@fxz26284407/yuanma-gateway 0.1.6 → 0.1.8

package/README.md

@@ -1,31 +1,39 @@
 # 远码网关（yuanma-gateway）
 
-远码的 Mac 本地网关与 HTTP/WS 公网密文中继。只包含两端网关，不包含鸿蒙工程、签名文件、个人文档库或运行数据。
+远码的 macOS / Windows 本地网关与 HTTP/WS 公网密文中继。只包含两端网关，不包含鸿蒙工程、签名文件、个人文档库或运行数据。
 
-## 局域网直连（本地开发版本，尚未发布到 npm）
+## 平台支持
 
-本地代码已支持手机直接连接 Mac，无需启动 Relay。npm 已发布的 0.1.0 仍沿用原中继流程；使用直连需同时更新本地网关和鸿蒙 App，旧 App 不支持新的直连二维码。
+从 0.1.8 起，macOS 与 Windows 11 x64 使用同一个 npm 包和版本，通过系统适配器连接 Codex、DeepSeek Harness 与 Antigravity。要求 Node.js 22，安装和升级命令相同。Windows 项目目录兼容反斜杠与正斜杠。
 
-在本仓库使用 Node.js 22 构建后运行：
+Windows 本地管理接口使用仅监听回环地址的鉴权入口，文件权限按当前用户 SID 设置；macOS 继续使用 Unix socket。二维码已缩小，配对准备阶段显示等待提示。
+
+## 局域网直连
+
+已发布的网关支持手机与电脑在同一局域网直连，无需部署 Relay。当前 App 最低要求网关 0.1.7，请同时更新手机与网关。
+
+在电脑安装 Node.js 22，并准备好与桌面共用的 Codex app-server 入口后执行：
 
 ```sh
-npm run build
-node bin/yuanma-gateway.mjs init
-node bin/yuanma-gateway.mjs pair
+npm install -g @fxz26284407/yuanma-gateway@latest --registry=https://registry.npmmirror.com
+yuanma-gateway init
+yuanma-gateway pair
 ```
 
-首次初始化的中继地址可以留空。单个常规内网 IPv4 自动选择，多个地址展示网卡与 IP 供选择；虚拟网卡需确认手机可达。默认端口为 `19089`，二维码地址为 `ws://所选内网IP:19089/v1/secure`。仅该加密入口对内网开放，本地管理接口继续使用 Unix socket。仍需准备与桌面共享的 Codex 后端及现有密钥保存模式。
+安装命令仅本次使用 npmmirror 镜像，不修改全局 npm 配置。镜像同步新版本可能有延迟；安装不到所需版本时，将命令中的镜像地址改为 https://registry.npmjs.org。
+
+首次初始化的中继地址可以留空。单个常规内网 IPv4 自动选择，多个地址展示网卡与 IP 供选择；虚拟网卡需确认手机可达。默认端口为 `19089`，二维码地址为 `ws://所选内网IP:19089/v1/secure`。仅该加密入口对内网开放，本地管理接口使用上述平台各自的受保护入口。仍需准备与桌面共享的 Codex 后端及现有密钥保存模式。
 
 普通 start/restart 沿用已保存模式；pair 默认局域网，多个内网 IP 时交互选择，直接执行：
 
 ```sh
-node bin/yuanma-gateway.mjs pair
+yuanma-gateway pair
 ```
 
 非交互或需要指定网卡、端口时：
 
 ```sh
-node bin/yuanma-gateway.mjs pair --lan-host 192.168.1.10 --lan-port 19089
+yuanma-gateway pair --lan-host 192.168.1.10 --lan-port 19089
 ```
 
 将示例 IP 替换为本机实际内网地址。IP 失效时重新选择并扫码，端口冲突时更换端口；不要将手机的 localhost 当作 Mac。网关保存连接方式，后续启动复用；设备身份与授权保持原样。
@@ -33,10 +41,10 @@ node bin/yuanma-gateway.mjs pair --lan-host 192.168.1.10 --lan-port 19089
 保留 Relay 扩展，切换时使用：
 
 ```sh
-node bin/yuanma-gateway.mjs pair --relay-url wss://relay.example.com
+yuanma-gateway pair --relay-url wss://relay.example.com
 ```
 
-局域网和 Relay 首版互斥，不会自动回退公网。以下中继安装与部署说明适用于已有发布版本及需要中继扩展的用户。
+局域网和 Relay 两种连接方式互斥，不会自动回退公网。跨网络使用时可按下文部署中继。
 
 ## 项目系列
 
@@ -91,7 +99,7 @@ node bin/yuanma-gateway.mjs pair --relay-url wss://relay.example.com
 ```sh
 nvm install 22
 nvm use 22
-npm install -g @fxz26284407/yuanma-gateway@0.1.0 --registry=https://registry.npmjs.org
+npm install -g @fxz26284407/yuanma-gateway@latest --registry=https://registry.npmmirror.com
 yuanma-gateway --version
 ```
 
@@ -110,10 +118,10 @@ yuanma-gateway projects
 ### 初始化
 
 ```sh
-yuanma-gateway init --relay-url wss://relay.example.com
+yuanma-gateway init
 ```
 
-将示例域名替换为实际 relay 地址。初始化读取真实 Codex 项目列表，由你选择初始项目。**现有产品会继续同步发现其他项目；配对后所有发现的项目和工作区默认可执行，初始列表不是权限白名单。** 初始化会明确说明并要求接受这项既有策略；会话中的执行审批仍独立管理。
+同一局域网使用时，中继地址留空；跨网络使用时，填写自行部署的实际 `wss://` 中继地址，也可使用 `yuanma-gateway init --relay-url wss://relay.example.com`。初始化读取真实 Codex 项目列表，由你选择初始项目。**现有产品会继续同步发现其他项目；配对后所有发现的项目和工作区默认可执行，初始列表不是权限白名单。** 初始化会明确说明并要求接受这项既有策略；会话中的执行审批仍独立管理。
 
