@ailuntz/codex-desktop-router 0.6.1

package/src/install.mjs

@@ -0,0 +1,100 @@
+import { existsSync, readFileSync, mkdirSync, writeFileSync, cpSync, rmSync, mkdtempSync, renameSync, realpathSync, readlinkSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { atomicJSON, configPath, codexHome } from './config.mjs';
+
+const label = 'com.ailuntz.codex-desktop-router';
+const installRoot = () => join(homedir(), '.local/share/codex-desktop-router');
+const plistPath = () => join(homedir(), 'Library/LaunchAgents', `${label}.plist`);
+const statePath = () => join(installRoot(), 'installation.json');
+export const shellQuote = value => "'" + value.replaceAll("'", "'\\''") + "'";
+export const xml = value => value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&apos;');
+const run = (args, required = true) => { try { return execFileSync('/bin/launchctl', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim(); } catch { if (required) throw new Error(`launchctl ${args[0]} 失败。`); return null; } };
+const currentEnv = () => run(['getenv', 'CODEX_CLI_PATH'], false) || null;
+const macOnly = () => { if (process.platform !== 'darwin') throw new Error('Desktop 自动安装目前仅支持 macOS。'); };
+
+export function installation() {
+  try { return JSON.parse(readFileSync(statePath(), 'utf8')); } catch (e) { if (e.code === 'ENOENT') return null; throw new Error('安装状态损坏，请先检查 installation.json。'); }
+}
+
+export function install() {
+  macOnly();
+  const previous = installation();
+  if (existsSync(plistPath()) && !previous) throw new Error('同名 LaunchAgent 已存在且不属于本次安装，已停止。');
+  const root = installRoot();
+  const source = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+  const runtime = join(root, 'runtime');
+  const wrapper = join(root, 'codex-desktop-router');
+  const env = currentEnv();
+  if (env && env !== wrapper) throw new Error('当前 CODEX_CLI_PATH 已指向其他程序；请先移除该覆盖再安装。');
+  mkdirSync(root, { recursive: true, mode: 0o700 });
+  // A local copy survives USB removal and npm cache cleanup. Node stays pinned
+  // to the executable used for installation, avoiding Finder's minimal PATH.
+  if (realpathSync(source) !== (existsSync(runtime) ? realpathSync(runtime) : runtime)) {
+    const staged = mkdtempSync(join(root, '.runtime-'));
+    const retired = `${staged}.previous`;
+    try {
+      for (const entry of ['bin', 'src', 'package.json', 'LICENSE']) cpSync(join(source, entry), join(staged, entry), { recursive: true });
+      // npm can hoist dependencies outside this package. Resolve the actual
+      // installed dependency rather than assuming source/node_modules exists.
+      let dependency = dirname(fileURLToPath(import.meta.resolve('smol-toml')));
+      while (!existsSync(join(dependency, 'package.json'))) {
+        const parent = dirname(dependency);
+        if (parent === dependency) throw new Error('找不到 smol-toml 依赖包。');
+        dependency = parent;
+      }
+      if (JSON.parse(readFileSync(join(dependency, 'package.json'), 'utf8')).name !== 'smol-toml') throw new Error('smol-toml 依赖包路径无效。');
+      cpSync(dependency, join(staged, 'node_modules/smol-toml'), { recursive: true });
+      if (existsSync(runtime)) renameSync(runtime, retired);
+      try { renameSync(staged, runtime); }
+      catch (error) { if (existsSync(retired)) renameSync(retired, runtime); throw error; }
+      rmSync(retired, { recursive: true, force: true });
+    } finally { rmSync(staged, { recursive: true, force: true }); }
+  }
+  const config = configPath();
+  const node = process.execPath;
+  writeFileSync(wrapper, `#!/bin/sh\nexport CODEX_HOME=${shellQuote(codexHome())}\nexport CODEX_DESKTOP_ROUTER_CONFIG=${shellQuote(config)}\nexec ${shellQuote(node)} ${shellQuote(join(runtime, 'bin/codex-desktop-router.mjs'))} "$@"\n`, { mode: 0o755 });
+  rmSync(join(root, '模型选择.command'), { force: true });
+  const activate = join(root, 'activate.sh');
+  writeFileSync(activate, `#!/bin/sh\nif [ -x ${shellQuote(node)} ] && [ -x ${shellQuote(wrapper)} ]; then\n  exec /bin/launchctl setenv CODEX_CLI_PATH ${shellQuote(wrapper)}\nfi\nexit 1\n`, { mode: 0o700 });
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict>\n<key>Label</key><string>${label}</string>\n<key>ProgramArguments</key><array><string>/bin/sh</string><string>${xml(activate)}</string></array>\n<key>RunAtLoad</key><true/>\n<key>LimitLoadToSessionType</key><string>Aqua</string>\n</dict></plist>\n`;
+  mkdirSync(dirname(plistPath()), { recursive: true });
+  writeFileSync(plistPath(), plist, { mode: 0o600 });
+  const state = { version: 1, wrapper, node, codexHome: codexHome(), configPath: config, previousEnv: previous ? previous.previousEnv : env, installedAt: new Date().toISOString() };
+  atomicJSON(statePath(), state);
+  run(['bootout', `gui/${process.getuid()}/${label}`], false);
+  run(['bootstrap', `gui/${process.getuid()}`, plistPath()]);
+  run(['setenv', 'CODEX_CLI_PATH', wrapper]);
+  if (currentEnv() !== wrapper) throw new Error('启动环境验证失败。');
+  // npm owns the terminal command. Retire our old link so it cannot shadow
+  // a newly upgraded npm package with the previous local runtime.
