@ducking-mind/proxy-app-cli 0.1.1 → 0.1.2

package/README.md

@@ -36,6 +36,8 @@ proxy-app publish --version 0.1.0  # 切换到指定已上传版本，也可回
 `publish --version <version>` 可选择历史已发布版本回滚，也可发布已上传草稿；不修改本地 manifest，
 不要求本地版本号与目标一致，不构建或上传。目标尚未上传时直接报错，目标已是当前线上版本时不重复切换。
 
+桌面宿主不属于本 CLI 的开源交付范围。CLI 只生成公开应用包；桌面安装包、更新元数据和签名材料由内部私有发布流水线生成。
+
 首次创建应用：
 
 ```bash
@@ -159,8 +161,7 @@ CLI 从已导出的变量读取配置，不会自动加载 `.env` 文件。请
 
 创建应用时，`--category` 支持 `ecommerce`（电商）、`comic`（漫剧）和 `other`（其他，默认）。分类用于应用市场展示，创建后可在“编辑应用资料”中调整。
 
-本地平台可直接使用默认地址，不需要任何配置。远程平台若 Portal 与 API 使用同一域名，
-只设置 `PROXY_PLATFORM_URL=https://platform.example` 即可；CLI 自动使用该站点的 `/api` 与登录页。若平台把 API 部署在独立域名，再额外设置 `PROXY_API_BASE_URL` 或 `PROXY_PORTAL_URL` 覆盖对应地址。单地址配置时，请清除已导出的旧覆盖变量。
+默认使用线上平台 `https://www.duckingmind.com`，API 地址为 `https://www.duckingmind.com/api`，登录页也使用该域名。其他环境若 Portal 与 API 使用同一域名，只设置 `PROXY_PLATFORM_URL=https://platform.example` 即可；若两者使用不同地址，再额外设置 `PROXY_API_BASE_URL` 或 `PROXY_PORTAL_URL` 覆盖对应地址。连接本地平台时，可分别设置 `PROXY_API_BASE_URL=http://localhost:9003/api` 与 `PROXY_PORTAL_URL=http://localhost:9004`。
 管理命令（创建、发布等）仍需 `PROXY_USER_ACCESS_TOKEN`；本地开发使用浏览器授权，不需要这个变量。
 若 shell 已全局导出 `PROXY_USER_ACCESS_TOKEN` 或旧别名 `PROXY_ACCESS_TOKEN`，开发命令会优先使用该令牌；想在浏览器中选择创建者账户时先运行 `unset PROXY_USER_ACCESS_TOKEN PROXY_ACCESS_TOKEN`。
 

package/agent-contract.mjs

@@ -1,14 +1,11 @@
 #!/usr/bin/env node
 
 import { spawn } from 'node:child_process'
-import { lstat, mkdir, readFile, stat, writeFile } from 'node:fs/promises'
+import { lstat, mkdir, readFile, writeFile } from 'node:fs/promises'
 import { resolve, sep } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
-const runtimeDirectory = await stat(new URL('../desktop/agent/protocol.mjs', import.meta.url)).then(() => '../desktop/agent/').catch(error => {
-  if (error.code !== 'ENOENT') throw error
-  return './agent-runtime/'
-})
+const runtimeDirectory = './agent-runtime/'
 const { normalizeCapabilityDeclaration, normalizeManifestAgent } = await import(new URL(`${runtimeDirectory}protocol.mjs`, import.meta.url))
 const { copyAgentPackage } = await import(new URL(`${runtimeDirectory}package-guide.mjs`, import.meta.url))
 

package/agent-runtime/package-guide.mjs

@@ -1,8 +1,11 @@
+/** Public Agent guide and example package validation helpers. The private host
+ * owns lifecycle, transport, authorization, and release behavior. */
+
 import { createHash } from 'node:crypto'
 import { constants } from 'node:fs'
 import { lstat, mkdir, open, realpath } from 'node:fs/promises'
 import { join, resolve } from 'node:path'
-import { normalizeManifestAgent, toolNameFor, validateValue } from './protocol.mjs'
+import { normalizeManifestAgent, validateValue } from './protocol.mjs'
 
 const MAX_TEXT_BYTES = 64 * 1024
 const MAX_PACKAGE_BYTES = 256 * 1024
@@ -112,47 +115,6 @@ async function readAgentPackage(root, manifest) {
   return readAgentPackageWithReader(manifest, entry => readPackageFile(packageRoot, entry))
 }
 
-/** Load the same bounded, schema-validated package resources for Web apps.
- * The platform-provided versioned entry anchors every URL; no account bearer
- * credential is sent to application content, even when hosted on a CDN.
- */
-export async function loadWebAgentPackage(manifest, { entryURL, platformOrigin, fetchImpl = fetch, signal } = {}) {
-  signal = signal ? AbortSignal.any([signal, AbortSignal.timeout(15000)]) : AbortSignal.timeout(15000)
-  const entry = new URL(entryURL, platformOrigin)
-  check(['https:', 'http:'].includes(entry.protocol) && !entry.username && !entry.password, 'invalid Web entry URL')
-  check(entry.protocol === 'https:' || ['localhost', '127.0.0.1', '[::1]'].includes(entry.hostname), 'insecure Web entry URL')
-  const runtimeEntry = 'index.html'
-  const suffix = runtimeEntry.split('/').map(encodeURIComponent).join('/')
-  check(entry.pathname.endsWith(`/${suffix}`), 'Web entry does not match the declared application entry')
-  const prefix = entry.pathname.slice(0, -suffix.length)
-  const { files, ...data } = await readAgentPackageWithReader(manifest, async path => {
-    const url = new URL(entry)
-    url.pathname = prefix + path.split('/').map(encodeURIComponent).join('/')
-    url.hash = ''
-    const response = await fetchImpl(url, { signal, redirect: 'error', credentials: 'omit' })
-    check(response.ok, `Web package entry unavailable: ${path} (${response.status})`)
-    check(!response.headers.get('content-length') || Number(response.headers.get('content-length')) <= MAX_TEXT_BYTES, `entry exceeds 64 KiB: ${path}`)
-    check(response.body, `empty Web package response: ${path}`)
-    const reader = response.body.getReader()
-    const chunks = []
-    let length = 0
-    try {
-      while (true) {
-        const { value, done } = await reader.read()
-        if (done) break
-        length += value.length
-        check(length <= MAX_TEXT_BYTES, `entry exceeds 64 KiB: ${path}`)
-        chunks.push(value)
-      }
-    } finally { await reader.cancel().catch(() => {}) }
-    const bytes = Buffer.concat(chunks)
-    let content
-    try { content = new TextDecoder('utf-8', { fatal: true }).decode(bytes) } catch { throw new Error(`Invalid UTF-8 agent package entry: ${path}`) }
-    return { bytes, content }
-  })
-  return data
-}
-
 /** Read only declared, bounded files from the selected application version. */
 export async function loadAgentPackage(root, manifest) {
   const { files, ...data } = await readAgentPackage(root, manifest)
@@ -180,14 +142,3 @@ export async function copyAgentPackage(source, destination, manifest) {
   }
   return data
 }
-
-/** The API topic is generated from the same declaration tools/list publishes. */
-export function renderAgentReference(manifest) {
-  const agent = normalizeManifestAgent(manifest)
-  if (!agent) return ''
-  const lines = [`# ${manifest.name || manifest.id} API`, '', `Application: ${manifest.id}`, `Application version: ${manifest.version}`, `Contract version: ${manifest.agent.contract_version || manifest.version}`, `Application targets: ${(agent.targets || ['desktop']).join(', ')}`, '', 'Generated from the active package manifest. Read the overview and workflow topics for business rules.', '']
-  for (const capability of agent.capabilities) {
-    lines.push(`## ${toolNameFor(agent.namespace, capability.name)}`, '', capability.description, '', `Targets: ${capability.targets.join(', ')}; access: ${capability.access}; idempotent: ${capability.idempotent}.`, '', 'Input schema:', '```json', JSON.stringify(capability.input_schema, null, 2), '```', '', 'Output schema:', '```json', JSON.stringify(capability.output_schema, null, 2), '```', '')
-  }
-  return lines.join('\n')
-}

package/agent-runtime/protocol.mjs

@@ -1,12 +1,10 @@
 /**
- * Shared protocol primitives for exposing Proxy Desktop applications to an
- * external agent (for example, through MCP). This module has no Electron or
- * transport dependency and is safe to use from the desktop host and tests.
