codexapp 0.1.53 → 0.1.56

package/dist-cli/index.js

@@ -2,22 +2,164 @@
 
 // src/cli/index.ts
 import { createServer as createServer2 } from "http";
-import { chmodSync, createWriteStream, existsSync as existsSync3, mkdirSync } from "fs";
+import { chmodSync, createWriteStream, existsSync as existsSync5, mkdirSync } from "fs";
 import { readFile as readFile4, stat as stat5, writeFile as writeFile4 } from "fs/promises";
-import { homedir as homedir3, networkInterfaces } from "os";
-import { isAbsolute as isAbsolute3, join as join5, resolve as resolve2 } from "path";
-import { spawn as spawn3, spawnSync } from "child_process";
-import { createInterface } from "readline/promises";
+import { homedir as homedir4, networkInterfaces } from "os";
+import { isAbsolute as isAbsolute3, join as join6, resolve as resolve2 } from "path";
+import { spawn as spawn3 } from "child_process";
+import { createInterface as createInterface2 } from "readline/promises";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 import { get as httpsGet } from "https";
 import { Command } from "commander";
 import qrcode from "qrcode-terminal";
 
+// src/commandResolution.ts
+import { spawnSync } from "child_process";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { delimiter, join } from "path";
+function uniqueStrings(values) {
+  const unique = [];
+  for (const value of values) {
+    const normalized = value?.trim();
+    if (!normalized || unique.includes(normalized)) continue;
+    unique.push(normalized);
+  }
+  return unique;
+}
+function isPathLike(command) {
+  return command.includes("/") || command.includes("\\") || /^[a-zA-Z]:/.test(command);
+}
+function isRunnableCommand(command, args = []) {
+  if (isPathLike(command) && !existsSync(command)) {
+    return false;
+  }
+  return canRunCommand(command, args);
+}
+function getWindowsAppDataNpmPrefix() {
+  const appData = process.env.APPDATA?.trim();
+  return appData ? join(appData, "npm") : null;
+}
+function getPotentialNpmPrefixes() {
+  return uniqueStrings([
+    process.env.npm_config_prefix,
+    process.env.PREFIX,
+    getUserNpmPrefix(),
+    process.platform === "win32" ? getWindowsAppDataNpmPrefix() : null
+  ]);
+}
+function getPotentialCodexPackageDirs(prefix) {
+  const dirs = [join(prefix, "node_modules", "@openai", "codex")];
+  if (process.platform !== "win32") {
+    dirs.push(join(prefix, "lib", "node_modules", "@openai", "codex"));
+  }
+  return dirs;
+}
+function getPotentialCodexExecutables(prefix) {
+  return getPotentialCodexPackageDirs(prefix).map((packageDir) => process.platform === "win32" ? join(
+    packageDir,
+    "node_modules",
+    "@openai",
+    "codex-win32-x64",
+    "vendor",
+    "x86_64-pc-windows-msvc",
+    "codex",
+    "codex.exe"
+  ) : join(packageDir, "bin", "codex"));
+}
+function getPotentialRipgrepExecutables(prefix) {
+  return getPotentialCodexPackageDirs(prefix).map((packageDir) => process.platform === "win32" ? join(
+    packageDir,
+    "node_modules",
+    "@openai",
+    "codex-win32-x64",
+    "vendor",
+    "x86_64-pc-windows-msvc",
+    "path",
+    "rg.exe"
+  ) : join(packageDir, "bin", "rg"));
+}
+function canRunCommand(command, args = []) {
+  const result = spawnSync(command, args, {
+    stdio: "ignore",
+    windowsHide: true
+  });
+  return !result.error && result.status === 0;
+}
+function getUserNpmPrefix() {
+  return join(homedir(), ".npm-global");
+}
+function getNpmGlobalBinDir(prefix) {
+  return process.platform === "win32" ? prefix : join(prefix, "bin");
+}
+function prependPathEntry(existingPath, entry) {
+  const normalizedEntry = entry.trim();
+  if (!normalizedEntry) return existingPath;
+  const parts = existingPath.split(delimiter).map((value) => value.trim()).filter(Boolean);
+  if (parts.includes(normalizedEntry)) {
+    return existingPath;
+  }
+  return existingPath ? `${normalizedEntry}${delimiter}${existingPath}` : normalizedEntry;
+}
+function resolveCodexCommand() {
+  const explicit = process.env.CODEXUI_CODEX_COMMAND?.trim();
+  const packageCandidates = getPotentialNpmPrefixes().flatMap(getPotentialCodexExecutables);
+  const fallbackCandidates = process.platform === "win32" ? [...packageCandidates, "codex"] : ["codex", ...packageCandidates];
+  for (const candidate of uniqueStrings([explicit, ...fallbackCandidates])) {
+    if (isRunnableCommand(candidate, ["--version"])) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveRipgrepCommand() {
+  const explicit = process.env.CODEXUI_RG_COMMAND?.trim();
+  const packageCandidates = getPotentialNpmPrefixes().flatMap(getPotentialRipgrepExecutables);
+  const fallbackCandidates = process.platform === "win32" ? [...packageCandidates, "rg"] : ["rg", ...packageCandidates];
+  for (const candidate of uniqueStrings([explicit, ...fallbackCandidates])) {
+    if (isRunnableCommand(candidate, ["--version"])) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolvePythonCommand() {
+  const candidates = process.platform === "win32" ? [
+    { command: "python", args: [] },
+    { command: "py", args: ["-3"] },
+    { command: "python3", args: [] }
+  ] : [
+    { command: "python3", args: [] },
+    { command: "python", args: [] }
+  ];
+  for (const candidate of candidates) {
+    if (isRunnableCommand(candidate.command, [...candidate.args, "--version"])) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveSkillInstallerScriptPath(codexHome) {
+  const normalizedCodexHome = codexHome?.trim();
+  const candidates = uniqueStrings([
+    normalizedCodexHome ? join(normalizedCodexHome, "skills", ".system", "skill-installer", "scripts", "install-skill-from-github.py") : null,
+    process.env.CODEX_HOME?.trim() ? join(process.env.CODEX_HOME.trim(), "skills", ".system", "skill-installer", "scripts", "install-skill-from-github.py") : null,
+    join(homedir(), ".codex", "skills", ".system", "skill-installer", "scripts", "install-skill-from-github.py"),
+    join(homedir(), ".cursor", "skills", ".system", "skill-installer", "scripts", "install-skill-from-github.py")
+  ]);
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+
 // src/server/httpServer.ts
 import { fileURLToPath } from "url";
-import { dirname as dirname2, extname as extname2, isAbsolute as isAbsolute2, join as join4 } from "path";
-import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname3, extname as extname3, isAbsolute as isAbsolute2, join as join5 } from "path";
+import { existsSync as existsSync4 } from "fs";
 import { writeFile as writeFile3, stat as stat4 } from "fs/promises";
 import express from "express";
 
@@ -25,18 +167,21 @@ import express from "express";
 import { spawn as spawn2 } from "child_process";
 import { randomBytes } from "crypto";
 import { mkdtemp as mkdtemp2, readFile as readFile2, mkdir as mkdir2, stat as stat2 } from "fs/promises";
+import { createReadStream } from "fs";
+import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 import { tmpdir as tmpdir2 } from "os";
-import { basename, isAbsolute, join as join2, resolve } from "path";
+import { basename as basename3, dirname, isAbsolute, join as join3, resolve } from "path";
+import { createInterface } from "readline";
 import { writeFile as writeFile2 } from "fs/promises";
 
 // src/server/skillsRoutes.ts
 import { spawn } from "child_process";
 import { mkdtemp, readFile, readdir, rm, mkdir, stat, lstat, readlink, symlink } from "fs/promises";
-import { existsSync } from "fs";
-import { homedir, tmpdir } from "os";
-import { join } from "path";
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir2, tmpdir } from "os";
+import { join as join2 } from "path";
 import { writeFile } from "fs/promises";
 function asRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -62,28 +207,45 @@ function setJson(res, statusCode, payload) {
 }
 function getCodexHomeDir() {
   const codexHome = process.env.CODEX_HOME?.trim();
-  return codexHome && codexHome.length > 0 ? codexHome : join(homedir(), ".codex");
+  return codexHome && codexHome.length > 0 ? codexHome : join2(homedir2(), ".codex");
 }
 function getSkillsInstallDir() {
-  return join(getCodexHomeDir(), "skills");
+  return join2(getCodexHomeDir(), "skills");
 }
+var DEFAULT_COMMAND_TIMEOUT_MS = 12e4;
 async function runCommand(command, args, options = {}) {
+  const timeout = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
   await new Promise((resolve3, reject) => {
     const proc = spawn(command, args, {
       cwd: options.cwd,
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
     });
+    let settled = false;
     let stdout = "";
     let stderr = "";
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      proc.kill("SIGKILL");
+      reject(new Error(`Command timed out after ${timeout}ms (${command} ${args.join(" ")})`));
+    }, timeout);
     proc.stdout.on("data", (chunk) => {
       stdout += chunk.toString();
     });
     proc.stderr.on("data", (chunk) => {
       stderr += chunk.toString();
     });
-    proc.on("error", reject);
+    proc.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(err);
+    });
     proc.on("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
       if (code === 0) {
         resolve3();
         return;
@@ -95,22 +257,38 @@ async function runCommand(command, args, options = {}) {
   });
 }
 async function runCommandWithOutput(command, args, options = {}) {
+  const timeout = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
   return await new Promise((resolve3, reject) => {
     const proc = spawn(command, args, {
       cwd: options.cwd,
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
     });
+    let settled = false;
     let stdout = "";
     let stderr = "";
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      proc.kill("SIGKILL");
+      reject(new Error(`Command timed out after ${timeout}ms (${command} ${args.join(" ")})`));
+    }, timeout);
     proc.stdout.on("data", (chunk) => {
       stdout += chunk.toString();
     });
     proc.stderr.on("data", (chunk) => {
       stderr += chunk.toString();
     });
-    proc.on("error", reject);
+    proc.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(err);
+    });
     proc.on("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
       if (code === 0) {
         resolve3(stdout.trim());
         return;
@@ -121,6 +299,21 @@ async function runCommandWithOutput(command, args, options = {}) {
     });
   });
 }
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve3, reject) => {
+    const timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+    promise.then(
+      (val) => {
+        clearTimeout(timer);
+        resolve3(val);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
 async function detectUserSkillsDir(appServer) {
   try {
     const result = await appServer.rpc("skills/list", {});
@@ -236,13 +429,14 @@ var DEFAULT_SKILLS_SYNC_REPO_NAME = "codexskills";
 var SKILLS_SYNC_MANIFEST_PATH = "installed-skills.json";
 var SYNC_UPSTREAM_SKILLS_OWNER = "OpenClawAndroid";
 var SYNC_UPSTREAM_SKILLS_REPO = "skills";
+var PRIVATE_SYNC_BRANCH = "main";
 var HUB_SKILLS_OWNER = "openclaw";
 var HUB_SKILLS_REPO = "skills";
 var startupSkillsSyncInitialized = false;
 var startupSyncStatus = {
   inProgress: false,
   mode: "idle",
-  branch: getPreferredSyncBranch(),
+  branch: PRIVATE_SYNC_BRANCH,
   lastAction: "not-started",
   lastRunAtIso: "",
   lastSuccessAtIso: "",
@@ -255,7 +449,7 @@ async function scanInstalledSkillsFromDisk() {
     const entries = await readdir(skillsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
-      const skillMd = join(skillsDir, entry.name, "SKILL.md");
+      const skillMd = join2(skillsDir, entry.name, "SKILL.md");
       try {
         await stat(skillMd);
         map.set(entry.name, { name: entry.name, path: skillMd, enabled: true });
@@ -266,8 +460,25 @@ async function scanInstalledSkillsFromDisk() {
   }
   return map;
 }
+function extractSkillDescriptionFromMarkdown(markdown) {
+  const lines = markdown.split(/\r?\n/);
+  let inCodeFence = false;
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (line.startsWith("```")) {
+      inCodeFence = !inCodeFence;
+      continue;
+    }
+    if (inCodeFence || line.length === 0) continue;
+    if (line.startsWith("#")) continue;
+    if (line.startsWith(">")) continue;
+    if (line.startsWith("- ") || line.startsWith("* ")) continue;
+    return line;
+  }
+  return "";
+}
 function getSkillsSyncStatePath() {
-  return join(getCodexHomeDir(), "skills-sync.json");
+  return join2(getCodexHomeDir(), "skills-sync.json");
 }
 async function readSkillsSyncState() {
   try {
@@ -340,14 +551,14 @@ async function completeGithubDeviceLogin(deviceCode) {
 }
 function isAndroidLikeRuntime() {
   if (process.platform === "android") return true;
-  if (existsSync("/data/data/com.termux")) return true;
+  if (existsSync2("/data/data/com.termux")) return true;
   if (process.env.TERMUX_VERSION) return true;
   const prefix = process.env.PREFIX?.toLowerCase() ?? "";
