codexgpt 1.0.0

package/scripts/analysis-smoke.mjs

@@ -0,0 +1,179 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const importBuilt = (relativePath) => import(pathToFileURL(path.join(projectRoot, 'dist', relativePath)).href);
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'codexgpt-analysis-'));
+const outside = await fs.mkdtemp(path.join(os.tmpdir(), 'codexgpt-analysis-outside-'));
+
+async function write(relativePath, content) {
+  const target = path.join(tmp, relativePath);
+  await fs.mkdir(path.dirname(target), { recursive: true });
+  await fs.writeFile(target, content, 'utf8');
+}
+
+try {
+  await write('package.json', JSON.stringify({ name: 'fixture', packageManager: 'pnpm@9.15.0', scripts: { test: 'node --test' } }, null, 2));
+  await write('src/index.ts', "import { authenticate } from './auth.js';\nexport const ready = authenticate('demo');\n");
+  await write('src/auth.ts', 'export function authenticate(user: string) { return Boolean(user); }\n');
+  await write('src/race.ts', 'export function temporaryFile() { return true; }\n');
+  await write('test/auth.test.ts', "import { authenticate } from '../src/auth.js';\nvoid authenticate('test');\n");
+  await write('README.md', '# Fixture\n');
+  await write('.env', 'PRIVATE_TOKEN=never-visible\n');
+  await write('python/service.py', 'def load_user(user_id):\n    return user_id\n');
+  await write('go/service.go', 'package service\nfunc LoadUser(id string) string { return id }\n');
+  await write('go.mod', 'module example.com/fixture\n\ngo 1.24\n');
+  await write('rust/service.rs', 'pub fn load_user(id: &str) -> &str { id }\n');
+  await write('swift/Service.swift', 'public func loadUser(_ id: String) -> String { id }\n');
+  await write('java/Service.java', 'public class Service { }\n');
+  await write('csharp/Service.cs', 'public class Service { }\n');
+  await write('c/service.c', 'int load_user(int id) { return id; }\n');
+  await write('cpp/service.cpp', 'class Service { };\n');
+  await write('notes/many.txt', Array.from({ length: 20 }, (_, index) => `common marker ${index}`).join('\n') + '\n');
+  await write('unknown/service.zig', 'pub fn loadUser() void {}\n');
+  await write('packages/core/package.json', JSON.stringify({ name: '@fixture/core' }, null, 2));
+  await write('packages/core/src/index.ts', 'export function coreValue() { return 1; }\n');
+  await write('packages/web/package.json', JSON.stringify({ name: '@fixture/web', dependencies: { '@fixture/core': 'workspace:*' } }, null, 2));
+  await write('packages/web/src/index.ts', "import { coreValue } from '../../core/src/index.js';\nexport const webValue = coreValue();\n");
+  await fs.writeFile(path.join(outside, 'outside.ts'), 'export const outside = true;\n', 'utf8');
+  let symlinkCreated = false;
+  try {
+    await fs.symlink(outside, path.join(tmp, 'outside-link'), 'dir');
+    symlinkCreated = true;
+  } catch (error) {
+    if (process.platform !== 'win32' || error?.code !== 'EPERM') throw error;
+  }
+
+  const [{ loadConfig }, { PathGuard, WorkspaceManager }, { inventoryWorkspace }, { extractWorkspaceFiles }, classification, analysisApi] = await Promise.all([
+    importBuilt('config.js'),
+    importBuilt('guard.js'),
+    importBuilt('analysis/inventory.js'),
+    importBuilt('analysis/extract.js'),
+    importBuilt('analysis/classify.js'),
+    importBuilt('analysis/index.js')
+  ]);
+  const config = loadConfig(['--root', tmp, '--bash', 'off', '--write', 'off']);
+  const guard = new PathGuard(config);
+  const workspace = new WorkspaceManager(config).defaultWorkspace();
+  const result = await inventoryWorkspace(config, guard, workspace);
+
+  assert(result.files.some((file) => file.path === 'src/index.ts' && file.language === 'typescript' && file.role === 'source'));
