codex-overleaf-link 2.3.5 → 2.4.0

package/extension/styles/panel.css

@@ -1029,11 +1029,21 @@
 }
 
 #codex-overleaf-panel .codex-diagnostics-menu {
-  position: absolute;
+  position: fixed;
   z-index: 2147483647;
-  top: 30px;
-  right: 0;
-  width: 260px;
+  top: 44px;
+  right: 12px;
+  bottom: auto;
+  left: auto;
+  margin: 0;
+  box-sizing: border-box;
+  width: min(300px, calc(100vw - 24px));
+  max-width: calc(100vw - 24px);
+  max-height: calc(100vh - 24px);
+  overflow: auto;
+  overscroll-behavior: contain;
+  overflow-wrap: anywhere;
+  color: var(--tl-fg-2);
   border: 1px solid var(--tl-border-strong);
   border-radius: 6px;
   background: var(--tl-surface-2);
@@ -1084,15 +1094,30 @@
   z-index: 2147483647;
   top: 44px;
   right: 12px;
-  width: min(316px, calc(var(--codex-overleaf-panel-width) - 24px));
-  max-height: min(520px, calc(100vh - 64px));
+  bottom: auto;
+  left: auto;
+  margin: 0;
+  padding: 0;
+  box-sizing: border-box;
+  width: min(560px, calc(100vw - 24px));
+  max-width: calc(100vw - 24px);
+  max-height: min(640px, calc(100vh - 24px));
   overflow: auto;
+  overscroll-behavior: contain;
+  overflow-wrap: anywhere;
+  color: var(--tl-fg-2);
   border: 1px solid var(--tl-border-strong);
   border-radius: 8px;
   background: var(--tl-surface-1);
   box-shadow: 0 14px 34px rgba(0, 0, 0, 0.48);
 }
 
+#codex-overleaf-panel .codex-diagnostics-menu::backdrop,
+#codex-overleaf-panel .codex-diagnostics-result::backdrop {
+  background: transparent;
+  pointer-events: none;
+}
+
 #codex-overleaf-panel .codex-diagnostics-result[hidden] {
   display: none;
 }
@@ -1581,7 +1606,7 @@
 
 #codex-overleaf-panel .codex-set-row-help {
   margin: 0;
-  color: var(--tl-fg-4);
+  color: var(--tl-fg-3);
   font-size: 11px;
   line-height: 1.45;
 }
@@ -1821,9 +1846,12 @@
 #codex-overleaf-panel .codex-plugin-confirm::backdrop { background: transparent; }
 
 #codex-overleaf-panel .codex-plugin-confirm-card {
+  display: flex;
+  flex-direction: column;
+  box-sizing: border-box;
   width: 100%;
   max-height: min(520px, calc(100vh - 28px));
-  overflow: hidden;
+  overflow: auto;
   border: 1px solid var(--tl-border-strong);
   border-radius: 8px;
   background: var(--tl-surface-1);
@@ -1832,6 +1860,7 @@
 
 #codex-overleaf-panel .codex-plugin-confirm-head {
   display: flex;
+  flex: 0 0 auto;
   align-items: center;
   gap: 10px;
   padding: 14px 14px 12px;
@@ -1860,6 +1889,8 @@
 }
 
 #codex-overleaf-panel .codex-plugin-confirm-body {
+  flex: 0 1 auto;
+  min-height: 0;
   max-height: 300px;
   overflow: auto;
   padding: 12px 14px;
@@ -1872,6 +1903,9 @@
 
 #codex-overleaf-panel .codex-plugin-confirm-actions {
   display: flex;
+  flex: 0 0 auto;
+  flex-wrap: wrap;
+  align-items: stretch;
   justify-content: flex-end;
   gap: 8px;
   padding: 12px 14px 14px;
@@ -1879,12 +1913,23 @@
 }
 
