codexapp 0.1.26 → 0.1.28

package/dist-cli/index.js

@@ -2,30 +2,32 @@
 
 // src/cli/index.ts
 import { createServer as createServer2 } from "http";
-import { existsSync as existsSync2 } from "fs";
-import { readFile as readFile3 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
+import { chmodSync, createWriteStream, existsSync as existsSync2, mkdirSync } from "fs";
+import { readFile as readFile2 } from "fs/promises";
+import { homedir as homedir2, networkInterfaces } from "os";
+import { join as join3 } from "path";
 import { spawn as spawn2, spawnSync } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname2 } from "path";
+import { get as httpsGet } from "https";
 import { Command } from "commander";
 import qrcode from "qrcode-terminal";
 
 // src/server/httpServer.ts
 import { fileURLToPath } from "url";
-import { dirname as dirname2, extname as extname2, isAbsolute as isAbsolute2, join as join3 } from "path";
+import { dirname, extname, isAbsolute as isAbsolute2, join as join2 } from "path";
 import { existsSync } from "fs";
-import { writeFile as writeFile2, stat as stat3 } from "fs/promises";
+import { readdir as readdir2, stat as stat2 } from "fs/promises";
 import express from "express";
 
 // src/server/codexAppServerBridge.ts
 import { spawn } from "child_process";
+import { randomBytes } from "crypto";
 import { mkdtemp, readFile, readdir, rm, mkdir, stat } from "fs/promises";
 import { request as httpsRequest } from "https";
 import { homedir } from "os";
 import { tmpdir } from "os";
-import { isAbsolute, join, resolve } from "path";
+import { basename, isAbsolute, join, resolve } from "path";
 import { writeFile } from "fs/promises";
 function asRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -49,6 +51,46 @@ function setJson(res, statusCode, payload) {
   res.setHeader("Content-Type", "application/json; charset=utf-8");
   res.end(JSON.stringify(payload));
 }
+function extractThreadMessageText(threadReadPayload) {
+  const payload = asRecord(threadReadPayload);
+  const thread = asRecord(payload?.thread);
+  const turns = Array.isArray(thread?.turns) ? thread.turns : [];
+  const parts = [];
+  for (const turn of turns) {
+    const turnRecord = asRecord(turn);
+    const items = Array.isArray(turnRecord?.items) ? turnRecord.items : [];
+    for (const item of items) {
+      const itemRecord = asRecord(item);
+      const type = typeof itemRecord?.type === "string" ? itemRecord.type : "";
+      if (type === "agentMessage" && typeof itemRecord?.text === "string" && itemRecord.text.trim().length > 0) {
+        parts.push(itemRecord.text.trim());
+        continue;
+      }
+      if (type === "userMessage") {
+        const content = Array.isArray(itemRecord?.content) ? itemRecord.content : [];
+        for (const block of content) {
+          const blockRecord = asRecord(block);
+          if (blockRecord?.type === "text" && typeof blockRecord.text === "string" && blockRecord.text.trim().length > 0) {
+            parts.push(blockRecord.text.trim());
+          }
+        }
+        continue;
+      }
+      if (type === "commandExecution") {
+        const command = typeof itemRecord?.command === "string" ? itemRecord.command.trim() : "";
+        const output = typeof itemRecord?.aggregatedOutput === "string" ? itemRecord.aggregatedOutput.trim() : "";
+        if (command) parts.push(command);
+        if (output) parts.push(output);
+      }
+    }
+  }
+  return parts.join("\n").trim();
+}
+function isExactPhraseMatch(query, doc) {
+  const q = query.trim().toLowerCase();
+  if (!q) return false;
+  return doc.title.toLowerCase().includes(q) || doc.preview.toLowerCase().includes(q) || doc.messageText.toLowerCase().includes(q);
+}
 function scoreFileCandidate(path, query) {
   if (!query) return 0;
   const lowerPath = path.toLowerCase();
@@ -122,6 +164,55 @@ async function runCommand(command, args, options = {}) {
     });
   });
 }
+function isMissingHeadError(error) {
+  const message = getErrorMessage(error, "").toLowerCase();
+  return message.includes("not a valid object name: 'head'") || message.includes("not a valid object name: head");
+}
+function isNotGitRepositoryError(error) {
+  const message = getErrorMessage(error, "").toLowerCase();
+  return message.includes("not a git repository") || message.includes("fatal: not a git repository");
+}
+async function ensureRepoHasInitialCommit(repoRoot) {
+  const agentsPath = join(repoRoot, "AGENTS.md");
+  try {
+    await stat(agentsPath);
+  } catch {
+    await writeFile(agentsPath, "", "utf8");
+  }
+  await runCommand("git", ["add", "AGENTS.md"], { cwd: repoRoot });
+  await runCommand(
