@ailuntz/codex-desktop-router 0.6.1

package/src/protocol.mjs

@@ -0,0 +1,47 @@
+import { Transform } from 'node:stream';
+
+// A byte-oriented framer preserves UTF-8 split across chunks and leaves every
+// non-routed frame exactly as received (including whitespace and CRLF).
+export class JsonLineRouter extends Transform {
+  constructor({ onReject, rewriteMessage, runFrame = operation => operation(), maxFrameBytes = 64 * 1024 * 1024 }) {
+    super();
+    Object.assign(this, { onReject, rewriteMessage, runFrame, maxFrameBytes });
+    this.parts = []; this.size = 0;
+  }
+  async frame(buffer) { return this.runFrame(() => this.routeFrame(buffer)); }
+  async routeFrame(buffer) {
+    let message;
+    try { message = JSON.parse(buffer.toString('utf8')); } catch { this.push(buffer); return; }
+    let routed;
+    try { routed = await this.rewriteMessage(message); }
+    catch (error) {
+      // A broken enabled configuration must never silently spend OpenAI quota.
+      this.onReject({ id: message.id, error: { code: -32603, message: `codex-desktop-router: ${error.message}` } });
+      return;
+    }
+    if (routed === message) this.push(buffer);
+    else if (routed == null) return;
+    else { this.push(Buffer.from(JSON.stringify(routed) + '\n')); }
+  }
+  _transform(chunk, encoding, callback) {
+    (async () => {
+      let start = 0;
+      while (start < chunk.length) {
+        const newline = chunk.indexOf(10, start);
+        const end = newline === -1 ? chunk.length : newline + 1;
+        const piece = chunk.subarray(start, end);
+        this.size += piece.length;
+        if (this.size > this.maxFrameBytes) throw new Error('JSONL 请求超过 64 MiB 上限。');
+        this.parts.push(piece);
+        if (newline !== -1) {
+          await this.frame(this.parts.length === 1 ? piece : Buffer.concat(this.parts, this.size));
+          this.parts = []; this.size = 0;
+        }
+        start = end;
+      }
+    })().then(() => callback(), callback);
+  }
+  _flush(callback) {
+    (async () => { if (this.size) await this.frame(Buffer.concat(this.parts, this.size)); })().then(() => callback(), callback);
+  }
+}

package/src/provider-switch.mjs

@@ -0,0 +1,207 @@
+import { isDeepStrictEqual } from 'node:util';
+import { randomUUID } from 'node:crypto';
+import { decodeAlias } from './model-menu.mjs';
+import { isRoutedProvider, findRoute, isChatProvider } from './config.mjs';
+
+// Private requests use the same initialized app-server connection. Their replies
+// and temporary archive lifecycle events must not appear as Desktop requests.
+export class ProviderSwitch {
+  constructor({ send, emit, getConfig, menu }) {
+    Object.assign(this, { send, emit, getConfig, menu });
+    this.prefix = `cdr-internal-${randomUUID()}-`;
+    this.sequence = 0; this.pending = new Map(); this.hidden = new Set();
+    this.settings = new Map(); this.waiters = new Set();
+  }
+  rpc(method, params) {
+    const id = this.prefix + (++this.sequence);
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => { this.pending.delete(id); reject(new Error('原生接口响应超时。')); }, 20000);
+      this.pending.set(id, { resolve, reject, timer });
+      this.send({ id, method, params });
+    });
+  }
+  response(message) {
+    if (message?.method === 'thread/settings/updated') {
+      const id = message.params?.threadId;
+      const value = message.params?.threadSettings;
+      if (id && value) {
+        this.settings.set(id, value);
+        if (this.settings.size > 10000) this.settings.delete(this.settings.keys().next().value);
+        for (const waiter of this.waiters) if (waiter.threadId === id && (!waiter.accept || waiter.accept(value))) { clearTimeout(waiter.timer); this.waiters.delete(waiter); waiter.resolve(value); }
+      }
+    }
+    const internal = typeof message?.id === 'string' && message.id.startsWith(this.prefix) && !message.method;
+    const pending = internal && this.pending.get(message.id);
+    if (pending) {
+      clearTimeout(pending.timer); this.pending.delete(message.id);
+      if (message.error) pending.reject(new Error('原生接口未能完成提供商切换。'));
+      else pending.resolve(message.result);
+      return null;
+    }
+    if (internal) return null; // Also discard late replies after a timeout.