+  if (previous?.binLink) {
+    try { if (readlinkSync(previous.binLink) === wrapper) rmSync(previous.binLink); } catch { /* user replaced the link */ }
+  }
+  return state;
+}
+
+export function uninstall() {
+  macOnly();
+  const state = installation();
+  if (!state) return false;
+  run(['bootout', `gui/${process.getuid()}/${label}`], false);
+  if (currentEnv() === state.wrapper) {
+    if (state.previousEnv) run(['setenv', 'CODEX_CLI_PATH', state.previousEnv]);
+    else run(['unsetenv', 'CODEX_CLI_PATH']);
+  }
+  rmSync(plistPath(), { force: true });
+  if (state.binLink) {
+    try { if (readlinkSync(state.binLink) === state.wrapper) rmSync(state.binLink); } catch { /* user replaced the link */ }
+  }
+  // Keep runtime files: an existing Desktop sidecar may still be using them.
+  // Configuration and credentials are deliberately retained for reinstall.
+  rmSync(statePath(), { force: true });
+  return true;
+}
+
+export function environmentStatus() {
+  return process.platform === 'darwin' ? currentEnv() : null;
+}

package/src/model-menu.mjs

@@ -0,0 +1,170 @@
+import { object, chatProviderId, isRoutedProvider, findRoute, isChatProvider } from './config.mjs';
+
+export const aliasFor = (provider, model) => `cdr:${provider}:${encodeURIComponent(model)}`;
+const isAlias = value => typeof value === 'string' && value.startsWith('cdr:');
+const threadMethods = new Set(['thread/start', 'thread/resume', 'thread/fork']);
+const settingMethods = new Set(['turn/start', 'turn/settings/update', 'thread/settings/update']);
+const trackedMethods = new Set([...threadMethods, ...settingMethods, 'thread/read', 'model/list', 'config/read', 'config/value/write', 'config/batchWrite']);
+
+export function decodeAlias(value, config) {
+  if (!isAlias(value)) return null;
+  const parts = value.split(':');
+  let model;
+  try { model = decodeURIComponent(parts[2]); } catch { throw new Error('Profile 模型选项格式无效；请刷新模型列表。'); }
+  if (parts.length !== 3 || !isRoutedProvider(parts[1], config) || !model || model.length > 200 || /[\s\x00-\x1f]/u.test(model) || aliasFor(parts[1], model) !== value) throw new Error('Profile 模型选项不属于当前提供商；请刷新模型列表。');
+  if (isChatProvider(parts[1], config) && !findRoute(parts[1], config).chat) throw new Error('此 profile 尚未提供可用于 Chat 的连接。');
+  return { provider: parts[1], model };
+}
+
+export function additionalModels(catalog, config, { firstPage = true, includeHidden = false } = {}) {
+  return config.routes.flatMap(route => {
+    if (!route.providerDefinition || route.error || (!firstPage && route.catalogPath)) return [];
+    const seen = new Set();
+    const models = (route.catalogPath ? route.catalog || [] : catalog).filter(entry => {
+      if (typeof entry?.model !== 'string' || !entry.model || isAlias(entry.model) || seen.has(entry.model) || (!includeHidden && entry.hidden)) return false;
+      seen.add(entry.model); return true;
+    });
+    return [route.provider, ...(route.chat ? [chatProviderId(route)] : [])].flatMap(provider => models.map(entry => ({
+      ...entry, id: aliasFor(provider, entry.model), model: aliasFor(provider, entry.model),
+      displayName: `${route.profile} · ${entry.displayName || entry.model}${provider === route.provider ? '' : '-Chat'}`,
+      isDefault: false,
+      ...(provider === route.provider ? {} : { inputModalities: ['text'], description: '纯文字聊天，不向模型提供工作区上下文或工具。' })
+    })));
+  });
+}
+
+function modelSlots(params) {
+  return [params?.model, params?.config?.model, params?.collaborationMode?.settings?.model].filter(v => v != null);
+}
+
+function normalizedParams(params, config) {
+  const result = { ...params };
+  if (isAlias(result.model)) result.model = decodeAlias(result.model, config).model;
+  if (isAlias(result.config?.model)) result.config = { ...result.config, model: decodeAlias(result.config.model, config).model };
+  if (isAlias(result.collaborationMode?.settings?.model)) result.collaborationMode = { ...result.collaborationMode, settings: { ...result.collaborationMode.settings, model: decodeAlias(result.collaborationMode.settings.model, config).model } };
+  return result;
+}
+
+// Only model routes and catalog settings are translated here. Native task
+// permissions, prompts and persisted provider metadata remain untouched.