+    "git",
+    ["-c", "user.name=Codex", "-c", "user.email=codex@local", "commit", "-m", "Initialize repository for worktree support"],
+    { cwd: repoRoot }
+  );
+}
+async function runCommandCapture(command, args, options = {}) {
+  return await new Promise((resolveOutput, reject) => {
+    const proc = spawn(command, args, {
+      cwd: options.cwd,
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    proc.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      if (code === 0) {
+        resolveOutput(stdout.trim());
+        return;
+      }
+      const details = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
+      const suffix = details.length > 0 ? `: ${details}` : "";
+      reject(new Error(`Command failed (${command} ${args.join(" ")})${suffix}`));
+    });
+  });
+}
 async function detectUserSkillsDir(appServer) {
   try {
     const result = await appServer.rpc("skills/list", {});
@@ -842,8 +933,82 @@ function getSharedBridgeState() {
   globalScope[SHARED_BRIDGE_KEY] = created;
   return created;
 }
+async function loadAllThreadsForSearch(appServer) {
+  const threads = [];
+  let cursor = null;
+  do {
+    const response = asRecord(await appServer.rpc("thread/list", {
+      archived: false,
+      limit: 100,
+      sortKey: "updated_at",
+      cursor
+    }));
+    const data = Array.isArray(response?.data) ? response.data : [];
+    for (const row of data) {
+      const record = asRecord(row);
+      const id = typeof record?.id === "string" ? record.id : "";
+      if (!id) continue;
+      const title = typeof record?.name === "string" && record.name.trim().length > 0 ? record.name.trim() : typeof record?.preview === "string" && record.preview.trim().length > 0 ? record.preview.trim() : "Untitled thread";
+      const preview = typeof record?.preview === "string" ? record.preview : "";
+      threads.push({ id, title, preview });
+    }
+    cursor = typeof response?.nextCursor === "string" && response.nextCursor.length > 0 ? response.nextCursor : null;
+  } while (cursor);
+  const docs = [];
+  const concurrency = 4;
+  for (let offset = 0; offset < threads.length; offset += concurrency) {
+    const batch = threads.slice(offset, offset + concurrency);
+    const loaded = await Promise.all(batch.map(async (thread) => {
+      try {
+        const readResponse = await appServer.rpc("thread/read", {
+          threadId: thread.id,
+          includeTurns: true
+        });
+        const messageText = extractThreadMessageText(readResponse);
+        const searchableText = [thread.title, thread.preview, messageText].filter(Boolean).join("\n");
+        return {
+          id: thread.id,
+          title: thread.title,
+          preview: thread.preview,
+          messageText,
+          searchableText
+        };
+      } catch {
+        const searchableText = [thread.title, thread.preview].filter(Boolean).join("\n");
+        return {
+          id: thread.id,
+          title: thread.title,
+          preview: thread.preview,
+          messageText: "",
+          searchableText
+        };
+      }
+    }));
+    docs.push(...loaded);
+  }
+  return docs;
+}
+async function buildThreadSearchIndex(appServer) {
+  const docs = await loadAllThreadsForSearch(appServer);
+  const docsById = new Map(docs.map((doc) => [doc.id, doc]));
+  return { docsById };
+}
 function createCodexBridgeMiddleware() {
   const { appServer, methodCatalog } = getSharedBridgeState();
+  let threadSearchIndex = null;
+  let threadSearchIndexPromise = null;
+  async function getThreadSearchIndex() {
+    if (threadSearchIndex) return threadSearchIndex;
+    if (!threadSearchIndexPromise) {
+      threadSearchIndexPromise = buildThreadSearchIndex(appServer).then((index) => {
+        threadSearchIndex = index;
+        return index;
+      }).finally(() => {
+        threadSearchIndexPromise = null;
+      });
+    }
+    return threadSearchIndexPromise;
+  }
   const middleware = async (req, res, next) => {
     try {
       if (!req.url) {
@@ -909,6 +1074,76 @@ function createCodexBridgeMiddleware() {
         setJson(res, 200, { data: { path: homedir() } });
         return;
       }
+      if (req.method === "POST" && url.pathname === "/codex-api/worktree/create") {
+        const payload = asRecord(await readJsonBody(req));
+        const rawSourceCwd = typeof payload?.sourceCwd === "string" ? payload.sourceCwd.trim() : "";
+        if (!rawSourceCwd) {
+          setJson(res, 400, { error: "Missing sourceCwd" });
+          return;
+        }
+        const sourceCwd = isAbsolute(rawSourceCwd) ? rawSourceCwd : resolve(rawSourceCwd);
+        try {