 当前版本的远程连接还需显式启用本机私有文件保存传输密钥的模式；交互界面会说明并征求选择。
 
@@ -193,7 +201,7 @@ yuanma-gateway restart
 ### 升级与停止
 
 ```sh
-npm install -g @fxz26284407/yuanma-gateway@latest --registry=https://registry.npmjs.org
+npm install -g @fxz26284407/yuanma-gateway@latest --registry=https://registry.npmmirror.com
 yuanma-gateway restart
 ```
 

package/bin/yuanma-gateway.mjs

@@ -1,53 +1,45 @@
 #!/usr/bin/env node
-import {mkdir, lstat, readFile, open, rename, unlink} from 'node:fs/promises';
+import {lstat, readFile, open, rename, unlink} from 'node:fs/promises';
 import {randomUUID} from 'node:crypto';
-import {spawn} from 'node:child_process';
-import {homedir} from 'node:os';
-import {dirname, join, resolve} from 'node:path';
+import {dirname, join, resolve,isAbsolute} from 'node:path';
+import {platform} from '../dist/platform.mjs';
 import {fileURLToPath} from 'node:url';
 import {parseArgs} from 'node:util';
 import {createInterface} from 'node:readline/promises';
 import {setTimeout as delay} from 'node:timers/promises';
-import {Rpc} from '../dist/rpc.mjs';
+import {CodexBackend} from '../dist/codex.js';
+import {withProgress} from '../scripts/terminal-progress.mjs';
 import {lanAddresses, lanConfig, DEFAULT_LAN_PORT} from '../dist/lan.js';
 import {relayEndpoint} from '../dist/relay-client.js';
 import {connectionArgs, gatewayLaunch, restartGateway, gatewayStatus, stopGateway, openGatewayLog} from '../scripts/restart-local-gateway.mjs';
 
 process.umask(0o077);
 const root=fileURLToPath(new URL('../',import.meta.url));
-const home=join(homedir(),'.local/share/yuanma/gateway');
+const home=platform.gatewayHome;
 const settingsPath=join(home,'installation.json');
 const cli=join(root,'dist/cli.js');
-const help=`远码网关（需要 Node.js 22 和与桌面共享的 Codex 后端）
-  yuanma-gateway init [--relay-url wss://域名] [--projects 项目ID,项目ID] [--allow-development-keys] [--accept-project-access]
+const help=`远码网关（需要 Node.js 22 和已登录的桌面智能体）
+  yuanma-gateway init [--backend codex|deepseek|antigravity] [--codex-endpoint 本机共享入口] [--relay-url wss://域名] [--projects 项目ID,项目ID] [--allow-development-keys] [--accept-project-access]
   yuanma-gateway init --config 原配置绝对路径 --state-dir 原状态目录绝对路径
   yuanma-gateway start [--relay-url wss://域名]
   yuanma-gateway restart [--relay-url wss://域名]
-  yuanma-gateway pair（默认局域网，交互选择内网 IP）
+  yuanma-gateway pair（默认小二维码，旧版手机可加 --legacy-qr）
   yuanma-gateway pair --relay-url ws[s]://中继地址
   局域网选项：--connection-mode lan [--lan-host 内网IP] [--lan-port 19089]
   中继选项：--relay-url ws[s]://中继地址（start/restart 沿用原模式，pair 默认局域网）
   yuanma-gateway status | stop | projects | devices | security
   yuanma-gateway device-project-policy --device-id 设备ID --capability control
-默认配置与状态位于 ~/.local/share/yuanma/gateway/，npm 升级不会覆盖。
+默认配置与状态位于 ${home}，npm 升级不会覆盖。
 当前版本配对后所有发现的项目和工作区默认可执行；会话执行审批独立管理。`;
 
