codex-overleaf-link 2.4.1 → 2.5.1

package/extension/src/shared/managedUpdateProjection.js

@@ -5,14 +5,15 @@
     waiting: 'waiting_for_idle',
     waiting_for_safe_point: 'waiting_for_idle',
     awaiting_health_check: 'awaiting_health',
-    health_checking: 'awaiting_health'
+    health_checking: 'awaiting_health',
+    bootstrap_pending: 'awaiting_health'
   });
-
   const PHASES = Object.freeze([
     'idle',
     'up_to_date',
     'checking',
     'update_available',
+    'manual_install_required',
     'downloading',
     'staged',
     'waiting_for_idle',
@@ -27,7 +28,7 @@
 
   const PHASE_TIMEOUTS = Object.freeze({
     checking: 60 * 1000,
-    downloading: 2 * 60 * 1000,
+    downloading: 6 * 60 * 1000,
     applying: 90 * 1000,
     awaiting_health: 2 * 60 * 1000,
     rolling_back: 60 * 1000
@@ -75,9 +76,11 @@
   const TRANSITIONS = Object.freeze({
     idle: Object.freeze(['checking']),
     up_to_date: Object.freeze(['checking', 'idle']),
-    checking: Object.freeze(['idle', 'up_to_date', 'update_available', 'failed']),
+    checking: Object.freeze(['idle', 'up_to_date', 'update_available', 'manual_install_required', 'failed']),
+    // Only a reinstall resolves it; leave by checking again or going idle.
+    manual_install_required: Object.freeze(['checking', 'idle', 'update_available', 'failed']),
     update_available: Object.freeze(['checking', 'downloading', 'deferred', 'failed']),
-    downloading: Object.freeze(['staged', 'failed']),
+    downloading: Object.freeze(['staged', 'failed', 'update_available', 'idle']),
     staged: Object.freeze(['waiting_for_idle', 'applying', 'update_available', 'deferred', 'failed']),
     waiting_for_idle: Object.freeze(['applying', 'update_available', 'deferred', 'failed']),
     applying: Object.freeze(['staged', 'awaiting_health', 'rolling_back', 'failed']),

package/extension/src/shared/nativeRequestIdentity.js

@@ -55,6 +55,7 @@
 
   return Object.freeze({
     MAX_REQUEST_ID_CHARS,
+    validate,
     resolve
   });
 });

package/extension/src/shared/pageRpcContract.js

@@ -5,21 +5,28 @@
 })(typeof window !== 'undefined' ? window : (typeof globalThis !== 'undefined' ? globalThis : this), function () {
   'use strict';
 
-  var REVISION = '2026-09-14-native-text-upload-v28';
+  var REVISION = '2026-10-05-scope-correction-v42';
   var METHODS = freezeCatalog({
     initializeCapability: entry('bridge.initialize', 'control', 'none', 'default', false, 'none'),
     probe: entry('bridge.probe', 'read', 'none', 'default', false, 'safe'),
     cancelActiveWrite: entry('write.cancel', 'control', 'none', 'default', false, 'idempotent'),
     getProjectSnapshot: entry('snapshot.read', 'read', 'none', 'snapshot', true, 'safe'),
     getProjectFileList: entry('snapshot.list', 'read', 'none', 'file_list', true, 'safe'),
+    listReferenceProjects: entry('reference.list', 'read', 'none', 'file_list', false, 'safe'),
+    getReferenceProjectSnapshot: entry('reference.read', 'read', 'none', 'snapshot', false, 'safe'),
+    cancelReferenceRead: entry('reference.cancel', 'control', 'none', 'default', false, 'idempotent'),
     invalidateProjectSnapshot: entry('snapshot.invalidate', 'cache', 'none', 'default', false, 'idempotent'),
     createCheckpoint: entry('checkpoint.create', 'page_state', 'none', 'default', false, 'no_retry'),
     ensureReviewing: entry('reviewing.enable', 'page_state', 'optional', 'default', true, 'idempotent'),
     ensureEditing: entry('reviewing.disable', 'page_state', 'optional', 'default', true, 'idempotent'),
     applyOperations: entry('document.write', 'document', 'required', 'writeback', true, 'no_retry'),
-    binaryUploadBegin: entry('asset.stage', 'cache', 'required', 'default', false, 'no_retry'),
+    // Receipts settle already-dispatched writes after cancellation; their RPC deadlines still apply.
+    getWritebackReceipt: entry('writeback.receipt', 'read', 'required', 'default', false, 'safe'),
+    getSelectionContext: entry('editor.selection', 'read', 'required', 'default', true, 'safe'),
+    binaryUploadBegin: entry('asset.stage', 'cache', 'required', 'default', true, 'no_retry'),
     binaryUploadAppend: entry('asset.stage', 'cache', 'none', 'writeback', true, 'no_retry'),
     binaryUploadCommit: entry('asset.write', 'document', 'required', 'writeback', true, 'no_retry'),
+    binaryUploadStatus: entry('asset.receipt', 'read', 'required', 'default', false, 'safe'),
     binaryUploadAbort: entry('asset.stage', 'cache', 'none', 'default', false, 'idempotent'),
     jumpToPosition: entry('editor.navigate', 'navigation', 'required', 'default', false, 'idempotent'),
     reconcileTrackedChangeCapture: entry('tracked_changes.read', 'read', 'required', 'default', false, 'safe'),

