codex-overleaf-link 2.3.5 → 2.3.6

package/extension/src/shared/sessionTitle.js

@@ -0,0 +1,120 @@
+(function initSessionTitle(root, factory) {
+  if (typeof module === 'object' && module.exports) {
+    module.exports = factory();
+  } else {
+    root.CodexOverleafModuleRegistry.define('SessionTitle', [], factory);
+  }
+})(typeof globalThis !== 'undefined' ? globalThis : window, function sessionTitleFactory() {
+  'use strict';
+
+  const INPUT_LIMIT = 12000;
+  const STORAGE_LIMIT = 80;
+  const segmenter = typeof Intl !== 'undefined' && typeof Intl.Segmenter === 'function'
+    ? new Intl.Segmenter(undefined, { granularity: 'grapheme' }) : null;
+  const FILE_TOKEN = /@file:(?:"([^"]+)"|'([^']+)'|([^\s]+))/g;
+
+  function derive(runs, task, options = {}) {
+    let fallback = '';
+    for (const run of Array.isArray(runs) ? runs : []) {
+      const candidate = fromPrompt(run?.task, options);
+      fallback ||= candidate;
+      if (candidate && !isGeneric(candidate)) return candidate;
+    }
+    const draft = fromPrompt(task, options);
+    return draft && !isGeneric(draft) ? draft : fallback || draft;
+  }
+
+  function fromPrompt(value, { sanitize = text => text, maxChars = 24 } = {}) {
+    if (typeof value !== 'string' || !value.trim()) return '';
+    const source = String(sanitize(value.slice(0, INPUT_LIMIT)) || '');
+    let fence = null;
+    let fallback = '';
+    for (const rawLine of source.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      const marker = /^(`{3,}|~{3,})(.*)$/.exec(line);
+      if (marker) {
+        if (!fence) {
+          fence = marker[1];
+          const language = marker[2].trim().match(/^[A-Za-z0-9_+-]{1,24}\b/)?.[0] || 'code';
+          fallback ||= `${language} snippet`;
+        } else if (marker[1][0] === fence[0] && marker[1].length >= fence.length && !marker[2].trim()) {
+          fence = null;
+        }
+        continue;
+      }
+      if (fence || !line || /^>/.test(line)) continue;
+      const withoutContext = line.replace(FILE_TOKEN, ' ').replace(/@(context|compile-log)\b/g, ' ').trim();
+      const cleaned = cleanLine(line);
+      if (!withoutContext || /^https?:\/\/\S+$/i.test(line)) {
+        fallback ||= cleaned;
+        continue;
+      }
+      for (const sentence of cleaned.split(/[\u3002\uff01\uff1f]+/u)) {
+        const candidate = sentence.trim().replace(/[,;:\uff0c\uff1b\uff1a]+$/u, '').trim();
+        if (!/[\p{L}\p{N}]/u.test(candidate) || isScaffolding(candidate)) continue;
+        fallback ||= candidate;
+        if (!isGeneric(candidate)) return shorten(candidate, maxChars);
+      }
+    }
+    return shorten(fallback, maxChars);
+  }
+
+  function cleanLine(value) {
+    return value
+      .replace(/^#{1,6}\s+/, '')
+      .replace(/^(?:[-*+]\s+|\d+\.\s+|\d+[)\u3001]\s*)/, '')
+      .replace(FILE_TOKEN, (_match, quoted, singleQuoted, bare) =>
+        String(quoted || singleQuoted || bare || '').replace(/\\/g, '/').split('/').pop())
+      .replace(/@(context|compile-log)\b/g, ' ')
+      .replace(/!?\[([^\]]*)\]\([^\n)]*\)/g, '$1')
+      .replace(/`([^`]+)`/g, '$1')
+      .replace(/\*\*([^*]+)\*\*/g, '$1')
+      .replace(/https?:\/\/\S+/gi, address => {
+        try { return new URL(address).hostname; } catch (_error) { return ''; }
+      })
+      .replace(/\[(?:REDACTED_SECRET|local path(?::\d+)?)\]/gi, ' ')
+      .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
+      .replace(/\s+/g, ' ').trim()
+      .replace(/^(?:\u8bf7(?:\u4f60)?\u5e2e\u6211|\u8bf7\u4f60|\u5e2e\u6211|\u9ebb\u70e6\u4f60(?:\u5e2e\u6211)?|\u9ebb\u70e6\u5e2e\u6211|please\s+)\s*/i, '');
+  }
+
+  function isScaffolding(value) {
+    return /^(?:my request(?: for [^:]+)?|request|task|context|files(?: mentioned by [^:]+)?|attachments|\u6211\u7684\u8bf7\u6c42|\u9700\u6c42|\u4efb\u52a1|\u4e0a\u4e0b\u6587|\u9644\u4ef6|\u6587\u4ef6)$/i.test(value);
+  }
+
+  function isGeneric(value) {
+    const text = String(value || '').trim().replace(/[\s.!?\u3002\uff1f\uff01\u2026]+$/u, '');
+    if (!text || Array.from(text).length < 2) return true;
+    return /^(?:ok(?:ay)?|yes|no|go|done|continue|proceed|thanks?|thank you|hello|hi|test|new task|untitled task|\u597d(?:\u7684)?|\u53ef\u4ee5|\u7ee7\u7eed|\u786e\u8ba4|\u786e\u5b9a|\u6536\u5230|\u8c22\u8c22|\u6d4b\u8bd5|\u6267\u884c|\u662f\u7684|\u4f60\u597d)$/i.test(text)
+      || /^[A-Za-z0-9_+-]{1,24} snippet$/i.test(text)
+      || /^[^\s]+\.(?:tex|bib|md|txt|pdf|svg|png|jpe?g|webp)(?::\d+)?$/i.test(text)
+      || /^(?:[A-Za-z0-9-]+\.)+[A-Za-z]{2,}$/i.test(text);
+  }
+
+  function shorten(value, maxChars) {
+    const title = String(value || '').trim();
+    if (!title) return '';
+    const chars = Number.isFinite(maxChars) && maxChars > 0 ? Math.min(40, Math.floor(maxChars)) : 24;
+    const maxUnits = chars * 2;
+    const glyphs = segmenter
+      ? Array.from(segmenter.segment(title), item => item.segment) : Array.from(title);
+    const width = glyph => /[^\u0000-\u00ff]/u.test(glyph) ? 2 : 1;
+    if (title.length <= STORAGE_LIMIT && glyphs.reduce((total, glyph) => total + width(glyph), 0) <= maxUnits) return title;
+    let prefix = '';
+    let units = 0;
+    let index = 0;
+    for (; index < glyphs.length; index++) {
+      const glyph = glyphs[index];
+      if (units + width(glyph) > maxUnits - 2 || prefix.length + glyph.length > STORAGE_LIMIT - 1) break;
+      prefix += glyph;
+      units += width(glyph);
+    }
+    const boundary = prefix.lastIndexOf(' ');
+    if (/[A-Za-z0-9]$/.test(prefix) && /^[A-Za-z0-9]/.test(glyphs[index] || '') && boundary >= prefix.length * 0.6) {
+      prefix = prefix.slice(0, boundary);
+    }
+    return prefix.trimEnd().replace(/[,;:\uff0c\uff1b\uff1a]+$/u, '') + '\u2026';
+  }
+
+  return Object.freeze({ derive, fromPrompt, isGeneric });
+});