 #codex-overleaf-panel .codex-plugin-confirm-actions button {
-  min-width: 72px;
-  height: 30px;
+  display: flex;
+  flex: 1 1 auto;
+  align-items: center;
+  justify-content: center;
+  box-sizing: border-box;
+  min-width: min(72px, 100%);
+  max-width: 100%;
+  min-height: 34px;
+  height: auto;
   border: 1px solid var(--tl-border-strong);
   border-radius: 6px;
-  padding: 0 12px;
+  padding: 7px 12px;
   font-weight: 650;
+  line-height: 1.35;
+  text-align: center;
+  white-space: normal;
+  overflow-wrap: anywhere;
 }
 
 #codex-overleaf-panel .codex-plugin-confirm-cancel {
@@ -2170,7 +2215,7 @@
   padding: 4px 10px;
   font-size: 11px;
   cursor: pointer;
-  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.35);
+  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.12);
   animation: tl-fade-in 120ms ease-out;
 }
 
@@ -2185,6 +2230,32 @@
   border-color: var(--tl-border-strong);
 }
 
+/* Let the browser anchor backscroll while the reader is detached. */
+#codex-overleaf-panel [data-log][data-log-auto-follow="false"],
+#codex-overleaf-panel [data-main][data-log-auto-follow="false"] {
+  overflow-anchor: auto;
+}
+
+#codex-overleaf-panel :is(.run-copy-action, .run-fork-action, .tl-jump-latest, .run-final-answer__recovery-action):focus-visible {
+  outline: 2px solid var(--tl-accent);
+  outline-offset: 2px;
+}
+
+#codex-overleaf-panel :is(input, textarea)::placeholder {
+  color: var(--tl-fg-3);
+  opacity: 1;
+}
+
+.codex-provider-dialog-root .codex-provider-field :is(input, textarea)::placeholder {
+  color: var(--provider-muted);
+  opacity: 1;
+}
+
+.codex-provider-dialog-root :is(button, input, textarea, select):focus-visible {
+  outline: 2px solid var(--provider-accent);
+  outline-offset: 2px;
+}
+
 /* Active-session bar: the title on the left, rename + delete on the right, so
    the session you are working in can be renamed/deleted in place. */
 #codex-overleaf-panel .codex-thread-title {
@@ -3084,13 +3155,13 @@
 }
 
 #codex-overleaf-panel .run-final-answer .run-system-label {
-  color: var(--tl-accent);
+  color: var(--tl-fg-3);
   font-weight: 650;
   letter-spacing: 0.01em;
 }
 
 #codex-overleaf-panel .run-completion-report[data-status="failed"] .run-system-label[data-system-label="conclusion"] {
-  color: var(--tl-fail);
+  color: var(--tl-fg-3);
 }
 
 #codex-overleaf-panel .run-final-answer .run-change-summary {
@@ -3179,9 +3250,8 @@
 }
 
 #codex-overleaf-panel .run-final-answer__meta {
-  margin: 10px 0 0;
-  padding: 8px 0 0;
-  border-top: 1px solid var(--tl-border);
+  margin: 14px 0 0;
+  padding: 0;
   display: grid;
   grid-template-columns: max-content 1fr;
   column-gap: 12px;
@@ -3205,18 +3275,15 @@
 }
 
 #codex-overleaf-panel .run-completion-report[data-status="failed"] {
-  color: var(--tl-fail);
+  color: var(--tl-fg-2);
 }
 
-/* .run-final-answer resets color to fg-1 for normal reports; a failed report's
-   conclusion must keep the alert color or failure reads like success. */
+/* Failure severity belongs to the status header and compact notice. */
 #codex-overleaf-panel .run-completion-report[data-status="failed"] .run-final-answer {
-  color: var(--tl-fail);
+  color: var(--tl-fg-2);
 }
 
