codexapp 0.1.28 → 0.1.30

package/dist-cli/index.js

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 
 // src/cli/index.ts
+import "dotenv/config";
 import { createServer as createServer2 } from "http";
-import { chmodSync, createWriteStream, existsSync as existsSync2, mkdirSync } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { readFile as readFile2 } from "fs/promises";
-import { homedir as homedir2, networkInterfaces } from "os";
+import { homedir as homedir2 } from "os";
 import { join as join3 } from "path";
 import { spawn as spawn2, spawnSync } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname2 } from "path";
-import { get as httpsGet } from "https";
 import { Command } from "commander";
 import qrcode from "qrcode-terminal";
 
 // src/server/httpServer.ts
 import { fileURLToPath } from "url";
 import { dirname, extname, isAbsolute as isAbsolute2, join as join2 } from "path";
-import { existsSync } from "fs";
-import { readdir as readdir2, stat as stat2 } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
 import express from "express";
 
 // src/server/codexAppServerBridge.ts
+import "dotenv/config";
 import { spawn } from "child_process";
-import { randomBytes } from "crypto";
 import { mkdtemp, readFile, readdir, rm, mkdir, stat } from "fs/promises";
+import { existsSync } from "fs";
 import { request as httpsRequest } from "https";
 import { homedir } from "os";
 import { tmpdir } from "os";
-import { basename, isAbsolute, join, resolve } from "path";
+import { isAbsolute, join, resolve } from "path";
 import { writeFile } from "fs/promises";
 function asRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -51,46 +51,6 @@ function setJson(res, statusCode, payload) {
   res.setHeader("Content-Type", "application/json; charset=utf-8");
   res.end(JSON.stringify(payload));
 }
-function extractThreadMessageText(threadReadPayload) {
-  const payload = asRecord(threadReadPayload);
-  const thread = asRecord(payload?.thread);
-  const turns = Array.isArray(thread?.turns) ? thread.turns : [];
-  const parts = [];
-  for (const turn of turns) {
-    const turnRecord = asRecord(turn);
-    const items = Array.isArray(turnRecord?.items) ? turnRecord.items : [];
-    for (const item of items) {
-      const itemRecord = asRecord(item);
-      const type = typeof itemRecord?.type === "string" ? itemRecord.type : "";
-      if (type === "agentMessage" && typeof itemRecord?.text === "string" && itemRecord.text.trim().length > 0) {
-        parts.push(itemRecord.text.trim());
-        continue;
-      }
-      if (type === "userMessage") {
-        const content = Array.isArray(itemRecord?.content) ? itemRecord.content : [];
-        for (const block of content) {
-          const blockRecord = asRecord(block);
-          if (blockRecord?.type === "text" && typeof blockRecord.text === "string" && blockRecord.text.trim().length > 0) {
-            parts.push(blockRecord.text.trim());
-          }
-        }
-        continue;
-      }
-      if (type === "commandExecution") {
-        const command = typeof itemRecord?.command === "string" ? itemRecord.command.trim() : "";
-        const output = typeof itemRecord?.aggregatedOutput === "string" ? itemRecord.aggregatedOutput.trim() : "";
-        if (command) parts.push(command);
-        if (output) parts.push(output);
-      }
-    }
-  }
-  return parts.join("\n").trim();
-}
-function isExactPhraseMatch(query, doc) {
-  const q = query.trim().toLowerCase();
-  if (!q) return false;
-  return doc.title.toLowerCase().includes(q) || doc.preview.toLowerCase().includes(q) || doc.messageText.toLowerCase().includes(q);
-}
 function scoreFileCandidate(path, query) {
   if (!query) return 0;
   const lowerPath = path.toLowerCase();
@@ -164,30 +124,8 @@ async function runCommand(command, args, options = {}) {
     });
   });
 }
-function isMissingHeadError(error) {
-  const message = getErrorMessage(error, "").toLowerCase();
-  return message.includes("not a valid object name: 'head'") || message.includes("not a valid object name: head");
-}
-function isNotGitRepositoryError(error) {
-  const message = getErrorMessage(error, "").toLowerCase();
-  return message.includes("not a git repository") || message.includes("fatal: not a git repository");
-}
-async function ensureRepoHasInitialCommit(repoRoot) {
-  const agentsPath = join(repoRoot, "AGENTS.md");
-  try {
-    await stat(agentsPath);
-  } catch {
-    await writeFile(agentsPath, "", "utf8");
-  }
-  await runCommand("git", ["add", "AGENTS.md"], { cwd: repoRoot });
-  await runCommand(
-    "git",
-    ["-c", "user.name=Codex", "-c", "user.email=codex@local", "commit", "-m", "Initialize repository for worktree support"],
-    { cwd: repoRoot }
-  );
-}
-async function runCommandCapture(command, args, options = {}) {
-  return await new Promise((resolveOutput, reject) => {
+async function runCommandWithOutput(command, args, options = {}) {
+  return await new Promise((resolve2, reject) => {
     const proc = spawn(command, args, {
       cwd: options.cwd,
       env: process.env,
@@ -204,7 +142,7 @@ async function runCommandCapture(command, args, options = {}) {
     proc.on("error", reject);
     proc.on("close", (code) => {
       if (code === 0) {
-        resolveOutput(stdout.trim());
+        resolve2(stdout);
         return;
       }
       const details = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
@@ -270,7 +208,7 @@ async function fetchSkillsTree() {
   if (skillsTreeCache && Date.now() - skillsTreeCache.fetchedAt < TREE_CACHE_TTL_MS) {
     return skillsTreeCache.entries;
   }
-  const resp = await ghFetch("https://api.github.com/repos/openclaw/skills/git/trees/main?recursive=1");
+  const resp = await ghFetch(`https://api.github.com/repos/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/git/trees/main?recursive=1`);
   if (!resp.ok) throw new Error(`GitHub tree API returned ${resp.status}`);
   const data = await resp.json();
   const metaPattern = /^skills\/([^/]+)\/([^/]+)\/_meta\.json$/;
@@ -286,7 +224,7 @@ async function fetchSkillsTree() {
     entries.push({
       name: skillName,
       owner,
-      url: `https://github.com/openclaw/skills/tree/main/skills/${owner}/${skillName}`
+      url: `https://github.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/tree/main/skills/${owner}/${skillName}`
     });
   }
   skillsTreeCache = { entries, fetchedAt: Date.now() };
@@ -298,7 +236,7 @@ async function fetchMetaBatch(entries) {
   const batch = toFetch.slice(0, 50);
   const results = await Promise.allSettled(
     batch.map(async (e) => {
-      const rawUrl = `https://raw.githubusercontent.com/openclaw/skills/main/skills/${e.owner}/${e.name}/_meta.json`;
+      const rawUrl = `https://raw.githubusercontent.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/main/skills/${e.owner}/${e.name}/_meta.json`;