package/extension/src/shared/projectFiles.js

@@ -83,55 +83,31 @@
       .replace(/^\/+/, '');
   }
 
+  // Project metadata, ZIP names and operation paths are already literal names.
+  // Decoding here would alias e.g. "a%20b.tex" with "a b.tex".
   function normalizeSafeProjectPath(value) {
-    if (typeof value !== 'string') {
-      return '';
-    }
-    if (hasControlCharacter(value)) {
-      return '';
-    }
-    const trimmed = value.trim();
-    if (!trimmed || trimmed.length > MAX_SAFE_PROJECT_PATH_LENGTH) {
-      return '';
-    }
-    if (trimmed.startsWith('/') || trimmed.includes('\\') || hasWindowsDrivePrefix(trimmed)) {
-      return '';
-    }
+    if (typeof value !== 'string' || !value || value.length > MAX_SAFE_PROJECT_PATH_LENGTH || value.trim() !== value
+      || hasControlCharacter(value) || value.startsWith('/') || value.includes('\\')
+      || hasWindowsDrivePrefix(value)) return '';
+    return value.split('/').some(segment => !segment || segment === '.' || segment === '..') ? '' : value;
+  }
 
-    let decoded = trimmed;
+  // Use only at an explicitly URL-encoded input boundary. Return one decoding,
+  // while conservatively checking nested encodings for traversal/separators.
+  function normalizeUrlEncodedProjectPath(value) {
+    if (typeof value !== 'string' || hasEncodedSeparator(value)) return '';
+    let decoded;
+    try { decoded = decodeURIComponent(value); } catch (_error) { return ''; }
+    const result = normalizeSafeProjectPath(decoded);
+    if (!result) return '';
     for (let index = 0; index < 3; index += 1) {
-      if (hasEncodedSeparator(decoded)) {
-        return '';
-      }
+      if (hasEncodedSeparator(decoded) || !normalizeSafeProjectPath(decoded)) return '';
       let next;
-      try {
-        next = decodeURIComponent(decoded);
-      } catch (_error) {
-        return '';
-      }
-      if (next === decoded) {
-        break;
-      }
+      try { next = decodeURIComponent(decoded); } catch (_error) { break; }
+      if (next === decoded) break;
       decoded = next;
     }
-
-    if (hasControlCharacter(decoded)
-      || decoded.startsWith('/')
-      || decoded.includes('\\')
-      || hasWindowsDrivePrefix(decoded)
-      || decoded.length > MAX_SAFE_PROJECT_PATH_LENGTH) {
-      return '';
-    }
-
-    const normalized = decoded.replace(/\/+/g, '/').trim();
-    if (!normalized || normalized.length > MAX_SAFE_PROJECT_PATH_LENGTH) {
-      return '';
-    }
-    const segments = normalized.split('/');
-    if (segments.some(segment => !segment || segment === '.' || segment === '..')) {
-      return '';
-    }
-    return normalized;
+    return hasEncodedSeparator(decoded) || !normalizeSafeProjectPath(decoded) ? '' : result;
   }
 
   function assertSafeProjectPath(value, label = 'path') {
@@ -175,6 +151,7 @@
     isUsableProjectFileContent,
     isTextProjectPath,
     normalizePath,
-    normalizeSafeProjectPath
+    normalizeSafeProjectPath,
+    normalizeUrlEncodedProjectPath
   };
 });

package/extension/src/shared/providerProfiles.js

@@ -9,6 +9,105 @@
 
   const BUILTIN_PROVIDER_ID = 'builtin';
 