package/extension/src/shared/updateRuntimeIdentity.js

@@ -0,0 +1,32 @@
+(function (root, factory) {
+  const api = factory();
+  if (typeof module === 'object' && module.exports) module.exports = api;
+  if (root) root.CodexOverleafUpdateRuntimeIdentity = api;
+})(typeof globalThis !== 'undefined' ? globalThis : this, function () {
+  'use strict';
+
+  function version(value) { return /^\d+\.\d+\.\d+$/.test(String(value || '')) ? String(value) : ''; }
+  function compare(left, right) {
+    const a = left.split('.').map(Number);
+    const b = right.split('.').map(Number);
+    return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+  }
+
+  function inspectInstalledRuntime(status = {}, options = {}) {
+    const result = { installedVersion: version(status.activeVersion), nativeVersion: version(status.runtimeVersion),
+      extensionVersion: version(options.extensionVersion), runtimeVersion: version(options.runtimeVersion), state: 'unknown' };
+    if (!status.managed || !result.installedVersion || !result.nativeVersion ||
+        !result.extensionVersion || !result.runtimeVersion) return result;
+    if (['authorized', 'bound'].includes(status.authorization?.state) ||
+        ['staged', 'activation_pending', 'applying', 'awaiting_health'].includes(status.transaction?.state)) {
+      return { ...result, state: 'transaction_active' };
+    }
+    if (status.installedAligned !== true) return { ...result, state: 'repair_required' };
+    const loaded = [result.nativeVersion, result.extensionVersion, result.runtimeVersion];
+    if (loaded.every(value => value === result.installedVersion)) return { ...result, state: 'aligned' };
+    return { ...result, state: loaded.every(value => compare(result.installedVersion, value) >= 0)
+      ? 'reload_required' : 'repair_required' };
+  }
+
+  return Object.freeze({ inspectInstalledRuntime });
+});