+    const threadId = message?.params?.threadId || message?.params?.thread?.id;
+    if (threadId && this.hidden.has(threadId) && !Object.hasOwn(message, 'id')) return null;
+    if (message?.method === 'thread/closed') this.settings.delete(threadId);
+    return message;
+  }
+  async snapshot(threadId, loaded) {
+    if (this.settings.has(threadId)) return this.settings.get(threadId);
+    // A resumed thread seeds a native baseline and emits no unchanged snapshot.
+    // Elicit one by temporarily changing a reversible setting while input is
+    // serialized and the task is idle, then restore it before archiving.
+    let change, restore;
+    if (loaded.serviceTier != null && loaded.serviceTier !== 'default') {
+      change = { serviceTier: null }; restore = { serviceTier: loaded.serviceTier };
+    } else {
+      let cursor, model = findRoute(loaded.modelProvider, this.getConfig())?.catalog?.find(m => m.model === loaded.model);
+      while (!model) {
+        const page = await this.rpc('model/list', { includeHidden: true, limit: 100, ...(cursor ? { cursor } : {}) });
+        model = page.data.find(m => m.model === loaded.model); cursor = page.nextCursor;
+        if (!cursor) break;
+      }
+      const effort = model?.supportedReasoningEfforts?.find(e => e.reasoningEffort !== loaded.reasoningEffort && !['ultra', 'persistent'].includes(e.reasoningEffort));
+      if (effort) {
+        change = { effort: effort.reasoningEffort }; restore = { effort: loaded.reasoningEffort };
+      } else if (model?.serviceTiers?.length) {
+        change = { serviceTier: model.serviceTiers[0].id }; restore = { serviceTier: null };
+      } else throw new Error('原生接口未提供可安全读取的完整设置，请先在原菜单调整一次推理强度再试。');
+    }
+    let waiter;
+    const notification = new Promise((resolve, reject) => {
+      waiter = { threadId, resolve, reject, timer: setTimeout(() => { this.waiters.delete(waiter); reject(new Error('无法读取任务当前设置。')); }, 10000) };
+      this.waiters.add(waiter);
+    });
+    try {
+      const [, snapshot] = await Promise.all([this.rpc('thread/settings/update', { threadId, ...change }), notification]);
+      if (Object.hasOwn(restore, 'effort') && restore.effort == null) restore.collaborationMode = { ...snapshot.collaborationMode, settings: { ...snapshot.collaborationMode.settings, reasoning_effort: null } };
+      await this.applySettings({ threadId, model: snapshot.model, ...restore }, snapshot.modelProvider);
+      return this.settings.get(threadId);
+    } catch (error) {
+      await this.rpc('thread/settings/update', { threadId, ...restore });
+      throw error;
+    } finally { clearTimeout(waiter.timer); this.waiters.delete(waiter); }
+  }
+  async applySettings(params, provider) {
+    const current = this.settings.get(params.threadId);
+    // Native settings updates are no-ops (with no notification) when unchanged.
