cloudflare-mcp-smart-proxy 1.3.1 → 1.4.0

package/README.md

@@ -61,7 +61,10 @@ node connector-cli.js install claude_code \
 ### Codex
 
 - 配置文件：`~/.codex/config.toml`
-- 写入方式：managed block，不覆盖用户其他配置
+- 设备身份：`~/.codex/cloudmcp/device-identity.json`
+- 写入方式：managed block 原子写入，不覆盖用户其他配置
+- 激活方式：安装完成后自动调用 Codex app-server 官方配置热加载，并确认 `cloudmcp` 已发现工具；无需重启对话或人工结束进程
+- 兼容迁移：首次安装会把已有 `~/.cloudmcp/device-identity.json` 安全迁移到 Codex 共享目录，避免不同运行视图生成不同设备身份
 
 ### Claude Code
 
@@ -78,6 +81,7 @@ node connector-cli.js install claude_code \
 - `CLOUDMCP_CONNECTOR_ID`
 - `CLOUDMCP_CONNECTOR_TYPE`
 - `CLOUDMCP_WORKSPACE_ID`
+- `CLOUDMCP_DEVICE_IDENTITY_PATH`
 
 这些字段会让连接器启动后直接进入：
 
@@ -108,10 +112,21 @@ node connector-cli.js print codex \
 npm run smoke:connectors
 ```
 
+### 重新激活现有 Codex 配置
+
+```bash
+node connector-cli.js reload codex
+```
+
+该命令不需要再次传入凭据。若 Codex app-server 正在运行，它会执行官方热加载并检查工具数量；若 app-server 尚未运行，配置会在下次启动时直接生效。运行中的 app-server 若加载失败或没有发现任何云端治理工具，命令会明确失败，不再把空工具集误报为安装成功。
+
 ## 验证
 
 ```bash
-node --test /home/coder/project/CLOUDMCP/tests/reference-connector-a3.test.js
+node --test /home/coder/project/CLOUDMCP/tests/reference-connector-a3.test.js \
+  /home/coder/project/CLOUDMCP/tests/codex-app-server-reload.test.js \
+  /home/coder/project/CLOUDMCP/tests/local-proxy-device-identity.test.js \
+  /home/coder/project/CLOUDMCP/tests/local-proxy-tool-discovery.test.js
 ```
 
 ## 备注

package/connector-cli.js

@@ -2,15 +2,16 @@
 
 import path from 'path';
 import { fileURLToPath } from 'url';
+import { reloadCodexMcpServer } from './src/codex-app-server.js';
 import { installReferenceConnector, printReferenceConnectorConfig } from './src/reference-connectors.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 function printUsage() {
-  console.error('Usage: cloudmcp-connector <install|print|smoke> <codex|claude_code> [options]');
+  console.error('Usage: cloudmcp-connector <install|print|smoke|reload> <codex|claude_code> [options]');
   console.error('');
-  console.error('Required options:');
+  console.error('Required options for install, print, and smoke:');
   console.error('  --cloud-url <url>');
   console.error('  --api-key <key>');
   console.error('  --client-profile-id <id>');
@@ -23,7 +24,13 @@ function printUsage() {
   console.error('  --scope <user|project>     Claude Code supports user/project; Codex is always user');
   console.error('  --server-name <name>       Default: cloudmcp');
   console.error('  --runtime <npm|local>      Default: npm');
+  console.error('  --codex-config-path <path> Shared Codex config source');
+  console.error('  --codex-device-identity-path <path> Shared CloudMCP device identity');
+  console.error('  --app-server-socket <path> Current runtime Codex app-server socket');
+  console.error('  --runtime-id <id>          Current Codex runtime identity');
   console.error('  --dry-run                  Show output without writing');
+  console.error('');
+  console.error('The reload codex command uses the existing Codex config and requires no credentials.');
 }
 
 function parseArgs(argv) {
@@ -79,6 +86,10 @@ function buildInstallOptions(options) {
     scope: options.scope || 'user',
     serverName: options['server-name'] || 'cloudmcp',
     runtime: options.runtime || 'npm',
+    codexConfigPath: options['codex-config-path'] || process.env.CODEX_SHARED_CONFIG_PATH || '',
+    codexDeviceIdentityPath: options['codex-device-identity-path']
+      || process.env.CODEX_SHARED_DEVICE_IDENTITY_PATH
+      || '',
     packageRoot: __dirname,
     dryRun: options.dryRun === true
   };
@@ -90,6 +101,15 @@ function printInstallResult(result, { includeContent = false } = {}) {
   console.error(`target: ${result.targetFile}`);
   console.error(`server: ${result.serverName}`);
   console.error(`written: ${result.written ? 'yes' : 'no'}`);
+  if (result.deviceIdentityPath) {
+    console.error(`device identity: ${result.deviceIdentityPath}`);
+  }
+  if (result.activation) {
+    console.error(`activation: ${result.activation.status}`);
+    if (Number.isInteger(result.activation.toolCount)) {
+      console.error(`tools: ${result.activation.toolCount}`);
+    }
+  }
   if (includeContent) {
     process.stdout.write(`${result.renderedContent}\n`);
   }
@@ -113,7 +133,7 @@ async function main() {