+ * Public compatibility primitives for an app Agent contract (for example,
+ * the `proxy.desktop.agent/v1` data format). This module validates application
+ * declarations and schemas; runtime registration, transport, authorization,
+ * and host lifecycle remain in the private desktop implementation.
  */
 
-import { serializeAgentError } from './runtime-status.mjs'
-import { createHash } from 'node:crypto'
-
 export const AGENT_PROTOCOL = 'proxy.desktop.agent/v1'
 export const AGENT_PROTOCOL_VERSION = 1
 
@@ -38,17 +36,6 @@ export function isAppManifestID(value) {
   return isPublicAppSlug(value) || (typeof value === 'string' && value === value.trim() && PLATFORM_APP_ID_RE.test(value))
 }
 
-// Only metadata from the authenticated platform (or the trusted account
-// broker) may approve a historical manifest identity. Never infer an alias by
-// adding/removing a prefix, and never alias one stable platform ID to another.
-export function appManifestIdentityMatches(value, metadata) {
-  if (!isAppManifestID(value) || !metadata) return false
-  const id = metadata.app_id || metadata.id
-  if (PLATFORM_APP_ID_RE.test(value)) return value === id
-  if (value === (metadata.app_slug || metadata.slug)) return true
-  return Array.isArray(metadata.app_aliases) && metadata.app_aliases.some(alias => isPublicAppSlug(alias) && alias === value)
-}
-
 export function assertAppId(value) {
   assert(isAppManifestID(value) || (typeof value === 'string' && value === value.trim() && LEGACY_APP_ID_RE.test(value)), `invalid app id: ${value}`)
   return value
@@ -164,86 +151,6 @@ export function normalizeManifestAgent(manifest) {
   return Object.freeze({ enabled: true, namespace, targets, contractVersion, summary, keywords, guide: agent.guide, examples: agent.examples, capabilities })
 }
 
-const canonical = value => Array.isArray(value) ? value.map(canonical) : isRecord(value) ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value
-/** Same contract identity for market metadata and installed packages, independent of transport/runtime state. */
-export function describeAgentContract(manifest) {
-  const agent = normalizeManifestAgent(manifest)
-  if (!agent) return null
-  const contract = { appId: manifest.id, namespace: agent.namespace, contractVersion: agent.contractVersion, targets: agent.targets,
-    capabilities: [...agent.capabilities].sort((a, b) => a.name.localeCompare(b.name)) }
-  return { enabled: true, namespace: agent.namespace, targets: agent.targets, contractVersion: agent.contractVersion,
-    contractHash: createHash('sha256').update(JSON.stringify(canonical(contract))).digest('hex'),
-    capabilityCount: agent.capabilities.length,
-    desktopCapabilityCount: agent.capabilities.filter(capability => capability.targets.includes('desktop')).length,
-    webCapabilityCount: agent.capabilities.filter(capability => capability.targets.includes('web')).length,
-    capabilities: agent.capabilities.map(({ name, title, description, access, targets, billable, completion }) => ({ name, title, description, access, targets, billable, completion })) }
-}
-
-export function normalizeRuntimeCapability(input) {
-  assert(isRecord(input), 'runtime capability must be an object')
-  const name = assertCapabilityName(input.name)
-  if (input.handlerVersion !== undefined) {
-    assert(Number.isInteger(input.handlerVersion) && input.handlerVersion > 0, `invalid handlerVersion for ${name}`)
-  }
-  if (input.available !== undefined) assert(typeof input.available === 'boolean', `invalid available for ${name}`)
-  return Object.freeze({ name, handlerVersion: input.handlerVersion || 1, available: input.available !== false })
-}
-
-export function validateRuntimeRegistration(manifest, registration, { target = 'desktop' } = {}) {
-  assert(AGENT_TARGETS.includes(target), 'invalid runtime target')
-  assert(isRecord(registration), 'runtime registration must be an object')
-  const agent = normalizeManifestAgent(manifest)
-  assert(agent, 'agent capabilities are not enabled in manifest')
-  assertAppId(registration.appId)
-  assertVersion(registration.version)
-  assert(registration.appId === manifest.id, 'runtime app id does not match manifest')
-  assert(registration.version === manifest.version, 'runtime app version does not match manifest')
-  assert(Array.isArray(registration.capabilities) && registration.capabilities.length <= 64, 'runtime capabilities must be an array with at most 64 entries')
-  const codeFirst = manifest.agent.contract_source === 'code'
-  const dynamic = registration.dynamic === true && !codeFirst
-  const declarations = new Map(agent.capabilities.map((capability) => [capability.name, capability]))
-  const runtime = []
-  const registeredDeclarations = []
-  const seen = new Set()
-  for (const raw of registration.capabilities) {
-    const capability = normalizeRuntimeCapability(raw)
-    assert(!seen.has(capability.name), `duplicate runtime capability: ${capability.name}`)
-    seen.add(capability.name)
-    let declared = declarations.get(capability.name)
-    const hasContract = ['title', 'description', 'access', 'input_schema', 'inputSchema', 'output_schema', 'outputSchema', 'targets', 'completion', 'idempotent', 'destructive', 'open_world', 'billable'].some(field => Object.hasOwn(raw, field))
-    let supplied
-    if (codeFirst || dynamic || hasContract) {
-      if (codeFirst || dynamic) assert(raw.access !== undefined && (raw.input_schema ?? raw.inputSchema) !== undefined && (raw.output_schema ?? raw.outputSchema) !== undefined, `runtime capability requires a complete code declaration: ${capability.name}`)
-      supplied = normalizeCapabilityDeclaration(raw, { defaultTargets: agent.targets })
-      assert(supplied.targets.every(item => agent.targets.includes(item)), `${capability.name}.targets must be a subset of application targets`)
-      assert(supplied.targets.includes(target), `runtime capability does not support ${target}: ${capability.name}`)
-    }
-    // Code-first applications provide the complete contract at runtime. The
-    // names-only form remains a compatibility path for already packaged
-    // applications whose generated manifest contains the contract.
-    if (declared) {
-      assert(declared.targets.includes(target), `runtime capability does not support ${target}: ${capability.name}`)
-      if (codeFirst) {
-        assert(JSON.stringify(canonical(supplied)) === JSON.stringify(canonical(declared)), `runtime capability contract differs from packaged code contract: ${capability.name}`)
-      }
-    } else if (!dynamic) {
-      assert(false, `runtime capability is not declared: ${capability.name}`)
-    }
-    if (dynamic) {
-      declared = supplied
-      declarations.set(capability.name, declared)
-    }
-    registeredDeclarations.push(declared)
-    if (capability.available) runtime.push({ ...capability, declaration: declared })
-  }
-  return Object.freeze({
-    appId: registration.appId,
-    version: registration.version,
-    capabilities: runtime,
-    declarations: registeredDeclarations,
-  })
-}
-
 export function toolNameFor(namespace, capability) {
   assertNamespace(namespace)
   assertCapabilityName(capability)
@@ -252,33 +159,6 @@ export function toolNameFor(namespace, capability) {
   return name
 }
 
-export function toMcpTool({ namespace, appId, version, contractVersion = version, contractHash, capability, runtime }) {
-  const declaration = normalizeCapabilityDeclaration({ ...capability, name: capability.name })
-  const tool = {
-    name: toolNameFor(namespace, declaration.name),
-    title: declaration.title,
-    description: [declaration.description || `${appId} ${declaration.name}`, declaration.billable ? 'May incur model or service charges.' : '', declaration.completion === 'accepted' ? 'Returns acceptance only; use the application task query to check completion.' : ''].filter(Boolean).join(' '),
-    inputSchema: declaration.input_schema,
-    _meta: { proxy: { appId, version, contractVersion, ...(contractHash ? { contractHash } : {}), capability: declaration.name, billable: declaration.billable, completion: declaration.completion, targets: declaration.targets } },
-  }
-  if (declaration.output_schema) tool.outputSchema = declaration.output_schema
-  tool.annotations = { readOnlyHint: declaration.access === ACCESS.READ, destructiveHint: declaration.destructive, idempotentHint: declaration.idempotent, openWorldHint: declaration.open_world }
-  if (runtime) tool._meta.proxy.runtime = runtime
-  return Object.freeze(tool)
-}
-
-export function createInvocation({ requestId, appId, appVersion, capability, args, deadlineAt, cancellationToken }) {
-  assert(typeof requestId === 'string' && requestId.length > 0 && requestId.length <= 128, 'invalid request id')
-  assertAppId(appId); assertVersion(appVersion); assertCapabilityName(capability)
-  assert(args === undefined || isRecord(args), 'agent arguments must be an object')
-  return Object.freeze({ requestId, appId, appVersion, capability, args: args || {}, deadlineAt, cancellationToken })
-}
-
-export function serializeError(error) {
-  return serializeAgentError(error)
-}
-
-
 // Deliberately bounded JSON Schema subset. Reject unsupported keywords instead
 // of advertising validation that the host cannot actually enforce.
