codexapp 0.1.47 → 0.1.49

package/dist-cli/index.js

@@ -2,11 +2,11 @@
 
 // src/cli/index.ts
 import { createServer as createServer2 } from "http";
-import { chmodSync, createWriteStream, existsSync as existsSync4, mkdirSync } from "fs";
+import { chmodSync, createWriteStream, existsSync as existsSync5, mkdirSync } from "fs";
 import { readFile as readFile4, stat as stat5, writeFile as writeFile4 } from "fs/promises";
-import { homedir as homedir3, networkInterfaces } from "os";
-import { isAbsolute as isAbsolute3, join as join5, resolve as resolve2 } from "path";
-import { spawn as spawn3, spawnSync } from "child_process";
+import { homedir as homedir4, networkInterfaces } from "os";
+import { isAbsolute as isAbsolute3, join as join6, resolve as resolve2 } from "path";
+import { spawn as spawn3 } from "child_process";
 import { createInterface as createInterface2 } from "readline/promises";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname3 } from "path";
@@ -16,8 +16,8 @@ import qrcode from "qrcode-terminal";
 
 // src/server/httpServer.ts
 import { fileURLToPath } from "url";
-import { dirname as dirname2, extname as extname2, isAbsolute as isAbsolute2, join as join4 } from "path";
-import { existsSync as existsSync3 } from "fs";
+import { dirname as dirname2, extname as extname3, isAbsolute as isAbsolute2, join as join5 } from "path";
+import { existsSync as existsSync4 } from "fs";
 import { writeFile as writeFile3, stat as stat4 } from "fs/promises";
 import express from "express";
 
@@ -28,9 +28,9 @@ import { mkdtemp as mkdtemp2, readFile as readFile2, mkdir as mkdir2, stat as st
 import { createReadStream } from "fs";
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 import { tmpdir as tmpdir2 } from "os";
-import { basename, isAbsolute, join as join2, resolve } from "path";
+import { basename as basename2, isAbsolute, join as join3, resolve } from "path";
 import { createInterface } from "readline";
 import { writeFile as writeFile2 } from "fs/promises";
 
@@ -1120,6 +1120,84 @@ async function handleSkillsRoutes(req, res, url, context) {
   return false;
 }
 
+// src/utils/commandInvocation.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { basename, extname, join as join2 } from "path";
+var WINDOWS_CMD_NAMES = /* @__PURE__ */ new Set(["codex", "npm", "npx"]);
+function quoteCmdExeArg(value) {
+  const normalized = value.replace(/"/g, '""');
+  if (!/[\s"]/u.test(normalized)) {
+    return normalized;
+  }
+  return `"${normalized}"`;
+}
+function needsCmdExeWrapper(command) {
+  if (process.platform !== "win32") {
+    return false;
+  }
+  const lowerCommand = command.toLowerCase();
+  const baseName = basename(lowerCommand);
+  if (/\.(cmd|bat)$/i.test(baseName)) {
+    return true;
+  }
+  if (extname(baseName)) {
+    return false;
+  }
+  return WINDOWS_CMD_NAMES.has(baseName);
+}
+function getSpawnInvocation(command, args = []) {
+  if (needsCmdExeWrapper(command)) {
+    return {
+      command: "cmd.exe",
+      args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]
+    };
+  }
+  return { command, args };
+}
+function spawnSyncCommand(command, args = [], options = {}) {
+  const invocation = getSpawnInvocation(command, args);
+  return spawnSync(invocation.command, invocation.args, options);
+}
+function canRunCommand(command, args = []) {
+  const result = spawnSyncCommand(command, args, { stdio: "ignore" });
+  return result.status === 0;
+}
+function getUserNpmPrefix() {
+  return join2(homedir2(), ".npm-global");
+}
+function resolveCodexCommand() {
+  if (canRunCommand("codex", ["--version"])) {
+    return "codex";
+  }
+  if (process.platform === "win32") {