   try {
     const options = parseArgs(process.argv.slice(2));
 
-    if (!['install', 'print', 'smoke'].includes(options.command)) {
+    if (!['install', 'print', 'smoke', 'reload'].includes(options.command)) {
       printUsage();
       process.exit(1);
     }
@@ -124,10 +144,37 @@ async function main() {
 
     if (options.command === 'install') {
       const result = installReferenceConnector(buildInstallOptions(options));
+      if (options.ecosystem === 'codex' && !options.dryRun) {
+        result.activation = await reloadCodexMcpServer({
+          serverName: result.serverName,
+          socketPath: options['app-server-socket'] || process.env.CODEX_APP_SERVER_SOCKET || '',
+          runtimeId: options['runtime-id'] || process.env.CODEX_RUNTIME_ID || ''
+        });
+      }
       printInstallResult(result);
       return;
     }
 
+    if (options.command === 'reload') {
+      if (options.ecosystem !== 'codex') {
+        throw new Error('Runtime reload is currently supported only for Codex');
+      }
+      const activation = await reloadCodexMcpServer({
+        serverName: options['server-name'] || 'cloudmcp',
+        socketPath: options['app-server-socket'] || process.env.CODEX_APP_SERVER_SOCKET || '',
+        runtimeId: options['runtime-id'] || process.env.CODEX_RUNTIME_ID || ''
+      });
+      printInstallResult({
+        ecosystem: 'codex',
+        scope: 'user',
+        targetFile: activation.socketPath,
+        serverName: activation.serverName,
+        written: false,
+        activation
+      });
+      return;
+    }
+
     if (options.command === 'print') {
       const result = printReferenceConnectorConfig(buildInstallOptions(options));
       printInstallResult(result, { includeContent: true });

package/index.js

@@ -25,6 +25,7 @@ const CLIENT_PROFILE_ID = process.env.CLOUDMCP_CLIENT_PROFILE_ID || process.env.
 const CONNECTOR_ID = process.env.CLOUDMCP_CONNECTOR_ID || process.env.CONNECTOR_ID || '';
 const CONNECTOR_TYPE = process.env.CLOUDMCP_CONNECTOR_TYPE || process.env.CONNECTOR_TYPE || 'smart_proxy';
 const WORKSPACE_ID = process.env.CLOUDMCP_WORKSPACE_ID || process.env.WORKSPACE_ID || '';
+const DEVICE_IDENTITY_PATH = process.env.CLOUDMCP_DEVICE_IDENTITY_PATH || '';
 const AUTO_SYNC_PROFILE = (process.env.CLOUDMCP_AUTO_SYNC_PROFILE || 'true') !== 'false';
 const AUTO_APPLY_BRAIN = (process.env.CLOUDMCP_AUTO_APPLY_BRAIN || 'true') !== 'false';
 const AUTO_REPORT_PROJECT_PROBE = (process.env.CLOUDMCP_AUTO_REPORT_PROJECT_PROBE || 'true') === 'true';
@@ -47,7 +48,8 @@ const connectorBridge = new ConnectorBridge({
   clientProfileId: CLIENT_PROFILE_ID,
   connectorId: CONNECTOR_ID,
   connectorType: CONNECTOR_TYPE,
-  workspaceId: WORKSPACE_ID
+  workspaceId: WORKSPACE_ID,
+  deviceIdentityPath: DEVICE_IDENTITY_PATH
 });
 const localTools = new LocalToolExecutor(WORKSPACE_ROOT, connectorBridge);
 const router = new SmartRouter(CLOUD_URL, CLOUD_API_KEY, localTools, WORKSPACE_ROOT, connectorBridge.deviceIdentity);
@@ -72,8 +74,9 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
     const tools = await router.getAllTools();
     return { tools };
   } catch (error) {
-    console.error('Error listing tools:', error);
-    return { tools: [] };
+    const safeError = sanitizeProxyError(error);
+    console.error('Error listing tools:', safeError);
+    throw new Error(`CloudMCP tool discovery failed: ${safeError}`);
   }
 });
 

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "cloudflare-mcp-smart-proxy",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "Smart proxy for Cloudflare MCP - routes tools to cloud or local execution",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jobssteve164dev/CLOUDMCP.git",
+    "directory": "local-proxy"
+  },
   "type": "module",
   "packageManager": "pnpm@10.33.0",
   "main": "index.js",

package/src/codex-app-server.js

@@ -0,0 +1,391 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+
+const DEFAULT_TIMEOUT_MS = 30_000;
+
+function readText(filePath) {
+  try {
+    return fs.readFileSync(filePath, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function readLink(filePath) {
+  try {
+    return fs.readlinkSync(filePath);
+  } catch {
+    return '';
+  }
+}
+
+function describeRuntime(pid = process.pid) {
