codexapp 0.1.44 → 0.1.45

package/dist-cli/index.js

@@ -2,11 +2,11 @@
 
 // src/cli/index.ts
 import { createServer as createServer2 } from "http";
-import { chmodSync, createWriteStream, existsSync as existsSync3, mkdirSync } from "fs";
-import { readFile as readFile4 } from "fs/promises";
-import { homedir as homedir3, networkInterfaces } from "os";
-import { join as join5 } from "path";
-import { spawn as spawn3, spawnSync } from "child_process";
+import { chmodSync, createWriteStream, existsSync as existsSync2, mkdirSync } from "fs";
+import { readFile as readFile3 } from "fs/promises";
+import { homedir as homedir2, networkInterfaces } from "os";
+import { join as join4 } from "path";
+import { spawn as spawn2, spawnSync } from "child_process";
 import { createInterface } from "readline/promises";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname3 } from "path";
@@ -16,1140 +16,52 @@ import qrcode from "qrcode-terminal";
 
 // src/server/httpServer.ts
 import { fileURLToPath } from "url";
-import { dirname as dirname2, extname as extname2, isAbsolute as isAbsolute2, join as join4 } from "path";
-import { existsSync as existsSync2 } from "fs";
-import { writeFile as writeFile3, stat as stat4 } from "fs/promises";
-import express from "express";
-
-// src/server/codexAppServerBridge.ts
-import { spawn as spawn2 } from "child_process";
-import { randomBytes } from "crypto";
-import { mkdtemp as mkdtemp2, readFile as readFile2, mkdir as mkdir2, stat as stat2 } from "fs/promises";
-import { request as httpsRequest } from "https";
-import { homedir as homedir2 } from "os";
-import { tmpdir as tmpdir2 } from "os";
-import { basename, isAbsolute, join as join2, resolve } from "path";
-import { writeFile as writeFile2 } from "fs/promises";
-
-// src/server/skillsRoutes.ts
-import { spawn } from "child_process";
-import { mkdtemp, readFile, readdir, rm, mkdir, stat, lstat, readlink, symlink } from "fs/promises";
-import { existsSync } from "fs";
-import { homedir, tmpdir } from "os";
-import { join } from "path";
-import { writeFile } from "fs/promises";
-function asRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function getErrorMessage(payload, fallback) {
-  if (payload instanceof Error && payload.message.trim().length > 0) {
-    return payload.message;
-  }
-  const record = asRecord(payload);
-  if (!record) return fallback;
-  const error = record.error;
-  if (typeof error === "string" && error.length > 0) return error;
-  const nestedError = asRecord(error);
-  if (nestedError && typeof nestedError.message === "string" && nestedError.message.length > 0) {
-    return nestedError.message;
-  }
-  return fallback;
-}
-function setJson(res, statusCode, payload) {
-  res.statusCode = statusCode;
-  res.setHeader("Content-Type", "application/json; charset=utf-8");
-  res.end(JSON.stringify(payload));
-}
-function getCodexHomeDir() {
-  const codexHome = process.env.CODEX_HOME?.trim();
-  return codexHome && codexHome.length > 0 ? codexHome : join(homedir(), ".codex");
-}
-function getSkillsInstallDir() {
-  return join(getCodexHomeDir(), "skills");
-}
-async function runCommand(command, args, options = {}) {
-  await new Promise((resolve2, reject) => {
-    const proc = spawn(command, args, {
-      cwd: options.cwd,
-      env: process.env,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    proc.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    proc.stderr.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    proc.on("error", reject);
-    proc.on("close", (code) => {
-      if (code === 0) {
-        resolve2();
-        return;
-      }
-      const details = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
-      const suffix = details.length > 0 ? `: ${details}` : "";
-      reject(new Error(`Command failed (${command} ${args.join(" ")})${suffix}`));
-    });
-  });
-}
-async function runCommandWithOutput(command, args, options = {}) {
-  return await new Promise((resolve2, reject) => {
-    const proc = spawn(command, args, {
-      cwd: options.cwd,
-      env: process.env,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    proc.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    proc.stderr.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    proc.on("error", reject);
-    proc.on("close", (code) => {
-      if (code === 0) {
-        resolve2(stdout.trim());
-        return;
-      }
-      const details = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
-      const suffix = details.length > 0 ? `: ${details}` : "";
-      reject(new Error(`Command failed (${command} ${args.join(" ")})${suffix}`));
-    });
-  });
-}
-async function detectUserSkillsDir(appServer) {
-  try {
-    const result = await appServer.rpc("skills/list", {});
-    for (const entry of result.data ?? []) {
-      for (const skill of entry.skills ?? []) {
-        if (skill.scope !== "user" || !skill.path) continue;
-        const parts = skill.path.split("/").filter(Boolean);
-        if (parts.length < 2) continue;
-        return `/${parts.slice(0, -2).join("/")}`;
-      }
-    }
-  } catch {
-  }
-  return getSkillsInstallDir();
-}
-async function ensureInstalledSkillIsValid(appServer, skillPath) {
-  const result = await appServer.rpc("skills/list", { forceReload: true });
-  const normalized = skillPath.endsWith("/SKILL.md") ? skillPath : `${skillPath}/SKILL.md`;
-  for (const entry of result.data ?? []) {
-    for (const error of entry.errors ?? []) {
-      if (error.path === normalized) {
-        throw new Error(error.message || "Installed skill is invalid");
-      }
-    }
-  }
-}
-var TREE_CACHE_TTL_MS = 5 * 60 * 1e3;
-var skillsTreeCache = null;
-var metaCache = /* @__PURE__ */ new Map();
-async function getGhToken() {
-  try {
-    const proc = spawn("gh", ["auth", "token"], { stdio: ["ignore", "pipe", "ignore"] });
-    let out = "";
-    proc.stdout.on("data", (d) => {
-      out += d.toString();
-    });
-    return new Promise((resolve2) => {
-      proc.on("close", (code) => resolve2(code === 0 ? out.trim() : null));
-      proc.on("error", () => resolve2(null));
-    });
-  } catch {
-    return null;
-  }
-}
-async function ghFetch(url) {
-  const token = await getGhToken();
-  const headers = {
-    Accept: "application/vnd.github+json",
-    "User-Agent": "codex-web-local"
-  };
-  if (token) headers.Authorization = `Bearer ${token}`;
-  return fetch(url, { headers });
-}
-async function fetchSkillsTree() {
-  if (skillsTreeCache && Date.now() - skillsTreeCache.fetchedAt < TREE_CACHE_TTL_MS) {
-    return skillsTreeCache.entries;
-  }
-  const resp = await ghFetch(`https://api.github.com/repos/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/git/trees/main?recursive=1`);
-  if (!resp.ok) throw new Error(`GitHub tree API returned ${resp.status}`);
-  const data = await resp.json();
-  const metaPattern = /^skills\/([^/]+)\/([^/]+)\/_meta\.json$/;
-  const seen = /* @__PURE__ */ new Set();
-  const entries = [];
-  for (const node of data.tree ?? []) {
-    const match = metaPattern.exec(node.path);
-    if (!match) continue;
-    const [, owner, skillName] = match;
-    const key = `${owner}/${skillName}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    entries.push({
-      name: skillName,
-      owner,
-      url: `https://github.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/tree/main/skills/${owner}/${skillName}`
-    });
-  }
-  skillsTreeCache = { entries, fetchedAt: Date.now() };
-  return entries;
-}
-async function fetchMetaBatch(entries) {
-  const toFetch = entries.filter((e) => !metaCache.has(`${e.owner}/${e.name}`));
-  if (toFetch.length === 0) return;
-  const batch = toFetch.slice(0, 50);
-  await Promise.allSettled(
-    batch.map(async (e) => {
-      const rawUrl = `https://raw.githubusercontent.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/main/skills/${e.owner}/${e.name}/_meta.json`;
-      const resp = await fetch(rawUrl);
-      if (!resp.ok) return;
-      const meta = await resp.json();
-      metaCache.set(`${e.owner}/${e.name}`, {
-        displayName: typeof meta.displayName === "string" ? meta.displayName : "",
-        description: typeof meta.displayName === "string" ? meta.displayName : "",
-        publishedAt: meta.latest?.publishedAt ?? 0
-      });
-    })
-  );
-}
-function buildHubEntry(e) {
-  const cached = metaCache.get(`${e.owner}/${e.name}`);
-  return {
-    name: e.name,
-    owner: e.owner,
-    description: cached?.description ?? "",
-    displayName: cached?.displayName ?? "",
-    publishedAt: cached?.publishedAt ?? 0,
-    avatarUrl: `https://github.com/${e.owner}.png?size=40`,
-    url: e.url,
-    installed: false
-  };
-}
-var GITHUB_DEVICE_CLIENT_ID = "Iv1.b507a08c87ecfe98";
-var DEFAULT_SKILLS_SYNC_REPO_NAME = "codexskills";
-var SKILLS_SYNC_MANIFEST_PATH = "installed-skills.json";
-var SYNC_UPSTREAM_SKILLS_OWNER = "OpenClawAndroid";
-var SYNC_UPSTREAM_SKILLS_REPO = "skills";
-var HUB_SKILLS_OWNER = "openclaw";
-var HUB_SKILLS_REPO = "skills";
-var startupSkillsSyncInitialized = false;
-var startupSyncStatus = {
-  inProgress: false,
-  mode: "idle",
-  branch: getPreferredSyncBranch(),
-  lastAction: "not-started",
-  lastRunAtIso: "",
-  lastSuccessAtIso: "",
-  lastError: ""
-};
-async function scanInstalledSkillsFromDisk() {
-  const map = /* @__PURE__ */ new Map();
-  const skillsDir = getSkillsInstallDir();
-  try {
-    const entries = await readdir(skillsDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
-      const skillMd = join(skillsDir, entry.name, "SKILL.md");
-      try {
-        await stat(skillMd);
-        map.set(entry.name, { name: entry.name, path: skillMd, enabled: true });
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return map;
-}
-function getSkillsSyncStatePath() {
-  return join(getCodexHomeDir(), "skills-sync.json");
-}
-async function readSkillsSyncState() {
-  try {
-    const raw = await readFile(getSkillsSyncStatePath(), "utf8");
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-async function writeSkillsSyncState(state) {
-  await writeFile(getSkillsSyncStatePath(), JSON.stringify(state), "utf8");
-}
-async function getGithubJson(url, token, method = "GET", body) {
-  const resp = await fetch(url, {
-    method,
-    headers: {
-      Accept: "application/vnd.github+json",
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${token}`,
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "codex-web-local"
-    },
-    body: body ? JSON.stringify(body) : void 0
-  });
-  if (!resp.ok) {
-    const text = await resp.text();
-    throw new Error(`GitHub API ${method} ${url} failed (${resp.status}): ${text}`);
-  }
-  return await resp.json();
-}
-async function startGithubDeviceLogin() {
-  const resp = await fetch("https://github.com/login/device/code", {
-    method: "POST",
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/x-www-form-urlencoded",
-      "User-Agent": "codex-web-local"
-    },
-    body: new URLSearchParams({
-      client_id: GITHUB_DEVICE_CLIENT_ID,
-      scope: "repo read:user"
-    })
-  });
-  if (!resp.ok) {
-    throw new Error(`GitHub device flow init failed (${resp.status})`);
-  }
-  return await resp.json();
-}
-async function completeGithubDeviceLogin(deviceCode) {
-  const resp = await fetch("https://github.com/login/oauth/access_token", {
-    method: "POST",
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/x-www-form-urlencoded",
-      "User-Agent": "codex-web-local"
-    },
-    body: new URLSearchParams({
-      client_id: GITHUB_DEVICE_CLIENT_ID,
-      device_code: deviceCode,
-      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-    })
-  });
-  if (!resp.ok) {
-    throw new Error(`GitHub token exchange failed (${resp.status})`);
-  }
-  const payload = await resp.json();
-  if (!payload.access_token) return { token: null, error: payload.error || "unknown_error" };
-  return { token: payload.access_token, error: null };
-}
-function isAndroidLikeRuntime() {
-  if (process.platform === "android") return true;
-  if (existsSync("/data/data/com.termux")) return true;
-  if (process.env.TERMUX_VERSION) return true;
-  const prefix = process.env.PREFIX?.toLowerCase() ?? "";
-  if (prefix.includes("/com.termux/")) return true;
-  const proot = process.env.PROOT_TMP_DIR?.toLowerCase() ?? "";
-  return proot.length > 0;
-}