+  assert(result.files.some((file) => file.path === 'test/auth.test.ts' && file.role === 'test'));
+  assert(!result.files.some((file) => file.path === '.env'));
+  assert(classification.detectProjectTypes(result.files).includes('node'));
+  assert(result.files.some((file) => file.path === 'src/index.ts' && file.entrypoint === true));
+  assert.equal(result.coverage.inventoryFiles, result.files.length);
+  assert.match(result.fingerprint, /^[a-f0-9]{64}$/);
+  assert(result.files.some((file) => file.path === 'unknown/service.zig' && file.language === 'unknown'));
+  if (symlinkCreated) assert(!result.files.some((file) => file.path.startsWith('outside-link/')));
+  await fs.rm(path.join(tmp, 'src', 'race.ts'));
+  const changedDuringScan = await extractWorkspaceFiles(config, guard, workspace, result.files);
+  assert.equal(changedDuringScan.truncated, true);
+  assert(changedDuringScan.warnings.some((warning) => warning.includes('changed or became unreadable')));
+
+  const analysis = await analysisApi.inspectWorkspace(config, guard, workspace);
+  assert(analysis.symbols.some((symbol) => symbol.name === 'authenticate' && symbol.kind === 'function' && symbol.path === 'src/auth.ts'));
+  assert(analysis.relationships.some((edge) => edge.from === 'src/index.ts' && edge.to === 'src/auth.ts' && edge.kind === 'imports'));
+  assert(analysis.relationships.some((edge) => edge.from === 'packages/web/src/index.ts' && edge.to === 'packages/core/src/index.ts' && edge.kind === 'imports'));
+
+  const expectedSymbols = [
+    ['python/service.py', 'load_user'],
+    ['go/service.go', 'LoadUser'],
+    ['rust/service.rs', 'load_user'],
+    ['swift/Service.swift', 'loadUser'],
+    ['java/Service.java', 'Service'],
+    ['csharp/Service.cs', 'Service'],
+    ['c/service.c', 'load_user'],
+    ['cpp/service.cpp', 'Service']
+  ];
+  for (const [file, name] of expectedSymbols) {
+    assert(analysis.symbols.some((symbol) => symbol.path === file && symbol.name === name), `missing ${name} in ${file}`);
+  }
+
+  const structured = await analysisApi.searchWorkspaceStructured(config, guard, workspace, {
+    query: 'authenticate',
+    intent: 'symbol',
+    includeTests: true
+  });
+  assert.equal(structured.groups.definitions[0]?.path, 'src/auth.ts');
+  assert(structured.groups.tests.some((match) => match.path === 'test/auth.test.ts'));
+  assert(structured.groups.definitions[0].reasons.includes('symbol definition'));
+  const impactSearch = await analysisApi.searchWorkspaceStructured(config, guard, workspace, {
+    query: 'authenticate',
+    intent: 'impact',
+    includeTests: true
+  });
+  assert(impactSearch.groups.references.some((match) => match.path === 'src/index.ts' && match.reasons.includes('dependent module')));
+  assert(impactSearch.groups.tests.some((match) => match.path === 'test/auth.test.ts' && match.reasons.includes('dependent test')));
+
+  const cached = await analysisApi.inspectWorkspace(config, guard, workspace);
+  assert.equal(cached.cache.hit, true);
+  await fs.appendFile(path.join(tmp, 'src/auth.ts'), 'export function authorize() { return true; }\n', 'utf8');
+  analysisApi.invalidateWorkspaceAnalysis(workspace.id);
+  const refreshed = await analysisApi.inspectWorkspace(config, guard, workspace);
+  assert.equal(refreshed.cache.hit, false);
+  assert(refreshed.symbols.some((symbol) => symbol.name === 'authorize'));
+
+  const review = await analysisApi.reviewWorkspaceChanges(config, guard, workspace, { changedPaths: ['src/auth.ts'] });
+  assert(review.affectedAreas.includes('src'));
+  assert(review.dependentFiles.some((file) => file.path === 'src/index.ts'));
+  assert(review.relatedTests.some((file) => file.path === 'test/auth.test.ts'));
+  assert(review.riskSignals.some((risk) => risk.id === 'authentication'));
