@ailuntz/minilink 0.9.9 → 0.9.11

package/README.md

@@ -26,6 +26,10 @@ minilink on
 
 `npm install` 只安装命令；`minilink on` 才接入 Desktop。更新包后再次运行 `minilink on`。
 
+本机 Desktop 集成调用 Desktop 自带的 Codex；SSH 远程入口调用远程主机的独立 Codex。配置和会话仍使用官方的 `CODEX_HOME`（默认 `~/.codex`）；MiniLink 自己的启动文件放在 `~/.local/share/minilink`。
+
+从 MacBook 的 Desktop 通过 SSH 使用 Mac mini 会话时，也要在 **Mac mini** 上安装并运行 `minilink on`。远程入口使用 Mac mini 的独立 Codex，并把模型列表和选择接入 MiniLink。`on` 会在远程登录 shell 中设置仅供 Codex SSH 启动器使用的 `CODEX_INSTALL_DIR`；`off` 会撤销这段设置。重新连接远程主机后生效。
+
 ## 命令
 
 | 命令 | 用途 |

package/bin/minilink.mjs

@@ -4,9 +4,10 @@ import { fileURLToPath } from 'node:url';
 import { VERSION, readConfig, configPath, codexHome, atomicJSON, discoverProfiles, resolveRealCodex, childEnvironment } from '../src/config.mjs';
 import { startUpdate, updateStatus } from '../src/update.mjs';
 import { runProxy } from '../src/proxy.mjs';
+import { runRemoteProxy } from '../src/remote.mjs';
 import { pickerEndpoints } from '../src/picker.mjs';
 import { selectModel, text, language } from '../src/terminal.mjs';
-import { installation, environmentStatus, syncLaunchEnvironment, ensureInstalled } from '../src/install.mjs';
+import { installation, environmentStatus, syncLaunchEnvironment, syncRemoteEnvironment, ensureInstalled } from '../src/install.mjs';
 
 const self = fileURLToPath(import.meta.url), args = process.argv.slice(2);
 const commands = ['on', 'link', 'off', 'doctor'];
@@ -22,8 +23,14 @@ async function main() {
     if (command === 'on') { discoverProfiles(); ensureInstalled(); }
     atomicJSON(configPath(), { version: 1, enabled: command === 'on' });
     syncLaunchEnvironment({ enabled: command === 'on' });
+    syncRemoteEnvironment({ enabled: command === 'on' });
     return output(text(command));
   }
+  if (command === 'remote-proxy') {
+    if (args.length !== 1) throw new Error('remote-proxy 不接受额外参数。');
+    process.exitCode = await runRemoteProxy();
+    return;
+  }
   if (command === 'link') {
     if (!readConfig().enabled) throw new Error(text('disabled'));
     return output(await selectModel(pickerEndpoints(codexHome())));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ailuntz/minilink",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Use your Codex profiles in the Desktop model menu.",
   "type": "module",
   "license": "MIT AND Apache-2.0",

package/src/config.mjs

@@ -1,6 +1,6 @@
 import { readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, realpathSync, accessSync, constants, statSync, copyFileSync, mkdtempSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { resolve, join, dirname, isAbsolute } from 'node:path';
+import { resolve, join, dirname } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { parseEnv } from 'node:util';
@@ -104,8 +104,8 @@ export function findApp() {
 }
 
 export function resolveRealCodex(selfPath) {
-  const candidate = setting('REAL_CODEX') || officialCodex();
-  if (!candidate || !isAbsolute(candidate)) throw new Error('找不到内置 Codex；可用 MINILINK_REAL_CODEX 指定绝对路径。');
+  const candidate = officialCodex();
+  if (!candidate) throw new Error('找不到 ChatGPT 内置 Codex。');
   let actual;
   try { actual = realpathSync(candidate); accessSync(actual, constants.X_OK); } catch { throw new Error('真正的 Codex 不存在或不可执行。'); }
   if (actual === realpathSync(selfPath) || actual === realpathSync(process.execPath)) throw new Error('检测到路由递归调用。');