       const resp = await fetch(rawUrl);
       if (!resp.ok) return;
       const meta = await resp.json();
@@ -324,6 +262,23 @@ function buildHubEntry(e) {
     installed: false
   };
 }
+var GITHUB_DEVICE_CLIENT_ID = "Iv1.b507a08c87ecfe98";
+var DEFAULT_SKILLS_SYNC_REPO_NAME = "codexskills";
+var SKILLS_SYNC_MANIFEST_PATH = "installed-skills.json";
+var SYNC_UPSTREAM_SKILLS_OWNER = "OpenClawAndroid";
+var SYNC_UPSTREAM_SKILLS_REPO = "skills";
+var HUB_SKILLS_OWNER = "openclaw";
+var HUB_SKILLS_REPO = "skills";
+var startupSkillsSyncInitialized = false;
+var startupSyncStatus = {
+  inProgress: false,
+  mode: "idle",
+  branch: getPreferredSyncBranch(),
+  lastAction: "not-started",
+  lastRunAtIso: "",
+  lastSuccessAtIso: "",
+  lastError: ""
+};
 async function scanInstalledSkillsFromDisk() {
   const map = /* @__PURE__ */ new Map();
   const skillsDir = getSkillsInstallDir();
@@ -342,6 +297,448 @@ async function scanInstalledSkillsFromDisk() {
   }
   return map;
 }
+function getSkillsSyncStatePath() {
+  return join(getCodexHomeDir(), "skills-sync.json");
+}
+async function readSkillsSyncState() {
+  try {
+    const raw = await readFile(getSkillsSyncStatePath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function writeSkillsSyncState(state) {
+  await writeFile(getSkillsSyncStatePath(), JSON.stringify(state), "utf8");
+}
+async function getGithubJson(url, token, method = "GET", body) {
+  const resp = await fetch(url, {
+    method,
+    headers: {
+      Accept: "application/vnd.github+json",
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "codex-web-local"
+    },
+    body: body ? JSON.stringify(body) : void 0
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`GitHub API ${method} ${url} failed (${resp.status}): ${text}`);
+  }
+  return await resp.json();
+}
+async function startGithubDeviceLogin() {
+  const resp = await fetch("https://github.com/login/device/code", {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded",
+      "User-Agent": "codex-web-local"
+    },
+    body: new URLSearchParams({
+      client_id: GITHUB_DEVICE_CLIENT_ID,
+      scope: "repo read:user"
+    })
+  });
+  if (!resp.ok) {
+    throw new Error(`GitHub device flow init failed (${resp.status})`);
+  }
+  return await resp.json();
+}
+async function completeGithubDeviceLogin(deviceCode) {
+  const resp = await fetch("https://github.com/login/oauth/access_token", {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded",
+      "User-Agent": "codex-web-local"
+    },
+    body: new URLSearchParams({
+      client_id: GITHUB_DEVICE_CLIENT_ID,
+      device_code: deviceCode,
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+    })
+  });
+  if (!resp.ok) {
+    throw new Error(`GitHub token exchange failed (${resp.status})`);
+  }
+  const payload = await resp.json();
+  if (!payload.access_token) return { token: null, error: payload.error || "unknown_error" };
+  return { token: payload.access_token, error: null };
+}
+function isAndroidLikeRuntime() {
+  if (process.platform === "android") return true;
+  if (existsSync("/data/data/com.termux")) return true;
+  if (process.env.TERMUX_VERSION) return true;
+  const prefix = process.env.PREFIX?.toLowerCase() ?? "";
+  if (prefix.includes("/com.termux/")) return true;
+  const proot = process.env.PROOT_TMP_DIR?.toLowerCase() ?? "";
+  if (proot.length > 0) return true;
+  return false;
+}
+function getPreferredSyncBranch() {
+  return isAndroidLikeRuntime() ? "android" : "main";
+}
+function isUpstreamSkillsRepo(repoOwner, repoName) {
+  return repoOwner.toLowerCase() === SYNC_UPSTREAM_SKILLS_OWNER.toLowerCase() && repoName.toLowerCase() === SYNC_UPSTREAM_SKILLS_REPO.toLowerCase();
+}
+async function resolveGithubUsername(token) {
+  const user = await getGithubJson("https://api.github.com/user", token);
+  return user.login;
+}
+async function ensurePrivateForkFromUpstream(token, username, repoName) {
+  const repoUrl = `https://api.github.com/repos/${username}/${repoName}`;
+  let created = false;
+  const existing = await fetch(repoUrl, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "codex-web-local"
+    }
+  });
+  if (existing.ok) {
+    const details = await existing.json();
+    if (details.private === true) return;
+    await getGithubJson(repoUrl, token, "PATCH", { private: true });
+    return;
+  }
+  if (existing.status !== 404) {
+    throw new Error(`Failed to check personal repo existence (${existing.status})`);
+  }
+  await getGithubJson(
+    "https://api.github.com/user/repos",
+    token,
+    "POST",
+    { name: repoName, private: true, auto_init: false, description: "Codex skills private mirror sync" }
+  );
+  created = true;
+  let ready = false;
+  for (let i = 0; i < 20; i++) {
+    const check = await fetch(repoUrl, {
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+        "User-Agent": "codex-web-local"
+      }
+    });
+    if (check.ok) {
+      ready = true;
+      break;
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, 1e3));
+  }
+  if (!ready) throw new Error("Private mirror repo was created but is not available yet");
+  if (!created) return;
+  const tmp = await mkdtemp(join(tmpdir(), "codex-skills-seed-"));
+  try {
+    const upstreamUrl = `https://github.com/${SYNC_UPSTREAM_SKILLS_OWNER}/${SYNC_UPSTREAM_SKILLS_REPO}.git`;
+    const branch = getPreferredSyncBranch();
+    try {
+      await runCommand("git", ["clone", "--depth", "1", "--single-branch", "--branch", branch, upstreamUrl, tmp]);
+    } catch {
+      await runCommand("git", ["clone", "--depth", "1", upstreamUrl, tmp]);
+    }
+    const privateRemote = toGitHubTokenRemote(username, repoName, token);
+    await runCommand("git", ["remote", "set-url", "origin", privateRemote], { cwd: tmp });
+    try {
+      await runCommand("git", ["checkout", "-B", branch], { cwd: tmp });
+    } catch {
+    }
+    await runCommand("git", ["push", "-u", "origin", `HEAD:${branch}`], { cwd: tmp });
+  } finally {
+    await rm(tmp, { recursive: true, force: true });
+  }
+}
+async function readRemoteSkillsManifest(token, repoOwner, repoName) {
+  const url = `https://api.github.com/repos/${repoOwner}/${repoName}/contents/${SKILLS_SYNC_MANIFEST_PATH}`;
+  const resp = await fetch(url, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "codex-web-local"
+    }
+  });
+  if (resp.status === 404) return [];
+  if (!resp.ok) throw new Error(`Failed to read remote manifest (${resp.status})`);
+  const payload = await resp.json();
+  const content = payload.content ? Buffer.from(payload.content.replace(/\n/g, ""), "base64").toString("utf8") : "[]";
+  const parsed = JSON.parse(content);
+  if (!Array.isArray(parsed)) return [];
+  const skills = [];
+  for (const row of parsed) {
+    const item = asRecord(row);