+  assert(review.recommendedCommands.some((item) => item.command === 'pnpm test' && item.source === 'package.json'));
+  assert(review.recommendedCommands.some((item) => item.command === 'go test ./...' && item.source === 'go.mod'));
+
+  const symbolLimitedConfig = {
+    ...config,
+    analysisLimits: { ...config.analysisLimits, maxSymbols: 2 }
+  };
+  analysisApi.invalidateWorkspaceAnalysis(workspace.id);
+  const symbolLimited = await analysisApi.inspectWorkspace(symbolLimitedConfig, guard, workspace);
+  assert.equal(symbolLimited.symbols.length, 2);
+  assert.equal(symbolLimited.coverage.truncated, true);
+  assert(symbolLimited.warnings.some((warning) => warning.includes('Symbol extraction reached')));
+
+  const searchLimitedConfig = {
+    ...config,
+    analysisLimits: { ...config.analysisLimits, maxAnalyzedFiles: 1 }
+  };
+  analysisApi.invalidateWorkspaceAnalysis(workspace.id);
+  const searchLimited = await analysisApi.searchWorkspaceStructured(searchLimitedConfig, guard, workspace, {
+    query: 'authenticate',
+    intent: 'symbol',
+    includeTests: true
+  });
+  assert.equal(searchLimited.coverage.truncated, true);
+  assert(searchLimited.warnings.some((warning) => warning.includes('Grouped search reached')));
+
+  const scoped = await analysisApi.searchWorkspaceStructured(config, guard, workspace, {
+    query: 'coreValue',
+    intent: 'symbol',
+    root: 'src'
+  });
+  assert.equal(scoped.matches.length, 0);
+
+  const unsupportedRegex = await analysisApi.searchWorkspaceStructured(config, guard, workspace, {
+    query: '(?i)authenticate',
+    intent: 'text',
+    regex: true
+  });
+  assert.equal(unsupportedRegex.matches.length, 0);
+  assert(unsupportedRegex.warnings.some((warning) => warning.includes('regular expression')));
+
+  const candidateLimited = await analysisApi.searchWorkspaceStructured(config, guard, workspace, {
+    query: 'common marker',
+    intent: 'text',
+    maxResults: 2
+  });
+  assert.equal(candidateLimited.matches.length, 2);
+  assert.equal(candidateLimited.coverage.truncated, true);
+  assert(candidateLimited.warnings.some((warning) => warning.includes('retained the first 8 candidates')));
+
+  console.log('✓ analysis smoke test passed');
+} finally {
+  await fs.rm(tmp, { recursive: true, force: true });
+  await fs.rm(outside, { recursive: true, force: true });
+}

package/scripts/atomic-file.mjs

@@ -0,0 +1,137 @@
+import { randomBytes } from "node:crypto";
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+
+function sameIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
+const RENAME_RETRY_CODES = new Set(["EACCES", "EBUSY", "EPERM"]);
+const RENAME_RETRIES = 20;
+const RENAME_RETRY_DELAY_MS = 25;
+const syncWaitBuffer = new Int32Array(new SharedArrayBuffer(4));
+
+async function renameAtomic(source, target, rename) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      await rename(source, target);
+      return;
+    } catch (error) {
+      if (!RENAME_RETRY_CODES.has(error?.code) || attempt >= RENAME_RETRIES) throw error;
+      await new Promise((resolve) => setTimeout(resolve, RENAME_RETRY_DELAY_MS));
+    }
+  }
+}
+
+function renameAtomicSync(source, target, rename) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      rename(source, target);
+      return;
+    } catch (error) {
+      if (!RENAME_RETRY_CODES.has(error?.code) || attempt >= RENAME_RETRIES) throw error;
+      Atomics.wait(syncWaitBuffer, 0, 0, RENAME_RETRY_DELAY_MS);
+    }
+  }
+}
+
+export function writeJsonAtomicFileSync(targetPath, value, options = {}) {
+  const target = path.resolve(targetPath);
+  const temporary = `${target}.${process.pid}.${randomBytes(12).toString("hex")}.tmp`;
+  const rename = options.rename ?? fs.renameSync;
+  const errors = [];
+  let descriptor;
+  let temporaryIdentity;
+  try {
+    descriptor = fs.openSync(temporary, "wx", 0o600);