-async function privateDirectory(path){
- await mkdir(path,{recursive:true,mode:0o700});
- const s=await lstat(path);
- if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==process.getuid()||(s.mode&0o077))throw Error('目录必须由当前用户拥有且权限为 700：'+path);
-}
-async function privateJson(path){
- const s=await lstat(path);
- if(!s.isFile()||s.isSymbolicLink()||s.nlink!==1||s.uid!==process.getuid()||(s.mode&0o077))throw Error('配置必须是当前用户的私有普通文件（权限 600）：'+path);
- return JSON.parse(await readFile(path,'utf8'));
-}
+const privateDirectory=path=>platform.files.privateDirectory(path);
+const privateJson=path=>platform.files.readPrivateJson(path);
 async function createJson(path,value){
  const f=await open(path,'wx',0o600);
- try{await f.writeFile(JSON.stringify(value,null,2)+'\n');await f.sync();}finally{await f.close();}
+ try{platform.files.protectCreatedFile(path);await f.writeFile(JSON.stringify(value,null,2)+'\n');await f.sync();}finally{await f.close();}
 }
 function validateConfig(config){
- if(!Array.isArray(config.projects)||!config.projects.length||config.projects.some(p=>typeof p.id!=='string'||!p.id||!Array.isArray(p.roots)||!p.roots.length||p.roots.some(r=>typeof r!=='string'||!r.startsWith('/'))))throw Error('配置需要明确的项目 ID 和绝对根目录');
+ if(!Array.isArray(config.projects)||!config.projects.length||config.projects.some(p=>typeof p.id!=='string'||!p.id||!Array.isArray(p.roots)||!p.roots.length||p.roots.some(r=>typeof r!=='string'||!isAbsolute(r))))throw Error('配置需要明确的项目 ID 和绝对根目录');
  if(config.connectionMode!==undefined&&!['lan','relay'].includes(config.connectionMode))throw Error('配置中的连接模式无效');
  if(config.relayUrl!=null)relayEndpoint(config.relayUrl);
 }
@@ -55,7 +47,7 @@ async function installation(values){
  const selected=values.config||values['state-dir'];
  if(selected&&(!values.config||!values['state-dir']))throw Error('--config 和 --state-dir 必须同时指定，避免误用另一套身份');
  const info=selected?{config:resolve(values.config),stateDir:resolve(values['state-dir'])}:await privateJson(settingsPath).catch(e=>{if(e.code==='ENOENT')throw Error('尚未初始化，请先运行 yuanma-gateway init');throw e;});
- if(typeof info.config!=='string'||!info.config.startsWith('/')||typeof info.stateDir!=='string'||!info.stateDir.startsWith('/'))throw Error('安装记录中的路径无效');
+ if(typeof info.config!=='string'||!isAbsolute(info.config)||typeof info.stateDir!=='string'||!isAbsolute(info.stateDir))throw Error('安装记录中的路径无效');
  const config=await privateJson(info.config);validateConfig(config);
  await lstat(info.stateDir);await privateDirectory(info.stateDir);
  if(info.relayUrl!=null)relayEndpoint(info.relayUrl);
@@ -99,8 +91,8 @@ async function selectConnection(values,saved={},choose=false){
  return {connectionMode:'lan',lanHost:lan.host,lanPort:lan.port,relayUrl:null};
 }
 async function catalog(socket){
- const rpc=new Rpc(socket,'yuanma_gateway_setup',{retainMessages:false});
- try{await rpc.initialize();const result=await rpc.call('project/list',{limit:100});return result.data;}finally{rpc.close();}
+ const backend=new CodexBackend(socket,[]);
+ try{return await backend.projectCatalog();}finally{await backend.close();}
 }
 async function init(values){
  await privateDirectory(home);
@@ -127,9 +119,17 @@ async function init(values){
   const entered=values['relay-url']??(values['connection-mode']||values['lan-host']||!process.stdin.isTTY?'':await ask('中继地址（可留空使用局域网直连）：'));
   prompt?.close();prompt=undefined;
   const connection=await selectConnection({...values,...(entered.trim()?{'relay-url':entered.trim()}:{})});
-  const socket=resolve(values['codex-socket']??join(homedir(),'.local/share/yuanma/shared/app-server.sock'));
-  const projects=await catalog(socket);
-  if(!Array.isArray(projects)||!projects.length)throw Error('共享 Codex 后端没有可选择的项目');
+  const supplied=values['codex-endpoint']??values['codex-socket']??platform.codex.defaultEndpoint;
+  const socket=!supplied||/^wss?:\/\//.test(supplied)?supplied:resolve(supplied);
+  const backend=values.backend??'codex';
+  let projects;
+  if(backend==='codex')projects=await catalog(socket);
+  else if(['deepseek','antigravity'].includes(backend)){
+   const {DeepSeekBackend}=await import('../dist/deepseek.js'),{AntigravityBackend}=await import('../dist/antigravity.js');
+   const native=backend==='deepseek'?new DeepSeekBackend([]):new AntigravityBackend([]);
+   try{projects=await native.projectCatalog();}finally{native.close();}
+  }else throw Error('未知智能体：'+backend);
+  if(!Array.isArray(projects)||!projects.length)throw Error('所选桌面智能体没有可选择的项目');
   let selected;
   if(values.projects){const ids=values.projects.split(',').map(x=>x.trim()).filter(Boolean);selected=projects.filter(p=>ids.includes(p.id));if(!ids.length||new Set(ids).size!==ids.length||selected.length!==ids.length)throw Error('--projects 包含未知或重复的项目 ID');}
   else{
@@ -138,11 +138,11 @@ async function init(values){
    if(!indices.length||new Set(indices).size!==indices.length||indices.some(i=>!Number.isInteger(i)||i<1||i>projects.length))throw Error('项目序号无效');
    selected=indices.map(i=>projects[i-1]);
   }
-  const allow=values['allow-development-keys']||(await ask('当前网关使用权限 600 的本机文件保存传输密钥，启用此模式？[y/N]：')).trim().toLowerCase()==='y';
+  const allow=values['allow-development-keys']||(await ask('当前网关使用仅当前用户可访问的本机文件保存传输密钥，启用此模式？[y/N]：')).trim().toLowerCase()==='y';
   if(!allow)throw Error('未启用当前版本所需的密钥模式，未创建配置或网关身份');
   const accepted=values['accept-project-access']||(await ask('配对后所有发现的项目和工作区默认可执行，初始项目列表不是权限白名单。接受此策略？[y/N]：')).trim().toLowerCase()==='y';
   if(!accepted)throw Error('未接受现有项目访问策略，未创建配置或网关身份');
-  const config={codexSocket:socket,...connection,allowDevelopmentKeys:true,projects:selected.map(p=>({id:p.id,...(p.name?{name:p.name}:{}),roots:p.roots}))};validateConfig(config);
+  const config={...(socket?{codexSocket:socket}:{}),backend,...connection,allowDevelopmentKeys:true,projects:selected.map(p=>({id:p.id,...(p.name?{name:p.name}:{}),roots:p.roots}))};validateConfig(config);
   await privateDirectory(stateDir);
   await createJson(configPath,config);
   await createJson(settingsPath,{config:configPath,stateDir,...connection});
@@ -158,10 +158,11 @@ async function start(info,connection){
  const logPath=join(info.stateDir,'gateway.log');
  const log=await openGatewayLog(logPath);
  try{
-  const args=[cli,'start','--config',info.config,'--state-dir',info.stateDir];args.push(...flags);
-  const child=spawn(process.execPath,args,{cwd:dirname(info.config),detached:true,stdio:['ignore',log.fd,log.fd]});child.unref();
+  const args=[cli,'start','--config',info.config,'--state-dir',info.stateDir];if(info.configData.backend)args.push('--backend',info.configData.backend);args.push(...flags);
+  const child=platform.spawn(process.execPath,args,{cwd:dirname(info.config),detached:true,stdio:['ignore',log.fd,log.fd]});child.unref();
   let error,exited=false;child.on('error',e=>{error=e;});child.on('exit',()=>{exited=true;});
-  for(let n=0;n<150;n++){
+  const deadline=Date.now()+platform.startupTimeoutMs;
+  while(Date.now()<deadline){
    if(error)throw error;
    if(exited)throw Error('网关启动失败，请查看 '+logPath);
    const state=await gatewayStatus(info.stateDir).catch(e=>{if(['ENOENT','ECONNREFUSED'].includes(e.code))return null;throw e;});
@@ -173,21 +174,22 @@ async function start(info,connection){
  }finally{await log.close();}
 }
 async function run(path,args){
- const child=spawn(process.execPath,[path,...args],{stdio:'inherit'});
+ const child=platform.spawn(process.execPath,[path,...args],{stdio:'inherit'});
  await new Promise((ok,fail)=>{child.on('error',fail);child.on('exit',(code,signal)=>{if(code===0)ok();else fail(Error('命令退出：'+(signal??code)));});});
 }
 