package/src/install.mjs

@@ -14,6 +14,8 @@ export const xml = value => value.replaceAll('&', '&amp;').replaceAll('<', '&lt;
 const launchctl = (args, required = true) => { try { return execFileSync('/bin/launchctl', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim(); } catch { if (required) throw new Error(`launchctl ${args[0]} 失败。`); return null; } };
 const defaultPlist = () => join(homedir(), 'Library/LaunchAgents', `${label}.plist`);
 const sourceRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const remoteStart = '# >>> minilink remote';
+const remoteEnd = '# <<< minilink remote';
 export function installation(root = installRoot()) {
   try { return JSON.parse(readFileSync(join(root, 'installation.json'), 'utf8')); } catch (e) { if (e.code === 'ENOENT') return null; throw new Error('安装状态损坏，请检查 installation.json。'); }
 }
@@ -51,6 +53,19 @@ export function syncLaunchEnvironment({ state = installation(), run = launchctl,
   }
 }
 
+// The Desktop SSH launcher places CODEX_INSTALL_DIR first in PATH. It starts
+// an interactive login shell with CODEX_REMOTE_PAYLOAD set before doing so.
+// Keep the change scoped to that launcher and preserve the user's shell file.
+export function syncRemoteEnvironment({ state = installation(), enabled, rc = join(homedir(), '.zshrc') } = {}) {
+  if (process.platform !== 'darwin' || !state?.remoteDir) return;
+  const existing = existsSync(rc) ? readFileSync(rc, 'utf8') : '';
+  const pattern = /(?:\n|^)# >>> minilink remote\n[\s\S]*?# <<< minilink remote\n?/g;
+  const clean = existing.replace(pattern, '\n').replace(/\n+$/, '');
+  const block = `${remoteStart}\nif [ -n "\${CODEX_REMOTE_PAYLOAD:-}" ] && [ -z "\${CODEX_INSTALL_DIR:-}" ]; then\n  export CODEX_INSTALL_DIR=${shellQuote(state.remoteDir)}\nfi\n${remoteEnd}`;
+  const updated = (clean ? clean + '\n' : '') + (enabled ? block + '\n' : '');
+  if (updated !== existing) atomicFile(rc, updated, existsSync(rc) ? statSync(rc).mode & 0o777 : 0o644);
+}
+
 function atomicFile(path, text, mode) {
   const temporary = `${path}.${process.pid}.tmp`;
   try { writeFileSync(temporary, text, { mode }); renameSync(temporary, path); }
@@ -130,6 +145,8 @@ function installWindows({ root = installRoot(), source = sourceRoot, home = code
 export function install({ root = installRoot(), plist = defaultPlist(), source = sourceRoot, home = codexHome(), config = configPath(), node = process.execPath, npm = process.env.npm_execpath, prefix = process.env.npm_config_prefix, run = launchctl, legacy = root === installRoot() ? legacyInstallation() : null } = {}) {
   if (process.platform !== 'darwin') throw new Error('Desktop 接入目前仅支持 macOS。');
   const previous = installation(root), wrapper = join(root, 'minilink');
+  const remoteDir = join(root, 'remote/bin'), remoteWrapper = join(remoteDir, 'codex');
+  const remoteCodex = join(home, 'packages/standalone/current/bin/codex');
   const packageManager = npm && prefix ? { npm, prefix } : previous?.npm && previous?.prefix ? { npm: previous.npm, prefix: previous.prefix } : npmDetails();
   if (existsSync(plist) && !previous) throw new Error('同名 LaunchAgent 已存在且不属于本次安装。');
   const env = run(['getenv', 'CODEX_CLI_PATH'], false) || null;
@@ -138,7 +155,7 @@ export function install({ root = installRoot(), plist = defaultPlist(), source =
   const runtime = mkdtempSync(join(root, 'releases', 'runtime-'));
   const activate = join(root, 'activate.sh'), stateFile = join(root, 'installation.json');
   const migrationFiles = legacy ? [legacy.state.wrapper, legacy.stateFile, legacy.plist, legacy.activate, config, `${config}.selection.json`] : [];
-  const snapshots = [...new Set([wrapper, activate, plist, stateFile, ...migrationFiles])].map(path => ({ path, data: existsSync(path) ? readFileSync(path) : null }));