+    const windowsCandidates = [
+      process.env.APPDATA ? join2(process.env.APPDATA, "npm", "codex.cmd") : "",
+      join2(homedir2(), ".local", "bin", "codex.cmd"),
+      join2(getUserNpmPrefix(), "bin", "codex.cmd")
+    ].filter(Boolean);
+    for (const candidate2 of windowsCandidates) {
+      if (existsSync2(candidate2) && canRunCommand(candidate2, ["--version"])) {
+        return candidate2;
+      }
+    }
+  }
+  const userCandidate = join2(getUserNpmPrefix(), "bin", "codex");
+  if (existsSync2(userCandidate) && canRunCommand(userCandidate, ["--version"])) {
+    return userCandidate;
+  }
+  const prefix = process.env.PREFIX?.trim();
+  if (!prefix) {
+    return null;
+  }
+  const candidate = join2(prefix, "bin", "codex");
+  if (existsSync2(candidate) && canRunCommand(candidate, ["--version"])) {
+    return candidate;
+  }
+  return null;
+}
+
 // src/server/codexAppServerBridge.ts
 function asRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -1195,6 +1273,53 @@ function scoreFileCandidate(path, query) {
   if (lowerPath.includes(lowerQuery)) return 4;
   return 10;
 }
+function decodeHtmlEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&#x2F;/gi, "/");
+}
+function stripHtml(value) {
+  return decodeHtmlEntities(value.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim());
+}
+function parseGithubTrendingHtml(html, limit) {
+  const rows = html.match(/<article[\s\S]*?<\/article>/g) ?? [];
+  const items = [];
+  let seq = Date.now();
+  for (const row of rows) {
+    const hrefMatch = row.match(/href="\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)"/);
+    if (!hrefMatch) continue;
+    const fullName = hrefMatch[1] ?? "";
+    if (!fullName || items.some((item) => item.fullName === fullName)) continue;
+    const descriptionMatch = row.match(/<p[^>]*>([\s\S]*?)<\/p>/);
+    const languageMatch = row.match(/programmingLanguage[^>]*>\s*([\s\S]*?)\s*<\/span>/);
+    const starsMatch = row.match(/href="\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/stargazers"[\s\S]*?>([\s\S]*?)<\/a>/);
+    const starsText = stripHtml(starsMatch?.[1] ?? "").replace(/,/g, "");
+    const stars = Number.parseInt(starsText, 10);
+    items.push({
+      id: seq,
+      fullName,
+      url: `https://github.com/${fullName}`,
+      description: stripHtml(descriptionMatch?.[1] ?? ""),
+      language: stripHtml(languageMatch?.[1] ?? ""),
+      stars: Number.isFinite(stars) ? stars : 0
+    });
+    seq += 1;
+    if (items.length >= limit) break;
+  }
+  return items;
+}
+async function fetchGithubTrending(since, limit) {
+  const endpoint = `https://github.com/trending?since=${since}`;
+  const response = await fetch(endpoint, {
+    headers: {
+      "User-Agent": "codex-web-local",
+      Accept: "text/html"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`GitHub trending fetch failed (${response.status})`);
+  }
+  const html = await response.text();
+  return parseGithubTrendingHtml(html, limit);
+}
 async function listFilesWithRipgrep(cwd) {
   return await new Promise((resolve3, reject) => {
     const proc = spawn2("rg", ["--files", "--hidden", "-g", "!.git", "-g", "!node_modules"], {
@@ -1224,7 +1349,7 @@ async function listFilesWithRipgrep(cwd) {
 }
 function getCodexHomeDir2() {
   const codexHome = process.env.CODEX_HOME?.trim();
-  return codexHome && codexHome.length > 0 ? codexHome : join2(homedir2(), ".codex");
+  return codexHome && codexHome.length > 0 ? codexHome : join3(homedir3(), ".codex");
 }
 async function runCommand2(command, args, options = {}) {
   await new Promise((resolve3, reject) => {
@@ -1262,7 +1387,7 @@ function isNotGitRepositoryError(error) {
