codex-overleaf-link 1.8.3 → 1.8.4

package/README.md

@@ -3,7 +3,7 @@
   <h1>Codex Overleaf Link</h1>
   <p><strong>Empower Overleaf with Codex.</strong></p>
   <p>
-    <img src="https://img.shields.io/badge/version-1.8.3-blue" alt="version">
+    <img src="https://img.shields.io/badge/version-1.8.4-blue" alt="version">
     <img src="https://img.shields.io/badge/platform-macOS%20%2F%20Windows%20%2F%20Linux-lightgrey" alt="platform">
     <img src="https://img.shields.io/badge/chrome-MV3-green" alt="chrome manifest v3">
     <img src="https://img.shields.io/badge/node-%3E%3D20-brightgreen" alt="node version">
@@ -38,14 +38,14 @@ One command installs the native host **and** sets up the extension: the script r
 macOS / Linux:
 
 ```bash
-CODEX_OVERLEAF_REF=v1.8.3 bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.8.3/install.sh)"
+CODEX_OVERLEAF_REF=v1.8.4 bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.8.4/install.sh)"
 ```
 
 Windows PowerShell:
 
 ```powershell
-iwr https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.8.3/install.ps1 -OutFile install.ps1
-$env:CODEX_OVERLEAF_REF='v1.8.3'
+iwr https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.8.4/install.ps1 -OutFile install.ps1
+$env:CODEX_OVERLEAF_REF='v1.8.4'
 powershell -ExecutionPolicy Bypass -File install.ps1
 ```
 
@@ -56,10 +56,10 @@ Then, in the `chrome://extensions` tab the script opened: enable **Developer mod
 `npm exec` installs and updates the **native host only** — it does not include the Chrome extension. Use it if you prefer a pinned npm package to a source checkout.
 
 ```bash
-npm exec --yes codex-overleaf-link@1.8.3 -- install-native
+npm exec --yes codex-overleaf-link@1.8.4 -- install-native
 ```
 
-Then add the extension yourself: download `codex-overleaf-link-extension-v1.8.3.zip` from the [v1.8.3 GitHub Release](https://github.com/Ghqqqq/codex-overleaf-link/releases/tag/v1.8.3), unzip it to a stable folder, and in `chrome://extensions` enable **Developer mode**, click **Load unpacked**, and select that folder.
+Then add the extension yourself: download `codex-overleaf-link-extension-v1.8.4.zip` from the [v1.8.4 GitHub Release](https://github.com/Ghqqqq/codex-overleaf-link/releases/tag/v1.8.4), unzip it to a stable folder, and in `chrome://extensions` enable **Developer mode**, click **Load unpacked**, and select that folder.
 
 ### Open Overleaf
 
@@ -86,9 +86,9 @@ npm installs, updates, uninstalls, and diagnoses the native host only. npm does
 
 | Action | Command |
 |--------|---------|
-| Install / update | `npm exec --yes codex-overleaf-link@1.8.3 -- install-native` |
-| Diagnose | `npm exec --yes codex-overleaf-link@1.8.3 -- doctor` |
-| Uninstall | `npm exec --yes codex-overleaf-link@1.8.3 -- uninstall-native` |
+| Install / update | `npm exec --yes codex-overleaf-link@1.8.4 -- install-native` |
+| Diagnose | `npm exec --yes codex-overleaf-link@1.8.4 -- doctor` |
+| Uninstall | `npm exec --yes codex-overleaf-link@1.8.4 -- uninstall-native` |
 
 Use `--extension-id <chrome-extension-id>` only for a custom/dev unpacked extension id that differs from the official bundled id.
 
@@ -98,13 +98,13 @@ To update, re-run any of the [native host installers](#install) — they install
 
 ## GitHub Release Artifacts
 
-The v1.8.3 GitHub Release contains:
+The v1.8.4 GitHub Release contains:
 
-- `codex-overleaf-link-extension-v1.8.3.zip`: loadable Chrome extension package for manual unpacked installation.
-- `codex-overleaf-native-host-v1.8.3.tar.gz`: native host runtime files used by the installer and release verification.
-- `codex-overleaf-link-1.8.3.tgz`: npm native host CLI package for pinned install, doctor, and uninstall flows.
-- `install.sh`: release-pinned macOS / Linux installer that defaults to `v1.8.3` when run directly from the release artifact.
-- `install.ps1`: release-pinned Windows PowerShell installer that defaults to `v1.8.3` when run directly from the release artifact.
+- `codex-overleaf-link-extension-v1.8.4.zip`: loadable Chrome extension package for manual unpacked installation.
+- `codex-overleaf-native-host-v1.8.4.tar.gz`: native host runtime files used by the installer and release verification.
+- `codex-overleaf-link-1.8.4.tgz`: npm native host CLI package for pinned install, doctor, and uninstall flows.
+- `install.sh`: release-pinned macOS / Linux installer that defaults to `v1.8.4` when run directly from the release artifact.
+- `install.ps1`: release-pinned Windows PowerShell installer that defaults to `v1.8.4` when run directly from the release artifact.
 - `uninstall-native-host.mjs`: native host uninstaller that removes the Chrome Native Messaging manifest, bridge executable, and runtime copy.
 - `nativeHostPlatform.js`, `manifest.js`, `runtimeInstaller.js`: helper files required by the loose uninstaller asset.
 - `SHA256SUMS` and `release-manifest.json`: checksum and artifact metadata for release verification.
@@ -115,7 +115,7 @@ The v1.8.3 GitHub Release contains:
 Remove the native host (use `--browser chromium` on Linux Chromium):
 
 ```bash
-npm exec --yes codex-overleaf-link@1.8.3 -- uninstall-native
+npm exec --yes codex-overleaf-link@1.8.4 -- uninstall-native
 ```
 