+  const PROVIDER_CONNECTIONS = {
+    kimi: {
+      anthropic: { baseUrl: 'https://api.moonshot.cn/anthropic', wireApiPreference: 'anthropic', authMode: 'bearer', reasoningAdapter: 'anthropic' },
+      chat: { baseUrl: 'https://api.moonshot.cn/v1', wireApiPreference: 'chat', authMode: 'bearer', reasoningAdapter: 'auto' }
+    },
+    glm: {
+      anthropic: { baseUrl: 'https://open.bigmodel.cn/api/anthropic', wireApiPreference: 'anthropic', authMode: 'bearer', reasoningAdapter: 'anthropic' },
+      chat: { baseUrl: 'https://open.bigmodel.cn/api/paas/v4', wireApiPreference: 'chat', authMode: 'bearer', reasoningAdapter: 'auto' }
+    },
+    deepseek: {
+      anthropic: { baseUrl: 'https://api.deepseek.com/anthropic', wireApiPreference: 'anthropic', authMode: 'x-api-key', reasoningAdapter: 'anthropic' },
+      chat: { baseUrl: 'https://api.deepseek.com', wireApiPreference: 'chat', authMode: 'bearer', reasoningAdapter: 'deepseek' }
+    }
+  };
+
+  // Shortcuts select a protocol-specific connection, never an active provider.
+  const PROVIDER_PRESETS = [
+    { id: 'custom', name: 'Custom connection', short: '+', baseUrl: '', wireApiPreference: 'auto' },
+    { id: 'openai-compatible', name: 'OpenAI-compatible API', short: 'API', baseUrl: '', wireApiPreference: 'auto' },
+    { id: 'anthropic-compatible', name: 'Anthropic-compatible API', short: 'API', baseUrl: '', wireApiPreference: 'anthropic', authMode: 'x-api-key', reasoningAdapter: 'anthropic' },
+    { id: 'kimi', name: 'Kimi', short: 'K', ...PROVIDER_CONNECTIONS.kimi.anthropic },
+    { id: 'glm', name: 'GLM', short: 'G', ...PROVIDER_CONNECTIONS.glm.anthropic },
+    { id: 'deepseek', name: 'DeepSeek', short: 'D', ...PROVIDER_CONNECTIONS.deepseek.anthropic }
+  ];
+  const MODEL_EFFORTS = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'];
+
+  function getPresetConnectionInfo(baseUrl) {
+    const normalized = normalizeText(baseUrl).replace(/\/+$/, '');
+    for (const [id, variants] of Object.entries(PROVIDER_CONNECTIONS)) {
+      for (const connection of Object.values(variants)) {
+        if (normalized === connection.baseUrl) return { id, connection: { ...connection } };
+      }
+    }
+    return null;
+  }
+
+  function getPresetConnection(id, protocol) {
+    const variants = Object.prototype.hasOwnProperty.call(PROVIDER_CONNECTIONS, id)
+      ? PROVIDER_CONNECTIONS[id] : null;
+    const connection = variants && Object.prototype.hasOwnProperty.call(variants, protocol)
+      ? variants[protocol] : null;
+    return connection ? { ...connection } : null;
+  }
+
+  function getProviderPresets() {
+    return PROVIDER_PRESETS.map(preset => ({ ...preset }));
+  }
+
+  function buildPresetDraft(id) {
+    const preset = PROVIDER_PRESETS.find(item => item.id === id) || PROVIDER_PRESETS[0];
+    const { id: _id, short: _short, ...connection } = preset;
+    return { ...buildEmptyDraft(), ...connection,
+      name: preset.id === 'custom' ? 'Custom provider' : preset.name };
+  }
+
+  function updateDraftModel(draft, originalId, patch) {
+    const models = Array.isArray(draft.models) ? draft.models : [];
+    const existing = models.find(model => model.id === originalId);
+    const fail = (message, field) => { throw Object.assign(new Error(message), { field }); };
+    const id = normalizeText(patch.id);
+    if (!id || id.length > 200 || /[\0\r\n"&|<>^%!\x60]/.test(id))
+      fail('Enter a valid model ID (up to 200 characters).', 'id');
+    if (models.some(model => model.id === id && model.id !== originalId))
+      fail('This model ID is already configured.', 'id');
+    if (!existing && models.length >= 32) fail('A provider can contain up to 32 models.', 'id');
+    const contextWindow = Number(patch.contextWindow);
+    if (!Number.isSafeInteger(contextWindow) || contextWindow < 8192 || contextWindow > 4000000)
+      fail('Context window must be an integer between 8192 and 4000000.', 'contextWindow');
+    const maxOutputTokens = patch.maxOutputTokens === '' || patch.maxOutputTokens == null
+      ? null : Number(patch.maxOutputTokens);
+    if (maxOutputTokens !== null && (!Number.isSafeInteger(maxOutputTokens)
+      || maxOutputTokens < 256 || maxOutputTokens > 65536 || maxOutputTokens >= contextWindow))