 const keywords = new Set(['type', 'properties', 'required', 'additionalProperties', 'items', 'enum', 'minLength', 'maxLength', 'minimum', 'maximum', 'minItems', 'maxItems', 'description', 'title', 'default'])

package/local-dev-relay.mjs

@@ -314,10 +314,11 @@ export async function createLocalDevelopmentRelay({ baseURL, portalURL = '', rel
         let requiresFreshLogin = forceLogin
         let developerToken = explicitToken
         if (!developerToken && !forceLogin) developerToken = await wait(Promise.resolve(developerCredentialStore?.load()))
-        // Do not silently reuse an already signed-in browser account when no
-        // developer credential is available. The login page will require the
-        // user to choose the creator account explicitly.
-        if (!developerToken && !explicitToken) requiresFreshLogin = true
+        // A missing developer cache does not mean that the Portal session is
+        // invalid. Let the Portal reuse its current signed-in account; the
+        // registration endpoint still enforces that it is the app creator.
+        // Force account selection only when replacing a rejected credential.
+        if (!developerToken && !explicitToken) requiresFreshLogin = false
         checkActive()
         if (developerToken) {
           try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ducking-mind/proxy-app-cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "CLI for creating, building and publishing Proxy platform apps",
   "repository": {
     "type": "git",
@@ -25,12 +25,13 @@
   },
   "files": [
     "proxy-app.mjs",
+    "platform-settings.mjs",
     "local-dev-relay.mjs",
     "local-dev-credentials.mjs",
     "artifact-security.mjs",
     "agent-contract.mjs",
-    "agent-runtime/*.mjs",
-    "release-runtime/*.mjs",
+    "agent-runtime/protocol.mjs",
+    "agent-runtime/package-guide.mjs",
     "prepare-agent-runtime.mjs"
   ],
   "scripts": {
@@ -43,7 +44,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@ducking-mind/proxy-app-desktop-runtime": "^0.1.0",
     "fflate": "^0.8.2"
   },
   "engines": {

package/platform-settings.mjs

@@ -0,0 +1,19 @@
+export const DEFAULT_PLATFORM_URL = 'https://www.duckingmind.com'
+
+export function platformAPIBaseURL(env = process.env) {
+  const explicit = env.PROXY_API_BASE_URL?.trim()
+  if (explicit) return explicit.replace(/\/$/, '')
+  const platform = env.PROXY_PLATFORM_URL?.trim() || DEFAULT_PLATFORM_URL
+  let url
+  try { url = new URL(platform) } catch { throw new Error('PROXY_PLATFORM_URL must be a valid platform origin, such as https://platform.example') }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/') {
+    throw new Error('PROXY_PLATFORM_URL must be a platform origin without a path, credentials, query, or hash')
+  }
+  return `${url.origin}/api`
+}
+
+export function platformPortalURL(env = process.env) {
+  const explicit = env.PROXY_PORTAL_URL?.trim() || env.PROXY_PUBLIC_URL?.trim()
+  if (explicit) return explicit
+  return env.PROXY_PLATFORM_URL?.trim() || DEFAULT_PLATFORM_URL
+}

package/prepare-agent-runtime.mjs

@@ -1,43 +1,10 @@
-import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises'
+import { access } from 'node:fs/promises'
 
-const source = new URL('../desktop/agent/', import.meta.url)
-const destination = new URL('./agent-runtime/', import.meta.url)
-const modules = new Set()
-async function collect(name) {
-  if (modules.has(name)) return
-  if (!/^[a-z][a-z0-9-]*\.mjs$/.test(name)) throw new Error(`Invalid agent runtime module: ${name}`)
-  modules.add(name)
-  const content = await readFile(new URL(name, source), 'utf8')
-  for (const match of content.matchAll(/(?:from\s*|import\s*)['"]\.\/([^'"]+)['"]/g)) await collect(match[1])
-  await writeFile(new URL(name, destination), content)
+// These modules are deliberately maintained as public, dependency-free copies.
+// They contain the application capability contract and package validation only;
+// the proprietary desktop host and its build scripts are never copied into an
+// npm package.
+for (const file of ['./agent-runtime/protocol.mjs', './agent-runtime/package-guide.mjs']) {
+  await access(new URL(file, import.meta.url))
 }
-
-// Include the transitive local imports, never the Electron entry points.
-// Repacking an installed npm package reuses its already bundled runtime.
-const hasSource = await stat(source).then(() => true).catch(error => { if (error.code !== 'ENOENT') throw error; return false })
-if (hasSource) {
-  await mkdir(destination, { recursive: true })
-  await collect('protocol.mjs')
-  await collect('package-guide.mjs')
-  for (const entry of await readdir(destination)) if (!modules.has(entry)) await rm(new URL(entry, destination), { recursive: true, force: true })
-} else {
-  await import(new URL('package-guide.mjs', destination))
-}
-// The package contract resolver uses this same bundled validation, including
-// when it is run as a project's direct build helper.
 await import(new URL('./agent-contract.mjs', import.meta.url))
-
-// The standalone CLI also exposes Electron release helpers. Keep a small copy
-// in the npm package so an installed CLI does not depend on the monorepo's
-// app/desktop directory. Source checkouts still use the live modules below.
-const releaseSource = new URL('../desktop/scripts/', import.meta.url)
-const releaseDestination = new URL('./release-runtime/', import.meta.url)
-const releaseModules = ['release-config.mjs', 'release-target.mjs']
-const hasReleaseSource = await stat(new URL(releaseModules[0], releaseSource)).then(() => true).catch(error => {
-  if (error.code !== 'ENOENT') throw error
-  return false
-})
-if (hasReleaseSource) {
-  await mkdir(releaseDestination, { recursive: true })
-  for (const name of releaseModules) await copyFile(new URL(name, releaseSource), new URL(name, releaseDestination))
-}

package/proxy-app.mjs

@@ -1,18 +1,16 @@
 #!/usr/bin/env node
 
 import { spawn } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
-import { cp, lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises'
+import { lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises'
 import { createHash, randomUUID } from 'node:crypto'
-import { createRequire } from 'node:module'
-import { basename, dirname, extname, join, resolve, sep } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { dirname, join, resolve, sep } from 'node:path'
 import { createServer as createTCPServer } from 'node:net'
 import { zipSync } from 'fflate'
 import { createLocalDevelopmentRelay } from './local-dev-relay.mjs'
 import { createLocalCredentialStore } from './local-dev-credentials.mjs'
 import { assertSafeArtifactFile, assertSafeArtifactDirectory } from './artifact-security.mjs'
 import { resolveAgentContract } from './agent-contract.mjs'
+import { platformAPIBaseURL, platformPortalURL } from './platform-settings.mjs'
 
 const MAX_BUNDLE_BYTES = 50 * 1024 * 1024
 const ALLOWED_PERMISSIONS = new Set(['user.profile.read', 'platform.capabilities.read', 'storage.user', 'notification', 'theme.read', 'locale.read'])
@@ -37,24 +35,8 @@ const appBinding = app => ({
   ...(publicAppAliases(app).length ? { app_aliases: publicAppAliases(app) } : {}),
 })
 
-// npm packages carry the same pure protocol modules as the desktop host.
-// Source checkouts prefer the live implementation so validation cannot drift.
-const agentRuntimeDirectory = await stat(new URL('../desktop/agent/protocol.mjs', import.meta.url)).then(() => '../desktop/agent/').catch(error => {
-  if (error.code !== 'ENOENT') throw error
-  return './agent-runtime/'
-})
-const { normalizeManifestAgent } = await import(new URL(`${agentRuntimeDirectory}protocol.mjs`, import.meta.url))
-const { loadAgentPackage, copyAgentPackage } = await import(new URL(`${agentRuntimeDirectory}package-guide.mjs`, import.meta.url))
-
-// Source checkouts use the live desktop release helpers. npm packages carry a
-// small prepackaged copy under release-runtime/ so `proxy-app` works after
-// installation without the monorepo's app/desktop directory.
