codex-overleaf-link 1.9.0 → 1.9.2

package/README.md

@@ -3,7 +3,7 @@
   <h1>Codex Overleaf Link</h1>
   <p><strong>Empower Overleaf with Codex.</strong></p>
   <p>
-    <img src="https://img.shields.io/badge/version-1.9.0-blue" alt="version">
+    <img src="https://img.shields.io/badge/version-1.9.2-blue" alt="version">
     <img src="https://img.shields.io/badge/platform-macOS%20%2F%20Windows%20%2F%20Linux-lightgrey" alt="platform">
     <img src="https://img.shields.io/badge/chrome-MV3-green" alt="chrome manifest v3">
     <img src="https://img.shields.io/badge/node-%3E%3D20-brightgreen" alt="node version">
@@ -33,33 +33,33 @@ Either way, the final **Load unpacked** click is manual — Chrome does not let
 
 ### Option A — installer script (recommended)
 
-One command installs the native host **and** sets up the extension: the script registers the native host, places the extension folder at `~/Codex Overleaf Link Extension`, copies that path to your clipboard, and opens `chrome://extensions` for you.
+One command installs the managed native host **and** managed extension runtime. On macOS/Linux it also creates the visible `~/Codex Overleaf Link Extension` shortcut pointing to the managed extension, copies that path to your clipboard, and opens `chrome://extensions` for you. Future signed stable updates target this same managed directory.
 
 macOS / Linux:
 
 ```bash
-CODEX_OVERLEAF_REF=v1.9.0 bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.9.0/install.sh)"
+CODEX_OVERLEAF_REF=v1.9.2 bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.9.2/install.sh)"
 ```
 
 Windows PowerShell:
 
 ```powershell
-iwr https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.9.0/install.ps1 -OutFile install.ps1
-$env:CODEX_OVERLEAF_REF='v1.9.0'
+iwr https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.9.2/install.ps1 -OutFile install.ps1
+$env:CODEX_OVERLEAF_REF='v1.9.2'
 powershell -ExecutionPolicy Bypass -File install.ps1
 ```
 
 Then, in the `chrome://extensions` tab the script opened: enable **Developer mode**, click **Load unpacked**, and choose the prepared extension folder (its path is already on your clipboard). That is the only manual step.
 
-### Option B — npm (native host only)
+### Option B — npm managed install
 
-`npm exec` installs and updates the **native host only** — it does not include the Chrome extension. Use it if you prefer a pinned npm package to a source checkout.
+`npm exec` installs the same managed native host and extension runtime without keeping a source checkout. Use it if you prefer a pinned npm package.
 
 ```bash
-npm exec --yes codex-overleaf-link@1.9.0 -- install-managed
+npm exec --yes codex-overleaf-link@1.9.2 -- install-managed
 ```
 
-Then add the extension yourself: download `codex-overleaf-link-extension-v1.9.0.zip` from the [v1.9.0 GitHub Release](https://github.com/Ghqqqq/codex-overleaf-link/releases/tag/v1.9.0), unzip it to a stable folder, and in `chrome://extensions` enable **Developer mode**, click **Load unpacked**, and select that folder.
+Then, in `chrome://extensions`, enable **Developer mode**, click **Load unpacked**, and select the managed extension path printed by the command. The Release extension zip remains available for explicitly unmanaged/manual installations.
 
 ### Open Overleaf
 
@@ -80,31 +80,31 @@ Then load `extension/` as an unpacked extension in Chrome. If Chrome assigns a d
 
 </details>
 
-## npm Native Host CLI
+## npm Managed CLI
 
-npm installs, updates, uninstalls, and diagnoses the native host only. npm does not install the Chrome extension; install the Chrome extension separately from the release source checkout or extension zip.
+npm installs, updates, and uninstalls the coordinated managed extension/native pair. Diagnostics still target the native host. The legacy `install-native` command remains available only for explicitly unmanaged extension directories.
 
 | Action | Command |
 |--------|---------|
-| Install / update | `npm exec --yes codex-overleaf-link@1.9.0 -- install-managed` |
-| Diagnose | `npm exec --yes codex-overleaf-link@1.9.0 -- doctor` |
-| Uninstall | `npm exec --yes codex-overleaf-link@1.9.0 -- uninstall-managed` |
+| Install / update | `npm exec --yes codex-overleaf-link@1.9.2 -- install-managed` |
+| Diagnose | `npm exec --yes codex-overleaf-link@1.9.2 -- doctor` |
+| Uninstall | `npm exec --yes codex-overleaf-link@1.9.2 -- uninstall-managed` |
 
 Use `--extension-id <chrome-extension-id>` only for a custom/dev unpacked extension id that differs from the official bundled id.
 