+          const sourceInfo = await stat(sourceCwd);
+          if (!sourceInfo.isDirectory()) {
+            setJson(res, 400, { error: "sourceCwd is not a directory" });
+            return;
+          }
+        } catch {
+          setJson(res, 404, { error: "sourceCwd does not exist" });
+          return;
+        }
+        try {
+          let gitRoot = "";
+          try {
+            gitRoot = await runCommandCapture("git", ["rev-parse", "--show-toplevel"], { cwd: sourceCwd });
+          } catch (error) {
+            if (!isNotGitRepositoryError(error)) throw error;
+            await runCommand("git", ["init"], { cwd: sourceCwd });
+            gitRoot = await runCommandCapture("git", ["rev-parse", "--show-toplevel"], { cwd: sourceCwd });
+          }
+          const repoName = basename(gitRoot) || "repo";
+          const worktreesRoot = join(getCodexHomeDir(), "worktrees");
+          await mkdir(worktreesRoot, { recursive: true });
+          let worktreeId = "";
+          let worktreeParent = "";
+          let worktreeCwd = "";
+          for (let attempt = 0; attempt < 12; attempt += 1) {
+            const candidate = randomBytes(2).toString("hex");
+            const parent = join(worktreesRoot, candidate);
+            try {
+              await stat(parent);
+              continue;
+            } catch {
+              worktreeId = candidate;
+              worktreeParent = parent;
+              worktreeCwd = join(parent, repoName);
+              break;
+            }
+          }
+          if (!worktreeId || !worktreeParent || !worktreeCwd) {
+            throw new Error("Failed to allocate a unique worktree id");
+          }
+          const branch = `codex/${worktreeId}`;
+          await mkdir(worktreeParent, { recursive: true });
+          try {
+            await runCommand("git", ["worktree", "add", "-b", branch, worktreeCwd, "HEAD"], { cwd: gitRoot });
+          } catch (error) {
+            if (!isMissingHeadError(error)) throw error;
+            await ensureRepoHasInitialCommit(gitRoot);
+            await runCommand("git", ["worktree", "add", "-b", branch, worktreeCwd, "HEAD"], { cwd: gitRoot });
+          }
+          setJson(res, 200, {
+            data: {
+              cwd: worktreeCwd,
+              branch,
+              gitRoot
+            }
+          });
+        } catch (error) {
+          setJson(res, 500, { error: getErrorMessage(error, "Failed to create worktree") });
+        }
+        return;
+      }
       if (req.method === "PUT" && url.pathname === "/codex-api/workspace-roots-state") {
         const payload = await readJsonBody(req);
         const record = asRecord(payload);
@@ -1034,6 +1269,20 @@ function createCodexBridgeMiddleware() {
         setJson(res, 200, { data: cache });
         return;
       }
+      if (req.method === "POST" && url.pathname === "/codex-api/thread-search") {
+        const payload = asRecord(await readJsonBody(req));
+        const query = typeof payload?.query === "string" ? payload.query.trim() : "";
+        const limitRaw = typeof payload?.limit === "number" ? payload.limit : 200;
+        const limit = Math.max(1, Math.min(1e3, Math.floor(limitRaw)));
+        if (!query) {
+          setJson(res, 200, { data: { threadIds: [], indexedThreadCount: 0 } });
+          return;
+        }
+        const index = await getThreadSearchIndex();
+        const matchedIds = Array.from(index.docsById.entries()).filter(([, doc]) => isExactPhraseMatch(query, doc)).slice(0, limit).map(([id]) => id);
+        setJson(res, 200, { data: { threadIds: matchedIds, indexedThreadCount: index.docsById.size } });
+        return;
+      }
       if (req.method === "PUT" && url.pathname === "/codex-api/thread-titles") {
         const payload = asRecord(await readJsonBody(req));
         const id = typeof payload?.id === "string" ? payload.id : "";
@@ -1197,6 +1446,7 @@ data: ${JSON.stringify({ ok: true })}
     }
   };
   middleware.dispose = () => {
+    threadSearchIndex = null;
     appServer.dispose();
   };
   middleware.subscribeNotifications = (listener) => {
@@ -1211,7 +1461,7 @@ data: ${JSON.stringify({ ok: true })}
 }
 
 // src/server/authMiddleware.ts
-import { randomBytes, timingSafeEqual } from "crypto";
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 var TOKEN_COOKIE = "codex_web_local_token";
 function constantTimeCompare(a, b) {
   const bufA = Buffer.from(a);
@@ -1309,7 +1559,7 @@ function createAuthSession(password) {
             res.status(401).json({ error: "Invalid password" });
             return;
           }
-          const token = randomBytes(32).toString("hex");