-function getPreferredSyncBranch() {
-  return isAndroidLikeRuntime() ? "android" : "main";
-}
-function isUpstreamSkillsRepo(repoOwner, repoName) {
-  return repoOwner.toLowerCase() === SYNC_UPSTREAM_SKILLS_OWNER.toLowerCase() && repoName.toLowerCase() === SYNC_UPSTREAM_SKILLS_REPO.toLowerCase();
-}
-async function resolveGithubUsername(token) {
-  const user = await getGithubJson("https://api.github.com/user", token);
-  return user.login;
-}
-async function ensurePrivateForkFromUpstream(token, username, repoName) {
-  const repoUrl = `https://api.github.com/repos/${username}/${repoName}`;
-  let created = false;
-  const existing = await fetch(repoUrl, {
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${token}`,
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "codex-web-local"
-    }
-  });
-  if (existing.ok) {
-    const details = await existing.json();
-    if (details.private === true) return;
-    await getGithubJson(repoUrl, token, "PATCH", { private: true });
-    return;
-  }
-  if (existing.status !== 404) {
-    throw new Error(`Failed to check personal repo existence (${existing.status})`);
-  }
-  await getGithubJson(
-    "https://api.github.com/user/repos",
-    token,
-    "POST",
-    { name: repoName, private: true, auto_init: false, description: "Codex skills private mirror sync" }
-  );
-  created = true;
-  let ready = false;
-  for (let i = 0; i < 20; i++) {
-    const check = await fetch(repoUrl, {
-      headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "X-GitHub-Api-Version": "2022-11-28",
-        "User-Agent": "codex-web-local"
-      }
-    });
-    if (check.ok) {
-      ready = true;
-      break;
-    }
-    await new Promise((resolve2) => setTimeout(resolve2, 1e3));
-  }
-  if (!ready) throw new Error("Private mirror repo was created but is not available yet");
-  if (!created) return;
-  const tmp = await mkdtemp(join(tmpdir(), "codex-skills-seed-"));
-  try {
-    const upstreamUrl = `https://github.com/${SYNC_UPSTREAM_SKILLS_OWNER}/${SYNC_UPSTREAM_SKILLS_REPO}.git`;
-    const branch = getPreferredSyncBranch();
-    try {
-      await runCommand("git", ["clone", "--depth", "1", "--single-branch", "--branch", branch, upstreamUrl, tmp]);
-    } catch {
-      await runCommand("git", ["clone", "--depth", "1", upstreamUrl, tmp]);
-    }
-    const privateRemote = toGitHubTokenRemote(username, repoName, token);
-    await runCommand("git", ["remote", "set-url", "origin", privateRemote], { cwd: tmp });
-    try {
-      await runCommand("git", ["checkout", "-B", branch], { cwd: tmp });
-    } catch {
-    }
-    await runCommand("git", ["push", "-u", "origin", `HEAD:${branch}`], { cwd: tmp });
-  } finally {
-    await rm(tmp, { recursive: true, force: true });
-  }
-}
-async function readRemoteSkillsManifest(token, repoOwner, repoName) {
-  const url = `https://api.github.com/repos/${repoOwner}/${repoName}/contents/${SKILLS_SYNC_MANIFEST_PATH}`;
-  const resp = await fetch(url, {
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${token}`,
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "codex-web-local"
-    }
-  });
-  if (resp.status === 404) return [];
-  if (!resp.ok) throw new Error(`Failed to read remote manifest (${resp.status})`);
-  const payload = await resp.json();
-  const content = payload.content ? Buffer.from(payload.content.replace(/\n/g, ""), "base64").toString("utf8") : "[]";
-  const parsed = JSON.parse(content);
-  if (!Array.isArray(parsed)) return [];
-  const skills = [];
-  for (const row of parsed) {
-    const item = asRecord(row);
-    const owner = typeof item?.owner === "string" ? item.owner : "";
-    const name = typeof item?.name === "string" ? item.name : "";
-    if (!name) continue;
-    skills.push({ ...owner ? { owner } : {}, name, enabled: item?.enabled !== false });
-  }
-  return skills;
-}
-async function writeRemoteSkillsManifest(token, repoOwner, repoName, skills) {
-  const url = `https://api.github.com/repos/${repoOwner}/${repoName}/contents/${SKILLS_SYNC_MANIFEST_PATH}`;
-  let sha = "";
-  const existing = await fetch(url, {
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${token}`,
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "codex-web-local"
-    }
-  });
-  if (existing.ok) {
-    const payload = await existing.json();
-    sha = payload.sha ?? "";
-  }
-  const content = Buffer.from(JSON.stringify(skills, null, 2), "utf8").toString("base64");
-  await getGithubJson(url, token, "PUT", {
-    message: "Update synced skills manifest",
-    content,
-    ...sha ? { sha } : {}
-  });
-}
-function toGitHubTokenRemote(repoOwner, repoName, token) {
-  return `https://x-access-token:${encodeURIComponent(token)}@github.com/${repoOwner}/${repoName}.git`;
-}
-async function ensureSkillsWorkingTreeRepo(repoUrl, branch) {
-  const localDir = getSkillsInstallDir();
-  await mkdir(localDir, { recursive: true });
-  const gitDir = join(localDir, ".git");
-  let hasGitDir = false;
-  try {
-    hasGitDir = (await stat(gitDir)).isDirectory();
-  } catch {
-    hasGitDir = false;
-  }
-  if (!hasGitDir) {
-    await runCommand("git", ["init"], { cwd: localDir });
-    await runCommand("git", ["config", "user.email", "skills-sync@local"], { cwd: localDir });
-    await runCommand("git", ["config", "user.name", "Skills Sync"], { cwd: localDir });
-    await runCommand("git", ["add", "-A"], { cwd: localDir });
-    try {
-      await runCommand("git", ["commit", "-m", "Local skills snapshot before sync"], { cwd: localDir });
-    } catch {
-    }
-    await runCommand("git", ["branch", "-M", branch], { cwd: localDir });
-    try {
-      await runCommand("git", ["remote", "add", "origin", repoUrl], { cwd: localDir });
-    } catch {
-      await runCommand("git", ["remote", "set-url", "origin", repoUrl], { cwd: localDir });
-    }
-    await runCommand("git", ["fetch", "origin"], { cwd: localDir });
-    try {
-      await runCommand("git", ["merge", "--allow-unrelated-histories", "--no-edit", `origin/${branch}`], { cwd: localDir });
-    } catch {
-    }
-    return localDir;
-  }
-  await runCommand("git", ["remote", "set-url", "origin", repoUrl], { cwd: localDir });
-  await runCommand("git", ["fetch", "origin"], { cwd: localDir });
-  await resolveMergeConflictsByNewerCommit(localDir, branch);
-  try {
-    await runCommand("git", ["checkout", branch], { cwd: localDir });
-  } catch {
-    await resolveMergeConflictsByNewerCommit(localDir, branch);
-    await runCommand("git", ["checkout", "-B", branch], { cwd: localDir });
-  }
-  await resolveMergeConflictsByNewerCommit(localDir, branch);
-  const localMtimesBeforePull = await snapshotFileMtimes(localDir);
-  try {
-    await runCommand("git", ["stash", "push", "--include-untracked", "-m", "codex-skills-autostash"], { cwd: localDir });
-  } catch {
-  }
-  let pulledMtimes = /* @__PURE__ */ new Map();
-  try {
-    await runCommand("git", ["pull", "--no-rebase", "origin", branch], { cwd: localDir });
-    pulledMtimes = await snapshotFileMtimes(localDir);
-  } catch {
-    await resolveMergeConflictsByNewerCommit(localDir, branch);
-    pulledMtimes = await snapshotFileMtimes(localDir);
-  }
-  try {
-    await runCommand("git", ["stash", "pop"], { cwd: localDir });
-  } catch {
-    await resolveStashPopConflictsByFileTime(localDir, localMtimesBeforePull, pulledMtimes);
-  }
-  return localDir;
-}
-async function resolveMergeConflictsByNewerCommit(repoDir, branch) {
-  const unmerged = (await runCommandWithOutput("git", ["diff", "--name-only", "--diff-filter=U"], { cwd: repoDir })).split(/\r?\n/).map((row) => row.trim()).filter(Boolean);
-  if (unmerged.length === 0) return;
-  for (const path of unmerged) {
-    const oursTime = await getCommitTime(repoDir, "HEAD", path);
-    const theirsTime = await getCommitTime(repoDir, `origin/${branch}`, path);
-    if (theirsTime > oursTime) {
-      await runCommand("git", ["checkout", "--theirs", "--", path], { cwd: repoDir });
-    } else {
-      await runCommand("git", ["checkout", "--ours", "--", path], { cwd: repoDir });
-    }
-    await runCommand("git", ["add", "--", path], { cwd: repoDir });
-  }
-  const mergeHead = (await runCommandWithOutput("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"], { cwd: repoDir })).trim();
-  if (mergeHead) {
-    await runCommand("git", ["commit", "-m", "Auto-resolve skills merge by newer file"], { cwd: repoDir });
-  }
-}
-async function getCommitTime(repoDir, ref, path) {
-  try {
-    const output = (await runCommandWithOutput("git", ["log", "-1", "--format=%ct", ref, "--", path], { cwd: repoDir })).trim();
-    return output ? Number.parseInt(output, 10) : 0;
-  } catch {
-    return 0;
-  }
-}
-async function resolveStashPopConflictsByFileTime(repoDir, localMtimesBeforePull, pulledMtimes) {
-  const unmerged = (await runCommandWithOutput("git", ["diff", "--name-only", "--diff-filter=U"], { cwd: repoDir })).split(/\r?\n/).map((row) => row.trim()).filter(Boolean);
-  if (unmerged.length === 0) return;
-  for (const path of unmerged) {
-    const localMtime = localMtimesBeforePull.get(path) ?? 0;
-    const pulledMtime = pulledMtimes.get(path) ?? 0;
-    const side = localMtime >= pulledMtime ? "--theirs" : "--ours";
-    await runCommand("git", ["checkout", side, "--", path], { cwd: repoDir });
-    await runCommand("git", ["add", "--", path], { cwd: repoDir });
-  }
-  const mergeHead = (await runCommandWithOutput("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"], { cwd: repoDir })).trim();
-  if (mergeHead) {
-    await runCommand("git", ["commit", "-m", "Auto-resolve stash-pop conflicts by file time"], { cwd: repoDir });
-  }
-}
-async function snapshotFileMtimes(dir) {
-  const mtimes = /* @__PURE__ */ new Map();
-  await walkFileMtimes(dir, dir, mtimes);
-  return mtimes;
-}
-async function walkFileMtimes(rootDir, currentDir, out) {
-  let entries;
-  try {
-    entries = await readdir(currentDir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    const entryName = String(entry.name);
-    if (entryName === ".git") continue;
-    const absolutePath = join(currentDir, entryName);
-    const relativePath = absolutePath.slice(rootDir.length + 1);
-    if (entry.isDirectory()) {
-      await walkFileMtimes(rootDir, absolutePath, out);
-      continue;
-    }
-    if (!entry.isFile()) continue;
-    try {
-      const info = await stat(absolutePath);
-      out.set(relativePath, info.mtimeMs);
-    } catch {
-    }
-  }
-}
-async function syncInstalledSkillsFolderToRepo(token, repoOwner, repoName, _installedMap) {
-  const remoteUrl = toGitHubTokenRemote(repoOwner, repoName, token);
-  const branch = getPreferredSyncBranch();
-  const repoDir = await ensureSkillsWorkingTreeRepo(remoteUrl, branch);
-  void _installedMap;
-  await runCommand("git", ["config", "user.email", "skills-sync@local"], { cwd: repoDir });
-  await runCommand("git", ["config", "user.name", "Skills Sync"], { cwd: repoDir });
-  await runCommand("git", ["add", "."], { cwd: repoDir });
-  const status = (await runCommandWithOutput("git", ["status", "--porcelain"], { cwd: repoDir })).trim();
-  if (!status) return;
-  await runCommand("git", ["commit", "-m", "Sync installed skills folder and manifest"], { cwd: repoDir });
-  await runCommand("git", ["push", "origin", `HEAD:${branch}`], { cwd: repoDir });
-}
-async function pullInstalledSkillsFolderFromRepo(token, repoOwner, repoName) {
-  const remoteUrl = toGitHubTokenRemote(repoOwner, repoName, token);
-  const branch = getPreferredSyncBranch();
-  await ensureSkillsWorkingTreeRepo(remoteUrl, branch);
-}
-async function bootstrapSkillsFromUpstreamIntoLocal() {
-  const repoUrl = `https://github.com/${SYNC_UPSTREAM_SKILLS_OWNER}/${SYNC_UPSTREAM_SKILLS_REPO}.git`;
-  const branch = getPreferredSyncBranch();
-  await ensureSkillsWorkingTreeRepo(repoUrl, branch);
-}
-async function collectLocalSyncedSkills(appServer) {
-  const state = await readSkillsSyncState();
-  const owners = { ...state.installedOwners ?? {} };
-  const tree = await fetchSkillsTree();
-  const uniqueOwnerByName = /* @__PURE__ */ new Map();
-  const ambiguousNames = /* @__PURE__ */ new Set();
-  for (const entry of tree) {
-    if (ambiguousNames.has(entry.name)) continue;
-    const existingOwner = uniqueOwnerByName.get(entry.name);
-    if (!existingOwner) {
-      uniqueOwnerByName.set(entry.name, entry.owner);
-      continue;
-    }