 ## Update
 
-To update, re-run any of the [native host installers](#install) — they install and update the same way. This is also the native mismatch recovery command shown by the popup and panel when they report **Native host update required**; it fixes extension/native version mismatch and native protocol mismatch. After updating, reload the extension in `chrome://extensions` and refresh the Overleaf page.
+Managed installations discover signed stable updates automatically and apply them only while all Overleaf tabs and the native host are idle. Re-run `install-managed` only for recovery or migration, including when the panel reports **Native host update required**. Explicitly unmanaged installations still require a manual extension/native update. After recovery, reload the extension in `chrome://extensions` and refresh Overleaf.
 
 ## GitHub Release Artifacts
 
-The v1.9.0 GitHub Release contains:
+The v1.9.2 GitHub Release contains:
 
-- `codex-overleaf-link-extension-v1.9.0.zip`: loadable Chrome extension package for manual unpacked installation.
-- `codex-overleaf-native-host-v1.9.0.tar.gz`: native host runtime files used by the installer and release verification.
-- `codex-overleaf-link-1.9.0.tgz`: npm native host CLI package for pinned install, doctor, and uninstall flows.
-- `install.sh`: release-pinned macOS / Linux installer that defaults to `v1.9.0` when run directly from the release artifact.
-- `install.ps1`: release-pinned Windows PowerShell installer that defaults to `v1.9.0` when run directly from the release artifact.
+- `codex-overleaf-link-extension-v1.9.2.zip`: loadable Chrome extension package for manual unpacked installation.
+- `codex-overleaf-native-host-v1.9.2.tar.gz`: native host runtime files used by the installer and release verification.
+- `codex-overleaf-link-1.9.2.tgz`: npm native host CLI package for pinned install, doctor, and uninstall flows.
+- `install.sh`: release-pinned macOS / Linux installer that defaults to `v1.9.2` when run directly from the release artifact.
+- `install.ps1`: release-pinned Windows PowerShell installer that defaults to `v1.9.2` when run directly from the release artifact.
 - `uninstall-native-host.mjs`: native host uninstaller that removes the Chrome Native Messaging manifest, bridge executable, and runtime copy.
 - `nativeHostPlatform.js`, `manifest.js`, `runtimeInstaller.js`: helper files required by the loose uninstaller asset.
 - `SHA256SUMS` and `release-manifest.json`: checksum and artifact metadata for release verification.
@@ -115,7 +115,7 @@ The v1.9.0 GitHub Release contains:
 Remove the native host (use `--browser chromium` on Linux Chromium):
 
 ```bash
-npm exec --yes codex-overleaf-link@1.9.0 -- uninstall-managed
+npm exec --yes codex-overleaf-link@1.9.2 -- uninstall-managed
 ```
 
 The same command works on Windows PowerShell. If you installed from a manual checkout or source installer, you can also run `npm run uninstall:native` inside the repo, use `node ~/.codex-overleaf/source/scripts/uninstall-native-host.mjs` on macOS / Linux, or use `node $env:LOCALAPPDATA\CodexOverleaf\source\scripts\uninstall-native-host.mjs` on Windows PowerShell.
@@ -150,13 +150,13 @@ Then remove the extension from `chrome://extensions`. To delete local data: on m
 Linux Chromium install or update:
 
 ```bash
-CODEX_OVERLEAF_REF=v1.9.0 bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.9.0/install.sh)" -- --browser chromium
+CODEX_OVERLEAF_REF=v1.9.2 bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ghqqqq/codex-overleaf-link/v1.9.2/install.sh)" -- --browser chromium
 ```
 
 Linux Chromium uninstall:
 
 ```bash
-npm exec --yes codex-overleaf-link@1.9.0 -- uninstall-managed --browser chromium
+npm exec --yes codex-overleaf-link@1.9.2 -- uninstall-managed --browser chromium
 ```
 