+          const token = randomBytes2(32).toString("hex");
           validTokens.add(token);
           res.setHeader("Set-Cookie", `${TOKEN_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict`);
           res.json({ ok: true });
@@ -1328,74 +1578,32 @@ function createAuthSession(password) {
   };
 }
 
-// src/server/localBrowseUi.ts
-import { dirname, extname, join as join2 } from "path";
-import { readFile as readFile2, readdir as readdir2, stat as stat2 } from "fs/promises";
-var TEXT_EDITABLE_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".txt",
-  ".md",
-  ".json",
-  ".js",
-  ".ts",
-  ".tsx",
-  ".jsx",
-  ".css",
-  ".scss",
-  ".html",
-  ".htm",
-  ".xml",
-  ".yml",
-  ".yaml",
-  ".log",
-  ".csv",
-  ".env",
-  ".py",
-  ".sh",
-  ".toml",
-  ".ini",
-  ".conf",
-  ".sql"
-]);
-function languageForPath(pathValue) {
-  const extension = extname(pathValue).toLowerCase();
-  switch (extension) {
-    case ".js":
-      return "javascript";
-    case ".ts":
-      return "typescript";
-    case ".jsx":
-      return "javascript";
-    case ".tsx":
-      return "typescript";
-    case ".py":
-      return "python";
-    case ".sh":
-      return "sh";
-    case ".css":
-    case ".scss":
-      return "css";
-    case ".html":
-    case ".htm":
-      return "html";
-    case ".json":
-      return "json";
-    case ".md":
-      return "markdown";
-    case ".yaml":
-    case ".yml":
-      return "yaml";
-    case ".xml":
-      return "xml";
-    case ".sql":
-      return "sql";
-    case ".toml":
-      return "ini";
-    case ".ini":
-    case ".conf":
-      return "ini";
-    default:
-      return "plaintext";
+// src/server/httpServer.ts
+import { WebSocketServer } from "ws";
+var __dirname = dirname(fileURLToPath(import.meta.url));
+var distDir = join2(__dirname, "..", "dist");
+var spaEntryFile = join2(distDir, "index.html");
+var IMAGE_CONTENT_TYPES = {
+  ".avif": "image/avif",
+  ".bmp": "image/bmp",
+  ".gif": "image/gif",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp"
+};
+function normalizeLocalImagePath(rawPath) {
+  const trimmed = rawPath.trim();
+  if (!trimmed) return "";
+  if (trimmed.startsWith("file://")) {
+    try {
+      return decodeURIComponent(trimmed.replace(/^file:\/\//u, ""));
+    } catch {
+      return trimmed.replace(/^file:\/\//u, "");
+    }
   }
+  return trimmed;
 }
 function normalizeLocalPath(rawPath) {
   const trimmed = rawPath.trim();
@@ -1417,72 +1625,39 @@ function decodeBrowsePath(rawPath) {
     return rawPath;
   }
 }
-function isTextEditablePath(pathValue) {
-  return TEXT_EDITABLE_EXTENSIONS.has(extname(pathValue).toLowerCase());
-}
 function escapeHtml(value) {
   return value.replace(/&/gu, "&amp;").replace(/</gu, "&lt;").replace(/>/gu, "&gt;").replace(/"/gu, "&quot;").replace(/'/gu, "&#39;");
 }
 function toBrowseHref(pathValue) {
   return `/codex-local-browse${encodeURI(pathValue)}`;
 }
-function toEditHref(pathValue) {
-  return `/codex-local-edit${encodeURI(pathValue)}`;
-}
-function escapeForInlineScriptString(value) {
-  return JSON.stringify(value).replace(/<\//gu, "<\\/").replace(/<!--/gu, "<\\!--").replace(/\u2028/gu, "\\u2028").replace(/\u2029/gu, "\\u2029");
-}
-async function getDirectoryItems(localPath) {
+async function renderDirectoryListing(res, localPath) {
   const entries = await readdir2(localPath, { withFileTypes: true });
-  const withMeta = await Promise.all(entries.map(async (entry) => {
-    const entryPath = join2(localPath, entry.name);
-    const entryStat = await stat2(entryPath);
-    return {
-      name: entry.name,
-      path: entryPath,
-      isDirectory: entry.isDirectory(),
-      editable: !entry.isDirectory() && isTextEditablePath(entryPath),
-      mtimeMs: entryStat.mtimeMs
-    };
-  }));
-  return withMeta.sort((a, b) => {
-    if (b.mtimeMs !== a.mtimeMs) return b.mtimeMs - a.mtimeMs;
-    if (a.isDirectory && !b.isDirectory) return -1;
-    if (!a.isDirectory && b.isDirectory) return 1;
+  const sorted = entries.slice().sort((a, b) => {
+    if (a.isDirectory() && !b.isDirectory()) return -1;
+    if (!a.isDirectory() && b.isDirectory()) return 1;
     return a.name.localeCompare(b.name);
   });
-}
-async function createDirectoryListingHtml(localPath) {
-  const items = await getDirectoryItems(localPath);
   const parentPath = dirname(localPath);
-  const rows = items.map((item) => {
-    const suffix = item.isDirectory ? "/" : "";
-    const editAction = item.editable ? ` <a class="icon-btn" aria-label="Edit ${escapeHtml(item.name)}" href="${escapeHtml(toEditHref(item.path))}" title="Edit">\u270F\uFE0F</a>` : "";