+  return {
+    pid,
+    runtimeId: (process.env.CODEX_RUNTIME_ID || '').trim() || 'unspecified',
+    mountNamespace: readLink(`/proc/${pid}/ns/mnt`),
+    cgroup: readText(`/proc/${pid}/cgroup`).trim().replace(/\s+/g, ' ')
+  };
+}
+
+function resolveSocketOwner(socketPath) {
+  if (process.platform !== 'linux') return null;
+  const socketRow = readText('/proc/net/unix')
+    .split('\n')
+    .map((line) => line.trim().split(/\s+/))
+    .find((fields) => fields.length >= 8 && fields.slice(7).join(' ') === socketPath);
+  const inode = socketRow?.[6];
+  if (!inode) return null;
+
+  let processEntries;
+  try {
+    processEntries = fs.readdirSync('/proc', { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  for (const entry of processEntries) {
+    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+    let fileDescriptors;
+    try {
+      fileDescriptors = fs.readdirSync(`/proc/${entry.name}/fd`);
+    } catch {
+      continue;
+    }
+    if (!fileDescriptors.some((fd) => readLink(`/proc/${entry.name}/fd/${fd}`) === `socket:[${inode}]`)) {
+      continue;
+    }
+    return describeRuntime(Number(entry.name));
+  }
+  return null;
+}
+
+export function validateCodexAppServerRuntime({
+  socketPath,
+  runtimeId = '',
+  requireOwner = false,
+  ownerResolver = resolveSocketOwner
+} = {}) {
+  if (!socketPath) throw new Error('Codex app-server socket path is required');
+  const expected = {
+    ...describeRuntime(),
+    runtimeId: runtimeId || (process.env.CODEX_RUNTIME_ID || '').trim() || 'unspecified'
+  };
+  const actual = ownerResolver(socketPath);
+  if (requireOwner && process.platform === 'linux' && !actual) {
+    throw new Error(
+      `Refusing Codex app-server socket with unknown runtime ownership: socket=${socketPath} `
+      + `expected_runtime=${expected.runtimeId} expected_mount_ns=${expected.mountNamespace} `
+      + `expected_cgroup=${expected.cgroup || 'unknown'}`
+    );
+  }
+  if (
+    actual?.mountNamespace
+    && expected.mountNamespace
+    && actual.mountNamespace !== expected.mountNamespace
+  ) {
+    throw new Error(
+      `Refusing Codex app-server socket from another runtime: socket=${socketPath} `
+      + `expected_runtime=${expected.runtimeId} expected_mount_ns=${expected.mountNamespace} `
+      + `expected_cgroup=${expected.cgroup || 'unknown'} actual_pid=${actual.pid || 'unknown'} `
+      + `actual_mount_ns=${actual.mountNamespace} actual_cgroup=${actual.cgroup || 'unknown'}`
+    );
+  }
+  return { expected, actual };
+}
+
+function encodeClientFrame(payload, opcode = 0x1) {
+  const body = Buffer.isBuffer(payload) ? payload : Buffer.from(String(payload));
+  const mask = crypto.randomBytes(4);
+  let header;
+  if (body.length < 126) {
+    header = Buffer.alloc(2);
+    header[1] = 0x80 | body.length;
+  } else if (body.length <= 0xffff) {
+    header = Buffer.alloc(4);
+    header[1] = 0x80 | 126;
+    header.writeUInt16BE(body.length, 2);
+  } else {
+    header = Buffer.alloc(10);
+    header[1] = 0x80 | 127;
+    header.writeBigUInt64BE(BigInt(body.length), 2);
+  }
+  header[0] = 0x80 | opcode;
+  const masked = Buffer.alloc(body.length);
+  for (let index = 0; index < body.length; index += 1) {
+    masked[index] = body[index] ^ mask[index % mask.length];
+  }
+  return Buffer.concat([header, mask, masked]);
+}
+
+function readServerFrame(buffer) {
+  if (buffer.length < 2) return null;
+  const opcode = buffer[0] & 0x0f;
+  const masked = Boolean(buffer[1] & 0x80);
+  let payloadLength = buffer[1] & 0x7f;
+  let offset = 2;
+  if (payloadLength === 126) {
+    if (buffer.length < 4) return null;
+    payloadLength = buffer.readUInt16BE(2);
+    offset = 4;
+  } else if (payloadLength === 127) {
+    if (buffer.length < 10) return null;
+    const length = buffer.readBigUInt64BE(2);
+    if (length > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new Error('Codex app-server response is too large');
+    }
+    payloadLength = Number(length);
+    offset = 10;
+  }
+  let mask = null;
+  if (masked) {
+    if (buffer.length < offset + 4) return null;
+    mask = buffer.subarray(offset, offset + 4);
+    offset += 4;
+  }
+  if (buffer.length < offset + payloadLength) return null;
+  let payload = buffer.subarray(offset, offset + payloadLength);