-    if (existingOwner !== entry.owner) {
-      uniqueOwnerByName.delete(entry.name);
-      ambiguousNames.add(entry.name);
-    }
-  }
-  const skills = await appServer.rpc("skills/list", {});
-  const seen = /* @__PURE__ */ new Set();
-  const synced = [];
-  let ownersChanged = false;
-  for (const entry of skills.data ?? []) {
-    for (const skill of entry.skills ?? []) {
-      const name = typeof skill.name === "string" ? skill.name : "";
-      if (!name || seen.has(name)) continue;
-      seen.add(name);
-      let owner = owners[name];
-      if (!owner) {
-        owner = uniqueOwnerByName.get(name) ?? "";
-        if (owner) {
-          owners[name] = owner;
-          ownersChanged = true;
-        }
-      }
-      synced.push({ ...owner ? { owner } : {}, name, enabled: skill.enabled !== false });
-    }
-  }
-  if (ownersChanged) {
-    await writeSkillsSyncState({ ...state, installedOwners: owners });
-  }
-  synced.sort((a, b) => `${a.owner ?? ""}/${a.name}`.localeCompare(`${b.owner ?? ""}/${b.name}`));
-  return synced;
-}
-async function autoPushSyncedSkills(appServer) {
-  const state = await readSkillsSyncState();
-  if (!state.githubToken || !state.repoOwner || !state.repoName) return;
-  if (isUpstreamSkillsRepo(state.repoOwner, state.repoName)) {
-    throw new Error("Refusing to push to upstream skills repository");
-  }
-  const local = await collectLocalSyncedSkills(appServer);
-  const installedMap = await scanInstalledSkillsFromDisk();
-  await writeRemoteSkillsManifest(state.githubToken, state.repoOwner, state.repoName, local);
-  await syncInstalledSkillsFolderToRepo(state.githubToken, state.repoOwner, state.repoName, installedMap);
-}
-async function ensureCodexAgentsSymlinkToSkillsAgents() {
-  const codexHomeDir = getCodexHomeDir();
-  const skillsAgentsPath = join(codexHomeDir, "skills", "AGENTS.md");
-  const codexAgentsPath = join(codexHomeDir, "AGENTS.md");
-  await mkdir(join(codexHomeDir, "skills"), { recursive: true });
-  let copiedFromCodex = false;
-  try {
-    const codexAgentsStat = await lstat(codexAgentsPath);
-    if (codexAgentsStat.isFile() || codexAgentsStat.isSymbolicLink()) {
-      const content = await readFile(codexAgentsPath, "utf8");
-      await writeFile(skillsAgentsPath, content, "utf8");
-      copiedFromCodex = true;
-    } else {
-      await rm(codexAgentsPath, { force: true, recursive: true });
-    }
-  } catch {
-  }
-  if (!copiedFromCodex) {
-    try {
-      const skillsAgentsStat = await stat(skillsAgentsPath);
-      if (!skillsAgentsStat.isFile()) {
-        await rm(skillsAgentsPath, { force: true, recursive: true });
-        await writeFile(skillsAgentsPath, "", "utf8");
-      }
-    } catch {
-      await writeFile(skillsAgentsPath, "", "utf8");
-    }
-  }
-  const relativeTarget = join("skills", "AGENTS.md");
-  try {
-    const current = await lstat(codexAgentsPath);
-    if (current.isSymbolicLink()) {
-      const existingTarget = await readlink(codexAgentsPath);
-      if (existingTarget === relativeTarget) return;
-    }
-    await rm(codexAgentsPath, { force: true, recursive: true });
-  } catch {
-  }
-  await symlink(relativeTarget, codexAgentsPath);
-}
-async function initializeSkillsSyncOnStartup(appServer) {
-  if (startupSkillsSyncInitialized) return;
-  startupSkillsSyncInitialized = true;
-  startupSyncStatus.inProgress = true;
-  startupSyncStatus.lastRunAtIso = (/* @__PURE__ */ new Date()).toISOString();
-  startupSyncStatus.lastError = "";
-  startupSyncStatus.branch = getPreferredSyncBranch();
-  try {
-    const state = await readSkillsSyncState();
-    if (!state.githubToken) {
-      await ensureCodexAgentsSymlinkToSkillsAgents();
-      if (!isAndroidLikeRuntime()) {
-        startupSyncStatus.mode = "idle";
-        startupSyncStatus.lastAction = "skip-upstream-non-android";
-        startupSyncStatus.lastSuccessAtIso = (/* @__PURE__ */ new Date()).toISOString();
-        return;
-      }
-      startupSyncStatus.mode = "unauthenticated-bootstrap";
-      startupSyncStatus.lastAction = "pull-upstream";
-      await bootstrapSkillsFromUpstreamIntoLocal();
-      try {
-        await appServer.rpc("skills/list", { forceReload: true });
-      } catch {
-      }
-      startupSyncStatus.lastSuccessAtIso = (/* @__PURE__ */ new Date()).toISOString();
-      startupSyncStatus.lastAction = "pull-upstream-complete";
-      return;
-    }
-    startupSyncStatus.mode = "authenticated-fork-sync";
-    startupSyncStatus.lastAction = "ensure-private-fork";
-    const username = state.githubUsername || await resolveGithubUsername(state.githubToken);
-    const repoName = DEFAULT_SKILLS_SYNC_REPO_NAME;
-    await ensurePrivateForkFromUpstream(state.githubToken, username, repoName);
-    await writeSkillsSyncState({ ...state, githubUsername: username, repoOwner: username, repoName });
-    startupSyncStatus.lastAction = "pull-private-fork";
-    await pullInstalledSkillsFolderFromRepo(state.githubToken, username, repoName);
-    try {
-      await appServer.rpc("skills/list", { forceReload: true });
-    } catch {
-    }
-    startupSyncStatus.lastAction = "push-private-fork";
-    await autoPushSyncedSkills(appServer);
-    startupSyncStatus.lastSuccessAtIso = (/* @__PURE__ */ new Date()).toISOString();
-    startupSyncStatus.lastAction = "startup-sync-complete";
-  } catch (error) {
-    startupSyncStatus.lastError = getErrorMessage(error, "startup-sync-failed");
-    startupSyncStatus.lastAction = "startup-sync-failed";
-  } finally {
-    startupSyncStatus.inProgress = false;
-  }
-}
-async function finalizeGithubLoginAndSync(token, username, appServer) {
-  const repoName = DEFAULT_SKILLS_SYNC_REPO_NAME;
-  await ensurePrivateForkFromUpstream(token, username, repoName);
-  const current = await readSkillsSyncState();
-  await writeSkillsSyncState({ ...current, githubToken: token, githubUsername: username, repoOwner: username, repoName });
-  await pullInstalledSkillsFolderFromRepo(token, username, repoName);
-  try {
-    await appServer.rpc("skills/list", { forceReload: true });
-  } catch {
-  }
-  await autoPushSyncedSkills(appServer);
-}
-async function searchSkillsHub(allEntries, query, limit, sort, installedMap) {
-  const q = query.toLowerCase().trim();
-  const filtered = q ? allEntries.filter((s) => {
-    if (s.name.toLowerCase().includes(q) || s.owner.toLowerCase().includes(q)) return true;
-    const cached = metaCache.get(`${s.owner}/${s.name}`);
-    return Boolean(cached?.displayName?.toLowerCase().includes(q));
-  }) : allEntries;
-  const page = filtered.slice(0, Math.min(limit * 2, 200));
-  await fetchMetaBatch(page);
-  let results = page.map(buildHubEntry);
-  if (sort === "date") {
-    results.sort((a, b) => b.publishedAt - a.publishedAt);
-  } else if (q) {
-    results.sort((a, b) => {
-      const aExact = a.name.toLowerCase() === q ? 1 : 0;
-      const bExact = b.name.toLowerCase() === q ? 1 : 0;
-      if (aExact !== bExact) return bExact - aExact;
-      return b.publishedAt - a.publishedAt;
-    });
-  }
-  return results.slice(0, limit).map((s) => {
-    const local = installedMap.get(s.name);
-    return local ? { ...s, installed: true, path: local.path, enabled: local.enabled } : s;
-  });
-}
-async function handleSkillsRoutes(req, res, url, context) {
-  const { appServer, readJsonBody: readJsonBody2 } = context;
-  if (req.method === "GET" && url.pathname === "/codex-api/skills-hub") {
-    try {
-      const q = url.searchParams.get("q") || "";
-      const limit = Math.min(Math.max(parseInt(url.searchParams.get("limit") || "50", 10) || 50, 1), 200);
-      const sort = url.searchParams.get("sort") || "date";
-      const allEntries = await fetchSkillsTree();
-      const installedMap = await scanInstalledSkillsFromDisk();
-      try {
-        const result = await appServer.rpc("skills/list", {});
-        for (const entry of result.data ?? []) {
-          for (const skill of entry.skills ?? []) {
-            if (skill.name) {
-              installedMap.set(skill.name, { name: skill.name, path: skill.path ?? "", enabled: skill.enabled !== false });
-            }
-          }
-        }
-      } catch {
-      }
-      const installedHubEntries = allEntries.filter((e) => installedMap.has(e.name));
-      await fetchMetaBatch(installedHubEntries);
-      const installed = [];
-      for (const [, info] of installedMap) {
-        const hubEntry = allEntries.find((e) => e.name === info.name);
-        const base = hubEntry ? buildHubEntry(hubEntry) : {
-          name: info.name,
-          owner: "local",
-          description: "",
-          displayName: "",
-          publishedAt: 0,
-          avatarUrl: "",
-          url: "",
-          installed: false
-        };
-        installed.push({ ...base, installed: true, path: info.path, enabled: info.enabled });
-      }
-      const results = await searchSkillsHub(allEntries, q, limit, sort, installedMap);
-      setJson(res, 200, { data: results, installed, total: allEntries.length });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to fetch skills hub") });
-    }
-    return true;
-  }
-  if (req.method === "GET" && url.pathname === "/codex-api/skills-sync/status") {
-    const state = await readSkillsSyncState();
-    setJson(res, 200, {
-      data: {
-        loggedIn: Boolean(state.githubToken),
-        githubUsername: state.githubUsername ?? "",
-        repoOwner: state.repoOwner ?? "",
-        repoName: state.repoName ?? "",
-        configured: Boolean(state.githubToken && state.repoOwner && state.repoName),
-        startup: {
-          inProgress: startupSyncStatus.inProgress,
-          mode: startupSyncStatus.mode,
-          branch: startupSyncStatus.branch,
-          lastAction: startupSyncStatus.lastAction,
-          lastRunAtIso: startupSyncStatus.lastRunAtIso,
-          lastSuccessAtIso: startupSyncStatus.lastSuccessAtIso,
-          lastError: startupSyncStatus.lastError
-        }
-      }
-    });
-    return true;
-  }
-  if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/github/start-login") {
-    try {
-      const started = await startGithubDeviceLogin();
-      setJson(res, 200, { data: started });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to start GitHub login") });
-    }
-    return true;
-  }
-  if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/github/token-login") {
-    try {
-      const payload = asRecord(await readJsonBody2(req));
-      const token = typeof payload?.token === "string" ? payload.token.trim() : "";
-      if (!token) {
-        setJson(res, 400, { error: "Missing GitHub token" });
-        return true;
-      }
-      const username = await resolveGithubUsername(token);
-      await finalizeGithubLoginAndSync(token, username, appServer);
-      setJson(res, 200, { ok: true, data: { githubUsername: username } });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to login with GitHub token") });
-    }
-    return true;
-  }
-  if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/github/logout") {
-    try {
-      const state = await readSkillsSyncState();
-      await writeSkillsSyncState({
-        ...state,
-        githubToken: void 0,
-        githubUsername: void 0,
-        repoOwner: void 0,
-        repoName: void 0
-      });
-      setJson(res, 200, { ok: true });
-    } catch (error) {
-      setJson(res, 500, { error: getErrorMessage(error, "Failed to logout GitHub") });
-    }
-    return true;
-  }
-  if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/github/complete-login") {
-    try {
-      const payload = asRecord(await readJsonBody2(req));
-      const deviceCode = typeof payload?.deviceCode === "string" ? payload.deviceCode : "";
-      if (!deviceCode) {
-        setJson(res, 400, { error: "Missing deviceCode" });
-        return true;
-      }
-      const result = await completeGithubDeviceLogin(deviceCode);
-      if (!result.token) {
-        setJson(res, 200, { ok: false, pending: result.error === "authorization_pending", error: result.error || "login_failed" });
-        return true;
-      }
-      const token = result.token;
-      const username = await resolveGithubUsername(token);
-      await finalizeGithubLoginAndSync(token, username, appServer);
-      setJson(res, 200, { ok: true, data: { githubUsername: username } });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to complete GitHub login") });