 ## Features
@@ -291,7 +291,7 @@ Composer attachments are turn-scoped Codex context. Limits are 8 attachments per
 Re-run any [native host installer](#install), reload the extension in `chrome://extensions`, then refresh the Overleaf tab. This also fixes extension/native version mismatch and native protocol mismatch.
 
 ```bash
-npm exec --yes codex-overleaf-link@1.9.0 -- install-managed
+npm exec --yes codex-overleaf-link@1.9.2 -- install-managed
 ```
 
 **The Windows popup or panel shows a Bash recovery command**
@@ -340,8 +340,8 @@ Use this matrix for release-candidate signoff and compatibility reports. Record
 | Browser/channel/version | Google Chrome channel and version. | Google Chrome channel and version. | Google Chrome channel and version. | Chromium channel/package and version. |
 | Install mode | Manual unpacked extension from GitHub Release zip or checkout. | Manual unpacked extension from GitHub Release zip or checkout. | Manual unpacked extension from GitHub Release zip or checkout. | Manual unpacked extension from GitHub Release zip or checkout; native host installed with `--browser chromium`. |
 | Extension id | Bundled id `illdpneeeopfffmiepaejglgmhpmdhdc`, or actual custom id passed with `--extension-id`. | Bundled id `illdpneeeopfffmiepaejglgmhpmdhdc`, or actual custom id passed with `--extension-id`. | Bundled id `illdpneeeopfffmiepaejglgmhpmdhdc`, or actual custom id passed with `--extension-id`. | Bundled id `illdpneeeopfffmiepaejglgmhpmdhdc`, or actual custom id passed with `--extension-id`. |
-| Installer/update command | `npm exec --yes codex-overleaf-link@1.9.0 -- install-managed` | `npm exec --yes codex-overleaf-link@1.9.0 -- install-managed` | `npm exec --yes codex-overleaf-link@1.9.0 -- install-managed` | `npm exec --yes codex-overleaf-link@1.9.0 -- install-managed --browser chromium` |
-| Uninstall command | `npm exec --yes codex-overleaf-link@1.9.0 -- uninstall-managed` | `npm exec --yes codex-overleaf-link@1.9.0 -- uninstall-managed` | `npm exec --yes codex-overleaf-link@1.9.0 -- uninstall-managed` | `npm exec --yes codex-overleaf-link@1.9.0 -- uninstall-managed --browser chromium` |
+| Installer/update command | `npm exec --yes codex-overleaf-link@1.9.2 -- install-managed` | `npm exec --yes codex-overleaf-link@1.9.2 -- install-managed` | `npm exec --yes codex-overleaf-link@1.9.2 -- install-managed` | `npm exec --yes codex-overleaf-link@1.9.2 -- install-managed --browser chromium` |
+| Uninstall command | `npm exec --yes codex-overleaf-link@1.9.2 -- uninstall-managed` | `npm exec --yes codex-overleaf-link@1.9.2 -- uninstall-managed` | `npm exec --yes codex-overleaf-link@1.9.2 -- uninstall-managed` | `npm exec --yes codex-overleaf-link@1.9.2 -- uninstall-managed --browser chromium` |
 | Manifest/registry path | `~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.codex.overleaf.json` | `HKCU\Software\Google\Chrome\NativeMessagingHosts\com.codex.overleaf` -> `%LOCALAPPDATA%\CodexOverleaf\native-host-runtime\com.codex.overleaf.json` | `~/.config/google-chrome/NativeMessagingHosts/com.codex.overleaf.json` | `~/.config/chromium/NativeMessagingHosts/com.codex.overleaf.json` |
 | Bridge/runtime/source path | Bridge `~/.codex-overleaf/codex-overleaf-bridge`; runtime `~/.codex-overleaf/native-host-runtime`; source `~/.codex-overleaf/source`. | Bridge `%LOCALAPPDATA%\CodexOverleaf\codex-overleaf-bridge.cmd`; runtime `%LOCALAPPDATA%\CodexOverleaf\native-host-runtime`; source `%LOCALAPPDATA%\CodexOverleaf\source`. | Bridge `~/.codex-overleaf/codex-overleaf-bridge`; runtime `~/.codex-overleaf/native-host-runtime`; source `~/.codex-overleaf/source`. | Bridge `~/.codex-overleaf/codex-overleaf-bridge`; runtime `~/.codex-overleaf/native-host-runtime`; source `~/.codex-overleaf/source`. |
 | Node/Git/Codex/TeX | Node.js >= 20; Git; Codex CLI installed and logged in; TeX optional. | Node.js >= 20; Git; Codex CLI installed and logged in; TeX optional. | Node.js >= 20; Git; Codex CLI installed and logged in; TeX optional. | Node.js >= 20; Git; Codex CLI installed and logged in; TeX optional. |
@@ -377,7 +377,7 @@ Contributions are welcome. Please open an issue before submitting large changes
 The recommended v1.9 installation owns one stable unpacked-extension directory and a versioned native-host directory:
 
 ```bash
-npm exec --yes codex-overleaf-link@1.9.0 -- install-managed
+npm exec --yes codex-overleaf-link@1.9.2 -- install-managed
 ```
 