+  if (mask) {
+    payload = Buffer.from(payload);
+    for (let index = 0; index < payload.length; index += 1) {
+      payload[index] ^= mask[index % mask.length];
+    }
+  }
+  return {
+    opcode,
+    payload,
+    remaining: buffer.subarray(offset + payloadLength)
+  };
+}
+
+function createRpcError(response) {
+  return new Error(response?.error?.message || 'Codex app-server request failed');
+}
+
+export function resolveCodexAppServerSocket({
+  homeDir = os.homedir(),
+  codexHome = '',
+  socketPath = '',
+  runtimeDir = process.env.XDG_RUNTIME_DIR || ''
+} = {}) {
+  const explicitSocketPath = socketPath || process.env.CODEX_APP_SERVER_SOCKET || '';
+  if (explicitSocketPath) return path.resolve(explicitSocketPath);
+  if (runtimeDir) return path.join(path.resolve(runtimeDir), 'codex', 'app-server.sock');
+  const resolvedCodexHome = codexHome || process.env.CODEX_HOME || path.join(homeDir, '.codex');
+  return path.join(resolvedCodexHome, 'app-server-control', 'app-server-control.sock');
+}
+
+function assertIsolatedSocketPath({ socketPath, homeDir, codexHome, isolationMode }) {
+  if (!isolationMode) return;
+  const resolvedCodexHome = codexHome || process.env.CODEX_HOME || path.join(homeDir, '.codex');
+  const legacySocketPath = path.join(path.resolve(resolvedCodexHome), 'app-server-control', 'app-server-control.sock');
+  if (path.resolve(socketPath) === legacySocketPath) {
+    throw new Error(
+      `Refusing shared Codex app-server socket in isolated runtime mode: socket=${socketPath}`
+    );
+  }
+}
+
+export async function connectCodexAppServer({ socketPath, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  if (!socketPath) throw new Error('Codex app-server socket path is required');
+  const socket = net.createConnection(socketPath);
+  const pending = new Map();
+  let nextId = 1;
+  let upgraded = false;
+  let buffer = Buffer.alloc(0);
+  let closed = false;
+
+  const failPending = (error) => {
+    for (const { reject } of pending.values()) reject(error);
+    pending.clear();
+  };
+
+  const parseFrames = () => {
+    while (true) {
+      const frame = readServerFrame(buffer);
+      if (!frame) return;
+      buffer = frame.remaining;
+      if (frame.opcode === 0x8) {
+        failPending(new Error('Codex app-server closed the connection'));
+        return;
+      }
+      if (frame.opcode === 0x9) {
+        socket.write(encodeClientFrame(frame.payload, 0x0a));
+        continue;
+      }
+      if (frame.opcode !== 0x1) continue;
+      let message;
+      try {
+        message = JSON.parse(frame.payload.toString('utf8'));
+      } catch {
+        continue;
+      }
+      if (message.id == null || !pending.has(message.id)) continue;
+      const request = pending.get(message.id);
+      pending.delete(message.id);
+      clearTimeout(request.timer);
+      if (message.error) request.reject(createRpcError(message));
+      else request.resolve(message.result);
+    }
+  };
+
+  const connected = new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('Timed out connecting to Codex app-server')), timeoutMs);
+    socket.once('connect', () => {
+      const websocketKey = crypto.randomBytes(16).toString('base64');
+      socket.write([
+        'GET / HTTP/1.1',
+        'Host: localhost',
+        'Upgrade: websocket',
+        'Connection: Upgrade',
+        `Sec-WebSocket-Key: ${websocketKey}`,
+        'Sec-WebSocket-Version: 13',
+        '',
+        ''
+      ].join('\r\n'));
+    });
+    socket.on('data', (chunk) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      if (!upgraded) {
+        const headerEnd = buffer.indexOf('\r\n\r\n');
+        if (headerEnd < 0) return;
+        const header = buffer.subarray(0, headerEnd).toString('utf8');
+        if (!/^HTTP\/1\.1 101\b/m.test(header)) {
+          clearTimeout(timer);
+          reject(new Error('Codex app-server rejected the WebSocket upgrade'));
+          return;
+        }
+        buffer = buffer.subarray(headerEnd + 4);
+        upgraded = true;
+        clearTimeout(timer);
+        resolve();
+      }
+      try {
+        parseFrames();
+      } catch (error) {
+        failPending(error);
+        socket.destroy(error);
+      }
+    });
+    socket.once('error', (error) => {