 try{
+ platform.supportedHost();
  if(!process.versions.node.startsWith('22.'))throw Error('请使用 Node.js 22（nvm install 22 && nvm use 22）');
  const [action='help',...args]=process.argv.slice(2);
  if(['help','--help','-h'].includes(action)||args.includes('--help'))console.log(help);
  else if(['--version','version'].includes(action))console.log(JSON.parse(await readFile(join(root,'package.json'),'utf8')).version);
  else{
-  const {values}=parseArgs({args,options:{config:{type:'string'},'state-dir':{type:'string'},'relay-url':{type:'string'},'connection-mode':{type:'string'},'lan-host':{type:'string'},'lan-port':{type:'string'},'codex-socket':{type:'string'},projects:{type:'string'},'allow-development-keys':{type:'boolean'},'accept-project-access':{type:'boolean'},backend:{type:'string'},'device-id':{type:'string'},capability:{type:'string'},'claim-id':{type:'string'},'grants-json':{type:'string'}}});
+  const {values}=parseArgs({args,options:{config:{type:'string'},'state-dir':{type:'string'},'relay-url':{type:'string'},'connection-mode':{type:'string'},'lan-host':{type:'string'},'lan-port':{type:'string'},'codex-socket':{type:'string'},'codex-endpoint':{type:'string'},projects:{type:'string'},'allow-development-keys':{type:'boolean'},'accept-project-access':{type:'boolean'},'legacy-qr':{type:'boolean'},backend:{type:'string'},'device-id':{type:'string'},capability:{type:'string'},'claim-id':{type:'string'},'grants-json':{type:'string'}}});
   if(action==='init')await init(values);
   else if(action==='projects'){
    if(values.backend&&values.backend!=='codex')await run(cli,['projects','--backend',values.backend]);
-   else{const socket=values['codex-socket']??join(homedir(),'.local/share/yuanma/shared/app-server.sock');console.log(JSON.stringify(await catalog(socket),null,2));}
+   else{const socket=values['codex-endpoint']??values['codex-socket']??platform.codex.defaultEndpoint;console.log(JSON.stringify(await catalog(socket),null,2));}
   }else if(['start','restart','stop','status','pair','devices','security','device-project-policy','pairing-pending','pairing-approve','pairing-reject','device-revoke'].includes(action)){
    const info=await installation(values);
    if(action==='start'||action==='restart'){
@@ -200,8 +202,8 @@ try{
    else if(action==='status')console.log(JSON.stringify(await gatewayStatus(info.stateDir),null,2));
    else if(action==='pair'){
     const connection=await selectConnection({...values,'connection-mode':values['connection-mode']??(values['relay-url']!==undefined?'relay':'lan')},{...info.configData,...info},process.stdin.isTTY);
-    await start(info,connection);await rememberConnection(info,connection);
-    await run(join(root,'scripts/pairing-qr.mjs'),['--state-dir',info.stateDir,'--auto-approve','--no-ui',...connectionArgs(connection)]);
+    await withProgress('正在确认网关并准备连接…',async()=>{await start(info,connection);await rememberConnection(info,connection);});
+    await run(join(root,'scripts/pairing-qr.mjs'),['--state-dir',info.stateDir,'--auto-approve','--no-ui',...(values['legacy-qr']?['--legacy-qr']:[]),...connectionArgs(connection)]);
    }else{
     const forwarded=[action,'--state-dir',info.stateDir];
     for(const key of ['backend','device-id','capability','claim-id','grants-json'])if(values[key]!==undefined)forwarded.push('--'+key,values[key]);