-/* Failed-status reports keep their alert color for the conclusion, but the
-   meta block stays muted so it still reads as system info rather than amplifying
-   the alert. */
+/* Keep system metadata subordinate to the answer in both themes. */
 #codex-overleaf-panel .run-completion-report[data-status="failed"] .run-final-answer__meta,
 #codex-overleaf-panel .run-completion-report[data-status="failed"] .run-final-answer__meta-value {
   color: var(--tl-fg-3);
@@ -3252,6 +3319,43 @@
   opacity: 0.6;
 }
 
+#codex-overleaf-panel .run-feedback {
+  display: grid;
+  gap: 5px;
+  margin: 12px 0 0;
+  padding: 10px 12px;
+  border-radius: 8px;
+  background: var(--tl-surface-2);
+  color: var(--tl-fg-2);
+  font-size: 12px;
+  line-height: 1.5;
+  overflow-wrap: anywhere;
+}
+
+#codex-overleaf-panel .run-feedback p { margin: 0; }
+#codex-overleaf-panel .run-feedback__title { color: var(--tl-fail); font-weight: 650; }
+#codex-overleaf-panel .run-feedback[data-tone="warning"] .run-feedback__title { color: var(--tl-review); }
+#codex-overleaf-panel .run-feedback .run-final-answer__recovery-action {
+  justify-self: start;
+  margin: 3px 0 0;
+  padding: 3px 0;
+  border: 0;
+  background: transparent;
+  color: var(--tl-accent);
+  font-weight: 600;
+}
+
+#codex-overleaf-panel :is(.run-copy-action, .run-fork-action) {
+  color: var(--tl-fg-3);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  #codex-overleaf-panel :is(.tl-jump-latest, .run-copy-action, .run-fork-action, .run-final-answer__recovery-action) {
+    animation: none;
+    transition: none;
+  }
+}
+
 #codex-overleaf-panel .codex-probe-line {
   flex: 0 0 auto;
   min-height: 18px;

package/native-host/src/mirrorWorkspace.js

@@ -712,6 +712,22 @@ function getMirrorStatus(projectId, options = {}) {
   };
 }
 
+function normalizeObservedPatchTime(value, fallback) {
+  const candidate = value == null ? fallback : value;
+  const timestamp = typeof candidate === 'number'
+    ? candidate
+    : typeof candidate === 'string' ? Date.parse(candidate) : NaN;
+  return Number.isFinite(timestamp) && Math.abs(timestamp) <= 8640000000000000
+    ? new Date(timestamp).toISOString()
+    : '';
+}
+
+function isFreshOtObservation(freshness) {
+  const timestamp = Date.parse(freshness?.observedAt ?? freshness?.lastPatchAt ?? '');
+  const ageMs = Date.now() - timestamp;
+  return Number.isFinite(timestamp) && ageMs >= 0 && ageMs <= 30000;
+}
+
 function buildOtStatusFields(baseline = {}, trusted) {
   const metadata = {
     lastOtPatchAt: baseline.lastOtPatchAt || '',
@@ -727,13 +743,15 @@ function buildOtStatusFields(baseline = {}, trusted) {
   }
   const textFiles = (baseline.files || []).filter(file => file?.kind === 'text');
   const freshFiles = textFiles
-    .filter(file => file.freshness?.source === 'ot' && file.freshness?.state === 'fresh')
+    .filter(file => file.freshness?.source === 'ot' && file.freshness?.state === 'fresh'
+      && isFreshOtObservation(file.freshness))
     .map(file => ({
       path: file.path,
       source: file.freshness.source,
       state: file.freshness.state,
       lastFullSyncAt: file.freshness.lastFullSyncAt || '',
       lastPatchAt: file.freshness.lastPatchAt || '',
+      observedAt: file.freshness.observedAt ?? file.freshness.lastPatchAt ?? '',
       observedVersion: file.freshness.observedVersion ?? null
     }))
     .sort((left, right) => left.path.localeCompare(right.path));
@@ -935,6 +953,7 @@ async function patchMirrorFiles({ projectId, files, rootDir, source = 'ot' }) {
         state: 'fresh',
         lastFullSyncAt: baseline.lastFullSyncAt || '',
         lastPatchAt: patchBatchAt,
+        observedAt: normalizeObservedPatchTime(patch.observedAt, patchBatchAt),
         observedVersion: patch.observedVersion ?? null
       }
     };