-const releaseRuntimeDirectory = await stat(new URL('../desktop/scripts/release-config.mjs', import.meta.url)).then(() => '../desktop/scripts/').catch(error => {
-  if (error.code !== 'ENOENT') throw error
-  return './release-runtime/'
-})
-const { isAllowedReleaseURL, loadReleaseConfig, parseConfigOption, releaseConfigRoot, validateReleaseConfig } = await import(new URL(`${releaseRuntimeDirectory}release-config.mjs`, import.meta.url))
-const { releaseFeedURL, releaseTarget } = await import(new URL(`${releaseRuntimeDirectory}release-target.mjs`, import.meta.url))
+const { normalizeManifestAgent } = await import(new URL('./agent-runtime/protocol.mjs', import.meta.url))
+const { loadAgentPackage, copyAgentPackage } = await import(new URL('./agent-runtime/package-guide.mjs', import.meta.url))
 
 function usage() {
   console.log(`在应用目录内，常用命令：
@@ -79,22 +61,18 @@ pack 无需提前执行 build 或 validate；已上传的版本由 publish 直
   proxy-app pack [app-dir] [-o <output.zip>]
   proxy-app upload [app-dir] [-o <output.zip>]
   proxy-app publish [app-dir] [-o <output.zip> | --version <uploaded-version>]
-  proxy-app desktop-build [app-dir]
-  proxy-app desktop-pack [app-dir] [-o <output-directory>]
 
   upload 只上传；publish 显式切换线上版本。首次使用 publish 仍需申请应用开放。
   --version 仅选择已上传版本，不构建、不上传、不修改本地 manifest。
   -o 与 --output 等价，也兼容原来的 <app-dir> <output.zip> 写法。
   --source 仅供 pack/upload 调试源码，跳过构建，不用于正式发布。
-  desktop-pack 会在输出目录生成 desktop-release.json 和 electron-updater metadata；发布配置
-  使用 desktop/release.config.json，API Key 只用于发布请求，不会写入安装包。
   应用分类：ecommerce（电商）、comic（漫剧）、other（其他，默认）。
 
 Publish environment:
   PROXY_PLATFORM_URL  Optional single-origin platform URL; derives API (/api) and login Portal
-  PROXY_API_BASE_URL  default: http://localhost:9003/api
+  PROXY_API_BASE_URL  default: https://www.duckingmind.com/api
                        Optional override when the platform uses a separate API host
-  PROXY_PORTAL_URL    Optional login Portal override; default: http://localhost:9004
+  PROXY_PORTAL_URL    Optional login Portal override; default: https://www.duckingmind.com
   PROXY_USER_ACCESS_TOKEN  Current platform user session for app management/CI only; never passed to the app
   PROXY_ACCESS_TOKEN       Legacy alias for PROXY_USER_ACCESS_TOKEN
 
@@ -165,8 +143,6 @@ function commandArguments(command, args) {
     pack: { values: ['--output'], flags: ['--source'], max: 2 },
     upload: { values: ['--output'], flags: ['--source'], max: 2 },
     publish: { values: ['--output', '--version'], max: 2 },
-    'desktop-build': { values: ['--config'], flags: ['--mac', '--macos', '-m', '--win', '--windows', '-w', '--linux', '-l', '--x64', '--arm64', '--ia32', '--env-overrides'], max: 1 },
-    'desktop-pack': { values: ['--output', '--config'], flags: ['--mac', '--macos', '-m', '--win', '--windows', '-w', '--linux', '-l', '--x64', '--arm64', '--ia32', '--env-overrides'], max: 2 },
   }
   const config = configurations[command]
   if (!config) throw new Error(`unknown command: ${command}`)
@@ -214,27 +190,6 @@ function apiSettings() {
   return { token, baseURL }
 }
 
-function platformAPIBaseURL() {
-  const explicit = process.env.PROXY_API_BASE_URL?.trim()
-  if (explicit) return explicit.replace(/\/$/, '')
-  const platform = process.env.PROXY_PLATFORM_URL?.trim()
-  if (!platform) return 'http://localhost:9003/api'
-  let url
-  try { url = new URL(platform) } catch { throw new Error('PROXY_PLATFORM_URL must be a valid platform origin, such as https://platform.example') }
-  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/') {
-    throw new Error('PROXY_PLATFORM_URL must be a platform origin without a path, credentials, query, or hash')
-  }
-  return `${url.origin}/api`
-}
-
-function platformPortalURL() {
-  const explicit = process.env.PROXY_PORTAL_URL?.trim() || process.env.PROXY_PUBLIC_URL?.trim()
-  if (explicit) return explicit
-  const platform = process.env.PROXY_PLATFORM_URL?.trim()
-  if (platform) return platform
-  return 'http://localhost:9004'
-}
-
 function responseError(body, fallback) {
   const message = typeof body?.error === 'string' ? body.error : body?.error?.message || body?.message
   const code = body?.code || body?.error?.code
@@ -652,207 +607,6 @@ async function packApp(appDir, output, { allowSource = false, allowSourceMaps =
   return { ...info, outputPath }
 }
 
-async function loadDesktopReleaseConfig(options = []) {
-  const parsed = parseConfigOption(options)
-  const config = await loadReleaseConfig({
-    root: releaseConfigRoot(),
-    cwd: process.env.INIT_CWD || process.cwd(),
-    configPath: parsed.configPath,
-    envOverrides: parsed.envOverrides,
-  })
-  // desktop-build/desktop-pack are also used for local staging. A release
-  // config is optional there; the main app's build:release command
-  // requires update.url before producing a publishable package.
-  return validateReleaseConfig(config)
-}
-
-async function resolveDesktopSource() {
-  const cliRoot = dirname(fileURLToPath(import.meta.url))
-  const checkout = join(cliRoot, '..', 'desktop')
-  if (await exists(join(checkout, 'host'))) return checkout
-  let packageManifest
-  try {
-    packageManifest = createRequire(join(cliRoot, 'package.json')).resolve('@ducking-mind/proxy-app-desktop-runtime/package.json')
-  } catch {
-    throw new Error('Electron runtime package is not installed. Install @ducking-mind/proxy-app-desktop-runtime before building a desktop app.')
-  }
-  const runtime = join(dirname(packageManifest), 'runtime')
-  if (!(await exists(join(runtime, 'host')))) throw new Error('Electron runtime package is incomplete; install a published runtime package with its runtime assets.')
-  return runtime
-}
-
-function findPackageRoot(name, fromDirectory) {
-  const require = createRequire(join(fromDirectory, 'package.json'))
-  let current = dirname(require.resolve(name))
-  while (true) {
-    const manifest = join(current, 'package.json')
-    if (existsSync(manifest)) {
-      try {
-        if (JSON.parse(readFileSync(manifest, 'utf8')).name === name) return current
-      } catch { /* Continue looking above the resolved entry. */ }
-    }
-    const parent = dirname(current)
-    if (parent === current) throw new Error(`cannot resolve installed package: ${name}`)
-    current = parent
-  }
-}
-
-async function desktopBuildApp(appDir, options = []) {
-  const releaseConfig = await loadDesktopReleaseConfig(options)
-  const info = await buildApp(appDir)
-  await assertSafeArtifactDirectory(info.artifactRoot)
-  const staging = join(info.root, 'dist-electron')
-  await rm(staging, { recursive: true, force: true })
-  await mkdir(join(staging, 'app'), { recursive: true })
-  await cp(info.artifactRoot, join(staging, 'app'), { recursive: true, dereference: true })
-  const desktopSource = await resolveDesktopSource()
-  await mkdir(join(staging, 'single-app'), { recursive: true })
-  await cp(join(desktopSource, 'single-app', 'main.mjs'), join(staging, 'single-app', 'main.mjs'))
-  await cp(join(desktopSource, 'single-app', 'preload.cjs'), join(staging, 'single-app', 'preload.cjs'))
-  await cp(join(desktopSource, 'unified', 'renderer', 'assets', 'duck-mark-v2.png'), join(staging, 'single-app', 'status-tray-icon.png'))
-  await cp(join(desktopSource, 'host'), join(staging, 'host'), { recursive: true })
-  await mkdir(join(staging, 'agent'), { recursive: true })
-  for (const name of ['protocol.mjs', 'runtime-status.mjs']) await cp(join(desktopSource, 'agent', name), join(staging, 'agent', name))
-  const desktopPackage = JSON.parse(await readFile(join(desktopSource, 'package.json'), 'utf8'))
-  const installedElectron = await readFile(join(info.root, 'node_modules', 'electron', 'package.json'), 'utf8').then(JSON.parse).catch(() =>
-    readFile(join(desktopSource, 'node_modules', 'electron', 'package.json'), 'utf8').then(JSON.parse).catch(() => null))
-  const electronVersion = installedElectron?.version || String(desktopPackage.devDependencies?.electron || '44.9.0').replace(/^[^0-9]*/, '')
-  // Standalone Electron apps use the same updater as the unified shell. Copy
-  // only its runtime dependency tree into staging; never ship the desktop
-  // project's full devDependencies or its Electron binary.