-    return `<li class="file-row"><a class="file-link" href="${escapeHtml(toBrowseHref(item.path))}">${escapeHtml(item.name)}${suffix}</a>${editAction}</li>`;
+  const rows = sorted.map((entry) => {
+    const entryPath = join2(localPath, entry.name);
+    const suffix = entry.isDirectory() ? "/" : "";
+    return `<li><a href="${escapeHtml(toBrowseHref(entryPath))}">${escapeHtml(entry.name)}${suffix}</a></li>`;
   }).join("\n");
   const parentLink = localPath !== parentPath ? `<p><a href="${escapeHtml(toBrowseHref(parentPath))}">..</a></p>` : "";
-  return `<!doctype html>
+  const html = `<!doctype html>
 <html lang="en">
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>Index of ${escapeHtml(localPath)}</title>
   <style>
-    body { font-family: ui-monospace, Menlo, Monaco, monospace; margin: 16px; background: #0b1020; color: #dbe6ff; }
+    body { font-family: ui-monospace, Menlo, Monaco, monospace; margin: 24px; background: #0b1020; color: #dbe6ff; }
     a { color: #8cc2ff; text-decoration: none; }
     a:hover { text-decoration: underline; }
-    ul { list-style: none; padding: 0; margin: 12px 0 0; display: flex; flex-direction: column; gap: 8px; }
-    .file-row { display: grid; grid-template-columns: minmax(0,1fr) auto; align-items: center; gap: 10px; }
-    .file-link { display: block; padding: 10px 12px; border: 1px solid #28405f; border-radius: 10px; background: #0f1b33; overflow-wrap: anywhere; }
-    .icon-btn { display: inline-flex; align-items: center; justify-content: center; width: 42px; height: 42px; border: 1px solid #36557a; border-radius: 10px; background: #162643; text-decoration: none; }
-    .icon-btn:hover { filter: brightness(1.08); text-decoration: none; }
+    ul { list-style: none; padding: 0; margin: 12px 0 0; }
+    li { padding: 3px 0; }
     h1 { font-size: 18px; margin: 0; word-break: break-all; }
-    @media (max-width: 640px) {
-      body { margin: 12px; }
-      .file-row { gap: 8px; }
-      .file-link { font-size: 15px; padding: 12px; }
-      .icon-btn { width: 44px; height: 44px; }
-    }
   </style>
 </head>
 <body>
@@ -1491,107 +1666,7 @@ async function createDirectoryListingHtml(localPath) {
   <ul>${rows}</ul>
 </body>
 </html>`;
-}
-async function createTextEditorHtml(localPath) {
-  const content = await readFile2(localPath, "utf8");
-  const parentPath = dirname(localPath);
-  const language = languageForPath(localPath);
-  const safeContentLiteral = escapeForInlineScriptString(content);
-  return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Edit ${escapeHtml(localPath)}</title>
-  <style>
-    html, body { width: 100%; height: 100%; margin: 0; }
-    body { font-family: ui-monospace, Menlo, Monaco, monospace; background: #0b1020; color: #dbe6ff; display: flex; flex-direction: column; overflow: hidden; }
-    .toolbar { position: sticky; top: 0; z-index: 10; display: flex; flex-direction: column; gap: 8px; padding: 10px 12px; background: #0b1020; border-bottom: 1px solid #243a5a; }
-    .row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
-    button, a { background: #1b2a4a; color: #dbe6ff; border: 1px solid #345; padding: 6px 10px; border-radius: 6px; text-decoration: none; cursor: pointer; }
-    button:hover, a:hover { filter: brightness(1.08); }
-    #editor { flex: 1 1 auto; min-height: 0; width: 100%; border: none; overflow: hidden; }
-    #status { margin-left: 8px; color: #8cc2ff; }
-    .ace_editor { background: #07101f !important; color: #dbe6ff !important; width: 100% !important; height: 100% !important; }
-    .ace_gutter { background: #07101f !important; color: #6f8eb5 !important; }
-    .ace_marker-layer .ace_active-line { background: #10213c !important; }
-    .ace_marker-layer .ace_selection { background: rgba(140, 194, 255, 0.3) !important; }
-    .meta { opacity: 0.9; font-size: 12px; overflow-wrap: anywhere; }
-  </style>
-</head>
-<body>
-  <div class="toolbar">
-    <div class="row">
-      <a href="${escapeHtml(toBrowseHref(parentPath))}">Back</a>
-      <button id="saveBtn" type="button">Save</button>
-      <span id="status"></span>
-    </div>
-    <div class="meta">${escapeHtml(localPath)} \xB7 ${escapeHtml(language)}</div>
-  </div>
-  <div id="editor"></div>
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/ace/1.36.2/ace.js"></script>
-  <script>
-    const saveBtn = document.getElementById('saveBtn');
-    const status = document.getElementById('status');
-    const editor = ace.edit('editor');
-    editor.setTheme('ace/theme/tomorrow_night');
-    editor.session.setMode('ace/mode/${escapeHtml(language)}');
-    editor.setValue(${safeContentLiteral}, -1);
-    editor.setOptions({
-      fontSize: '13px',
-      wrap: true,