package/extension/styles/panel.css

@@ -1581,7 +1581,7 @@
 
 #codex-overleaf-panel .codex-set-row-help {
   margin: 0;
-  color: var(--tl-fg-4);
+  color: var(--tl-fg-3);
   font-size: 11px;
   line-height: 1.45;
 }
@@ -2170,7 +2170,7 @@
   padding: 4px 10px;
   font-size: 11px;
   cursor: pointer;
-  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.35);
+  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.12);
   animation: tl-fade-in 120ms ease-out;
 }
 
@@ -2185,6 +2185,32 @@
   border-color: var(--tl-border-strong);
 }
 
+/* Let the browser anchor backscroll while the reader is detached. */
+#codex-overleaf-panel [data-log][data-log-auto-follow="false"],
+#codex-overleaf-panel [data-main][data-log-auto-follow="false"] {
+  overflow-anchor: auto;
+}
+
+#codex-overleaf-panel :is(.run-copy-action, .run-fork-action, .tl-jump-latest, .run-final-answer__recovery-action):focus-visible {
+  outline: 2px solid var(--tl-accent);
+  outline-offset: 2px;
+}
+
+#codex-overleaf-panel :is(input, textarea)::placeholder {
+  color: var(--tl-fg-3);
+  opacity: 1;
+}
+
+.codex-provider-dialog-root .codex-provider-field :is(input, textarea)::placeholder {
+  color: var(--provider-muted);
+  opacity: 1;
+}
+
+.codex-provider-dialog-root :is(button, input, textarea, select):focus-visible {
+  outline: 2px solid var(--provider-accent);
+  outline-offset: 2px;
+}
+
 /* Active-session bar: the title on the left, rename + delete on the right, so
    the session you are working in can be renamed/deleted in place. */
 #codex-overleaf-panel .codex-thread-title {
@@ -3084,13 +3110,13 @@
 }
 
 #codex-overleaf-panel .run-final-answer .run-system-label {
-  color: var(--tl-accent);
+  color: var(--tl-fg-3);
   font-weight: 650;
   letter-spacing: 0.01em;
 }
 
 #codex-overleaf-panel .run-completion-report[data-status="failed"] .run-system-label[data-system-label="conclusion"] {
-  color: var(--tl-fail);
+  color: var(--tl-fg-3);
 }
 
 #codex-overleaf-panel .run-final-answer .run-change-summary {
@@ -3179,9 +3205,8 @@
 }
 
 #codex-overleaf-panel .run-final-answer__meta {
-  margin: 10px 0 0;
-  padding: 8px 0 0;
-  border-top: 1px solid var(--tl-border);
+  margin: 14px 0 0;
+  padding: 0;
   display: grid;
   grid-template-columns: max-content 1fr;
   column-gap: 12px;
@@ -3205,18 +3230,15 @@
 }
 
 #codex-overleaf-panel .run-completion-report[data-status="failed"] {
-  color: var(--tl-fail);
+  color: var(--tl-fg-2);
 }
 
-/* .run-final-answer resets color to fg-1 for normal reports; a failed report's
-   conclusion must keep the alert color or failure reads like success. */
+/* Failure severity belongs to the status header and compact notice. */
 #codex-overleaf-panel .run-completion-report[data-status="failed"] .run-final-answer {
-  color: var(--tl-fail);
+  color: var(--tl-fg-2);
 }
 
-/* Failed-status reports keep their alert color for the conclusion, but the
-   meta block stays muted so it still reads as system info rather than amplifying
-   the alert. */
+/* Keep system metadata subordinate to the answer in both themes. */
 #codex-overleaf-panel .run-completion-report[data-status="failed"] .run-final-answer__meta,
 #codex-overleaf-panel .run-completion-report[data-status="failed"] .run-final-answer__meta-value {
   color: var(--tl-fg-3);
@@ -3252,6 +3274,43 @@
   opacity: 0.6;
 }
 