+      clearTimeout(timer);
+      reject(error);
+      failPending(error);
+    });
+    socket.once('close', () => {
+      if (!closed) failPending(new Error('Codex app-server connection closed'));
+    });
+  });
+
+  await connected;
+
+  const request = (method, params = {}) => new Promise((resolve, reject) => {
+    const id = nextId;
+    nextId += 1;
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error(`Timed out waiting for Codex app-server method ${method}`));
+    }, timeoutMs);
+    pending.set(id, { resolve, reject, timer });
+    socket.write(encodeClientFrame(JSON.stringify({ method, id, params })));
+  });
+
+  await request('initialize', {
+    clientInfo: {
+      name: 'cloudmcp_connector',
+      title: 'CloudMCP Connector',
+      version: '1.0.0'
+    }
+  });
+  socket.write(encodeClientFrame(JSON.stringify({ method: 'initialized' })));
+
+  return {
+    request,
+    close() {
+      if (closed) return;
+      closed = true;
+      socket.end(encodeClientFrame(Buffer.alloc(0), 0x8));
+    }
+  };
+}
+
+function normalizeServerRows(result) {
+  if (Array.isArray(result?.data)) return result.data;
+  if (Array.isArray(result?.items)) return result.items;
+  if (Array.isArray(result?.servers)) return result.servers;
+  return [];
+}
+
+export async function reloadCodexMcpServer({
+  serverName = 'cloudmcp',
+  homeDir = os.homedir(),
+  codexHome = '',
+  socketPath = '',
+  runtimeDir = process.env.XDG_RUNTIME_DIR || '',
+  runtimeId = process.env.CODEX_RUNTIME_ID || '',
+  isolationMode = Boolean(
+    process.env.CODEX_RUNTIME_ISOLATION === '1'
+      || process.env.CODEX_APP_SERVER_SOCKET
+      || process.env.CODEX_RUNTIME_ID
+      || process.env.XDG_RUNTIME_DIR
+  ),
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  rpcClient = null,
+  runtimeValidator = validateCodexAppServerRuntime
+} = {}) {
+  const resolvedSocketPath = resolveCodexAppServerSocket({
+    homeDir,
+    codexHome,
+    socketPath,
+    runtimeDir
+  });
+  assertIsolatedSocketPath({
+    socketPath: resolvedSocketPath,
+    homeDir,
+    codexHome,
+    isolationMode
+  });
+  if (!rpcClient && !fs.existsSync(resolvedSocketPath)) {
+    return {
+      status: 'next_start',
+      serverName,
+      socketPath: resolvedSocketPath,
+      toolCount: null
+    };
+  }
+
+  let client = rpcClient;
+  try {
+    if (!rpcClient) {
+      runtimeValidator({
+        socketPath: resolvedSocketPath,
+        runtimeId,
+        requireOwner: isolationMode
+      });
+    }
+    client ||= await connectCodexAppServer({ socketPath: resolvedSocketPath, timeoutMs });
+    await client.request('config/mcpServer/reload', {});
+    const result = await client.request('mcpServerStatus/list', { cursor: null, limit: 100 });
+    const server = normalizeServerRows(result).find((item) => item?.name === serverName);
+    if (!server) {
+      throw new Error(`Codex did not load MCP server "${serverName}" after config reload`);
+    }
+    const toolCount = Array.isArray(server.tools)
+      ? server.tools.length
+      : (server.tools && typeof server.tools === 'object' ? Object.keys(server.tools).length : 0);
+    if (toolCount === 0) {
+      throw new Error(`Codex loaded MCP server "${serverName}" without any tools`);
+    }
+    return {
+      status: 'ready',
+      serverName,
+      socketPath: resolvedSocketPath,
+      toolCount,
+      authStatus: server.authStatus || server.auth_status || null
+    };
+  } finally {
+    if (!rpcClient) client?.close?.();
+  }
+}

package/src/connector-bridge.js

@@ -34,6 +34,7 @@ export class ConnectorBridge {
     connectorId,
     connectorType,
     workspaceId,
+    deviceIdentityPath = '',
     deviceIdentity = null,
     cloudClient = null
   }) {
@@ -42,7 +43,7 @@ export class ConnectorBridge {
     this.connectorId = normalizeString(connectorId, defaultConnectorId());
     this.connectorType = normalizeString(connectorType, 'smart_proxy');
     this.workspaceId = normalizeString(workspaceId, defaultWorkspaceId(this.workspaceRoot));
-    this.deviceIdentity = deviceIdentity || new DeviceIdentity();
+    this.deviceIdentity = deviceIdentity || new DeviceIdentity({ identityPath: deviceIdentityPath });
     this.cloudClient = cloudClient || new CloudClient({