-      showPrintMargin: false,
-      useSoftTabs: true,
-      tabSize: 2,
-      behavioursEnabled: true,
-    });
-    editor.resize();
-
-    saveBtn.addEventListener('click', async () => {
-      status.textContent = 'Saving...';
-      const response = await fetch(location.pathname, {
-        method: 'PUT',
-        headers: { 'Content-Type': 'text/plain; charset=utf-8' },
-        body: editor.getValue(),
-      });
-      status.textContent = response.ok ? 'Saved' : 'Save failed';
-    });
-  </script>
-</body>
-</html>`;
-}
-
-// src/server/httpServer.ts
-import { WebSocketServer } from "ws";
-var __dirname = dirname2(fileURLToPath(import.meta.url));
-var distDir = join3(__dirname, "..", "dist");
-var spaEntryFile = join3(distDir, "index.html");
-var IMAGE_CONTENT_TYPES = {
-  ".avif": "image/avif",
-  ".bmp": "image/bmp",
-  ".gif": "image/gif",
-  ".jpeg": "image/jpeg",
-  ".jpg": "image/jpeg",
-  ".png": "image/png",
-  ".svg": "image/svg+xml",
-  ".webp": "image/webp"
-};
-function normalizeLocalImagePath(rawPath) {
-  const trimmed = rawPath.trim();
-  if (!trimmed) return "";
-  if (trimmed.startsWith("file://")) {
-    try {
-      return decodeURIComponent(trimmed.replace(/^file:\/\//u, ""));
-    } catch {
-      return trimmed.replace(/^file:\/\//u, "");
-    }
-  }
-  return trimmed;
-}
-function readWildcardPathParam(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) return value.join("/");
-  return "";
+  res.status(200).type("text/html; charset=utf-8").send(html);
 }
 function createServer(options = {}) {
   const app = express();
@@ -1608,7 +1683,7 @@ function createServer(options = {}) {
       res.status(400).json({ error: "Expected absolute local file path." });
       return;
     }
-    const contentType = IMAGE_CONTENT_TYPES[extname2(localPath).toLowerCase()];
+    const contentType = IMAGE_CONTENT_TYPES[extname(localPath).toLowerCase()];
     if (!contentType) {
       res.status(415).json({ error: "Unsupported image type." });
       return;
@@ -1635,18 +1710,17 @@ function createServer(options = {}) {
     });
   });
   app.get("/codex-local-browse/*path", async (req, res) => {
-    const rawPath = readWildcardPathParam(req.params.path);
+    const rawPath = typeof req.params.path === "string" ? req.params.path : "";
     const localPath = decodeBrowsePath(`/${rawPath}`);
     if (!localPath || !isAbsolute2(localPath)) {
       res.status(400).json({ error: "Expected absolute local file path." });
       return;
     }
     try {
-      const fileStat = await stat3(localPath);
+      const fileStat = await stat2(localPath);
       res.setHeader("Cache-Control", "private, no-store");
       if (fileStat.isDirectory()) {
-        const html = await createDirectoryListingHtml(localPath);
-        res.status(200).type("text/html; charset=utf-8").send(html);
+        await renderDirectoryListing(res, localPath);
         return;
       }
       res.sendFile(localPath, { dotfiles: "allow" }, (error) => {
@@ -1657,44 +1731,6 @@ function createServer(options = {}) {
       res.status(404).json({ error: "File not found." });
     }
   });
-  app.get("/codex-local-edit/*path", async (req, res) => {
-    const rawPath = readWildcardPathParam(req.params.path);
-    const localPath = decodeBrowsePath(`/${rawPath}`);
-    if (!localPath || !isAbsolute2(localPath)) {
-      res.status(400).json({ error: "Expected absolute local file path." });
-      return;
-    }
-    try {
-      const fileStat = await stat3(localPath);
-      if (!fileStat.isFile()) {
-        res.status(400).json({ error: "Expected file path." });
-        return;
-      }
-      const html = await createTextEditorHtml(localPath);
-      res.status(200).type("text/html; charset=utf-8").send(html);
-    } catch {
-      res.status(404).json({ error: "File not found." });
-    }
-  });
-  app.put("/codex-local-edit/*path", express.text({ type: "*/*", limit: "10mb" }), async (req, res) => {
-    const rawPath = readWildcardPathParam(req.params.path);
-    const localPath = decodeBrowsePath(`/${rawPath}`);
-    if (!localPath || !isAbsolute2(localPath)) {
-      res.status(400).json({ error: "Expected absolute local file path." });
-      return;
-    }
-    if (!isTextEditablePath(localPath)) {
-      res.status(415).json({ error: "Only text-like files are editable." });
-      return;
-    }
-    const body = typeof req.body === "string" ? req.body : "";
-    try {
-      await writeFile2(localPath, body, "utf8");
-      res.status(200).json({ ok: true });
-    } catch {
-      res.status(404).json({ error: "File not found." });
-    }
-  });
   const hasFrontendAssets = existsSync(spaEntryFile);