-    }
-    return true;
-  }
-  if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/push") {
-    try {
-      const state = await readSkillsSyncState();
-      if (!state.githubToken || !state.repoOwner || !state.repoName) {
-        setJson(res, 400, { error: "Skills sync is not configured yet" });
-        return true;
-      }
-      if (isUpstreamSkillsRepo(state.repoOwner, state.repoName)) {
-        setJson(res, 400, { error: "Refusing to push to upstream repository" });
-        return true;
-      }
-      const local = await collectLocalSyncedSkills(appServer);
-      const installedMap = await scanInstalledSkillsFromDisk();
-      await writeRemoteSkillsManifest(state.githubToken, state.repoOwner, state.repoName, local);
-      await syncInstalledSkillsFolderToRepo(state.githubToken, state.repoOwner, state.repoName, installedMap);
-      setJson(res, 200, { ok: true, data: { synced: local.length } });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to push synced skills") });
-    }
-    return true;
-  }
-  if (req.method === "POST" && url.pathname === "/codex-api/skills-sync/pull") {
-    try {
-      const state = await readSkillsSyncState();
-      if (!state.githubToken || !state.repoOwner || !state.repoName) {
-        await bootstrapSkillsFromUpstreamIntoLocal();
-        try {
-          await appServer.rpc("skills/list", { forceReload: true });
-        } catch {
-        }
-        setJson(res, 200, { ok: true, data: { synced: 0, source: "upstream" } });
-        return true;
-      }
-      const remote = await readRemoteSkillsManifest(state.githubToken, state.repoOwner, state.repoName);
-      const tree = await fetchSkillsTree();
-      const uniqueOwnerByName = /* @__PURE__ */ new Map();
-      const ambiguousNames = /* @__PURE__ */ new Set();
-      for (const entry of tree) {
-        if (ambiguousNames.has(entry.name)) continue;
-        const existingOwner = uniqueOwnerByName.get(entry.name);
-        if (!existingOwner) {
-          uniqueOwnerByName.set(entry.name, entry.owner);
-          continue;
-        }
-        if (existingOwner !== entry.owner) {
-          uniqueOwnerByName.delete(entry.name);
-          ambiguousNames.add(entry.name);
-        }
-      }
-      const localDir = await detectUserSkillsDir(appServer);
-      await pullInstalledSkillsFolderFromRepo(state.githubToken, state.repoOwner, state.repoName);
-      const installerScript = "/Users/igor/.cursor/skills/.system/skill-installer/scripts/install-skill-from-github.py";
-      const localSkills = await scanInstalledSkillsFromDisk();
-      for (const skill of remote) {
-        const owner = skill.owner || uniqueOwnerByName.get(skill.name) || "";
-        if (!owner) continue;
-        if (!localSkills.has(skill.name)) {
-          await runCommand("python3", [
-            installerScript,
-            "--repo",
-            `${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}`,
-            "--path",
-            `skills/${owner}/${skill.name}`,
-            "--dest",
-            localDir,
-            "--method",
-            "git"
-          ]);
-        }
-        const skillPath = join(localDir, skill.name);
-        await appServer.rpc("skills/config/write", { path: skillPath, enabled: skill.enabled });
-      }
-      const remoteNames = new Set(remote.map((row) => row.name));
-      for (const [name, localInfo] of localSkills.entries()) {
-        if (!remoteNames.has(name)) {
-          await rm(localInfo.path.replace(/\/SKILL\.md$/, ""), { recursive: true, force: true });
-        }
-      }
-      const nextOwners = {};
-      for (const item of remote) {
-        const owner = item.owner || uniqueOwnerByName.get(item.name) || "";
-        if (owner) nextOwners[item.name] = owner;
-      }
-      await writeSkillsSyncState({ ...state, installedOwners: nextOwners });
-      try {
-        await appServer.rpc("skills/list", { forceReload: true });
-      } catch {
-      }
-      setJson(res, 200, { ok: true, data: { synced: remote.length } });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to pull synced skills") });
-    }
-    return true;
-  }
-  if (req.method === "GET" && url.pathname === "/codex-api/skills-hub/readme") {
-    try {
-      const owner = url.searchParams.get("owner") || "";
-      const name = url.searchParams.get("name") || "";
-      if (!owner || !name) {
-        setJson(res, 400, { error: "Missing owner or name" });
-        return true;
-      }
-      const rawUrl = `https://raw.githubusercontent.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/main/skills/${owner}/${name}/SKILL.md`;
-      const resp = await fetch(rawUrl);
-      if (!resp.ok) throw new Error(`Failed to fetch SKILL.md: ${resp.status}`);
-      const content = await resp.text();
-      setJson(res, 200, { content });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to fetch SKILL.md") });
-    }
-    return true;
-  }
-  if (req.method === "POST" && url.pathname === "/codex-api/skills-hub/install") {
-    try {
-      const payload = asRecord(await readJsonBody2(req));
-      const owner = typeof payload?.owner === "string" ? payload.owner : "";
-      const name = typeof payload?.name === "string" ? payload.name : "";
-      if (!owner || !name) {
-        setJson(res, 400, { error: "Missing owner or name" });
-        return true;
-      }
-      const installerScript = "/Users/igor/.cursor/skills/.system/skill-installer/scripts/install-skill-from-github.py";
-      const installDest = await detectUserSkillsDir(appServer);
-      await runCommand("python3", [
-        installerScript,
-        "--repo",
-        `${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}`,
-        "--path",
-        `skills/${owner}/${name}`,
-        "--dest",
-        installDest,
-        "--method",
-        "git"
-      ]);
-      const skillDir = join(installDest, name);
-      await ensureInstalledSkillIsValid(appServer, skillDir);
-      const syncState = await readSkillsSyncState();
-      const nextOwners = { ...syncState.installedOwners ?? {}, [name]: owner };
-      await writeSkillsSyncState({ ...syncState, installedOwners: nextOwners });
-      await autoPushSyncedSkills(appServer);
-      setJson(res, 200, { ok: true, path: skillDir });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to install skill") });
-    }
-    return true;
-  }
-  if (req.method === "POST" && url.pathname === "/codex-api/skills-hub/uninstall") {
-    try {
-      const payload = asRecord(await readJsonBody2(req));
-      const name = typeof payload?.name === "string" ? payload.name : "";
-      const path = typeof payload?.path === "string" ? payload.path : "";
-      const target = path || (name ? join(getSkillsInstallDir(), name) : "");
-      if (!target) {
-        setJson(res, 400, { error: "Missing name or path" });
-        return true;
-      }
-      await rm(target, { recursive: true, force: true });
-      if (name) {
-        const syncState = await readSkillsSyncState();
-        const nextOwners = { ...syncState.installedOwners ?? {} };
-        delete nextOwners[name];
-        await writeSkillsSyncState({ ...syncState, installedOwners: nextOwners });
-      }
-      await autoPushSyncedSkills(appServer);
-      try {
-        await appServer.rpc("skills/list", { forceReload: true });
-      } catch {
-      }
-      setJson(res, 200, { ok: true, deletedPath: target });
-    } catch (error) {
-      setJson(res, 502, { error: getErrorMessage(error, "Failed to uninstall skill") });
-    }
-    return true;
-  }
-  return false;
-}
+import { dirname as dirname2, extname as extname2, isAbsolute as isAbsolute2, join as join3 } from "path";
+import { existsSync } from "fs";
+import { writeFile as writeFile2, stat as stat3 } from "fs/promises";
+import express from "express";
 
 // src/server/codexAppServerBridge.ts
-function asRecord2(value) {
+import { spawn } from "child_process";
+import { randomBytes } from "crypto";
+import { mkdtemp, readFile, readdir, rm, mkdir, stat } from "fs/promises";
+import { request as httpsRequest } from "https";
+import { homedir } from "os";
+import { tmpdir } from "os";
+import { basename, isAbsolute, join, resolve } from "path";
+import { writeFile } from "fs/promises";
+function asRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function getErrorMessage2(payload, fallback) {
+function getErrorMessage(payload, fallback) {
   if (payload instanceof Error && payload.message.trim().length > 0) {
     return payload.message;
   }
-  const record = asRecord2(payload);
+  const record = asRecord(payload);
   if (!record) return fallback;
   const error = record.error;
   if (typeof error === "string" && error.length > 0) return error;
-  const nestedError = asRecord2(error);
+  const nestedError = asRecord(error);
   if (nestedError && typeof nestedError.message === "string" && nestedError.message.length > 0) {
     return nestedError.message;
   }
   return fallback;
 }
-function setJson2(res, statusCode, payload) {
+function setJson(res, statusCode, payload) {
   res.statusCode = statusCode;
   res.setHeader("Content-Type", "application/json; charset=utf-8");
   res.end(JSON.stringify(payload));
 }
 function extractThreadMessageText(threadReadPayload) {
-  const payload = asRecord2(threadReadPayload);
-  const thread = asRecord2(payload?.thread);
+  const payload = asRecord(threadReadPayload);
+  const thread = asRecord(payload?.thread);
   const turns = Array.isArray(thread?.turns) ? thread.turns : [];
   const parts = [];
   for (const turn of turns) {
-    const turnRecord = asRecord2(turn);
+    const turnRecord = asRecord(turn);
     const items = Array.isArray(turnRecord?.items) ? turnRecord.items : [];
     for (const item of items) {
-      const itemRecord = asRecord2(item);
+      const itemRecord = asRecord(item);
       const type = typeof itemRecord?.type === "string" ? itemRecord.type : "";
       if (type === "agentMessage" && typeof itemRecord?.text === "string" && itemRecord.text.trim().length > 0) {
         parts.push(itemRecord.text.trim());
@@ -1158,7 +70,7 @@ function extractThreadMessageText(threadReadPayload) {
       if (type === "userMessage") {
         const content = Array.isArray(itemRecord?.content) ? itemRecord.content : [];
         for (const block of content) {
-          const blockRecord = asRecord2(block);
+          const blockRecord = asRecord(block);
           if (blockRecord?.type === "text" && typeof blockRecord.text === "string" && blockRecord.text.trim().length > 0) {
             parts.push(blockRecord.text.trim());
           }
@@ -1194,7 +106,7 @@ function scoreFileCandidate(path, query) {
 }
 async function listFilesWithRipgrep(cwd) {
   return await new Promise((resolve2, reject) => {
-    const proc = spawn2("rg", ["--files", "--hidden", "-g", "!.git", "-g", "!node_modules"], {
+    const proc = spawn("rg", ["--files", "--hidden", "-g", "!.git", "-g", "!node_modules"], {
       cwd,
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
@@ -1219,13 +131,16 @@ async function listFilesWithRipgrep(cwd) {
     });
   });
 }
-function getCodexHomeDir2() {
+function getCodexHomeDir() {
   const codexHome = process.env.CODEX_HOME?.trim();
-  return codexHome && codexHome.length > 0 ? codexHome : join2(homedir2(), ".codex");
+  return codexHome && codexHome.length > 0 ? codexHome : join(homedir(), ".codex");
 }
-async function runCommand2(command, args, options = {}) {
+function getSkillsInstallDir() {
+  return join(getCodexHomeDir(), "skills");
+}
+async function runCommand(command, args, options = {}) {
   await new Promise((resolve2, reject) => {
-    const proc = spawn2(command, args, {
+    const proc = spawn(command, args, {
       cwd: options.cwd,
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
@@ -1251,30 +166,30 @@ async function runCommand2(command, args, options = {}) {
   });
 }
 function isMissingHeadError(error) {
-  const message = getErrorMessage2(error, "").toLowerCase();
+  const message = getErrorMessage(error, "").toLowerCase();
   return message.includes("not a valid object name: 'head'") || message.includes("not a valid object name: head") || message.includes("invalid reference: head");
 }
 function isNotGitRepositoryError(error) {
-  const message = getErrorMessage2(error, "").toLowerCase();