   return message.includes("not a git repository") || message.includes("fatal: not a git repository");
 }
 async function ensureRepoHasInitialCommit(repoRoot) {
-  const agentsPath = join2(repoRoot, "AGENTS.md");
+  const agentsPath = join3(repoRoot, "AGENTS.md");
   try {
     await stat2(agentsPath);
   } catch {
@@ -1302,6 +1427,33 @@ async function runCommandCapture(command, args, options = {}) {
     });
   });
 }
+async function runCommandWithOutput2(command, args, options = {}) {
+  return await new Promise((resolve3, reject) => {
+    const proc = spawn2(command, args, {
+      cwd: options.cwd,
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    proc.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      if (code === 0) {
+        resolve3(stdout.trim());
+        return;
+      }
+      const details = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
+      const suffix = details.length > 0 ? `: ${details}` : "";
+      reject(new Error(`Command failed (${command} ${args.join(" ")})${suffix}`));
+    });
+  });
+}
 function normalizeStringArray(value) {
   if (!Array.isArray(value)) return [];
   const normalized = [];
@@ -1322,8 +1474,32 @@ function normalizeStringRecord(value) {
   }
   return next;
 }
+function normalizeCommitMessage(value) {
+  if (typeof value !== "string") return "";
+  const normalized = value.replace(/\r\n?/gu, "\n").split("\n").map((line) => line.trim()).filter((line) => line.length > 0).join("\n").trim();
+  return normalized.slice(0, 2e3);
+}
+async function hasGitWorkingTreeChanges(cwd) {
+  const status = await runCommandWithOutput2("git", ["status", "--porcelain"], { cwd });
+  return status.trim().length > 0;
+}
+async function findCommitByExactMessage(cwd, message) {
+  const normalizedTarget = normalizeCommitMessage(message);
+  if (!normalizedTarget) return "";
+  const raw = await runCommandWithOutput2("git", ["log", "--format=%H%x1f%B%x1e"], { cwd });
+  const entries = raw.split("");
+  for (const entry of entries) {
+    if (!entry.trim()) continue;
+    const [shaRaw, bodyRaw] = entry.split("");
+    const sha = (shaRaw ?? "").trim();
+    const body = normalizeCommitMessage(bodyRaw ?? "");
+    if (!sha) continue;
+    if (body === normalizedTarget) return sha;
+  }
+  return "";
+}
 function getCodexAuthPath() {
-  return join2(getCodexHomeDir2(), "auth.json");
+  return join3(getCodexHomeDir2(), "auth.json");
 }
 async function readCodexAuth() {
   try {
@@ -1337,10 +1513,10 @@ async function readCodexAuth() {
   }
 }
 function getCodexGlobalStatePath() {
-  return join2(getCodexHomeDir2(), ".codex-global-state.json");
+  return join3(getCodexHomeDir2(), ".codex-global-state.json");
 }
 function getCodexSessionIndexPath() {
-  return join2(getCodexHomeDir2(), "session_index.jsonl");
+  return join3(getCodexHomeDir2(), "session_index.jsonl");
 }
 var MAX_THREAD_TITLES = 500;
 var EMPTY_THREAD_TITLE_CACHE = { titles: {}, order: [] };
@@ -1599,10 +1775,10 @@ function handleFileUpload(req, res) {
         setJson2(res, 400, { error: "No file in request" });
         return;
       }
-      const uploadDir = join2(tmpdir2(), "codex-web-uploads");
+      const uploadDir = join3(tmpdir2(), "codex-web-uploads");
       await mkdir2(uploadDir, { recursive: true });
-      const destDir = await mkdtemp2(join2(uploadDir, "f-"));
-      const destPath = join2(destDir, fileName);
+      const destDir = await mkdtemp2(join3(uploadDir, "f-"));
+      const destPath = join3(destDir, fileName);
       await writeFile2(destPath, fileData);
       setJson2(res, 200, { path: destPath });
     } catch (err) {
@@ -1709,7 +1885,8 @@ var AppServerProcess = class {
