codex-overleaf-link 2.5.1 → 2.6.5

package/native-host/src/updateManager.js

@@ -35,6 +35,11 @@ const ACTIVATION_DELAY_MS = 125;
 const APPLYING_TRANSACTION_STATES = new Set(['activation_pending', 'applying', 'awaiting_health',
   ...BootstrapUpdate.BOOTSTRAP_STATES]);
 const CONSENT_MIGRATION_TARGET_VERSION = '1.9.4';
+// Pure reads of user-owned stores that do not depend on update files. They stay
+// available while a migration or its recovery is unsettled.
+const READ_ONLY_DURING_UPDATE = new Set(['codex.providers.list']);
+// A user-requested return to the source version of an applied update.
+const USER_ROLLBACK_REASON = 'update_user_rollback';
 const UPDATE_METHODS = new Set([
   'update.status',
   'update.bootstrap',
@@ -107,7 +112,12 @@ async function handleUpdateRequest(request, options = {}) {
       case 'update.confirm':
         return okResponse(request.id, await withUpdateMutex(context, () => confirmUpdate(context, request.params || {})));
       case 'update.rollback':
-        return okResponse(request.id, await withUpdateMutex(context, () => rollbackUpdate(context, request.params || {})));
+        return okResponse(request.id, await withUpdateMutex(context, () => {
+          if (request.params?.reasonCode === USER_ROLLBACK_REASON && !getApplyGate(options).idle) {
+            throw updateError('update_native_busy', 'Native host is still processing a Codex task.');
+          }
+          return rollbackUpdate(context, request.params || {});
+        }));
       case 'update.cancel':
         return okResponse(request.id, await cancelNetworkUpdate(context, request.params || {}));
       case 'update.revoke': {
@@ -264,7 +274,8 @@ async function recoverBootstrapTransaction(options, transactionId, token) {
 }
 
 function assertBootstrapBusinessAvailable(request, options = {}) {
-  if (isUpdateMethod(request?.method) || ['bridge.ping', 'codex.cancel'].includes(request?.method)) return;
+  if (isUpdateMethod(request?.method) || ['bridge.ping', 'codex.cancel'].includes(request?.method)
+    || READ_ONLY_DURING_UPDATE.has(request?.method)) return;
   const context = getManagedContext(options);
   if (!context.managed) return;
   const journal = readJournal(context);
@@ -352,9 +363,14 @@ async function checkForUpdate(context, params = {}, options = {}) {
     };
   }
   const cooldowns = readJsonSafe(path.join(context.updatesRoot, COOLDOWN_FILE), {});
-  if (Number(cooldowns[latestVersion]?.until || 0) > Date.now()) {
+  const cooldown = cooldowns[latestVersion];
+  // Read legacy user-rollback cooldowns, allowing explicit checks to bypass
+  // them. New user rollbacks defer browser prompts without a Native cooldown.
+  if (Number(cooldown?.until || 0) > Date.now()
+    && !(cooldown.reasonCode === USER_ROLLBACK_REASON && params.manual === true)) {
     return { managed: true, available: false, reason: 'cooldown', currentVersion, latestVersion,
-      cooldownUntil: Number(cooldowns[latestVersion].until), etag: releaseResponse.headers.get('etag') || '' };
+      cooldownUntil: Number(cooldown.until), cooldownReason: cooldown.reasonCode || '',
+      etag: releaseResponse.headers.get('etag') || '' };
   }
 
   const manifestBytes = await fetchReleaseAsset(
@@ -393,6 +409,19 @@ async function checkForUpdate(context, params = {}, options = {}) {
     });
     return manual;
   }
+  try {
+    BootstrapUpdate.assertMigrationSource(context, manifest, currentVersion);
+  } catch (error) {
+    if (error.code !== 'update_bootstrap_source_mismatch') throw error;
+    // Never cached as an installable candidate: only a reinstall can replace
+    // startup files this release cannot migrate.