+  const message = getErrorMessage(error, "").toLowerCase();
   return message.includes("not a git repository") || message.includes("fatal: not a git repository");
 }
 async function ensureRepoHasInitialCommit(repoRoot) {
-  const agentsPath = join2(repoRoot, "AGENTS.md");
+  const agentsPath = join(repoRoot, "AGENTS.md");
   try {
-    await stat2(agentsPath);
+    await stat(agentsPath);
   } catch {
-    await writeFile2(agentsPath, "", "utf8");
+    await writeFile(agentsPath, "", "utf8");
   }
-  await runCommand2("git", ["add", "AGENTS.md"], { cwd: repoRoot });
-  await runCommand2(
+  await runCommand("git", ["add", "AGENTS.md"], { cwd: repoRoot });
+  await runCommand(
     "git",
     ["-c", "user.name=Codex", "-c", "user.email=codex@local", "commit", "-m", "Initialize repository for worktree support"],
     { cwd: repoRoot }
   );
 }
 async function runCommandCapture(command, args, options = {}) {
-  return await new Promise((resolve2, reject) => {
-    const proc = spawn2(command, args, {
+  return await new Promise((resolveOutput, reject) => {
+    const proc = spawn(command, args, {
       cwd: options.cwd,
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
@@ -1290,7 +205,7 @@ async function runCommandCapture(command, args, options = {}) {
     proc.on("error", reject);
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve2(stdout.trim());
+        resolveOutput(stdout.trim());
         return;
       }
       const details = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
@@ -1299,6 +214,161 @@ async function runCommandCapture(command, args, options = {}) {
     });
   });
 }
+async function detectUserSkillsDir(appServer) {
+  try {
+    const result = await appServer.rpc("skills/list", {});
+    for (const entry of result.data ?? []) {
+      for (const skill of entry.skills ?? []) {
+        if (skill.scope !== "user" || !skill.path) continue;
+        const parts = skill.path.split("/").filter(Boolean);
+        if (parts.length < 2) continue;
+        return `/${parts.slice(0, -2).join("/")}`;
+      }
+    }
+  } catch {
+  }
+  return getSkillsInstallDir();
+}
+async function ensureInstalledSkillIsValid(appServer, skillPath) {
+  const result = await appServer.rpc("skills/list", { forceReload: true });
+  const normalized = skillPath.endsWith("/SKILL.md") ? skillPath : `${skillPath}/SKILL.md`;
+  for (const entry of result.data ?? []) {
+    for (const error of entry.errors ?? []) {
+      if (error.path === normalized) {
+        throw new Error(error.message || "Installed skill is invalid");
+      }
+    }
+  }
+}
+var TREE_CACHE_TTL_MS = 5 * 60 * 1e3;
+var skillsTreeCache = null;
+var metaCache = /* @__PURE__ */ new Map();
+async function getGhToken() {
+  try {
+    const proc = spawn("gh", ["auth", "token"], { stdio: ["ignore", "pipe", "ignore"] });
+    let out = "";
+    proc.stdout.on("data", (d) => {
+      out += d.toString();
+    });
+    return new Promise((resolve2) => {
+      proc.on("close", (code) => resolve2(code === 0 ? out.trim() : null));
+      proc.on("error", () => resolve2(null));
+    });
+  } catch {
+    return null;
+  }
+}
+async function ghFetch(url) {
+  const token = await getGhToken();
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "codex-web-local"
+  };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  return fetch(url, { headers });
+}
+async function fetchSkillsTree() {
+  if (skillsTreeCache && Date.now() - skillsTreeCache.fetchedAt < TREE_CACHE_TTL_MS) {
+    return skillsTreeCache.entries;
+  }
+  const resp = await ghFetch("https://api.github.com/repos/openclaw/skills/git/trees/main?recursive=1");
+  if (!resp.ok) throw new Error(`GitHub tree API returned ${resp.status}`);
+  const data = await resp.json();
+  const metaPattern = /^skills\/([^/]+)\/([^/]+)\/_meta\.json$/;
+  const seen = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const node of data.tree ?? []) {
+    const match = metaPattern.exec(node.path);
+    if (!match) continue;
+    const [, owner, skillName] = match;
+    const key = `${owner}/${skillName}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    entries.push({
+      name: skillName,
+      owner,
+      url: `https://github.com/openclaw/skills/tree/main/skills/${owner}/${skillName}`
+    });
+  }
+  skillsTreeCache = { entries, fetchedAt: Date.now() };
+  return entries;
+}
+async function fetchMetaBatch(entries) {
+  const toFetch = entries.filter((e) => !metaCache.has(`${e.owner}/${e.name}`));
+  if (toFetch.length === 0) return;
+  const batch = toFetch.slice(0, 50);
+  const results = await Promise.allSettled(
+    batch.map(async (e) => {
+      const rawUrl = `https://raw.githubusercontent.com/openclaw/skills/main/skills/${e.owner}/${e.name}/_meta.json`;
+      const resp = await fetch(rawUrl);
+      if (!resp.ok) return;
+      const meta = await resp.json();
+      metaCache.set(`${e.owner}/${e.name}`, {
+        displayName: typeof meta.displayName === "string" ? meta.displayName : "",
+        description: typeof meta.displayName === "string" ? meta.displayName : "",
+        publishedAt: meta.latest?.publishedAt ?? 0
+      });
+    })
+  );
+  void results;
+}
+function buildHubEntry(e) {
+  const cached = metaCache.get(`${e.owner}/${e.name}`);
+  return {
+    name: e.name,
+    owner: e.owner,
+    description: cached?.description ?? "",
+    displayName: cached?.displayName ?? "",
+    publishedAt: cached?.publishedAt ?? 0,
+    avatarUrl: `https://github.com/${e.owner}.png?size=40`,
+    url: e.url,
+    installed: false
+  };
+}
+async function scanInstalledSkillsFromDisk() {
+  const map = /* @__PURE__ */ new Map();
+  const skillsDir = getSkillsInstallDir();
+  try {
+    const entries = await readdir(skillsDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
+      const skillMd = join(skillsDir, entry.name, "SKILL.md");
+      try {
+        await stat(skillMd);
+        map.set(entry.name, { name: entry.name, path: skillMd, enabled: true });
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return map;
+}
+async function searchSkillsHub(allEntries, query, limit, sort, installedMap) {
+  const q = query.toLowerCase().trim();
+  let filtered = q ? allEntries.filter((s) => {
+    if (s.name.toLowerCase().includes(q) || s.owner.toLowerCase().includes(q)) return true;
+    const cached = metaCache.get(`${s.owner}/${s.name}`);
+    if (cached?.displayName?.toLowerCase().includes(q)) return true;
+    return false;
+  }) : allEntries;
+  const page = filtered.slice(0, Math.min(limit * 2, 200));
+  await fetchMetaBatch(page);
+  let results = page.map(buildHubEntry);
+  if (sort === "date") {
+    results.sort((a, b) => b.publishedAt - a.publishedAt);
+  } else if (q) {
+    results.sort((a, b) => {
+      const aExact = a.name.toLowerCase() === q ? 1 : 0;
+      const bExact = b.name.toLowerCase() === q ? 1 : 0;
+      if (aExact !== bExact) return bExact - aExact;
+      return b.publishedAt - a.publishedAt;
+    });
+  }
+  return results.slice(0, limit).map((s) => {
+    const local = installedMap.get(s.name);
+    return local ? { ...s, installed: true, path: local.path, enabled: local.enabled } : s;
+  });
+}
 function normalizeStringArray(value) {
   if (!Array.isArray(value)) return [];
   const normalized = [];
@@ -1320,11 +390,11 @@ function normalizeStringRecord(value) {
   return next;
 }
 function getCodexAuthPath() {
-  return join2(getCodexHomeDir2(), "auth.json");
+  return join(getCodexHomeDir(), "auth.json");
 }
 async function readCodexAuth() {
   try {
-    const raw = await readFile2(getCodexAuthPath(), "utf8");
+    const raw = await readFile(getCodexAuthPath(), "utf8");
     const auth = JSON.parse(raw);
     const token = auth.tokens?.access_token;
     if (!token) return null;
@@ -1334,13 +404,13 @@ async function readCodexAuth() {
   }
 }
 function getCodexGlobalStatePath() {
-  return join2(getCodexHomeDir2(), ".codex-global-state.json");
+  return join(getCodexHomeDir(), ".codex-global-state.json");
 }
 var MAX_THREAD_TITLES = 500;
 function normalizeThreadTitleCache(value) {
-  const record = asRecord2(value);
+  const record = asRecord(value);
   if (!record) return { titles: {}, order: [] };
-  const rawTitles = asRecord2(record.titles);
+  const rawTitles = asRecord(record.titles);
   const titles = {};
   if (rawTitles) {
     for (const [k, v] of Object.entries(rawTitles)) {
@@ -1366,8 +436,8 @@ function removeFromThreadTitleCache(cache, id) {
 async function readThreadTitleCache() {
   const statePath = getCodexGlobalStatePath();
   try {
-    const raw = await readFile2(statePath, "utf8");
-    const payload = asRecord2(JSON.parse(raw)) ?? {};
+    const raw = await readFile(statePath, "utf8");
+    const payload = asRecord(JSON.parse(raw)) ?? {};
     return normalizeThreadTitleCache(payload["thread-titles"]);
   } catch {
     return { titles: {}, order: [] };
@@ -1377,21 +447,21 @@ async function writeThreadTitleCache(cache) {
   const statePath = getCodexGlobalStatePath();
   let payload = {};
   try {
-    const raw = await readFile2(statePath, "utf8");
-    payload = asRecord2(JSON.parse(raw)) ?? {};
+    const raw = await readFile(statePath, "utf8");
+    payload = asRecord(JSON.parse(raw)) ?? {};
   } catch {
     payload = {};
   }
   payload["thread-titles"] = cache;
-  await writeFile2(statePath, JSON.stringify(payload), "utf8");
+  await writeFile(statePath, JSON.stringify(payload), "utf8");
 }
 async function readWorkspaceRootsState() {
   const statePath = getCodexGlobalStatePath();
   let payload = {};
   try {
-    const raw = await readFile2(statePath, "utf8");
+    const raw = await readFile(statePath, "utf8");
     const parsed = JSON.parse(raw);
-    payload = asRecord2(parsed) ?? {};
+    payload = asRecord(parsed) ?? {};
   } catch {
     payload = {};
   }
@@ -1405,15 +475,15 @@ async function writeWorkspaceRootsState(nextState) {
   const statePath = getCodexGlobalStatePath();
   let payload = {};
   try {
-    const raw = await readFile2(statePath, "utf8");
-    payload = asRecord2(JSON.parse(raw)) ?? {};
+    const raw = await readFile(statePath, "utf8");
+    payload = asRecord(JSON.parse(raw)) ?? {};
   } catch {
     payload = {};
   }
   payload["electron-saved-workspace-roots"] = normalizeStringArray(nextState.order);
   payload["electron-workspace-root-labels"] = normalizeStringRecord(nextState.labels);
   payload["active-workspace-roots"] = normalizeStringArray(nextState.active);
-  await writeFile2(statePath, JSON.stringify(payload), "utf8");
+  await writeFile(statePath, JSON.stringify(payload), "utf8");
 }
 async function readJsonBody(req) {
   const raw = await readRawBody(req);
@@ -1451,7 +521,7 @@ function handleFileUpload(req, res) {
       const contentType = req.headers["content-type"] ?? "";
       const boundaryMatch = contentType.match(/boundary=(.+)/i);
       if (!boundaryMatch) {
-        setJson2(res, 400, { error: "Missing multipart boundary" });
+        setJson(res, 400, { error: "Missing multipart boundary" });
         return;
       }
       const boundary = boundaryMatch[1];
@@ -1481,21 +551,21 @@ function handleFileUpload(req, res) {
         break;
       }
       if (!fileData) {
-        setJson2(res, 400, { error: "No file in request" });
+        setJson(res, 400, { error: "No file in request" });
         return;
       }
-      const uploadDir = join2(tmpdir2(), "codex-web-uploads");
-      await mkdir2(uploadDir, { recursive: true });
-      const destDir = await mkdtemp2(join2(uploadDir, "f-"));
-      const destPath = join2(destDir, fileName);
-      await writeFile2(destPath, fileData);
-      setJson2(res, 200, { path: destPath });
+      const uploadDir = join(tmpdir(), "codex-web-uploads");
+      await mkdir(uploadDir, { recursive: true });
+      const destDir = await mkdtemp(join(uploadDir, "f-"));
+      const destPath = join(destDir, fileName);
+      await writeFile(destPath, fileData);
+      setJson(res, 200, { path: destPath });
     } catch (err) {
-      setJson2(res, 500, { error: getErrorMessage2(err, "Upload failed") });
+      setJson(res, 500, { error: getErrorMessage(err, "Upload failed") });
     }
   });
   req.on("error", (err) => {
-    setJson2(res, 500, { error: getErrorMessage2(err, "Upload stream error") });
+    setJson(res, 500, { error: getErrorMessage(err, "Upload stream error") });
   });
 }