+export class ModelMenu {
+  constructor({ getConfig, requireProvider, readSelection = () => null, saveSelection = () => {}, onCatalog = () => {}, onSelection = () => {}, onPrewarmSkipped = () => {} }) {
+    Object.assign(this, { getConfig, requireProvider, readSelection, saveSelection, onCatalog, onSelection, onPrewarmSkipped });
+    this.pending = new Map(); this.threads = new Map();
+    this.desktopClient = false;
+  }
+  rememberThread(thread) {
+    if (!object(thread) || typeof thread.id !== 'string' || typeof thread.modelProvider !== 'string') return;
+    this.threads.set(thread.id, thread.modelProvider);
+    if (this.threads.size > 10000) this.threads.delete(this.threads.keys().next().value);
+  }
+  request(message) {
+    if (!object(message) || !Object.hasOwn(message, 'id') || typeof message.method !== 'string') return message;
+    const method = message.method;
+    if (method === 'initialize') {
+      this.desktopClient = message.params?.clientInfo?.title === 'Codex Desktop';
+      return message;
+    }
+    if (!trackedMethods.has(method)) return message;
+    const params = message.params ?? {};
+    if (!object(params)) return message;
+    const config = this.getConfig();
+    // Verified in Desktop 26.908: preparePrewarmRequest omits threadSource;
+    // actual prepareConversation defaults it to "user". Desktop catches a
+    // failed prewarm and starts a fresh thread on send. Otherwise its cache
+    // (keyed by cwd, not provider/model) can pin a new task to the wrong provider.
+    if (this.desktopClient && config.enabled && method === 'thread/start' && params.threadSource == null) {
+      this.onPrewarmSkipped();
+      throw new Error('菜单路由已跳过 Desktop 预热；正常发送时会按所选模型创建新任务。');
+    }
+    let result = message;
+    const record = { method, time: Date.now(), threadId: params.threadId, firstPage: !params.cursor, includeHidden: params.includeHidden === true };
+    if (threadMethods.has(method) || settingMethods.has(method)) {
+      const values = modelSlots(params);
+      const selected = values.map(v => decodeAlias(v, config)).filter(Boolean);
+      if (selected.length && (selected.some(s => s.model !== selected[0].model || s.provider !== selected[0].provider) || values.some(v => !isAlias(v) && v !== selected[0].model))) throw new Error('请求中包含冲突的模型选择，请重新选择模型。');
+      if (selected.length) {
+        const selection = selected[0];
+        this.requireProvider(findRoute(selection.provider, config));
+        if (settingMethods.has(method)) {
+          const provider = this.threads.get(params.threadId);
+          if (provider !== selection.provider && !(findRoute(provider, config) === findRoute(selection.provider, config) && isChatProvider(provider, config) === isChatProvider(selection.provider, config))) throw new Error('任务路由尚未就绪，请重新打开任务后再选择 profile 模型。');
+        } else if (!config.enabled) throw new Error('Profile 新任务路由已关闭；请先执行 codex-desktop-router on。');
+        const rewritten = normalizedParams(params, config);
+        if (threadMethods.has(method)) {
+          if (rewritten.modelProvider && rewritten.modelProvider !== 'openai' && !isRoutedProvider(rewritten.modelProvider, config)) throw new Error('模型选项与显式提供商不一致。');
+          rewritten.modelProvider = selection.provider;
+          rewritten.model = selection.model;
+          const route = findRoute(selection.provider, config);
+          rewritten.config = { ...(route.catalogPath ? { model_catalog_json: route.catalogPath } : {}), ...rewritten.config };
+        }
+        result = { ...message, params: rewritten };
+        this.onSelection(method);
+      } else if (settingMethods.has(method) && values.length && isRoutedProvider(this.threads.get(params.threadId), config)) {
+        // An official picker row must not silently use the existing custom key.
+        throw new Error('任务路由尚未切换，请重新打开任务后再选择模型。');
+      }
+    } else if (method === 'config/value/write' || method === 'config/batchWrite') {
+      const edits = method === 'config/value/write' ? [params] : params.edits;
+      if (Array.isArray(edits)) {
+        let changed = false;
+        const normalized = edits.map(edit => {
+          if (object(edit) && edit.keyPath === 'model' && params.filePath == null && !isAlias(edit.value)) record.savedSelection = null;
+          if (!object(edit) || !isAlias(edit.value)) return edit;
+          if (edit.keyPath !== 'model' || params.filePath != null) throw new Error('Profile 菜单默认值目前只支持主配置；不要将虚拟模型保存进独立 profile。');
+          const selection = decodeAlias(edit.value, config);
+          this.requireProvider(findRoute(selection.provider, config));
+          record.savedSelection = selection;
+          changed = true;
+          return { ...edit, value: selection.model };
+        });
+        if (changed) result = { ...message, params: method === 'config/value/write' ? normalized[0] : { ...params, edits: normalized } };
+      }
+    }
+    for (const [id, request] of this.pending) if (Date.now() - request.time > 300000) this.pending.delete(id);
+    if (this.pending.size >= 4096) throw new Error('路由器等待中的请求过多，请稍后重试。');
+    this.pending.set(message.id, record);
+    return result;
+  }
+  response(message) {
+    if (!object(message)) return message;
+    const record = Object.hasOwn(message, 'id') && !message.method ? this.pending.get(message.id) : undefined;
+    if (record) this.pending.delete(message.id);
+    this.rememberThread(message.result?.thread);
+    this.rememberThread(message.params?.thread);
+    if (message.method === 'thread/settings/updated') this.rememberThread({ id: message.params?.threadId, modelProvider: message.params?.threadSettings?.modelProvider });
+    let config;
+    try { config = this.getConfig(); } catch { return message; }
+    if (message.error) return message;
+    if (record?.method === 'model/list' && Array.isArray(message.result?.data)) {
+      if (!config.enabled) return message;
+      // Inherited profiles mirror each native page; explicit catalogs appear once.