   if (prefix.includes("/com.termux/")) return true;
   const proot = process.env.PROOT_TMP_DIR?.toLowerCase() ?? "";
   return proot.length > 0;
 }
-function getPreferredSyncBranch() {
+function getPreferredPublicUpstreamBranch() {
   return isAndroidLikeRuntime() ? "android" : "main";
 }
 function isUpstreamSkillsRepo(repoOwner, repoName) {
@@ -402,10 +613,10 @@ async function ensurePrivateForkFromUpstream(token, username, repoName) {
   }
   if (!ready) throw new Error("Private mirror repo was created but is not available yet");
   if (!created) return;
-  const tmp = await mkdtemp(join(tmpdir(), "codex-skills-seed-"));
+  const tmp = await mkdtemp(join2(tmpdir(), "codex-skills-seed-"));
   try {
     const upstreamUrl = `https://github.com/${SYNC_UPSTREAM_SKILLS_OWNER}/${SYNC_UPSTREAM_SKILLS_REPO}.git`;
-    const branch = getPreferredSyncBranch();
+    const branch = PRIVATE_SYNC_BRANCH;
     try {
       await runCommand("git", ["clone", "--depth", "1", "--single-branch", "--branch", branch, upstreamUrl, tmp]);
     } catch {
@@ -476,7 +687,7 @@ function toGitHubTokenRemote(repoOwner, repoName, token) {
 async function ensureSkillsWorkingTreeRepo(repoUrl, branch) {
   const localDir = getSkillsInstallDir();
   await mkdir(localDir, { recursive: true });
-  const gitDir = join(localDir, ".git");
+  const gitDir = join2(localDir, ".git");
   let hasGitDir = false;
   try {
     hasGitDir = (await stat(gitDir)).isDirectory();
@@ -522,7 +733,7 @@ async function ensureSkillsWorkingTreeRepo(repoUrl, branch) {
   }
   let pulledMtimes = /* @__PURE__ */ new Map();
   try {
-    await runCommand("git", ["pull", "--no-rebase", "origin", branch], { cwd: localDir });
+    await runCommand("git", ["pull", "--no-rebase", "--no-ff", "origin", branch], { cwd: localDir });
     pulledMtimes = await snapshotFileMtimes(localDir);
   } catch {
     await resolveMergeConflictsByNewerCommit(localDir, branch);
@@ -591,7 +802,7 @@ async function walkFileMtimes(rootDir, currentDir, out) {
   for (const entry of entries) {
     const entryName = String(entry.name);
     if (entryName === ".git") continue;
-    const absolutePath = join(currentDir, entryName);
+    const absolutePath = join2(currentDir, entryName);
     const relativePath = absolutePath.slice(rootDir.length + 1);
     if (entry.isDirectory()) {
       await walkFileMtimes(rootDir, absolutePath, out);
@@ -606,8 +817,37 @@ async function walkFileMtimes(rootDir, currentDir, out) {
   }
 }
 async function syncInstalledSkillsFolderToRepo(token, repoOwner, repoName, _installedMap) {
+  function isNonFastForwardPushError(error) {
+    const text = getErrorMessage(error, "").toLowerCase();
+    return text.includes("non-fast-forward") || text.includes("fetch first") || text.includes("rejected") && text.includes("push");
+  }
+  async function pushWithNonFastForwardRetry(repoDir2, branch2) {
+    const maxAttempts = 3;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      try {
+        await runCommand("git", ["push", "origin", `HEAD:${branch2}`], { cwd: repoDir2 });
+        return;
+      } catch (error) {
+        if (!isNonFastForwardPushError(error) || attempt >= maxAttempts) {
+          throw error;
+        }
+      }
+      await runCommand("git", ["fetch", "origin"], { cwd: repoDir2 });
+      try {
+        await runCommand("git", ["pull", "--no-rebase", "--no-ff", "origin", branch2], { cwd: repoDir2 });
+      } catch {
+        await resolveMergeConflictsByNewerCommit(repoDir2, branch2);
+      }
+      await runCommand("git", ["add", "."], { cwd: repoDir2 });
+      const statusAfterReconcile = (await runCommandWithOutput("git", ["status", "--porcelain"], { cwd: repoDir2 })).trim();
+      if (statusAfterReconcile) {
+        await runCommand("git", ["commit", "-m", "Reconcile skills sync before push retry"], { cwd: repoDir2 });
+      }
+    }
+    throw new Error("Failed to push after non-fast-forward retries");
+  }
   const remoteUrl = toGitHubTokenRemote(repoOwner, repoName, token);
-  const branch = getPreferredSyncBranch();
+  const branch = PRIVATE_SYNC_BRANCH;
   const repoDir = await ensureSkillsWorkingTreeRepo(remoteUrl, branch);
   void _installedMap;
   await runCommand("git", ["config", "user.email", "skills-sync@local"], { cwd: repoDir });
@@ -616,16 +856,16 @@ async function syncInstalledSkillsFolderToRepo(token, repoOwner, repoName, _inst
   const status = (await runCommandWithOutput("git", ["status", "--porcelain"], { cwd: repoDir })).trim();
   if (!status) return;
   await runCommand("git", ["commit", "-m", "Sync installed skills folder and manifest"], { cwd: repoDir });
-  await runCommand("git", ["push", "origin", `HEAD:${branch}`], { cwd: repoDir });
+  await pushWithNonFastForwardRetry(repoDir, branch);
 }
 async function pullInstalledSkillsFolderFromRepo(token, repoOwner, repoName) {
   const remoteUrl = toGitHubTokenRemote(repoOwner, repoName, token);
-  const branch = getPreferredSyncBranch();
+  const branch = PRIVATE_SYNC_BRANCH;
   await ensureSkillsWorkingTreeRepo(remoteUrl, branch);
 }
 async function bootstrapSkillsFromUpstreamIntoLocal() {
   const repoUrl = `https://github.com/${SYNC_UPSTREAM_SKILLS_OWNER}/${SYNC_UPSTREAM_SKILLS_REPO}.git`;
-  const branch = getPreferredSyncBranch();
+  const branch = getPreferredPublicUpstreamBranch();
   await ensureSkillsWorkingTreeRepo(repoUrl, branch);
 }
 async function collectLocalSyncedSkills(appServer) {
@@ -685,9 +925,9 @@ async function autoPushSyncedSkills(appServer) {
 }
 async function ensureCodexAgentsSymlinkToSkillsAgents() {
   const codexHomeDir = getCodexHomeDir();
-  const skillsAgentsPath = join(codexHomeDir, "skills", "AGENTS.md");
-  const codexAgentsPath = join(codexHomeDir, "AGENTS.md");
-  await mkdir(join(codexHomeDir, "skills"), { recursive: true });
+  const skillsAgentsPath = join2(codexHomeDir, "skills", "AGENTS.md");
+  const codexAgentsPath = join2(codexHomeDir, "AGENTS.md");
+  await mkdir(join2(codexHomeDir, "skills"), { recursive: true });
   let copiedFromCodex = false;
   try {
     const codexAgentsStat = await lstat(codexAgentsPath);
@@ -711,7 +951,7 @@ async function ensureCodexAgentsSymlinkToSkillsAgents() {
       await writeFile(skillsAgentsPath, "", "utf8");
     }
   }
-  const relativeTarget = join("skills", "AGENTS.md");
+  const relativeTarget = join2("skills", "AGENTS.md");
   try {
     const current = await lstat(codexAgentsPath);
     if (current.isSymbolicLink()) {
@@ -729,7 +969,7 @@ async function initializeSkillsSyncOnStartup(appServer) {
   startupSyncStatus.inProgress = true;
   startupSyncStatus.lastRunAtIso = (/* @__PURE__ */ new Date()).toISOString();
   startupSyncStatus.lastError = "";
-  startupSyncStatus.branch = getPreferredSyncBranch();
+  startupSyncStatus.branch = PRIVATE_SYNC_BRANCH;
   try {
     const state = await readSkillsSyncState();
     if (!state.githubToken) {
@@ -741,6 +981,7 @@ async function initializeSkillsSyncOnStartup(appServer) {
         return;
       }
       startupSyncStatus.mode = "unauthenticated-bootstrap";
+      startupSyncStatus.branch = getPreferredPublicUpstreamBranch();
       startupSyncStatus.lastAction = "pull-upstream";
       await bootstrapSkillsFromUpstreamIntoLocal();
       try {
@@ -752,6 +993,7 @@ async function initializeSkillsSyncOnStartup(appServer) {
       return;
     }
     startupSyncStatus.mode = "authenticated-fork-sync";
+    startupSyncStatus.branch = PRIVATE_SYNC_BRANCH;
     startupSyncStatus.lastAction = "ensure-private-fork";
     const username = state.githubUsername || await resolveGithubUsername(state.githubToken);
     const repoName = DEFAULT_SKILLS_SYNC_REPO_NAME;
@@ -991,13 +1233,21 @@ async function handleSkillsRoutes(req, res, url, context) {
       }
       const localDir = await detectUserSkillsDir(appServer);
       await pullInstalledSkillsFolderFromRepo(state.githubToken, state.repoOwner, state.repoName);
-      const installerScript = "/Users/igor/.cursor/skills/.system/skill-installer/scripts/install-skill-from-github.py";
+      const installerScript = resolveSkillInstallerScriptPath(getCodexHomeDir());
+      if (!installerScript) {
+        throw new Error("Skill installer script not found");
+      }
+      const pythonCommand = resolvePythonCommand();
+      if (!pythonCommand) {
+        throw new Error("Python 3 is required to install skills");
+      }
       const localSkills = await scanInstalledSkillsFromDisk();
       for (const skill of remote) {
         const owner = skill.owner || uniqueOwnerByName.get(skill.name) || "";
         if (!owner) continue;
         if (!localSkills.has(skill.name)) {
-          await runCommand("python3", [
+          await runCommand(pythonCommand.command, [
+            ...pythonCommand.args,
             installerScript,
             "--repo",
             `${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}`,
@@ -1009,7 +1259,7 @@ async function handleSkillsRoutes(req, res, url, context) {
             "git"
           ]);
         }
-        const skillPath = join(localDir, skill.name);
+        const skillPath = join2(localDir, skill.name);
         await appServer.rpc("skills/config/write", { path: skillPath, enabled: skill.enabled });
       }
       const remoteNames = new Set(remote.map((row) => row.name));
@@ -1038,15 +1288,29 @@ async function handleSkillsRoutes(req, res, url, context) {
     try {
       const owner = url.searchParams.get("owner") || "";
       const name = url.searchParams.get("name") || "";
+      const installed = url.searchParams.get("installed") === "true";
+      const skillPath = url.searchParams.get("path") || "";
       if (!owner || !name) {
         setJson(res, 400, { error: "Missing owner or name" });
         return true;
       }
+      if (installed) {
+        const installedMap = await scanInstalledSkillsFromDisk();
+        const installedInfo = installedMap.get(name);
+        const localSkillPath = installedInfo?.path || (skillPath ? skillPath.endsWith("/SKILL.md") ? skillPath : `${skillPath}/SKILL.md` : "");
+        if (localSkillPath) {
+          const content2 = await readFile(localSkillPath, "utf8");
+          const description2 = extractSkillDescriptionFromMarkdown(content2);
+          setJson(res, 200, { content: content2, description: description2, source: "local" });
+          return true;
+        }
+      }
       const rawUrl = `https://raw.githubusercontent.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/main/skills/${owner}/${name}/SKILL.md`;
       const resp = await fetch(rawUrl);
       if (!resp.ok) throw new Error(`Failed to fetch SKILL.md: ${resp.status}`);
       const content = await resp.text();
-      setJson(res, 200, { content });
+      const description = extractSkillDescriptionFromMarkdown(content);
+      setJson(res, 200, { content, description, source: "remote" });
     } catch (error) {
       setJson(res, 502, { error: getErrorMessage(error, "Failed to fetch SKILL.md") });
     }
@@ -1061,9 +1325,25 @@ async function handleSkillsRoutes(req, res, url, context) {
         setJson(res, 400, { error: "Missing owner or name" });
         return true;
       }
-      const installerScript = "/Users/igor/.cursor/skills/.system/skill-installer/scripts/install-skill-from-github.py";
-      const installDest = await detectUserSkillsDir(appServer);
-      await runCommand("python3", [
+      const installerScript = resolveSkillInstallerScriptPath(getCodexHomeDir());
+      if (!installerScript) {
+        throw new Error("Skill installer script not found");
+      }
+      const pythonCommand = resolvePythonCommand();
+      if (!pythonCommand) {
+        throw new Error("Python 3 is required to install skills");
+      }
+      const installDest = await withTimeout(
+        detectUserSkillsDir(appServer),
+        1e4,
+        "detectUserSkillsDir"
+      ).catch(() => getSkillsInstallDir());
+      const skillDir = join2(installDest, name);
+      if (existsSync2(skillDir)) {
+        await rm(skillDir, { recursive: true, force: true });
+      }
+      await runCommand(pythonCommand.command, [
+        ...pythonCommand.args,
         installerScript,
         "--repo",
         `${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}`,
@@ -1073,13 +1353,16 @@ async function handleSkillsRoutes(req, res, url, context) {
         installDest,
         "--method",
         "git"
-      ]);
-      const skillDir = join(installDest, name);
-      await ensureInstalledSkillIsValid(appServer, skillDir);
+      ], { timeoutMs: 9e4 });
+      try {
+        await withTimeout(ensureInstalledSkillIsValid(appServer, skillDir), 1e4, "ensureInstalledSkillIsValid");
+      } catch {
+      }
       const syncState = await readSkillsSyncState();
       const nextOwners = { ...syncState.installedOwners ?? {}, [name]: owner };
       await writeSkillsSyncState({ ...syncState, installedOwners: nextOwners });