+    const manual = { managed: true, available: false, reason: 'manual_install_required', code: error.code,
+      currentVersion, latestVersion, manualInstall: {}, etag: releaseResponse.headers.get('etag') || '' };
+    atomicWriteJson(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), { ...manual,
+      checkedAt: new Date().toISOString(), manifestBase64: manifestBytes.toString('base64'),
+      signatureBase64: signatureBytes.toString('base64') });
+    return manual;
+  }
   const candidate = {
     checkedAt: new Date().toISOString(),
     currentVersion,
@@ -416,8 +445,15 @@ function readManualCandidate(context, currentVersion, etag) {
       Buffer.from(manual.signatureBase64, 'base64'),
       { allowBootstrapMismatch: true }
     );
-    if (!isNewerStableVersion(manifest.version, currentVersion)
-      || manifest.bootstrapProtocol === BOOTSTRAP_PROTOCOL) return null;
+    if (!isNewerStableVersion(manifest.version, currentVersion)) return null;
+    if (manifest.bootstrapProtocol === BOOTSTRAP_PROTOCOL) {
+      // Same protocol: a hint only while the installed startup files still
+      // cannot be migrated by this signed release.
+      try { BootstrapUpdate.assertMigrationSource(context, manifest, currentVersion); return null; }
+      catch (error) { if (error.code !== 'update_bootstrap_source_mismatch') return null; }
+      return { managed: true, available: false, reason: 'manual_install_required', code: 'update_bootstrap_source_mismatch',
+        currentVersion, latestVersion: manifest.version, manualInstall: {}, etag };
+    }
     return {
       managed: true, available: false, reason: 'manual_install_required',
       currentVersion, latestVersion: manifest.version,
@@ -494,6 +530,7 @@ function authorizeUpdate(context, params = {}) {
       !isNewerStableVersion(targetVersion, activeVersion)) {
     throw updateError('update_consent_mismatch', 'Update authorization does not match the active signed candidate.');
   }
+  BootstrapUpdate.assertMigrationSource(context, manifest, activeVersion);
   const existing = readAuthorization(context);
   if (existing?.id === authorizationId &&
       existing.targetVersion === targetVersion &&
@@ -536,6 +573,11 @@ async function stageCandidate(context, options = {}) {
     throw updateError('update_candidate_stale', 'The staged update is no longer newer than the active version.');
   }
   const authorization = requireAuthorization(context, manifest.version, ['authorized', 'bound']);
+  try { BootstrapUpdate.assertMigrationSource(context, manifest, activeVersion); }
+  catch (error) {
+    if (authorization.state === 'authorized') settleAuthorization(context, authorization.id, 'revoked');
+    throw error;
+  }
   const existingJournal = readJournal(context);
   if (existingJournal?.state === 'staged' && existingJournal.targetVersion === manifest.version) {
     if (existingJournal.authorizationId !== authorization.id ||
@@ -832,14 +874,40 @@ function rollbackUpdate(context, params = {}) {
   if (journal.bootstrapMigration && !params.transactionId && journal.bootstrapMigration.phase !== 'pending') {
     throw updateError('update_transaction_mismatch', 'Bootstrap rollback must identify its update transaction.');
   }
+  const userRequested = params.reasonCode === USER_ROLLBACK_REASON;
+  // Check every precondition before writing the rolling-back state, so an
+  // unavailable request never turns a working installation into a recovery.
+  if (userRequested && (!params.transactionId
+    || (journal.state === 'committed' && !userRollbackAvailable(context, journal)))) {
+    throw updateError('update_rollback_unavailable', 'The previous version is no longer available for rollback.');
+  }
   const migration = Boolean(journal.bootstrapMigration);
   if (migration) writeJournal(context, { ...journal, state: 'bootstrap_rolling_back' });
-  const rollbackEvidence = rollbackFiles(context, journal, { deferSourceActivation: migration });
+  let rollbackEvidence;
+  try {
+    rollbackEvidence = rollbackFiles(context, journal, { deferSourceActivation: migration });
+  } catch (error) {
+    // The incomplete state remains. The failure record bounds automatic retries
+    // and lets status report the reason; explicit rollback requests still run.