-  const runtimeDependencies = new Set()
-  async function copyRuntimeDependency(name, fromDir = desktopSource) {
-    if (runtimeDependencies.has(name)) return
-    let source
-    try { source = findPackageRoot(name, fromDir) }
-    catch { throw new Error(`桌面运行依赖缺失：${name}`) }
-    runtimeDependencies.add(name)
-    await cp(source, join(staging, 'node_modules', name), { recursive: true, dereference: true })
-    const packageJSON = JSON.parse(await readFile(join(source, 'package.json'), 'utf8'))
-    for (const dependency of Object.keys(packageJSON.dependencies || {})) await copyRuntimeDependency(dependency, source)
-  }
-  await copyRuntimeDependency('electron-updater')
-  const targetPlatform = desktopTargetPlatform(releaseConfig.buildTarget?.platform || process.platform)
-  const targetArch = desktopTargetArch(releaseConfig.buildTarget?.arch || process.arch)
-  if (targetPlatform === 'darwin' && targetArch === 'ia32') throw new Error('macOS 不支持 ia32 发布架构')
-  const updateURL = resolveDesktopFeedURL(releaseConfig.updateURL, targetPlatform, targetArch)
-  const updateChannel = releaseConfig.updateChannel
-  await writeFile(join(staging, 'update-config.json'), `${JSON.stringify({ url: updateURL, channel: updateChannel }, null, 2)}\n`)
-  const builder = { appId: `com.duckingmind.proxy.app.${info.manifest.id.replaceAll('.', '-')}`, productName: info.manifest.name, electronVersion, artifactName: '${productName}-${version}-${arch}.${ext}', directories: { output: 'release' }, files: ['single-app/**', 'host/**', 'agent/**', 'app/**', 'node_modules/**', 'package.json'], extraResources: [{ from: 'update-config.json', to: 'update-config.json' }], asar: true, mac: { target: ['dmg', 'zip'] }, win: { target: ['nsis'] }, linux: { target: ['AppImage'] } }
-  // setFeedURL alone is insufficient: electron-updater reads app-update.yml
-  // for cache/signing configuration when downloading. Generic publication
-  // makes electron-builder embed it while --publish never keeps uploads local.
-  builder.publish = updateURL ? [{ provider: 'generic', url: updateURL, channel: updateChannel }] : null
-  await writeFile(join(staging, 'electron-builder.json'), JSON.stringify(builder, null, 2) + '\n')
-  await writeFile(join(staging, 'package.json'), JSON.stringify({ name: info.manifest.id.replaceAll('.', '-'), version: info.manifest.version, description: info.manifest.description || info.manifest.name, author: 'Proxy', private: true, type: 'module', main: 'single-app/main.mjs', dependencies: { 'electron-updater': desktopPackage.dependencies?.['electron-updater'] || '^6.6.2' } }, null, 2) + '\n')
-  await writeFile(join(staging, 'desktop-manifest.json'), JSON.stringify({ app_id: info.manifest.id, version: info.manifest.version, name: info.manifest.name }, null, 2) + '\n')
-  console.log(JSON.stringify({ staging, app_id: info.manifest.id, version: info.manifest.version }, null, 2))
-  return { ...info, staging, releaseConfig, targetPlatform, targetArch }
-}
-
-async function desktopPackApp(appDir, output, options = []) {
-  const info = await desktopBuildApp(appDir, options)
-  const outputPath = resolve(output || join(info.root, 'dist-electron', 'release'))
-  await mkdir(outputPath, { recursive: true })
-  const configPath = join(info.staging, 'electron-builder.json')
-  const config = JSON.parse(await readFile(configPath, 'utf8'))
-  config.directories = { ...(config.directories || {}), output: outputPath }
-  await writeFile(configPath, JSON.stringify(config, null, 2) + '\n')
-  const desktopRoot = await resolveDesktopSource()
-  const builderName = process.platform === 'win32' ? 'electron-builder.cmd' : 'electron-builder'
-  const commands = [join(info.root, 'node_modules', '.bin', builderName), join(desktopRoot, 'node_modules', '.bin', builderName)]
-  let builder = null
-  for (const candidate of commands) if (await exists(candidate)) { builder = candidate; break }
-  if (!builder) throw new Error('Electron 打包需要在当前应用依赖中安装 electron-builder。')
-  const targetPlatform = info.targetPlatform
-  const targetArch = info.targetArch
-  if (targetPlatform === 'darwin' && targetArch === 'ia32') throw new Error('macOS 不支持 ia32 发布架构')
-  await run(builder, ['--config', join(info.staging, 'electron-builder.json'), '--projectDir', info.staging, { darwin: '--mac', win32: '--win', linux: '--linux' }[targetPlatform], `--${targetArch}`, '--publish', 'never'], info.staging, process.env).catch((error) => {
-    throw new Error(`Electron 打包失败：${error.message}`)
-  })
-  const release = await writeDesktopReleaseRecord(info, outputPath, info.releaseConfig, targetPlatform, targetArch)
-  console.log(JSON.stringify({ output: outputPath, app_id: info.manifest.id, version: info.manifest.version, release }, null, 2))
-  return { ...info, outputPath, release }
-}
-
-function desktopTargetPlatform(value = process.platform) {
-  if (value === 'darwin') return 'darwin'
-  if (value === 'win32') return 'win32'
-  if (value === 'linux') return 'linux'
-  throw new Error(`不支持的桌面发布平台：${value}`)
-}
-
-function desktopTargetArch(value = process.arch) {
-  if (value === 'x64' || value === 'arm64') return value
-  if (value === 'ia32') return value
-  throw new Error(`不支持的桌面发布架构：${value}`)
-}
-
-function resolveDesktopFeedURL(value, platform, arch) {
-  const raw = String(value || '').trim()
-  if (!raw) return ''
-  const resolved = raw.replaceAll('{platform}', platform).replaceAll('{arch}', arch).replace(/\/+$/, '')
-  let url
-  try { url = new URL(resolved) } catch { throw new Error('发布配置 update.url 必须是 HTTPS 或本机回环 HTTP 更新目录地址') }
-  if (!isAllowedReleaseURL(resolved)) throw new Error('发布配置 update.url 必须是无凭据、无查询参数的 HTTPS 或本机回环 HTTP 更新目录地址')
-  const explicitTarget = /\/(darwin|win32|linux)\/(arm64|x64|ia32)$/.exec(url.pathname)
-  if (explicitTarget && (explicitTarget[1] !== platform || explicitTarget[2] !== arch)) throw new Error(`更新地址目标与 ${platform}/${arch} 不一致，请使用 {platform}/{arch}`)
-  return resolved
-}
-
-/**
- * When a standalone Electron app is built for distribution, emit the same
- * importable record and generic-provider feed as the unified shell. Local
- * builds use an upload placeholder that publish-release.mjs replaces.