-      await autoPushSyncedSkills(appServer);
+      autoPushSyncedSkills(appServer).catch(() => {
+      });
       setJson(res, 200, { ok: true, path: skillDir });
     } catch (error) {
       setJson(res, 502, { error: getErrorMessage(error, "Failed to install skill") });
@@ -1091,7 +1374,7 @@ async function handleSkillsRoutes(req, res, url, context) {
       const payload = asRecord(await readJsonBody2(req));
       const name = typeof payload?.name === "string" ? payload.name : "";
       const path = typeof payload?.path === "string" ? payload.path : "";
-      const target = path || (name ? join(getSkillsInstallDir(), name) : "");
+      const target = path || (name ? join2(getSkillsInstallDir(), name) : "");
       if (!target) {
         setJson(res, 400, { error: "Missing name or path" });
         return true;
@@ -1103,9 +1386,10 @@ async function handleSkillsRoutes(req, res, url, context) {
         delete nextOwners[name];
         await writeSkillsSyncState({ ...syncState, installedOwners: nextOwners });
       }
-      await autoPushSyncedSkills(appServer);
+      autoPushSyncedSkills(appServer).catch(() => {
+      });
       try {
-        await appServer.rpc("skills/list", { forceReload: true });
+        await withTimeout(appServer.rpc("skills/list", { forceReload: true }), 1e4, "skills/list reload");
       } catch {
       }
       setJson(res, 200, { ok: true, deletedPath: target });
@@ -1117,7 +1401,8 @@ async function handleSkillsRoutes(req, res, url, context) {
   return false;
 }
 
-// src/server/codexAppServerBridge.ts
+// src/server/telegramThreadBridge.ts
+import { basename } from "path";
 function asRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -1135,21 +1420,425 @@ function getErrorMessage2(payload, fallback) {
   }
   return fallback;
 }
+var TelegramThreadBridge = class {
+  constructor(appServer) {
+    this.threadIdByChatId = /* @__PURE__ */ new Map();
+    this.chatIdsByThreadId = /* @__PURE__ */ new Map();
+    this.lastForwardedTurnByThreadId = /* @__PURE__ */ new Map();
+    this.active = false;
+    this.pollingTask = null;
+    this.nextUpdateOffset = 0;
+    this.lastError = "";
+    this.appServer = appServer;
+    this.token = process.env.TELEGRAM_BOT_TOKEN?.trim() ?? "";
+    this.defaultCwd = process.env.TELEGRAM_DEFAULT_CWD?.trim() ?? process.cwd();
+  }
+  start() {
+    if (!this.token || this.active) return;
+    this.active = true;
+    void this.notifyOnlineForKnownChats().catch(() => {
+    });
+    this.pollingTask = this.pollLoop();
+    this.appServer.onNotification((notification) => {
+      void this.handleNotification(notification).catch(() => {
+      });
+    });
+  }
+  stop() {
+    this.active = false;
+  }
+  async pollLoop() {
+    while (this.active) {
+      try {
+        const updates = await this.getUpdates();
+        this.lastError = "";
+        for (const update of updates) {
+          const updateId = typeof update.update_id === "number" ? update.update_id : -1;
+          if (updateId >= 0) {
+            this.nextUpdateOffset = Math.max(this.nextUpdateOffset, updateId + 1);
+          }
+          await this.handleIncomingUpdate(update);
+        }
+      } catch (error) {
+        this.lastError = getErrorMessage2(error, "Telegram polling failed");
+        await new Promise((resolve3) => setTimeout(resolve3, 1500));
+      }
+    }
+  }
+  async getUpdates() {
+    if (!this.token) {
+      throw new Error("Telegram bot token is not configured");
+    }
+    const response = await fetch(this.apiUrl("getUpdates"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        timeout: 45,
+        offset: this.nextUpdateOffset,
+        allowed_updates: ["message", "callback_query"]
+      })
+    });
+    const payload = asRecord2(await response.json());
+    const result = Array.isArray(payload?.result) ? payload.result : [];
+    return result;
+  }
+  apiUrl(method) {
+    return `https://api.telegram.org/bot${this.token}/${method}`;
+  }
+  configureToken(token) {
+    const normalizedToken = token.trim();
+    if (!normalizedToken) {
+      throw new Error("Telegram bot token is required");
+    }
+    this.token = normalizedToken;
+  }
+  getStatus() {
+    return {
+      configured: this.token.length > 0,
+      active: this.active,
+      mappedChats: this.threadIdByChatId.size,
+      mappedThreads: this.chatIdsByThreadId.size,
+      lastError: this.lastError
+    };
+  }
+  connectThread(threadId, chatId, token) {
+    const normalizedThreadId = threadId.trim();
+    if (!normalizedThreadId) {
+      throw new Error("threadId is required");
+    }
+    if (!Number.isFinite(chatId)) {
+      throw new Error("chatId must be a number");
+    }
+    if (typeof token === "string" && token.trim().length > 0) {
+      this.configureToken(token);
+    }
+    if (!this.token) {
+      throw new Error("Telegram bot token is not configured");
+    }
+    this.bindChatToThread(chatId, normalizedThreadId);
+    this.start();
+    void this.sendOnlineMessage(chatId).catch(() => {
+    });
+  }
+  async sendTelegramMessage(chatId, text, options = {}) {
+    const message = text.trim();
+    if (!message) return;
+    const payload = { chat_id: chatId, text: message };
+    if (options.replyMarkup) {
+      payload.reply_markup = options.replyMarkup;
+    }
+    await fetch(this.apiUrl("sendMessage"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+  }
+  async sendOnlineMessage(chatId) {
+    await this.sendTelegramMessage(chatId, "Codex thread bridge went online.");
+  }
+  async notifyOnlineForKnownChats() {
+    const knownChatIds = Array.from(this.threadIdByChatId.keys());
+    for (const chatId of knownChatIds) {
+      await this.sendOnlineMessage(chatId);
+    }
+  }
+  async handleIncomingUpdate(update) {
+    if (update.callback_query) {
+      await this.handleCallbackQuery(update.callback_query);
+      return;
+    }
+    const message = update.message;
+    const chatId = message?.chat?.id;
+    const text = message?.text?.trim();
+    if (typeof chatId !== "number" || !text) return;
+    if (text === "/start") {
+      await this.sendThreadPicker(chatId);
+      return;
+    }
+    if (text === "/newthread") {
+      const threadId2 = await this.createThreadForChat(chatId);
+      await this.sendTelegramMessage(chatId, `Mapped to new thread: ${threadId2}`);
+      return;
+    }
+    const threadCommand = text.match(/^\/thread\s+(\S+)$/);
+    if (threadCommand) {
+      const threadId2 = threadCommand[1];
+      this.bindChatToThread(chatId, threadId2);
+      await this.sendTelegramMessage(chatId, `Mapped to thread: ${threadId2}`);
+      return;
+    }
+    const threadId = await this.ensureThreadForChat(chatId);
+    try {
+      await this.appServer.rpc("turn/start", {
+        threadId,
+        input: [{ type: "text", text }]
+      });
+    } catch (error) {
+      const message2 = getErrorMessage2(error, "Failed to forward message to thread");
+      await this.sendTelegramMessage(chatId, `Forward failed: ${message2}`);
+    }
+  }
+  async handleCallbackQuery(callbackQuery) {
+    const callbackId = typeof callbackQuery.id === "string" ? callbackQuery.id : "";
+    const data = typeof callbackQuery.data === "string" ? callbackQuery.data : "";
+    const chatId = callbackQuery.message?.chat?.id;
+    if (!callbackId) return;
+    if (!data.startsWith("thread:") || typeof chatId !== "number") {
+      await this.answerCallbackQuery(callbackId, "Invalid selection");
+      return;
+    }
+    const threadId = data.slice("thread:".length).trim();
+    if (!threadId) {
+      await this.answerCallbackQuery(callbackId, "Invalid thread id");
+      return;
+    }
+    this.bindChatToThread(chatId, threadId);
+    await this.answerCallbackQuery(callbackId, "Thread connected");
+    await this.sendTelegramMessage(chatId, `Connected to thread: ${threadId}`);
+    const history = await this.readThreadHistorySummary(threadId);
+    if (history) {
+      await this.sendTelegramMessage(chatId, history);
+    }
+  }
+  async answerCallbackQuery(callbackQueryId, text) {
+    await fetch(this.apiUrl("answerCallbackQuery"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        callback_query_id: callbackQueryId,
+        text
+      })
+    });
+  }
+  async sendThreadPicker(chatId) {
+    const threads = await this.listRecentThreads();
+    if (threads.length === 0) {
+      await this.sendTelegramMessage(chatId, "No threads found. Send /newthread to create one.");
+      return;
+    }
+    const inlineKeyboard = threads.map((thread) => [
+      {
+        text: thread.title,
+        callback_data: `thread:${thread.id}`
+      }
+    ]);
+    await this.sendTelegramMessage(chatId, "Select a thread to connect:", {
+      replyMarkup: { inline_keyboard: inlineKeyboard }
+    });
+  }
+  async listRecentThreads() {
+    const payload = asRecord2(await this.appServer.rpc("thread/list", {
+      archived: false,
+      limit: 20,
+      sortKey: "updated_at"
+    }));
+    const rows = Array.isArray(payload?.data) ? payload.data : [];
+    const threads = [];
+    for (const row of rows) {
+      const record = asRecord2(row);
+      const id = typeof record?.id === "string" ? record.id.trim() : "";
+      if (!id) continue;
+      const name = typeof record?.name === "string" ? record.name.trim() : "";
+      const preview = typeof record?.preview === "string" ? record.preview.trim() : "";
+      const cwd = typeof record?.cwd === "string" ? record.cwd.trim() : "";
+      const projectName = cwd ? basename(cwd) : "project";
+      const threadTitle = (name || preview || id).replace(/\s+/g, " ").trim();
+      const title = `${projectName}/${threadTitle}`.slice(0, 64);
+      threads.push({ id, title });
+    }
+    return threads;
+  }
+  async createThreadForChat(chatId) {
+    const response = asRecord2(await this.appServer.rpc("thread/start", { cwd: this.defaultCwd }));
+    const thread = asRecord2(response?.thread);
+    const threadId = typeof thread?.id === "string" ? thread.id : "";
+    if (!threadId) {
+      throw new Error("thread/start did not return thread id");
+    }
+    this.bindChatToThread(chatId, threadId);
+    return threadId;
+  }
+  async ensureThreadForChat(chatId) {
+    const existing = this.threadIdByChatId.get(chatId);
+    if (existing) return existing;
+    return this.createThreadForChat(chatId);
+  }
+  bindChatToThread(chatId, threadId) {
+    const previousThreadId = this.threadIdByChatId.get(chatId);
+    if (previousThreadId && previousThreadId !== threadId) {
+      const previousSet = this.chatIdsByThreadId.get(previousThreadId);
+      previousSet?.delete(chatId);
+      if (previousSet && previousSet.size === 0) {
+        this.chatIdsByThreadId.delete(previousThreadId);
+      }
+    }
+    this.threadIdByChatId.set(chatId, threadId);
+    const chatIds = this.chatIdsByThreadId.get(threadId) ?? /* @__PURE__ */ new Set();
+    chatIds.add(chatId);
+    this.chatIdsByThreadId.set(threadId, chatIds);
+  }
+  extractThreadId(notification) {
+    const params = asRecord2(notification.params);
+    if (!params) return "";
+    const directThreadId = typeof params.threadId === "string" ? params.threadId : "";
+    if (directThreadId) return directThreadId;
+    const turn = asRecord2(params.turn);
+    const turnThreadId = typeof turn?.threadId === "string" ? turn.threadId : "";
+    return turnThreadId;
+  }
+  extractTurnId(notification) {
+    const params = asRecord2(notification.params);
+    if (!params) return "";
+    const directTurnId = typeof params.turnId === "string" ? params.turnId : "";
+    if (directTurnId) return directTurnId;
+    const turn = asRecord2(params.turn);
+    const turnId = typeof turn?.id === "string" ? turn.id : "";
+    return turnId;
+  }
+  async handleNotification(notification) {
+    if (notification.method !== "turn/completed") return;
+    const threadId = this.extractThreadId(notification);
+    if (!threadId) return;
+    const chatIds = this.chatIdsByThreadId.get(threadId);
+    if (!chatIds || chatIds.size === 0) return;
+    const turnId = this.extractTurnId(notification);
+    const lastForwardedTurnId = this.lastForwardedTurnByThreadId.get(threadId);
+    if (turnId && lastForwardedTurnId === turnId) return;
+    const assistantReply = await this.readLatestAssistantMessage(threadId);
+    if (!assistantReply) return;
+    for (const chatId of chatIds) {
+      await this.sendTelegramMessage(chatId, assistantReply);
+    }
+    if (turnId) {
+      this.lastForwardedTurnByThreadId.set(threadId, turnId);
+    }
+  }
+  async readLatestAssistantMessage(threadId) {
+    const response = asRecord2(await this.appServer.rpc("thread/read", { threadId, includeTurns: true }));
+    const thread = asRecord2(response?.thread);
+    const turns = Array.isArray(thread?.turns) ? thread.turns : [];
+    for (let turnIndex = turns.length - 1; turnIndex >= 0; turnIndex -= 1) {