package/dist/antigravity-native.js

@@ -1,12 +1,14 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
 import { request } from 'node:https';
-import { readFile, stat } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { Fault, requireValue } from './domain.js';
-const exec = promisify(execFile);
-const app = '/Applications/Antigravity.app/Contents/Resources/app';
-const binary = '/Applications/Antigravity.app/Contents/Resources/bin/language_server';
+import { platform } from './platform.mjs';
+/** Protobuf JSON omits an empty map. Accept the native empty response, but reject unrelated/malformed payloads. */
+export function cascadeSummaries(value) {
+    requireValue(value && typeof value === 'object' && !Array.isArray(value) && (value.trajectorySummaries !== undefined || Object.keys(value).length === 0), 'PROTOCOL_INCOMPATIBLE', '桌面会话目录格式已变化', 503);
+    const summaries = value.trajectorySummaries === undefined ? {} : value.trajectorySummaries;
+    requireValue(summaries && typeof summaries === 'object' && !Array.isArray(summaries), 'PROTOCOL_INCOMPATIBLE', '桌面会话目录格式已变化', 503);
+    return summaries;
+}
 /** Same-user desktop process only. Local CSRF credentials never leave this client. */
 export class AntigravityNative {
     #authority;
@@ -39,40 +41,18 @@ export class AntigravityNative {
         }
     }
     async discover(epoch) {
-        requireValue(process.platform === 'darwin', 'BACKEND_UNAVAILABLE', 'Antigravity 桌面接入需要 macOS', 503);
-        const version = JSON.parse(await readFile(app + '/package.json', 'utf8')).version;
-        requireValue(version === '2.29.0', 'PROTOCOL_INCOMPATIBLE', '当前仅适配 Antigravity App 2.29.0，请核对桌面版本', 503);
-        const { stdout } = await exec('/bin/ps', ['-axo', 'uid,pid,ppid,command'], { maxBuffer: 4 * 1024 * 1024 });
-        const processes = stdout.split('\n').flatMap(line => {
-            const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/.exec(line);
-            if (!match || Number(match[1]) !== process.getuid?.() || !match[4].startsWith(binary + ' '))
-                return [];
-            const flag = (name) => new RegExp('--' + name + '(?:=|\\s+)([^\\s]+)').exec(match[4])?.[1];
-            if (flag('app_data_dir') !== 'antigravity' || flag('subclient_type') !== 'hub' || flag('override_ide_name') !== 'antigravity')
-                return [];
-            const token = flag('csrf_token');
-            return token ? [{ pid: Number(match[2]), token }] : [];
-        });
-        requireValue(processes.length === 1, 'BACKEND_UNAVAILABLE', '请打开唯一的 Antigravity App 桌面实例', 503);
-        const desktop = processes[0];
-        const { stdout: listeners } = await exec('/usr/sbin/lsof', ['-nP', '-a', '-p', String(desktop.pid), '-iTCP', '-sTCP:LISTEN', '-Fn'], { maxBuffer: 65536 });
-        const ports = [...new Set([...listeners.matchAll(/^n(?:127\.0\.0\.1|\*|\[::1\]):(\d+)$/gm)].map(m => Number(m[1])))];
-        requireValue(ports.length > 0, 'BACKEND_UNAVAILABLE', '无法核实 Antigravity 桌面监听地址', 503);
-        const executable = await stat(binary);
-        requireValue(executable.isFile() && !(executable.mode & 0o002), 'UNSAFE_STORAGE', 'Antigravity 可执行文件权限异常', 403);
+        const desktop = await platform.antigravity.discover();
         let found;
-        for (const port of ports) {
-            const authority = { ...desktop, port };
+        for (const port of desktop.ports) {
+            const authority = { pid: desktop.pid, port, token: desktop.token };
             try {
-                const value = await this.rpc(authority, 'GetAllCascadeTrajectories', { excludeSubtrajectories: true }, 5000);
-                if (value.trajectorySummaries && typeof value.trajectorySummaries === 'object') {
-                    found = authority;
-                    break;
-                }
+                cascadeSummaries(await this.rpc(authority, 'GetAllCascadeTrajectories', { excludeSubtrajectories: true }, 5000));
+                found = authority;
+                break;
             }
             catch { /* Only ports owned by the verified desktop process are considered. */ }
         }
-        requireValue(found, 'BACKEND_UNAVAILABLE', 'Antigravity 桌面会话接口未就绪', 503);
+        requireValue(found, 'BACKEND_UNAVAILABLE', platform.antigravity.unavailableMessage, 503);
         requireValue(epoch === this.#epoch, 'BACKEND_UNAVAILABLE', 'Antigravity 连接已关闭', 503);
         this.#authority = found;
         this.#checked = Date.now();
@@ -82,7 +62,12 @@ export class AntigravityNative {
         await this.connect();
         const authority = this.#authority;
         try {
-            return await this.rpc(authority, method, params, timeout, signal);
+            const result = await this.rpc(authority, method, params, timeout, signal);
+            if (method === 'GetCascadeTrajectorySteps') {
+                requireValue(result && typeof result === 'object' && !Array.isArray(result) && (result.steps === undefined || Array.isArray(result.steps)), 'PROTOCOL_INCOMPATIBLE', '原生步骤列表格式已变化', 503);
+                return { ...result, steps: result.steps ?? [] };
+            }
+            return result;
         }
         catch (error) {
             if (!signal?.aborted && this.#authority === authority) {