   start() {
     if (this.process) return;
     this.stopping = false;
-    const proc = spawn2("codex", this.appServerArgs, { stdio: ["pipe", "pipe", "pipe"] });
+    const invocation = getSpawnInvocation(resolveCodexCommand() ?? "codex", this.appServerArgs);
+    const proc = spawn2(invocation.command, invocation.args, { stdio: ["pipe", "pipe", "pipe"] });
     this.process = proc;
     proc.stdout.setEncoding("utf8");
     proc.stdout.on("data", (chunk) => {
@@ -1935,7 +2112,8 @@ var MethodCatalog = class {
   }
   async runGenerateSchemaCommand(outDir) {
     await new Promise((resolve3, reject) => {
-      const process2 = spawn2("codex", ["app-server", "generate-json-schema", "--out", outDir], {
+      const invocation = getSpawnInvocation(resolveCodexCommand() ?? "codex", ["app-server", "generate-json-schema", "--out", outDir]);
+      const process2 = spawn2(invocation.command, invocation.args, {
         stdio: ["ignore", "ignore", "pipe"]
       });
       let stderr = "";
@@ -1991,9 +2169,9 @@ var MethodCatalog = class {
     if (this.methodCache) {
       return this.methodCache;
     }
-    const outDir = await mkdtemp2(join2(tmpdir2(), "codex-web-local-schema-"));
+    const outDir = await mkdtemp2(join3(tmpdir2(), "codex-web-local-schema-"));
     await this.runGenerateSchemaCommand(outDir);
-    const clientRequestPath = join2(outDir, "ClientRequest.json");
+    const clientRequestPath = join3(outDir, "ClientRequest.json");
     const raw = await readFile2(clientRequestPath, "utf8");
     const parsed = JSON.parse(raw);
     const methods = this.extractMethodsFromClientRequest(parsed);
@@ -2004,9 +2182,9 @@ var MethodCatalog = class {
     if (this.notificationCache) {
       return this.notificationCache;
     }
-    const outDir = await mkdtemp2(join2(tmpdir2(), "codex-web-local-schema-"));
+    const outDir = await mkdtemp2(join3(tmpdir2(), "codex-web-local-schema-"));
     await this.runGenerateSchemaCommand(outDir);
-    const serverNotificationPath = join2(outDir, "ServerNotification.json");
+    const serverNotificationPath = join3(outDir, "ServerNotification.json");
     const raw = await readFile2(serverNotificationPath, "utf8");
     const parsed = JSON.parse(raw);
     const methods = this.extractMethodsFromServerNotification(parsed);
@@ -2168,7 +2346,20 @@ function createCodexBridgeMiddleware() {
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/home-directory") {
-        setJson2(res, 200, { data: { path: homedir2() } });
+        setJson2(res, 200, { data: { path: homedir3() } });
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/codex-api/github-trending") {
+        const sinceRaw = (url.searchParams.get("since") ?? "").trim().toLowerCase();
+        const since = sinceRaw === "weekly" ? "weekly" : sinceRaw === "monthly" ? "monthly" : "daily";
+        const limitRaw = Number.parseInt((url.searchParams.get("limit") ?? "6").trim(), 10);
+        const limit = Number.isFinite(limitRaw) ? Math.max(1, Math.min(10, limitRaw)) : 6;
+        try {
+          const data = await fetchGithubTrending(since, limit);
+          setJson2(res, 200, { data });
+        } catch (error) {
+          setJson2(res, 502, { error: getErrorMessage2(error, "Failed to fetch GitHub trending") });
+        }
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/worktree/create") {
@@ -2198,22 +2389,22 @@ function createCodexBridgeMiddleware() {
             await runCommand2("git", ["init"], { cwd: sourceCwd });
             gitRoot = await runCommandCapture("git", ["rev-parse", "--show-toplevel"], { cwd: sourceCwd });
           }
-          const repoName = basename(gitRoot) || "repo";