+      const turn = asRecord2(turns[turnIndex]);
+      const items = Array.isArray(turn?.items) ? turn.items : [];
+      for (let itemIndex = items.length - 1; itemIndex >= 0; itemIndex -= 1) {
+        const item = asRecord2(items[itemIndex]);
+        if (item?.type === "agentMessage") {
+          const text = typeof item.text === "string" ? item.text.trim() : "";
+          if (text) return text;
+        }
+      }
+    }
+    return "";
+  }
+  async readThreadHistorySummary(threadId) {
+    const response = asRecord2(await this.appServer.rpc("thread/read", { threadId, includeTurns: true }));
+    const thread = asRecord2(response?.thread);
+    const turns = Array.isArray(thread?.turns) ? thread.turns : [];
+    const historyRows = [];
+    for (const turn of turns) {
+      const turnRecord = asRecord2(turn);
+      const items = Array.isArray(turnRecord?.items) ? turnRecord.items : [];
+      for (const item of items) {
+        const itemRecord = asRecord2(item);
+        const type = typeof itemRecord?.type === "string" ? itemRecord.type : "";
+        if (type === "userMessage") {
+          const content = Array.isArray(itemRecord?.content) ? itemRecord.content : [];
+          for (const block of content) {
+            const blockRecord = asRecord2(block);
+            if (blockRecord?.type === "text" && typeof blockRecord.text === "string" && blockRecord.text.trim()) {
+              historyRows.push(`User: ${blockRecord.text.trim()}`);
+            }
+          }
+        }
+        if (type === "agentMessage" && typeof itemRecord?.text === "string" && itemRecord.text.trim()) {
+          historyRows.push(`Assistant: ${itemRecord.text.trim()}`);
+        }
+      }
+    }
+    if (historyRows.length === 0) {
+      return "Thread has no message history yet.";
+    }
+    const tail = historyRows.slice(-12).join("\n\n");
+    const maxLen = 3800;
+    const summary = tail.length > maxLen ? tail.slice(tail.length - maxLen) : tail;
+    return `Recent history:
+
+${summary}`;
+  }
+};
+
+// src/utils/commandInvocation.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { basename as basename2, extname } from "path";
+var WINDOWS_CMD_NAMES = /* @__PURE__ */ new Set(["codex", "npm", "npx"]);
+function quoteCmdExeArg(value) {
+  const normalized = value.replace(/"/g, '""');
+  if (!/[\s"]/u.test(normalized)) {
+    return normalized;
+  }
+  return `"${normalized}"`;
+}
+function needsCmdExeWrapper(command) {
+  if (process.platform !== "win32") {
+    return false;
+  }
+  const lowerCommand = command.toLowerCase();
+  const baseName = basename2(lowerCommand);
+  if (/\.(cmd|bat)$/i.test(baseName)) {
+    return true;
+  }
+  if (extname(baseName)) {
+    return false;
+  }
+  return WINDOWS_CMD_NAMES.has(baseName);
+}
+function getSpawnInvocation(command, args = []) {
+  if (needsCmdExeWrapper(command)) {
+    return {
+      command: "cmd.exe",
+      args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]
+    };
+  }
+  return { command, args };
+}
+function spawnSyncCommand(command, args = [], options = {}) {
+  const invocation = getSpawnInvocation(command, args);
+  return spawnSync2(invocation.command, invocation.args, options);
+}
+
+// src/server/codexAppServerBridge.ts
+function asRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function getErrorMessage3(payload, fallback) {
+  if (payload instanceof Error && payload.message.trim().length > 0) {
+    return payload.message;
+  }
+  const record = asRecord3(payload);
+  if (!record) return fallback;
+  const error = record.error;
+  if (typeof error === "string" && error.length > 0) return error;
+  const nestedError = asRecord3(error);
+  if (nestedError && typeof nestedError.message === "string" && nestedError.message.length > 0) {
+    return nestedError.message;
+  }
+  return fallback;
+}
 function setJson2(res, statusCode, payload) {
   res.statusCode = statusCode;
   res.setHeader("Content-Type", "application/json; charset=utf-8");
   res.end(JSON.stringify(payload));
 }
 function extractThreadMessageText(threadReadPayload) {
-  const payload = asRecord2(threadReadPayload);
-  const thread = asRecord2(payload?.thread);
+  const payload = asRecord3(threadReadPayload);
+  const thread = asRecord3(payload?.thread);
   const turns = Array.isArray(thread?.turns) ? thread.turns : [];
   const parts = [];
   for (const turn of turns) {
-    const turnRecord = asRecord2(turn);
+    const turnRecord = asRecord3(turn);
     const items = Array.isArray(turnRecord?.items) ? turnRecord.items : [];
     for (const item of items) {
-      const itemRecord = asRecord2(item);
+      const itemRecord = asRecord3(item);
       const type = typeof itemRecord?.type === "string" ? itemRecord.type : "";
       if (type === "agentMessage" && typeof itemRecord?.text === "string" && itemRecord.text.trim().length > 0) {
         parts.push(itemRecord.text.trim());
@@ -1158,7 +1847,7 @@ function extractThreadMessageText(threadReadPayload) {
       if (type === "userMessage") {
         const content = Array.isArray(itemRecord?.content) ? itemRecord.content : [];
         for (const block of content) {
-          const blockRecord = asRecord2(block);
+          const blockRecord = asRecord3(block);
           if (blockRecord?.type === "text" && typeof blockRecord.text === "string" && blockRecord.text.trim().length > 0) {
             parts.push(blockRecord.text.trim());
           }
@@ -1192,9 +1881,62 @@ function scoreFileCandidate(path, query) {
   if (lowerPath.includes(lowerQuery)) return 4;
   return 10;
 }
+function decodeHtmlEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&#x2F;/gi, "/");
+}
+function stripHtml(value) {
+  return decodeHtmlEntities(value.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim());
+}
+function parseGithubTrendingHtml(html, limit) {
+  const rows = html.match(/<article[\s\S]*?<\/article>/g) ?? [];
+  const items = [];
+  let seq = Date.now();
+  for (const row of rows) {
+    const repoBlockMatch = row.match(/<h2[\s\S]*?<\/h2>/);
+    const hrefMatch = repoBlockMatch?.[0]?.match(/href="\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)"/);
+    if (!hrefMatch) continue;
+    const fullName = hrefMatch[1] ?? "";
+    if (!fullName || items.some((item) => item.fullName === fullName)) continue;
+    const descriptionMatch = row.match(/<p[^>]*class="[^"]*col-9[^"]*"[^>]*>([\s\S]*?)<\/p>/) ?? row.match(/<p[^>]*class="[^"]*color-fg-muted[^"]*"[^>]*>([\s\S]*?)<\/p>/) ?? row.match(/<p[^>]*>([\s\S]*?)<\/p>/);
+    const languageMatch = row.match(/programmingLanguage[^>]*>\s*([\s\S]*?)\s*<\/span>/);
+    const starsMatch = row.match(/href="\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/stargazers"[\s\S]*?>([\s\S]*?)<\/a>/);
+    const starsText = stripHtml(starsMatch?.[1] ?? "").replace(/,/g, "");
+    const stars = Number.parseInt(starsText, 10);
+    items.push({
+      id: seq,
+      fullName,
+      url: `https://github.com/${fullName}`,
+      description: stripHtml(descriptionMatch?.[1] ?? ""),
+      language: stripHtml(languageMatch?.[1] ?? ""),
+      stars: Number.isFinite(stars) ? stars : 0
+    });
+    seq += 1;
+    if (items.length >= limit) break;
+  }
+  return items;
+}
+async function fetchGithubTrending(since, limit) {
+  const endpoint = `https://github.com/trending?since=${since}`;
+  const response = await fetch(endpoint, {
+    headers: {
+      "User-Agent": "codex-web-local",
+      Accept: "text/html"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`GitHub trending fetch failed (${response.status})`);
+  }
+  const html = await response.text();
+  return parseGithubTrendingHtml(html, limit);
+}
 async function listFilesWithRipgrep(cwd) {
   return await new Promise((resolve3, reject) => {
-    const proc = spawn2("rg", ["--files", "--hidden", "-g", "!.git", "-g", "!node_modules"], {
+    const ripgrepCommand = resolveRipgrepCommand();
+    if (!ripgrepCommand) {
+      reject(new Error("ripgrep (rg) is not available"));
+      return;
+    }
+    const proc = spawn2(ripgrepCommand, ["--files", "--hidden", "-g", "!.git", "-g", "!node_modules"], {
       cwd,
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
@@ -1221,7 +1963,7 @@ async function listFilesWithRipgrep(cwd) {
 }
 function getCodexHomeDir2() {
   const codexHome = process.env.CODEX_HOME?.trim();
-  return codexHome && codexHome.length > 0 ? codexHome : join2(homedir2(), ".codex");
+  return codexHome && codexHome.length > 0 ? codexHome : join3(homedir3(), ".codex");
 }
 async function runCommand2(command, args, options = {}) {
   await new Promise((resolve3, reject) => {
@@ -1251,15 +1993,15 @@ async function runCommand2(command, args, options = {}) {
   });
 }
 function isMissingHeadError(error) {
-  const message = getErrorMessage2(error, "").toLowerCase();
+  const message = getErrorMessage3(error, "").toLowerCase();
   return message.includes("not a valid object name: 'head'") || message.includes("not a valid object name: head") || message.includes("invalid reference: head");
 }
 function isNotGitRepositoryError(error) {
-  const message = getErrorMessage2(error, "").toLowerCase();
+  const message = getErrorMessage3(error, "").toLowerCase();
   return message.includes("not a git repository") || message.includes("fatal: not a git repository");
 }
 async function ensureRepoHasInitialCommit(repoRoot) {
-  const agentsPath = join2(repoRoot, "AGENTS.md");
+  const agentsPath = join3(repoRoot, "AGENTS.md");
   try {
     await stat2(agentsPath);
   } catch {
@@ -1299,6 +2041,33 @@ async function runCommandCapture(command, args, options = {}) {
     });
   });
 }
+async function runCommandWithOutput2(command, args, options = {}) {
+  return await new Promise((resolve3, reject) => {
+    const proc = spawn2(command, args, {
+      cwd: options.cwd,
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    proc.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      if (code === 0) {
+        resolve3(stdout.trim());
+        return;
+      }
+      const details = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
+      const suffix = details.length > 0 ? `: ${details}` : "";
+      reject(new Error(`Command failed (${command} ${args.join(" ")})${suffix}`));
+    });
+  });
+}
 function normalizeStringArray(value) {
   if (!Array.isArray(value)) return [];
   const normalized = [];
@@ -1319,8 +2088,88 @@ function normalizeStringRecord(value) {
   }
   return next;
 }
+function normalizeCommitMessage(value) {
+  if (typeof value !== "string") return "";
+  const normalized = value.replace(/\r\n?/gu, "\n").split("\n").map((line) => line.trim()).filter((line) => line.length > 0).join("\n").trim();
+  return normalized.slice(0, 2e3);
+}
+function getRollbackGitDirForCwd(cwd) {
+  return join3(cwd, ".codex", "rollbacks", ".git");
+}
+async function ensureLocalCodexGitignoreHasRollbacks(cwd) {
+  const localCodexDir = join3(cwd, ".codex");
+  const gitignorePath = join3(localCodexDir, ".gitignore");
+  await mkdir2(localCodexDir, { recursive: true });
+  let current = "";
+  try {
+    current = await readFile2(gitignorePath, "utf8");
+  } catch {
+    current = "";
+  }
+  const rows = current.split(/\r?\n/).map((line) => line.trim());
+  if (rows.includes("rollbacks/")) return;
+  const prefix = current.length > 0 && !current.endsWith("\n") ? `${current}
+` : current;
+  await writeFile2(gitignorePath, `${prefix}rollbacks/
+`, "utf8");
+}
+async function ensureRollbackGitRepo(cwd) {
+  const gitDir = getRollbackGitDirForCwd(cwd);
+  try {
+    const headInfo = await stat2(join3(gitDir, "HEAD"));
+    if (!headInfo.isFile()) {
+      throw new Error("Invalid rollback git repository");
+    }
+  } catch {
+    await mkdir2(dirname(gitDir), { recursive: true });
+    await runCommand2("git", ["--git-dir", gitDir, "--work-tree", cwd, "init"]);
+  }
+  await runCommand2("git", ["--git-dir", gitDir, "config", "user.email", "codex@local"]);
+  await runCommand2("git", ["--git-dir", gitDir, "config", "user.name", "Codex Rollback"]);
+  try {
+    await runCommandCapture("git", ["--git-dir", gitDir, "--work-tree", cwd, "rev-parse", "--verify", "HEAD"]);
+  } catch {
+    await runCommand2(
+      "git",
+      ["--git-dir", gitDir, "--work-tree", cwd, "commit", "--allow-empty", "-m", "Initialize rollback history"]
+    );
+  }
+  await ensureLocalCodexGitignoreHasRollbacks(cwd);
+  return gitDir;
+}
+async function runRollbackGit(cwd, args) {
+  const gitDir = await ensureRollbackGitRepo(cwd);
+  await runCommand2("git", ["--git-dir", gitDir, "--work-tree", cwd, ...args]);
+}
+async function runRollbackGitCapture(cwd, args) {
+  const gitDir = await ensureRollbackGitRepo(cwd);
+  return await runCommandCapture("git", ["--git-dir", gitDir, "--work-tree", cwd, ...args]);
+}
+async function runRollbackGitWithOutput(cwd, args) {
+  const gitDir = await ensureRollbackGitRepo(cwd);
+  return await runCommandWithOutput2("git", ["--git-dir", gitDir, "--work-tree", cwd, ...args]);