+      fail('Output limit must be between 256 and 65536 and smaller than the context window.', 'maxOutputTokens');
+    const model = { ...existing, id, label: normalizeText(patch.label).slice(0, 200) || id,
+      contextWindow, maxOutputTokens,
+      inputModalities: normalizeInputModalities(patch.inputModalities),
+      supportsParallelToolCalls: patch.supportsParallelToolCalls === true,
+      upstreamResponseMode: normalizeUpstreamResponseMode(patch.upstreamResponseMode, true),
+      reasoningEfforts: MODEL_EFFORTS.filter(effort => patch.reasoningEfforts?.includes(effort)),
+      reasoningAdapter: patch.reasoningAdapter ? normalizeReasoningAdapter(patch.reasoningAdapter) : '',
+      reasoningCapability: patch.reasoningCapability ? normalizeReasoningCapability(patch.reasoningCapability)
+        : patch.reasoningEfforts?.length ? 'effort' : '',
+      baseInstructions: normalizeText(patch.baseInstructions).slice(0, 8000)
+    };
+    model.resolvedUpstreamResponseMode = model.upstreamResponseMode === existing?.upstreamResponseMode
+      ? existing.resolvedUpstreamResponseMode || '' : '';
+    return { ...draft,
+      models: existing ? models.map(item => item.id === originalId ? model : item) : [...models, model],
+      defaultModelId: !draft.defaultModelId || draft.defaultModelId === originalId ? id : draft.defaultModelId
+    };
+  }
+
+  function removeDraftModel(draft, id) {
+    const models = (draft.models || []).filter(model => model.id !== id);
+    return { ...draft, models, defaultModelId: draft.defaultModelId === id
+      ? models[0]?.id || '' : draft.defaultModelId };
+  }
+
+
   function normalizeCatalog(value = {}) {
     const providers = Array.isArray(value.providers)
       ? value.providers.map(normalizeProvider).filter(Boolean)
@@ -68,7 +167,8 @@
       anthropicThinkingMode: normalizeAnthropicThinkingMode(value.anthropicThinkingMode),
       anthropicPromptCaching: value.anthropicPromptCaching === true,
       impersonateClaudeCode: value.impersonateClaudeCode === true,
-      maxOutputTokens: normalizeMaxOutputTokens(value.maxOutputTokens),
+      maxOutputTokens: normalizeMaxOutputTokens(value.maxOutputTokens, value.outputBudgetVersion !== 1),
+      outputBudgetVersion: 1,
       hasSecret: value.hasSecret === true,
       secretUpdatedAt: normalizeInteger(value.secretUpdatedAt),
       endpointDisclosureHost: normalizeText(value.endpointDisclosureHost),
@@ -110,6 +210,9 @@
         upstreamResponseMode: normalizeUpstreamResponseMode(value?.upstreamResponseMode, true),
         resolvedUpstreamResponseMode: normalizeUpstreamResponseMode(value?.resolvedUpstreamResponseMode, false),
         contextWindow: normalizeInteger(value?.contextWindow) || 262144,
+        maxOutputTokens: value?.maxOutputTokens == null ? null : Math.min(65536, Math.max(256, normalizeInteger(value.maxOutputTokens))),
+        reasoningAdapter: value?.reasoningAdapter ? normalizeReasoningAdapter(value.reasoningAdapter) : '',
+        reasoningCapability: value?.reasoningCapability ? normalizeReasoningCapability(value.reasoningCapability) : '',
         supportsParallelToolCalls: value?.supportsParallelToolCalls === true,
         inputModalities: normalizeInputModalities(value?.inputModalities),
         baseInstructions: normalizeText(value?.baseInstructions)
@@ -160,6 +263,7 @@
       anthropicPromptCaching: false,
       impersonateClaudeCode: false,
       maxOutputTokens: 65536,
+      outputBudgetVersion: 1,
       hasSecret: false,
       secretUpdatedAt: 0,
       endpointDisclosureHost: '',
@@ -278,14 +382,21 @@
     return Number.isFinite(number) && number >= 0 ? Math.floor(number) : 0;
   }
 
-  function normalizeMaxOutputTokens(value) {
+  function normalizeMaxOutputTokens(value, legacy = false) {
     const number = normalizeInteger(value);
-    if (!number || number === 8192 || number === 32768) return 65536;
+    if (!number || (legacy && (number === 8192 || number === 32768))) return 65536;
     return Math.min(65536, Math.max(256, number));
   }
 
   return {
     BUILTIN_PROVIDER_ID,
+    MODEL_EFFORTS,
+    getProviderPresets,
+    getPresetConnectionInfo,
+    getPresetConnection,
+    buildPresetDraft,
+    updateDraftModel,
+    removeDraftModel,
     buildBuiltinProvider,
     buildEmptyDraft,
     buildRunSelection,