   if (hasFrontendAssets) {
     app.use(express.static(distDir));
@@ -1766,11 +1802,11 @@ function generatePassword() {
 
 // src/cli/index.ts
 var program = new Command().name("codexui").description("Web interface for Codex app-server");
-var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
+var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
 async function readCliVersion() {
   try {
-    const packageJsonPath = join4(__dirname2, "..", "package.json");
-    const raw = await readFile3(packageJsonPath, "utf8");
+    const packageJsonPath = join3(__dirname2, "..", "package.json");
+    const raw = await readFile2(packageJsonPath, "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.version === "string" ? parsed.version : "unknown";
   } catch {
@@ -1795,13 +1831,13 @@ function runWithStatus(command, args) {
   return result.status ?? -1;
 }
 function getUserNpmPrefix() {
-  return join4(homedir2(), ".npm-global");
+  return join3(homedir2(), ".npm-global");
 }
 function resolveCodexCommand() {
   if (canRun("codex", ["--version"])) {
     return "codex";
   }
-  const userCandidate = join4(getUserNpmPrefix(), "bin", "codex");
+  const userCandidate = join3(getUserNpmPrefix(), "bin", "codex");
   if (existsSync2(userCandidate) && canRun(userCandidate, ["--version"])) {
     return userCandidate;
   }
@@ -1809,15 +1845,88 @@ function resolveCodexCommand() {
   if (!prefix) {
     return null;
   }
-  const candidate = join4(prefix, "bin", "codex");
+  const candidate = join3(prefix, "bin", "codex");
   if (existsSync2(candidate) && canRun(candidate, ["--version"])) {
     return candidate;
   }
   return null;
 }
+function resolveCloudflaredCommand() {
+  if (canRun("cloudflared", ["--version"])) {
+    return "cloudflared";
+  }
+  const localCandidate = join3(homedir2(), ".local", "bin", "cloudflared");
+  if (existsSync2(localCandidate) && canRun(localCandidate, ["--version"])) {
+    return localCandidate;
+  }
+  return null;
+}
+function mapCloudflaredLinuxArch(arch) {
+  if (arch === "x64") {
+    return "amd64";
+  }
+  if (arch === "arm64") {
+    return "arm64";
+  }
+  return null;
+}
+function downloadFile(url, destination) {
+  return new Promise((resolve2, reject) => {
+    const request = (currentUrl) => {
+      httpsGet(currentUrl, (response) => {
+        const code = response.statusCode ?? 0;
+        if (code >= 300 && code < 400 && response.headers.location) {
+          response.resume();
+          request(response.headers.location);
+          return;
+        }
+        if (code !== 200) {
+          response.resume();
+          reject(new Error(`Download failed with HTTP status ${String(code)}`));
+          return;
+        }
+        const file = createWriteStream(destination, { mode: 493 });
+        response.pipe(file);
+        file.on("finish", () => {
+          file.close();
+          resolve2();
+        });
+        file.on("error", reject);
+      }).on("error", reject);
+    };
+    request(url);
+  });
+}
+async function ensureCloudflaredInstalledLinux() {
+  const current = resolveCloudflaredCommand();
+  if (current) {
+    return current;
+  }
+  if (process.platform !== "linux") {
+    return null;
+  }
+  const mappedArch = mapCloudflaredLinuxArch(process.arch);
+  if (!mappedArch) {
+    throw new Error(`cloudflared auto-install is not supported for Linux architecture: ${process.arch}`);
+  }
+  const userBinDir = join3(homedir2(), ".local", "bin");
+  mkdirSync(userBinDir, { recursive: true });
+  const destination = join3(userBinDir, "cloudflared");
+  const downloadUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${mappedArch}`;
+  console.log("\ncloudflared not found. Installing to ~/.local/bin...\n");
+  await downloadFile(downloadUrl, destination);
+  chmodSync(destination, 493);
+  process.env.PATH = `${userBinDir}:${process.env.PATH ?? ""}`;
+  const installed = resolveCloudflaredCommand();
+  if (!installed) {
+    throw new Error("cloudflared download completed but executable is still not available");
+  }
+  console.log("\ncloudflared installed.\n");
+  return installed;
+}
 function hasCodexAuth() {
-  const codexHome = process.env.CODEX_HOME?.trim() || join4(homedir2(), ".codex");
-  return existsSync2(join4(codexHome, "auth.json"));
+  const codexHome = process.env.CODEX_HOME?.trim() || join3(homedir2(), ".codex");
+  return existsSync2(join3(codexHome, "auth.json"));
 }
 function ensureCodexInstalled() {
   let codexCommand = resolveCodexCommand();
@@ -1835,7 +1944,7 @@ function ensureCodexInstalled() {
 Global npm install requires elevated permissions. Retrying with --prefix ${userPrefix}...