-          const worktreesRoot = join2(getCodexHomeDir2(), "worktrees");
+          const repoName = basename2(gitRoot) || "repo";
+          const worktreesRoot = join3(getCodexHomeDir2(), "worktrees");
           await mkdir2(worktreesRoot, { recursive: true });
           let worktreeId = "";
           let worktreeParent = "";
           let worktreeCwd = "";
           for (let attempt = 0; attempt < 12; attempt += 1) {
             const candidate = randomBytes(2).toString("hex");
-            const parent = join2(worktreesRoot, candidate);
+            const parent = join3(worktreesRoot, candidate);
             try {
               await stat2(parent);
               continue;
             } catch {
               worktreeId = candidate;
               worktreeParent = parent;
-              worktreeCwd = join2(parent, repoName);
+              worktreeCwd = join3(parent, repoName);
               break;
             }
           }
@@ -2241,6 +2432,99 @@ function createCodexBridgeMiddleware() {
         }
         return;
       }
+      if (req.method === "POST" && url.pathname === "/codex-api/worktree/auto-commit") {
+        const payload = asRecord2(await readJsonBody(req));
+        const rawCwd = typeof payload?.cwd === "string" ? payload.cwd.trim() : "";
+        const commitMessage = normalizeCommitMessage(payload?.message);
+        if (!rawCwd) {
+          setJson2(res, 400, { error: "Missing cwd" });
+          return;
+        }
+        if (!commitMessage) {
+          setJson2(res, 400, { error: "Missing message" });
+          return;
+        }
+        const cwd = isAbsolute(rawCwd) ? rawCwd : resolve(rawCwd);
+        try {
+          const cwdInfo = await stat2(cwd);
+          if (!cwdInfo.isDirectory()) {
+            setJson2(res, 400, { error: "cwd is not a directory" });
+            return;
+          }
+        } catch {
+          setJson2(res, 404, { error: "cwd does not exist" });
+          return;
+        }
+        try {
+          await runCommandCapture("git", ["rev-parse", "--is-inside-work-tree"], { cwd });
+          const beforeStatus = await runCommandWithOutput2("git", ["status", "--porcelain"], { cwd });
+          if (!beforeStatus.trim()) {
+            setJson2(res, 200, { data: { committed: false } });
+            return;
+          }
+          await runCommand2("git", ["add", "-A"], { cwd });
+          const stagedStatus = await runCommandWithOutput2("git", ["diff", "--cached", "--name-only"], { cwd });
+          if (!stagedStatus.trim()) {
+            setJson2(res, 200, { data: { committed: false } });
+            return;
+          }
+          await runCommand2("git", ["commit", "-m", commitMessage], { cwd });
+          setJson2(res, 200, { data: { committed: true } });
+        } catch (error) {
+          setJson2(res, 500, { error: getErrorMessage2(error, "Failed to auto-commit worktree changes") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/worktree/rollback-to-message") {
+        const payload = asRecord2(await readJsonBody(req));
+        const rawCwd = typeof payload?.cwd === "string" ? payload.cwd.trim() : "";
+        const commitMessage = normalizeCommitMessage(payload?.message);
+        if (!rawCwd) {
+          setJson2(res, 400, { error: "Missing cwd" });
+          return;
+        }
+        if (!commitMessage) {
+          setJson2(res, 400, { error: "Missing message" });
+          return;
+        }
+        const cwd = isAbsolute(rawCwd) ? rawCwd : resolve(rawCwd);
+        try {
+          const cwdInfo = await stat2(cwd);
+          if (!cwdInfo.isDirectory()) {
+            setJson2(res, 400, { error: "cwd is not a directory" });