 The same command works on Windows PowerShell. If you installed from a manual checkout or source installer, you can also run `npm run uninstall:native` inside the repo, use `node ~/.codex-overleaf/source/scripts/uninstall-native-host.mjs` on macOS / Linux, or use `node $env:LOCALAPPDATA\CodexOverleaf\source\scripts\uninstall-native-host.mjs` on Windows PowerShell.
@@ -150,13 +150,13 @@ Then remove the extension from `chrome://extensions`. To delete local data: on m
 Linux Chromium install or update:
 
 ```bash
-CODEX_OVERLEAF_REF=v1.8.3 bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.8.3/install.sh)" -- --browser chromium
+CODEX_OVERLEAF_REF=v1.8.4 bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.8.4/install.sh)" -- --browser chromium
 ```
 
 Linux Chromium uninstall:
 
 ```bash
-npm exec --yes codex-overleaf-link@1.8.3 -- uninstall-native --browser chromium
+npm exec --yes codex-overleaf-link@1.8.4 -- uninstall-native --browser chromium
 ```
 
 ## Features
@@ -291,7 +291,7 @@ Composer attachments are turn-scoped Codex context. Limits are 8 attachments per
 Re-run any [native host installer](#install), reload the extension in `chrome://extensions`, then refresh the Overleaf tab. This also fixes extension/native version mismatch and native protocol mismatch.
 
 ```bash
-npm exec --yes codex-overleaf-link@1.8.3 -- install-native
+npm exec --yes codex-overleaf-link@1.8.4 -- install-native
 ```
 
 **The Windows popup or panel shows a Bash recovery command**
@@ -340,8 +340,8 @@ Use this matrix for release-candidate signoff and compatibility reports. Record
 | Browser/channel/version | Google Chrome channel and version. | Google Chrome channel and version. | Google Chrome channel and version. | Chromium channel/package and version. |
 | Install mode | Manual unpacked extension from GitHub Release zip or checkout. | Manual unpacked extension from GitHub Release zip or checkout. | Manual unpacked extension from GitHub Release zip or checkout. | Manual unpacked extension from GitHub Release zip or checkout; native host installed with `--browser chromium`. |
 | Extension id | Bundled id `illdpneeeopfffmiepaejglgmhpmdhdc`, or actual custom id passed with `--extension-id`. | Bundled id `illdpneeeopfffmiepaejglgmhpmdhdc`, or actual custom id passed with `--extension-id`. | Bundled id `illdpneeeopfffmiepaejglgmhpmdhdc`, or actual custom id passed with `--extension-id`. | Bundled id `illdpneeeopfffmiepaejglgmhpmdhdc`, or actual custom id passed with `--extension-id`. |
-| Installer/update command | `npm exec --yes codex-overleaf-link@1.8.3 -- install-native` | `npm exec --yes codex-overleaf-link@1.8.3 -- install-native` | `npm exec --yes codex-overleaf-link@1.8.3 -- install-native` | `npm exec --yes codex-overleaf-link@1.8.3 -- install-native --browser chromium` |
-| Uninstall command | `npm exec --yes codex-overleaf-link@1.8.3 -- uninstall-native` | `npm exec --yes codex-overleaf-link@1.8.3 -- uninstall-native` | `npm exec --yes codex-overleaf-link@1.8.3 -- uninstall-native` | `npm exec --yes codex-overleaf-link@1.8.3 -- uninstall-native --browser chromium` |
+| Installer/update command | `npm exec --yes codex-overleaf-link@1.8.4 -- install-native` | `npm exec --yes codex-overleaf-link@1.8.4 -- install-native` | `npm exec --yes codex-overleaf-link@1.8.4 -- install-native` | `npm exec --yes codex-overleaf-link@1.8.4 -- install-native --browser chromium` |
+| Uninstall command | `npm exec --yes codex-overleaf-link@1.8.4 -- uninstall-native` | `npm exec --yes codex-overleaf-link@1.8.4 -- uninstall-native` | `npm exec --yes codex-overleaf-link@1.8.4 -- uninstall-native` | `npm exec --yes codex-overleaf-link@1.8.4 -- uninstall-native --browser chromium` |
 | Manifest/registry path | `~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.codex.overleaf.json` | `HKCU\Software\Google\Chrome\NativeMessagingHosts\com.codex.overleaf` -> `%LOCALAPPDATA%\CodexOverleaf\native-host-runtime\com.codex.overleaf.json` | `~/.config/google-chrome/NativeMessagingHosts/com.codex.overleaf.json` | `~/.config/chromium/NativeMessagingHosts/com.codex.overleaf.json` |
 | Bridge/runtime/source path | Bridge `~/.codex-overleaf/codex-overleaf-bridge`; runtime `~/.codex-overleaf/native-host-runtime`; source `~/.codex-overleaf/source`. | Bridge `%LOCALAPPDATA%\CodexOverleaf\codex-overleaf-bridge.cmd`; runtime `%LOCALAPPDATA%\CodexOverleaf\native-host-runtime`; source `%LOCALAPPDATA%\CodexOverleaf\source`. | Bridge `~/.codex-overleaf/codex-overleaf-bridge`; runtime `~/.codex-overleaf/native-host-runtime`; source `~/.codex-overleaf/source`. | Bridge `~/.codex-overleaf/codex-overleaf-bridge`; runtime `~/.codex-overleaf/native-host-runtime`; source `~/.codex-overleaf/source`. |
 | Node/Git/Codex/TeX | Node.js >= 20; Git; Codex CLI installed and logged in; TeX optional. | Node.js >= 20; Git; Codex CLI installed and logged in; TeX optional. | Node.js >= 20; Git; Codex CLI installed and logged in; TeX optional. | Node.js >= 20; Git; Codex CLI installed and logged in; TeX optional. |

