codex-overleaf-link 2.2.0 → 2.3.0

package/native-host/src/codexRuntimeIdentity.js

@@ -7,7 +7,7 @@ const { spawnSync } = require('node:child_process');
 
 const RUNTIME_ENV_KEY = 'CODEX_OVERLEAF_CODEX_RUNTIME_JSON';
 const MAX_CODEX_CANDIDATES = 8;
-const VERSION_TIMEOUT_MS = 700;
+const VERSION_TIMEOUT_MS = 3000;
 
 function buildCodexRuntimeIdentity(options = {}) {
   const env = options.env || process.env;

package/native-host/src/codexSessionRunner.js

@@ -10,7 +10,10 @@ const { computeTextPatches } = require('./textPatch');
 const { buildCodexHomeEnv } = require('./codexHome');
 const { buildCodexSpeedArgs } = require('./codexArgs');
 const { truncateText } = require('./debugLog');
-const { enforceNativeOkResponseBudget } = require('./nativeResponseBudget');
+const {
+  estimateBase64DecodedBytes,
+  reduceTaskResult
+} = require('./nativeTransportEnvelope');
 const { buildCodexTurnPrompt: buildCodexPromptParts } = require('./codexPromptAssembly');
 const { evaluateSkillCommand } = require('./commandApproval');
 const {
@@ -186,7 +189,7 @@ async function runCodexSession({ params = {}, env = process.env, emit = () => {}
   throwIfAborted(signal);
 
   if (skillInstallTurn) {
-    return enforceNativeOkResponseBudget({
+    return reduceTaskResult({
       status: 'completed',
       projectId: mirror.projectKey,
       workspacePath: mirror.workspacePath,
@@ -245,7 +248,7 @@ async function runCodexSession({ params = {}, env = process.env, emit = () => {}
       ignoredChangedCount: rawSyncChanges.length,
       ignoredUnsupportedCount: unsupportedChanges.length
     }, rawSyncChanges.length || unsupportedChanges.length ? 'warning' : 'completed');
-    return enforceNativeOkResponseBudget({
+    return reduceTaskResult({
       status: 'completed',
       projectId: mirror.projectKey,
       workspacePath: mirror.workspacePath,
@@ -266,7 +269,7 @@ async function runCodexSession({ params = {}, env = process.env, emit = () => {}
     }
     return change;
   });
-  const response = enforceNativeOkResponseBudget({
+  const response = reduceTaskResult({
     status: 'completed',
     projectId: mirror.projectKey,
     workspacePath: mirror.workspacePath,
@@ -370,15 +373,6 @@ function normalizeTurnAttachments(value) {
   return result;
 }
 
-function estimateBase64DecodedBytes(value) {
-  const clean = String(value || '').replace(/\s+/g, '');
-  if (!clean) {
-    return 0;
-  }
-  const padding = clean.endsWith('==') ? 2 : clean.endsWith('=') ? 1 : 0;
-  return Math.max(0, Math.floor(clean.length * 3 / 4) - padding);
-}
-
 function sanitizeAttachmentFileName(value) {
   const basename = String(value || '')
     .replace(/\0/g, '')

package/native-host/src/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 
-const { decodeFrames, encodeMessage } = require('./nativeMessaging');
+const { decodeInputFrames, encodeOutputFrame } = require('./nativeTransportEnvelope');
 const { logDebug } = require('./debugLog');
 const { handleRequest } = require('./taskRunner');
 const { abortAllActiveOperations, getActiveNativeWorkState } = require('./taskRunnerRuntime');
@@ -21,7 +21,7 @@ process.stdin.on('data', chunk => {
 