package/dist/antigravity.js

@@ -1,13 +1,12 @@
 import Database from 'better-sqlite3';
-import { constants } from 'node:fs';
-import { open, realpath, stat, readFile, writeFile, rename, lstat, mkdir } from 'node:fs/promises';
+import { realpath, stat, readFile, writeFile, rename, lstat, mkdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, relative, isAbsolute, sep, basename, dirname, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
+import { platform } from './platform.mjs';
 import { imageChunk } from './media.js';
-import { AntigravityNative } from './antigravity-native.js';
+import { AntigravityNative, cascadeSummaries } from './antigravity-native.js';
 import { messageInput, resolveExtensions } from './extensions.js';
 import { iconSource, iconFields, extensionIconChunk } from './extension-icons.js';
 import { permissionKey } from './permissions.js';
@@ -42,7 +41,7 @@ export class AntigravityBackend {
     kind = 'antigravity';
     // Writes are available only while attached to the verified desktop process.
     get readOnly() { return !this.desktop.ready; }
-    get capabilities() { return { commands: this.readOnly ? [] : agentCommands, modeControl: false, modelSettings: !this.readOnly, permissions: !this.readOnly, suggestions: !this.readOnly, steer: !this.readOnly, images: !this.readOnly, files: !this.readOnly, extensions: !this.readOnly, changes: !this.readOnly, projectActions: [{ action: 'rename', label: '重命名' }], threadActions: [{ action: 'rename', label: '重命名' }, { action: 'pin', label: '置顶', activeLabel: '取消置顶' }, { action: 'archive', label: '归档' }] }; }
+    get capabilities() { return { turnOutcome: this.desktop.ready, commands: this.readOnly ? [] : agentCommands, modeControl: false, modelSettings: !this.readOnly, permissions: !this.readOnly, suggestions: !this.readOnly, steer: !this.readOnly, images: !this.readOnly, files: !this.readOnly, extensions: !this.readOnly, changes: !this.readOnly && platform.antigravity.diffAvailable, projectActions: [{ action: 'rename', label: '重命名' }], threadActions: [{ action: 'rename', label: '重命名' }, { action: 'pin', label: '置顶', activeLabel: '取消置顶' }, { action: 'archive', label: '归档' }] }; }
     permissionSelections = new Map();
     ready = false;
     logs = new Map();
@@ -63,10 +62,10 @@ export class AntigravityBackend {
     async bytes(path, limit) {
         const root = await realpath(this.dataRoot), resolved = await realpath(path);
         requireValue(within(root, resolved), 'UNSAFE_STORAGE', 'Antigravity 文件超出数据目录', 403);
-        const file = await open(resolved, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const file = await platform.files.openNativeRead(resolved);
         try {
             const before = await file.stat();
-            requireValue(before.isFile() && before.uid === process.getuid?.() && before.size <= limit, 'UNSAFE_STORAGE', 'Antigravity 文件不可读取或超过当前容量限制', 413);
+            requireValue(before.isFile() && before.size <= limit, 'UNSAFE_STORAGE', 'Antigravity 文件不可读取或超过当前容量限制', 413);
             const bytes = Buffer.alloc(before.size);
             let offset = 0;
             while (offset < bytes.length) {
@@ -91,9 +90,9 @@ export class AntigravityBackend {
         catch {
             return this.diskSessions();
         }
-        requireValue(response.trajectorySummaries && typeof response.trajectorySummaries === 'object', 'PROTOCOL_INCOMPATIBLE', '桌面会话目录格式已变化', 503);
+        const summaries = cascadeSummaries(response);
         const sessions = [];
-        for (const [id, row] of Object.entries(response.trajectorySummaries)) {
+        for (const [id, row] of Object.entries(summaries)) {
             if (!UUID.test(id) || row.trajectoryMetadata?.parentConversationId || row.annotations?.archived)
                 continue;
             const uris = row.trajectoryMetadata?.workspaceUris ?? row.workspaces?.map((w) => w.workspaceFolderAbsoluteUri);
@@ -108,7 +107,10 @@ export class AntigravityBackend {
             } }));
             if (roots.some(root => root === null))
                 continue;
-            sessions.push({ conversation_id: id, title: row.annotations?.title ?? row.summary ?? '未命名会话', workspace_uris: JSON.stringify(uris), status: row.status ?? 'unknown', not_fully_idle: 0, last_modified_time: row.lastModifiedTime ?? '', app_data_dir: 'antigravity', parent_conversation_id: '', roots: [...new Set(roots)].sort(), statusKnown: ['CASCADE_RUN_STATUS_IDLE', 'CASCADE_RUN_STATUS_RUNNING', 'CASCADE_RUN_STATUS_CANCELING', 'CASCADE_RUN_STATUS_BUSY'].includes(row.status), stepCount: row.stepCount, lastUserInputStepIndex: row.lastUserInputStepIndex, pinned: row.annotations?.pinned === true });
+            // Protobuf JSON omits the scalar zero; disk-only summaries keep an unknown count.
+            const stepCount = row.stepCount === undefined ? 0 : row.stepCount;
+            requireValue(Number.isSafeInteger(stepCount) && stepCount >= 0, 'PROTOCOL_INCOMPATIBLE', '原生会话步骤数量无效', 503);
+            sessions.push({ conversation_id: id, title: row.annotations?.title ?? row.summary ?? '未命名会话', workspace_uris: JSON.stringify(uris), status: row.status ?? 'unknown', not_fully_idle: 0, last_modified_time: row.lastModifiedTime ?? '', app_data_dir: 'antigravity', parent_conversation_id: '', roots: [...new Set(roots)].sort(), statusKnown: ['CASCADE_RUN_STATUS_IDLE', 'CASCADE_RUN_STATUS_RUNNING', 'CASCADE_RUN_STATUS_CANCELING', 'CASCADE_RUN_STATUS_BUSY'].includes(row.status), stepCount, lastUserInputStepIndex: row.lastUserInputStepIndex, pinned: row.annotations?.pinned === true });
         }
         this.ready = true;
         return sessions.sort((a, b) => Date.parse(b.last_modified_time) - Date.parse(a.last_modified_time));
@@ -124,7 +126,8 @@ export class AntigravityBackend {
                 const root = await realpath(this.dataRoot);
                 for (const suffix of ['', '-wal', '-shm']) {
                     const resolved = await realpath(path + suffix), file = await stat(resolved);