+    const failed = readJournal(context);
+    if (failed?.id === journal.id) {
+      writeJournal(context, { ...failed, updatedAt: new Date().toISOString(), rollbackFailure: {
+        code: safeErrorCode(error), attempts: Number(failed.rollbackFailure?.attempts || 0) + 1,
+        at: new Date().toISOString() } });
+    }
+    throw error;
+  }
   const cooldowns = readJsonSafe(path.join(context.updatesRoot, COOLDOWN_FILE), {});
-  cooldowns[journal.targetVersion] = {
-    until: Date.now() + 24 * 60 * 60 * 1000,
-    reasonCode: normalizeReasonCode(params.reasonCode)
-  };
+  if (userRequested) {
+    // The restored Native may predate manual-check exemptions. Keep its
+    // original check usable; the coordinator snoozes automatic prompts.
+    delete cooldowns[journal.targetVersion];
+  } else {
+    cooldowns[journal.targetVersion] = {
+      until: Date.now() + 24 * 60 * 60 * 1000,
+      reasonCode: normalizeReasonCode(params.reasonCode)
+    };
+  }
   atomicWriteJson(path.join(context.updatesRoot, COOLDOWN_FILE), cooldowns);
   const restoredJournal = {
     ...journal,
@@ -848,6 +916,7 @@ function rollbackUpdate(context, params = {}) {
     rolledBackAt: new Date().toISOString(),
     updatedAt: new Date().toISOString(),
     previousManifest: undefined,
+    rollbackFailure: undefined,
     rollbackEvidence,
     ...(migration ? { bootstrapMigration: { ...journal.bootstrapMigration, phase: 'restored',
       sourceUnchanged: rollbackEvidence.bootstrapSourceUnchanged === true },
@@ -867,6 +936,27 @@ function rollbackUpdate(context, params = {}) {
   return { transactionId: journal.id, version: journal.sourceVersion, state: 'rolled_back', restoredPair: rollbackEvidence };
 }
 
+// A committed update can be returned to its source pair only while every
+// source layer is still on disk: the previous runtime slot, the source Native
+// version, the saved manifest and, for a Bootstrap migration, its backups.
+function userRollbackAvailable(context, journal) {
+  if (journal?.state !== 'committed' || !parseSemver(journal.sourceVersion) || !journal.previousManifest
+    || readVersionPointer(context.nativeRoot, 'active-version') !== journal.targetVersion) return false;
+  if (journal.bootstrapMigration
+    && !fs.existsSync(path.join(context.updatesRoot, 'bootstrap-migrations', journal.id, 'state.json'))) return false;
+  // Status runs often, so this reads only the version identities. rollbackFiles
+  // still verifies both full source trees before and after restoring them.
+  const previousRuntime = path.join(context.extensionRoot, 'slots', 'previous', 'runtime');
+  try {
+    const compatibility = fs.readFileSync(path.join(previousRuntime, 'src', 'shared', 'compatibility.js'), 'utf8');
+    const nativePackage = readJsonSafe(path.join(context.nativeRoot, 'versions', journal.sourceVersion, 'package.json'), null);
+    return compatibility.match(/BUILD_TARGET_VERSION\s*=\s*['"]([^'"]+)['"]/)?.[1] === journal.sourceVersion
+      && nativePackage?.version === journal.sourceVersion;
+  } catch (_) {
+    return false;
+  }
+}
+
 function revokeUpdate(context, params = {}) {
   const authorizationId = String(params.authorizationId || '');
   const targetVersion = String(params.targetVersion || '');
@@ -909,12 +999,19 @@ function rollbackFiles(context, journal, options = {}) {
   const runtime = path.join(context.extensionRoot, 'runtime');
   const previousRuntime = path.join(context.extensionRoot, 'slots', 'previous', 'runtime');
   // An early interrupted apply may still have the source in the current slot.
-  // A missing previous slot is recoverable only when these actual bytes match
-  // the source pair; the source manifest and markers alone are insufficient.
-  const source = readManagedRuntimeEvidence(context, journal.sourceVersion,
-    fs.existsSync(previousRuntime) ? previousRuntime : runtime);
+  // A missing or stale previous slot is recoverable only when these actual
+  // bytes match the source pair; manifest and markers alone are insufficient.