+    const owner = typeof item?.owner === "string" ? item.owner : "";
+    const name = typeof item?.name === "string" ? item.name : "";
+    if (!name) continue;
+    skills.push({ ...owner ? { owner } : {}, name, enabled: item?.enabled !== false });
+  }
+  return skills;
+}
+async function writeRemoteSkillsManifest(token, repoOwner, repoName, skills) {
+  const url = `https://api.github.com/repos/${repoOwner}/${repoName}/contents/${SKILLS_SYNC_MANIFEST_PATH}`;
+  let sha = "";
+  const existing = await fetch(url, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "codex-web-local"
+    }
+  });
+  if (existing.ok) {
+    const payload = await existing.json();
+    sha = payload.sha ?? "";
+  }
+  const content = Buffer.from(JSON.stringify(skills, null, 2), "utf8").toString("base64");
+  await getGithubJson(url, token, "PUT", {
+    message: "Update synced skills manifest",
+    content,
+    ...sha ? { sha } : {}
+  });
+}
+function toGitHubTokenRemote(repoOwner, repoName, token) {
+  return `https://x-access-token:${encodeURIComponent(token)}@github.com/${repoOwner}/${repoName}.git`;
+}
+async function ensureSkillsWorkingTreeRepo(repoUrl, branch) {
+  const localDir = getSkillsInstallDir();
+  await mkdir(localDir, { recursive: true });
+  const gitDir = join(localDir, ".git");
+  let hasGitDir = false;
+  try {
+    hasGitDir = (await stat(gitDir)).isDirectory();
+  } catch {
+    hasGitDir = false;
+  }
+  if (!hasGitDir) {
+    await runCommand("git", ["init"], { cwd: localDir });
+    await runCommand("git", ["config", "user.email", "skills-sync@local"], { cwd: localDir });
+    await runCommand("git", ["config", "user.name", "Skills Sync"], { cwd: localDir });
+    await runCommand("git", ["add", "-A"], { cwd: localDir });
+    try {
+      await runCommand("git", ["commit", "-m", "Local skills snapshot before sync"], { cwd: localDir });
+    } catch {
+    }
+    await runCommand("git", ["branch", "-M", branch], { cwd: localDir });
+    try {
+      await runCommand("git", ["remote", "add", "origin", repoUrl], { cwd: localDir });
+    } catch {
+      await runCommand("git", ["remote", "set-url", "origin", repoUrl], { cwd: localDir });
+    }
+    await runCommand("git", ["fetch", "origin"], { cwd: localDir });
+    try {
+      await runCommand("git", ["merge", "--allow-unrelated-histories", "--no-edit", `origin/${branch}`], { cwd: localDir });
+    } catch {
+    }
+    return localDir;
+  }
+  await runCommand("git", ["remote", "set-url", "origin", repoUrl], { cwd: localDir });
+  await runCommand("git", ["fetch", "origin"], { cwd: localDir });
+  await resolveMergeConflictsByNewerCommit(localDir, branch);
+  try {
+    await runCommand("git", ["checkout", branch], { cwd: localDir });
+  } catch {
+    await resolveMergeConflictsByNewerCommit(localDir, branch);
+    await runCommand("git", ["checkout", "-B", branch], { cwd: localDir });
+  }
+  await resolveMergeConflictsByNewerCommit(localDir, branch);
+  try {
+    await runCommand("git", ["stash", "push", "--include-untracked", "-m", "codex-skills-autostash"], { cwd: localDir });
+  } catch {
+  }
+  try {
+    await runCommand("git", ["pull", "--no-rebase", "origin", branch], { cwd: localDir });
+  } catch {
+    await resolveMergeConflictsByNewerCommit(localDir, branch);
+  }
+  try {
+    await runCommand("git", ["stash", "pop"], { cwd: localDir });
+  } catch {
+  }
+  return localDir;
+}
+async function resolveMergeConflictsByNewerCommit(repoDir, branch) {
+  const unmerged = (await runCommandWithOutput("git", ["diff", "--name-only", "--diff-filter=U"], { cwd: repoDir })).split(/\r?\n/).map((row) => row.trim()).filter(Boolean);
+  if (unmerged.length === 0) return;
+  for (const path of unmerged) {
+    const oursTime = await getCommitTime(repoDir, "HEAD", path);
+    const theirsTime = await getCommitTime(repoDir, `origin/${branch}`, path);
+    if (theirsTime > oursTime) {
+      await runCommand("git", ["checkout", "--theirs", "--", path], { cwd: repoDir });
+    } else {
+      await runCommand("git", ["checkout", "--ours", "--", path], { cwd: repoDir });
+    }
+    await runCommand("git", ["add", "--", path], { cwd: repoDir });
+  }
+  const mergeHead = (await runCommandWithOutput("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"], { cwd: repoDir })).trim();
+  if (mergeHead) {
+    await runCommand("git", ["commit", "-m", "Auto-resolve skills merge by newer file"], { cwd: repoDir });
+  }
+}
+async function getCommitTime(repoDir, ref, path) {
+  try {
+    const output = (await runCommandWithOutput("git", ["log", "-1", "--format=%ct", ref, "--", path], { cwd: repoDir })).trim();
+    return output ? Number.parseInt(output, 10) : 0;
+  } catch {
+    return 0;
+  }
+}
+async function syncInstalledSkillsFolderToRepo(token, repoOwner, repoName, _installedMap) {
+  const remoteUrl = toGitHubTokenRemote(repoOwner, repoName, token);
+  const branch = getPreferredSyncBranch();
+  const repoDir = await ensureSkillsWorkingTreeRepo(remoteUrl, branch);
+  const addPaths = ["."];
+  void _installedMap;
+  await runCommand("git", ["config", "user.email", "skills-sync@local"], { cwd: repoDir });
+  await runCommand("git", ["config", "user.name", "Skills Sync"], { cwd: repoDir });
+  await runCommand("git", ["add", ...addPaths], { cwd: repoDir });
+  const status = (await runCommandWithOutput("git", ["status", "--porcelain"], { cwd: repoDir })).trim();
+  if (!status) return;
+  await runCommand("git", ["commit", "-m", "Sync installed skills folder and manifest"], { cwd: repoDir });
+  await runCommand("git", ["push", "origin", `HEAD:${branch}`], { cwd: repoDir });
+}
+async function pullInstalledSkillsFolderFromRepo(token, repoOwner, repoName, _localSkillsDir) {
+  const remoteUrl = toGitHubTokenRemote(repoOwner, repoName, token);
+  const branch = getPreferredSyncBranch();
+  await ensureSkillsWorkingTreeRepo(remoteUrl, branch);
+}
+async function bootstrapSkillsFromUpstreamIntoLocal(_localSkillsDir) {
+  void _localSkillsDir;
+  const repoUrl = `https://github.com/${SYNC_UPSTREAM_SKILLS_OWNER}/${SYNC_UPSTREAM_SKILLS_REPO}.git`;
+  const branch = getPreferredSyncBranch();
+  await ensureSkillsWorkingTreeRepo(repoUrl, branch);
+}
+async function collectLocalSyncedSkills(appServer) {
+  const state = await readSkillsSyncState();
+  const owners = { ...state.installedOwners ?? {} };
+  const tree = await fetchSkillsTree();
+  const uniqueOwnerByName = /* @__PURE__ */ new Map();
+  const ambiguousNames = /* @__PURE__ */ new Set();
+  for (const entry of tree) {
+    if (ambiguousNames.has(entry.name)) continue;
+    const existingOwner = uniqueOwnerByName.get(entry.name);
+    if (!existingOwner) {
+      uniqueOwnerByName.set(entry.name, entry.owner);
+      continue;
+    }
+    if (existingOwner !== entry.owner) {