       cloudUrl,
       cloudApiKey,

package/src/device-identity.js

@@ -15,8 +15,10 @@ async function sha256Hex(value) {
   return Buffer.from(digest).toString('hex');
 }
 
-function defaultIdentityPath() {
-  return path.join(os.homedir(), '.cloudmcp', 'device-identity.json');
+export function resolveDeviceIdentityPath({ identityPath = '', homeDir = os.homedir(), env = process.env } = {}) {
+  return identityPath
+    || env.CLOUDMCP_DEVICE_IDENTITY_PATH
+    || path.join(homeDir, '.cloudmcp', 'device-identity.json');
 }
 
 function ensureParent(filePath) {
@@ -24,8 +26,8 @@ function ensureParent(filePath) {
 }
 
 export class DeviceIdentity {
-  constructor({ identityPath = defaultIdentityPath() } = {}) {
-    this.identityPath = identityPath;
+  constructor({ identityPath = '' } = {}) {
+    this.identityPath = resolveDeviceIdentityPath({ identityPath });
     this.record = null;
     this.privateKey = null;
   }
@@ -40,15 +42,29 @@ export class DeviceIdentity {
         true,
         ['sign', 'verify']
       );
-      this.record = {
+      const generatedRecord = {
         deviceId: `dev_${crypto.randomUUID()}`,
         publicKeyJwk: await subtle.exportKey('jwk', keyPair.publicKey),
         privateKeyJwk: await subtle.exportKey('jwk', keyPair.privateKey),
         createdAt: Date.now()
       };
       ensureParent(this.identityPath);
-      fs.writeFileSync(this.identityPath, `${JSON.stringify(this.record, null, 2)}\n`, { mode: 0o600 });
+      try {
+        fs.writeFileSync(this.identityPath, `${JSON.stringify(generatedRecord, null, 2)}\n`, {
+          encoding: 'utf8',
+          flag: 'wx',
+          mode: 0o600
+        });
+        this.record = generatedRecord;
+      } catch (error) {
+        if (error?.code !== 'EEXIST') throw error;
+        this.record = JSON.parse(fs.readFileSync(this.identityPath, 'utf8'));
+      }
     }
+    if (!this.record?.deviceId || !this.record?.publicKeyJwk || !this.record?.privateKeyJwk) {
+      throw new Error(`Invalid CloudMCP device identity at ${this.identityPath}`);
+    }
+    fs.chmodSync(this.identityPath, 0o600);
     this.privateKey = await subtle.importKey(
       'jwk',
       this.record.privateKeyJwk,

package/src/ide-configurator.js

@@ -16,7 +16,11 @@
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
-import { mergeCodexConfig, mergeClaudeCodeConfig } from './reference-connectors.js';
+import {
+  mergeCodexConfig,
+  mergeClaudeCodeConfig,
+  writeFileAtomically
+} from './reference-connectors.js';
 
 // ── IDE detection ─────────────────────────────────────────────────────────────
 
@@ -130,8 +134,10 @@ function _applyCodex(snapshot, workspaceRoot) {
   const mcpServers = snapshot.mcpServers || {};
 
   if (Object.keys(mcpServers).length > 0) {
-    const configDir = path.join(os.homedir(), '.codex');
-    const configFile = path.join(configDir, 'config.toml');
+    const configFile = path.resolve(
+      (process.env.CODEX_SHARED_CONFIG_PATH || '').trim()
+        || path.join(os.homedir(), '.codex', 'config.toml')
+    );
     _ensureDir(configFile);
     let content = fs.existsSync(configFile) ? fs.readFileSync(configFile, 'utf8') : '';
     for (const [serverName, serverDefinition] of Object.entries(mcpServers)) {
@@ -140,7 +146,7 @@ function _applyCodex(snapshot, workspaceRoot) {
         enabled: serverDefinition?.enabled !== false
       });
     }
-    fs.writeFileSync(configFile, content, 'utf8');
+    writeFileAtomically(configFile, content);
     results.push({ action: 'merged_mcp', file: configFile, count: Object.keys(mcpServers).length });
   }
 

package/src/reference-connectors.js

@@ -5,6 +5,7 @@ import path from 'path';
 const DEFAULT_SERVER_NAME = 'cloudmcp';
 const DEFAULT_PACKAGE_NAME = 'cloudflare-mcp-smart-proxy';
 const DEFAULT_PACKAGE_BIN = 'cloudflare-mcp-proxy';
+const DEFAULT_CODEX_STARTUP_TIMEOUT_SEC = 30;
 const MANAGED_BLOCK_PREFIX = '# BEGIN CLOUDMCP MANAGED MCP SERVER';
 const MANAGED_BLOCK_SUFFIX = '# END CLOUDMCP MANAGED MCP SERVER';
 
@@ -43,6 +44,34 @@ function ensureDir(targetPath) {
   }
 }
 
+function resolveAtomicWriteTarget(filePath) {
+  try {
+    if (fs.lstatSync(filePath).isSymbolicLink()) {
+      return fs.realpathSync(filePath);
+    }
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+  return filePath;