+      const additions = additionalModels(message.result.data, config, record).filter(entry => !message.result.data.some(m => m.id === entry.id || m.model === entry.model));
+      this.onCatalog(additions.length);
+      return { ...message, result: { ...message.result, data: [...message.result.data, ...additions] } };
+    }
+    if (record && Object.hasOwn(record, 'savedSelection')) this.saveSelection(record.savedSelection);
+    if (record?.method === 'config/read' && object(message.result?.config) && config.enabled) {
+      const saved = this.readSelection();
+      if (saved && isRoutedProvider(saved.provider, config) && saved.model === message.result.config.model) return { ...message, result: { ...message.result, config: { ...message.result.config, model: aliasFor(isChatProvider(saved.provider, config) ? chatProviderId(findRoute(saved.provider, config)) : findRoute(saved.provider, config).provider, saved.model) } } };
+    }
+    const threadId = message.params?.threadId || message.result?.thread?.id || record?.threadId;
+    const actualProvider = message.result?.modelProvider || this.threads.get(threadId);
+    const route = findRoute(actualProvider, config);
+    const provider = route ? (isChatProvider(actualProvider, config) ? chatProviderId(route) : route.provider) : actualProvider;
+    if (!isRoutedProvider(provider, config)) return message;
+    const decorate = value => {
+      if (!object(value)) return value;
+      let updated = value;
+      if (typeof value.model === 'string' && !isAlias(value.model)) updated = { ...updated, model: aliasFor(provider, value.model) };
+      if (typeof value.collaborationMode?.settings?.model === 'string' && !isAlias(value.collaborationMode.settings.model)) updated = { ...updated, collaborationMode: { ...value.collaborationMode, settings: { ...value.collaborationMode.settings, model: aliasFor(provider, value.collaborationMode.settings.model) } } };
+      return updated;
+    };
+    if (record && (threadMethods.has(record.method) || record.method === 'thread/settings/update')) {
+      const result = decorate(message.result);
+      if (result !== message.result) return { ...message, result };
+    }
+    if (message.method === 'thread/settings/updated') return { ...message, params: { ...message.params, threadSettings: decorate(message.params.threadSettings) } };
+    return message;
+  }
+}

package/src/picker-client.js

@@ -0,0 +1,51 @@
+const $ = id => document.getElementById(id);
+const token = location.hash.slice(1) || sessionStorage.getItem('picker-token');
+if (token) sessionStorage.setItem('picker-token', token);
+history.replaceState(null, '', '/');
+let state, busy = false;
+const say = (text, error = false) => { $('message').textContent = text; $('message').className = error ? 'error' : ''; };
+async function api(path, body) {
+  const response = await fetch(path, { method: body ? 'POST' : 'GET', headers: { Authorization: `Bearer ${token}`, ...(body ? { 'Content-Type': 'application/json' } : {}) }, ...(body ? { body: JSON.stringify(body) } : {}) });
+  const data = await response.json(); if (!response.ok) throw new Error(data.error); return data;
+}
+function fill(select, options, selected) {
+  select.replaceChildren(...options.map(([value, text]) => { const option = document.createElement('option'); option.value = value; option.textContent = text; return option; }));
+  if (options.some(([value]) => value === selected)) select.value = selected;
+}
+function changeModel(effort) {
+  const model = state.models.find(m => m.model === $('model').value);
+  fill($('effort'), model?.efforts?.length ? model.efforts.map(e => [e.reasoningEffort, e.reasoningEffort]) : [['default', '默认']], effort || model?.effort);
+}
+function changeThread() {
+  const thread = state.threads.find(t => t.id === $('thread').value);
+  const pin = thread?.pin || ($('thread').value === 'next' ? state.next : null);
+  const current = state.models.find(m => m.model === pin?.model);
+  $('details').textContent = thread ? `${thread.cwd || ''}\n${thread.status === 'active' ? '正在回复，请等待完成。' : '任务已载入。'}${pin ? ` 由此页管理：${current?.name || pin.model}` : ' 由 Desktop 菜单管理。'}` : pin ? `下一个新任务将使用 ${current?.name || pin.model}。` : '先在这里选好模型，再回 Desktop 新建任务并发送。';
+  fill($('model'), state.models.map(m => [m.model, m.name]), pin?.model || thread?.model);
+  changeModel(pin?.effort);