+    const same = current?.modelProvider === provider && Object.entries(params).every(([key, value]) => {
+      if (key === 'threadId' || (value == null && key !== 'serviceTier')) return true;
+      if (key === 'permissions') return value === current.activePermissionProfile?.id;
+      if (key === 'serviceTier') return (value ?? 'default') === (current[key] ?? 'default');
+      return isDeepStrictEqual(value, current[key]);
+    });
+    if (same) return;
+    let waiter;
+    const notification = new Promise((resolve, reject) => {
+      waiter = { threadId: params.threadId, accept: value => value.modelProvider === provider && value.model === params.model && (params.effort == null || value.effort === params.effort) && (!Object.hasOwn(params, 'serviceTier') || (value.serviceTier ?? 'default') === (params.serviceTier ?? 'default')),
+        resolve, reject, timer: setTimeout(() => { this.waiters.delete(waiter); reject(new Error('无法确认恢复后的任务设置。')); }, 10000) };
+      this.waiters.add(waiter);
+    });
+    try { await Promise.all([this.rpc('thread/settings/update', params), notification]); }
+    finally { clearTimeout(waiter.timer); this.waiters.delete(waiter); }
+  }
+  async prepare(message) {
+    if (!message || !Object.hasOwn(message, 'id') || !['thread/settings/update', 'turn/settings/update', 'turn/start'].includes(message.method)) return;
+    const params = message.params;
+    if (!params || typeof params.threadId !== 'string') return;
+    const config = this.getConfig();
+    const values = [params.model, params.config?.model, params.collaborationMode?.settings?.model].filter(v => v != null);
+    if (!values.length) return;
+    const selections = values.map(v => decodeAlias(v, config));
+    const models = values.map((v, i) => selections[i]?.model || v);
+    if (models.some(m => typeof m !== 'string' || m !== models[0])) throw new Error('请求中包含冲突的模型选择，请重新选择模型。');
+    const selected = selections.find(Boolean);
+    if (selections.some(s => s && s.provider !== selected.provider)) throw new Error("请求中包含冲突的提供商。");
+    const custom = Boolean(selected);
+    const known = this.menu.threads.get(params.threadId);
+    if (!custom && !isRoutedProvider(known, config)) return;
+    if (custom) this.menu.requireProvider(findRoute(selected.provider, config));
+    const { thread } = await this.rpc('thread/read', { threadId: params.threadId, includeTurns: false });
+    this.menu.rememberThread(thread);
+    if (custom && findRoute(thread.modelProvider, config) === findRoute(selected.provider, config) && isChatProvider(thread.modelProvider, config) === isChatProvider(selected.provider, config)) return;
+    const nativeProvider = (await this.rpc('config/read', { includeLayers: false })).config.model_provider || 'openai';
+    const provider = custom ? selected.provider : nativeProvider;
+    if (provider === thread.modelProvider) return;
+    if ((!isRoutedProvider(thread.modelProvider, config) && thread.modelProvider !== nativeProvider) || (!isRoutedProvider(provider, config) && provider !== nativeProvider)) throw new Error('当前任务属于其他提供商，请使用它原有的切换方式。');
+    if (custom && !config.enabled) throw new Error('Profile 路由已关闭；请先开启。');
+    if (thread.status?.type !== 'idle') throw new Error('请等当前回复和工具运行结束后，再切换提供商。');
+    if (thread.ephemeral || !thread.path) throw new Error('此任务尚未保存历史，无法安全切换提供商；请新建任务选择目标模型。');
+    // Native archive also archives descendants, so do not use it on an agent tree.
+    for (const archived of [false, true]) {
+      const children = await this.rpc('thread/list', { ancestorThreadId: thread.id, archived, limit: 1, modelProviders: [], sourceKinds: ['subAgent', 'subAgentReview', 'subAgentCompact', 'subAgentThreadSpawn', 'subAgentOther'] });
+      if (children.data.length) throw new Error('此任务含有子代理，暂不支持跨提供商切换；请新建任务选择目标模型。');
+    }
+    await this.switchThread(thread, provider, models[0], params);
+  }
+  resumeParams(threadId, snapshot, loaded, provider, model) {
+    const params = { threadId, excludeTurns: true, modelProvider: provider, model, cwd: snapshot.cwd,
+      approvalPolicy: snapshot.approvalPolicy, approvalsReviewer: snapshot.approvalsReviewer,
+      runtimeWorkspaceRoots: loaded.runtimeWorkspaceRoots, serviceTier: snapshot.serviceTier,
+      config: snapshot.effort == null ? {} : { model_reasoning_effort: snapshot.effort } };
+    const route = findRoute(provider, this.getConfig());
+    if (route?.catalogPath) params.config.model_catalog_json = route.catalogPath;
+    if (snapshot.activePermissionProfile?.id) params.permissions = snapshot.activePermissionProfile.id;