+}
+async function hasRollbackGitWorkingTreeChanges(cwd) {
+  const status = await runRollbackGitWithOutput(cwd, ["status", "--porcelain"]);
+  return status.trim().length > 0;
+}
+async function findRollbackCommitByExactMessage(cwd, message) {
+  const normalizedTarget = normalizeCommitMessage(message);
+  if (!normalizedTarget) return "";
+  const raw = await runRollbackGitWithOutput(cwd, ["log", "--format=%H%x1f%B%x1e"]);
+  const entries = raw.split("");
+  for (const entry of entries) {
+    if (!entry.trim()) continue;
+    const [shaRaw, bodyRaw] = entry.split("");
+    const sha = (shaRaw ?? "").trim();
+    const body = normalizeCommitMessage(bodyRaw ?? "");
+    if (!sha) continue;
+    if (body === normalizedTarget) return sha;
+  }
+  return "";
+}
 function getCodexAuthPath() {
-  return join2(getCodexHomeDir2(), "auth.json");
+  return join3(getCodexHomeDir2(), "auth.json");
 }
 async function readCodexAuth() {
   try {
@@ -1334,13 +2183,21 @@ async function readCodexAuth() {
   }
 }
 function getCodexGlobalStatePath() {
-  return join2(getCodexHomeDir2(), ".codex-global-state.json");
+  return join3(getCodexHomeDir2(), ".codex-global-state.json");
+}
+function getCodexSessionIndexPath() {
+  return join3(getCodexHomeDir2(), "session_index.jsonl");
 }
 var MAX_THREAD_TITLES = 500;
+var EMPTY_THREAD_TITLE_CACHE = { titles: {}, order: [] };
+var sessionIndexThreadTitleCacheState = {
+  fileSignature: null,
+  cache: EMPTY_THREAD_TITLE_CACHE
+};
 function normalizeThreadTitleCache(value) {
-  const record = asRecord2(value);
-  if (!record) return { titles: {}, order: [] };
-  const rawTitles = asRecord2(record.titles);
+  const record = asRecord3(value);
+  if (!record) return EMPTY_THREAD_TITLE_CACHE;
+  const rawTitles = asRecord3(record.titles);
   const titles = {};
   if (rawTitles) {
     for (const [k, v] of Object.entries(rawTitles)) {
@@ -1363,14 +2220,55 @@ function removeFromThreadTitleCache(cache, id) {
   const { [id]: _, ...titles } = cache.titles;
   return { titles, order: cache.order.filter((o) => o !== id) };
 }
+function normalizeSessionIndexThreadTitle(value) {
+  const record = asRecord3(value);
+  if (!record) return null;
+  const id = typeof record.id === "string" ? record.id.trim() : "";
+  const title = typeof record.thread_name === "string" ? record.thread_name.trim() : "";
+  const updatedAtIso = typeof record.updated_at === "string" ? record.updated_at.trim() : "";
+  const updatedAtMs = updatedAtIso ? Date.parse(updatedAtIso) : Number.NaN;
+  if (!id || !title) return null;
+  return {
+    id,
+    title,
+    updatedAtMs: Number.isFinite(updatedAtMs) ? updatedAtMs : 0
+  };
+}
+function trimThreadTitleCache(cache) {
+  const titles = { ...cache.titles };
+  const order = cache.order.filter((id) => {
+    if (!titles[id]) return false;
+    return true;
+  }).slice(0, MAX_THREAD_TITLES);
+  for (const id of Object.keys(titles)) {
+    if (!order.includes(id)) {
+      delete titles[id];
+    }
+  }
+  return { titles, order };
+}
+function mergeThreadTitleCaches(base, overlay) {
+  const titles = { ...base.titles, ...overlay.titles };
+  const order = [];
+  for (const id of [...overlay.order, ...base.order]) {
+    if (!titles[id] || order.includes(id)) continue;
+    order.push(id);
+  }
+  for (const id of Object.keys(titles)) {
+    if (!order.includes(id)) {
+      order.push(id);
+    }
+  }
+  return trimThreadTitleCache({ titles, order });
+}
 async function readThreadTitleCache() {
   const statePath = getCodexGlobalStatePath();
   try {
     const raw = await readFile2(statePath, "utf8");
-    const payload = asRecord2(JSON.parse(raw)) ?? {};
+    const payload = asRecord3(JSON.parse(raw)) ?? {};
     return normalizeThreadTitleCache(payload["thread-titles"]);
   } catch {
-    return { titles: {}, order: [] };
+    return EMPTY_THREAD_TITLE_CACHE;
   }
 }
 async function writeThreadTitleCache(cache) {
@@ -1378,20 +2276,83 @@ async function writeThreadTitleCache(cache) {
   let payload = {};
   try {
     const raw = await readFile2(statePath, "utf8");
-    payload = asRecord2(JSON.parse(raw)) ?? {};
+    payload = asRecord3(JSON.parse(raw)) ?? {};
   } catch {
     payload = {};
   }
   payload["thread-titles"] = cache;
   await writeFile2(statePath, JSON.stringify(payload), "utf8");
 }
+function getSessionIndexFileSignature(stats) {
+  return `${String(stats.mtimeMs)}:${String(stats.size)}`;
+}
+async function parseThreadTitlesFromSessionIndex(sessionIndexPath) {
+  const latestById = /* @__PURE__ */ new Map();
+  const input = createReadStream(sessionIndexPath, { encoding: "utf8" });
+  const lines = createInterface({
+    input,
+    crlfDelay: Infinity
+  });
+  try {
+    for await (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const entry = normalizeSessionIndexThreadTitle(JSON.parse(trimmed));
+        if (!entry) continue;
+        const previous = latestById.get(entry.id);
+        if (!previous || entry.updatedAtMs >= previous.updatedAtMs) {
+          latestById.set(entry.id, entry);
+        }
+      } catch {
+      }
+    }
+  } finally {
+    lines.close();
+    input.close();
+  }
+  const entries = Array.from(latestById.values()).sort((first, second) => second.updatedAtMs - first.updatedAtMs);
+  const titles = {};
+  const order = [];
+  for (const entry of entries) {
+    titles[entry.id] = entry.title;
+    order.push(entry.id);
+  }
+  return trimThreadTitleCache({ titles, order });
+}
+async function readThreadTitlesFromSessionIndex() {
+  const sessionIndexPath = getCodexSessionIndexPath();
+  try {
+    const stats = await stat2(sessionIndexPath);
+    const fileSignature = getSessionIndexFileSignature(stats);
+    if (sessionIndexThreadTitleCacheState.fileSignature === fileSignature) {
+      return sessionIndexThreadTitleCacheState.cache;
+    }
+    const cache = await parseThreadTitlesFromSessionIndex(sessionIndexPath);
+    sessionIndexThreadTitleCacheState = { fileSignature, cache };
+    return cache;
+  } catch {
+    sessionIndexThreadTitleCacheState = {
+      fileSignature: "missing",
+      cache: EMPTY_THREAD_TITLE_CACHE
+    };
+    return sessionIndexThreadTitleCacheState.cache;
+  }
+}
+async function readMergedThreadTitleCache() {
+  const [sessionIndexCache, persistedCache] = await Promise.all([
+    readThreadTitlesFromSessionIndex(),
+    readThreadTitleCache()
+  ]);
+  return mergeThreadTitleCaches(persistedCache, sessionIndexCache);
+}
 async function readWorkspaceRootsState() {
   const statePath = getCodexGlobalStatePath();
   let payload = {};
   try {
     const raw = await readFile2(statePath, "utf8");
     const parsed = JSON.parse(raw);
-    payload = asRecord2(parsed) ?? {};
+    payload = asRecord3(parsed) ?? {};
   } catch {
     payload = {};
   }
@@ -1406,7 +2367,7 @@ async function writeWorkspaceRootsState(nextState) {
   let payload = {};
   try {
     const raw = await readFile2(statePath, "utf8");
-    payload = asRecord2(JSON.parse(raw)) ?? {};
+    payload = asRecord3(JSON.parse(raw)) ?? {};
   } catch {
     payload = {};
   }
@@ -1415,6 +2376,36 @@ async function writeWorkspaceRootsState(nextState) {
   payload["active-workspace-roots"] = normalizeStringArray(nextState.active);
   await writeFile2(statePath, JSON.stringify(payload), "utf8");
 }
+function normalizeTelegramBridgeConfig(value) {
+  const record = asRecord3(value);
+  if (!record) return { botToken: "" };
+  const botToken = typeof record.botToken === "string" ? record.botToken.trim() : "";
+  return { botToken };
+}
+async function readTelegramBridgeConfig() {
+  const statePath = getCodexGlobalStatePath();
+  try {
+    const raw = await readFile2(statePath, "utf8");
+    const payload = asRecord3(JSON.parse(raw)) ?? {};
+    return normalizeTelegramBridgeConfig(payload["telegram-bridge"]);
+  } catch {
+    return { botToken: "" };
+  }
+}
+async function writeTelegramBridgeConfig(nextState) {
+  const statePath = getCodexGlobalStatePath();
+  let payload = {};
+  try {
+    const raw = await readFile2(statePath, "utf8");
+    payload = asRecord3(JSON.parse(raw)) ?? {};
+  } catch {
+    payload = {};
+  }
+  payload["telegram-bridge"] = {
+    botToken: nextState.botToken.trim()
+  };
+  await writeFile2(statePath, JSON.stringify(payload), "utf8");
+}
 async function readJsonBody(req) {
   const raw = await readRawBody(req);
   if (raw.length === 0) return null;
@@ -1484,46 +2475,93 @@ function handleFileUpload(req, res) {
         setJson2(res, 400, { error: "No file in request" });
         return;
       }
-      const uploadDir = join2(tmpdir2(), "codex-web-uploads");
+      const uploadDir = join3(tmpdir2(), "codex-web-uploads");
       await mkdir2(uploadDir, { recursive: true });
-      const destDir = await mkdtemp2(join2(uploadDir, "f-"));
-      const destPath = join2(destDir, fileName);
+      const destDir = await mkdtemp2(join3(uploadDir, "f-"));
+      const destPath = join3(destDir, fileName);
       await writeFile2(destPath, fileData);
       setJson2(res, 200, { path: destPath });
     } catch (err) {
-      setJson2(res, 500, { error: getErrorMessage2(err, "Upload failed") });
+      setJson2(res, 500, { error: getErrorMessage3(err, "Upload failed") });
     }
   });
   req.on("error", (err) => {
-    setJson2(res, 500, { error: getErrorMessage2(err, "Upload stream error") });
+    setJson2(res, 500, { error: getErrorMessage3(err, "Upload stream error") });
+  });
+}
+function httpPost(url, headers, body) {
+  const doRequest = url.startsWith("http://") ? httpRequest : httpsRequest;
+  return new Promise((resolve3, reject) => {
+    const req = doRequest(url, { method: "POST", headers }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => resolve3({ status: res.statusCode ?? 500, body: Buffer.concat(chunks).toString("utf8") }));
+      res.on("error", reject);
+    });
+    req.on("error", reject);
+    req.write(body);
+    req.end();
+  });
+}
+var curlImpersonateAvailable = null;
+function curlImpersonatePost(url, headers, body) {
+  return new Promise((resolve3, reject) => {
+    const args = ["-s", "-w", "\n%{http_code}", "-X", "POST", url];
+    for (const [k, v] of Object.entries(headers)) {
+      if (k.toLowerCase() === "content-length") continue;
+      args.push("-H", `${k}: ${String(v)}`);
+    }
+    args.push("--data-binary", "@-");
+    const proc = spawn2("curl-impersonate-chrome", args, {
+      env: { ...process.env, CURL_IMPERSONATE: "chrome116" },
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const chunks = [];
+    proc.stdout.on("data", (c) => chunks.push(c));
+    proc.on("error", (e) => {
+      curlImpersonateAvailable = false;
+      reject(e);
+    });
+    proc.on("close", (code) => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      const lastNewline = raw.lastIndexOf("\n");
+      const statusStr = lastNewline >= 0 ? raw.slice(lastNewline + 1).trim() : "";
+      const responseBody = lastNewline >= 0 ? raw.slice(0, lastNewline) : raw;
+      const status = parseInt(statusStr, 10) || (code === 0 ? 200 : 500);
+      curlImpersonateAvailable = true;
+      resolve3({ status, body: responseBody });
+    });
+    proc.stdin.write(body);
+    proc.stdin.end();
   });
 }
 async function proxyTranscribe(body, contentType, authToken, accountId) {
-  const headers = {
+  const chatgptHeaders = {
     "Content-Type": contentType,
     "Content-Length": body.length,
     Authorization: `Bearer ${authToken}`,
     originator: "Codex Desktop",
     "User-Agent": `Codex Desktop/0.1.0 (${process.platform}; ${process.arch})`
   };
-  if (accountId) {
-    headers["ChatGPT-Account-Id"] = accountId;
+  if (accountId) chatgptHeaders["ChatGPT-Account-Id"] = accountId;
+  const postFn = curlImpersonateAvailable !== false ? curlImpersonatePost : httpPost;
+  let result;
+  try {
+    result = await postFn("https://chatgpt.com/backend-api/transcribe", chatgptHeaders, body);
+  } catch {
+    result = await httpPost("https://chatgpt.com/backend-api/transcribe", chatgptHeaders, body);
   }
-  return new Promise((resolve3, reject) => {
-    const req = httpsRequest(
-      "https://chatgpt.com/backend-api/transcribe",
-      { method: "POST", headers },
-      (res) => {
-        const chunks = [];
-        res.on("data", (c) => chunks.push(c));
-        res.on("end", () => resolve3({ status: res.statusCode ?? 500, body: Buffer.concat(chunks).toString("utf8") }));
-        res.on("error", reject);
+  if (result.status === 403 && result.body.includes("cf_chl")) {
+    if (curlImpersonateAvailable !== false && postFn !== curlImpersonatePost) {
+      try {
+        const ciResult = await curlImpersonatePost("https://chatgpt.com/backend-api/transcribe", chatgptHeaders, body);
+        if (ciResult.status !== 403) return ciResult;
+      } catch {
       }
-    );
-    req.on("error", reject);
-    req.write(body);
-    req.end();
-  });
+    }