   let decoded;
   try {
-    decoded = decodeFrames(buffered);
+    decoded = decodeInputFrames(buffered);
   } catch (error) {
     writeResponse({
       ok: false,
@@ -111,24 +111,7 @@ function writeResponse(response) {
     logDebug('stdout.write_skipped', { ok: response?.ok, code: response?.error?.code });
     return false;
   }
-  let frame;
-  try {
-    frame = encodeMessage(response);
-  } catch (error) {
-    const fallback = buildOversizeResponseFallback(response, error);
-    try {
-      frame = encodeMessage(fallback);
-    } catch (fallbackError) {
-      frame = encodeMessage({
-        id: response?.id,
-        ok: false,
-        error: {
-          code: 'native_response_too_large',
-          message: truncateForNativeFrame(fallbackError.message || error.message || 'Native response exceeded the browser frame limit.', 800)
-        }
-      });
-    }
-  }
+  const frame = encodeOutputFrame(response);
   logDebug('stdout.write', { bytes: frame.length, ok: response?.ok, code: response?.error?.code });
   try {
     process.stdout.write(frame, error => {
@@ -168,55 +151,6 @@ function handleNativeDisconnect(source, error) {
   exitTimer.unref?.();
 }
 
-function buildOversizeResponseFallback(response, error) {
-  if (response?.event) {
-    const event = response.event || {};
-    return {
-      id: response.id,
-      ok: true,
-      event: {
-        type: event.type || 'native.event.truncated',
-        title: truncateForNativeFrame(event.title || 'Native event was truncated', 500),
-        status: event.status || 'warning',
-        detail: {
-          code: 'native_event_truncated',
-          reason: truncateForNativeFrame(error?.message || 'Native event exceeded the browser frame limit.', 800),
-          originalType: truncateForNativeFrame(event.type || '', 160),
-          originalTitle: truncateForNativeFrame(event.title || '', 500),
-          originalDetailBytes: stringByteLength(safeJsonStringify(event.detail))
-        },
-        timestamp: event.timestamp || new Date().toISOString()
-      }
-    };
-  }
-
-  return {
-    id: response?.id,
-    ok: false,
-    error: {
-      code: 'native_response_too_large',
-      message: truncateForNativeFrame(error?.message || 'Native response exceeded the browser frame limit.', 800),
-      originalOk: response?.ok === true
-    }
-  };
-}
-
-function truncateForNativeFrame(value, limit) {
-  const text = String(value || '');
-  if (text.length <= limit) {
-    return text;
-  }
-  return `${text.slice(0, Math.max(0, limit - 24))}... [truncated]`;
-}
-
-function safeJsonStringify(value) {
-  try {
-    return JSON.stringify(value);
-  } catch (_error) {
-    return '';
-  }
-}
-
 function summarizeRequest(message) {
   const params = message?.params || {};
   return {

package/native-host/src/managedInstall.js

@@ -54,14 +54,19 @@ function installManagedDistribution(options = {}) {
   const unique = process.pid + '-' + Date.now() + '-' + Math.random().toString(16).slice(2);
   const extensionStage = path.join(parent, '.extension.staging-' + unique);
   const extensionRollback = path.join(parent, '.extension.rollback-' + unique);
-  buildManagedExtensionTree({
-    packageRoot,
-    targetRoot: extensionStage,
-    version,
-    releaseRef,
-    releaseChannel,
-    allowedFiles: options.allowedFiles
-  });
+  try {
+    buildManagedExtensionTree({
+      packageRoot,
+      targetRoot: extensionStage,
+      version,
+      releaseRef,
+      releaseChannel,
+      allowedFiles: options.allowedFiles
+    });
+  } catch (error) {
+    safeRemove(extensionStage);
+    throw error;
+  }
 
   const previousExtensionMarker = readManagedMarker(extensionRoot, EXTENSION_MARKER);
   if (fs.existsSync(extensionRoot) && !isManagedMarker(previousExtensionMarker, 'extension')) {
@@ -145,6 +150,7 @@ function buildManagedExtensionTree(options = {}) {
   copyPackageTree(packageRoot, 'extension/vendor', targetRoot, 'runtime/vendor', { allowedFiles });
   copyPackageFile(packageRoot, 'extension/runtime-manifest.json', targetRoot, 'runtime/runtime-manifest.json', allowedFiles);
   rewriteManagedRuntimeAssetPaths(targetRoot);
+  assertManagedRuntimeManifestFiles(targetRoot);
   fs.writeFileSync(path.join(targetRoot, EXTENSION_MARKER), JSON.stringify({
     managedBy: MANAGED_BY,
     kind: 'extension',
@@ -413,6 +419,41 @@ function resolveForPlatform(value, platformPath) {
   return platformPath.isAbsolute(value) ? value : platformPath.resolve(value);
 }
 