+    return params;
+  }
+  restoreParams(threadId, snapshot, model) {
+    const result = { threadId, cwd: snapshot.cwd, approvalPolicy: snapshot.approvalPolicy,
+      approvalsReviewer: snapshot.approvalsReviewer, model, serviceTier: snapshot.serviceTier,
+      disabledPluginIds: snapshot.disabledPluginIds, effort: snapshot.effort, summary: snapshot.summary, personality: snapshot.personality,
+      collaborationMode: { ...snapshot.collaborationMode, settings: { ...snapshot.collaborationMode.settings, model } } };
+    if (snapshot.activePermissionProfile?.id) result.permissions = snapshot.activePermissionProfile.id;
+    else result.sandboxPolicy = snapshot.sandboxPolicy;
+    return result;
+  }
+  async switchThread(thread, provider, model, requested = {}) {
+    const id = thread.id;
+    let snapshot, loaded, archived = false, closed = false, targetLoaded = false;
+    this.hidden.add(id);
+    try {
+      loaded = await this.rpc('thread/resume', { threadId: id, excludeTurns: true });
+      snapshot = await this.snapshot(id, loaded);
+      const desired = { ...snapshot };
+      if (requested.effort != null) desired.effort = requested.effort;
+      if (requested.collaborationMode != null) {
+        desired.collaborationMode = requested.collaborationMode;
+        if (requested.collaborationMode.settings.reasoning_effort != null) desired.effort = requested.collaborationMode.settings.reasoning_effort;
+      } else if (requested.effort != null) {
+        desired.collaborationMode = { ...snapshot.collaborationMode, settings: { ...snapshot.collaborationMode.settings, reasoning_effort: requested.effort } };
+      }
+      // Archiving uses Codex's own graceful shutdown and journal flush. Unarchive
+      // immediately restores the same thread before resuming with the new provider.
+      await this.rpc('thread/archive', { threadId: id }); archived = true; closed = true;
+      await this.rpc('thread/unarchive', { threadId: id }); archived = false;
+      const resumed = await this.rpc('thread/resume', this.resumeParams(id, desired, loaded, provider, model));
+      targetLoaded = true;
+      if (resumed.thread.id !== id || resumed.modelProvider !== provider) throw new Error('恢复后的提供商不匹配。');
+      this.settings.delete(id);
+      await this.snapshot(id, resumed);
+      await this.applySettings(this.restoreParams(id, desired, model), provider);
+      this.menu.rememberThread(resumed.thread);
+    } catch (error) {
+      if (closed && snapshot && loaded) {
+        try {
+          if (targetLoaded) { await this.rpc('thread/archive', { threadId: id }); archived = true; }
+          if (archived) { await this.rpc('thread/unarchive', { threadId: id }); archived = false; }
+          const original = await this.rpc('thread/resume', this.resumeParams(id, snapshot, loaded, snapshot.modelProvider, snapshot.model));
+          this.settings.delete(id);
+          await this.snapshot(id, original);
+          await this.applySettings(this.restoreParams(id, snapshot, snapshot.model), snapshot.modelProvider);
+          this.menu.rememberThread(original.thread);
+        } catch {
+          throw new Error('提供商切换未完成。历史记录已保留，请重新打开任务；不要重复发送消息。');
+        }
+      }
+      throw new Error(`提供商未切换，仍保留原任务。${error.message}`);
+    } finally {
+      this.hidden.delete(id);
+      const current = this.settings.get(id);
+      if (current) this.emit({ method: 'thread/settings/updated', params: { threadId: id, threadSettings: current } });
+    }
+  }
+  close() {
+    for (const pending of this.pending.values()) { clearTimeout(pending.timer); pending.reject(new Error('原生进程已退出。')); }
+    for (const waiter of this.waiters) { clearTimeout(waiter.timer); waiter.reject(new Error('原生进程已退出。')); }
+    this.pending.clear(); this.waiters.clear();
+  }
+}

package/src/proxy.mjs

@@ -0,0 +1,164 @@
+import { watchUpdates } from './update.mjs';
+import { spawn } from 'node:child_process';
+import { join } from 'node:path';
+import { rmSync, existsSync, readFileSync } from 'node:fs';
+import { JsonLineRouter } from './protocol.mjs';
+import { ModelMenu } from './model-menu.mjs';
+import { ProviderSwitch } from './provider-switch.mjs';
+import { Picker } from './picker.mjs';
+import { Chat } from './chat.mjs';
+import { ProfileCatalogs, applyLayers } from './profiles.mjs';
+import { VERSION, readConfig, configPath, codexHome, atomicJSON, resolveRealCodex, providerArgs, childEnvironment, discoverProfiles } from './config.mjs';
+
+export function isStdioServer(args) {
+  // Skip values of global flags before finding the CLI subcommand.