+    temporaryIdentity = fs.fstatSync(descriptor, { bigint: true });
+    fs.writeFileSync(descriptor, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = undefined;
+    renameAtomicSync(temporary, target, rename);
+  } catch (error) {
+    errors.push(error);
+  }
+
+  if (descriptor !== undefined) {
+    try {
+      fs.closeSync(descriptor);
+    } catch (error) {
+      errors.push(error);
+    }
+  }
+
+  if (temporaryIdentity) {
+    try {
+      const current = fs.lstatSync(temporary, { bigint: true });
+      if (
+        !current.isFile() ||
+        current.isSymbolicLink() ||
+        current.nlink !== 1n ||
+        !sameIdentity(current, temporaryIdentity)
+      ) {
+        const error = new Error("ATOMIC_TEMP_IDENTITY_CHANGED");
+        error.code = "ATOMIC_TEMP_IDENTITY_CHANGED";
+        throw error;
+      }
+      fs.unlinkSync(temporary);
+    } catch (error) {
+      if (error?.code !== "ENOENT") errors.push(error);
+    }
+  }
+
+  if (errors.length === 1) throw errors[0];
+  if (errors.length > 1) throw new AggregateError(errors, "Atomic JSON write and cleanup failed.");
+}
+
+export async function writeJsonAtomicFile(targetPath, value, options = {}) {
+  const target = path.resolve(targetPath);
+  const temporary = `${target}.${process.pid}.${randomBytes(12).toString("hex")}.tmp`;
+  const rename = options.rename ?? fsp.rename;
+  const errors = [];
+  let handle;
+  let temporaryIdentity;
+  try {
+    handle = await fsp.open(temporary, "wx", 0o600);
+    temporaryIdentity = await handle.stat({ bigint: true });
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = undefined;
+    await renameAtomic(temporary, target, rename);
+  } catch (error) {
+    errors.push(error);
+  }
+
+  if (handle) {
+    try {
+      await handle.close();
+    } catch (error) {
+      errors.push(error);
+    }
+  }
+
+  if (temporaryIdentity) {
+    try {
+      const current = await fsp.lstat(temporary, { bigint: true });
+      if (
+        !current.isFile() ||
+        current.isSymbolicLink() ||
+        current.nlink !== 1n ||
+        !sameIdentity(current, temporaryIdentity)
+      ) {
+        const error = new Error("ATOMIC_TEMP_IDENTITY_CHANGED");
+        error.code = "ATOMIC_TEMP_IDENTITY_CHANGED";
+        throw error;
+      }
+      await fsp.unlink(temporary);
+    } catch (error) {
+      if (error?.code !== "ENOENT") errors.push(error);
+    }
+  }
+
+  if (errors.length === 1) throw errors[0];
+  if (errors.length > 1) throw new AggregateError(errors, "Atomic JSON write and cleanup failed.");
+}

package/scripts/ci-change-classifier.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import fsp from "node:fs/promises";
+
+const argv = process.argv.slice(2);
+function option(name) {
+  const index = argv.indexOf(name);
+  return index === -1 ? undefined : argv[index + 1];
+}
+
+const base = option("--base");
+const head = option("--head") ?? "HEAD";
+const output = option("--output") ?? process.env.GITHUB_OUTPUT;
+const zeroSha = /^0{40}$/;
+
+function git(args) {
+  const result = spawnSync("git", args, { encoding: "utf8", windowsHide: true, maxBuffer: 2 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(result.stderr || `git ${args.join(" ")} failed`);
+  return result.stdout;
+}
+
+function isDocsOnlyPath(file) {
+  return file === "AGENTS.md" ||
+    file === "Memory.md" ||
+    file === "CHANGELOG.md" ||
+    file === "CONTRIBUTING.md" ||
+    file === "FAQ.md" ||
+    file === "FAQ_ZH.md" ||
+    file === "README.md" ||
+    file === "README_ZH.md" ||
+    file === "SECURITY.md" ||
+    file === "DOMAIN_SETUP.md" ||
+    file === "PUBLIC_LAUNCH_CHECKLIST.md" ||
+    file.startsWith("docs/") ||
+    file.endsWith(".md");
+}
+
+let files;
+if (!base || zeroSha.test(base)) {