+  $('apply').disabled = busy || (thread && thread.status !== 'idle');
+  $('release').disabled = busy || !pin;
+}
+async function refresh() {
+  const selected = $('thread').value;
+  state = await api('/state');
+  $('update').hidden = !state.update?.available;
+  $('update').textContent = state.update?.available ? `新版 ${state.update.latest} 可用\n${state.update.command}\n升级后重启 Desktop。` : '';
+  fill($('thread'), [['next', '下一个新任务'], ...state.threads.map(t => [t.id, t.name.slice(0, 90)])], selected);
+  changeThread();
+}
+async function action(operation) {
+  if (busy) return;
+  busy = true; $('apply').disabled = true; $('release').disabled = true;
+  try { await operation(); } catch (error) { say(error.message || '连接已结束，请重新打开选择页。', true); }
+  finally { busy = false; if (state) changeThread(); }
+}
+$('thread').onchange = () => { changeThread(); say(''); };
+$('model').onchange = () => changeModel();
+$('refresh').onclick = () => action(refresh);
+$('form').onsubmit = event => { event.preventDefault(); action(async () => {
+  await api('/choose', { threadId: $('thread').value, model: $('model').value, effort: $('effort').value === 'default' ? null : $('effort').value });
+  await refresh(); say('已设置。回到 Desktop 继续发送消息即可。');
+}); };
+$('release').onclick = () => action(async () => { await api('/release', { threadId: $('thread').value }); await refresh(); say('已交回 Desktop 菜单。'); });
+action(refresh);

package/src/picker.html

@@ -0,0 +1,8 @@
+<!doctype html>
+<html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>模型选择 · Codex Desktop Router</title>
+<style>
+:root{color-scheme:light dark;font:16px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:#f5f5f3;color:#242623}body{margin:0;padding:56px 20px}main{max-width:640px;margin:auto}header{margin-bottom:32px}.eyebrow{font-size:12px;letter-spacing:.1em;color:#687368}h1{font-size:32px;line-height:1.2;margin:12px 0}p{color:#646d65;margin:12px 0}form{background:#fff;border:1px solid #e2e6df;border-radius:18px;padding:28px;box-shadow:0 8px 28px #18371a08}label{display:block;font-weight:600;font-size:14px;margin:16px 0 7px}label:first-child{margin-top:0}select,button{font:inherit;border-radius:9px}select{width:100%;padding:11px;border:1px solid #cad2c8;background:#fafbf9;color:inherit}button{cursor:pointer;border:0;padding:11px 17px;background:#255b3d;color:white;font-weight:600}button:disabled{opacity:.45;cursor:default}.secondary{background:#eef1ec;color:#425044}nav{display:flex;gap:10px;flex-wrap:wrap;margin-top:24px}.detail{font-size:13px;white-space:pre-wrap;overflow-wrap:anywhere}.note{font-size:13px;margin:20px 0 0}#message{min-height:26px;margin-top:18px;color:#255b3d}#message.error{color:#ad3434}footer{font-size:12px;color:#778076;margin-top:24px}a{color:inherit}#refresh{float:right;padding:5px 10px;font-size:13px}@media(prefers-color-scheme:dark){:root{background:#171c18;color:#e0e8e1}form{background:#202721;border-color:#394238}p,footer{color:#abb7ad}select{background:#252e27;border-color:#526152}.secondary{background:#364337;color:#d4e0d6}#message{color:#87d6a4}#message.error{color:#ffa0a0}}
+</style>
+<main><header><button id="refresh" class="secondary" type="button">刷新</button><div class="eyebrow">CODEX DESKTOP ROUTER</div><h1>选择下一条回复的模型</h1><p>Desktop 的额度提示挡住菜单时，在这里切换。</p></header>
+<form id="form"><label for="thread">任务</label><select id="thread" required></select><p id="details" class="detail"></p><label for="model">模型</label><select id="model" required></select><label for="effort">推理强度</label><select id="effort" required></select><nav><button id="apply" type="submit">使用此模型</button><button id="release" class="secondary" type="button">交回 Desktop 菜单</button></nav><p class="note">启用后，该任务的模型与推理强度由此页管理，直到交回菜单或退出 Desktop。原生菜单可能仍显示额度提示，以此页的选择为准。</p><div id="message" role="status" aria-live="polite"></div></form>
+<p id="update" class="detail" hidden></p><footer>模型和推理选项来自客户端及 profile 指定的目录。此页不改变账户额度。新任务选项只作用于下一次正式创建的本地任务。</footer></main><script src="/picker.js"></script></html>

package/src/picker.mjs

@@ -0,0 +1,155 @@
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { checkForUpdates, updateStatus } from './update.mjs';
+import { VERSION } from './config.mjs';
+import { additionalModels } from './model-menu.mjs';
+
+// A choice in this page explicitly owns model selection until released. Desktop
+// can substitute its reserve model at submission time, not just hide its menu.