+  let index = 0;
+  const valueFlags = new Set(['-c', '--config', '--enable', '--disable', '-p', '--profile', '--code-mode-host']);
+  while (index < args.length && args[index].startsWith('-')) {
+    if (valueFlags.has(args[index])) index += 2; else index++;
+  }
+  if (args[index] !== 'app-server') return false;
+  for (let i = index + 1; i < args.length; i++) {
+    const arg = args[i];
+    if (['--help', '-h', '--version', '-V'].includes(arg)) return false;
+    if (arg.startsWith('--listen=')) { if (arg.slice(9) !== 'stdio://') return false; continue; }
+    if (arg === '--listen') { if (args[++i] !== 'stdio://') return false; continue; }
+    if (valueFlags.has(arg) || ['--ws-auth', '--ws-token-file', '--ws-token-sha256', '--ws-shared-secret-file', '--ws-issuer', '--ws-audience', '--ws-max-clock-skew-seconds'].includes(arg)) { i++; continue; }
+    if (!arg.startsWith('-')) return false; // daemon/proxy/schema tooling
+  }
+  return true;
+}
+
+export async function runProxy(args, selfPath) {
+  if ((Number.parseInt(process.env.CODEX_DESKTOP_ROUTER_ACTIVE, 10) || 0) >= 8) throw new Error('检测到 router 递归调用；CODEX_DESKTOP_ROUTER_REAL_CODEX 必须指向真正的 codex。');
+  const path = configPath();
+  readConfig(path);
+  const hadConfig = existsSync(path);
+  const executable = resolveRealCodex(selfPath);
+  const routed = isStdioServer(args);
+  const stopUpdates = routed ? watchUpdates() : () => {};
+  const routes = routed ? discoverProfiles() : [];
+  const env = childEnvironment(routes);
+  env.CODEX_CLI_PATH = executable;
+  const chats = routes.filter(r => r.chat).map(route => new Chat({ config: route, key: env[route.providerDefinition.env_key], env }));
+  const picker = routed ? new Picker({ chats }) : null;
+  const endpoint = picker ? await picker.listen() : null;
+  for (const chat of chats) env[chat.envKey] = chat.token;
+  const definitions = new Map(chats.map(chat => [chat.config.provider, chat.definition(endpoint.port)]));
+  // app-server's own -c options replace root-level -c values. Desktop sends
+  // both, so append our provider in the subcommand scope or it disappears.
+  const child = spawn(executable, [...args, ...(routed ? providerArgs(routes, definitions) : [])], { env, stdio: routed ? ['pipe', 'pipe', 'inherit'] : 'inherit' });
+  let killTimer, hardTimer, router, output, switches, catalogs, initializeId, failed = false;
+  const runtimePath = join(codexHome(), 'desktop-router-runs', `${process.pid}.json`);
+  const pickerPath = join(codexHome(), 'desktop-router-runs', `${process.pid}.picker.json`);
+  const metadata = { pid: process.pid, childPid: child.pid, version: VERSION, startedAt: new Date().toISOString(), configPath: path, routedStarts: 0, modelListsAugmented: 0, menuSelections: 0, prewarmsSkipped: 0, executable };
+  const save = () => { try { atomicJSON(runtimePath, metadata); } catch { /* diagnostics must not interrupt work */ } };
+  const stop = (signal = 'SIGTERM') => {
+    child.kill(signal);
+    if (!hardTimer) { hardTimer = setTimeout(() => child.kill('SIGKILL'), 5000); hardTimer.unref(); }
+  };
+  const fail = () => { failed = true; process.stderr.write('codex-desktop-router: 传输失败，已停止 app-server。\n'); stop(); };
+  const signals = new Map(['SIGINT', 'SIGTERM', 'SIGHUP'].map(signal => [signal, () => stop(signal)]));
+  for (const [signal, handler] of signals) process.on(signal, handler);
+  if (routed) {
+    save();
+    const getConfig = () => {
+      if (hadConfig && !existsSync(path)) throw new Error('路由配置被删除；请恢复配置。');
+      return { ...readConfig(path), routes };
+    };
+    const requireProvider = route => {