+  const snapshots = [...new Set([wrapper, remoteWrapper, activate, plist, stateFile, ...migrationFiles])].map(path => ({ path, data: existsSync(path) ? readFileSync(path) : null }));
   let migrationLocked = false, retired = false, touched = false;
   try {
     if (legacy) {
@@ -161,10 +178,12 @@ export function install({ root = installRoot(), plist = defaultPlist(), source =
     }
     if (JSON.parse(readFileSync(join(dependency, 'package.json'), 'utf8')).name !== 'smol-toml') throw new Error('smol-toml 依赖路径无效。');
     cpSync(dependency, join(runtime, 'node_modules/smol-toml'), { recursive: true });
-    const state = { version: 2, packageVersion: VERSION, source, runtime, wrapper, node, npm: packageManager.npm || previous?.npm, prefix: packageManager.prefix || previous?.prefix, codexHome: home, configPath: config, previousEnv: previous?.previousEnv || legacy?.state.previousEnv || null, installedAt: new Date().toISOString() };
+    const state = { version: 3, packageVersion: VERSION, source, runtime, wrapper, remoteDir, node, npm: packageManager.npm || previous?.npm, prefix: packageManager.prefix || previous?.prefix, codexHome: home, configPath: config, previousEnv: previous?.previousEnv || legacy?.state.previousEnv || null, installedAt: new Date().toISOString() };
     // A Desktop process can retain this launcher after npm removes the state.
     const fallback = `if [ ! -f ${shellQuote(stateFile)} ]; then\n  exec "\${CODEX_DESKTOP_APP:-/Applications/ChatGPT.app}/${bundledCodexRelativePath}" "$@"\nfi`;
     atomicFile(wrapper, `#!/bin/sh\n${fallback}\nexport CODEX_HOME=${shellQuote(home)}\nexport MINILINK_CONFIG=${shellQuote(config)}\nexec ${shellQuote(node)} ${shellQuote(join(runtime, 'bin/minilink.mjs'))} "$@"\n`, 0o755);
+    mkdirSync(remoteDir, { recursive: true, mode: 0o700 });
+    atomicFile(remoteWrapper, `#!/bin/sh\nif [ "$1" = app-server ] && [ "$2" = proxy ] && [ "$#" -eq 2 ] && [ -f ${shellQuote(join(runtime, 'bin/minilink.mjs'))} ]; then\n  export CODEX_HOME=${shellQuote(home)}\n  export MINILINK_CONFIG=${shellQuote(config)}\n  export MINILINK_REMOTE_CODEX=${shellQuote(remoteCodex)}\n  exec ${shellQuote(node)} ${shellQuote(join(runtime, 'bin/minilink.mjs'))} remote-proxy\nfi\nexec ${shellQuote(remoteCodex)} "$@"\n`, 0o755);
     atomicFile(activate, `#!/bin/sh\nexec ${shellQuote(node)} ${shellQuote(join(runtime, 'src/lifecycle.mjs'))}\n`, 0o700);
     mkdirSync(dirname(plist), { recursive: true });
     atomicFile(plist, `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>${label}</string><key>ProgramArguments</key><array><string>/bin/sh</string><string>${xml(activate)}</string></array><key>RunAtLoad</key><true/><key>StartInterval</key><integer>30</integer><key>LimitLoadToSessionType</key><string>Aqua</string></dict></plist>\n`, 0o600);
@@ -183,7 +202,7 @@ export function install({ root = installRoot(), plist = defaultPlist(), source =
     return state;
   } catch (error) {
     if (!touched) { rmSync(runtime, { recursive: true, force: true }); throw error; }
-    for (const { path, data } of snapshots) { if (data === null) rmSync(path, { force: true }); else atomicFile(path, data, [wrapper, legacy?.state.wrapper].includes(path) ? 0o755 : [activate, legacy?.activate].includes(path) ? 0o700 : 0o600); }
+    for (const { path, data } of snapshots) { if (data === null) rmSync(path, { force: true }); else atomicFile(path, data, [wrapper, remoteWrapper, legacy?.state.wrapper].includes(path) ? 0o755 : [activate, legacy?.activate].includes(path) ? 0o700 : 0o600); }
     run(['bootout', `gui/${process.getuid()}/${label}`], false);
     if (previous) run(['bootstrap', `gui/${process.getuid()}`, plist], false);
     if (retired) run(['bootstrap', `gui/${process.getuid()}`, legacy.plist], false);