-                    requireValue(within(root, resolved) && file.isFile() && file.uid === process.getuid?.() && file.size <= 32 * 1024 * 1024, 'UNSAFE_STORAGE', 'Antigravity 摘要文件不可读取或超过容量限制', 413);
+                    const owned = platform.files.owned(resolved, file);
+                    requireValue(within(root, resolved) && file.isFile() && owned && file.size <= 32 * 1024 * 1024, 'UNSAFE_STORAGE', 'Antigravity 摘要文件不可读取或超过容量限制', 413);
                 }
                 db = new Database(await realpath(path), { readonly: true, fileMustExist: true });
             }
@@ -222,11 +225,12 @@ export class AntigravityBackend {
     async createProject(name, idempotencyKey, parentPath = '~/workspace') {
         name = name.trim();
         requireValue(name.length > 0 && name.length <= 80 && name !== '.' && name !== '..' && !/[\\/\x00-\x1f\x7f]/.test(name), 'INVALID_REQUEST', '项目名称无效', 400);
+        platform.checkProjectName(name);
         const key = digest({ kind: this.kind, idempotencyKey }), id = key.slice(0, 8) + '-' + key.slice(8, 12) + '-4' + key.slice(13, 16) + '-a' + key.slice(17, 20) + '-' + key.slice(20, 32);
         const existing = (await this.nativeProjects()).find(p => p.native.id === id);
         if (existing)
             return existing.scope;
-        const parent = resolve(parentPath === '~' ? homedir() : parentPath.startsWith('~/') ? join(homedir(), parentPath.slice(2)) : parentPath);
+        const parent = platform.projectParent(parentPath);
         await mkdir(parent, { recursive: true });
         const root = join(await realpath(parent), name);
         await mkdir(root, { recursive: true });
@@ -322,7 +326,15 @@ export class AntigravityBackend {
             return { id, name: catalog.trajectorySummaries[id].summary || '新会话', status: 'idle' };
         }
         requireValue(!creation.recoverOnly, 'CREATION_UNKNOWN', '原创建请求尚未确认，请稍后在原项目重试', 409);
-        const result = await this.desktop.call('StartCascade', { cascadeId: id, workspaceUris: project.scope.roots.map(r => pathToFileURL(r).href), projectEnvConfig: { projectId: project.native.id }, backend: 'BACKEND_TYPE_LOCAL' });
+        let result;
+        try {
+            result = await this.desktop.call('StartCascade', { cascadeId: id, source: 'CORTEX_TRAJECTORY_SOURCE_CASCADE_CLIENT', workspaceUris: [], projectEnvConfig: { projectId: project.native.id, defaultProjectEnvironment: {} }, backend: 'BACKEND_TYPE_LOCAL' });
+        }
+        catch (error) {
+            if (error.rpcError?.code === 'invalid_argument')
+                throw new Fault('CREATION_NOT_STARTED', 'Antigravity 未接受新建请求，请在原项目重试', 400);
+            throw error;
+        }
         if (result.cascadeId !== id)
             throw new Error('Antigravity 会话创建结果未知，请核对原项目');
         await this.session(id, projectId);
@@ -495,7 +507,26 @@ export class AntigravityBackend {
         const f = this.desktop.ready ? await this.follow(row).catch(() => undefined) : undefined;
         const records = f ? nativeRecords(f.steps, f.fallbackTurn) : [], latestTurnId = records.at(-1)?.turnId ?? (row.lastUserInputStepIndex !== undefined ? 'agy-turn-' + row.lastUserInputStepIndex : log.records.at(-1)?.turnId);
         const status = f?.update.status ?? row.status, nativeBusy = status !== 'CASCADE_RUN_STATUS_IDLE' || !!row.not_fully_idle;
-        return { runtime: await this.runtime(threadId), name: row.title, active: nativeBusy, statusKnown: row.statusKnown === true, turnId: row.statusKnown && nativeBusy ? latestTurnId ?? null : null, waiting: !!f && [...f.steps.values()].some(s => s.requestedInteraction && !['completed', 'failed', 'cancelled'].includes(stepStatus(s.status))), latestTurnId, permissions };
+        const waiting = !!f && [...f.steps.values()].some(step => step.requestedInteraction && !['completed', 'failed', 'cancelled'].includes(stepStatus(step.status)));
+        let outcome = 'unknown';
+        if (f && ['CASCADE_RUN_STATUS_RUNNING', 'CASCADE_RUN_STATUS_BUSY', 'CASCADE_RUN_STATUS_CANCELING'].includes(status))
+            outcome = 'running';
+        const tailIndex = (row.stepCount ?? 0) - 1;
+        const tail = f?.steps.get(tailIndex);
+        const reply = tail?.plannerResponse;
+        if (row.status === 'CASCADE_RUN_STATUS_IDLE' && f?.update.status === row.status && !nativeBusy && !waiting &&
+            row.lastUserInputStepIndex !== undefined && latestTurnId === 'agy-turn-' + row.lastUserInputStepIndex &&
+            records.at(-1)?.step.step_index === tailIndex && tail?.type === 'CORTEX_STEP_TYPE_PLANNER_RESPONSE' &&
+            tail.metadata?.source === 'CORTEX_STEP_SOURCE_MODEL' && reply) {
+            if (tail.status === 'CORTEX_STEP_STATUS_CANCELED' || reply.stopReason === 'STOP_REASON_CLIENT_CANCELED')
+                outcome = 'cancelled';
+            else if (tail.status === 'CORTEX_STEP_STATUS_ERROR' || reply.stopReason === 'STOP_REASON_ERROR')
+                outcome = 'failed';
+            else if (tail.status === 'CORTEX_STEP_STATUS_DONE' && reply.stopReason === 'STOP_REASON_STOP_PATTERN' &&
+                !reply.toolCalls?.length && typeof reply.response === 'string' && reply.response.trim())
+                outcome = 'completed';
+        }
+        return { turnOutcome: latestTurnId ? { turnId: latestTurnId, state: outcome } : undefined, runtime: await this.runtime(threadId), name: row.title, active: nativeBusy, statusKnown: row.statusKnown === true, turnId: row.statusKnown && nativeBusy ? latestTurnId ?? null : null, waiting, latestTurnId, permissions };
     }
     async runtime(threadId) {
         if (!this.desktop.ready)
@@ -691,7 +722,8 @@ export class AntigravityBackend {
                 const file = await lstat(this.preferencesPath).catch(missing);
                 if (!file)
                     return;
-                requireValue(file.isFile() && !file.isSymbolicLink() && file.uid === process.getuid?.() && file.size <= 512 * 1024, 'UNSAFE_STORAGE', '模型设置文件不可读取', 403);