+function assertManagedRuntimeManifestFiles(targetRoot) {
+  const runtimeRoot = path.join(targetRoot, 'runtime');
+  const runtimeManifest = readJson(path.join(runtimeRoot, 'runtime-manifest.json'));
+  const runtimeFiles = [
+    ...(Array.isArray(runtimeManifest.js) ? runtimeManifest.js : []),
+    ...(Array.isArray(runtimeManifest.css) ? runtimeManifest.css : [])
+  ];
+  const missing = [];
+
+  for (const relativePath of runtimeFiles) {
+    if (
+      typeof relativePath !== 'string'
+      || relativePath.length === 0
+      || path.isAbsolute(relativePath)
+      || relativePath.split(/[\\/]+/).includes('..')
+    ) {
+      throw new Error('Managed runtime manifest contains an unsafe path: ' + String(relativePath));
+    }
+    const filePath = path.resolve(runtimeRoot, relativePath);
+    const relativeToRuntime = path.relative(runtimeRoot, filePath);
+    if (
+      relativeToRuntime.startsWith('..')
+      || path.isAbsolute(relativeToRuntime)
+      || !fs.existsSync(filePath)
+      || !fs.statSync(filePath).isFile()
+    ) {
+      missing.push(relativePath);
+    }
+  }
+
+  if (missing.length > 0) {
+    throw new Error('Managed runtime is incomplete; missing file(s): ' + missing.join(', '));
+  }
+}
+
 function safeRemove(target) {
   fs.rmSync(target, { recursive: true, force: true });
 }
@@ -425,6 +466,7 @@ module.exports = {
   EXTENSION_MARKER,
   MANAGED_BY,
   NATIVE_MARKER,
+  assertManagedRuntimeManifestFiles,
   assertSafeManagedRoot,
   buildManagedExtensionTree,
   installManagedDistribution,

package/native-host/src/mirrorWorkspace.js

@@ -124,13 +124,15 @@ async function collectMirrorChangesDetailed({ projectId, rootDir }) {
     const previous = baselineByPath.get(filePath);
     const target = resolveWorkspacePath(mirror.workspacePath, filePath);
     const stat = fs.statSync(target);
-    if (!previous && isGeneratedArtifactPath(filePath, baselineByPath)) {
-      unsupportedChanges.push({
-        type: 'unsupported-local-file',
-        path: filePath,
-        reason: 'generated_artifact',
-        size: stat.size
-      });
+    if (isGeneratedArtifactPath(filePath, baselineByPath)) {
+      if (!previous || !workspaceFileMatchesBaseline(target, previous)) {
+        unsupportedChanges.push({
+          type: 'unsupported-local-file',
+          path: filePath,
+          reason: 'generated_artifact',
+          size: stat.size
+        });
+      }
       continue;
     }
     if (isSupportedBinaryAssetPath(filePath)) {
@@ -602,7 +604,12 @@ function hasMatchingRootSourceFile(normalizedPdfPath, baselineByPath) {
     return true;
   }
   const stem = normalizedPdfPath.replace(/\.pdf$/i, '');
-  return baselineByPath.has(`${stem}.tex`) || stem === 'main' || stem === 'output';
+  const sourcePath = `${stem}.tex`;
+  const hasMatchingSource = baselineByPath.has(sourcePath)
+    || Array.from(baselineByPath.keys()).some(filePath =>
+      normalizeRelativePath(filePath).toLowerCase() === sourcePath
+    );
+  return hasMatchingSource || stem === 'main' || stem === 'output';
 }
 