package/src/proxy.mjs

@@ -3,7 +3,7 @@ import { runtimeDirectory } from './runtime.mjs';
 import { randomUUID } from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { join } from 'node:path';
-import { rmSync, existsSync, readFileSync } from 'node:fs';
+import { rmSync, existsSync, readFileSync, realpathSync, accessSync, constants } from 'node:fs';
 import { JsonLineRouter } from './protocol.mjs';
 import { ModelMenu } from './model-menu.mjs';
 import { ProviderSwitch } from './provider-switch.mjs';
@@ -32,11 +32,13 @@ export function isStdioServer(args) {
 }
 
 export async function runProxy(args, selfPath) {
-  if ((Number.parseInt(setting('ACTIVE'), 10) || 0) >= 8) throw new Error('检测到 minilink 递归调用；MINILINK_REAL_CODEX 必须指向真正的 codex。');
+  if ((Number.parseInt(setting('ACTIVE'), 10) || 0) >= 8) throw new Error('检测到 minilink 递归调用。');
   const path = configPath();
   const enabled = readConfig(path).enabled;
   const hadConfig = existsSync(path);
-  const executable = resolveRealCodex(selfPath);
+  const executable = process.env.MINILINK_REMOTE_BRIDGE === '1' && process.env.MINILINK_REMOTE_CODEX
+    ? realpathSync(process.env.MINILINK_REMOTE_CODEX) : resolveRealCodex(selfPath);
+  accessSync(executable, constants.X_OK);
   const routed = enabled && isStdioServer(args);
   const routes = routed ? discoverProfiles() : [];
   const env = enabled ? childEnvironment(routes) : { ...process.env, MINILINK_ACTIVE: String((Number.parseInt(setting('ACTIVE'), 10) || 0) + 1) };