 Load the printed extension path once from `chrome://extensions`. Starting with the next signed stable release, Codex Overleaf Link checks GitHub Releases automatically, downloads and verifies the coordinated extension/native-host bundle, waits until every connected Overleaf tab is saved and idle, and then updates both components together. A failed health check restores the previous version automatically.
@@ -387,11 +387,11 @@ The stable updater ignores drafts and prereleases, performs no telemetry, and ca
 The legacy native-only installer remains available for source or unmanaged extension directories:
 
 ```bash
-npm exec --yes codex-overleaf-link@1.9.0 -- install-native
+npm exec --yes codex-overleaf-link@1.9.2 -- install-native
 ```
 
 Legacy native-only installations can be removed with:
 
 ```bash
-npm exec --yes codex-overleaf-link@1.9.0 -- uninstall-native
+npm exec --yes codex-overleaf-link@1.9.2 -- uninstall-native
 ```

package/extension/bootstrap/manifest.template.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Codex Overleaf Link",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Connect the active Overleaf project to a local Codex bridge.",
   "icons": {
     "16": "assets/icons/icon16.png",

package/extension/src/content/contentRuntime.js

@@ -88,11 +88,8 @@
     buildSnapshotRestoreUndo,
     buildUndoCheckpoint
   } = window.CodexOverleafUndoOperations;
-  const {
-    buildHumanCompletionReport,
-    mapAgentEventToActivity,
-    translateRawError
-  } = window.CodexOverleafAgentTranscript;
+  const { buildHumanCompletionReport, mapAgentEventToActivity, stripEmptyHtmlCommentPlaceholders,
+    translateRawError } = window.CodexOverleafAgentTranscript;
   const i18n = window.CodexOverleafI18n;
   const nativeChannel = window.CodexOverleafNativeChannel.create({
     chrome,
@@ -7040,19 +7037,24 @@
     const existing = [...events].reverse().find(item => item.kind === 'stream' && item.streamKey === streamKey);
     if (existing) {
       const nextTitle = sanitizeAssistantVisibleText(event.title);
-      existing.title = event.replaceText
+      const nextRole = sanitizeAssistantVisibleText(event.streamRole) || existing.streamRole;
+      const combinedTitle = event.replaceText
         ? nextTitle
         : sanitizeAssistantVisibleText(appendStreamText(existing.title, nextTitle));
+      existing.title = nextRole === 'reasoning' ? stripEmptyHtmlCommentPlaceholders(combinedTitle) : combinedTitle;
       existing.status = sanitizeAssistantVisibleText(event.status) || existing.status || 'running';
       existing.timestamp = event.timestamp || existing.timestamp;
-      existing.streamRole = sanitizeAssistantVisibleText(event.streamRole) || existing.streamRole;
+      existing.streamRole = nextRole;
       return existing;
     }
 
+    const streamRole = sanitizeAssistantVisibleText(event.streamRole);
+    const title = sanitizeAssistantVisibleText(event.title);
     const next = {
       ...event,
       streamKey,
-      title: sanitizeAssistantVisibleText(event.title)
+      streamRole,
+      title: streamRole === 'reasoning' ? stripEmptyHtmlCommentPlaceholders(title) : title
     };
     delete next.appendText;
     delete next.replaceText;

package/extension/src/content/runTimelineView.js

@@ -30,6 +30,7 @@
       renderMarkdownBlockText,
       sanitizeAssistantVisibleText,
       sanitizeAssistantVisibleValue,
+      stripEmptyHtmlCommentPlaceholders = value => value,
       buildMarkdownInlineNodes,
       getPanel,
       getState,
@@ -504,14 +505,18 @@
   }
 