+#codex-overleaf-panel .run-feedback {
+  display: grid;
+  gap: 5px;
+  margin: 12px 0 0;
+  padding: 10px 12px;
+  border-radius: 8px;
+  background: var(--tl-surface-2);
+  color: var(--tl-fg-2);
+  font-size: 12px;
+  line-height: 1.5;
+  overflow-wrap: anywhere;
+}
+
+#codex-overleaf-panel .run-feedback p { margin: 0; }
+#codex-overleaf-panel .run-feedback__title { color: var(--tl-fail); font-weight: 650; }
+#codex-overleaf-panel .run-feedback[data-tone="warning"] .run-feedback__title { color: var(--tl-review); }
+#codex-overleaf-panel .run-feedback .run-final-answer__recovery-action {
+  justify-self: start;
+  margin: 3px 0 0;
+  padding: 3px 0;
+  border: 0;
+  background: transparent;
+  color: var(--tl-accent);
+  font-weight: 600;
+}
+
+#codex-overleaf-panel :is(.run-copy-action, .run-fork-action) {
+  color: var(--tl-fg-3);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  #codex-overleaf-panel :is(.tl-jump-latest, .run-copy-action, .run-fork-action, .run-final-answer__recovery-action) {
+    animation: none;
+    transition: none;
+  }
+}
+
 #codex-overleaf-panel .codex-probe-line {
   flex: 0 0 auto;
   min-height: 18px;

package/native-host/src/mirrorWorkspace.js

@@ -712,6 +712,22 @@ function getMirrorStatus(projectId, options = {}) {
   };
 }
 
+function normalizeObservedPatchTime(value, fallback) {
+  const candidate = value == null ? fallback : value;
+  const timestamp = typeof candidate === 'number'
+    ? candidate
+    : typeof candidate === 'string' ? Date.parse(candidate) : NaN;
+  return Number.isFinite(timestamp) && Math.abs(timestamp) <= 8640000000000000
+    ? new Date(timestamp).toISOString()
+    : '';
+}
+
+function isFreshOtObservation(freshness) {
+  const timestamp = Date.parse(freshness?.observedAt ?? freshness?.lastPatchAt ?? '');
+  const ageMs = Date.now() - timestamp;
+  return Number.isFinite(timestamp) && ageMs >= 0 && ageMs <= 30000;
+}
+
 function buildOtStatusFields(baseline = {}, trusted) {
   const metadata = {
     lastOtPatchAt: baseline.lastOtPatchAt || '',
@@ -727,13 +743,15 @@ function buildOtStatusFields(baseline = {}, trusted) {
   }
   const textFiles = (baseline.files || []).filter(file => file?.kind === 'text');
   const freshFiles = textFiles
-    .filter(file => file.freshness?.source === 'ot' && file.freshness?.state === 'fresh')
+    .filter(file => file.freshness?.source === 'ot' && file.freshness?.state === 'fresh'
+      && isFreshOtObservation(file.freshness))
     .map(file => ({
       path: file.path,
       source: file.freshness.source,
       state: file.freshness.state,
       lastFullSyncAt: file.freshness.lastFullSyncAt || '',
       lastPatchAt: file.freshness.lastPatchAt || '',
+      observedAt: file.freshness.observedAt ?? file.freshness.lastPatchAt ?? '',
       observedVersion: file.freshness.observedVersion ?? null
     }))
     .sort((left, right) => left.path.localeCompare(right.path));
@@ -935,6 +953,7 @@ async function patchMirrorFiles({ projectId, files, rootDir, source = 'ot' }) {
         state: 'fresh',
         lastFullSyncAt: baseline.lastFullSyncAt || '',
         lastPatchAt: patchBatchAt,
+        observedAt: normalizeObservedPatchTime(patch.observedAt, patchBatchAt),
         observedVersion: patch.observedVersion ?? null
       }
     };