+      uniqueOwnerByName.delete(entry.name);
+      ambiguousNames.add(entry.name);
+    }
+  }
+  const skills = await appServer.rpc("skills/list", {});
+  const seen = /* @__PURE__ */ new Set();
+  const synced = [];
+  let ownersChanged = false;
+  for (const entry of skills.data ?? []) {
+    for (const skill of entry.skills ?? []) {
+      const name = typeof skill.name === "string" ? skill.name : "";
+      if (!name || seen.has(name)) continue;
+      seen.add(name);
+      let owner = owners[name];
+      if (!owner) {
+        owner = uniqueOwnerByName.get(name) ?? "";
+        if (owner) {
+          owners[name] = owner;
+          ownersChanged = true;
+        }
+      }
+      synced.push({ ...owner ? { owner } : {}, name, enabled: skill.enabled !== false });
+    }
+  }
+  if (ownersChanged) {
+    await writeSkillsSyncState({ ...state, installedOwners: owners });
+  }
+  synced.sort((a, b) => `${a.owner ?? ""}/${a.name}`.localeCompare(`${b.owner ?? ""}/${b.name}`));
+  return synced;
+}
+async function autoPushSyncedSkills(appServer) {
+  const state = await readSkillsSyncState();
+  if (!state.githubToken || !state.repoOwner || !state.repoName) return;
+  if (isUpstreamSkillsRepo(state.repoOwner, state.repoName)) {
+    throw new Error("Refusing to push to upstream skills repository");
+  }
+  const local = await collectLocalSyncedSkills(appServer);
+  const installedMap = await scanInstalledSkillsFromDisk();
+  await writeRemoteSkillsManifest(state.githubToken, state.repoOwner, state.repoName, local);
+  await syncInstalledSkillsFolderToRepo(state.githubToken, state.repoOwner, state.repoName, installedMap);
+}
+async function initializeSkillsSyncOnStartup(appServer) {
+  if (startupSkillsSyncInitialized) return;
+  startupSkillsSyncInitialized = true;
+  startupSyncStatus.inProgress = true;
+  startupSyncStatus.lastRunAtIso = (/* @__PURE__ */ new Date()).toISOString();
+  startupSyncStatus.lastError = "";
+  startupSyncStatus.branch = getPreferredSyncBranch();
+  try {
+    const state = await readSkillsSyncState();
+    const localSkillsDir = getSkillsInstallDir();
+    if (!state.githubToken) {
+      if (!isAndroidLikeRuntime()) {
+        startupSyncStatus.mode = "idle";
+        startupSyncStatus.lastAction = "skip-upstream-non-android";
+        startupSyncStatus.lastSuccessAtIso = (/* @__PURE__ */ new Date()).toISOString();
+        return;
+      }
+      startupSyncStatus.mode = "unauthenticated-bootstrap";
+      startupSyncStatus.lastAction = "pull-upstream";
+      await bootstrapSkillsFromUpstreamIntoLocal(localSkillsDir);
+      try {
+        await appServer.rpc("skills/list", { forceReload: true });
+      } catch {
+      }
+      startupSyncStatus.lastSuccessAtIso = (/* @__PURE__ */ new Date()).toISOString();
+      startupSyncStatus.lastAction = "pull-upstream-complete";
+      return;
+    }
+    startupSyncStatus.mode = "authenticated-fork-sync";
+    startupSyncStatus.lastAction = "ensure-private-fork";
+    const username = state.githubUsername || await resolveGithubUsername(state.githubToken);
+    const repoName = DEFAULT_SKILLS_SYNC_REPO_NAME;
+    await ensurePrivateForkFromUpstream(state.githubToken, username, repoName);
+    const nextState = { ...state, githubUsername: username, repoOwner: username, repoName };
+    await writeSkillsSyncState(nextState);
+    startupSyncStatus.lastAction = "pull-private-fork";
+    await pullInstalledSkillsFolderFromRepo(state.githubToken, username, repoName, localSkillsDir);
+    try {
+      await appServer.rpc("skills/list", { forceReload: true });
+    } catch {
+    }
+    startupSyncStatus.lastAction = "push-private-fork";
+    await autoPushSyncedSkills(appServer);
+    startupSyncStatus.lastSuccessAtIso = (/* @__PURE__ */ new Date()).toISOString();
+    startupSyncStatus.lastAction = "startup-sync-complete";
+  } catch (error) {
+    startupSyncStatus.lastError = getErrorMessage(error, "startup-sync-failed");
+    startupSyncStatus.lastAction = "startup-sync-failed";
+  } finally {
+    startupSyncStatus.inProgress = false;
+  }
+}
+async function finalizeGithubLoginAndSync(token, username, appServer) {
+  const repoName = DEFAULT_SKILLS_SYNC_REPO_NAME;
+  await ensurePrivateForkFromUpstream(token, username, repoName);
+  const current = await readSkillsSyncState();
+  await writeSkillsSyncState({
+    ...current,
+    githubToken: token,
+    githubUsername: username,
+    repoOwner: username,
+    repoName
+  });
+  const localDir = getSkillsInstallDir();
+  await pullInstalledSkillsFolderFromRepo(token, username, repoName, localDir);
+  try {
+    await appServer.rpc("skills/list", { forceReload: true });
+  } catch {
+  }
+  await autoPushSyncedSkills(appServer);
+}
 async function searchSkillsHub(allEntries, query, limit, sort, installedMap) {
   const q = query.toLowerCase().trim();
   let filtered = q ? allEntries.filter((s) => {
@@ -933,82 +1330,9 @@ function getSharedBridgeState() {
   globalScope[SHARED_BRIDGE_KEY] = created;
   return created;
 }
-async function loadAllThreadsForSearch(appServer) {
-  const threads = [];
-  let cursor = null;
-  do {
-    const response = asRecord(await appServer.rpc("thread/list", {
-      archived: false,
-      limit: 100,
-      sortKey: "updated_at",
-      cursor
-    }));
-    const data = Array.isArray(response?.data) ? response.data : [];
-    for (const row of data) {
-      const record = asRecord(row);
-      const id = typeof record?.id === "string" ? record.id : "";
-      if (!id) continue;
-      const title = typeof record?.name === "string" && record.name.trim().length > 0 ? record.name.trim() : typeof record?.preview === "string" && record.preview.trim().length > 0 ? record.preview.trim() : "Untitled thread";
-      const preview = typeof record?.preview === "string" ? record.preview : "";
-      threads.push({ id, title, preview });
-    }
-    cursor = typeof response?.nextCursor === "string" && response.nextCursor.length > 0 ? response.nextCursor : null;
-  } while (cursor);
-  const docs = [];
-  const concurrency = 4;
-  for (let offset = 0; offset < threads.length; offset += concurrency) {
-    const batch = threads.slice(offset, offset + concurrency);
-    const loaded = await Promise.all(batch.map(async (thread) => {
-      try {
-        const readResponse = await appServer.rpc("thread/read", {
-          threadId: thread.id,
-          includeTurns: true
-        });
-        const messageText = extractThreadMessageText(readResponse);
-        const searchableText = [thread.title, thread.preview, messageText].filter(Boolean).join("\n");
-        return {
-          id: thread.id,
-          title: thread.title,
-          preview: thread.preview,
-          messageText,
-          searchableText
-        };
-      } catch {