+export class Picker {
+  constructor({ bridge, menu, getConfig, serialize, chats = [] } = {}) {
+    Object.assign(this, { bridge, menu, getConfig, serialize, chats });
+    this.pins = new Map(); this.starts = new Map(); this.next = null; this.sequence = 0;
+  }
+  request(message) {
+    if (!this.getConfig().enabled) { this.pins.clear(); this.starts.clear(); this.next = null; }
+    const params = message?.params;
+    if (!params || !Object.hasOwn(message, 'id')) return message;
+    let pin = this.pins.get(params.threadId);
+    if (message.method === 'thread/start' && params.threadSource === 'user' && this.next) {
+      pin = this.next;
+      this.next = null;
+      this.starts.set(message.id, pin);
+    }
+    if (!pin || !['thread/start', 'thread/resume', 'thread/settings/update', 'turn/settings/update', 'turn/start'].includes(message.method)) return message;
+    const updated = { ...params, model: pin.model, effort: pin.effort };
+    if (params.config?.model != null) updated.config = { ...params.config, model: pin.model };
+    if (params.collaborationMode) updated.collaborationMode = { ...params.collaborationMode, settings: { ...params.collaborationMode.settings, model: pin.model, reasoning_effort: pin.effort } };
+    return { ...message, params: updated };
+  }
+  response(message) {
+    const pin = this.starts.get(message?.id);
+    if (!pin || message.method) return;
+    this.starts.delete(message.id);
+    if (message.result?.thread?.id) this.pins.set(message.result.thread.id, pin);
+    else if (message.error && !this.next) this.next = pin;
+  }
+  async catalog() {
+    await this.refreshCatalogs?.();
+    const models = []; let cursor;
+    do {
+      const page = await this.bridge.rpc('model/list', { limit: 100, includeHidden: false, ...(cursor ? { cursor } : {}) });
+      models.push(...page.data); cursor = page.nextCursor;
+      if (models.length > 10000) throw new Error('模型目录过大，请重新打开选择页。');
+    } while (cursor);
+    const config = this.getConfig();
+    return [...models, ...(config.enabled ? additionalModels(models, config) : [])].filter(m => !m.hidden);
+  }
+  async state() {
+    void checkForUpdates();
+    this.request(null);
+    const models = await this.catalog();
+    const threads = [];
+    let cursor;
+    do {
+      const page = await this.bridge.rpc('thread/loaded/list', { limit: 100, ...(cursor ? { cursor } : {}) });
+      for (const id of page.data) {
+        try {
+          const { thread } = await this.bridge.rpc('thread/read', { threadId: id, includeTurns: false });
+          if (thread.parentThreadId || thread.source?.subAgent) continue;
+          this.menu.rememberThread(thread);
+          threads.push({ id, name: thread.name || thread.preview || '未命名任务', cwd: thread.cwd, status: thread.status?.type,
+            model: thread.model, provider: thread.modelProvider, pin: this.pins.get(id) || null });
+        } catch { /* a task may close while the list is being read */ }
+      }
+      cursor = page.nextCursor;
+    } while (cursor);
+    return { update: updateStatus(), threads, next: this.next, models: models.map(m => ({ model: m.model, name: m.displayName || m.model,
+      effort: m.defaultReasoningEffort, efforts: m.supportedReasoningEfforts || [] })) };
+  }
+  async choose({ threadId, model, effort }) {
+    if (!this.getConfig().enabled) throw new Error('路由已关闭，请先运行 codex-desktop-router on。');
+    if (typeof threadId !== 'string') throw new Error('请选择任务。');
+    const entry = (await this.catalog()).find(m => m.model === model);
+    if (!entry) throw new Error('此模型已不在原生目录中，请刷新。');
+    const supported = entry.supportedReasoningEfforts || [];
+    effort = supported.length ? (effort ?? entry.defaultReasoningEffort) : null;
+    if (supported.length && !supported.some(e => e.reasoningEffort === effort)) throw new Error('请选择该模型支持的推理强度。');
+    const pin = { model, effort };
+    if (threadId === 'next') { this.next = pin; return { ok: true }; }
+    const { thread } = await this.bridge.rpc('thread/read', { threadId, includeTurns: false });
+    if (thread.status?.type !== 'idle') throw new Error('请等待任务回复和工具运行结束。');
+    this.menu.rememberThread(thread);
+    const message = { id: `picker-${++this.sequence}`, method: 'thread/settings/update', params: { threadId, model, effort } };
+    await this.bridge.prepare(message);
+    const routed = this.menu.request(message);
+    this.menu.pending.delete(message.id);
+    await this.bridge.rpc(message.method, routed.params);
+    this.pins.set(threadId, pin);
+    return { ok: true };
+  }
+  release({ threadId }) {
+    if (typeof threadId !== 'string') throw new Error('请选择任务。');
+    if (threadId === 'next') this.next = null;
+    else this.pins.delete(threadId);
+    return { ok: true };
+  }
+  async listen() {
+    const token = randomBytes(32).toString('hex');
+    let origin;
+    const server = createServer(async (req, res) => {
+      const reply = (code, body, type = 'application/json') => {