package/native-host/src/releaseProxy.js

@@ -0,0 +1,177 @@
+'use strict';
+
+const http = require('node:http');
+const https = require('node:https');
+const tls = require('node:tls');
+const net = require('node:net');
+const { Readable } = require('node:stream');
+const { execFileSync } = require('node:child_process');
+const { updateError } = require('./updateTrust');
+let systemCache = { platform: '', at: 0, text: '' };
+
+function proxyError(code, message, retryable = false) {
+  return Object.assign(updateError(code, message), { retryable });
+}
+
+function bypassProxy(url, values = '') {
+  const host = url.hostname.toLowerCase();
+  const port = url.port || (url.protocol === 'https:' ? '443' : '80');
+  return String(values).split(/[,;\s]+/).some(raw => {
+    if (!raw) return false;
+    if (raw === '*') return true;
+    if (raw === '<local>') return !host.includes('.');
+    const match = raw.toLowerCase().match(/^(.*?)(?::(\d+))?$/);
+    if (match[2] && match[2] !== port) return false;
+    const domain = match[1].replace(/^\*?\./, '');
+    return host === domain || host.endsWith('.' + domain);
+  });
+}
+
+function readSystemProxy(platform) {
+  if (systemCache.platform === platform && Date.now() - systemCache.at < 30000) return systemCache.text;
+  let text = '';
+  try {
+    const command = platform === 'darwin' ? '/usr/sbin/scutil' : 'reg.exe';
+    const args = platform === 'darwin' ? ['--proxy']
+      : ['query', 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings'];
+    text = execFileSync(command, args, { encoding: 'utf8', timeout: 1000, maxBuffer: 32768,
+      windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch (_error) { /* environment proxies and direct access remain available */ }
+  systemCache = { platform, at: Date.now(), text };
+  return text;
+}
+
+function resolveReleaseProxy(value, options = {}) {
+  const url = new URL(value);
+  const env = options.env || process.env;
+  if (bypassProxy(url, env.NO_PROXY || env.no_proxy)) return null;
+  const protocol = url.protocol === 'https:' ? 'HTTPS' : 'HTTP';
+  let configured = env[protocol + '_PROXY'] || env[protocol.toLowerCase() + '_proxy'] || env.ALL_PROXY || env.all_proxy;
+  let source = 'environment';
+  const platform = options.platform || process.platform;
+  if (!configured && ['darwin', 'win32'].includes(platform)) {
+    source = 'system';
+    const text = (options.systemProxy || readSystemProxy)(platform);
+    if (platform === 'darwin') {
+      const field = key => text.match(new RegExp('(?:^|\\n)\\s*' + key + '\\s*:\\s*([^\\n]+)'))?.[1]?.trim() || '';
+      if (field(protocol + 'Enable') === '1') {
+        const host = field(protocol + 'Proxy');
+        const port = Number(field(protocol + 'Port'));
+        if (host && Number.isInteger(port) && port > 0 && port <= 65535) {
+          configured = 'http://' + (host.includes(':') ? '[' + host + ']' : host) + ':' + port;
+        }
+      }
+      const exceptions = text.match(/ExceptionsList\s*:[\s\S]*?\n\s*}/)?.[0] || '';
+      const values = Array.from(exceptions.matchAll(/\d+\s*:\s*([^\n]+)/g), match => match[1].trim()).join(',');
+      if (bypassProxy(url, values)) return null;
+    } else if (/ProxyEnable\s+REG_DWORD\s+0x1\b/i.test(text)) {
+      const server = text.match(/ProxyServer\s+REG_SZ\s+([^\r\n]+)/i)?.[1]?.trim() || '';
+      const exceptions = text.match(/ProxyOverride\s+REG_SZ\s+([^\r\n]+)/i)?.[1] || '';
+      if (bypassProxy(url, exceptions)) return null;
+      configured = server.includes('=')
+        ? server.split(';').find(part => part.toLowerCase().startsWith(protocol.toLowerCase() + '='))?.split('=').slice(1).join('=')
+        : server;
+      if (configured && !configured.includes('://')) configured = 'http://' + configured;
+    }
+  }
+  if (!configured) return null;
+  let proxy;
+  try { proxy = new URL(configured); } catch (_error) {
+    throw proxyError('update_proxy_invalid', 'The configured update proxy address is invalid.');
+  }
+  if (!['http:', 'https:'].includes(proxy.protocol)) {
+    throw proxyError('update_proxy_unsupported', 'The update proxy must use HTTP or HTTPS. SOCKS and PAC require an HTTP proxy endpoint.');
+  }
+  return { url: proxy.href, source };
+}
+
+function hostname(url) { return url.hostname.replace(/^\[|\]$/g, ''); }
+function proxyHeaders(proxy) {
+  if (!proxy.username && !proxy.password) return {};
+  let credentials;
+  try { credentials = decodeURIComponent(proxy.username) + ':' + decodeURIComponent(proxy.password); }