+            return;
+          }
+        } catch {
+          setJson2(res, 404, { error: "cwd does not exist" });
+          return;
+        }
+        try {
+          await runCommandCapture("git", ["rev-parse", "--is-inside-work-tree"], { cwd });
+          const commitSha = await findCommitByExactMessage(cwd, commitMessage);
+          if (!commitSha) {
+            setJson2(res, 404, { error: "No matching commit found for this user message" });
+            return;
+          }
+          let resetTargetSha = "";
+          try {
+            resetTargetSha = await runCommandCapture("git", ["rev-parse", `${commitSha}^`], { cwd });
+          } catch {
+            setJson2(res, 409, { error: "Cannot rollback: matched commit has no parent commit" });
+            return;
+          }
+          let stashed = false;
+          if (await hasGitWorkingTreeChanges(cwd)) {
+            const stashMessage = `codex-auto-stash-before-rollback-${Date.now()}`;
+            await runCommand2("git", ["stash", "push", "-u", "-m", stashMessage], { cwd });
+            stashed = true;
+          }
+          await runCommand2("git", ["reset", "--hard", resetTargetSha], { cwd });
+          setJson2(res, 200, { data: { reset: true, commitSha, resetTargetSha, stashed } });
+        } catch (error) {
+          setJson2(res, 500, { error: getErrorMessage2(error, "Failed to rollback worktree to user message commit") });
+        }
+        return;
+      }
       if (req.method === "PUT" && url.pathname === "/codex-api/workspace-roots-state") {
         const payload = await readJsonBody(req);
         const record = asRecord2(payload);
@@ -2318,7 +2602,7 @@ function createCodexBridgeMiddleware() {
         let index = 1;
         while (index < 1e5) {
           const candidateName = `New Project (${String(index)})`;
-          const candidatePath = join2(normalizedBasePath, candidateName);
+          const candidatePath = join3(normalizedBasePath, candidateName);
           try {
             await stat2(candidatePath);
             index += 1;
@@ -2564,7 +2848,7 @@ function createAuthSession(password) {
 }
 
 // src/server/localBrowseUi.ts
-import { dirname, extname, join as join3 } from "path";
+import { dirname, extname as extname2, join as join4 } from "path";
 import { open, readFile as readFile3, readdir as readdir3, stat as stat3 } from "fs/promises";
 var TEXT_EDITABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
@@ -2595,7 +2879,7 @@ var TEXT_EDITABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".ps1"
 ]);
 function languageForPath(pathValue) {
-  const extension = extname(pathValue).toLowerCase();
+  const extension = extname2(pathValue).toLowerCase();
   switch (extension) {
     case ".js":
       return "javascript";
@@ -2656,7 +2940,7 @@ function decodeBrowsePath(rawPath) {
   }
 }
 function isTextEditablePath(pathValue) {
-  return TEXT_EDITABLE_EXTENSIONS.has(extname(pathValue).toLowerCase());
+  return TEXT_EDITABLE_EXTENSIONS.has(extname2(pathValue).toLowerCase());
 }
 function looksLikeTextBuffer(buffer) {
   if (buffer.length === 0) return true;
@@ -2702,7 +2986,7 @@ function escapeForInlineScriptString(value) {
 async function getDirectoryItems(localPath) {
   const entries = await readdir3(localPath, { withFileTypes: true });
   const withMeta = await Promise.all(entries.map(async (entry) => {
-    const entryPath = join3(localPath, entry.name);
+    const entryPath = join4(localPath, entry.name);
     const entryStat = await stat3(entryPath);
     const editable = !entry.isDirectory() && await isTextEditableFile(entryPath);
     return {
@@ -2889,8 +3173,8 @@ async function createTextEditorHtml(localPath) {