package/extension/src/shared/compatibility.js

@@ -12,7 +12,7 @@
   const MIN_NATIVE_VERSION = '1.0.0';
   const MIN_COMPATIBLE_NATIVE_VERSION = '1.0.0';
   const MIN_COMPATIBLE_EXTENSION_VERSION = '1.0.0';
-  const BUILD_TARGET_VERSION = '1.8.3';
+  const BUILD_TARGET_VERSION = '1.8.4';
   const DEFAULT_CHROME_EXTENSION_ID = 'illdpneeeopfffmiepaejglgmhpmdhdc';
   const REQUIRED_CAPABILITIES = Object.freeze([
     'bridgePing',

package/extension/src/shared/storageDb.js

@@ -1156,7 +1156,7 @@
       if (!s) continue;
       if (s.accountScopeId !== accountScopeId) continue;
       if (typeof s.lastActivityAt !== 'string' || !s.lastActivityAt) continue;
-      if (typeof s.projectId !== 'string' || !s.projectId) continue;
+      if (!isValidOverleafProjectId(s.projectId)) continue;
       var prev = byProject[s.projectId];
       if (!prev || prev.lastActivityAt < s.lastActivityAt) {
         byProject[s.projectId] = s;
@@ -1188,6 +1188,10 @@
     return rows;
   }
 
+  function isValidOverleafProjectId(value) {
+    return typeof value === 'string' && /^[a-f0-9]{24}$/.test(value);
+  }
+
   // Per spec §5.10:
   //   1. trackedChangeStatus if set (pending/accepted/rejected/needs_review)
   //   2. else run status (running/completed/failed/background_completed/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-overleaf-link",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "Cross-platform Chrome bridge that connects Codex to the active Overleaf project.",
   "license": "MIT",
   "type": "commonjs",

package/scripts/verify-npm-package.mjs

@@ -153,12 +153,18 @@ function getCurrentPackageTarballName() {
 }
 
 function runNpm(args) {
-  const result = spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, {
-    cwd: repoRoot,
-    encoding: 'utf8',
-    shell: process.platform === 'win32',
-    windowsHide: true
-  });
+  const result = process.platform === 'win32'
+    ? spawnSync(`npm.cmd ${args.map(quoteWindowsShellArg).join(' ')}`, {
+        cwd: repoRoot,
+        encoding: 'utf8',
+        shell: true,
+        windowsHide: true
+      })
+    : spawnSync('npm', args, {
+        cwd: repoRoot,
+        encoding: 'utf8',
+        windowsHide: true
+      });
 
   if (result.error) {
     throw result.error;
@@ -170,6 +176,14 @@ function runNpm(args) {
   return result.stdout;
 }
 
+function quoteWindowsShellArg(arg) {
+  const value = String(arg);
+  if (/^[A-Za-z0-9._=:/-]+$/.test(value)) {
+    return value;
+  }
+  return `"${value.replace(/"/g, '\\"')}"`;
+}
+
 function parsePackJsonText(text) {
   const parsed = JSON.parse(text);
   const packuments = Array.isArray(parsed) ? parsed : [parsed];