-        const searchableText = [thread.title, thread.preview].filter(Boolean).join("\n");
-        return {
-          id: thread.id,
-          title: thread.title,
-          preview: thread.preview,
-          messageText: "",
-          searchableText
-        };
-      }
-    }));
-    docs.push(...loaded);
-  }
-  return docs;
-}
-async function buildThreadSearchIndex(appServer) {
-  const docs = await loadAllThreadsForSearch(appServer);
-  const docsById = new Map(docs.map((doc) => [doc.id, doc]));
-  return { docsById };
-}
 function createCodexBridgeMiddleware() {
   const { appServer, methodCatalog } = getSharedBridgeState();
-  let threadSearchIndex = null;
-  let threadSearchIndexPromise = null;
-  async function getThreadSearchIndex() {
-    if (threadSearchIndex) return threadSearchIndex;
-    if (!threadSearchIndexPromise) {
-      threadSearchIndexPromise = buildThreadSearchIndex(appServer).then((index) => {
-        threadSearchIndex = index;
-        return index;
-      }).finally(() => {
-        threadSearchIndexPromise = null;
-      });
-    }
-    return threadSearchIndexPromise;
-  }
+  void initializeSkillsSyncOnStartup(appServer);
   const middleware = async (req, res, next) => {
     try {
       if (!req.url) {
@@ -1074,76 +1398,6 @@ function createCodexBridgeMiddleware() {
         setJson(res, 200, { data: { path: homedir() } });
         return;
       }
-      if (req.method === "POST" && url.pathname === "/codex-api/worktree/create") {
-        const payload = asRecord(await readJsonBody(req));
-        const rawSourceCwd = typeof payload?.sourceCwd === "string" ? payload.sourceCwd.trim() : "";
-        if (!rawSourceCwd) {
-          setJson(res, 400, { error: "Missing sourceCwd" });
-          return;
-        }
-        const sourceCwd = isAbsolute(rawSourceCwd) ? rawSourceCwd : resolve(rawSourceCwd);
-        try {
-          const sourceInfo = await stat(sourceCwd);
-          if (!sourceInfo.isDirectory()) {
-            setJson(res, 400, { error: "sourceCwd is not a directory" });
-            return;
-          }
-        } catch {
-          setJson(res, 404, { error: "sourceCwd does not exist" });
-          return;
-        }
-        try {
-          let gitRoot = "";
-          try {
-            gitRoot = await runCommandCapture("git", ["rev-parse", "--show-toplevel"], { cwd: sourceCwd });
-          } catch (error) {
-            if (!isNotGitRepositoryError(error)) throw error;
-            await runCommand("git", ["init"], { cwd: sourceCwd });
-            gitRoot = await runCommandCapture("git", ["rev-parse", "--show-toplevel"], { cwd: sourceCwd });
-          }
-          const repoName = basename(gitRoot) || "repo";
-          const worktreesRoot = join(getCodexHomeDir(), "worktrees");
-          await mkdir(worktreesRoot, { recursive: true });
-          let worktreeId = "";
-          let worktreeParent = "";
-          let worktreeCwd = "";
-          for (let attempt = 0; attempt < 12; attempt += 1) {
-            const candidate = randomBytes(2).toString("hex");
-            const parent = join(worktreesRoot, candidate);
-            try {
-              await stat(parent);
-              continue;
-            } catch {
-              worktreeId = candidate;
-              worktreeParent = parent;
-              worktreeCwd = join(parent, repoName);
-              break;
-            }
-          }
-          if (!worktreeId || !worktreeParent || !worktreeCwd) {
-            throw new Error("Failed to allocate a unique worktree id");
-          }
-          const branch = `codex/${worktreeId}`;
-          await mkdir(worktreeParent, { recursive: true });
-          try {
-            await runCommand("git", ["worktree", "add", "-b", branch, worktreeCwd, "HEAD"], { cwd: gitRoot });
-          } catch (error) {
-            if (!isMissingHeadError(error)) throw error;
-            await ensureRepoHasInitialCommit(gitRoot);
-            await runCommand("git", ["worktree", "add", "-b", branch, worktreeCwd, "HEAD"], { cwd: gitRoot });
-          }
-          setJson(res, 200, {
-            data: {
-              cwd: worktreeCwd,
-              branch,
-              gitRoot
-            }
-          });
-        } catch (error) {
-          setJson(res, 500, { error: getErrorMessage(error, "Failed to create worktree") });
-        }
-        return;
-      }
       if (req.method === "PUT" && url.pathname === "/codex-api/workspace-roots-state") {
         const payload = await readJsonBody(req);
         const record = asRecord(payload);
@@ -1269,20 +1523,6 @@ function createCodexBridgeMiddleware() {
         setJson(res, 200, { data: cache });
         return;
       }
-      if (req.method === "POST" && url.pathname === "/codex-api/thread-search") {
-        const payload = asRecord(await readJsonBody(req));
-        const query = typeof payload?.query === "string" ? payload.query.trim() : "";
-        const limitRaw = typeof payload?.limit === "number" ? payload.limit : 200;
-        const limit = Math.max(1, Math.min(1e3, Math.floor(limitRaw)));
-        if (!query) {
-          setJson(res, 200, { data: { threadIds: [], indexedThreadCount: 0 } });
-          return;
-        }
-        const index = await getThreadSearchIndex();
-        const matchedIds = Array.from(index.docsById.entries()).filter(([, doc]) => isExactPhraseMatch(query, doc)).slice(0, limit).map(([id]) => id);
-        setJson(res, 200, { data: { threadIds: matchedIds, indexedThreadCount: index.docsById.size } });
-        return;
-      }
       if (req.method === "PUT" && url.pathname === "/codex-api/thread-titles") {
         const payload = asRecord(await readJsonBody(req));
         const id = typeof payload?.id === "string" ? payload.id : "";
@@ -1339,6 +1579,182 @@ function createCodexBridgeMiddleware() {
         }
         return;
       }
+      if (req.method === "GET" && url.pathname === "/codex-api/skills-sync/status") {
+        const state = await readSkillsSyncState();
+        setJson(res, 200, {
+          data: {
+            loggedIn: Boolean(state.githubToken),
+            githubUsername: state.githubUsername ?? "",
+            repoOwner: state.repoOwner ?? "",
+            repoName: state.repoName ?? "",
+            configured: Boolean(state.githubToken && state.repoOwner && state.repoName),
+            startup: {
+              inProgress: startupSyncStatus.inProgress,
+              mode: startupSyncStatus.mode,
+              branch: startupSyncStatus.branch,
+              lastAction: startupSyncStatus.lastAction,
+              lastRunAtIso: startupSyncStatus.lastRunAtIso,
+              lastSuccessAtIso: startupSyncStatus.lastSuccessAtIso,
+              lastError: startupSyncStatus.lastError
+            }
+          }
+        });
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/github/start-login") {