 // src/server/httpServer.ts
 import { WebSocketServer } from "ws";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var distDir = join4(__dirname, "..", "dist");
-var spaEntryFile = join4(distDir, "index.html");
+var distDir = join5(__dirname, "..", "dist");
+var spaEntryFile = join5(distDir, "index.html");
 var IMAGE_CONTENT_TYPES = {
   ".avif": "image/avif",
   ".bmp": "image/bmp",
@@ -2947,7 +3231,7 @@ function createServer(options = {}) {
       res.status(400).json({ error: "Expected absolute local file path." });
       return;
     }
-    const contentType = IMAGE_CONTENT_TYPES[extname2(localPath).toLowerCase()];
+    const contentType = IMAGE_CONTENT_TYPES[extname3(localPath).toLowerCase()];
     if (!contentType) {
       res.status(415).json({ error: "Unsupported image type." });
       return;
@@ -3034,7 +3318,7 @@ function createServer(options = {}) {
       res.status(404).json({ error: "File not found." });
     }
   });
-  const hasFrontendAssets = existsSync3(spaEntryFile);
+  const hasFrontendAssets = existsSync4(spaEntryFile);
   if (hasFrontendAssets) {
     app.use(express.static(distDir));
   }
@@ -3105,9 +3389,25 @@ function generatePassword() {
 // src/cli/index.ts
 var program = new Command().name("codexui").description("Web interface for Codex app-server");
 var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
+var hasPromptedCloudflaredInstall = false;
+function getCodexHomePath() {
+  return process.env.CODEX_HOME?.trim() || join6(homedir4(), ".codex");
+}
+function getCloudflaredPromptMarkerPath() {
+  return join6(getCodexHomePath(), ".cloudflared-install-prompted");
+}
+function hasPromptedCloudflaredInstallPersisted() {
+  return existsSync5(getCloudflaredPromptMarkerPath());
+}
+async function persistCloudflaredInstallPrompted() {
+  const codexHome = getCodexHomePath();
+  mkdirSync(codexHome, { recursive: true });
+  await writeFile4(getCloudflaredPromptMarkerPath(), `${Date.now()}
+`, "utf8");
+}
 async function readCliVersion() {
   try {
-    const packageJsonPath = join5(__dirname2, "..", "package.json");
+    const packageJsonPath = join6(__dirname2, "..", "package.json");
     const raw = await readFile4(packageJsonPath, "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.version === "string" ? parsed.version : "unknown";
@@ -3119,46 +3419,25 @@ function isTermuxRuntime() {
   return Boolean(process.env.TERMUX_VERSION || process.env.PREFIX?.includes("/com.termux/"));
 }
 function canRun(command, args = []) {
-  const result = spawnSync(command, args, { stdio: "ignore" });
-  return result.status === 0;
+  const result = canRunCommand(command, args);
+  return result;
 }
 function runOrFail(command, args, label) {
-  const result = spawnSync(command, args, { stdio: "inherit" });
+  const result = spawnSyncCommand(command, args, { stdio: "inherit" });
   if (result.status !== 0) {
     throw new Error(`${label} failed with exit code ${String(result.status ?? -1)}`);
   }
 }
 function runWithStatus(command, args) {
-  const result = spawnSync(command, args, { stdio: "inherit" });
+  const result = spawnSyncCommand(command, args, { stdio: "inherit" });
   return result.status ?? -1;
 }
-function getUserNpmPrefix() {
-  return join5(homedir3(), ".npm-global");
-}
-function resolveCodexCommand() {
-  if (canRun("codex", ["--version"])) {
-    return "codex";
-  }
-  const userCandidate = join5(getUserNpmPrefix(), "bin", "codex");
-  if (existsSync4(userCandidate) && canRun(userCandidate, ["--version"])) {
-    return userCandidate;
-  }
-  const prefix = process.env.PREFIX?.trim();
-  if (!prefix) {
-    return null;
-  }