package/native-host/src/releaseProxy.js

@@ -0,0 +1,177 @@
+'use strict';
+
+const http = require('node:http');
+const https = require('node:https');
+const tls = require('node:tls');
+const net = require('node:net');
+const { Readable } = require('node:stream');
+const { execFileSync } = require('node:child_process');
+const { updateError } = require('./updateTrust');
+let systemCache = { platform: '', at: 0, text: '' };
+
+function proxyError(code, message, retryable = false) {
+  return Object.assign(updateError(code, message), { retryable });
+}
+
+function bypassProxy(url, values = '') {
+  const host = url.hostname.toLowerCase();
+  const port = url.port || (url.protocol === 'https:' ? '443' : '80');
+  return String(values).split(/[,;\s]+/).some(raw => {
+    if (!raw) return false;
+    if (raw === '*') return true;
+    if (raw === '<local>') return !host.includes('.');
+    const match = raw.toLowerCase().match(/^(.*?)(?::(\d+))?$/);
+    if (match[2] && match[2] !== port) return false;
+    const domain = match[1].replace(/^\*?\./, '');
+    return host === domain || host.endsWith('.' + domain);
+  });
+}
+
+function readSystemProxy(platform) {
+  if (systemCache.platform === platform && Date.now() - systemCache.at < 30000) return systemCache.text;
+  let text = '';
+  try {
+    const command = platform === 'darwin' ? '/usr/sbin/scutil' : 'reg.exe';
+    const args = platform === 'darwin' ? ['--proxy']
+      : ['query', 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings'];
+    text = execFileSync(command, args, { encoding: 'utf8', timeout: 1000, maxBuffer: 32768,
+      windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch (_error) { /* environment proxies and direct access remain available */ }
+  systemCache = { platform, at: Date.now(), text };
+  return text;
+}
+
+function resolveReleaseProxy(value, options = {}) {
+  const url = new URL(value);
+  const env = options.env || process.env;
+  if (bypassProxy(url, env.NO_PROXY || env.no_proxy)) return null;
+  const protocol = url.protocol === 'https:' ? 'HTTPS' : 'HTTP';
+  let configured = env[protocol + '_PROXY'] || env[protocol.toLowerCase() + '_proxy'] || env.ALL_PROXY || env.all_proxy;
+  let source = 'environment';
+  const platform = options.platform || process.platform;
+  if (!configured && ['darwin', 'win32'].includes(platform)) {
+    source = 'system';
+    const text = (options.systemProxy || readSystemProxy)(platform);
+    if (platform === 'darwin') {
+      const field = key => text.match(new RegExp('(?:^|\\n)\\s*' + key + '\\s*:\\s*([^\\n]+)'))?.[1]?.trim() || '';
+      if (field(protocol + 'Enable') === '1') {
+        const host = field(protocol + 'Proxy');
+        const port = Number(field(protocol + 'Port'));
+        if (host && Number.isInteger(port) && port > 0 && port <= 65535) {
+          configured = 'http://' + (host.includes(':') ? '[' + host + ']' : host) + ':' + port;
+        }
+      }
+      const exceptions = text.match(/ExceptionsList\s*:[\s\S]*?\n\s*}/)?.[0] || '';
+      const values = Array.from(exceptions.matchAll(/\d+\s*:\s*([^\n]+)/g), match => match[1].trim()).join(',');
+      if (bypassProxy(url, values)) return null;
+    } else if (/ProxyEnable\s+REG_DWORD\s+0x1\b/i.test(text)) {
+      const server = text.match(/ProxyServer\s+REG_SZ\s+([^\r\n]+)/i)?.[1]?.trim() || '';
+      const exceptions = text.match(/ProxyOverride\s+REG_SZ\s+([^\r\n]+)/i)?.[1] || '';
+      if (bypassProxy(url, exceptions)) return null;
+      configured = server.includes('=')
+        ? server.split(';').find(part => part.toLowerCase().startsWith(protocol.toLowerCase() + '='))?.split('=').slice(1).join('=')
+        : server;
+      if (configured && !configured.includes('://')) configured = 'http://' + configured;
+    }
+  }
+  if (!configured) return null;
+  let proxy;
+  try { proxy = new URL(configured); } catch (_error) {
+    throw proxyError('update_proxy_invalid', 'The configured update proxy address is invalid.');
+  }
+  if (!['http:', 'https:'].includes(proxy.protocol)) {
+    throw proxyError('update_proxy_unsupported', 'The update proxy must use HTTP or HTTPS. SOCKS and PAC require an HTTP proxy endpoint.');
+  }
+  return { url: proxy.href, source };
+}
+
+function hostname(url) { return url.hostname.replace(/^\[|\]$/g, ''); }
+function proxyHeaders(proxy) {
+  if (!proxy.username && !proxy.password) return {};
+  let credentials;
+  try { credentials = decodeURIComponent(proxy.username) + ':' + decodeURIComponent(proxy.password); }