   function sanitizeRunEventForRender(event = {}) {
+    const streamRole = sanitizeAssistantVisibleText(event.streamRole);
+    const title = sanitizeAssistantVisibleText(event.title);
     return {
       ...event,
-      title: sanitizeAssistantVisibleText(event.title),
+      title: streamRole === 'reasoning'
+        ? stripEmptyHtmlCommentPlaceholders(title)
+        : title,
       status: sanitizeAssistantVisibleText(event.status),
       detail: sanitizeAssistantVisibleValue(event.detail),
       technicalDetail: sanitizeAssistantVisibleValue(event.technicalDetail),
       streamKey: sanitizeAssistantVisibleText(event.streamKey),
-      streamRole: sanitizeAssistantVisibleText(event.streamRole)
+      streamRole
     };
   }
   function renderActivityLine(input) {

package/extension/src/shared/agentTranscript.js

@@ -355,7 +355,10 @@
       return mapThreadItemEvent(params.item, method === 'item/started', event, locale);
     }
     if (method === 'item/agentMessage/delta' || method === 'item/reasoning/summaryTextDelta') {
-      const title = cleanStreamDeltaText(params.delta || '');
+      const title = cleanStreamDeltaText(
+        params.delta || '',
+        method === 'item/reasoning/summaryTextDelta'
+      );
       if (!title.length) {
         return technicalOnly(event, locale);
       }
@@ -458,7 +461,7 @@
       }
     }
     if (item.type === 'reasoning') {
-      const summary = normalizeStringList(item.summary).at(-1);
+      const summary = stripEmptyHtmlCommentPlaceholders(normalizeStringList(item.summary).at(-1));
       if (!started && summary) {
         return {
           kind: 'stream',
@@ -1140,10 +1143,20 @@
     return String(text || '').replace(/\s+/g, ' ').trim();
   }
 
-  function cleanStreamDeltaText(text) {
-    return String(text || '')
+  function cleanStreamDeltaText(text, stripReasoningPlaceholders = false) {
+    const normalized = String(text || '')
       .replace(/\r\n?/g, '\n')
       .replace(/\u00a0/g, ' ');
+    return stripReasoningPlaceholders
+      ? stripEmptyHtmlCommentPlaceholders(normalized)
+      : normalized;
+  }
+
+  function stripEmptyHtmlCommentPlaceholders(text) {
+    return String(text || '')
+      .replace(/<!--[\t \r\n]*-->/g, '')
+      .replace(/(^|\n)[\t ]*<!--[\t ]*$/g, '$1')
+      .replace(/(^|\n)[\t ]*-->[\t ]*$/g, '$1');
   }
 
   function cleanVisibleMarkdownText(text) {
@@ -1571,6 +1584,7 @@
     formatFailureBlock,
     formatHumanReport,
     mapAgentEventToActivity,
+    stripEmptyHtmlCommentPlaceholders,
     translateRawError
   };
 });

package/extension/src/shared/compatibility.js

@@ -12,7 +12,7 @@
   const MIN_NATIVE_VERSION = '1.0.0';
   const MIN_COMPATIBLE_NATIVE_VERSION = '1.0.0';
   const MIN_COMPATIBLE_EXTENSION_VERSION = '1.0.0';
-  const BUILD_TARGET_VERSION = '1.9.0';
+  const BUILD_TARGET_VERSION = '1.9.2';
   const DEFAULT_CHROME_EXTENSION_ID = 'illdpneeeopfffmiepaejglgmhpmdhdc';
   const REQUIRED_CAPABILITIES = Object.freeze([
     'bridgePing',

