validation failed: exited with code ${testResult.code}`);
@@ -728,7 +731,7 @@ export async function installProxyApi() {
                 await fs.unlink(archivePath).catch(() => { });
                 await fs.rm(extractDir, { recursive: true, force: true }).catch(() => { });
                 throw new Error(`Extracted binary failed validation: ${validationError instanceof Error ? validationError.message : String(validationError)}\n\n` +
-                    'The binary may be corrupted or incompatible with your system.');
+                    "The binary may be corrupted or incompatible with your system.");
             }
             // Backup existing binary if present, but be ready to rollback
             let backupPath = null;
@@ -755,7 +758,7 @@ export async function installProxyApi() {
                         await fs.rename(backupPath, binaryPath);
                     }
                     catch (rollbackError) {
-                        debugLog('Failed to rollback after copy failure:', rollbackError);
+                        debugLog("Failed to rollback after copy failure:", rollbackError);
                     }
                 }
                 // Clean up
@@ -765,59 +768,59 @@ export async function installProxyApi() {
             }
             // Clean up on success
             await fs.unlink(archivePath).catch((err) => {
-                debugLog('Warning: Failed to cleanup archive file:', err);
+                debugLog("Warning: Failed to cleanup archive file:", err);
             });
             await fs.rm(extractDir, { recursive: true, force: true }).catch((err) => {
-                debugLog('Warning: Failed to cleanup extract directory:', err);
+                debugLog("Warning: Failed to cleanup extract directory:", err);
             });
             // Clean up backup on success
             if (backupPath) {
                 await fs.unlink(backupPath).catch((err) => {
-                    debugLog('Warning: Failed to cleanup backup file:', err);
+                    debugLog("Warning: Failed to cleanup backup file:", err);
                 });
             }
             console.log(`CLIProxyAPI installed successfully to: ${binaryPath}`);
             // Check if install dir is in PATH (use platform-specific delimiter and case-insensitive on Windows)
-            const pathEnv = process.env.PATH || '';
+            const pathEnv = process.env.PATH || "";
             // Filter empty segments to avoid false positives from '::' in PATH
-            const pathDirs = pathEnv.split(delimiter).filter(p => p.length > 0);
+            const pathDirs = pathEnv.split(delimiter).filter((p) => p.length > 0);
             // Normalize paths for comparison: resolve to absolute paths, normalize separators, case-insensitive on Windows
             const normalizePath = (p) => {
                 const resolved = resolve(p);
                 const normalized = normalize(resolved);
                 return isWindows ? normalized.toLowerCase() : normalized;
             };
-            const binInPath = pathDirs.some(dir => normalizePath(dir) === normalizePath(installDir));
+            const binInPath = pathDirs.some((dir) => normalizePath(dir) === normalizePath(installDir));
             if (!binInPath) {
-                console.log('');
-                console.log('⚠️  WARNING: ~/.local/bin is not in your PATH');
-                console.log('');
-                console.log('To use ccodex, add ~/.local/bin to your PATH:');
-                console.log('');
-                console.log('  For bash (add to ~/.bashrc):');
+                console.log("");
+                console.log("⚠️  WARNING: ~/.local/bin is not in your PATH");
+                console.log("");
+                console.log("To use ccodex, add ~/.local/bin to your PATH:");
+                console.log("");
+                console.log("  For bash (add to ~/.bashrc):");
                 console.log('    export PATH="$HOME/.local/bin:$PATH"');
-                console.log('');
-                console.log('  For zsh (add to ~/.zshrc):');
+                console.log("");
+                console.log("  For zsh (add to ~/.zshrc):");
                 console.log('    export PATH="$HOME/.local/bin:$PATH"');
-                console.log('');
-                console.log('Then reload your shell: source ~/.bashrc (or ~/.zshrc)');
+                console.log("");
+                console.log("Then reload your shell: source ~/.bashrc (or ~/.zshrc)");
             }
         }
         catch (error) {
             // Clean up archive and extract dir on error
             await fs.unlink(archivePath).catch((err) => {
-                debugLog('Warning: Failed to cleanup archive file during error handling:', err);
+                debugLog("Warning: Failed to cleanup archive file during error handling:", err);
             });
             await fs.rm(extractDir, { recursive: true, force: true }).catch((err) => {
-                debugLog('Warning: Failed to cleanup extract directory during error handling:', err);