+  catch (_error) { throw proxyError('update_proxy_invalid', 'The configured proxy credentials are malformed.'); }
+  return { 'Proxy-Authorization': 'Basic ' + Buffer.from(credentials).toString('base64') };
+}
+
+function tunnel(target, proxy, signal) {
+  return new Promise((resolve, reject) => {
+    const authority = target.hostname + ':' + (target.port || '443');
+    const client = proxy.protocol === 'https:' ? https : http;
+    const request = client.request({ protocol: proxy.protocol, hostname: hostname(proxy), port: proxy.port,
+      method: 'CONNECT', path: authority, headers: { Host: authority, ...proxyHeaders(proxy) }, agent: false, signal });
+    request.once('error', reject);
+    request.once('connect', (response, socket, head) => {
+      if (response.statusCode !== 200) {
+        socket.destroy();
+        reject(proxyError(response.statusCode === 407 ? 'update_proxy_auth_required' : 'update_proxy_failed',
+          'The proxy refused the secure update connection (HTTP ' + response.statusCode + ').', response.statusCode >= 500));
+        return;
+      }
+      if (signal.aborted) { socket.destroy(); reject(signal.reason); return; }
+      if (head.length) socket.unshift(head);
+      const secure = tls.connect({ socket, host: hostname(target),
+        servername: net.isIP(hostname(target)) ? undefined : hostname(target), ALPNProtocols: ['http/1.1'] });
+      const abort = () => secure.destroy(signal.reason);
+      signal.addEventListener('abort', abort, { once: true });
+      secure.once('close', () => signal.removeEventListener('abort', abort));
+      secure.once('error', reject);
+      secure.once('secureConnect', () => resolve(secure));
+    });
+    request.end();
+  });
+}
+
+async function proxyRequest(target, proxy, init) {
+  let agent;
+  if (target.protocol === 'https:') {
+    const socket = await tunnel(target, proxy, init.signal);
+    if (init.signal.aborted) { socket.destroy(); throw init.signal.reason; }
+    agent = new https.Agent({ keepAlive: false });
+    agent.createConnection = () => socket;
+  }
+  return new Promise((resolve, reject) => {
+    const headers = { ...Object.fromEntries(new Headers(init.headers || {})), Host: target.host };
+    const secure = target.protocol === 'https:';
+    const client = secure || proxy.protocol === 'https:' ? https : http;
+    const request = secure
+      ? client.request(target, { method: init.method, headers, agent, signal: init.signal })
+      : client.request({ protocol: proxy.protocol, hostname: hostname(proxy), port: proxy.port,
+        method: init.method, path: target.href, headers: { ...headers, ...proxyHeaders(proxy) }, agent: false, signal: init.signal });
+    request.once('error', error => { agent?.destroy(); reject(error); });
+    request.once('response', incoming => {
+      incoming.once('close', () => agent?.destroy());
+      const headers = new Headers();
+      for (let i = 0; i < incoming.rawHeaders.length; i += 2) headers.append(incoming.rawHeaders[i], incoming.rawHeaders[i + 1]);
+      const empty = init.method === 'HEAD' || [204, 205, 304].includes(incoming.statusCode);
+      if (empty) incoming.resume();
+      const response = new Response(empty ? null : Readable.toWeb(incoming),
+        { status: incoming.statusCode, statusText: incoming.statusMessage, headers });
+      Object.defineProperty(response, 'url', { value: target.href });
+      resolve(response);
+    });
+    request.end();
+  });
+}
+
+async function fetchRelease(url, init, options = {}) {
+  const proxy = resolveReleaseProxy(url, options);
+  if (!proxy) return globalThis.fetch(url, init);
+  let target = new URL(url);
+  for (let redirect = 0; redirect <= 5; redirect += 1) {
+    const response = await proxyRequest(target, new URL(proxy.url), init);
+    if (![301, 302, 303, 307, 308].includes(response.status)) return response;
+    const location = response.headers.get('location');
+    if (!location) return response;
+    if (response.body) await response.body.cancel();
+    const next = new URL(location, target);
+    if (!['http:', 'https:'].includes(next.protocol) || target.protocol === 'https:' && next.protocol !== 'https:' ||
+        options.allowedHosts && !options.allowedHosts.has(next.hostname)) {
+      throw proxyError('update_asset_redirect_forbidden', 'Release request redirected to an untrusted host.');
+    }
+    target = next;
+  }
+  throw proxyError('update_network_redirect_limit', 'The update request exceeded its redirect limit.');
+}
+
+module.exports = { fetchRelease, resolveReleaseProxy };