package/native-host/src/codexSessionRunner.js

@@ -1125,8 +1125,8 @@ function isAllowedLocalCommand(params = {}) {
   }
 
   const allowed = new Set([
-    'rg', 'grep', 'cat', 'sed', 'head', 'tail', 'nl', 'find', 'ls',
-    'wc', 'diff', 'sort', 'tr', 'awk', 'printf', 'cut', 'uniq',
+    'rg', 'grep', 'cat', 'head', 'tail', 'nl', 'find', 'ls',
+    'wc', 'diff', 'sort', 'tr', 'printf', 'cut', 'uniq',
     'stat', 'file', 'basename', 'dirname', 'realpath',
     'shasum', 'md5', 'md5sum',
     'latexmk', 'pdflatex', 'xelatex', 'lualatex', 'bibtex', 'biber',
@@ -1201,13 +1201,34 @@ function isUnsafeShellToken(token) {
 function hasDisallowedCommandArguments(executable, args = []) {
   const flags = args.map(String);
   if (executable === 'find') {
-    return flags.some(flag => ['-exec', '-execdir', '-delete', '-ok', '-okdir'].includes(flag));
-  }
-  if (executable === 'sed') {
-    return flags.some(flag => flag === '-i' || /^-i[^a-zA-Z0-9]?/.test(flag));
-  }
-  if (executable === 'awk') {
-    return flags.some((flag, index) => flag === '-i' && flags[index + 1] === 'inplace');
+    return flags.some(flag => [
+      '-exec', '-execdir', '-delete', '-ok', '-okdir',
+      '-fprint', '-fprint0', '-fprintf', '-fls'
+    ].includes(flag));
+  }
+  if (executable === 'rg') {
+    return flags.some(flag => flag === '--pre' || flag.startsWith('--pre='));
+  }
+  if (executable === 'sort') {
+    return flags.some(flag => flag === '-o'
+      || flag.startsWith('-o')
+      || flag === '--output'
+      || flag.startsWith('--output=')
+      || flag === '-T'
+      || flag.startsWith('-T')
+      || flag === '--temporary-directory'
+      || flag.startsWith('--temporary-directory='));
+  }
+  if (executable === 'latexmk') {
+    return !flags.includes('-norc')
+      || flags.some(isUnsafeLatexmkArgument)
+      || flags.some(isUnsafeTexEngineArgument);
+  }
+  if (['pdflatex', 'xelatex', 'lualatex'].includes(executable)) {
+    if (executable === 'lualatex' && !flags.some(flag => flag === '--safer' || flag === '-safer')) {
+      return true;
+    }
+    return flags.some(isUnsafeTexEngineArgument);
   }
   if (executable === 'shasum' || executable === 'md5sum') {
     return flags.some(flag => flag === '-c' || flag === '--check');
@@ -1215,6 +1236,28 @@ function hasDisallowedCommandArguments(executable, args = []) {
   return false;
 }
 
+function isUnsafeLatexmkArgument(value) {
+  const flag = String(value || '').toLowerCase();
+  return /^-(?:e|r)(?:$|=)/.test(flag)
+    || /^-(?:usepretex|useposttex)(?:$|=)/.test(flag)
+    || /^-(?:pdflatex|xelatex|lualatex|latex|bibtex|biber|makeindex|dvi_filter|ps_filter|pdf_previewer)(?:$|=)/.test(flag);
+}
+
+function isUnsafeTexEngineArgument(value) {
+  const flag = String(value || '').toLowerCase();
+  if (/(?:shell-escape|shell-restricted|write18)/.test(flag)) {
+    return true;
+  }
+  if (/^--?(?:output-directory|aux-directory|outdir|auxdir)(?:$|=)/.test(flag)) {
+    return true;
+  }
+  if (flag === '-jobname' || flag === '--jobname') {
+    return true;
+  }
+  const jobName = flag.match(/^--?jobname=(.*)$/)?.[1] || '';
+  return Boolean(jobName && (jobName.includes('..') || /[\\/]/.test(jobName)));
+}
+
 function pathBasename(value) {
   return String(value || '').split(/[\\/]/).pop();
 }

package/native-host/src/mirrorWorkspace.js

@@ -42,8 +42,13 @@ async function syncOverleafToMirror({ projectId, project, rootDir }) {
   const previous = readBaseline(mirror.baselinePath);
   const fullProjectSnapshot = project?.capabilities?.fullProjectSnapshot !== false;
 
+  const mirrorRoot = path.dirname(mirror.projectRoot);
+  assertSafeMirrorPathBeforeCreate(mirror.workspacePath, mirrorRoot);
+  assertSafeMirrorPathBeforeCreate(mirror.metadataPath, mirrorRoot);
   fs.mkdirSync(mirror.workspacePath, { recursive: true });
   fs.mkdirSync(mirror.metadataPath, { recursive: true });
+  assertSafeMirrorPathBeforeCreate(mirror.workspacePath, mirrorRoot);
+  assertSafeMirrorPathBeforeCreate(mirror.metadataPath, mirrorRoot);
 