+                debugLog("Warning: Failed to cleanup extract directory during error handling:", err);
             });
             throw new Error(`Failed to install CLIProxyAPI: ${error instanceof Error ? error.message : String(error)}\n\n` +
-                'Please install CLIProxyAPI manually:\n' +
-                '  1. Visit https://github.com/router-for-me/CLIProxyAPI/releases\n' +
+                "Please install CLIProxyAPI manually:\n" +
+                "  1. Visit https://github.com/router-for-me/CLIProxyAPI/releases\n" +
                 `  2. Download ${archiveFileName} for your system\n` +
-                '  3. Extract the archive\n' +
-                '  4. Place the binary in a directory in your PATH\n' +
-                '  5. Make it executable: chmod +x cli-proxy-api');
+                "  3. Extract the archive\n" +
+                "  4. Place the binary in a directory in your PATH\n" +
+                "  5. Make it executable: chmod +x cli-proxy-api");
         }
     });
 }
@@ -829,42 +832,42 @@ export async function startProxy() {
         return;
     }
     const proxyExe = await requireTrustedProxyCommand();
-    console.log('Starting CLIProxyAPI in background...');
+    console.log("Starting CLIProxyAPI in background...");
     const logFile = getLogFilePath();
     await ensureDir(dirname(logFile));
-    const { spawn } = await import('child_process');
-    const fs = await import('fs/promises');
+    const { spawn } = await import("child_process");
+    const fs = await import("fs/promises");
     let out = null;
     try {
         // Create log with restrictive permissions (user read/write only)
-        out = await fs.open(logFile, 'a');
+        out = await fs.open(logFile, "a");
         // Set restrictive permissions on Unix/macOS (0600 = user read/write only)
-        if (process.platform !== 'win32') {
+        if (process.platform !== "win32") {
             try {
                 await fs.chmod(logFile, 0o600);
             }
             catch {
                 // If chmod fails, continue anyway - the file was created successfully
-                debugLog('Warning: Could not set restrictive permissions on log file');
+                debugLog("Warning: Could not set restrictive permissions on log file");
             }
         }
         const child = spawn(proxyExe, [], {
             detached: true,
-            stdio: ['ignore', out.fd, out.fd],
+            stdio: ["ignore", out.fd, out.fd],
         });
         // Handle spawn errors immediately (fail-fast)
         await new Promise((resolve, reject) => {
-            child.once('error', (error) => {
+            child.once("error", (error) => {
                 reject(new Error(`Failed to start CLIProxyAPI: ${error.message}`));
             });
-            child.once('spawn', () => resolve());
+            child.once("spawn", () => resolve());
         });
         child.unref();
         // Wait for proxy to be ready
         for (let i = 0; i < CONFIG.PROXY_STARTUP_MAX_RETRIES; i++) {
             await sleep(CONFIG.PROXY_STARTUP_RETRY_DELAY_MS);
             if (await isProxyRunning()) {
-                console.log('CLIProxyAPI is running.');
+                console.log("CLIProxyAPI is running.");
                 return;
             }
         }
@@ -881,36 +884,36 @@ export async function startProxy() {
  */
 export async function launchLogin() {
     const proxyExe = await requireTrustedProxyCommand();
-    console.log('Launching ChatGPT/Codex OAuth login in browser...');
-    const spawnCmd = (await import('cross-spawn')).default;
+    console.log("Launching ChatGPT/Codex OAuth login in browser...");
+    const spawnCmd = (await import("cross-spawn")).default;
     return new Promise((resolve, reject) => {
-        const child = spawnCmd(proxyExe, ['-codex-login'], {
-            stdio: 'inherit',
+        const child = spawnCmd(proxyExe, ["-codex-login"], {
+            stdio: "inherit",
         });
-        child.on('close', (code) => {
+        child.on("close", (code) => {
             if (code === 0) {
                 resolve();
             }
             else {
-                reject(new Error('Login failed'));
+                reject(new Error("Login failed"));
             }
         });
-        child.on('error', (error) => reject(error));
+        child.on("error", (error) => reject(error));
     });
 }
 /**
  * Wait for auth to be configured after login
  */
 export async function waitForAuth() {
-    console.log('Waiting for authentication...');
+    console.log("Waiting for authentication...");
     for (let i = 0; i < CONFIG.AUTH_WAIT_MAX_RETRIES; i++) {
         await sleep(CONFIG.AUTH_WAIT_RETRY_DELAY_MS);
         const auth = await checkAuthConfigured();
         if (auth.configured) {
-            console.log('Authentication configured.');
+            console.log("Authentication configured.");
             return;
         }
     }
-    throw new Error('Authentication still not configured after login.');
+    throw new Error("Authentication still not configured after login.");
 }
 //# sourceMappingURL=proxy.js.map