+}
+
+export function writeFileAtomically(filePath, content) {
+  const writeTarget = resolveAtomicWriteTarget(filePath);
+  ensureDir(writeTarget);
+  const temporaryPath = `${writeTarget}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(temporaryPath, content, {
+      encoding: 'utf8',
+      flag: 'wx',
+      mode: 0o600
+    });
+    fs.renameSync(temporaryPath, writeTarget);
+  } catch (error) {
+    if (fs.existsSync(temporaryPath)) fs.unlinkSync(temporaryPath);
+    throw error;
+  }
+}
+
 function readJson(filePath, fallback) {
   try {
     return JSON.parse(fs.readFileSync(filePath, 'utf8'));
@@ -68,7 +97,9 @@ function toManagedEnv({
   clientProfileId,
   connectorId,
   connectorType,
-  workspaceId
+  workspaceId,
+  deviceIdentityPath,
+  codexConfigPath
 }) {
   const env = {
     CLOUDFLARE_MCP_URL: normalizeEnvValue(cloudUrl),
@@ -77,7 +108,9 @@ function toManagedEnv({
     CLOUDMCP_CLIENT_PROFILE_ID: normalizeEnvValue(clientProfileId),
     CLOUDMCP_CONNECTOR_ID: normalizeEnvValue(connectorId),
     CLOUDMCP_CONNECTOR_TYPE: normalizeEnvValue(connectorType),
-    CLOUDMCP_WORKSPACE_ID: normalizeEnvValue(workspaceId)
+    CLOUDMCP_WORKSPACE_ID: normalizeEnvValue(workspaceId),
+    CLOUDMCP_DEVICE_IDENTITY_PATH: normalizeEnvValue(deviceIdentityPath),
+    CODEX_SHARED_CONFIG_PATH: normalizeEnvValue(codexConfigPath)
   };
 
   return Object.fromEntries(
@@ -118,6 +151,8 @@ export function buildReferenceConnectorServer({
   connectorId = '',
   connectorType = '',
   workspaceId = '',
+  deviceIdentityPath = '',
+  codexConfigPath = '',
   packageRoot = null,
   runtime = 'npm'
 }) {
@@ -139,9 +174,12 @@ export function buildReferenceConnectorServer({
       clientProfileId,
       connectorId: resolvedConnectorId,
       connectorType: resolvedConnectorType,
-      workspaceId: resolvedWorkspaceId
+      workspaceId: resolvedWorkspaceId,
+      deviceIdentityPath,
+      codexConfigPath: normalizedEcosystem === 'codex' ? codexConfigPath : ''
     }),
     enabled: true,
+    startupTimeoutSec: normalizedEcosystem === 'codex' ? DEFAULT_CODEX_STARTUP_TIMEOUT_SEC : null,
     connectorId: resolvedConnectorId,
     connectorType: resolvedConnectorType,
     workspaceId: resolvedWorkspaceId
@@ -152,7 +190,8 @@ export function getReferenceConnectorTarget({
   ecosystem,
   workspaceRoot = process.cwd(),
   scope = 'user',
-  homeDir = null
+  homeDir = null,
+  codexConfigPath = ''
 }) {
   const normalizedEcosystem = normalizeString(ecosystem).toLowerCase();
   const normalizedScope = normalizeString(scope, 'user').toLowerCase();
@@ -164,7 +203,11 @@ export function getReferenceConnectorTarget({
       ecosystem: normalizedEcosystem,
       scope: 'user',
       format: 'toml',
-      targetFile: path.join(resolvedHomeDir, '.codex', 'config.toml')
+      targetFile: path.resolve(
+        normalizeString(codexConfigPath)
+          || normalizeString(process.env.CODEX_SHARED_CONFIG_PATH)
+          || path.join(resolvedHomeDir, '.codex', 'config.toml')
+      )
     };
   }
 
@@ -197,6 +240,10 @@ export function buildCodexManagedBlock(serverName, serverDefinition) {
     `enabled = ${serverDefinition.enabled === false ? 'false' : 'true'}`
   ];
 
+  if (Number.isFinite(serverDefinition.startupTimeoutSec)) {
+    lines.push(`startup_timeout_sec = ${serverDefinition.startupTimeoutSec}`);
+  }
+
   const envEntries = Object.entries(serverDefinition.env || {});
   if (envEntries.length > 0) {
     lines.push('', `[mcp_servers.${serverName}.env]`);
@@ -254,6 +301,8 @@ export function installReferenceConnector({
   scope = 'user',
   serverName = DEFAULT_SERVER_NAME,
   homeDir = null,
+  codexConfigPath = '',
+  codexDeviceIdentityPath = '',
   dryRun = false
 }) {
   const normalizedServerName = sanitizeServerName(serverName);
@@ -261,8 +310,35 @@ export function installReferenceConnector({
     ecosystem,
     workspaceRoot,
     scope,
-    homeDir
+    homeDir,
+    codexConfigPath
   });
+  const resolvedHomeDir = resolveHomeDir(homeDir);
+  const deviceIdentityPath = target.ecosystem === 'codex'
+    ? path.resolve(
+      normalizeString(codexDeviceIdentityPath)
+        || normalizeString(process.env.CODEX_SHARED_DEVICE_IDENTITY_PATH)
+        || path.join(resolvedHomeDir, '.codex', 'cloudmcp', 'device-identity.json')