   if (fullProjectSnapshot) {
     for (const filePath of listWorkspaceFiles(mirror.workspacePath)) {
@@ -52,6 +57,7 @@ async function syncOverleafToMirror({ projectId, project, rootDir }) {
       }
       const target = resolveWorkspacePath(mirror.workspacePath, filePath);
       if (fs.existsSync(target)) {
+        assertSafeWorkspaceTarget(mirror.workspacePath, target, filePath);
         fs.rmSync(target, { force: true });
         removeEmptyParents(path.dirname(target), mirror.workspacePath);
       }
@@ -63,6 +69,7 @@ async function syncOverleafToMirror({ projectId, project, rootDir }) {
 
   for (const file of files) {
     const target = resolveWorkspacePath(mirror.workspacePath, file.path);
+    assertSafeWorkspaceTarget(mirror.workspacePath, target, file.path);
     const prev = previousByPath.get(file.path);
     const nextHash = hashProjectFile(file);
     if (prev && prev.hash === nextHash && workspaceFileMatchesBaseline(target, prev)) {
@@ -530,6 +537,9 @@ function listWorkspaceFiles(workspacePath) {
       }
       const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
       const absolute = path.join(dir, entry.name);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`Unsafe mirror symlink: ${relative}`);
+      }
       if (entry.isDirectory()) {
         walk(absolute, relative);
       } else if (entry.isFile()) {
@@ -753,6 +763,7 @@ async function applyFileOverlays({ projectId, overlays, rootDir }) {
     }
     const normalizedPath = normalizeRelativePath(overlay.path);
     const target = resolveWorkspacePath(mirror.workspacePath, normalizedPath);
+    assertSafeWorkspaceTarget(mirror.workspacePath, target, normalizedPath);
     fs.mkdirSync(path.dirname(target), { recursive: true });
     fs.writeFileSync(target, overlay.content, 'utf8');
 
@@ -803,6 +814,9 @@ async function confirmWritebackFiles({ projectId, paths, rootDir }) {
     } catch (error) {
       return { ok: false, reason: 'unsafe_path', path: normalizedPath };
     }
+    if (!isSafeWorkspaceWriteTarget(mirror.workspacePath, target)) {
+      return { ok: false, reason: 'unsafe_path', path: normalizedPath };
+    }
     let content;
     try {
       content = fs.readFileSync(target, 'utf8');
@@ -1017,6 +1031,34 @@ function isSafeWorkspaceWriteTarget(workspacePath, target) {
   }
 }
 
+function assertSafeWorkspaceTarget(workspacePath, target, filePath = '') {
+  if (!isSafeWorkspaceWriteTarget(workspacePath, target)) {
+    throw new Error(`Unsafe mirror path: ${filePath || target}`);
+  }
+}
+
+function assertSafeMirrorPathBeforeCreate(target, boundary) {
+  const root = path.resolve(boundary);
+  const resolvedTarget = path.resolve(target);
+  if (resolvedTarget === root || !resolvedTarget.startsWith(root + path.sep)) {
+    throw new Error(`Unsafe mirror root path: ${target}`);
+  }
+  let current = root;
+  const parts = path.relative(root, resolvedTarget).split(path.sep).filter(Boolean);
+  for (let index = -1; index < parts.length; index += 1) {
+    if (index >= 0) {
+      current = path.join(current, parts[index]);
+    }
+    if (!fs.existsSync(current)) {
+      continue;
+    }
+    const stat = fs.lstatSync(current);
+    if (stat.isSymbolicLink() || (index < parts.length - 1 && !stat.isDirectory())) {
+      throw new Error(`Unsafe mirror root path: ${current}`);
+    }
+  }
+}
+
 function markMirrorDirty({ projectId, rootDir, reason = 'dirty_mirror' }) {
   const mirror = getProjectMirror(projectId, { rootDir });
   const baseline = readBaseline(mirror.baselinePath);
@@ -1040,6 +1082,9 @@ function verifyWorkspaceMatchesBaseline(workspacePath, baselineFiles = []) {
     if (!fs.existsSync(target)) {
       return { ok: false, reason: 'workspace_mismatch', path: file.path };
     }
+    if (!isSafeWorkspaceWriteTarget(workspacePath, target)) {
+      return { ok: false, reason: 'unsafe_path', path: file.path };
+    }
     if (file.kind === 'binary') {
       if (hashBytes(fs.readFileSync(target)) !== file.hash) {
         return { ok: false, reason: 'workspace_mismatch', path: file.path };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-overleaf-link",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Cross-platform Chrome bridge that connects Codex to the active Overleaf project.",
   "license": "MIT",
   "type": "commonjs",