+        res.writeHead(code, { 'content-type': `${type}; charset=utf-8`, 'cache-control': 'no-store', 'x-content-type-options': 'nosniff',
+          'referrer-policy': 'no-referrer', 'content-security-policy': "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" });
+        res.end(type === 'application/json' ? JSON.stringify(body) : body);
+      };
+      if (req.headers.host !== new URL(origin).host || (req.headers.origin && req.headers.origin !== origin)) return reply(403, { error: '访问来源不匹配。' });
+      const chat = this.chats.find(c => req.url?.startsWith(c.path + '/'));
+      if (chat) return chat.handle(req, res);
+      if (req.method === 'GET' && ['/', '/picker.js'].includes(req.url)) {
+        const filename = req.url === '/' ? 'picker.html' : 'picker-client.js';
+        return reply(200, readFileSync(new URL(filename, import.meta.url), 'utf8'), req.url === '/' ? 'text/html' : 'text/javascript');
+      }
+      if (req.headers.authorization !== `Bearer ${token}`) return reply(401, { error: '入口已失效，请重新打开模型选择页。' });
+      try {
+        if (req.method === 'GET' && req.url === '/state') return reply(200, await this.serialize(() => this.state()));
+        if (req.method === 'POST' && ['/choose', '/release'].includes(req.url)) {
+          if (req.headers['content-type'] !== 'application/json') return reply(415, { error: '请求格式不正确。' });
+          let raw = ''; for await (const data of req) { raw += data; if (raw.length > 8192) return reply(413, { error: '请求过大。' }); }
+          const body = JSON.parse(raw);
+          if (!body || typeof body !== 'object' || Array.isArray(body)) throw new Error('请求格式不正确。');
+          return reply(200, await this.serialize(() => req.url === '/choose' ? this.choose(body) : this.release(body)));
+        }
+        reply(404, { error: '没有这个操作。' });
+      } catch (error) { reply(400, { error: error instanceof SyntaxError ? '请求格式不正确。' : error.message }); }
+    });
+    server.requestTimeout = 10000; server.headersTimeout = 10000;
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+    origin = `http://127.0.0.1:${server.address().port}`;
+    server.unref(); this.server = server;
+    return { port: server.address().port, token };
+  }
+  close() { for (const chat of this.chats) chat.close(); this.server?.closeAllConnections(); this.server?.close(); }
+}
+
+export function openPicker(home) {
+  const directory = join(home, 'desktop-router-runs');
+  const active = [];
+  try {
+    for (const file of readdirSync(directory)) {
+      if (!/^\d+\.picker\.json$/.test(file)) continue;
+      try { const item = JSON.parse(readFileSync(join(directory, file), 'utf8')); const run = JSON.parse(readFileSync(join(directory, `${item.pid}.json`), 'utf8')); process.kill(item.pid, 0); if (run.version === VERSION) active.push(item); } catch { /* stale process */ }
+    }
+  } catch { /* no active router */ }
+  if (!active.length) return false;
+  // Each native connection has its own set of loaded tasks. Open all active pages
+  // when Desktop has more than one connection, instead of silently picking one.
+  for (const item of active) {
+    if (!Number.isInteger(item.port) || item.port < 1 || item.port > 65535 || !/^[a-f0-9]{64}$/.test(item.token)) continue;
+    execFileSync('/usr/bin/open', [`http://127.0.0.1:${item.port}/#${item.token}`], { stdio: 'ignore' });
+  }
+  return true;
+}

package/src/profiles.mjs

@@ -0,0 +1,127 @@
+import { resolve, dirname } from 'node:path';
+import { statSync } from 'node:fs';
+import { rpcClient } from './rpc.mjs';
+import { codexHome, merge, findRoute } from './config.mjs';
+
+// Model routing uses the client's layers, with the profile between user and
+// project/session settings. Task permissions remain owned by Desktop/Codex.
+export function applyLayers(route, layers) {
+  let effective = {}, inserted = false;
+  const upper = new Set(['project', 'sessionFlags', 'legacyManagedConfigTomlFromFile', 'legacyManagedConfigTomlFromMdm']);
+  // config/read returns highest precedence first.
+  for (const layer of [...(layers || [])].reverse()) {
+    if (layer.disabledReason) continue;
+    if (!inserted && upper.has(layer.name.type)) { effective = merge(effective, route.layer); inserted = true; }
+    const config = { ...layer.config };
+    if (typeof config.model_catalog_json === 'string') {
+      const base = layer.name.file ? dirname(layer.name.file) : layer.name.dotCodexFolder || process.cwd();
+      config.model_catalog_json = resolve(base, config.model_catalog_json);
+    }
+    effective = merge(effective, config);
+  }
+  if (!inserted) effective = merge(effective, route.layer);
+  const catalogPath = effective.model_catalog_json == null ? null : resolve(codexHome(), effective.model_catalog_json);
+  // Choosing a route is an explicit provider selection. Do not reassign its
+  // credentials using another project's default provider.
+  return { ...route, catalogPath };
+}
+
+// Codex owns model metadata at process scope. Catalog-backed tasks therefore
+// share a native worker for each catalog revision, not a hand-built metadata map.