+      if (!route || route.error) throw new Error(route?.error || 'Profile 已不存在，请重启 Desktop。');
+      const current = discoverProfiles().find(r => r.profile === route.profile);
+      if (!current || current.fingerprint !== route.fingerprint) throw new Error('Profile 已改变，请重启 Desktop 后再选择。');
+      if (!route.providerDefinition) throw new Error(`Profile ${route.profile} 引用的提供商没有定义。`);
+      const key = route.providerDefinition.env_key;
+      if (key && !env[key]) throw new Error(`Profile ${route.profile} 缺少所需环境变量。`);
+    };
+    const selectionPath = `${path}.selection.json`;
+    const menu = new ModelMenu({
+      getConfig, requireProvider,
+      readSelection: () => { try { return JSON.parse(readFileSync(selectionPath, 'utf8')); } catch { return null; } },
+      saveSelection: selection => { try { atomicJSON(selectionPath, selection); } catch { process.stderr.write('codex-desktop-router: 菜单默认选择未能保存。\n'); } },
+      onCatalog: () => { metadata.modelListsAugmented++; save(); },
+      onPrewarmSkipped: () => { metadata.prewarmsSkipped++; save(); },
+      onSelection: method => { metadata.menuSelections++; if (method === 'thread/start') metadata.routedStarts++; save(); }
+    });
+    let present;
+    const emit = message => present(message).then(visible => { if (visible != null) process.stdout.write(JSON.stringify(visible) + '\n'); }).catch(fail);
+    switches = new ProviderSwitch({
+      getConfig, menu,
+      send: message => { catalogs.forward(message).then(forwarded => { if (!forwarded) child.stdin.write(JSON.stringify(message) + '\n'); }).catch(() => emit({ id: message.id, error: { code: -32603, message: '模型目录进程无法接收请求。' } })); },
+      emit: message => process.stdout.write(JSON.stringify(menu.response(message)) + '\n')
+    });
+    let queue = Promise.resolve();
+    const serialize = operation => { const result = queue.then(operation); queue = result.catch(() => {}); return result; };
+    catalogs = new ProfileCatalogs(executable, [...args, ...providerArgs(routes, definitions)], env, getConfig, emit);
+    catalogs.readThread = async threadId => (await switches.rpc('thread/read', { threadId, includeTurns: false })).thread;
+    let ready = Promise.resolve();
+    const refreshCatalogs = async () => {
+      await ready;
+      for (const route of routes) if (route.catalogPath) {
+        try { route.catalog = await catalogs.load(route.catalogPath); route.error = null; }
+        catch { route.error = `Profile ${route.profile} 的模型目录无法加载，请检查 model_catalog_json。`; }
+      }
+    };
+    Object.assign(picker, { bridge: switches, menu, getConfig, serialize, refreshCatalogs });
+    for (const chat of chats) Object.assign(chat, { bridge: switches, menu });
+    present = async message => {
+      picker.response(message);
+      for (const chat of chats) chat.response(message);
+      if (initializeId !== undefined && message?.id === initializeId && !message.method && message.result && menu.desktopClient) {
+        initializeId = undefined;
+        ready = switches.rpc('config/read', { includeLayers: true }).then(({ layers }) => {
+          for (const route of routes) Object.assign(route, applyLayers(route, layers));
+        });
+        ready.catch(() => {});
+        try { atomicJSON(pickerPath, { pid: process.pid, ...endpoint }); }
+        catch { process.stderr.write('codex-desktop-router: 独立模型选择页启动失败，原生菜单仍可使用。\n'); }
+      }
+      const visible = switches.response(message); return visible == null ? null : menu.response(visible);
+    };
+    // Frame the primary stream before emitting worker messages. Independent
+    // processes may split JSON across chunks; their bytes must never interleave.