- */
-async function writeDesktopReleaseRecord(info, outputPath, releaseConfig, configuredPlatform, configuredArch) {
-  const artifactBase = String(releaseConfig.artifactBaseURL || '').trim().replace(/\/$/, '')
-  if (artifactBase && !artifactBase.startsWith('https://')) throw new Error('发布配置 release.artifactBaseUrl 必须使用 HTTPS')
-  const product = String(releaseConfig.product || info.manifest.id).trim()
-  const channel = releaseConfig.updateChannel
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/.test(product)) throw new Error('发布配置 product 无效')
-  if (!['latest', 'beta'].includes(channel)) throw new Error('发布配置 update.channel 必须是 latest 或 beta')
-  const platform = desktopTargetPlatform(configuredPlatform)
-  const arch = desktopTargetArch(configuredArch)
-  if (platform === 'darwin' && arch === 'ia32') throw new Error('macOS 不支持 ia32 发布架构')
-  const targetExtension = platform === 'darwin' ? '.zip' : platform === 'win32' ? '.exe' : '.appimage'
-  const candidates = []
-  for (const entry of await readdir(outputPath, { withFileTypes: true })) {
-    if (!entry.isFile() || extname(entry.name).toLowerCase() !== targetExtension || !entry.name.includes(info.manifest.version)) continue
-    const archInName = /(?:^|[-_])(x64|arm64|ia32)(?:[-_.]|$)/i.exec(entry.name)?.[1]?.toLowerCase()
-    if (archInName && archInName !== arch) continue
-    const file = join(outputPath, entry.name)
-    const details = await stat(file)
-    if (details.size > 0) candidates.push({ file, name: entry.name, mtimeMs: details.mtimeMs })
-  }
-  candidates.sort((a, b) => b.mtimeMs - a.mtimeMs)
-  const artifact = candidates[0]
-  if (!artifact) throw new Error(`未找到 ${platform}/${arch} 的 ${info.manifest.version} ${targetExtension} 发布产物`)
-  const data = await readFile(artifact.file)
-  const sha512 = createHash('sha512').update(data).digest('base64')
-  const artifactURL = artifactBase
-    ? `${artifactBase}/${encodeURIComponent(basename(artifact.file))}`
-    : `https://upload.invalid/${encodeURIComponent(basename(artifact.file))}`
-  const release = {
-    product,
-    version: info.manifest.version,
-    channel,
-    platform,
-    arch,
-    artifact_url: artifactURL,
-    artifact_name: basename(artifact.file),
-    sha512,
-    size: data.length,
-    release_notes: String(releaseConfig.releaseNotes || '').trim(),
-  }
-  const metadataName = platform === 'darwin' ? `${channel}-mac.yml` : platform === 'linux' ? `${channel}-linux${arch === 'x64' ? '' : `-${arch}`}.yml` : `${channel}.yml`
-  const metadata = `version: ${release.version}\nfiles:\n  - url: ${JSON.stringify(artifactURL)}\n    sha512: ${sha512}\n    size: ${data.length}\npath: ${JSON.stringify(release.artifact_name)}\nsha512: ${sha512}\nreleaseDate: ${new Date().toISOString()}\nreleaseNotes: ${JSON.stringify(release.release_notes)}\n`
-  await writeFile(join(outputPath, metadataName), metadata)
-  const recordPath = join(outputPath, 'desktop-release.json')
-  await writeFile(recordPath, `${JSON.stringify(release, null, 2)}\n`)
-  return { ...release, metadata: metadataName, record: recordPath }
-}
-
 function defaultAgentNamespace(identifier) {
   return identifier.replace(/^app\./, '').replace(/[^a-z0-9]+/g, '_').slice(0, 48) || 'app'
 }
@@ -919,9 +673,9 @@ async function writeProject(root, app) {
   await writeFile(join(root, 'tsconfig.json'), JSON.stringify({ compilerOptions: { target: 'ES2022', module: 'ESNext', moduleResolution: 'Bundler', resolveJsonModule: true, strict: true, skipLibCheck: true, lib: ['ES2022', 'DOM', 'DOM.Iterable'], types: ['vite/client', 'node'], noEmit: true }, include: ['src', 'vite.config.ts'] }, null, 2) + '\n')
   await writeFile(join(root, 'package.json'), JSON.stringify({ name: app.slug.replaceAll('.', '-'), private: true, type: 'module', scripts: { dev: 'proxy-app dev', 'dev:server': 'vite', typecheck: 'tsc --noEmit', build: 'npm run typecheck && vite build' }, dependencies: { '@ducking-mind/proxy-app-sdk': '^0.1.0' }, devDependencies: { [cliPackage.name]: `^${cliPackage.version}`, '@types/node': '^22.18.0', typescript: '^5.2.2', vite: '^8.2.2' }, engines: { node: '>=22.18' } }, null, 2) + '\n')
   await writeFile(join(root, 'agent', 'guide.md'), `# ${app.name} 能力说明\n\n这是由 “proxy-app init” 生成的能力指南。外部 Codex 通过主应用 MCP 调用能力，应用本身不实现 Agent。\n\n当前提供 “proxy_${namespace}_read_metadata”，用于确认应用 ID、版本和名称。能力定义在 “src/agent-tools.mjs” 中维护，应用使用同一份定义注册处理器；构建命令自动生成发布契约，无需在 manifest 中重复声明能力。\n`)
-  await writeFile(join(root, 'agent', 'workflow.md'), `# 调用流程\n\n1. 先读取应用状态和本指南。\n2. 调用 “proxy_${namespace}_read_metadata” 确认当前版本。\n3. 新增写能力时，先读取业务 revision，并为每次新操作生成唯一 “idempotency_key”。\n4. Web 和本地 App 共用同一套 manifest；仅在能力确实支持时缩小 “targets”。\n`)
+  await writeFile(join(root, 'agent', 'workflow.md'), `# 调用流程\n\n1. 先读取应用状态和本指南。\n2. 调用 “proxy_${namespace}_read_metadata” 确认当前版本。\n3. 新增写能力时，先读取业务 revision，并为每次新操作生成唯一 “idempotency_key”。\n4. Web 和私有桌面宿主共用同一套 manifest；仅在能力确实支持时缩小 “targets”。桌面宿主源码和构建流程不属于公开 CLI。\n`)
   await writeFile(join(root, 'agent', 'examples.json'), JSON.stringify([{ capability: 'read_metadata', input: {}, output: { appId: app.slug, version: '0.1.0', name: app.name } }], null, 2) + '\n')
-  await writeFile(join(root, 'README.md'), `# ${app.name}\n\n## 开发\n\n~~~bash\nnpm install\nnpx proxy-app create\nnpm run dev\n~~~\n\n已有平台应用时跳过 create，将 manifest.id 设为平台应用的公开 slug 后直接运行 npm run dev，无需 link 或 repair。启动时会先完成开发者授权与应用检查，再运行开发服务器，不要求手工配置用户 token。底层服务器命令配置在 package.json 的 dev:server 中。\n\n## 能力接入\n\n本项目已生成 Web 与本地 App 两个运行目标，以及一个 “read_metadata” 示例。能力的名称、Schema 和读写属性只在 “src/agent-tools.mjs” 中维护，处理器注册使用同一份定义。源码 manifest 不再声明 Agent 配置；构建会从代码自动生成发布能力目录，请勿手工重复维护。新增能力后同步业务指南和示例，再运行：\n\n~~~bash\nnpx proxy-app validate\nnpx proxy-app pack\n~~~\n\n完整约定见仓库的 [应用开发指南](https://github.com/duckingmind/app/blob/main/docs/APP_DEVELOPMENT.md)。\n`)
+  await writeFile(join(root, 'README.md'), `# ${app.name}\n\n## 开发\n\n~~~bash\nnpm install\nnpx proxy-app create\nnpm run dev\n~~~\n\n已有平台应用时跳过 create，将 manifest.id 设为平台应用的公开 slug 后直接运行 npm run dev，无需 link 或 repair。启动时会先完成开发者授权与应用检查，再运行开发服务器，不要求手工配置用户 token。底层服务器命令配置在 package.json 的 dev:server 中。\n\n## 能力接入\n\n本项目生成 Web 目标，并保留供私有桌面宿主识别的 “desktop” 兼容目标；公开 CLI 只构建和发布 Web 应用。能力的名称、Schema 和读写属性只在 “src/agent-tools.mjs” 中维护，处理器注册使用同一份定义。源码 manifest 不再声明 Agent 配置；构建会从代码自动生成发布能力目录，请勿手工重复维护。新增能力后同步业务指南和示例，再运行：\n\n~~~bash\nnpx proxy-app validate\nnpx proxy-app pack\n~~~\n\n完整约定见仓库的 [应用开发指南](https://github.com/duckingmind/app/blob/main/docs/APP_DEVELOPMENT.md)。\n`)
 }
 
 async function replaceIdentifier(root, previous, next) {
@@ -1166,8 +920,6 @@ try {
     else if (command === 'pack') await packApp(appDir, output, { allowSource: options.includes('--source') })
     else if (command === 'upload') await uploadApp(appDir, output, { allowSource: options.includes('--source') })
     else if (command === 'publish') await publishApp(appDir, output, option(options, '--version'))
-    else if (command === 'desktop-build') await desktopBuildApp(appDir, options)
-    else if (command === 'desktop-pack') await desktopPackApp(appDir, output, options)
   }
 } catch (error) {
   console.error(`proxy app: ${error instanceof Error ? error.message : String(error)}`)

package/agent-runtime/runtime-status.mjs

@@ -1,70 +0,0 @@
-/** Descriptive renderer state only; neither status nor recovery hints grant access. */
-const states = new Set(['ready', 'auth_required', 'loading', 'no_document', 'busy', 'error'])
-const actions = new Set(['wait', 'user_login', 'open_document', 'retry', 'inspect_state'])
-const record = value => value !== null && typeof value === 'object' && !Array.isArray(value)
-const check = (condition, message) => { if (!condition) throw new TypeError(message) }
-const keys = (value, allowed, field) => check(Object.keys(value).every(key => allowed.includes(key)), `Unexpected ${field} field`)
-
-export function normalizeNextAction(value) {
-  check(record(value), 'nextAction must be an object')
-  keys(value, ['type', 'capability'], 'nextAction')
-  check(actions.has(value.type), 'Invalid nextAction type')
-  if (value.capability !== undefined) check(typeof value.capability === 'string' && /^[a-z][a-z0-9_-]{0,127}$/.test(value.capability), 'Invalid nextAction capability')
-  return { type: value.type, ...(value.capability === undefined ? {} : { capability: value.capability }) }
-}
-
-export function normalizeRuntimeStatus(value) {
-  check(record(value), 'Runtime status must be an object')