+        try {
+          const started = await startGithubDeviceLogin();
+          setJson(res, 200, { data: started });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to start GitHub login") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/github/token-login") {
+        try {
+          const payload = asRecord(await readJsonBody(req));
+          const token = typeof payload?.token === "string" ? payload.token.trim() : "";
+          if (!token) {
+            setJson(res, 400, { error: "Missing GitHub token" });
+            return;
+          }
+          const username = await resolveGithubUsername(token);
+          await finalizeGithubLoginAndSync(token, username, appServer);
+          setJson(res, 200, { ok: true, data: { githubUsername: username } });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to login with GitHub token") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/github/logout") {
+        try {
+          const state = await readSkillsSyncState();
+          await writeSkillsSyncState({
+            ...state,
+            githubToken: void 0,
+            githubUsername: void 0,
+            repoOwner: void 0,
+            repoName: void 0
+          });
+          setJson(res, 200, { ok: true });
+        } catch (error) {
+          setJson(res, 500, { error: getErrorMessage(error, "Failed to logout GitHub") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/github/complete-login") {
+        try {
+          const payload = asRecord(await readJsonBody(req));
+          const deviceCode = typeof payload?.deviceCode === "string" ? payload.deviceCode : "";
+          if (!deviceCode) {
+            setJson(res, 400, { error: "Missing deviceCode" });
+            return;
+          }
+          const result = await completeGithubDeviceLogin(deviceCode);
+          if (!result.token) {
+            setJson(res, 200, { ok: false, pending: result.error === "authorization_pending", error: result.error || "login_failed" });
+            return;
+          }
+          const token = result.token;
+          const username = await resolveGithubUsername(token);
+          await finalizeGithubLoginAndSync(token, username, appServer);
+          setJson(res, 200, { ok: true, data: { githubUsername: username } });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to complete GitHub login") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/push") {
+        try {
+          const state = await readSkillsSyncState();
+          if (!state.githubToken || !state.repoOwner || !state.repoName) {
+            setJson(res, 400, { error: "Skills sync is not configured yet" });
+            return;
+          }
+          if (isUpstreamSkillsRepo(state.repoOwner, state.repoName)) {
+            setJson(res, 400, { error: "Refusing to push to upstream repository" });
+            return;
+          }
+          const local = await collectLocalSyncedSkills(appServer);
+          const installedMap = await scanInstalledSkillsFromDisk();
+          await writeRemoteSkillsManifest(state.githubToken, state.repoOwner, state.repoName, local);
+          await syncInstalledSkillsFolderToRepo(state.githubToken, state.repoOwner, state.repoName, installedMap);
+          setJson(res, 200, { ok: true, data: { synced: local.length } });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to push synced skills") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/pull") {
+        try {
+          const state = await readSkillsSyncState();
+          if (!state.githubToken || !state.repoOwner || !state.repoName) {
+            setJson(res, 400, { error: "Skills sync is not configured yet" });
+            return;
+          }
+          const remote = await readRemoteSkillsManifest(state.githubToken, state.repoOwner, state.repoName);
+          const tree = await fetchSkillsTree();
+          const uniqueOwnerByName = /* @__PURE__ */ new Map();
+          const ambiguousNames = /* @__PURE__ */ new Set();
+          for (const entry of tree) {
+            if (ambiguousNames.has(entry.name)) continue;
+            const existingOwner = uniqueOwnerByName.get(entry.name);
+            if (!existingOwner) {
+              uniqueOwnerByName.set(entry.name, entry.owner);
+              continue;
+            }
+            if (existingOwner !== entry.owner) {
+              uniqueOwnerByName.delete(entry.name);
+              ambiguousNames.add(entry.name);
+            }
+          }
+          const localDir = await detectUserSkillsDir(appServer);
+          await pullInstalledSkillsFolderFromRepo(state.githubToken, state.repoOwner, state.repoName, localDir);
+          const installerScript = "/Users/igor/.cursor/skills/.system/skill-installer/scripts/install-skill-from-github.py";
+          const localSkills = await scanInstalledSkillsFromDisk();
+          for (const skill of remote) {
+            const owner = skill.owner || uniqueOwnerByName.get(skill.name) || "";
+            if (!owner) {
+              continue;
+            }
+            if (!localSkills.has(skill.name)) {
+              await runCommand("python3", [
+                installerScript,
+                "--repo",
+                `${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}`,
+                "--path",
+                `skills/${owner}/${skill.name}`,
+                "--dest",
+                localDir,
+                "--method",
+                "git"
+              ]);
+            }
+            const skillPath = join(localDir, skill.name);
+            await appServer.rpc("skills/config/write", { path: skillPath, enabled: skill.enabled });
+          }
+          const remoteNames = new Set(remote.map((row) => row.name));
+          for (const [name, localInfo] of localSkills.entries()) {
+            if (!remoteNames.has(name)) {
+              await rm(localInfo.path.replace(/\/SKILL\.md$/, ""), { recursive: true, force: true });
+            }
+          }
+          const nextOwners = {};
+          for (const item of remote) {
+            const owner = item.owner || uniqueOwnerByName.get(item.name) || "";
+            if (owner) nextOwners[item.name] = owner;
+          }
+          await writeSkillsSyncState({ ...state, installedOwners: nextOwners });
+          try {
+            await appServer.rpc("skills/list", { forceReload: true });
+          } catch {
+          }
+          setJson(res, 200, { ok: true, data: { synced: remote.length } });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to pull synced skills") });
+        }
+        return;
+      }
       if (req.method === "GET" && url.pathname === "/codex-api/skills-hub/readme") {
         try {
           const owner = url.searchParams.get("owner") || "";
@@ -1347,7 +1763,7 @@ function createCodexBridgeMiddleware() {