+    return { status: 503, body: JSON.stringify({ error: "Transcription blocked by Cloudflare. Install curl-impersonate-chrome." }) };
+  }
+  return result;
 }
 var AppServerProcess = class {
   constructor() {
@@ -1544,10 +2582,18 @@ var AppServerProcess = class {
       'sandbox_mode="danger-full-access"'
     ];
   }
+  getCodexCommand() {
+    const codexCommand = resolveCodexCommand();
+    if (!codexCommand) {
+      throw new Error("Codex CLI is not available. Install @openai/codex or set CODEXUI_CODEX_COMMAND.");
+    }
+    return codexCommand;
+  }
   start() {
     if (this.process) return;
     this.stopping = false;
-    const proc = spawn2("codex", this.appServerArgs, { stdio: ["pipe", "pipe", "pipe"] });
+    const invocation = getSpawnInvocation(this.getCodexCommand(), this.appServerArgs);
+    const proc = spawn2(invocation.command, invocation.args, { stdio: ["pipe", "pipe", "pipe"] });
     this.process = proc;
     proc.stdout.setEncoding("utf8");
     proc.stdout.on("data", (chunk) => {
@@ -1641,7 +2687,7 @@ var AppServerProcess = class {
     }
     this.pendingServerRequests.delete(requestId);
     this.sendServerRequestReply(requestId, reply);
-    const requestParams = asRecord2(pendingRequest.params);
+    const requestParams = asRecord3(pendingRequest.params);
     const threadId = typeof requestParams?.threadId === "string" && requestParams.threadId.length > 0 ? requestParams.threadId : "";
     this.emitNotification({
       method: "server/request/resolved",
@@ -1710,7 +2756,7 @@ var AppServerProcess = class {
   }
   async respondToServerRequest(payload) {
     await this.ensureInitialized();
-    const body = asRecord2(payload);
+    const body = asRecord3(payload);
     if (!body) {
       throw new Error("Invalid response payload: expected object");
     }
@@ -1718,7 +2764,7 @@ var AppServerProcess = class {
     if (typeof id !== "number" || !Number.isInteger(id)) {
       throw new Error('Invalid response payload: "id" must be an integer');
     }
-    const rawError = asRecord2(body.error);
+    const rawError = asRecord3(body.error);
     if (rawError) {
       const message = typeof rawError.message === "string" && rawError.message.trim().length > 0 ? rawError.message.trim() : "Server request rejected by client";
       const code = typeof rawError.code === "number" && Number.isFinite(rawError.code) ? Math.trunc(rawError.code) : -32e3;
@@ -1773,7 +2819,13 @@ var MethodCatalog = class {
   }
   async runGenerateSchemaCommand(outDir) {
     await new Promise((resolve3, reject) => {
-      const process2 = spawn2("codex", ["app-server", "generate-json-schema", "--out", outDir], {
+      const codexCommand = resolveCodexCommand();
+      if (!codexCommand) {
+        reject(new Error("Codex CLI is not available. Install @openai/codex or set CODEXUI_CODEX_COMMAND."));
+        return;
+      }
+      const invocation = getSpawnInvocation(codexCommand, ["app-server", "generate-json-schema", "--out", outDir]);
+      const process2 = spawn2(invocation.command, invocation.args, {
         stdio: ["ignore", "ignore", "pipe"]
       });
       let stderr = "";
@@ -1792,13 +2844,13 @@ var MethodCatalog = class {
     });
   }
   extractMethodsFromClientRequest(payload) {
-    const root = asRecord2(payload);
+    const root = asRecord3(payload);
     const oneOf = Array.isArray(root?.oneOf) ? root.oneOf : [];
     const methods = /* @__PURE__ */ new Set();
     for (const entry of oneOf) {
-      const row = asRecord2(entry);
-      const properties = asRecord2(row?.properties);
-      const methodDef = asRecord2(properties?.method);
+      const row = asRecord3(entry);
+      const properties = asRecord3(row?.properties);
+      const methodDef = asRecord3(properties?.method);
       const methodEnum = Array.isArray(methodDef?.enum) ? methodDef.enum : [];
       for (const item of methodEnum) {
         if (typeof item === "string" && item.length > 0) {
@@ -1809,13 +2861,13 @@ var MethodCatalog = class {
     return Array.from(methods).sort((a, b) => a.localeCompare(b));
   }
   extractMethodsFromServerNotification(payload) {
-    const root = asRecord2(payload);
+    const root = asRecord3(payload);
     const oneOf = Array.isArray(root?.oneOf) ? root.oneOf : [];
     const methods = /* @__PURE__ */ new Set();
     for (const entry of oneOf) {
-      const row = asRecord2(entry);
-      const properties = asRecord2(row?.properties);
-      const methodDef = asRecord2(properties?.method);
+      const row = asRecord3(entry);
+      const properties = asRecord3(row?.properties);
+      const methodDef = asRecord3(properties?.method);
       const methodEnum = Array.isArray(methodDef?.enum) ? methodDef.enum : [];
       for (const item of methodEnum) {
         if (typeof item === "string" && item.length > 0) {
@@ -1829,9 +2881,9 @@ var MethodCatalog = class {
     if (this.methodCache) {
       return this.methodCache;
     }
-    const outDir = await mkdtemp2(join2(tmpdir2(), "codex-web-local-schema-"));
+    const outDir = await mkdtemp2(join3(tmpdir2(), "codex-web-local-schema-"));
     await this.runGenerateSchemaCommand(outDir);
-    const clientRequestPath = join2(outDir, "ClientRequest.json");
+    const clientRequestPath = join3(outDir, "ClientRequest.json");
     const raw = await readFile2(clientRequestPath, "utf8");
     const parsed = JSON.parse(raw);
     const methods = this.extractMethodsFromClientRequest(parsed);
@@ -1842,9 +2894,9 @@ var MethodCatalog = class {
     if (this.notificationCache) {
       return this.notificationCache;
     }
-    const outDir = await mkdtemp2(join2(tmpdir2(), "codex-web-local-schema-"));
+    const outDir = await mkdtemp2(join3(tmpdir2(), "codex-web-local-schema-"));
     await this.runGenerateSchemaCommand(outDir);
-    const serverNotificationPath = join2(outDir, "ServerNotification.json");
+    const serverNotificationPath = join3(outDir, "ServerNotification.json");
     const raw = await readFile2(serverNotificationPath, "utf8");
     const parsed = JSON.parse(raw);
     const methods = this.extractMethodsFromServerNotification(parsed);
@@ -1857,9 +2909,11 @@ function getSharedBridgeState() {
   const globalScope = globalThis;
   const existing = globalScope[SHARED_BRIDGE_KEY];
   if (existing) return existing;
+  const appServer = new AppServerProcess();
   const created = {
-    appServer: new AppServerProcess(),
-    methodCatalog: new MethodCatalog()
+    appServer,
+    methodCatalog: new MethodCatalog(),
+    telegramBridge: new TelegramThreadBridge(appServer)
   };
   globalScope[SHARED_BRIDGE_KEY] = created;
   return created;
@@ -1868,7 +2922,7 @@ async function loadAllThreadsForSearch(appServer) {
   const threads = [];
   let cursor = null;
   do {
-    const response = asRecord2(await appServer.rpc("thread/list", {
+    const response = asRecord3(await appServer.rpc("thread/list", {
       archived: false,
       limit: 100,
       sortKey: "updated_at",
@@ -1876,7 +2930,7 @@ async function loadAllThreadsForSearch(appServer) {
     }));
     const data = Array.isArray(response?.data) ? response.data : [];
     for (const row of data) {
-      const record = asRecord2(row);
+      const record = asRecord3(row);
       const id = typeof record?.id === "string" ? record.id : "";
       if (!id) continue;
       const title = typeof record?.name === "string" && record.name.trim().length > 0 ? record.name.trim() : typeof record?.preview === "string" && record.preview.trim().length > 0 ? record.preview.trim() : "Untitled thread";
@@ -1925,7 +2979,7 @@ async function buildThreadSearchIndex(appServer) {
   return { docsById };
 }
 function createCodexBridgeMiddleware() {
-  const { appServer, methodCatalog } = getSharedBridgeState();
+  const { appServer, methodCatalog, telegramBridge } = getSharedBridgeState();
   let threadSearchIndex = null;
   let threadSearchIndexPromise = null;
   async function getThreadSearchIndex() {
@@ -1941,6 +2995,12 @@ function createCodexBridgeMiddleware() {
     return threadSearchIndexPromise;
   }
   void initializeSkillsSyncOnStartup(appServer);
+  void readTelegramBridgeConfig().then((config) => {
+    if (!config.botToken) return;
+    telegramBridge.configureToken(config.botToken);
+    telegramBridge.start();
+  }).catch(() => {
+  });
   const middleware = async (req, res, next) => {
     try {
       if (!req.url) {
@@ -1957,7 +3017,7 @@ function createCodexBridgeMiddleware() {
       }
       if (req.method === "POST" && url.pathname === "/codex-api/rpc") {
         const payload = await readJsonBody(req);
-        const body = asRecord2(payload);
+        const body = asRecord3(payload);
         if (!body || typeof body.method !== "string" || body.method.length === 0) {
           setJson2(res, 400, { error: "Invalid body: expected { method, params? }" });
           return;
@@ -2006,11 +3066,24 @@ function createCodexBridgeMiddleware() {
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/home-directory") {
-        setJson2(res, 200, { data: { path: homedir2() } });
+        setJson2(res, 200, { data: { path: homedir3() } });
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/codex-api/github-trending") {
+        const sinceRaw = (url.searchParams.get("since") ?? "").trim().toLowerCase();
+        const since = sinceRaw === "weekly" ? "weekly" : sinceRaw === "monthly" ? "monthly" : "daily";
+        const limitRaw = Number.parseInt((url.searchParams.get("limit") ?? "6").trim(), 10);
+        const limit = Number.isFinite(limitRaw) ? Math.max(1, Math.min(10, limitRaw)) : 6;
+        try {
+          const data = await fetchGithubTrending(since, limit);
+          setJson2(res, 200, { data });
+        } catch (error) {
+          setJson2(res, 502, { error: getErrorMessage3(error, "Failed to fetch GitHub trending") });
+        }
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/worktree/create") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord3(await readJsonBody(req));
         const rawSourceCwd = typeof payload?.sourceCwd === "string" ? payload.sourceCwd.trim() : "";
         if (!rawSourceCwd) {
           setJson2(res, 400, { error: "Missing sourceCwd" });
@@ -2036,22 +3109,22 @@ function createCodexBridgeMiddleware() {
             await runCommand2("git", ["init"], { cwd: sourceCwd });
             gitRoot = await runCommandCapture("git", ["rev-parse", "--show-toplevel"], { cwd: sourceCwd });
           }
-          const repoName = basename(gitRoot) || "repo";
-          const worktreesRoot = join2(getCodexHomeDir2(), "worktrees");
+          const repoName = basename3(gitRoot) || "repo";
+          const worktreesRoot = join3(getCodexHomeDir2(), "worktrees");
           await mkdir2(worktreesRoot, { recursive: true });
           let worktreeId = "";
           let worktreeParent = "";
           let worktreeCwd = "";
           for (let attempt = 0; attempt < 12; attempt += 1) {
             const candidate = randomBytes(2).toString("hex");
-            const parent = join2(worktreesRoot, candidate);
+            const parent = join3(worktreesRoot, candidate);
             try {
               await stat2(parent);
               continue;
             } catch {
               worktreeId = candidate;
               worktreeParent = parent;
-              worktreeCwd = join2(parent, repoName);
+              worktreeCwd = join3(parent, repoName);
               break;
             }
           }
@@ -2075,13 +3148,106 @@ function createCodexBridgeMiddleware() {
             }
           });
         } catch (error) {
-          setJson2(res, 500, { error: getErrorMessage2(error, "Failed to create worktree") });
+          setJson2(res, 500, { error: getErrorMessage3(error, "Failed to create worktree") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/worktree/auto-commit") {
+        const payload = asRecord3(await readJsonBody(req));
+        const rawCwd = typeof payload?.cwd === "string" ? payload.cwd.trim() : "";
+        const commitMessage = normalizeCommitMessage(payload?.message);
+        if (!rawCwd) {
+          setJson2(res, 400, { error: "Missing cwd" });
+          return;
+        }
+        if (!commitMessage) {
+          setJson2(res, 400, { error: "Missing message" });
+          return;
+        }
+        const cwd = isAbsolute(rawCwd) ? rawCwd : resolve(rawCwd);
+        try {
+          const cwdInfo = await stat2(cwd);
+          if (!cwdInfo.isDirectory()) {
+            setJson2(res, 400, { error: "cwd is not a directory" });
+            return;
+          }
+        } catch {
+          setJson2(res, 404, { error: "cwd does not exist" });
+          return;
+        }
+        try {
+          await ensureRollbackGitRepo(cwd);
+          const beforeStatus = await runRollbackGitWithOutput(cwd, ["status", "--porcelain"]);
+          if (!beforeStatus.trim()) {
+            setJson2(res, 200, { data: { committed: false } });
+            return;
+          }
+          await runRollbackGit(cwd, ["add", "-A"]);