 async function proxyTranscribe(body, contentType, authToken, accountId) {
@@ -1547,7 +617,7 @@ var AppServerProcess = class {
   start() {
     if (this.process) return;
     this.stopping = false;
-    const proc = spawn2("codex", this.appServerArgs, { stdio: ["pipe", "pipe", "pipe"] });
+    const proc = spawn("codex", this.appServerArgs, { stdio: ["pipe", "pipe", "pipe"] });
     this.process = proc;
     proc.stdout.setEncoding("utf8");
     proc.stdout.on("data", (chunk) => {
@@ -1641,7 +711,7 @@ var AppServerProcess = class {
     }
     this.pendingServerRequests.delete(requestId);
     this.sendServerRequestReply(requestId, reply);
-    const requestParams = asRecord2(pendingRequest.params);
+    const requestParams = asRecord(pendingRequest.params);
     const threadId = typeof requestParams?.threadId === "string" && requestParams.threadId.length > 0 ? requestParams.threadId : "";
     this.emitNotification({
       method: "server/request/resolved",
@@ -1710,7 +780,7 @@ var AppServerProcess = class {
   }
   async respondToServerRequest(payload) {
     await this.ensureInitialized();
-    const body = asRecord2(payload);
+    const body = asRecord(payload);
     if (!body) {
       throw new Error("Invalid response payload: expected object");
     }
@@ -1718,7 +788,7 @@ var AppServerProcess = class {
     if (typeof id !== "number" || !Number.isInteger(id)) {
       throw new Error('Invalid response payload: "id" must be an integer');
     }
-    const rawError = asRecord2(body.error);
+    const rawError = asRecord(body.error);
     if (rawError) {
       const message = typeof rawError.message === "string" && rawError.message.trim().length > 0 ? rawError.message.trim() : "Server request rejected by client";
       const code = typeof rawError.code === "number" && Number.isFinite(rawError.code) ? Math.trunc(rawError.code) : -32e3;
@@ -1773,7 +843,7 @@ var MethodCatalog = class {
   }
   async runGenerateSchemaCommand(outDir) {
     await new Promise((resolve2, reject) => {
-      const process2 = spawn2("codex", ["app-server", "generate-json-schema", "--out", outDir], {
+      const process2 = spawn("codex", ["app-server", "generate-json-schema", "--out", outDir], {
         stdio: ["ignore", "ignore", "pipe"]
       });
       let stderr = "";
@@ -1792,13 +862,13 @@ var MethodCatalog = class {
     });
   }
   extractMethodsFromClientRequest(payload) {
-    const root = asRecord2(payload);
+    const root = asRecord(payload);
     const oneOf = Array.isArray(root?.oneOf) ? root.oneOf : [];
     const methods = /* @__PURE__ */ new Set();
     for (const entry of oneOf) {
-      const row = asRecord2(entry);
-      const properties = asRecord2(row?.properties);
-      const methodDef = asRecord2(properties?.method);
+      const row = asRecord(entry);
+      const properties = asRecord(row?.properties);
+      const methodDef = asRecord(properties?.method);
       const methodEnum = Array.isArray(methodDef?.enum) ? methodDef.enum : [];
       for (const item of methodEnum) {
         if (typeof item === "string" && item.length > 0) {
@@ -1809,13 +879,13 @@ var MethodCatalog = class {
     return Array.from(methods).sort((a, b) => a.localeCompare(b));
   }
   extractMethodsFromServerNotification(payload) {
-    const root = asRecord2(payload);
+    const root = asRecord(payload);
     const oneOf = Array.isArray(root?.oneOf) ? root.oneOf : [];
     const methods = /* @__PURE__ */ new Set();
     for (const entry of oneOf) {
-      const row = asRecord2(entry);
-      const properties = asRecord2(row?.properties);
-      const methodDef = asRecord2(properties?.method);
+      const row = asRecord(entry);
+      const properties = asRecord(row?.properties);
+      const methodDef = asRecord(properties?.method);
       const methodEnum = Array.isArray(methodDef?.enum) ? methodDef.enum : [];
       for (const item of methodEnum) {
         if (typeof item === "string" && item.length > 0) {
@@ -1829,10 +899,10 @@ var MethodCatalog = class {
     if (this.methodCache) {
       return this.methodCache;
     }
-    const outDir = await mkdtemp2(join2(tmpdir2(), "codex-web-local-schema-"));
+    const outDir = await mkdtemp(join(tmpdir(), "codex-web-local-schema-"));
     await this.runGenerateSchemaCommand(outDir);
-    const clientRequestPath = join2(outDir, "ClientRequest.json");
-    const raw = await readFile2(clientRequestPath, "utf8");
+    const clientRequestPath = join(outDir, "ClientRequest.json");
+    const raw = await readFile(clientRequestPath, "utf8");
     const parsed = JSON.parse(raw);
     const methods = this.extractMethodsFromClientRequest(parsed);
     this.methodCache = methods;
@@ -1842,10 +912,10 @@ var MethodCatalog = class {
     if (this.notificationCache) {
       return this.notificationCache;
     }
-    const outDir = await mkdtemp2(join2(tmpdir2(), "codex-web-local-schema-"));
+    const outDir = await mkdtemp(join(tmpdir(), "codex-web-local-schema-"));
     await this.runGenerateSchemaCommand(outDir);
-    const serverNotificationPath = join2(outDir, "ServerNotification.json");
-    const raw = await readFile2(serverNotificationPath, "utf8");
+    const serverNotificationPath = join(outDir, "ServerNotification.json");
+    const raw = await readFile(serverNotificationPath, "utf8");
     const parsed = JSON.parse(raw);
     const methods = this.extractMethodsFromServerNotification(parsed);
     this.notificationCache = methods;
@@ -1868,7 +938,7 @@ async function loadAllThreadsForSearch(appServer) {
   const threads = [];
   let cursor = null;
   do {
-    const response = asRecord2(await appServer.rpc("thread/list", {
+    const response = asRecord(await appServer.rpc("thread/list", {
       archived: false,
       limit: 100,
       sortKey: "updated_at",
@@ -1876,7 +946,7 @@ async function loadAllThreadsForSearch(appServer) {
     }));
     const data = Array.isArray(response?.data) ? response.data : [];
     for (const row of data) {
-      const record = asRecord2(row);
+      const record = asRecord(row);
       const id = typeof record?.id === "string" ? record.id : "";
       if (!id) continue;
       const title = typeof record?.name === "string" && record.name.trim().length > 0 ? record.name.trim() : typeof record?.preview === "string" && record.preview.trim().length > 0 ? record.preview.trim() : "Untitled thread";
@@ -1940,7 +1010,6 @@ function createCodexBridgeMiddleware() {
     }
     return threadSearchIndexPromise;
   }
-  void initializeSkillsSyncOnStartup(appServer);
   const middleware = async (req, res, next) => {
     try {
       if (!req.url) {
@@ -1948,28 +1017,25 @@ function createCodexBridgeMiddleware() {
         return;
       }
       const url = new URL(req.url, "http://localhost");
-      if (await handleSkillsRoutes(req, res, url, { appServer, readJsonBody })) {
-        return;
-      }
       if (req.method === "POST" && url.pathname === "/codex-api/upload-file") {
         handleFileUpload(req, res);
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/rpc") {
         const payload = await readJsonBody(req);
-        const body = asRecord2(payload);
+        const body = asRecord(payload);
         if (!body || typeof body.method !== "string" || body.method.length === 0) {
-          setJson2(res, 400, { error: "Invalid body: expected { method, params? }" });
+          setJson(res, 400, { error: "Invalid body: expected { method, params? }" });
           return;
         }
         const result = await appServer.rpc(body.method, body.params ?? null);
-        setJson2(res, 200, { result });
+        setJson(res, 200, { result });
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/transcribe") {
         const auth = await readCodexAuth();
         if (!auth) {
-          setJson2(res, 401, { error: "No auth token available for transcription" });
+          setJson(res, 401, { error: "No auth token available for transcription" });
           return;
         }
         const rawBody = await readRawBody(req);
@@ -1983,48 +1049,48 @@ function createCodexBridgeMiddleware() {
       if (req.method === "POST" && url.pathname === "/codex-api/server-requests/respond") {
         const payload = await readJsonBody(req);
         await appServer.respondToServerRequest(payload);
-        setJson2(res, 200, { ok: true });
+        setJson(res, 200, { ok: true });
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/server-requests/pending") {
-        setJson2(res, 200, { data: appServer.listPendingServerRequests() });
+        setJson(res, 200, { data: appServer.listPendingServerRequests() });
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/meta/methods") {
         const methods = await methodCatalog.listMethods();
-        setJson2(res, 200, { data: methods });
+        setJson(res, 200, { data: methods });
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/meta/notifications") {
         const methods = await methodCatalog.listNotificationMethods();
-        setJson2(res, 200, { data: methods });
+        setJson(res, 200, { data: methods });
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/workspace-roots-state") {
         const state = await readWorkspaceRootsState();
-        setJson2(res, 200, { data: state });
+        setJson(res, 200, { data: state });
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/home-directory") {
-        setJson2(res, 200, { data: { path: homedir2() } });
+        setJson(res, 200, { data: { path: homedir() } });
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/worktree/create") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord(await readJsonBody(req));
         const rawSourceCwd = typeof payload?.sourceCwd === "string" ? payload.sourceCwd.trim() : "";
         if (!rawSourceCwd) {
-          setJson2(res, 400, { error: "Missing sourceCwd" });
+          setJson(res, 400, { error: "Missing sourceCwd" });
           return;
         }
         const sourceCwd = isAbsolute(rawSourceCwd) ? rawSourceCwd : resolve(rawSourceCwd);
         try {
-          const sourceInfo = await stat2(sourceCwd);
+          const sourceInfo = await stat(sourceCwd);
           if (!sourceInfo.isDirectory()) {
-            setJson2(res, 400, { error: "sourceCwd is not a directory" });
+            setJson(res, 400, { error: "sourceCwd is not a directory" });
             return;
           }
         } catch {
-          setJson2(res, 404, { error: "sourceCwd does not exist" });
+          setJson(res, 404, { error: "sourceCwd does not exist" });
           return;
         }
         try {
@@ -2033,25 +1099,25 @@ function createCodexBridgeMiddleware() {
             gitRoot = await runCommandCapture("git", ["rev-parse", "--show-toplevel"], { cwd: sourceCwd });
           } catch (error) {
             if (!isNotGitRepositoryError(error)) throw error;
-            await runCommand2("git", ["init"], { cwd: sourceCwd });
+            await runCommand("git", ["init"], { cwd: sourceCwd });
             gitRoot = await runCommandCapture("git", ["rev-parse", "--show-toplevel"], { cwd: sourceCwd });
           }
           const repoName = basename(gitRoot) || "repo";
-          const worktreesRoot = join2(getCodexHomeDir2(), "worktrees");
-          await mkdir2(worktreesRoot, { recursive: true });
+          const worktreesRoot = join(getCodexHomeDir(), "worktrees");
+          await mkdir(worktreesRoot, { recursive: true });
           let worktreeId = "";
           let worktreeParent = "";
           let worktreeCwd = "";
           for (let attempt = 0; attempt < 12; attempt += 1) {
             const candidate = randomBytes(2).toString("hex");
-            const parent = join2(worktreesRoot, candidate);
+            const parent = join(worktreesRoot, candidate);
             try {
-              await stat2(parent);
+              await stat(parent);
               continue;
             } catch {
               worktreeId = candidate;
               worktreeParent = parent;
-              worktreeCwd = join2(parent, repoName);
+              worktreeCwd = join(parent, repoName);
               break;
             }
           }
@@ -2059,15 +1125,15 @@ function createCodexBridgeMiddleware() {
             throw new Error("Failed to allocate a unique worktree id");
           }
           const branch = `codex/${worktreeId}`;
-          await mkdir2(worktreeParent, { recursive: true });