package/native-host/src/releaseTransport.js

@@ -0,0 +1,154 @@
+'use strict';
+
+const { updateError } = require('./updateTrust');
+const { fetchRelease } = require('./releaseProxy');
+
+const RETRYABLE_HTTP = new Set([408, 429, 500, 502, 503, 504]);
+const CERTIFICATE_ERRORS = /CERT|TLS_CERT|SELF_SIGNED|UNABLE_TO_VERIFY|DEPTH_ZERO/;
+
+function abortable(promise, signal) {
+  if (signal.aborted) {
+    void Promise.resolve(promise).catch(() => {});
+    return Promise.reject(signal.reason);
+  }
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener('abort', abort, { once: true });
+    Promise.resolve(promise).then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+  });
+}
+
+function terminalError(code, message) {
+  return Object.assign(updateError(code, message), { retryable: false });
+}
+
+async function readBoundedBody(response, limit, signal) {
+  const declared = Number(response.headers?.get?.('content-length') || 0);
+  if (declared > limit) throw terminalError('update_download_limit', 'Update response exceeds its size limit.');
+  const reader = response.body?.getReader?.();
+  if (!reader) {
+    const bytes = Buffer.from(await abortable(response.arrayBuffer(), signal));
+    if (!bytes.length || bytes.length > limit) throw terminalError('update_download_limit', 'Update response exceeds its size limit.');
+    return bytes;
+  }
+  const chunks = [];
+  let length = 0;
+  try {
+    while (true) {
+      const chunk = await abortable(reader.read(), signal);
+      if (chunk.done) break;
+      const bytes = Buffer.from(chunk.value);
+      length += bytes.length;
+      if (length > limit) throw terminalError('update_download_limit', 'Update response exceeds its size limit.');
+      chunks.push(bytes);
+    }
+    if (!length) throw terminalError('update_download_limit', 'Update response is empty.');
+    return Buffer.concat(chunks, length);
+  } catch (error) {
+    void reader.cancel().catch(() => {});
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+function networkFailure(error, signal, callerSignal) {
+  let cause = error;
+  for (let depth = 0; depth < 8 && cause?.cause && cause.cause !== cause; depth += 1) cause = cause.cause;
+  const reason = String(typeof cause?.code === 'string' ? cause.code : cause?.name || error?.name || 'network_error');
+  if (callerSignal?.aborted) return { code: 'update_network_cancelled', reason: 'cancelled', retryable: false };
+  if (error?.retryable === false) return { code: error.code || 'update_network_failed', reason, retryable: false };
+  if (CERTIFICATE_ERRORS.test(reason)) return { code: 'update_network_certificate', reason, retryable: false };
+  if (signal.aborted || /TIMEOUT|Timeout|AbortError/.test(reason)) {
+    return { code: 'update_network_timeout', reason, retryable: true };
+  }
+  if (/ENOTFOUND|EAI_AGAIN/.test(reason)) return { code: 'update_network_dns', reason, retryable: true };
+  return { code: /^update_[a-z0-9_]+$/.test(error?.code || '') ? error.code : 'update_network_failed',
+    reason, retryable: error?.retryable !== false };
+}
+
+function retryDelay(response, fallback) {
+  const value = response?.headers?.get?.('retry-after');
+  if (!value) return fallback;
+  const seconds = Number(value);
+  const delay = Number.isFinite(seconds) ? seconds * 1000 : Date.parse(value) - Date.now();
+  return Number.isFinite(delay) ? Math.max(fallback, delay, 0) : fallback;
+}
+
+function delay(milliseconds, signal) {
+  if (!milliseconds) return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    const abort = () => { clearTimeout(timer); reject(signal.reason); };
+    const timer = setTimeout(() => { signal?.removeEventListener('abort', abort); resolve(); }, milliseconds);
+    if (signal?.aborted) abort();
+    else signal?.addEventListener('abort', abort, { once: true });
+  });
+}
+
+async function requestRelease(url, options = {}) {