 function isSupportedBinaryAssetPath(filePath) {

package/native-host/src/nativeTransportEnvelope.js

@@ -0,0 +1,148 @@
+'use strict';
+
+const {
+  MAX_NATIVE_OUTPUT_MESSAGE_BYTES,
+  decodeFrames,
+  encodeMessage
+} = require('./nativeMessaging');
+const nativeQuotas = require('./nativeQuotas');
+const {
+  enforceNativeOkResponseBudget,
+  truncateUtf8Text
+} = require('./nativeResponseBudget');
+
+function decodeInputFrames(buffer) {
+  return decodeFrames(buffer);
+}
+
+function encodeOutputFrame(response) {
+  try {
+    return encodeMessage(response);
+  } catch (error) {
+    const fallback = buildOversizeResponseFallback(response, error);
+    try {
+      return encodeMessage(fallback);
+    } catch (fallbackError) {
+      return encodeMessage(buildFinalOversizeError(response, fallbackError, error));
+    }
+  }
+}
+
+  function getRequestQuotaViolation(request) {
+    if (typeof request?.id === "string" && request.id.length > 160) {
+      return {
+        field: "id",
+        limit: 160,
+        actual: request.id.length,
+        reason: "request id is too large"
+      };
+    }
+    return nativeQuotas.validateNativeRequestQuotas(request);
+  }
+
+function reduceTaskResult(result) {
+  return enforceNativeOkResponseBudget(result);
+}
+
+function buildOversizeResponseFallback(response, error) {
+  if (response?.event) {
+    const event = response.event || {};
+    return {
+      id: boundedResponseId(response.id),
+      ok: true,
+      event: {
+        type: event.type || 'native.event.truncated',
+        title: truncateForNativeFrame(event.title || 'Native event was truncated', 500),
+        status: event.status || 'warning',
+        detail: {
+          code: 'native_event_truncated',
+          reason: truncateForNativeFrame(
+            error?.message || 'Native event exceeded the browser frame limit.',
+            800
+          ),
+          originalType: truncateForNativeFrame(event.type || '', 160),
+          originalTitle: truncateForNativeFrame(event.title || '', 500),
+          originalDetailBytes: measureJsonBytes(event.detail)
+        },
+        timestamp: event.timestamp || new Date().toISOString()
+      }
+    };
+  }
+
+  return {
+    id: boundedResponseId(response?.id),
+    ok: false,
+    error: {
+      code: 'native_response_too_large',
+      message: truncateForNativeFrame(
+        error?.message || 'Native response exceeded the browser frame limit.',
+        800
+      ),
+      originalOk: response?.ok === true
+    }
+  };
+}
+
+function buildFinalOversizeError(response, fallbackError, originalError) {
+  return {
+    id: boundedResponseId(response?.id),
+    ok: false,
+    error: {
+      code: 'native_response_too_large',
+      message: truncateForNativeFrame(
+        fallbackError?.message
+          || originalError?.message
+          || 'Native response exceeded the browser frame limit.',
+        800
+      )
+    }
+  };
+}
+
+function boundedResponseId(value) {
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    return value;
+  }
+  return truncateForNativeFrame(value, 160);
+}
+
+function measureJsonBytes(value) {
+  try {
+    return Buffer.byteLength(JSON.stringify(value), 'utf8');
+  } catch (_error) {
+    return 0;
+  }
+}
+
+function truncateForNativeFrame(value, maxChars) {
+  const text = String(value || '');
+  if (text.length <= maxChars) {
+    return text;
+  }
+  return `${text.slice(0, Math.max(0, maxChars - 24))}... [truncated]`;
+}
+
+module.exports = {
+  MAX_NATIVE_OUTPUT_MESSAGE_BYTES,
+  NATIVE_REQUEST_QUOTAS: nativeQuotas.NATIVE_REQUEST_QUOTAS,
+  buildOversizeResponseFallback,
+  decodeInputFrames,
+  encodeOutputFrame,
+  estimateBase64DecodedBytes: nativeQuotas.estimateBase64DecodedBytes,
+  firstQuotaViolation: nativeQuotas.firstQuotaViolation,
+  getRequestQuotaViolation,
+  measureJsonBytes,
+  measureOperationPayloads: nativeQuotas.measureOperationPayloads,
+  quotaViolation: nativeQuotas.quotaViolation,
+  reduceTaskResult,
+  truncateForNativeFrame,
+  truncateUtf8Text,
+  validateAttachmentQuota: nativeQuotas.validateAttachmentQuota,
+  validateCompileLogQuota: nativeQuotas.validateCompileLogQuota,
+  validateFilePayloadQuota: nativeQuotas.validateFilePayloadQuota,
+  validateOperationListQuota: nativeQuotas.validateOperationListQuota,
+  validateOperationPayloadQuota: nativeQuotas.validateOperationPayloadQuota,
+  validatePatchFileTextQuota: nativeQuotas.validatePatchFileTextQuota,
+  validateProjectSnapshotQuota: nativeQuotas.validateProjectSnapshotQuota,
+  validateSkillContentQuota: nativeQuotas.validateSkillContentQuota
+};