+          await mkdir(worktreeParent, { recursive: true });
           try {
-            await runCommand2("git", ["worktree", "add", "-b", branch, worktreeCwd, "HEAD"], { cwd: gitRoot });
+            await runCommand("git", ["worktree", "add", "-b", branch, worktreeCwd, "HEAD"], { cwd: gitRoot });
           } catch (error) {
             if (!isMissingHeadError(error)) throw error;
             await ensureRepoHasInitialCommit(gitRoot);
-            await runCommand2("git", ["worktree", "add", "-b", branch, worktreeCwd, "HEAD"], { cwd: gitRoot });
+            await runCommand("git", ["worktree", "add", "-b", branch, worktreeCwd, "HEAD"], { cwd: gitRoot });
           }
-          setJson2(res, 200, {
+          setJson(res, 200, {
             data: {
               cwd: worktreeCwd,
               branch,
@@ -2075,15 +1141,15 @@ function createCodexBridgeMiddleware() {
             }
           });
         } catch (error) {
-          setJson2(res, 500, { error: getErrorMessage2(error, "Failed to create worktree") });
+          setJson(res, 500, { error: getErrorMessage(error, "Failed to create worktree") });
         }
         return;
       }
       if (req.method === "PUT" && url.pathname === "/codex-api/workspace-roots-state") {
         const payload = await readJsonBody(req);
-        const record = asRecord2(payload);
+        const record = asRecord(payload);
         if (!record) {
-          setJson2(res, 400, { error: "Invalid body: expected object" });
+          setJson(res, 400, { error: "Invalid body: expected object" });
           return;
         }
         const nextState = {
@@ -2092,33 +1158,33 @@ function createCodexBridgeMiddleware() {
           active: normalizeStringArray(record.active)
         };
         await writeWorkspaceRootsState(nextState);
-        setJson2(res, 200, { ok: true });
+        setJson(res, 200, { ok: true });
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/project-root") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord(await readJsonBody(req));
         const rawPath = typeof payload?.path === "string" ? payload.path.trim() : "";
         const createIfMissing = payload?.createIfMissing === true;
         const label = typeof payload?.label === "string" ? payload.label : "";
         if (!rawPath) {
-          setJson2(res, 400, { error: "Missing path" });
+          setJson(res, 400, { error: "Missing path" });
           return;
         }
         const normalizedPath = isAbsolute(rawPath) ? rawPath : resolve(rawPath);
         let pathExists = true;
         try {
-          const info = await stat2(normalizedPath);
+          const info = await stat(normalizedPath);
           if (!info.isDirectory()) {
-            setJson2(res, 400, { error: "Path exists but is not a directory" });
+            setJson(res, 400, { error: "Path exists but is not a directory" });
             return;
           }
         } catch {
           pathExists = false;
         }
         if (!pathExists && createIfMissing) {
-          await mkdir2(normalizedPath, { recursive: true });
+          await mkdir(normalizedPath, { recursive: true });
         } else if (!pathExists) {
-          setJson2(res, 404, { error: "Directory does not exist" });
+          setJson(res, 404, { error: "Directory does not exist" });
           return;
         }
         const existingState = await readWorkspaceRootsState();
@@ -2133,103 +1199,215 @@ function createCodexBridgeMiddleware() {
           labels: nextLabels,
           active: nextActive
         });
-        setJson2(res, 200, { data: { path: normalizedPath } });
+        setJson(res, 200, { data: { path: normalizedPath } });
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/project-root-suggestion") {
         const basePath = url.searchParams.get("basePath")?.trim() ?? "";
         if (!basePath) {
-          setJson2(res, 400, { error: "Missing basePath" });
+          setJson(res, 400, { error: "Missing basePath" });
           return;
         }
         const normalizedBasePath = isAbsolute(basePath) ? basePath : resolve(basePath);
         try {
-          const baseInfo = await stat2(normalizedBasePath);
+          const baseInfo = await stat(normalizedBasePath);
           if (!baseInfo.isDirectory()) {
-            setJson2(res, 400, { error: "basePath is not a directory" });
+            setJson(res, 400, { error: "basePath is not a directory" });
             return;
           }
         } catch {
-          setJson2(res, 404, { error: "basePath does not exist" });
+          setJson(res, 404, { error: "basePath does not exist" });
           return;
         }
         let index = 1;
         while (index < 1e5) {
           const candidateName = `New Project (${String(index)})`;
-          const candidatePath = join2(normalizedBasePath, candidateName);
+          const candidatePath = join(normalizedBasePath, candidateName);
           try {
-            await stat2(candidatePath);
+            await stat(candidatePath);
             index += 1;
             continue;
           } catch {
-            setJson2(res, 200, { data: { name: candidateName, path: candidatePath } });
+            setJson(res, 200, { data: { name: candidateName, path: candidatePath } });
             return;
           }
         }
-        setJson2(res, 500, { error: "Failed to compute project name suggestion" });
+        setJson(res, 500, { error: "Failed to compute project name suggestion" });
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/composer-file-search") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord(await readJsonBody(req));
         const rawCwd = typeof payload?.cwd === "string" ? payload.cwd.trim() : "";
         const query = typeof payload?.query === "string" ? payload.query.trim() : "";
         const limitRaw = typeof payload?.limit === "number" ? payload.limit : 20;
         const limit = Math.max(1, Math.min(100, Math.floor(limitRaw)));
         if (!rawCwd) {
-          setJson2(res, 400, { error: "Missing cwd" });
+          setJson(res, 400, { error: "Missing cwd" });
           return;
         }
         const cwd = isAbsolute(rawCwd) ? rawCwd : resolve(rawCwd);
         try {
-          const info = await stat2(cwd);
+          const info = await stat(cwd);
           if (!info.isDirectory()) {
-            setJson2(res, 400, { error: "cwd is not a directory" });
+            setJson(res, 400, { error: "cwd is not a directory" });
             return;
           }
         } catch {
-          setJson2(res, 404, { error: "cwd does not exist" });
+          setJson(res, 404, { error: "cwd does not exist" });
           return;
         }
         try {
           const files = await listFilesWithRipgrep(cwd);
           const scored = files.map((path) => ({ path, score: scoreFileCandidate(path, query) })).filter((row) => query.length === 0 || row.score < 10).sort((a, b) => a.score - b.score || a.path.localeCompare(b.path)).slice(0, limit).map((row) => ({ path: row.path }));
-          setJson2(res, 200, { data: scored });
+          setJson(res, 200, { data: scored });
         } catch (error) {
-          setJson2(res, 500, { error: getErrorMessage2(error, "Failed to search files") });
+          setJson(res, 500, { error: getErrorMessage(error, "Failed to search files") });
         }
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/thread-titles") {
         const cache = await readThreadTitleCache();
-        setJson2(res, 200, { data: cache });
+        setJson(res, 200, { data: cache });
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/thread-search") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord(await readJsonBody(req));
         const query = typeof payload?.query === "string" ? payload.query.trim() : "";
         const limitRaw = typeof payload?.limit === "number" ? payload.limit : 200;
         const limit = Math.max(1, Math.min(1e3, Math.floor(limitRaw)));
         if (!query) {
-          setJson2(res, 200, { data: { threadIds: [], indexedThreadCount: 0 } });
+          setJson(res, 200, { data: { threadIds: [], indexedThreadCount: 0 } });
           return;
         }
         const index = await getThreadSearchIndex();
         const matchedIds = Array.from(index.docsById.entries()).filter(([, doc]) => isExactPhraseMatch(query, doc)).slice(0, limit).map(([id]) => id);
-        setJson2(res, 200, { data: { threadIds: matchedIds, indexedThreadCount: index.docsById.size } });
+        setJson(res, 200, { data: { threadIds: matchedIds, indexedThreadCount: index.docsById.size } });
         return;
       }
       if (req.method === "PUT" && url.pathname === "/codex-api/thread-titles") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord(await readJsonBody(req));
         const id = typeof payload?.id === "string" ? payload.id : "";
         const title = typeof payload?.title === "string" ? payload.title : "";
         if (!id) {
-          setJson2(res, 400, { error: "Missing id" });
+          setJson(res, 400, { error: "Missing id" });
           return;
         }
         const cache = await readThreadTitleCache();
         const next2 = title ? updateThreadTitleCache(cache, id, title) : removeFromThreadTitleCache(cache, id);
         await writeThreadTitleCache(next2);
-        setJson2(res, 200, { ok: true });
+        setJson(res, 200, { ok: true });
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/codex-api/skills-hub") {
+        try {
+          const q = url.searchParams.get("q") || "";
+          const limit = Math.min(Math.max(parseInt(url.searchParams.get("limit") || "50", 10) || 50, 1), 200);
+          const sort = url.searchParams.get("sort") || "date";
+          const allEntries = await fetchSkillsTree();
+          const installedMap = await scanInstalledSkillsFromDisk();
+          try {
+            const result = await appServer.rpc("skills/list", {});
+            for (const entry of result.data ?? []) {
+              for (const skill of entry.skills ?? []) {
+                if (skill.name) {
+                  installedMap.set(skill.name, { name: skill.name, path: skill.path ?? "", enabled: skill.enabled !== false });
+                }
+              }
+            }
+          } catch {
+          }
+          const installedHubEntries = allEntries.filter((e) => installedMap.has(e.name));
+          await fetchMetaBatch(installedHubEntries);
+          const installed = [];
+          for (const [, info] of installedMap) {
+            const hubEntry = allEntries.find((e) => e.name === info.name);
+            const base = hubEntry ? buildHubEntry(hubEntry) : {
+              name: info.name,
+              owner: "local",
+              description: "",
+              displayName: "",
+              publishedAt: 0,
+              avatarUrl: "",
+              url: "",
+              installed: false
+            };
+            installed.push({ ...base, installed: true, path: info.path, enabled: info.enabled });
+          }
+          const results = await searchSkillsHub(allEntries, q, limit, sort, installedMap);
+          setJson(res, 200, { data: results, installed, total: allEntries.length });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to fetch skills hub") });
+        }
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/codex-api/skills-hub/readme") {
+        try {
+          const owner = url.searchParams.get("owner") || "";
+          const name = url.searchParams.get("name") || "";
+          if (!owner || !name) {
+            setJson(res, 400, { error: "Missing owner or name" });
+            return;
+          }
+          const rawUrl = `https://raw.githubusercontent.com/openclaw/skills/main/skills/${owner}/${name}/SKILL.md`;
+          const resp = await fetch(rawUrl);
+          if (!resp.ok) throw new Error(`Failed to fetch SKILL.md: ${resp.status}`);
+          const content = await resp.text();
+          setJson(res, 200, { content });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to fetch SKILL.md") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/skills-hub/install") {
+        try {
+          const payload = asRecord(await readJsonBody(req));
+          const owner = typeof payload?.owner === "string" ? payload.owner : "";
+          const name = typeof payload?.name === "string" ? payload.name : "";