-  keys(value, ['state', 'reason', 'retryable', 'nextAction', 'context'], 'runtime status')
-  check(states.has(value.state), 'Invalid runtime state')
-  const result = { state: value.state }
-  if (value.reason !== undefined) {
-    check(typeof value.reason === 'string' && value.reason.length <= 512, 'Invalid runtime reason')
-    result.reason = value.reason
-  }
-  if (value.retryable !== undefined) {
-    check(typeof value.retryable === 'boolean', 'Invalid runtime retryable value')
-    result.retryable = value.retryable
-  }
-  if (value.nextAction !== undefined) result.nextAction = normalizeNextAction(value.nextAction)
-  if (value.context !== undefined) {
-    check(record(value.context), 'Runtime context must be an object')
-    keys(value.context, ['activeDocumentId'], 'runtime context')
-    if (value.context.activeDocumentId !== undefined) check(typeof value.context.activeDocumentId === 'string' && value.context.activeDocumentId.length <= 128, 'Invalid activeDocumentId')
-    result.context = value.context.activeDocumentId === undefined ? {} : { activeDocumentId: value.context.activeDocumentId }
-  }
-  return result
-}
-
-/** Keep recovery metadata across process boundaries without forwarding arbitrary fields. */
-export function serializeAgentError(error) {
-  const result = {
-    code: typeof error?.code === 'string' ? error.code.slice(0, 128) : 'AGENT_HANDLER_ERROR',
-    message: typeof error?.message === 'string' ? error.message.slice(0, 2048) : 'Application handler failed',
-  }
-  // Preserve public platform diagnostics through the renderer/child/MCP
-  // boundaries, without forwarding credentials or arbitrary error fields.
-  if (Number.isInteger(error?.status) && error.status >= 100 && error.status <= 599) result.status = error.status
-  if (typeof error?.requestId === 'string') result.requestId = error.requestId.slice(0, 256)
-  if (typeof error?.authReason === 'string') result.authReason = error.authReason.slice(0, 128)
-  if (typeof error?.reason === 'string') result.reason = error.reason.slice(0, 512)
-  if (typeof error?.retryable === 'boolean') result.retryable = error.retryable
-  if (typeof error?.executionStarted === 'boolean') result.executionStarted = error.executionStarted
-  if (error?.nextAction !== undefined) {
-    try { result.nextAction = normalizeNextAction(error.nextAction) } catch { /* Invalid hints cannot obscure the actual error. */ }
-  }
-  const recovery = {
-    AGENT_OUTCOME_UNKNOWN: { reason: 'execution_outcome_unknown', retryable: false, nextAction: { type: 'inspect_state' } },
-    AGENT_WRITE_BUSY: { reason: 'write_pending_or_unknown', retryable: false, nextAction: { type: 'inspect_state' } },
-    AGENT_IDEMPOTENCY_CONFLICT: { reason: 'idempotency_conflict', retryable: false, nextAction: { type: 'inspect_state' } },
-    AGENT_APP_UNAVAILABLE: { reason: 'app_unavailable', retryable: true, nextAction: { type: 'wait' } },
-    AGENT_APP_NOT_READY: { reason: 'app_not_ready', retryable: true, nextAction: { type: 'wait' } },
-  }[result.code]
-  if (recovery) for (const [key, value] of Object.entries(recovery)) if (result[key] === undefined) result[key] = value
-  // An unknown execution outcome must never acquire an automatic retry hint.
-  if (result.code === 'AGENT_OUTCOME_UNKNOWN') {
-    result.retryable = false
-    result.nextAction = { type: 'inspect_state' }
-  }
-  return result
-}

package/release-runtime/release-config.mjs

@@ -1,154 +0,0 @@
-import { access, readFile } from 'node:fs/promises'
-import { dirname, join, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-// This file deliberately contains no credentials. A developer may copy
-// release.config.example.json to release.config.json (which is gitignored)
-// and put the publish key in that local file.
-export const DEFAULT_RELEASE_CONFIG = Object.freeze({
-  product: 'duckingmind',
-  updateURL: '',
-  updateChannel: 'latest',
-  apiURL: '',
-  apiKey: '',
-  releaseNotes: '',
-  artifactBaseURL: '',
-})
-
-export function parseConfigOption(args) {
-  const rest = []
-  let configPath
-  let envOverrides = false
-  for (let index = 0; index < args.length; index += 1) {
-    const value = args[index]
-    if (value === '--env-overrides') { envOverrides = true; continue }
-    if (value === '--config') {
-      const next = args[++index]
-      if (!next || next.startsWith('--')) throw new Error('Missing value for --config')
-      configPath = next
-      continue
-    }
-    if (value.startsWith('--config=')) {
-      configPath = value.slice('--config='.length)
-      if (!configPath) throw new Error('Missing value for --config')
-      continue
-    }
-    rest.push(value)
-  }
-  return { args: rest, configPath, envOverrides }
-}
-
-function stringValue(value, fallback = '') {
-  return value == null ? fallback : String(value).trim()
-}
-
-function flattenConfig(value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('发布配置必须是 JSON 对象')
-  const update = value.update && typeof value.update === 'object' ? value.update : {}
-  const release = value.release && typeof value.release === 'object' ? value.release : {}
-  const build = value.build && typeof value.build === 'object' ? value.build : {}
-  return {
-    product: stringValue(value.product ?? release.product, 'duckingmind'),
-    updateURL: stringValue(value.updateURL ?? value.updateUrl ?? value.update_url ?? update.url ?? update.updateURL ?? update.update_url),
-    updateChannel: stringValue(value.updateChannel ?? value.channel ?? update.channel, 'latest'),
-    apiURL: stringValue(value.apiURL ?? value.apiUrl ?? value.api_url ?? release.apiURL ?? release.apiUrl ?? release.api_url),
-    apiKey: stringValue(value.apiKey ?? value.api_key ?? release.apiKey ?? release.api_key),
-    releaseNotes: stringValue(value.releaseNotes ?? value.release_notes ?? value.notes ?? release.releaseNotes ?? release.release_notes ?? release.notes),
-    artifactBaseURL: stringValue(value.artifactBaseURL ?? value.artifactBaseUrl ?? value.artifact_base_url ?? release.artifactBaseURL ?? release.artifactBaseUrl ?? release.artifact_base_url),
-    buildTarget: { platform: stringValue(build.platform), arch: stringValue(build.arch) },
-    releaseDirs: release.directories ?? ['release'],
-    recordPaths: release.records ?? [],
-  }
-}
-
-function envOverrides(env = process.env) {
-  const keys = {
-    product: 'PROXY_DESKTOP_PRODUCT',
-    updateURL: 'PROXY_DESKTOP_UPDATE_URL',
-    updateChannel: 'PROXY_DESKTOP_UPDATE_CHANNEL',
-    apiURL: 'PROXY_DESKTOP_RELEASE_API_URL',
-    apiKey: 'PROXY_DESKTOP_RELEASE_API_KEY',
-    releaseNotes: 'PROXY_DESKTOP_RELEASE_NOTES',
-    artifactBaseURL: 'PROXY_DESKTOP_ARTIFACT_BASE_URL',
-  }
-  return Object.fromEntries(Object.entries(keys).filter(([, key]) => env[key] != null && String(env[key]).trim() !== '').map(([name, key]) => [name, String(env[key]).trim()]))
-}
-
-async function firstExisting(paths) {
-  for (const path of paths) {
-    try {
-      await access(path)
-      return path
-    } catch {}
-  }
-  return undefined
-}
-
-export function defaultConfigPaths({ root, cwd = process.cwd() }) {
-  const candidates = [join(root, 'release.config.json'), join(root, 'release.config.local.json')]
-  if (cwd && resolve(cwd) !== resolve(root)) {
-    candidates.push(join(cwd, 'desktop', 'release.config.json'), join(cwd, 'desktop', 'release.config.local.json'))
-  }
-  return [...new Set(candidates)]
-}
-
-export function isAllowedReleaseURL(value) {
-  let parsed
-  try { parsed = new URL(String(value || '').trim()) } catch { return false }
-  const loopbackHTTP = parsed.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)
-  return (parsed.protocol === 'https:' || loopbackHTTP) && !parsed.username && !parsed.password && !parsed.search && !parsed.hash
-}
-
-export async function loadReleaseConfig({ root = releaseConfigRoot(), cwd = process.env.INIT_CWD || process.cwd(), configPath, env = process.env, envOverrides: allowEnv = false } = {}) {
-  const explicit = configPath || (allowEnv ? env.PROXY_DESKTOP_RELEASE_CONFIG : '')
-  const selected = explicit
-    ? resolve(cwd, explicit)
-    : await firstExisting(defaultConfigPaths({ root, cwd }))
-  let fileConfig = {}
-  if (selected) {
-    try {
-      fileConfig = JSON.parse(await readFile(selected, 'utf8'))
-    } catch (error) {
-      // JSON parser errors may contain excerpts from the key. Never echo them.