+  let sourceRuntime = fs.existsSync(previousRuntime) ? previousRuntime : runtime;
+  let source;
+  try {
+    source = readManagedRuntimeEvidence(context, journal.sourceVersion, sourceRuntime);
+  } catch (error) {
+    if (journal.state !== 'applying' || sourceRuntime !== previousRuntime) throw error;
+    source = readManagedRuntimeEvidence(context, journal.sourceVersion, runtime);
+    sourceRuntime = runtime;
+  }
   if (journal.bootstrapMigration) BootstrapUpdate.restoreBootstrap(context, journal);
-  if (fs.existsSync(previousRuntime)) {
+  if (sourceRuntime === previousRuntime) {
     fs.rmSync(runtime, { recursive: true, force: true });
     fs.renameSync(previousRuntime, runtime);
     fs.rmSync(path.dirname(previousRuntime), { recursive: true, force: true });
@@ -1003,7 +1100,12 @@ function recoverAndReadStatus(context, params = {}) {
   }
   journal = BootstrapUpdate.bindBootstrapMigration(context, journal, bootstrapDependencies(context));
   if (BootstrapUpdate.bootstrapExpired(journal, { recoveryRequested: params.bootstrapRecovery === true, context })) {
-    rollbackUpdate(context, { transactionId: journal.id, expectedState: journal.state, reasonCode: 'update_bootstrap_health_timeout' });
+    try {
+      rollbackUpdate(context, { transactionId: journal.id, expectedState: journal.state, reasonCode: 'update_bootstrap_health_timeout' });
+    } catch (_error) {
+      // Recorded as rollbackFailure on the journal; status still answers so
+      // the browser can show the reason instead of an unreadable state.
+    }
     journal = readJournal(context);
   }
   if (journal?.state === 'rolled_back' || journal?.state === 'superseded') {
@@ -1027,7 +1129,18 @@ function recoverAndReadStatus(context, params = {}) {
       cleanupStage(journal.stageRoot);
     }
   }
-  return currentStatus(context, journal);
+  const status = currentStatus(context, journal);
+  if (journal?.state === 'rolled_back' && !journal.bootstrapMigration && status.restoredPair) {
+    const authorization = readAuthorization(context);
+    if (['bound', 'consumed'].includes(authorization?.state) && authorization.id === journal.authorizationId
+      && authorization.transactionId === journal.id && authorization.sourceVersion === journal.sourceVersion
+      && authorization.targetVersion === journal.targetVersion) {
+      settleAuthorization(context, journal.authorizationId, 'revoked');
+      status.authorization = publicAuthorization(readAuthorization(context));
+    }
+    cleanupStage(journal.stageRoot);
+  }
+  return status;
 }
 
 function finishSourceActivation(context, journal) {
@@ -1035,7 +1148,11 @@ function finishSourceActivation(context, journal) {
   if (!sameRuntimeEvidence(actual, journal.rollbackEvidence)) {
     throw updateError('update_rollback_unconfirmed', 'The recovered source files changed before activation.');
   }
-  BootstrapUpdate.bootstrapEvidence(context, journal, 'source');
+  const bootstrap = BootstrapUpdate.bootstrapEvidence(context, journal, 'source');
+  if (journal.bootstrapMigration
+    && (!bootstrap?.digest || bootstrap.digest !== journal.rollbackEvidence?.bootstrapSha256)) {
+    throw updateError('update_bootstrap_source_mismatch', 'The recovered Bootstrap bytes changed before activation.');
+  }
   settleAuthorization(context, journal.authorizationId, 'revoked');
   atomicWriteText(path.join(context.nativeRoot, 'active-version'), journal.sourceVersion + '\n');
   const finished = { ...journal, sourceActivationPending: false };
@@ -1059,10 +1176,13 @@ function settleReinstalledUpdate(context, version, expected) {
   }
   const reinstalledPair = readManagedRuntimeEvidence(context, version);
   const timestamp = new Date().toISOString();
+  // The installer already activated `version`; a pending switch back to the
+  // source would block business requests and could repoint the launcher.