+  const started = Date.now();
+  const deadline = options.deadlineAt || started + (options.totalTimeoutMs ?? 45000);
+  const maxAttempts = Math.max(1, Math.min(5, options.maxAttempts ?? 3));
+  const host = new URL(url).hostname;
+  let failure;
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new DOMException('Update request timed out.', 'TimeoutError')),
+      Math.min(remaining, options.timeoutMs ?? 12000));
+    const cancel = () => controller.abort(options.signal.reason);
+    if (options.signal?.aborted) cancel();
+    else options.signal?.addEventListener('abort', cancel, { once: true });
+    let response;
+    let retryAfter = 0;
+    try {
+      const fetchImpl = options.fetch || ((value, init) => fetchRelease(value, init, options));
+      response = await abortable(fetchImpl(url, {
+        method: options.method || 'GET', headers: options.headers,
+        redirect: 'follow', signal: controller.signal
+      }), controller.signal);
+      const finalUrl = new URL(response.url || url);
+      if (options.allowedHosts && (finalUrl.protocol !== 'https:' || !options.allowedHosts.has(finalUrl.hostname))) {
+        throw terminalError('update_asset_redirect_forbidden', 'Release request redirected to an untrusted host.');
+      }
+      if (!response.ok && response.status !== 304) {
+        throw Object.assign(updateError(options.httpErrorCode || 'update_asset_http_error',
+          'Update request failed with HTTP ' + response.status + '.'), { retryable: RETRYABLE_HTTP.has(response.status) });
+      }
+      const bytes = options.method === 'HEAD' || response.status === 304
+        ? null : await readBoundedBody(response, options.limit ?? 32 * 1024 * 1024, controller.signal);
+      return { ok: response.ok, status: response.status, url: finalUrl.href, headers: response.headers,
+        bytes, attempts: attempt, elapsedMs: Date.now() - started };
+    } catch (error) {
+      const classified = networkFailure(error, controller.signal, options.signal);
+      const diagnostics = { stage: options.stage || 'download', host, attempt,
+        elapsedMs: Date.now() - started, reason: classified.reason, retryable: classified.retryable,
+        ...(response ? { httpStatus: response.status } : {}) };
+      const description = classified.code === 'update_network_timeout' ? 'Connection or download timed out'
+        : classified.code === 'update_network_dns' ? 'DNS lookup failed'
+          : classified.code === 'update_network_certificate' ? 'TLS certificate verification failed'
+            : classified.code === 'update_network_cancelled' ? 'Update request was cancelled'
+              : error?.retryable === false ? error.message : 'Network request failed';
+      const reason = response ? 'HTTP ' + response.status
+        : /^[A-Z][A-Z0-9_]{1,79}$/.test(classified.reason) ? classified.reason : '';
+      failure = updateError(classified.code,
+        description.replace(/\.$/, '') + ' (' + diagnostics.stage + ', ' + host + ', attempt ' + attempt +
+          (reason ? ', ' + reason : '') + ', ' + (diagnostics.elapsedMs / 1000).toFixed(1) + 's).',
+        { cause: error, network: diagnostics });
+      try { options.onDiagnostic?.(diagnostics); } catch (_error) { /* diagnostics are best effort */ }
+      if (!classified.retryable || attempt === maxAttempts) throw failure;
+      retryAfter = retryDelay(response, (options.delayMs ?? 500) * attempt);
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener('abort', cancel);
+      controller.abort();
+      if (response?.body && !response.body.locked) void response.body.cancel().catch(() => {});
+    }
+    if (Date.now() + retryAfter >= deadline) break;
+    await delay(retryAfter, options.signal);
+  }
+  throw failure || updateError('update_network_timeout', 'The update network time budget was exhausted.');
+}
+
+module.exports = { requestRelease };