+    output = new JsonLineRouter({ rewriteMessage: async message => present(await catalogs.observe(message)), onReject: fail });
+    router = new JsonLineRouter({
+      runFrame: serialize,
+      rewriteMessage: async message => {
+        if (message?.method === 'initialize') { initializeId = message.id; catalogs.initialize = message.params; }
+        if (message?.method !== 'initialize') await ready;
+        if (message?.method === 'model/list') await refreshCatalogs();
+        const selected = picker.request(message);
+        await switches.prepare(selected);
+        const routed = menu.request(selected);
+        for (const chat of chats) await chat.prepare(routed);
+        return await catalogs.forward(routed) ? null : routed;
+      },
+      onReject: error => {
+        picker.response(error);
+        for (const chat of chats) chat.response(error);
+        menu.response(error);
+        if (!process.stdout.write(JSON.stringify(error) + '\n')) {
+          process.stdin.pause();
+          process.stdout.once('drain', () => process.stdin.resume());
+        }
+      }
+    });
+    for (const stream of [router, output, child.stdin, child.stdout]) stream.on('error', fail);
+    process.stdin.pipe(router).pipe(child.stdin);
+    child.stdout.pipe(output).pipe(process.stdout, { end: false });
+    process.stdin.once('end', () => { killTimer = setTimeout(() => stop(), 10000); killTimer.unref(); });
+    process.stdin.on('error', fail);
+    process.stdout.on('error', fail);
+  }
+  return await new Promise(resolve => {
+    child.once('error', () => { failed = true; process.stderr.write('codex-desktop-router: 无法启动真正的 codex。\n'); });
+    child.once('close', async (code, signal) => {
+      stopUpdates(); clearTimeout(killTimer); clearTimeout(hardTimer); await catalogs?.close(); switches?.close(); picker?.close();
+      for (const [name, handler] of signals) process.removeListener(name, handler);
+      process.stdin.removeListener('error', fail); process.stdout.removeListener('error', fail);
+      if (router) { process.stdin.unpipe(router); process.stdin.pause(); router.destroy(); }
+      if (routed) { rmSync(runtimePath, { force: true }); rmSync(pickerPath, { force: true }); }
+      resolve(failed ? 1 : code ?? ({ SIGINT: 130, SIGTERM: 143, SIGHUP: 129 }[signal] || 1));
+    });
+  });
+}

package/src/rpc.mjs

@@ -0,0 +1,55 @@
+import { randomUUID } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { createInterface } from 'node:readline';
+
+export function rpcClient(executable, args, env, timeout = 30000, onMessage = null) {
+  const child = spawn(executable, args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
+  child.stderr.resume();
+  let seq = 0, closed = false;
+  const prefix = `cdr-rpc-${randomUUID()}-`;
+  const pending = new Map(), notifications = [], waiters = new Set();
+  const lineReader = createInterface({ input: child.stdout });
+  const abort = () => {
+    closed = true;
+    for (const p of [...pending.values(), ...waiters]) { clearTimeout(p.timer); p.reject(new Error('app-server 已退出。')); }
+    pending.clear(); waiters.clear();
+  };
+  child.stdin.on('error', abort); child.on('error', abort); child.on('close', abort);
+  const done = new Promise(resolve => child.once('close', resolve));
+  lineReader.on('line', line => {
+    let message;
+    try { message = JSON.parse(line); } catch { abort(); child.kill(); return; }
+    if (Object.hasOwn(message, 'id') && pending.has(message.id)) {
+      const p = pending.get(message.id); clearTimeout(p.timer); pending.delete(message.id);
+      if (message.error) { p.error.message = `RPC ${p.method} 返回错误 ${message.error.code}。`; p.reject(p.error); } else p.resolve(message.result);
+    } else {
+      if (onMessage) { onMessage(message); return; }
+      notifications.push(message);
+      if (notifications.length > 10000) notifications.shift();
+      for (const p of waiters) if (p.predicate(message)) { clearTimeout(p.timer); waiters.delete(p); p.resolve(message); }
+    }
+  });
+  return {
+    child,