+          if (!owner || !name) {
+            setJson(res, 400, { error: "Missing owner or name" });
+            return;
+          }
+          const installerScript = "/Users/igor/.cursor/skills/.system/skill-installer/scripts/install-skill-from-github.py";
+          const installDest = await detectUserSkillsDir(appServer);
+          const skillPathInRepo = `skills/${owner}/${name}`;
+          await runCommand("python3", [
+            installerScript,
+            "--repo",
+            "openclaw/skills",
+            "--path",
+            skillPathInRepo,
+            "--dest",
+            installDest,
+            "--method",
+            "git"
+          ]);
+          const skillDir = join(installDest, name);
+          await ensureInstalledSkillIsValid(appServer, skillDir);
+          setJson(res, 200, { ok: true, path: skillDir });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to install skill") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/skills-hub/uninstall") {
+        try {
+          const payload = asRecord(await readJsonBody(req));
+          const name = typeof payload?.name === "string" ? payload.name : "";
+          const path = typeof payload?.path === "string" ? payload.path : "";
+          const target = path || (name ? join(getSkillsInstallDir(), name) : "");
+          if (!target) {
+            setJson(res, 400, { error: "Missing name or path" });
+            return;
+          }
+          await rm(target, { recursive: true, force: true });
+          try {
+            await appServer.rpc("skills/list", { forceReload: true });
+          } catch {
+          }
+          setJson(res, 200, { ok: true, deletedPath: target });
+        } catch (error) {
+          setJson(res, 502, { error: getErrorMessage(error, "Failed to uninstall skill") });
+        }
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/events") {
@@ -2264,8 +1442,8 @@ data: ${JSON.stringify({ ok: true })}
       }
       next();
     } catch (error) {
-      const message = getErrorMessage2(error, "Unknown bridge error");
-      setJson2(res, 502, { error: message });
+      const message = getErrorMessage(error, "Unknown bridge error");
+      setJson(res, 502, { error: message });
     }
   };
   middleware.dispose = () => {
@@ -2402,8 +1580,8 @@ function createAuthSession(password) {
 }
 
 // src/server/localBrowseUi.ts
-import { dirname, extname, join as join3 } from "path";
-import { open, readFile as readFile3, readdir as readdir3, stat as stat3 } from "fs/promises";
+import { dirname, extname, join as join2 } from "path";
+import { open, readFile as readFile2, readdir as readdir2, stat as stat2 } from "fs/promises";
 var TEXT_EDITABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
   ".md",
@@ -2518,7 +1696,7 @@ async function probeFileIsText(localPath) {
 async function isTextEditableFile(localPath) {
   if (isTextEditablePath(localPath)) return true;
   try {
-    const fileStat = await stat3(localPath);
+    const fileStat = await stat2(localPath);
     if (!fileStat.isFile()) return false;
     return await probeFileIsText(localPath);
   } catch {
@@ -2538,10 +1716,10 @@ function escapeForInlineScriptString(value) {
   return JSON.stringify(value).replace(/<\//gu, "<\\/").replace(/<!--/gu, "<\\!--").replace(/\u2028/gu, "\\u2028").replace(/\u2029/gu, "\\u2029");
 }
 async function getDirectoryItems(localPath) {
-  const entries = await readdir3(localPath, { withFileTypes: true });
+  const entries = await readdir2(localPath, { withFileTypes: true });
   const withMeta = await Promise.all(entries.map(async (entry) => {
-    const entryPath = join3(localPath, entry.name);
-    const entryStat = await stat3(entryPath);
+    const entryPath = join2(localPath, entry.name);
+    const entryStat = await stat2(entryPath);
     const editable = !entry.isDirectory() && await isTextEditableFile(entryPath);
     return {
       name: entry.name,
@@ -2599,7 +1777,7 @@ async function createDirectoryListingHtml(localPath) {
 </html>`;
 }
 async function createTextEditorHtml(localPath) {
-  const content = await readFile3(localPath, "utf8");
+  const content = await readFile2(localPath, "utf8");
   const parentPath = dirname(localPath);
   const language = languageForPath(localPath);
   const safeContentLiteral = escapeForInlineScriptString(content);
@@ -2670,8 +1848,8 @@ async function createTextEditorHtml(localPath) {
 // src/server/httpServer.ts
 import { WebSocketServer } from "ws";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var distDir = join4(__dirname, "..", "dist");
-var spaEntryFile = join4(distDir, "index.html");
+var distDir = join3(__dirname, "..", "dist");
+var spaEntryFile = join3(distDir, "index.html");
 var IMAGE_CONTENT_TYPES = {
   ".avif": "image/avif",
   ".bmp": "image/bmp",
@@ -2682,20 +1860,6 @@ var IMAGE_CONTENT_TYPES = {
   ".svg": "image/svg+xml",
   ".webp": "image/webp"
 };
-function renderFrontendMissingHtml(message, details) {
-  const lines = details && details.length > 0 ? `<pre>${details.join("\n")}</pre>` : "";
-  return [
-    "<!doctype html>",
-    '<html lang="en">',
-    '<head><meta charset="utf-8"><title>Codex Web UI Error</title></head>',
-    "<body>",
-    `<h1>${message}</h1>`,
-    lines,
-    '<p><a href="/">Back to chat</a></p>',
-    "</body>",
-    "</html>"
-  ].join("");
-}
 function normalizeLocalImagePath(rawPath) {
   const trimmed = rawPath.trim();
   if (!trimmed) return "";
@@ -2762,7 +1926,7 @@ function createServer(options = {}) {
       return;
     }
     try {
-      const fileStat = await stat4(localPath);
+      const fileStat = await stat3(localPath);
       res.setHeader("Cache-Control", "private, no-store");
       if (fileStat.isDirectory()) {
         const html = await createDirectoryListingHtml(localPath);
@@ -2785,7 +1949,7 @@ function createServer(options = {}) {
       return;
     }
     try {
-      const fileStat = await stat4(localPath);
+      const fileStat = await stat3(localPath);
       if (!fileStat.isFile()) {
         res.status(400).json({ error: "Expected file path." });
         return;
@@ -2809,31 +1973,32 @@ function createServer(options = {}) {
     }
     const body = typeof req.body === "string" ? req.body : "";
     try {
-      await writeFile3(localPath, body, "utf8");
+      await writeFile2(localPath, body, "utf8");
       res.status(200).json({ ok: true });
     } catch {
       res.status(404).json({ error: "File not found." });
     }
   });
-  const hasFrontendAssets = existsSync2(spaEntryFile);
+  const hasFrontendAssets = existsSync(spaEntryFile);
   if (hasFrontendAssets) {
     app.use(express.static(distDir));
   }
   app.use((_req, res) => {
     if (!hasFrontendAssets) {
-      res.status(503).type("text/html; charset=utf-8").send(
-        renderFrontendMissingHtml("Codex web UI assets are missing.", [
+      res.status(503).type("text/plain").send(
+        [
+          "Codex web UI assets are missing.",
           `Expected: ${spaEntryFile}`,
           "If running from source, build frontend assets with: npm run build:frontend",
           "If running with npx, clear the npx cache and reinstall codexapp."
-        ])
+        ].join("\n")
       );
       return;
     }
     res.sendFile(spaEntryFile, (error) => {
       if (!error) return;
       if (!res.headersSent) {
-        res.status(404).type("text/html; charset=utf-8").send(renderFrontendMissingHtml("Frontend entry file not found."));
+        res.status(404).type("text/plain").send("Frontend entry file not found.");
       }
     });
   });
@@ -2888,8 +2053,8 @@ var program = new Command().name("codexui").description("Web interface for Codex
 var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
 async function readCliVersion() {
   try {
-    const packageJsonPath = join5(__dirname2, "..", "package.json");
-    const raw = await readFile4(packageJsonPath, "utf8");
+    const packageJsonPath = join4(__dirname2, "..", "package.json");
+    const raw = await readFile3(packageJsonPath, "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.version === "string" ? parsed.version : "unknown";
   } catch {
@@ -2914,22 +2079,22 @@ function runWithStatus(command, args) {
   return result.status ?? -1;
 }
 function getUserNpmPrefix() {
-  return join5(homedir3(), ".npm-global");
+  return join4(homedir2(), ".npm-global");
 }
 function resolveCodexCommand() {
   if (canRun("codex", ["--version"])) {
     return "codex";
   }
-  const userCandidate = join5(getUserNpmPrefix(), "bin", "codex");
-  if (existsSync3(userCandidate) && canRun(userCandidate, ["--version"])) {
+  const userCandidate = join4(getUserNpmPrefix(), "bin", "codex");
+  if (existsSync2(userCandidate) && canRun(userCandidate, ["--version"])) {
     return userCandidate;
   }
   const prefix = process.env.PREFIX?.trim();
   if (!prefix) {
     return null;
   }
-  const candidate = join5(prefix, "bin", "codex");
-  if (existsSync3(candidate) && canRun(candidate, ["--version"])) {
+  const candidate = join4(prefix, "bin", "codex");
+  if (existsSync2(candidate) && canRun(candidate, ["--version"])) {
     return candidate;
   }
   return null;
@@ -2938,8 +2103,8 @@ function resolveCloudflaredCommand() {
   if (canRun("cloudflared", ["--version"])) {
     return "cloudflared";
   }
-  const localCandidate = join5(homedir3(), ".local", "bin", "cloudflared");
-  if (existsSync3(localCandidate) && canRun(localCandidate, ["--version"])) {
+  const localCandidate = join4(homedir2(), ".local", "bin", "cloudflared");
+  if (existsSync2(localCandidate) && canRun(localCandidate, ["--version"])) {
     return localCandidate;
   }
   return null;
@@ -2992,9 +2157,9 @@ async function ensureCloudflaredInstalledLinux() {
   if (!mappedArch) {
     throw new Error(`cloudflared auto-install is not supported for Linux architecture: ${process.arch}`);
   }
-  const userBinDir = join5(homedir3(), ".local", "bin");
+  const userBinDir = join4(homedir2(), ".local", "bin");
   mkdirSync(userBinDir, { recursive: true });
-  const destination = join5(userBinDir, "cloudflared");
+  const destination = join4(userBinDir, "cloudflared");
   const downloadUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${mappedArch}`;
   console.log("\ncloudflared not found. Installing to ~/.local/bin...\n");
   await downloadFile(downloadUrl, destination);
@@ -3033,8 +2198,8 @@ async function resolveCloudflaredForTunnel() {
   return ensureCloudflaredInstalledLinux();
 }
 function hasCodexAuth() {
-  const codexHome = process.env.CODEX_HOME?.trim() || join5(homedir3(), ".codex");
-  return existsSync3(join5(codexHome, "auth.json"));
+  const codexHome = process.env.CODEX_HOME?.trim() || join4(homedir2(), ".codex");
+  return existsSync2(join4(codexHome, "auth.json"));
 }
 function ensureCodexInstalled() {
   let codexCommand = resolveCodexCommand();
@@ -3052,7 +2217,7 @@ function ensureCodexInstalled() {
 Global npm install requires elevated permissions. Retrying with --prefix ${userPrefix}...
 `);
       runOrFail("npm", ["install", "-g", "--prefix", userPrefix, pkg], `${label} (user prefix)`);
-      process.env.PATH = `${join5(userPrefix, "bin")}:${process.env.PATH ?? ""}`;
+      process.env.PATH = `${join4(userPrefix, "bin")}:${process.env.PATH ?? ""}`;
     };
     if (isTermuxRuntime()) {
       console.log("\nCodex CLI not found. Installing Termux-compatible Codex CLI from npm...\n");
@@ -3101,7 +2266,7 @@ function printTermuxKeepAlive(lines) {
 }
 function openBrowser(url) {
   const command = process.platform === "darwin" ? { cmd: "open", args: [url] } : process.platform === "win32" ? { cmd: "cmd", args: ["/c", "start", "", url] } : { cmd: "xdg-open", args: [url] };
-  const child = spawn3(command.cmd, command.args, { detached: true, stdio: "ignore" });
+  const child = spawn2(command.cmd, command.args, { detached: true, stdio: "ignore" });
   child.on("error", () => {
   });
   child.unref();
@@ -3133,7 +2298,7 @@ function getAccessibleUrls(port) {
 }
 async function startCloudflaredTunnel(command, localPort) {
   return new Promise((resolve2, reject) => {
-    const child = spawn3(command, ["tunnel", "--url", `http://localhost:${String(localPort)}`], {
+    const child = spawn2(command, ["tunnel", "--url", `http://localhost:${String(localPort)}`], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     const timeout = setTimeout(() => {