   writeJournal(context, {
     ...journal, state: 'superseded', supersededFromState: journal.state,
     supersededByVersion: version, supersededAt: timestamp,
-    updatedAt: timestamp, reasonCode: 'update_reinstalled', reinstalledPair
+    updatedAt: timestamp, reasonCode: 'update_reinstalled', reinstalledPair,
+    sourceActivationPending: false
   });
   const authorization = readAuthorization(context);
   if (authorization?.state === 'bound' && authorization.id === journal.authorizationId
@@ -1104,6 +1224,8 @@ function currentStatus(context, journal = readJournal(context)) {
       ...(journal.state === 'awaiting_health' && BootstrapUpdate.migrationHint(context, journal)
         && journal.bootstrapMigration?.phase !== 'loaded' ? { state: 'bootstrap_pending' } : {}) } : null,
     authorization: publicAuthorization(readAuthorization(context)),
+    rollbackAvailable: userRollbackAvailable(context, journal)
+      ? { transactionId: journal.id, sourceVersion: journal.sourceVersion, targetVersion: journal.targetVersion } : null,
     restoredPair,
     reinstalledPair
   };
@@ -1347,7 +1469,8 @@ function publicTransaction(journal) {
     supersededAt: journal.supersededAt,
     supersededByVersion: journal.supersededByVersion,
     supersededFromState: journal.supersededFromState,
-    reasonCode: journal.reasonCode || ''
+    reasonCode: journal.reasonCode || '',
+    rollbackFailureCode: journal.rollbackFailure?.code || ''
   };
 }
 

package/native-host/src/writingStyleRuntime.js

@@ -374,7 +374,7 @@ async function build({ params, env, signal, execute, providerLaunch, onControlRe
       reasoningEffort: params.reasoningEffort || '', speedTier: params.speedTier || 'standard',
       sandboxMode: 'read-only', approvalPolicy: 'never',
       loadCodexLocalSkills: false, loadCodexOverleafSkills: false,
-      disableCodexOverleafSkillIds: ['annotated-rewrite', 'parallel-subagents'],
+      disableCodexOverleafSkillIds: ['annotated-rewrite', 'parallel-subagents', 'reviewer-response'],
       skillInvocation: null, projectLocalSkills: null, providerLaunch, env, signal,
       onControlReady, emit: () => {}
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-overleaf-link",
-  "version": "2.5.1",
+  "version": "2.6.5",
   "description": "Cross-platform Chrome bridge that connects Codex to the active Overleaf project.",
   "license": "MIT",
   "type": "commonjs",
@@ -16,13 +16,9 @@
     "agent:codex": "node scripts/codex-json-agent.mjs",
     "build:content": "node scripts/build-content-bundle.mjs",
     "check:module-graph": "node scripts/check-content-module-graph.mjs",
-    "test": "npm run check:module-graph && node scripts/run-tests.mjs",
-    "test:fast": "npm run check:module-graph && node scripts/run-tests.mjs --fast",
-    "test:focus": "npm run check:module-graph && node scripts/run-tests.mjs",
-    "check:architecture": "node scripts/check-architecture-budget.mjs --enforce-target",
-    "benchmark:large": "node scripts/benchmark-large-project.mjs --gate",
+    "test": "npm run build:content && node scripts/run-tests.mjs",
     "smoke:extension": "npm run build:content && node scripts/smoke-extension.mjs",
-    "smoke:prepare:chrome": "npm run build:content && npm run test:fast && npm run install:managed",
+    "smoke:prepare:chrome": "npm test && npm run install:managed",
     "verify:release": "node scripts/verify-release.mjs",
     "verify:source": "node scripts/verify-release.mjs --source-hygiene-only",
     "verify:release-artifacts": "node scripts/verify-release-artifacts.mjs",
@@ -38,7 +34,8 @@
     "uninstall:native": "node scripts/uninstall-native-host.mjs",
     "bridge": "node native-host/src/index.js",
     "verify:npm-package": "node scripts/verify-npm-package.mjs",
-    "pack:npm": "npm run build:content && node scripts/verify-npm-package.mjs --pack"
+    "pack:npm": "npm run build:content && node scripts/verify-npm-package.mjs --pack",
+    "test:platform": "npm run build:content && node scripts/run-tests.mjs --platform"
   },
   "engines": {
     "node": ">=20"