package/native-host/src/taskRunnerRuntime.js

@@ -26,10 +26,10 @@ const { getNativeRuntimePlatform, summarizeNativeEnvironment } = require('./nati
 const {
   NATIVE_REQUEST_QUOTAS,
   firstQuotaViolation,
-  validateNativeRequestQuotas,
+  getRequestQuotaViolation,
   validateOperationListQuota,
   validateOperationPayloadQuota
-} = require('./nativeQuotas');
+} = require('./nativeTransportEnvelope');
 const { version: PACKAGE_VERSION } = require('../../package.json');
 
 const activeProjectLocks = new Map();
@@ -49,7 +49,7 @@ async function handleRequest(request, env = process.env, emit = () => {}) {
     return errorResponse(undefined, 'invalid_request', 'Request must be an object');
   }
 
-  const quotaError = validateNativeRequestQuotas(request);
+  const quotaError = getRequestQuotaViolation(request);
   if (quotaError) {
     return quotaErrorResponse(request.id, quotaError);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-overleaf-link",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Cross-platform Chrome bridge that connects Codex to the active Overleaf project.",
   "license": "MIT",
   "type": "commonjs",
@@ -14,14 +14,19 @@
   "homepage": "https://github.com/Ghqqqq/codex-overleaf-link#readme",
   "scripts": {
     "agent:codex": "node scripts/codex-json-agent.mjs",
-    "test": "node scripts/run-tests.mjs",
+    "build:content": "node scripts/build-content-bundle.mjs",
+    "check:module-graph": "node scripts/check-content-module-graph.mjs",
+    "test": "npm run check:module-graph && node scripts/run-tests.mjs",
     "check:architecture": "node scripts/check-architecture-budget.mjs --enforce-target",
     "benchmark:large": "node scripts/benchmark-large-project.mjs --gate",
-    "smoke:extension": "node scripts/smoke-extension.mjs",
+    "smoke:extension": "npm run build:content && node scripts/smoke-extension.mjs",
     "verify:release": "node scripts/verify-release.mjs",
+    "verify:source": "node scripts/verify-release.mjs --source-hygiene-only",
     "verify:release-artifacts": "node scripts/verify-release-artifacts.mjs",
     "verify:update-boundary": "node scripts/verify-update-boundary.mjs",
     "verify:update-hop": "node scripts/verify-update-hop.mjs",
+    "verify:update-hop:local": "node scripts/verify-update-hop.mjs --local-test-key",
+    "rehearse:update-hop": "npm run build:release && npm run verify:update-hop:local",
     "build:release": "node scripts/build-release.mjs",
     "sign:release": "node scripts/sign-release-manifest.mjs",
     "install:managed": "node scripts/install-managed.mjs",
@@ -30,7 +35,7 @@
     "uninstall:native": "node scripts/uninstall-native-host.mjs",
     "bridge": "node native-host/src/index.js",
     "verify:npm-package": "node scripts/verify-npm-package.mjs",
-    "pack:npm": "node scripts/verify-npm-package.mjs --pack"
+    "pack:npm": "npm run build:content && node scripts/verify-npm-package.mjs --pack"
   },
   "engines": {
     "node": ">=20"
@@ -56,5 +61,8 @@
     "scripts/verify-npm-package.mjs",
     "README.md",
     "package.json"
-  ]
+  ],
+  "devDependencies": {
+    "esbuild": "0.28.1"
+  }
 }