+          const stagedStatus = await runRollbackGitWithOutput(cwd, ["diff", "--cached", "--name-only"]);
+          if (!stagedStatus.trim()) {
+            setJson2(res, 200, { data: { committed: false } });
+            return;
+          }
+          await runRollbackGit(cwd, ["commit", "-m", commitMessage]);
+          setJson2(res, 200, { data: { committed: true } });
+        } catch (error) {
+          setJson2(res, 500, { error: getErrorMessage3(error, "Failed to auto-commit rollback changes") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/worktree/rollback-to-message") {
+        const payload = asRecord3(await readJsonBody(req));
+        const rawCwd = typeof payload?.cwd === "string" ? payload.cwd.trim() : "";
+        const commitMessage = normalizeCommitMessage(payload?.message);
+        if (!rawCwd) {
+          setJson2(res, 400, { error: "Missing cwd" });
+          return;
+        }
+        if (!commitMessage) {
+          setJson2(res, 400, { error: "Missing message" });
+          return;
+        }
+        const cwd = isAbsolute(rawCwd) ? rawCwd : resolve(rawCwd);
+        try {
+          const cwdInfo = await stat2(cwd);
+          if (!cwdInfo.isDirectory()) {
+            setJson2(res, 400, { error: "cwd is not a directory" });
+            return;
+          }
+        } catch {
+          setJson2(res, 404, { error: "cwd does not exist" });
+          return;
+        }
+        try {
+          await ensureRollbackGitRepo(cwd);
+          const commitSha = await findRollbackCommitByExactMessage(cwd, commitMessage);
+          if (!commitSha) {
+            setJson2(res, 404, { error: "No matching commit found for this user message" });
+            return;
+          }
+          let resetTargetSha = "";
+          try {
+            resetTargetSha = await runRollbackGitCapture(cwd, ["rev-parse", `${commitSha}^`]);
+          } catch {
+            setJson2(res, 409, { error: "Cannot rollback: matched commit has no parent commit" });
+            return;
+          }
+          let stashed = false;
+          if (await hasRollbackGitWorkingTreeChanges(cwd)) {
+            const stashMessage = `codex-auto-stash-before-rollback-${Date.now()}`;
+            await runRollbackGit(cwd, ["stash", "push", "-u", "-m", stashMessage]);
+            stashed = true;
+          }
+          await runRollbackGit(cwd, ["reset", "--hard", resetTargetSha]);
+          setJson2(res, 200, { data: { reset: true, commitSha, resetTargetSha, stashed } });
+        } catch (error) {
+          setJson2(res, 500, { error: getErrorMessage3(error, "Failed to rollback project to user message commit") });
         }
         return;
       }
       if (req.method === "PUT" && url.pathname === "/codex-api/workspace-roots-state") {
         const payload = await readJsonBody(req);
-        const record = asRecord2(payload);
+        const record = asRecord3(payload);
         if (!record) {
           setJson2(res, 400, { error: "Invalid body: expected object" });
           return;
@@ -2096,7 +3262,7 @@ function createCodexBridgeMiddleware() {
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/project-root") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord3(await readJsonBody(req));
         const rawPath = typeof payload?.path === "string" ? payload.path.trim() : "";
         const createIfMissing = payload?.createIfMissing === true;
         const label = typeof payload?.label === "string" ? payload.label : "";
@@ -2156,7 +3322,7 @@ function createCodexBridgeMiddleware() {
         let index = 1;
         while (index < 1e5) {
           const candidateName = `New Project (${String(index)})`;
-          const candidatePath = join2(normalizedBasePath, candidateName);
+          const candidatePath = join3(normalizedBasePath, candidateName);
           try {
             await stat2(candidatePath);
             index += 1;
@@ -2170,7 +3336,7 @@ function createCodexBridgeMiddleware() {
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/composer-file-search") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord3(await readJsonBody(req));
         const rawCwd = typeof payload?.cwd === "string" ? payload.cwd.trim() : "";
         const query = typeof payload?.query === "string" ? payload.query.trim() : "";
         const limitRaw = typeof payload?.limit === "number" ? payload.limit : 20;
@@ -2195,17 +3361,17 @@ function createCodexBridgeMiddleware() {
           const scored = files.map((path) => ({ path, score: scoreFileCandidate(path, query) })).filter((row) => query.length === 0 || row.score < 10).sort((a, b) => a.score - b.score || a.path.localeCompare(b.path)).slice(0, limit).map((row) => ({ path: row.path }));
           setJson2(res, 200, { data: scored });
         } catch (error) {
-          setJson2(res, 500, { error: getErrorMessage2(error, "Failed to search files") });
+          setJson2(res, 500, { error: getErrorMessage3(error, "Failed to search files") });
         }
         return;
       }
       if (req.method === "GET" && url.pathname === "/codex-api/thread-titles") {
-        const cache = await readThreadTitleCache();
+        const cache = await readMergedThreadTitleCache();
         setJson2(res, 200, { data: cache });
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/thread-search") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord3(await readJsonBody(req));
         const query = typeof payload?.query === "string" ? payload.query.trim() : "";
         const limitRaw = typeof payload?.limit === "number" ? payload.limit : 200;
         const limit = Math.max(1, Math.min(1e3, Math.floor(limitRaw)));
@@ -2219,7 +3385,7 @@ function createCodexBridgeMiddleware() {
         return;
       }
       if (req.method === "PUT" && url.pathname === "/codex-api/thread-titles") {
-        const payload = asRecord2(await readJsonBody(req));
+        const payload = asRecord3(await readJsonBody(req));
         const id = typeof payload?.id === "string" ? payload.id : "";
         const title = typeof payload?.title === "string" ? payload.title : "";
         if (!id) {
@@ -2232,6 +3398,23 @@ function createCodexBridgeMiddleware() {
         setJson2(res, 200, { ok: true });
         return;
       }
+      if (req.method === "POST" && url.pathname === "/codex-api/telegram/configure-bot") {
+        const payload = asRecord3(await readJsonBody(req));
+        const botToken = typeof payload?.botToken === "string" ? payload.botToken.trim() : "";
+        if (!botToken) {
+          setJson2(res, 400, { error: "Missing botToken" });
+          return;
+        }
+        telegramBridge.configureToken(botToken);
+        telegramBridge.start();
+        await writeTelegramBridgeConfig({ botToken });
+        setJson2(res, 200, { ok: true });
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/codex-api/telegram/status") {
+        setJson2(res, 200, { data: telegramBridge.getStatus() });
+        return;
+      }
       if (req.method === "GET" && url.pathname === "/codex-api/events") {
         res.statusCode = 200;
         res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
@@ -2264,12 +3447,13 @@ data: ${JSON.stringify({ ok: true })}
       }
       next();
     } catch (error) {
-      const message = getErrorMessage2(error, "Unknown bridge error");
+      const message = getErrorMessage3(error, "Unknown bridge error");
       setJson2(res, 502, { error: message });
     }
   };
   middleware.dispose = () => {
     threadSearchIndex = null;
+    telegramBridge.stop();
     appServer.dispose();
   };
   middleware.subscribeNotifications = (listener) => {
@@ -2402,7 +3586,7 @@ function createAuthSession(password) {
 }
 
 // src/server/localBrowseUi.ts
-import { dirname, extname, join as join3 } from "path";
+import { dirname as dirname2, extname as extname2, join as join4 } from "path";
 import { open, readFile as readFile3, readdir as readdir3, stat as stat3 } from "fs/promises";
 var TEXT_EDITABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
@@ -2433,7 +3617,7 @@ var TEXT_EDITABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".ps1"
 ]);
 function languageForPath(pathValue) {
-  const extension = extname(pathValue).toLowerCase();
+  const extension = extname2(pathValue).toLowerCase();
   switch (extension) {
     case ".js":
       return "javascript";
@@ -2494,7 +3678,7 @@ function decodeBrowsePath(rawPath) {
   }
 }
 function isTextEditablePath(pathValue) {
-  return TEXT_EDITABLE_EXTENSIONS.has(extname(pathValue).toLowerCase());
+  return TEXT_EDITABLE_EXTENSIONS.has(extname2(pathValue).toLowerCase());
 }
 function looksLikeTextBuffer(buffer) {
   if (buffer.length === 0) return true;
@@ -2540,7 +3724,7 @@ function escapeForInlineScriptString(value) {
 async function getDirectoryItems(localPath) {
   const entries = await readdir3(localPath, { withFileTypes: true });
   const withMeta = await Promise.all(entries.map(async (entry) => {
-    const entryPath = join3(localPath, entry.name);
+    const entryPath = join4(localPath, entry.name);
     const entryStat = await stat3(entryPath);
     const editable = !entry.isDirectory() && await isTextEditableFile(entryPath);
     return {
@@ -2560,13 +3744,13 @@ async function getDirectoryItems(localPath) {
 }
 async function createDirectoryListingHtml(localPath) {
   const items = await getDirectoryItems(localPath);
-  const parentPath = dirname(localPath);
+  const parentPath = dirname2(localPath);
   const rows = items.map((item) => {
     const suffix = item.isDirectory ? "/" : "";
     const editAction = item.editable ? ` <a class="icon-btn" aria-label="Edit ${escapeHtml(item.name)}" href="${escapeHtml(toEditHref(item.path))}" title="Edit">\u270F\uFE0F</a>` : "";
-    return `<li class="file-row"><a class="file-link" href="${escapeHtml(toBrowseHref(item.path))}">${escapeHtml(item.name)}${suffix}</a>${editAction}</li>`;
+    return `<li class="file-row"><a class="file-link" href="${escapeHtml(toBrowseHref(item.path))}">${escapeHtml(item.name)}${suffix}</a><span class="row-actions">${editAction}</span></li>`;
   }).join("\n");
-  const parentLink = localPath !== parentPath ? `<p><a href="${escapeHtml(toBrowseHref(parentPath))}">..</a></p>` : "";
+  const parentLink = localPath !== parentPath ? `<a href="${escapeHtml(toBrowseHref(parentPath))}">..</a>` : "";
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -2580,8 +3764,27 @@ async function createDirectoryListingHtml(localPath) {
     ul { list-style: none; padding: 0; margin: 12px 0 0; display: flex; flex-direction: column; gap: 8px; }
     .file-row { display: grid; grid-template-columns: minmax(0,1fr) auto; align-items: center; gap: 10px; }
     .file-link { display: block; padding: 10px 12px; border: 1px solid #28405f; border-radius: 10px; background: #0f1b33; overflow-wrap: anywhere; }
-    .icon-btn { display: inline-flex; align-items: center; justify-content: center; width: 42px; height: 42px; border: 1px solid #36557a; border-radius: 10px; background: #162643; text-decoration: none; }
+    .header-actions { display: flex; align-items: center; gap: 10px; margin-top: 10px; flex-wrap: wrap; }
+    .header-parent-link { color: #9ec8ff; font-size: 14px; padding: 8px 10px; border: 1px solid #2a4569; border-radius: 10px; background: #101f3a; }
+    .header-parent-link:hover { text-decoration: none; filter: brightness(1.08); }
+    .header-open-btn {
+      height: 42px;
+      padding: 0 14px;
+      border: 1px solid #4f8de0;
+      border-radius: 10px;
+      background: linear-gradient(135deg, #2e6ee6 0%, #3d8cff 100%);
+      color: #eef6ff;
+      font-weight: 700;
+      letter-spacing: 0.01em;
+      cursor: pointer;
+      box-shadow: 0 6px 18px rgba(33, 90, 199, 0.35);
+    }
+    .header-open-btn:hover { filter: brightness(1.08); }
+    .header-open-btn:disabled { opacity: 0.6; cursor: default; }
+    .row-actions { display: inline-flex; align-items: center; gap: 8px; min-width: 42px; justify-content: flex-end; }
+    .icon-btn { display: inline-flex; align-items: center; justify-content: center; width: 42px; height: 42px; border: 1px solid #36557a; border-radius: 10px; background: #162643; color: #dbe6ff; text-decoration: none; cursor: pointer; }
     .icon-btn:hover { filter: brightness(1.08); text-decoration: none; }
+    .status { margin: 10px 0 0; color: #8cc2ff; min-height: 1.25em; }
     h1 { font-size: 18px; margin: 0; word-break: break-all; }
     @media (max-width: 640px) {
       body { margin: 12px; }
@@ -2593,14 +3796,52 @@ async function createDirectoryListingHtml(localPath) {
 </head>
 <body>
   <h1>Index of ${escapeHtml(localPath)}</h1>
-  ${parentLink}
+  <div class="header-actions">
+    ${parentLink ? `<a class="header-parent-link" href="${escapeHtml(toBrowseHref(parentPath))}">..</a>` : ""}
+    <button class="header-open-btn open-folder-btn" type="button" aria-label="Open current folder in Codex" title="Open folder in Codex" data-path="${escapeHtml(localPath)}">Open folder in Codex</button>