package/native-host/src/taskRunnerRuntime.js

@@ -82,6 +82,10 @@ async function handleRequest(request, env = process.env, emit = () => {}) {
     return handleMirrorStatus(request, env);
   }
 
+  if (request.method === 'mirror.invalidate') {
+    return handleMirrorInvalidate(request, env);
+  }
+
   if (request.method === 'mirror.scanSensitive') {
     return handleMirrorScanSensitive(request, env);
   }
@@ -709,6 +713,27 @@ async function handleMirrorConfirmWriteback(request, env) {
   }
 }
 
+function handleMirrorInvalidate(request, env) {
+  const projectId = request.params?.projectId;
+  if (typeof projectId !== 'string' || !projectId.trim()) {
+    return errorResponse(request.id, 'invalid_project_id', 'Mirror invalidation requires an explicit project id.');
+  }
+  const projectKey = resolveProjectKey({ projectId });
+  const lockToken = acquireProjectLock(projectKey);
+  if (!lockToken) {
+    return errorResponse(request.id, 'project_locked', `Project ${projectKey} is currently in use by codex.run`);
+  }
+  try {
+    const { markMirrorDirty } = require('./mirrorWorkspace');
+    markMirrorDirty({ projectId, rootDir: env.CODEX_OVERLEAF_MIRROR_ROOT, reason: 'overleaf_undo' });
+    return okResponse(request.id, { invalidated: true, projectKey });
+  } catch (error) {
+    return errorResponse(request.id, 'mirror_invalidation_failed', error.message);
+  } finally {
+    releaseProjectLock(projectKey, lockToken);
+  }
+}
+
 function handleMirrorStatus(request, env) {
   const { getMirrorStatus } = require('./mirrorWorkspace');
   const params = request.params || {};