+  files = git(["diff-tree", "--no-commit-id", "--name-only", "-r", head]).split(/\r?\n/).filter(Boolean);
+  if (files.length === 0) files = git(["ls-tree", "-r", "--name-only", head]).split(/\r?\n/).filter(Boolean);
+} else {
+  files = git(["diff", "--name-only", `${base}...${head}`]).split(/\r?\n/).filter(Boolean);
+}
+
+const docsOnly = files.length > 0 && files.every(isDocsOnlyPath);
+const facts = {
+  changed_files: files.length,
+  docs_only: docsOnly,
+  runtime: !docsOnly,
+  files
+};
+const lines = [
+  `changed_files=${facts.changed_files}`,
+  `docs_only=${facts.docs_only}`,
+  `runtime=${facts.runtime}`
+].join("\n") + "\n";
+if (output) await fsp.appendFile(output, lines, "utf8");
+process.stdout.write(`${JSON.stringify(facts, null, 2)}\n`);

package/scripts/ci-failure-summary.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { createBoundedCliEnvironment } from "../dist/cliEnvironment.js";
+
+const argv = process.argv.slice(2);
+function option(name) {
+  const index = argv.indexOf(name);
+  return index === -1 ? undefined : argv[index + 1];
+}
+
+const runId = option("--run");
+const maxLines = Number(option("--max-lines") ?? 220);
+const contextLines = Number(option("--context") ?? 2);
+if (!/^\d+$/.test(runId ?? "")) {
+  console.error("Usage: npm run ci:failure-summary -- --run <run-id> [--max-lines 220] [--context 2]");
+  process.exit(2);
+}
+
+const match = /(?:\bnot ok\b|AssertionError|ERR_ASSERTION|\bactual\s*:|\bexpected\s*:|\boperator\s*:|\berror\s*:|npm ERR!|ELIFECYCLE|Process completed with exit code|Caused by:|UnhandledPromiseRejection|\bSIG(?:TERM|KILL|INT)\b)/i;
+const child = spawn("gh", ["run", "view", runId, "--log-failed"], {
+  cwd: process.cwd(),
+  env: createBoundedCliEnvironment({ includeCi: false }),
+  shell: false,
+  windowsHide: true,
+  stdio: ["ignore", "pipe", "pipe"]
+});
+
+const selected = [];
+const selectedSet = new Set();
+const recent = [];
+let pendingContext = 0;
+let buffer = "";
+let stderr = "";
+let dropped = 0;
+
+function add(line) {
+  if (selectedSet.has(line)) return;
+  if (selected.length >= maxLines) {
+    dropped += 1;
+    return;
+  }
+  selectedSet.add(line);
+  selected.push(line);
+}
+
+function consumeLine(line) {
+  recent.push(line);
+  if (recent.length > contextLines + 1) recent.shift();
+  if (match.test(line)) {
+    for (const prior of recent) add(prior);
+    pendingContext = contextLines;
+    return;
+  }
+  if (pendingContext > 0) {
+    add(line);
+    pendingContext -= 1;
+  }
+}
+
+child.stdout.on("data", (chunk) => {
+  buffer += chunk.toString("utf8");
+  const lines = buffer.split(/\r?\n/);
+  buffer = lines.pop() ?? "";
+  for (const line of lines) consumeLine(line);
+});
+child.stderr.on("data", (chunk) => {
+  stderr += chunk.toString("utf8");
+  if (stderr.length > 32_000) stderr = stderr.slice(-32_000);
+});
+
+const exitCode = await new Promise((resolve) => {
+  child.once("error", (error) => {
+    stderr += `\n${error.stack ?? error.message}`;
+    resolve(127);
+  });
+  child.once("close", (code) => resolve(code ?? 1));
+});
+if (buffer) consumeLine(buffer);
+
+if (exitCode !== 0) {
+  console.error(`gh run view ${runId} --log-failed exited ${exitCode}.`);
+  console.error(stderr.trim());
+  process.exit(exitCode);
+}
+
+if (selected.length === 0) {
+  console.log(`Run ${runId}: no matching assertion/error lines were found in failed-step logs.`);
+} else {
+  console.log(`# Compact failure summary for run ${runId}`);
+  console.log(selected.join("\n"));
+  if (dropped > 0) console.log(`\n[${dropped} additional matching/context lines omitted by --max-lines]`);
+}

package/scripts/cloudflared-installer.mjs

@@ -0,0 +1,215 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  CLOUDFLARED_RELEASE,
+  cloudflaredAsset,
+  cloudflaredReleaseUrl
+} from "./cloudflared-release.mjs";