-  const candidate = join5(prefix, "bin", "codex");
-  if (existsSync4(candidate) && canRun(candidate, ["--version"])) {
-    return candidate;
-  }
-  return null;
-}
 function resolveCloudflaredCommand() {
   if (canRun("cloudflared", ["--version"])) {
     return "cloudflared";
   }
-  const localCandidate = join5(homedir3(), ".local", "bin", "cloudflared");
-  if (existsSync4(localCandidate) && canRun(localCandidate, ["--version"])) {
+  const localCandidate = join6(homedir4(), ".local", "bin", "cloudflared");
+  if (existsSync5(localCandidate) && canRun(localCandidate, ["--version"])) {
     return localCandidate;
   }
   return null;
@@ -3211,9 +3490,9 @@ async function ensureCloudflaredInstalledLinux() {
   if (!mappedArch) {
     throw new Error(`cloudflared auto-install is not supported for Linux architecture: ${process.arch}`);
   }
-  const userBinDir = join5(homedir3(), ".local", "bin");
+  const userBinDir = join6(homedir4(), ".local", "bin");
   mkdirSync(userBinDir, { recursive: true });
-  const destination = join5(userBinDir, "cloudflared");
+  const destination = join6(userBinDir, "cloudflared");
   const downloadUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${mappedArch}`;
   console.log("\ncloudflared not found. Installing to ~/.local/bin...\n");
   await downloadFile(downloadUrl, destination);
@@ -3227,6 +3506,14 @@ async function ensureCloudflaredInstalledLinux() {
   return installed;
 }
 async function shouldInstallCloudflaredInteractively() {
+  if (hasPromptedCloudflaredInstall || hasPromptedCloudflaredInstallPersisted()) {
+    return false;
+  }
+  hasPromptedCloudflaredInstall = true;
+  await persistCloudflaredInstallPrompted();
+  if (process.platform === "win32") {
+    return false;
+  }
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     console.warn("\n[cloudflared] cloudflared is missing and terminal is non-interactive, skipping install.");
     return false;
@@ -3245,6 +3532,9 @@ async function resolveCloudflaredForTunnel() {
   if (current) {
     return current;
   }
+  if (process.platform === "win32") {
+    return null;
+  }
   const installApproved = await shouldInstallCloudflaredInteractively();
   if (!installApproved) {
     return null;
@@ -3252,8 +3542,8 @@ async function resolveCloudflaredForTunnel() {
   return ensureCloudflaredInstalledLinux();
 }
 function hasCodexAuth() {
-  const codexHome = process.env.CODEX_HOME?.trim() || join5(homedir3(), ".codex");
-  return existsSync4(join5(codexHome, "auth.json"));
+  const codexHome = getCodexHomePath();
+  return existsSync5(join6(codexHome, "auth.json"));
 }
 function ensureCodexInstalled() {
   let codexCommand = resolveCodexCommand();
@@ -3271,7 +3561,7 @@ function ensureCodexInstalled() {
 Global npm install requires elevated permissions. Retrying with --prefix ${userPrefix}...
 `);
       runOrFail("npm", ["install", "-g", "--prefix", userPrefix, pkg], `${label} (user prefix)`);
-      process.env.PATH = `${join5(userPrefix, "bin")}:${process.env.PATH ?? ""}`;
+      process.env.PATH = `${join6(userPrefix, "bin")}:${process.env.PATH ?? ""}`;
     };
     if (isTermuxRuntime()) {
       console.log("\nCodex CLI not found. Installing Termux-compatible Codex CLI from npm...\n");
@@ -3412,8 +3702,8 @@ function listenWithFallback(server, startPort) {
   });
 }
 function getCodexGlobalStatePath2() {
-  const codexHome = process.env.CODEX_HOME?.trim() || join5(homedir3(), ".codex");
-  return join5(codexHome, ".codex-global-state.json");
+  const codexHome = getCodexHomePath();
+  return join6(codexHome, ".codex-global-state.json");
 }
 function normalizeUniqueStrings(value) {
   if (!Array.isArray(value)) return [];