package/src/remote.mjs

@@ -0,0 +1,125 @@
+import { createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { TextDecoder } from 'node:util';
+import { readConfig } from './config.mjs';
+
+const MAX_MESSAGE = 64 * 1024 * 1024;
+const MAX_HEADER = 16 * 1024;
+const GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+
+function frame(opcode, payload = Buffer.alloc(0)) {
+  const size = payload.length;
+  const header = size < 126 ? Buffer.from([0x80 | opcode, size])
+    : size < 65536 ? Buffer.from([0x80 | opcode, 126, size >> 8, size & 255])
+      : Buffer.from([0x80 | opcode, 127, 0, 0, 0, 0, (size / 0x1000000) & 255, (size >>> 16) & 255, (size >>> 8) & 255, size & 255]);
+  return Buffer.concat([header, payload]);
+}
+
+// The Codex SSH launcher prints its own eight-byte marker, then runs
+// `codex app-server proxy`. That proxy carries a WebSocket handshake and
+// frames over stdio. Bridge those frames to MiniLink's existing JSONL router.
+export class RemoteBridge {
+  constructor({ input, output, backend }) {
+    Object.assign(this, { input, output, backend });
+    this.buffer = Buffer.alloc(0);
+    this.lines = Buffer.alloc(0);
+    this.handshaken = false;
+    this.fragment = null;
+    this.fragmentSize = 0;
+    this.closed = false;
+    input.on('data', chunk => this.receive(chunk));
+    input.on('end', () => backend.stdin.end());
+    input.on('error', () => backend.kill());
+    backend.stdout.on('data', chunk => this.backendOutput(chunk));
+    backend.stdout.on('error', () => backend.kill());
+    backend.stderr.pipe(process.stderr, { end: false });
+    backend.on('close', () => { this.closed = true; output.end(); });
+    backend.on('error', () => { this.close(1011); });
+  }
+  close(code = 1002) {
+    if (this.closed) return;
+    this.closed = true;
+    this.output.write(frame(8, Buffer.from([code >> 8, code & 255])));
+    this.backend.kill();
+    this.output.end();
+  }
+  receive(chunk) {
+    if (this.closed) return;
+    this.buffer = Buffer.concat([this.buffer, chunk]);
+    if (!this.handshaken) {
+      if (this.buffer.length > MAX_HEADER) return this.close();
+      const end = this.buffer.indexOf('\r\n\r\n');
+      if (end < 0) return;
+      const header = this.buffer.subarray(0, end + 4).toString('latin1');
+      const key = /^sec-websocket-key:\s*([^\r\n]+)\s*$/im.exec(header)?.[1]?.trim();
+      if (!/^GET [^\r\n]+ HTTP\/1\.1\r\n/i.test(header) || !/^upgrade:\s*websocket\s*$/im.test(header) || !/^connection:.*\bupgrade\b/im.test(header) || !key || Buffer.from(key, 'base64').length !== 16) return this.close();
+      const accept = createHash('sha1').update(key + GUID).digest('base64');
+      this.output.write(`HTTP/1.1 101 Switching Protocols\r\nconnection: Upgrade\r\nupgrade: websocket\r\nsec-websocket-accept: ${accept}\r\nx-codex-websocket-max-unfragmented-message-bytes: 16777216\r\n\r\n`);
+      this.buffer = this.buffer.subarray(end + 4);
+      this.handshaken = true;
+    }
+    while (this.buffer.length >= 2 && !this.closed) {
+      const first = this.buffer[0], second = this.buffer[1];
+      const opcode = first & 15, fin = Boolean(first & 0x80);
+      if (first & 0x70 || !(second & 0x80)) return this.close();
+      let length = second & 127, offset = 2;
+      if (length === 126) {
+        if (this.buffer.length < 4) return;
+        length = this.buffer.readUInt16BE(2); offset = 4;
+      } else if (length === 127) {
+        if (this.buffer.length < 10) return;
+        length = Number(this.buffer.readBigUInt64BE(2)); offset = 10;
+      }
+      if (!Number.isSafeInteger(length) || length > MAX_MESSAGE || this.buffer.length > MAX_MESSAGE + MAX_HEADER) return this.close(1009);
+      if (this.buffer.length < offset + 4 + length) return;
+      if (opcode >= 8 && (!fin || length > 125)) return this.close();
+      const mask = this.buffer.subarray(offset, offset + 4), payload = Buffer.from(this.buffer.subarray(offset + 4, offset + 4 + length));
+      for (let i = 0; i < payload.length; i++) payload[i] ^= mask[i % 4];
+      this.buffer = this.buffer.subarray(offset + 4 + length);
+      if (opcode === 8) { this.close(1000); return; }
+      if (opcode === 9) { this.output.write(frame(10, payload)); continue; }
+      if (opcode === 10) continue;
+      if (opcode === 1) {
+        if (this.fragment) return this.close();
+        this.fragment = [payload]; this.fragmentSize = payload.length;
+      } else if (opcode === 0 && this.fragment) this.fragment.push(payload);
+      else return this.close();
+      if (opcode === 0) this.fragmentSize += payload.length;
+      if (this.fragmentSize > MAX_MESSAGE) return this.close(1009);
+      if (fin) {
+        const message = Buffer.concat(this.fragment);
+        this.fragment = null; this.fragmentSize = 0;
+        let normalized;
+        try { normalized = JSON.stringify(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(message))); }
+        catch { return this.close(1007); }
+        this.backend.stdin.write(normalized);
+        this.backend.stdin.write('\n');
+      }
+    }
+  }
+  backendOutput(chunk) {
+    this.lines = Buffer.concat([this.lines, chunk]);
+    if (this.lines.length > MAX_MESSAGE) return this.close(1009);
+    let end;
+    while ((end = this.lines.indexOf(10)) >= 0) {
+      const line = this.lines.subarray(0, end);
+      this.lines = this.lines.subarray(end + 1);
+      if (line.length) this.output.write(frame(1, line));
+    }
+  }
+}
+
+export function runRemoteProxy() {
+  if (!readConfig().enabled) {
+    const standalone = process.env.MINILINK_REMOTE_CODEX;
+    if (!standalone) throw new Error('找不到远程 Codex。');
+    const child = spawn(standalone, ['app-server', 'proxy'], { stdio: 'inherit', env: process.env });
+    return new Promise(resolve => { child.on('close', code => resolve(code ?? 1)); child.on('error', () => resolve(1)); });
+  }
+  const self = fileURLToPath(new URL('../bin/minilink.mjs', import.meta.url));
+  const backend = spawn(process.execPath, [self, 'app-server', '--stdio'], { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, MINILINK_REMOTE_BRIDGE: '1' } });
+  new RemoteBridge({ input: process.stdin, output: process.stdout, backend });
+  for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(signal, () => backend.kill(signal));
+  return new Promise(resolve => backend.on('close', code => resolve(code ?? 1)));
+}