+import { createOwnedTempRootSync } from "./owned-temp-root.mjs";
+
+const MAX_DOWNLOAD_BYTES = 100 * 1024 * 1024;
+
+export function cloudflaredTunnelArgs(...args) {
+  return ["tunnel", "--no-autoupdate", ...args];
+}
+
+export function sha256Buffer(buffer) {
+  return createHash("sha256").update(buffer).digest("hex");
+}
+
+export function assertSha256(buffer, expected, label = "download") {
+  const actual = sha256Buffer(buffer);
+  if (actual !== expected.toLowerCase()) {
+    throw new Error(`SHA-256 verification failed for ${label}. Expected ${expected}, received ${actual}.`);
+  }
+  return actual;
+}
+
+function CodexGPTHome() {
+  const configured = process.env.CODEXGPT_HOME?.trim();
+  return configured ? path.resolve(configured) : path.join(os.homedir(), ".codexgpt");
+}
+
+function binaryName() {
+  return process.platform === "win32" ? "cloudflared.exe" : "cloudflared";
+}
+
+export function managedCloudflaredInstallPath() {
+  return path.join(CodexGPTHome(), "bin", binaryName());
+}
+
+function findFile(root, fileName) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const fullPath = path.join(root, entry.name);
+    if (entry.isFile() && entry.name === fileName) return fullPath;
+    if (entry.isDirectory()) {
+      const nested = findFile(fullPath, fileName);
+      if (nested) return nested;
+    }
+  }
+  return "";
+}
+
+function cloudflaredVersion(binaryPath) {
+  const result = spawnSync(binaryPath, ["--version"], {
+    encoding: "utf8",
+    shell: false,
+    timeout: 15000,
+    windowsHide: true
+  });
+  if (result.error || result.status !== 0) return "";
+  return `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
+}
+
+export function verifiedInstalledCloudflaredVersion(binaryPath) {
+  if (!fs.existsSync(binaryPath)) return "";
+  const asset = cloudflaredAsset();
+  if (!asset.archive) {
+    const stat = fs.statSync(binaryPath);
+    if (!stat.isFile() || stat.size > MAX_DOWNLOAD_BYTES) return "";
+    const installedDigest = sha256Buffer(fs.readFileSync(binaryPath));
+    if (installedDigest !== asset.sha256) return "";
+  }
+  const output = cloudflaredVersion(binaryPath);
+  return output.includes(CLOUDFLARED_RELEASE.version) ? output : "";
+}
+
+async function downloadVerifiedAsset(asset, tempRoot) {
+  const url = cloudflaredReleaseUrl(asset);
+  console.error(`[codexgpt] Downloading pinned cloudflared ${CLOUDFLARED_RELEASE.version}: ${asset.file}`);
+  const response = await fetch(url, { headers: { "user-agent": "codexgpt-verified-installer" } });
+  if (!response.ok) {
+    throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
+  }
+  const contentLength = Number(response.headers.get("content-length") ?? 0);
+  if (Number.isFinite(contentLength) && contentLength > MAX_DOWNLOAD_BYTES) {
+    throw new Error(`Refusing cloudflared download larger than ${MAX_DOWNLOAD_BYTES} bytes.`);
+  }
+  if (!response.body) throw new Error(`Cloudflared download returned no response body: ${url}`);
+  const chunks = [];
+  let receivedBytes = 0;
+  for await (const chunk of response.body) {
+    const bufferChunk = Buffer.from(chunk);
+    receivedBytes += bufferChunk.byteLength;
+    if (receivedBytes > MAX_DOWNLOAD_BYTES) {
+      throw new Error(`Refusing cloudflared download larger than ${MAX_DOWNLOAD_BYTES} bytes.`);
+    }
+    chunks.push(bufferChunk);
+  }
+  const buffer = Buffer.concat(chunks, receivedBytes);
+  const digest = assertSha256(buffer, asset.sha256, asset.file);
+  const downloadedPath = path.join(tempRoot, asset.file);
+  fs.writeFileSync(downloadedPath, buffer, { mode: 0o700 });
+  console.error(`[codexgpt] Verified SHA-256: ${digest}`);
+  return downloadedPath;
+}
+
+function extractExecutable(asset, downloadedPath, tempRoot) {
+  if (!asset.archive) return downloadedPath;