+export class ProfileCatalogs {
+  constructor(executable, args, env, getConfig, emit) {
+    Object.assign(this, { executable, args, env, getConfig, emit });
+    this.workers = new Map(); this.owners = new Map(); this.pending = new Map(); this.serverRequests = new Map();
+  }
+  async worker(path) {
+    const stat = statSync(path), key = `${path}:${stat.mtimeMs}:${stat.size}`;
+    if (this.workers.has(key)) return this.workers.get(key);
+    const worker = { key, path, models: null };
+    worker.client = rpcClient(this.executable, [...this.args, '-c', `model_catalog_json=${JSON.stringify(path)}`], this.env, 30000, message => {
+      this.observe(message, worker).then(visible => {
+        // Connection-wide account/config notifications belong to the primary.
+        if (visible && (Object.hasOwn(visible, 'id') || visible.params?.threadId || visible.params?.thread?.id)) this.emit(visible);
+      }).catch(() => this.emit({ method: 'error', params: { message: '模型目录进程通信失败。' } }));
+    });
+    worker.client.child.once('close', () => {
+      this.workers.delete(key);
+      for (const [id, owner] of this.owners) if (owner === worker) this.owners.delete(id);
+      for (const [id, origin] of this.serverRequests) if (origin.worker === worker) this.serverRequests.delete(id);
+      for (const [id, request] of this.pending) if (request.worker === worker) {
+        this.pending.delete(id); this.emit({ id, error: { code: -32603, message: '模型目录进程已退出，请重新打开任务。' } });
+      }
+    });
+    try {
+      await worker.client.rpc('initialize', this.initialize || { clientInfo: { name: 'codex_desktop_router', version: '1' } });
+      worker.client.send({ method: 'initialized' });
+      this.workers.set(key, worker);
+      for (const previous of this.workers.values()) if (previous !== worker && previous.path === path && ![...this.owners.values()].includes(previous)) await previous.client.close();
+      return worker;
+    } catch (error) { await worker.client.close(); throw error; }
+  }
+  async load(path) {
+    const worker = await this.worker(path);
+    if (worker.models) return worker.models;
+    const models = []; let cursor;
+    do {
+      const page = await worker.client.rpc('model/list', { includeHidden: true, limit: 100, ...(cursor ? { cursor } : {}) });
+      models.push(...page.data); cursor = page.nextCursor;
+      if (models.length > 10000) throw new Error('模型目录超过读取上限。');
+    } while (cursor);
+    worker.models = models;
+    return models;
+  }
+  async forward(message) {
+    if (!message || !Object.hasOwn(message, 'id')) return false;
+    if (!message.method) {
+      const origin = this.serverRequests.get(message.id);
+      if (!origin) return false;
+      this.serverRequests.delete(message.id); origin.worker.client.send({ ...message, id: origin.id }); return true;
+    }
+    const params = message.params || {}, config = this.getConfig();
+    let owner = this.owners.get(params.threadId) || null;
+    if (['thread/start', 'thread/resume', 'thread/fork'].includes(message.method)) {
+      let provider = params.modelProvider;
+      if (message.method === 'thread/resume' && !provider && !owner && params.threadId) {
+        provider = (await this.readThread(params.threadId)).modelProvider;
+      }
+      const route = findRoute(provider, config);
+      if (provider || message.method === 'thread/start') {
+        const path = route && (params.config?.model_catalog_json ?? route.catalogPath);
+        owner = path ? await this.worker(resolve(codexHome(), path)) : null;
+      }
+    }
+    this.pending.set(message.id, { method: message.method, firstPage: !params.cursor, worker: owner, time: Date.now() });
+    for (const [id, request] of this.pending) if (Date.now() - request.time > 300000) this.pending.delete(id);
+    if (!owner) return false;
+    owner.client.send(message); return true;
+  }
+  async observe(message, worker = null) {
+    if (worker && message?.method === 'thread/started' && message.params?.thread?.id) this.owners.set(message.params.thread.id, worker);
+    if (message?.method && Object.hasOwn(message, 'id') && worker) {
+      const id = `cdr-worker-${worker.client.child.pid}-${message.id}`;
+      this.serverRequests.set(id, { worker, id: message.id });
+      return { ...message, id };
+    }
+    const request = !message?.method && this.pending.get(message?.id);
+    if (request) {
+      this.pending.delete(message.id);
+      if (message.result?.thread?.id && ['thread/start', 'thread/resume', 'thread/fork'].includes(request.method)) {
+        this.owners.set(message.result.thread.id, worker);
+      }
+      if (!worker && request.method === 'thread/loaded/list' && request.firstPage && message.result?.data) {
+        const extra = [];
+        for (const other of this.workers.values()) {
+          let cursor;
+          do {
+            const page = await other.client.rpc('thread/loaded/list', { limit: 100, ...(cursor ? { cursor } : {}) });
+            extra.push(...page.data); cursor = page.nextCursor;
+          } while (cursor);
+        }
+        if (extra.length) return { ...message, result: { ...message.result, data: [...new Set([...message.result.data, ...extra])] } };
+      }
+    }
+    return message;
+  }
+  async close() { await Promise.all([...this.workers.values()].map(w => w.client.close())); }
+}