-      throw new Error(`无法读取发布配置 ${selected}: ${error.code || 'invalid JSON'}`)
-    }
-  } else if (explicit) {
-    throw new Error(`发布配置不存在: ${selected}`)
-  }
-  const values = { ...DEFAULT_RELEASE_CONFIG, ...flattenConfig(fileConfig), ...(allowEnv ? envOverrides(env) : {}) }
-  const configDirectory = selected ? dirname(selected) : root
-  for (const field of ['releaseDirs', 'recordPaths']) {
-    if (!Array.isArray(values[field]) || values[field].some(path => typeof path !== 'string' || !path.trim())) throw new Error(`发布配置 release.${field === 'releaseDirs' ? 'directories' : 'records'} 必须是路径数组`)
-    values[field] = values[field].map(path => resolve(configDirectory, path))
-  }
-  if (allowEnv) {
-    if (env.PROXY_DESKTOP_PLATFORM) values.buildTarget.platform = env.PROXY_DESKTOP_PLATFORM
-    if (env.PROXY_DESKTOP_ARCH) values.buildTarget.arch = env.PROXY_DESKTOP_ARCH
-  }
-  return { ...values, path: selected }
-}
-
-export function validateReleaseConfig(config, { requireUpdateURL = false, requirePublish = false } = {}) {
-  const updateURL = stringValue(config?.updateURL)
-  const channel = stringValue(config?.updateChannel || 'latest')
-  if (requireUpdateURL && !updateURL) throw new Error('发布配置缺少 update.url')
-  if (updateURL) {
-    let parsed
-    const resolved = updateURL.replaceAll('{platform}', 'darwin').replaceAll('{arch}', 'arm64')
-    try { parsed = new URL(resolved) } catch { throw new Error('发布配置 update.url 必须是 HTTPS 或本机回环 HTTP 地址') }
-    if (!isAllowedReleaseURL(resolved)) throw new Error('发布配置 update.url 必须是无凭据、无查询参数的 HTTPS 或本机回环 HTTP 地址')
-  }
-  if (!['latest', 'beta'].includes(channel)) throw new Error('发布配置 update.channel 必须是 latest 或 beta')
-  if (requirePublish) {
-    let parsed
-    const apiURL = stringValue(config?.apiURL)
-    try { parsed = new URL(apiURL) } catch { throw new Error('发布配置 release.apiUrl 必须是 HTTPS 或本机回环 HTTP 地址') }
-    if (!isAllowedReleaseURL(apiURL)) throw new Error('发布配置 release.apiUrl 必须是无凭据、无查询参数的 HTTPS 或本机回环 HTTP 地址')
-    if (!stringValue(config?.apiKey)) throw new Error('发布配置 release.apiKey 不能为空')
-  }
-  return { ...config, updateURL, updateChannel: channel }
-}
-
-export function releaseConfigRoot() {
-  return join(dirname(fileURLToPath(import.meta.url)), '..')
-}

package/release-runtime/release-target.mjs

@@ -1,48 +0,0 @@
-import { isAllowedReleaseURL } from './release-config.mjs'
-
-const platforms = new Map([
-  ['--mac', 'darwin'], ['--macos', 'darwin'], ['-m', 'darwin'],
-  ['--win', 'win32'], ['--windows', 'win32'], ['-w', 'win32'],
-  ['--linux', 'linux'], ['-l', 'linux'],
-])
-const architectures = new Set(['x64', 'arm64', 'ia32'])
-
-// An update feed is specific to one OS/CPU. Build each target separately so
-// the packaged feed and the generated release record always describe its bytes.
-export function releaseTarget(args, host = process) {
-  const requestedPlatforms = new Set()
-  const requestedArchitectures = new Set()
-  for (let i = 0; i < args.length; i += 1) {
-    const value = args[i]
-    const platformFlag = value.split('=')[0]
-    if (platforms.has(platformFlag)) requestedPlatforms.add(platforms.get(platformFlag))
-    if (value === '--armv7l') throw new Error('Unsupported release architecture: armv7l')
-    if (value === '--universal') throw new Error('Release builds require a separate arm64 or x64 package; --universal is unsupported')
-    const arch = value === '--arch' ? args[++i] : value.replace(/^--(?:arch=)?/, '')
-    if (architectures.has(arch)) requestedArchitectures.add(arch)
-    else if (value === '--arch' || value.startsWith('--arch=')) throw new Error(`Unsupported release architecture: ${arch}`)
-  }
-  if (requestedPlatforms.size > 1 || requestedArchitectures.size > 1) {
-    throw new Error('Build one platform and architecture at a time; publish their release records together')
-  }
-  const platform = [...requestedPlatforms][0] || host.platform
-  const arch = [...requestedArchitectures][0] || host.arch
-  if (!['darwin', 'win32', 'linux'].includes(platform) || !architectures.has(arch) || (platform === 'darwin' && arch === 'ia32')) {
-    throw new Error(`Unsupported release target: ${platform}/${arch}`)
-  }
-  return { platform, arch }
-}
-
-export function releaseFeedURL(value, target) {
-  const resolved = String(value || '').trim().replaceAll('{platform}', target.platform).replaceAll('{arch}', target.arch).replace(/\/+$/, '')
-  let url
-  try { url = new URL(resolved) } catch { throw new Error('发布配置 update.url 必须是 HTTPS 或本机回环 HTTP 更新目录地址') }
-  if (!isAllowedReleaseURL(resolved)) {
-    throw new Error('发布配置 update.url 必须是无凭据、无查询参数或片段的 HTTPS 或本机回环 HTTP 更新目录地址')
-  }
-  const routeTarget = /\/(darwin|win32|linux)\/(arm64|x64|ia32)$/.exec(url.pathname)
-  if (routeTarget && (routeTarget[1] !== target.platform || routeTarget[2] !== target.arch)) {
-    throw new Error(`Update URL target does not match ${target.platform}/${target.arch}; use {platform}/{arch} placeholders`)
-  }
-  return resolved
-}