+  </div>
+  <p id="status" class="status"></p>
   <ul>${rows}</ul>
+  <script>
+    const status = document.getElementById('status');
+    document.addEventListener('click', async (event) => {
+      const target = event.target;
+      if (!(target instanceof Element)) return;
+      const button = target.closest('.open-folder-btn');
+      if (!(button instanceof HTMLButtonElement)) return;
+
+      const path = button.getAttribute('data-path') || '';
+      if (!path) return;
+      button.disabled = true;
+      status.textContent = 'Opening folder in Codex...';
+      try {
+        const response = await fetch('/codex-api/project-root', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            path,
+            createIfMissing: false,
+            label: '',
+          }),
+        });
+        if (!response.ok) {
+          status.textContent = 'Failed to open folder.';
+          button.disabled = false;
+          return;
+        }
+        window.location.assign('/#/');
+      } catch {
+        status.textContent = 'Failed to open folder.';
+        button.disabled = false;
+      }
+    });
+  </script>
 </body>
 </html>`;
 }
 async function createTextEditorHtml(localPath) {
   const content = await readFile3(localPath, "utf8");
-  const parentPath = dirname(localPath);
+  const parentPath = dirname2(localPath);
   const language = languageForPath(localPath);
   const safeContentLiteral = escapeForInlineScriptString(content);
   return `<!doctype html>
@@ -2669,9 +3910,9 @@ async function createTextEditorHtml(localPath) {
 
 // src/server/httpServer.ts
 import { WebSocketServer } from "ws";
-var __dirname = dirname2(fileURLToPath(import.meta.url));
-var distDir = join4(__dirname, "..", "dist");
-var spaEntryFile = join4(distDir, "index.html");
+var __dirname = dirname3(fileURLToPath(import.meta.url));
+var distDir = join5(__dirname, "..", "dist");
+var spaEntryFile = join5(distDir, "index.html");
 var IMAGE_CONTENT_TYPES = {
   ".avif": "image/avif",
   ".bmp": "image/bmp",
@@ -2728,7 +3969,7 @@ function createServer(options = {}) {
       res.status(400).json({ error: "Expected absolute local file path." });
       return;
     }
-    const contentType = IMAGE_CONTENT_TYPES[extname2(localPath).toLowerCase()];
+    const contentType = IMAGE_CONTENT_TYPES[extname3(localPath).toLowerCase()];
     if (!contentType) {
       res.status(415).json({ error: "Unsupported image type." });
       return;
@@ -2815,7 +4056,7 @@ function createServer(options = {}) {
       res.status(404).json({ error: "File not found." });
     }
   });
-  const hasFrontendAssets = existsSync2(spaEntryFile);
+  const hasFrontendAssets = existsSync4(spaEntryFile);
   if (hasFrontendAssets) {
     app.use(express.static(distDir));
   }
@@ -2885,10 +4126,26 @@ function generatePassword() {
 
 // src/cli/index.ts
 var program = new Command().name("codexui").description("Web interface for Codex app-server");
-var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
+var __dirname2 = dirname4(fileURLToPath2(import.meta.url));
+var hasPromptedCloudflaredInstall = false;
+function getCodexHomePath() {
+  return process.env.CODEX_HOME?.trim() || join6(homedir4(), ".codex");
+}
+function getCloudflaredPromptMarkerPath() {
+  return join6(getCodexHomePath(), ".cloudflared-install-prompted");
+}
+function hasPromptedCloudflaredInstallPersisted() {
+  return existsSync5(getCloudflaredPromptMarkerPath());
+}
+async function persistCloudflaredInstallPrompted() {
+  const codexHome = getCodexHomePath();
+  mkdirSync(codexHome, { recursive: true });
+  await writeFile4(getCloudflaredPromptMarkerPath(), `${Date.now()}
+`, "utf8");
+}
 async function readCliVersion() {
   try {
-    const packageJsonPath = join5(__dirname2, "..", "package.json");
+    const packageJsonPath = join6(__dirname2, "..", "package.json");
     const raw = await readFile4(packageJsonPath, "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.version === "string" ? parsed.version : "unknown";
@@ -2899,47 +4156,22 @@ async function readCliVersion() {
 function isTermuxRuntime() {
   return Boolean(process.env.TERMUX_VERSION || process.env.PREFIX?.includes("/com.termux/"));
 }
-function canRun(command, args = []) {
-  const result = spawnSync(command, args, { stdio: "ignore" });
-  return result.status === 0;
-}
 function runOrFail(command, args, label) {
-  const result = spawnSync(command, args, { stdio: "inherit" });
+  const result = spawnSyncCommand(command, args, { stdio: "inherit" });
   if (result.status !== 0) {
     throw new Error(`${label} failed with exit code ${String(result.status ?? -1)}`);
   }
 }
 function runWithStatus(command, args) {
-  const result = spawnSync(command, args, { stdio: "inherit" });
+  const result = spawnSyncCommand(command, args, { stdio: "inherit" });
   return result.status ?? -1;
 }
-function getUserNpmPrefix() {
-  return join5(homedir3(), ".npm-global");
-}
-function resolveCodexCommand() {
-  if (canRun("codex", ["--version"])) {
-    return "codex";
-  }
-  const userCandidate = join5(getUserNpmPrefix(), "bin", "codex");
-  if (existsSync3(userCandidate) && canRun(userCandidate, ["--version"])) {
-    return userCandidate;
-  }
-  const prefix = process.env.PREFIX?.trim();
-  if (!prefix) {
-    return null;
-  }
-  const candidate = join5(prefix, "bin", "codex");
-  if (existsSync3(candidate) && canRun(candidate, ["--version"])) {
-    return candidate;
-  }
-  return null;
-}
 function resolveCloudflaredCommand() {
-  if (canRun("cloudflared", ["--version"])) {
+  if (canRunCommand("cloudflared", ["--version"])) {
     return "cloudflared";
   }
-  const localCandidate = join5(homedir3(), ".local", "bin", "cloudflared");
-  if (existsSync3(localCandidate) && canRun(localCandidate, ["--version"])) {
+  const localCandidate = join6(homedir4(), ".local", "bin", "cloudflared");
+  if (existsSync5(localCandidate) && canRunCommand(localCandidate, ["--version"])) {
     return localCandidate;
   }
   return null;
@@ -2992,14 +4224,14 @@ async function ensureCloudflaredInstalledLinux() {
   if (!mappedArch) {
     throw new Error(`cloudflared auto-install is not supported for Linux architecture: ${process.arch}`);
   }
-  const userBinDir = join5(homedir3(), ".local", "bin");
+  const userBinDir = join6(homedir4(), ".local", "bin");
   mkdirSync(userBinDir, { recursive: true });
-  const destination = join5(userBinDir, "cloudflared");
+  const destination = join6(userBinDir, "cloudflared");
   const downloadUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${mappedArch}`;
   console.log("\ncloudflared not found. Installing to ~/.local/bin...\n");
   await downloadFile(downloadUrl, destination);
   chmodSync(destination, 493);
-  process.env.PATH = `${userBinDir}:${process.env.PATH ?? ""}`;
+  process.env.PATH = prependPathEntry(process.env.PATH ?? "", userBinDir);
   const installed = resolveCloudflaredCommand();
   if (!installed) {
     throw new Error("cloudflared download completed but executable is still not available");
@@ -3008,11 +4240,19 @@ async function ensureCloudflaredInstalledLinux() {
   return installed;
 }
 async function shouldInstallCloudflaredInteractively() {
+  if (hasPromptedCloudflaredInstall || hasPromptedCloudflaredInstallPersisted()) {
+    return false;
+  }
+  hasPromptedCloudflaredInstall = true;
+  await persistCloudflaredInstallPrompted();
+  if (process.platform === "win32") {
+    return false;
+  }
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     console.warn("\n[cloudflared] cloudflared is missing and terminal is non-interactive, skipping install.");
     return false;
   }
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     const answer = await prompt.question("cloudflared is not installed. Install it now to ~/.local/bin? [y/N] ");
     const normalized = answer.trim().toLowerCase();
@@ -3026,6 +4266,9 @@ async function resolveCloudflaredForTunnel() {
   if (current) {
     return current;
   }
+  if (process.platform === "win32") {
+    return null;
+  }
   const installApproved = await shouldInstallCloudflaredInteractively();
   if (!installApproved) {
     return null;
@@ -3033,8 +4276,8 @@ async function resolveCloudflaredForTunnel() {
   return ensureCloudflaredInstalledLinux();
 }
 function hasCodexAuth() {
-  const codexHome = process.env.CODEX_HOME?.trim() || join5(homedir3(), ".codex");
-  return existsSync3(join5(codexHome, "auth.json"));
+  const codexHome = getCodexHomePath();
+  return existsSync5(join6(codexHome, "auth.json"));
 }
 function ensureCodexInstalled() {
   let codexCommand = resolveCodexCommand();
@@ -3052,7 +4295,7 @@ function ensureCodexInstalled() {
 Global npm install requires elevated permissions. Retrying with --prefix ${userPrefix}...
 `);
       runOrFail("npm", ["install", "-g", "--prefix", userPrefix, pkg], `${label} (user prefix)`);
-      process.env.PATH = `${join5(userPrefix, "bin")}:${process.env.PATH ?? ""}`;
+      process.env.PATH = prependPathEntry(process.env.PATH ?? "", getNpmGlobalBinDir(userPrefix));
     };
     if (isTermuxRuntime()) {
       console.log("\nCodex CLI not found. Installing Termux-compatible Codex CLI from npm...\n");
@@ -3115,19 +4358,22 @@ function parseCloudflaredUrl(chunk) {
 }
 function getAccessibleUrls(port) {
   const urls = /* @__PURE__ */ new Set([`http://localhost:${String(port)}`]);
-  const interfaces = networkInterfaces();
-  for (const entries of Object.values(interfaces)) {
-    if (!entries) {
-      continue;
-    }
-    for (const entry of entries) {
-      if (entry.internal) {
+  try {
+    const interfaces = networkInterfaces();
+    for (const entries of Object.values(interfaces)) {
+      if (!entries) {
         continue;
       }
-      if (entry.family === "IPv4") {
-        urls.add(`http://${entry.address}:${String(port)}`);
+      for (const entry of entries) {
+        if (entry.internal) {
+          continue;
+        }
+        if (entry.family === "IPv4") {
+          urls.add(`http://${entry.address}:${String(port)}`);
+        }
       }
     }
+  } catch {
   }
   return Array.from(urls);
 }
@@ -3190,8 +4436,8 @@ function listenWithFallback(server, startPort) {
   });
 }
 function getCodexGlobalStatePath2() {
-  const codexHome = process.env.CODEX_HOME?.trim() || join5(homedir3(), ".codex");
-  return join5(codexHome, ".codex-global-state.json");
+  const codexHome = getCodexHomePath();
+  return join6(codexHome, ".codex-global-state.json");
 }
 function normalizeUniqueStrings(value) {
   if (!Array.isArray(value)) return [];
@@ -3256,6 +4502,9 @@ async function startServer(options) {
     }
   }
   const codexCommand = ensureCodexInstalled() ?? resolveCodexCommand();
+  if (codexCommand) {
+    process.env.CODEXUI_CODEX_COMMAND = codexCommand;
+  }
   if (!hasCodexAuth() && codexCommand) {
     console.log("\nCodex is not logged in. Starting `codex login`...\n");
     runOrFail(codexCommand, ["login"], "Codex login");
@@ -3315,7 +4564,7 @@ async function startServer(options) {
     qrcode.generate(tunnelUrl, { small: true });
     console.log("");
   }
-  openBrowser(`http://localhost:${String(port)}`);
+  if (options.open) openBrowser(`http://localhost:${String(port)}`);
   function shutdown() {
     console.log("\nShutting down...");
     if (tunnelChild && !tunnelChild.killed) {
@@ -3335,10 +4584,11 @@ async function startServer(options) {
 }
 async function runLogin() {
   const codexCommand = ensureCodexInstalled() ?? "codex";
+  process.env.CODEXUI_CODEX_COMMAND = codexCommand;
   console.log("\nStarting `codex login`...\n");
   runOrFail(codexCommand, ["login"], "Codex login");
 }
-program.argument("[projectPath]", "project directory to open on launch").option("--open-project <path>", "open project directory on launch (Codex desktop parity)").option("-p, --port <port>", "port to listen on", "5999").option("--password <pass>", "set a specific password").option("--no-password", "disable password protection").option("--tunnel", "start cloudflared tunnel", true).option("--no-tunnel", "disable cloudflared tunnel startup").action(async (projectPath, opts) => {
+program.argument("[projectPath]", "project directory to open on launch").option("--open-project <path>", "open project directory on launch (Codex desktop parity)").option("-p, --port <port>", "port to listen on", "5999").option("--password <pass>", "set a specific password").option("--no-password", "disable password protection").option("--tunnel", "start cloudflared tunnel", true).option("--no-tunnel", "disable cloudflared tunnel startup").option("--open", "open browser on startup", true).option("--no-open", "do not open browser on startup").action(async (projectPath, opts) => {
   const rawArgv = process.argv.slice(2);
   const openProjectFlagIndex = rawArgv.findIndex((arg) => arg === "--open-project" || arg.startsWith("--open-project="));
   let openProjectOnly = (opts.openProject ?? "").trim();