+  catch (_error) { throw proxyError('update_proxy_invalid', 'The configured proxy credentials are malformed.'); }
+  return { 'Proxy-Authorization': 'Basic ' + Buffer.from(credentials).toString('base64') };
+}
+
+function tunnel(target, proxy, signal) {
+  return new Promise((resolve, reject) => {
+    const authority = target.hostname + ':' + (target.port || '443');
+    const client = proxy.protocol === 'https:' ? https : http;
+    const request = client.request({ protocol: proxy.protocol, hostname: hostname(proxy), port: proxy.port,
+      method: 'CONNECT', path: authority, headers: { Host: authority, ...proxyHeaders(proxy) }, agent: false, signal });
+    request.once('error', reject);
+    request.once('connect', (response, socket, head) => {
+      if (response.statusCode !== 200) {
+        socket.destroy();
+        reject(proxyError(response.statusCode === 407 ? 'update_proxy_auth_required' : 'update_proxy_failed',
+          'The proxy refused the secure update connection (HTTP ' + response.statusCode + ').', response.statusCode >= 500));
+        return;
+      }
+      if (signal.aborted) { socket.destroy(); reject(signal.reason); return; }
+      if (head.length) socket.unshift(head);
+      const secure = tls.connect({ socket, host: hostname(target),
+        servername: net.isIP(hostname(target)) ? undefined : hostname(target), ALPNProtocols: ['http/1.1'] });
+      const abort = () => secure.destroy(signal.reason);
+      signal.addEventListener('abort', abort, { once: true });
+      secure.once('close', () => signal.removeEventListener('abort', abort));
+      secure.once('error', reject);
+      secure.once('secureConnect', () => resolve(secure));
+    });
+    request.end();
+  });
+}
+
+async function proxyRequest(target, proxy, init) {
+  let agent;
+  if (target.protocol === 'https:') {
+    const socket = await tunnel(target, proxy, init.signal);
+    if (init.signal.aborted) { socket.destroy(); throw init.signal.reason; }
+    agent = new https.Agent({ keepAlive: false });
+    agent.createConnection = () => socket;
+  }
+  return new Promise((resolve, reject) => {
+    const headers = { ...Object.fromEntries(new Headers(init.headers || {})), Host: target.host };
+    const secure = target.protocol === 'https:';
+    const client = secure || proxy.protocol === 'https:' ? https : http;
+    const request = secure
+      ? client.request(target, { method: init.method, headers, agent, signal: init.signal })
+      : client.request({ protocol: proxy.protocol, hostname: hostname(proxy), port: proxy.port,
+        method: init.method, path: target.href, headers: { ...headers, ...proxyHeaders(proxy) }, agent: false, signal: init.signal });
+    request.once('error', error => { agent?.destroy(); reject(error); });
+    request.once('response', incoming => {
+      incoming.once('close', () => agent?.destroy());
+      const headers = new Headers();
+      for (let i = 0; i < incoming.rawHeaders.length; i += 2) headers.append(incoming.rawHeaders[i], incoming.rawHeaders[i + 1]);
+      const empty = init.method === 'HEAD' || [204, 205, 304].includes(incoming.statusCode);
+      if (empty) incoming.resume();
+      const response = new Response(empty ? null : Readable.toWeb(incoming),
+        { status: incoming.statusCode, statusText: incoming.statusMessage, headers });
+      Object.defineProperty(response, 'url', { value: target.href });
+      resolve(response);
+    });
+    request.end();
+  });
+}
+
+async function fetchRelease(url, init, options = {}) {
+  const proxy = resolveReleaseProxy(url, options);
+  if (!proxy) return globalThis.fetch(url, init);
+  let target = new URL(url);
+  for (let redirect = 0; redirect <= 5; redirect += 1) {
+    const response = await proxyRequest(target, new URL(proxy.url), init);
+    if (![301, 302, 303, 307, 308].includes(response.status)) return response;
+    const location = response.headers.get('location');
+    if (!location) return response;
+    if (response.body) await response.body.cancel();
+    const next = new URL(location, target);
+    if (!['http:', 'https:'].includes(next.protocol) || target.protocol === 'https:' && next.protocol !== 'https:' ||
+        options.allowedHosts && !options.allowedHosts.has(next.hostname)) {
+      throw proxyError('update_asset_redirect_forbidden', 'Release request redirected to an untrusted host.');
+    }
+    target = next;
+  }
+  throw proxyError('update_network_redirect_limit', 'The update request exceeded its redirect limit.');
+}
+
+module.exports = { fetchRelease, resolveReleaseProxy };