             setJson(res, 400, { error: "Missing owner or name" });
             return;
           }
-          const rawUrl = `https://raw.githubusercontent.com/openclaw/skills/main/skills/${owner}/${name}/SKILL.md`;
+          const rawUrl = `https://raw.githubusercontent.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/main/skills/${owner}/${name}/SKILL.md`;
           const resp = await fetch(rawUrl);
           if (!resp.ok) throw new Error(`Failed to fetch SKILL.md: ${resp.status}`);
           const content = await resp.text();
@@ -1372,7 +1788,7 @@ function createCodexBridgeMiddleware() {
           await runCommand("python3", [
             installerScript,
             "--repo",
-            "openclaw/skills",
+            `${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}`,
             "--path",
             skillPathInRepo,
             "--dest",
@@ -1382,6 +1798,10 @@ function createCodexBridgeMiddleware() {
           ]);
           const skillDir = join(installDest, name);
           await ensureInstalledSkillIsValid(appServer, skillDir);
+          const syncState = await readSkillsSyncState();
+          const nextOwners = { ...syncState.installedOwners ?? {}, [name]: owner };
+          await writeSkillsSyncState({ ...syncState, installedOwners: nextOwners });
+          await autoPushSyncedSkills(appServer);
           setJson(res, 200, { ok: true, path: skillDir });
         } catch (error) {
           setJson(res, 502, { error: getErrorMessage(error, "Failed to install skill") });
@@ -1399,6 +1819,13 @@ function createCodexBridgeMiddleware() {
             return;
           }
           await rm(target, { recursive: true, force: true });
+          if (name) {
+            const syncState = await readSkillsSyncState();
+            const nextOwners = { ...syncState.installedOwners ?? {} };
+            delete nextOwners[name];
+            await writeSkillsSyncState({ ...syncState, installedOwners: nextOwners });
+          }
+          await autoPushSyncedSkills(appServer);
           try {
             await appServer.rpc("skills/list", { forceReload: true });
           } catch {
@@ -1446,7 +1873,6 @@ data: ${JSON.stringify({ ok: true })}
     }
   };
   middleware.dispose = () => {
-    threadSearchIndex = null;
     appServer.dispose();
   };
   middleware.subscribeNotifications = (listener) => {
@@ -1461,7 +1887,7 @@ data: ${JSON.stringify({ ok: true })}
 }
 
 // src/server/authMiddleware.ts
-import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { randomBytes, timingSafeEqual } from "crypto";
 var TOKEN_COOKIE = "codex_web_local_token";
 function constantTimeCompare(a, b) {
   const bufA = Buffer.from(a);
@@ -1559,7 +1985,7 @@ function createAuthSession(password) {
             res.status(401).json({ error: "Invalid password" });
             return;
           }
-          const token = randomBytes2(32).toString("hex");
+          const token = randomBytes(32).toString("hex");
           validTokens.add(token);
           res.setHeader("Set-Cookie", `${TOKEN_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict`);
           res.json({ ok: true });
@@ -1605,69 +2031,6 @@ function normalizeLocalImagePath(rawPath) {
   }
   return trimmed;
 }
-function normalizeLocalPath(rawPath) {
-  const trimmed = rawPath.trim();
-  if (!trimmed) return "";
-  if (trimmed.startsWith("file://")) {
-    try {
-      return decodeURIComponent(trimmed.replace(/^file:\/\//u, ""));
-    } catch {
-      return trimmed.replace(/^file:\/\//u, "");
-    }
-  }
-  return trimmed;
-}
-function decodeBrowsePath(rawPath) {
-  if (!rawPath) return "";
-  try {
-    return decodeURIComponent(rawPath);
-  } catch {
-    return rawPath;
-  }
-}
-function escapeHtml(value) {
-  return value.replace(/&/gu, "&amp;").replace(/</gu, "&lt;").replace(/>/gu, "&gt;").replace(/"/gu, "&quot;").replace(/'/gu, "&#39;");
-}
-function toBrowseHref(pathValue) {
-  return `/codex-local-browse${encodeURI(pathValue)}`;
-}
-async function renderDirectoryListing(res, localPath) {
-  const entries = await readdir2(localPath, { withFileTypes: true });
-  const sorted = entries.slice().sort((a, b) => {
-    if (a.isDirectory() && !b.isDirectory()) return -1;
-    if (!a.isDirectory() && b.isDirectory()) return 1;
-    return a.name.localeCompare(b.name);
-  });
-  const parentPath = dirname(localPath);
-  const rows = sorted.map((entry) => {
-    const entryPath = join2(localPath, entry.name);
-    const suffix = entry.isDirectory() ? "/" : "";
-    return `<li><a href="${escapeHtml(toBrowseHref(entryPath))}">${escapeHtml(entry.name)}${suffix}</a></li>`;
-  }).join("\n");
-  const parentLink = localPath !== parentPath ? `<p><a href="${escapeHtml(toBrowseHref(parentPath))}">..</a></p>` : "";
-  const html = `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Index of ${escapeHtml(localPath)}</title>
-  <style>
-    body { font-family: ui-monospace, Menlo, Monaco, monospace; margin: 24px; background: #0b1020; color: #dbe6ff; }
-    a { color: #8cc2ff; text-decoration: none; }
-    a:hover { text-decoration: underline; }
-    ul { list-style: none; padding: 0; margin: 12px 0 0; }
-    li { padding: 3px 0; }
-    h1 { font-size: 18px; margin: 0; word-break: break-all; }
-  </style>
-</head>
-<body>
-  <h1>Index of ${escapeHtml(localPath)}</h1>
-  ${parentLink}
-  <ul>${rows}</ul>
-</body>
-</html>`;
-  res.status(200).type("text/html; charset=utf-8").send(html);
-}
 function createServer(options = {}) {
   const app = express();
   const bridge = createCodexBridgeMiddleware();
@@ -1695,43 +2058,7 @@ function createServer(options = {}) {
       if (!res.headersSent) res.status(404).json({ error: "Image file not found." });
     });
   });
-  app.get("/codex-local-file", (req, res) => {
-    const rawPath = typeof req.query.path === "string" ? req.query.path : "";
-    const localPath = normalizeLocalPath(rawPath);
-    if (!localPath || !isAbsolute2(localPath)) {
-      res.status(400).json({ error: "Expected absolute local file path." });
-      return;
-    }
-    res.setHeader("Cache-Control", "private, no-store");
-    res.setHeader("Content-Disposition", "inline");
-    res.sendFile(localPath, { dotfiles: "allow" }, (error) => {
-      if (!error) return;
-      if (!res.headersSent) res.status(404).json({ error: "File not found." });
-    });
-  });
-  app.get("/codex-local-browse/*path", async (req, res) => {
-    const rawPath = typeof req.params.path === "string" ? req.params.path : "";
-    const localPath = decodeBrowsePath(`/${rawPath}`);
-    if (!localPath || !isAbsolute2(localPath)) {
-      res.status(400).json({ error: "Expected absolute local file path." });
-      return;
-    }
-    try {
-      const fileStat = await stat2(localPath);
-      res.setHeader("Cache-Control", "private, no-store");