 `);
       runOrFail("npm", ["install", "-g", "--prefix", userPrefix, pkg], `${label} (user prefix)`);
-      process.env.PATH = `${join4(userPrefix, "bin")}:${process.env.PATH ?? ""}`;
+      process.env.PATH = `${join3(userPrefix, "bin")}:${process.env.PATH ?? ""}`;
     };
     if (isTermuxRuntime()) {
       console.log("\nCodex CLI not found. Installing Termux-compatible Codex CLI from npm...\n");
@@ -1896,9 +2005,27 @@ function parseCloudflaredUrl(chunk) {
   }
   return urlMatch[urlMatch.length - 1] ?? null;
 }
-async function startCloudflaredTunnel(localPort) {
+function getAccessibleUrls(port) {
+  const urls = /* @__PURE__ */ new Set([`http://localhost:${String(port)}`]);
+  const interfaces = networkInterfaces();
+  for (const entries of Object.values(interfaces)) {
+    if (!entries) {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.internal) {
+        continue;
+      }
+      if (entry.family === "IPv4") {
+        urls.add(`http://${entry.address}:${String(port)}`);
+      }
+    }
+  }
+  return Array.from(urls);
+}
+async function startCloudflaredTunnel(command, localPort) {
   return new Promise((resolve2, reject) => {
-    const child = spawn2("cloudflared", ["tunnel", "--url", `http://localhost:${String(localPort)}`], {
+    const child = spawn2(command, ["tunnel", "--url", `http://localhost:${String(localPort)}`], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     const timeout = setTimeout(() => {
@@ -1949,7 +2076,7 @@ function listenWithFallback(server, startPort) {
       };
       server.once("error", onError);
       server.once("listening", onListening);
-      server.listen(port);
+      server.listen(port, "0.0.0.0");
     };
     attempt(startPort);
   });
@@ -1971,7 +2098,8 @@ async function startServer(options) {
   let tunnelUrl = null;
   if (options.tunnel) {
     try {
-      const tunnel = await startCloudflaredTunnel(port);
+      const cloudflaredCommand = await ensureCloudflaredInstalledLinux() ?? "cloudflared";
+      const tunnel = await startCloudflaredTunnel(cloudflaredCommand, port);
       tunnelChild = tunnel.process;
       tunnelUrl = tunnel.url;
     } catch (error) {
@@ -1986,8 +2114,15 @@ async function startServer(options) {
     `  Version:  ${version}`,
     "  GitHub:   https://github.com/friuns2/codexui",
     "",
-    `  Local:    http://localhost:${String(port)}`
+    `  Bind:     http://0.0.0.0:${String(port)}`
   ];
+  const accessUrls = getAccessibleUrls(port);
+  if (accessUrls.length > 0) {
+    lines.push(`  Local:    ${accessUrls[0]}`);
+    for (const accessUrl of accessUrls.slice(1)) {
+      lines.push(`  Network:  ${accessUrl}`);
+    }
+  }
   if (port !== requestedPort) {
     lines.push(`  Requested port ${String(requestedPort)} was unavailable; using ${String(port)}.`);
   }
@@ -1996,9 +2131,7 @@ async function startServer(options) {
   }
   if (tunnelUrl) {
     lines.push(`  Tunnel:   ${tunnelUrl}`);
-    lines.push("");
-    lines.push("  Tunnel QR code:");
-    lines.push(`  URL:      ${tunnelUrl}`);
+    lines.push("  Tunnel QR code below");
   }
   printTermuxKeepAlive(lines);
   lines.push("");