+    )
+    : path.join(resolvedHomeDir, '.cloudmcp', 'device-identity.json');
+  const legacyDeviceIdentityPath = path.join(resolvedHomeDir, '.cloudmcp', 'device-identity.json');
+
+  let migratedDeviceIdentity = false;
+  if (
+    !dryRun
+    && target.ecosystem === 'codex'
+    && !fs.existsSync(deviceIdentityPath)
+    && fs.existsSync(legacyDeviceIdentityPath)
+  ) {
+    ensureDir(deviceIdentityPath);
+    try {
+      fs.copyFileSync(legacyDeviceIdentityPath, deviceIdentityPath, fs.constants.COPYFILE_EXCL);
+      fs.chmodSync(deviceIdentityPath, 0o600);
+      migratedDeviceIdentity = true;
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+    }
+  }
   const serverDefinition = buildReferenceConnectorServer({
     ecosystem,
     cloudUrl,
@@ -272,6 +348,8 @@ export function installReferenceConnector({
     connectorId,
     connectorType,
     workspaceId,
+    deviceIdentityPath,
+    codexConfigPath: target.ecosystem === 'codex' ? target.targetFile : '',
     packageRoot,
     runtime
   });
@@ -292,8 +370,7 @@ export function installReferenceConnector({
   }
 
   if (!dryRun) {
-    ensureDir(target.targetFile);
-    fs.writeFileSync(target.targetFile, renderedContent, 'utf8');
+    writeFileAtomically(target.targetFile, renderedContent);
   }
 
   return {
@@ -303,7 +380,9 @@ export function installReferenceConnector({
     serverName: normalizedServerName,
     serverDefinition,
     renderedContent,
-    written: !dryRun
+    written: !dryRun,
+    deviceIdentityPath,
+    migratedDeviceIdentity
   };
 }
 

package/src/router.js

@@ -280,41 +280,35 @@ export class SmartRouter {
    * 获取所有工具列表（合并云端和本地）
    */
   async getAllTools() {
-    try {
-      const [cloudTools, localTools] = await Promise.all([
-        this.getCloudTools(),
-        this.localTools.listTools()
-      ]);
-
-      // 合并工具列表，添加 source 标识
-      const allTools = [
-        ...cloudTools.map(t => ({ ...t, source: 'cloud' })),
-        ...localTools.map(t => ({ ...t, source: 'local' }))
-      ];
+    const [cloudTools, localTools] = await Promise.all([
+      this.getCloudTools(),
+      this.localTools.listTools()
+    ]);
 
-      return allTools;
-    } catch (error) {
-      console.error('Error getting all tools:', error);
-      // 如果云端获取失败，至少返回本地工具
-      return this.localTools.listTools().map(t => ({ ...t, source: 'local' }));
+    if (cloudTools.length === 0) {
+      throw new Error('CloudMCP returned no governed cloud tools');
     }
+
+    return [
+      ...cloudTools.map(t => ({ ...t, source: 'cloud' })),
+      ...localTools.map(t => ({ ...t, source: 'local' }))
+    ];
   }
 
   /**
    * 获取云端工具列表
    */
   async getCloudTools() {
-    try {
-      const body = JSON.stringify({
+    const body = JSON.stringify({
         jsonrpc: '2.0',
         id: Date.now(),
         method: 'tools/list',
         params: {}
       });
-      const signedHeaders = this.deviceIdentity
-        ? await this.deviceIdentity.buildSignedHeaders({ method: 'POST', pathname: '/mcp', body })
-        : {};
-      const response = await fetch(`${this.cloudUrl}/mcp`, {
+    const signedHeaders = this.deviceIdentity
+      ? await this.deviceIdentity.buildSignedHeaders({ method: 'POST', pathname: '/mcp', body })
+      : {};
+    const response = await fetch(`${this.cloudUrl}/mcp`, {
         method: 'POST',
         headers: {
           'Authorization': `Bearer ${this.cloudApiKey}`,
@@ -324,20 +318,14 @@ export class SmartRouter {
         body
       });
 
-      if (!response.ok) {
-        throw new Error(`Failed to fetch cloud tools: ${response.status}`);
-      }
+    if (!response.ok) {
+      throw new Error(`Failed to fetch cloud tools: ${response.status}`);
+    }
 
-      const result = await response.json();
-      
-      if (result.error) {
-        throw new Error(result.error.message || 'Failed to fetch cloud tools');
-      }
-      
-      return result.result?.tools || [];
-    } catch (error) {
-      console.error('Error fetching cloud tools:', error);
-      return [];
+    const result = await response.json();
+    if (result.error) {
+      throw new Error(result.error.message || 'Failed to fetch cloud tools');
     }
+    return result.result?.tools || [];
   }
 }