+                const owned = platform.files.preferencesOwned(this.preferencesPath, file);
+                requireValue(file.isFile() && !file.isSymbolicLink() && owned && file.size <= 512 * 1024, 'UNSAFE_STORAGE', '模型设置文件不可读取', 403);
                 const value = JSON.parse(await readFile(this.preferencesPath, 'utf8'));
                 requireValue(value.version === 1 && value.models && typeof value.models === 'object', 'PROTOCOL_INCOMPATIBLE', '模型设置文件格式无效', 503);
                 for (const [id, row] of Object.entries(value.models))
@@ -765,6 +797,7 @@ export class AntigravityBackend {
                 requireValue(Buffer.byteLength(text) <= 512 * 1024, 'STORAGE_FULL', '会话模型设置已满', 413);
                 const temp = path + '.' + randomUUID();
                 await writeFile(temp, text, { mode: 0o600, flag: 'wx' });
+                platform.files.protectCreatedFile(temp);
                 await rename(temp, path);
             });
             await this.preferencesWrite;
@@ -772,23 +805,22 @@ export class AntigravityBackend {
         return { model, effort };
     }
     async getPermissions(projectId, threadId) {
-        await this.session(threadId, projectId);
+        const row = await this.session(threadId, projectId);
         const state = await this.desktop.state();
         const preset = state.userConfig?.userSettings?.permissionPreset ?? state.state?.userSettings?.permissionPreset;
         const mode = preset === 'AGENT_PERMISSION_PRESET_REQUEST_REVIEW' ? 'request-review' : preset === 'AGENT_PERMISSION_PRESET_TURBO' ? 'turbo' : 'desktop';
         const options = [
-            { value: 'desktop', label: '沿用桌面策略', description: '确认此手机沿用桌面当前的执行权限，不修改桌面设置', requiresConfirmation: true },
+            { value: 'desktop', label: '沿用桌面策略', description: '沿用桌面当前的执行权限，不修改桌面设置', requiresConfirmation: false },
             { value: 'request-review', label: '要求审查', description: '将 Antigravity 桌面全局策略切换为要求审查，影响后续任务', requiresConfirmation: true },
             { value: 'turbo', label: 'Turbo', description: '将 Antigravity 桌面全局策略切换为 Turbo，影响后续任务', requiresConfirmation: true }
         ];
-        const selection = this.permissionSelections.get(permissionKey(projectId, threadId));
-        return { mode, scope: 'desktop-global', mobileControl: !this.readOnly && (selection === 'desktop' || selection === mode), options };
+        return { mode, scope: 'desktop-global', mobileControl: row.statusKnown && !this.readOnly && typeof preset === 'string' && preset.length > 0, options };
     }
     async setPermissions(projectId, threadId, mode, confirmed = false) {
         const row = await this.session(threadId, projectId);
         requireValue(row.statusKnown && !this.readOnly, 'BACKEND_UNAVAILABLE', '请先打开 Antigravity 桌面应用', 503);
         requireValue(['desktop', 'request-review', 'turbo'].includes(mode), 'INVALID_REQUEST', '执行策略无效', 400);
-        requireValue(confirmed, 'CONFIRM_FULL_ACCESS', '请确认使用所选执行策略', 428);
+        requireValue(mode === 'desktop' || confirmed, 'CONFIRM_FULL_ACCESS', '请确认使用所选执行策略', 428);
         if (mode !== 'desktop') {
             const preset = mode === 'turbo' ? 'AGENT_PERMISSION_PRESET_TURBO' : 'AGENT_PERMISSION_PRESET_REQUEST_REVIEW';
             await this.desktop.call('JetboxWriteState', { userConfig: { userSettings: { permissionPreset: preset } } });
@@ -799,7 +831,9 @@ export class AntigravityBackend {
         return this.getPermissions(projectId, threadId);
     }
     async interactionSnapshot(projectId, threadId, fresh = false) {
-        await this.session(threadId, projectId);
+        const row = await this.session(threadId, projectId);
+        if (row.stepCount === 0)
+            return { at: Date.now(), generation: this.desktop.generation, trajectoryId: '', steps: [] };
         const cached = this.interactions.get(threadId);
         if (!fresh && cached?.generation === this.desktop.generation && Date.now() - cached.at < 1500)
             return cached;
@@ -920,25 +954,7 @@ export class AntigravityBackend {
             }
             const original = data.originalContents ?? '', modified = data.modifiedContents ?? '';
             requireValue(typeof original === 'string' && typeof modified === 'string', 'PROTOCOL_INCOMPATIBLE', '原生差异内容格式已变化', 503);
-            const diff = await new Promise((ok, no) => {
-                // Native diff reads pipes: no worktree reads, temporary files or reconstructed Git state.
-                const child = spawn('/usr/bin/diff', ['-u', '-L', path, '-L', path, original.length ? '/dev/fd/3' : '/dev/null', modified.length ? '/dev/fd/4' : '/dev/null'], { stdio: ['ignore', 'pipe', 'ignore', 'pipe', 'pipe'] });
-                let text = '';
-                const timer = setTimeout(() => { child.kill(); no(new Error('差异生成超时')); }, 10000);
-                timer.unref();
-                child.stdout.setEncoding('utf8');
-                child.stdout.on('data', (chunk) => { text += chunk; if (Buffer.byteLength(text) > 4 * 1024 * 1024) {
-                    child.kill();
-                    no(new Error('单个差异超过容量限制'));
-                } });
-                child.once('error', e => { clearTimeout(timer); no(e); });
-                child.once('close', code => { clearTimeout(timer); code === 0 || code === 1 ? ok(text) : no(new Error('无法生成原生差异')); });
-                for (const [fd, content] of [[3, original], [4, modified]]) {
-                    const pipe = child.stdio[fd];
-                    pipe.on('error', () => { });
-                    pipe.end(content);
-                }
-            }).catch(() => { partial = true; return ''; });
+            const diff = await platform.antigravity.diff(path, original, modified).catch(() => { partial = true; return ''; });
             if (diff)
                 items.push({ type: 'fileChange', status: 'completed', changes: [{ path, kind: { type: 'update' }, diff }] });
             else if (data.additions || data.deletions)