-      if (fileStat.isDirectory()) {
-        await renderDirectoryListing(res, localPath);
-        return;
-      }
-      res.sendFile(localPath, { dotfiles: "allow" }, (error) => {
-        if (!error) return;
-        if (!res.headersSent) res.status(404).json({ error: "File not found." });
-      });
-    } catch {
-      res.status(404).json({ error: "File not found." });
-    }
-  });
-  const hasFrontendAssets = existsSync(spaEntryFile);
+  const hasFrontendAssets = existsSync2(spaEntryFile);
   if (hasFrontendAssets) {
     app.use(express.static(distDir));
   }
@@ -1838,7 +2165,7 @@ function resolveCodexCommand() {
     return "codex";
   }
   const userCandidate = join3(getUserNpmPrefix(), "bin", "codex");
-  if (existsSync2(userCandidate) && canRun(userCandidate, ["--version"])) {
+  if (existsSync3(userCandidate) && canRun(userCandidate, ["--version"])) {
     return userCandidate;
   }
   const prefix = process.env.PREFIX?.trim();
@@ -1846,87 +2173,14 @@ function resolveCodexCommand() {
     return null;
   }
   const candidate = join3(prefix, "bin", "codex");
-  if (existsSync2(candidate) && canRun(candidate, ["--version"])) {
+  if (existsSync3(candidate) && canRun(candidate, ["--version"])) {
     return candidate;
   }
   return null;
 }
-function resolveCloudflaredCommand() {
-  if (canRun("cloudflared", ["--version"])) {
-    return "cloudflared";
-  }
-  const localCandidate = join3(homedir2(), ".local", "bin", "cloudflared");
-  if (existsSync2(localCandidate) && canRun(localCandidate, ["--version"])) {
-    return localCandidate;
-  }
-  return null;
-}
-function mapCloudflaredLinuxArch(arch) {
-  if (arch === "x64") {
-    return "amd64";
-  }
-  if (arch === "arm64") {
-    return "arm64";
-  }
-  return null;
-}
-function downloadFile(url, destination) {
-  return new Promise((resolve2, reject) => {
-    const request = (currentUrl) => {
-      httpsGet(currentUrl, (response) => {
-        const code = response.statusCode ?? 0;
-        if (code >= 300 && code < 400 && response.headers.location) {
-          response.resume();
-          request(response.headers.location);
-          return;
-        }
-        if (code !== 200) {
-          response.resume();
-          reject(new Error(`Download failed with HTTP status ${String(code)}`));
-          return;
-        }
-        const file = createWriteStream(destination, { mode: 493 });
-        response.pipe(file);
-        file.on("finish", () => {
-          file.close();
-          resolve2();
-        });
-        file.on("error", reject);
-      }).on("error", reject);
-    };
-    request(url);
-  });
-}
-async function ensureCloudflaredInstalledLinux() {
-  const current = resolveCloudflaredCommand();
-  if (current) {
-    return current;
-  }
-  if (process.platform !== "linux") {
-    return null;
-  }
-  const mappedArch = mapCloudflaredLinuxArch(process.arch);
-  if (!mappedArch) {
-    throw new Error(`cloudflared auto-install is not supported for Linux architecture: ${process.arch}`);
-  }
-  const userBinDir = join3(homedir2(), ".local", "bin");
-  mkdirSync(userBinDir, { recursive: true });
-  const destination = join3(userBinDir, "cloudflared");
-  const downloadUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${mappedArch}`;
-  console.log("\ncloudflared not found. Installing to ~/.local/bin...\n");
-  await downloadFile(downloadUrl, destination);
-  chmodSync(destination, 493);
-  process.env.PATH = `${userBinDir}:${process.env.PATH ?? ""}`;
-  const installed = resolveCloudflaredCommand();
-  if (!installed) {
-    throw new Error("cloudflared download completed but executable is still not available");
-  }
-  console.log("\ncloudflared installed.\n");
-  return installed;
-}
 function hasCodexAuth() {
   const codexHome = process.env.CODEX_HOME?.trim() || join3(homedir2(), ".codex");
-  return existsSync2(join3(codexHome, "auth.json"));
+  return existsSync3(join3(codexHome, "auth.json"));
 }
 function ensureCodexInstalled() {
   let codexCommand = resolveCodexCommand();
@@ -2005,27 +2259,9 @@ function parseCloudflaredUrl(chunk) {
   }
   return urlMatch[urlMatch.length - 1] ?? null;
 }
-function getAccessibleUrls(port) {
-  const urls = /* @__PURE__ */ new Set([`http://localhost:${String(port)}`]);
-  const interfaces = networkInterfaces();
-  for (const entries of Object.values(interfaces)) {
-    if (!entries) {
-      continue;
-    }
-    for (const entry of entries) {
-      if (entry.internal) {
-        continue;
-      }
-      if (entry.family === "IPv4") {
-        urls.add(`http://${entry.address}:${String(port)}`);
-      }
-    }
-  }
-  return Array.from(urls);
-}
-async function startCloudflaredTunnel(command, localPort) {
+async function startCloudflaredTunnel(localPort) {
   return new Promise((resolve2, reject) => {
-    const child = spawn2(command, ["tunnel", "--url", `http://localhost:${String(localPort)}`], {
+    const child = spawn2("cloudflared", ["tunnel", "--url", `http://localhost:${String(localPort)}`], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     const timeout = setTimeout(() => {
@@ -2076,7 +2312,7 @@ function listenWithFallback(server, startPort) {
       };
       server.once("error", onError);
       server.once("listening", onListening);
-      server.listen(port, "0.0.0.0");
+      server.listen(port);
     };
     attempt(startPort);
   });
@@ -2098,8 +2334,7 @@ async function startServer(options) {
   let tunnelUrl = null;
   if (options.tunnel) {
     try {
-      const cloudflaredCommand = await ensureCloudflaredInstalledLinux() ?? "cloudflared";
-      const tunnel = await startCloudflaredTunnel(cloudflaredCommand, port);
+      const tunnel = await startCloudflaredTunnel(port);
       tunnelChild = tunnel.process;
       tunnelUrl = tunnel.url;
     } catch (error) {
@@ -2114,15 +2349,8 @@ async function startServer(options) {
     `  Version:  ${version}`,
     "  GitHub:   https://github.com/friuns2/codexui",
     "",
-    `  Bind:     http://0.0.0.0:${String(port)}`
+    `  Local:    http://localhost:${String(port)}`
   ];
-  const accessUrls = getAccessibleUrls(port);
-  if (accessUrls.length > 0) {
-    lines.push(`  Local:    ${accessUrls[0]}`);
-    for (const accessUrl of accessUrls.slice(1)) {
-      lines.push(`  Network:  ${accessUrl}`);
-    }
-  }
   if (port !== requestedPort) {
     lines.push(`  Requested port ${String(requestedPort)} was unavailable; using ${String(port)}.`);
   }
@@ -2131,7 +2359,9 @@ async function startServer(options) {
   }
   if (tunnelUrl) {
     lines.push(`  Tunnel:   ${tunnelUrl}`);
-    lines.push("  Tunnel QR code below");
+    lines.push("");
+    lines.push("  Tunnel QR code:");
+    lines.push(`  URL:      ${tunnelUrl}`);
   }
   printTermuxKeepAlive(lines);
   lines.push("");