+    send(message) { if (closed) throw new Error('app-server 已退出。'); child.stdin.write(JSON.stringify(message) + '\n'); },
+    rpc(method, params) { return new Promise((resolve, reject) => {
+      if (closed) return reject(new Error('app-server 已退出。'));
+      const id = prefix + (++seq);
+      const timer = setTimeout(() => { pending.delete(id); reject(new Error(`RPC ${method} 超时。`)); }, timeout);
+      pending.set(id, { method, resolve, reject, timer, error: new Error(`RPC ${method}`) }); child.stdin.write(JSON.stringify({ id, method, params }) + '\n');
+    }); },
+    wait(predicate) {
+      const found = notifications.find(predicate); if (found) return Promise.resolve(found);
+      return new Promise((resolve, reject) => {
+        if (closed) return reject(new Error('app-server 已退出。'));
+        const p = { predicate, resolve, reject };
+        p.timer = setTimeout(() => { waiters.delete(p); reject(new Error('等待完成通知超时。')); }, timeout); waiters.add(p);
+      });
+    },
+    async close() {
+      if (closed) return;
+      child.stdin.end(); const timer = setTimeout(() => child.kill('SIGKILL'), 12000);
+      await done; clearTimeout(timer);
+    }
+  };
+}

package/src/update.mjs

@@ -0,0 +1,58 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { VERSION, codexHome, atomicJSON } from './config.mjs';
+
+const name = '@ailuntz/codex-desktop-router';
+const interval = 24 * 60 * 60 * 1000;
+const version = value => typeof value === 'string' && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value) && value.split('.').every(n => Number.isSafeInteger(Number(n)));
+const disabled = () => Boolean(process.env.CODEX_DESKTOP_ROUTER_NO_UPDATE_CHECK || process.env.CI || process.env.NODE_TEST_CONTEXT);
+const pathFor = home => join(home, 'desktop-router-update.json');
+
+export function isNewer(latest, current) {
+  if (!version(latest) || !version(current)) return false;
+  const left = latest.split('.').map(Number), right = current.split('.').map(Number);
+  for (let i = 0; i < 3; i++) if (left[i] !== right[i]) return left[i] > right[i];
+  return false;
+}
+
+function read(home) {
+  try {
+    const value = JSON.parse(readFileSync(pathFor(home), 'utf8'));
+    return { checkedAt: Number.isFinite(value.checkedAt) ? value.checkedAt : 0, latest: version(value.latest) ? value.latest : null };
+  } catch { return { checkedAt: 0, latest: null }; }
+}
+
+export function updateStatus(home = codexHome()) {
+  const state = read(home);
+  return { current: VERSION, latest: state.latest, available: isNewer(state.latest, VERSION),
+    command: `npm install -g ${name}@latest && codex-desktop-router install` };
+}
+
+export async function checkForUpdates({ home = codexHome(), fetcher = fetch, now = Date.now(), skip = disabled() } = {}) {
+  const state = read(home);
+  if (skip || (state.checkedAt > 0 && now >= state.checkedAt && now - state.checkedAt < interval)) return updateStatus(home);
+  try {
+    // Record the attempt before I/O so offline starts also respect the interval.
+    atomicJSON(pathFor(home), { ...state, checkedAt: now });
+    const response = await fetcher(`https://registry.npmjs.org/${encodeURIComponent(name)}/latest`, {
+      headers: { accept: 'application/json' }, signal: AbortSignal.timeout(1500), redirect: 'error'
+    });
+    if (!response.ok) { await response.body?.cancel(); return updateStatus(home); }
+    const chunks = []; let size = 0;
+    for await (const chunk of response.body) {
+      size += chunk.length;
+      if (size > 65536) throw new Error('Oversized registry response');
+      chunks.push(chunk);
+    }
+    const manifest = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    if (manifest.name === name && version(manifest.version)) atomicJSON(pathFor(home), { checkedAt: now, latest: manifest.version });
+  } catch { /* Updates must never interrupt native requests or offline use. */ }
+  return updateStatus(home);
+}
+
+export function watchUpdates() {
+  void checkForUpdates();
+  const timer = setInterval(() => { void checkForUpdates(); }, interval);
+  timer.unref();
+  return () => clearInterval(timer);
+}