+  const extractDir = path.join(tempRoot, "extract");
+  fs.mkdirSync(extractDir, { recursive: true });
+  const result = spawnSync("tar", ["-xzf", downloadedPath, "-C", extractDir], {
+    encoding: "utf8",
+    shell: false,
+    windowsHide: true
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error(`Failed to extract ${asset.file}: ${result.stderr || result.stdout || result.error?.message || result.status}`);
+  }
+  const extracted = findFile(extractDir, "cloudflared");
+  if (!extracted) throw new Error(`Could not find cloudflared inside ${asset.file}.`);
+  return extracted;
+}
+
+function replaceInstalledBinary(sourcePath, destination) {
+  const binDir = path.dirname(destination);
+  fs.mkdirSync(binDir, { recursive: true, mode: 0o700 });
+  const staged = path.join(binDir, `.${process.pid}.new-${binaryName()}`);
+  const backup = path.join(binDir, `.backup-${binaryName()}`);
+  fs.rmSync(staged, { force: true });
+  fs.copyFileSync(sourcePath, staged);
+  if (process.platform !== "win32") fs.chmodSync(staged, 0o755);
+
+  const versionOutput = cloudflaredVersion(staged);
+  if (!versionOutput.includes(CLOUDFLARED_RELEASE.version)) {
+    fs.rmSync(staged, { force: true });
+    throw new Error(
+      `Verified file did not report cloudflared ${CLOUDFLARED_RELEASE.version}. ` +
+      `Reported: ${versionOutput || "no version output"}`
+    );
+  }
+
+  fs.rmSync(backup, { force: true });
+  const hadExisting = fs.existsSync(destination);
+  try {
+    if (hadExisting) fs.renameSync(destination, backup);
+    fs.renameSync(staged, destination);
+    fs.rmSync(backup, { force: true });
+  } catch (error) {
+    fs.rmSync(staged, { force: true });
+    if (hadExisting && fs.existsSync(backup) && !fs.existsSync(destination)) {
+      fs.renameSync(backup, destination);
+    }
+    throw error;
+  }
+  return versionOutput;
+}
+
+export async function installVerifiedCloudflared({ ensureOnly = false } = {}) {
+  const destination = managedCloudflaredInstallPath();
+  const installed = verifiedInstalledCloudflaredVersion(destination);
+  if (installed && ensureOnly) {
+    console.error(`[codexgpt] Verified cloudflared already installed: ${installed}`);
+    return destination;
+  }
+
+  const asset = cloudflaredAsset();
+  const ownedTemp = createOwnedTempRootSync("cloudflared-install");
+  const tempRoot = ownedTemp.path;
+  try {
+    const downloaded = await downloadVerifiedAsset(asset, tempRoot);
+    const executable = extractExecutable(asset, downloaded, tempRoot);
+    const versionOutput = replaceInstalledBinary(executable, destination);
+    console.error(`[codexgpt] Installed verified cloudflared: ${versionOutput}`);
+    console.error(`[codexgpt] Path: ${destination}`);
+    return destination;
+  } finally {
+    ownedTemp.cleanupSync();
+  }
+}
+
+async function main() {
+  const command = process.argv[2] || "ensure";
+  if (command === "status") {
+    const destination = managedCloudflaredInstallPath();
+    const installed = verifiedInstalledCloudflaredVersion(destination);
+    if (!installed) {
+      console.error(`[codexgpt] Pinned cloudflared ${CLOUDFLARED_RELEASE.version} is not installed at ${destination}.`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(installed);
+    return;
+  }
+  if (command === "ensure") {
+    await installVerifiedCloudflared({ ensureOnly: true });
+    return;
+  }
+  if (command === "install" || command === "upgrade") {
+    await installVerifiedCloudflared({ ensureOnly: false });
+    return;
+  }
+  throw new Error("Usage: node scripts/cloudflared-installer.mjs [ensure|install|upgrade|status]");
+}
+
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+if (isMain) {
+  main().catch((error) => {
+    console.error(`[codexgpt] ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  });
+}