@petercjl/codex-own 0.6.3 → 0.6.5

package/lib/extraction.mjs

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {execFileSync} from 'node:child_process';
+import {archiveInventory,validateArchiveName,extractedHash} from './archive-inventory.mjs';
+
+const error=(code,message,extra={})=>Object.assign(new Error(message),{code,...extra});
+export function archiveNames(text){
+ const names=text.split('\n').map(n=>n.replace(/\r$/,'')).filter(Boolean);
+ if(!names.length||names.length>200000)throw error('UNSAFE_ARCHIVE','Empty or excessive archive inventory');
+ for(const n of names){const normalized=n.replaceAll('\\','/');if(/^[a-zA-Z]:|^\/|^\\|[\0\r\n]/.test(n)||normalized.split('/').includes('..'))throw error('UNSAFE_ARCHIVE','Unsafe archive entry');}
+ return [...new Set(names)];
+}
+function inspectTree(root){
+ function walk(dir){for(const x of fs.readdirSync(dir,{withFileTypes:true})){
+  const f=path.join(dir,x.name),s=fs.lstatSync(f);
+  if(s.isSymbolicLink()){const link=fs.readlinkSync(f),resolved=path.resolve(path.dirname(f),link);if(path.isAbsolute(link)||!resolved.startsWith(root+path.sep))throw error('UNSAFE_ARCHIVE','Escaping archive symlink');}
+  else if(s.isDirectory())walk(f);else if(!s.isFile())throw error('UNSAFE_ARCHIVE','Unsupported archive file type');
+ }}walk(root);
+}
+export function extractChecked(archive,dest,{tar,attempts=3,report=()=>{},inventory=archiveInventory,execute=execFileSync,delay=ms=>Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,ms)}={}){
+ if(!Number.isInteger(attempts)||attempts<1||attempts>3)throw error('INVALID_ARGUMENT','Extraction attempts must be 1..3');
+ const cwd=path.dirname(path.resolve(archive)),source=path.basename(archive),root=path.resolve(dest),target=path.relative(cwd,root);
+ const entries=inventory(archive);for(const e of entries)validateArchiveName(e.name);const names=entries.map(e=>e.name);
+ fs.mkdirSync(root);let missing=names,lastError;
+ const absent=()=>entries.filter(e=>{try{const file=path.join(root,e.name),s=fs.lstatSync(file);if(e.type==='Directory')return !s.isDirectory();if(e.type==='SymbolicLink')return !s.isSymbolicLink()||e.link!==undefined&&fs.readlinkSync(file)!==e.link;if(!s.isFile())return true;return e.size!==undefined&&e.type!=='Link'&&s.size!==e.size||!!e.sha256&&extractedHash(file)!==e.sha256;}catch(e){if(['ENOENT','ENOTDIR','EPERM','EBUSY','EACCES'].includes(e.code))return true;throw e;}}).map(e=>e.name);
+ for(let attempt=1;attempt<=attempts;attempt++){
+  // A previous partial extraction must not provide an escaping link for retry.
+  inspectTree(root);
+  try{
+   if(attempt===1||!missing.length||missing.length>32||missing.some(n=>/[^\x20-\x7e]/.test(n)))execute(tar,['-xf',source,'-C',target],{cwd,stdio:'pipe'});
+   else{
+    // One entry at a time also keeps Windows argv bounded for long inventories.
+    for(const n of missing)execute(tar,['-xf',source,'-C',target,'--',n],{cwd,stdio:'pipe'});
+   }
+   lastError=null;
+  }catch(e){lastError=e;}
+  inspectTree(root);report('正在核对解压文件大小与内容校验和');missing=absent();
+  if(!missing.length&&!lastError)return {entries:names.length,attempts:attempt};
+  if(attempt<attempts){report(`解压验证未完成：${missing.length} 项缺失或内容不符，重试 ${attempt}/${attempts-1}`);delay(attempt*500);}
+ }
+ throw error(missing.length?'UNPACK_INCOMPLETE':'UNPACK_FAILED',`解压验证失败，${missing.length} 项缺失或内容不符；可能被占用或被安全软件拦截。示例：${missing.slice(0,5).join(', ')||'tar 未正常退出'}`,{missing:missing.slice(0,30),missingCount:missing.length,stage:root,tarExit:lastError?.status??null});
+}

package/lib/file-operations.mjs

@@ -0,0 +1,22 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Reserve a new directory atomically, then copy its children. This avoids the
+// Windows Node 24.22 strict cp(existing empty directory) incompatibility while
+// still refusing an existing destination and every existing child.
+export function copyNewDirectory(source,target,{onCreate=()=>{},copy=fs.cpSync}={}){
+ fs.mkdirSync(target);
+ try{onCreate();for(const name of fs.readdirSync(source))copy(path.join(source,name),path.join(target,name),{recursive:true,force:false,errorOnExist:true,dereference:false,verbatimSymlinks:true});}
+ catch(e){try{removeNewTreeSync(target);}catch{e.partialTarget=target;}throw e;}
+}
+// Do not invoke native recursive rmSync: older Windows runtimes can terminate
+// the process on sharing violations instead of returning a JavaScript error.
+export function removeNewTreeSync(file){
+ const st=fs.lstatSync(file);
+ if(st.isDirectory()&&!st.isSymbolicLink()){for(const n of fs.readdirSync(file))removeNewTreeSync(path.join(file,n));fs.rmdirSync(file);}
+ else fs.unlinkSync(file);
+}
+export async function removeTemporary(file,{report=()=>{}}={}){
+ try{await fs.promises.rm(file,{recursive:true,force:true,maxRetries:3,retryDelay:200});return true;}
+ catch(e){report(`临时目录被占用，保留供 repair 检查：${file}`);return false;}
+}

package/lib/maintenance.mjs

@@ -0,0 +1,54 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import {paths,locked,rejectLinks,running,fail} from './manager.mjs';
+
+const uuid='[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}';
+function readJSON(f){try{return JSON.parse(fs.readFileSync(f,'utf8'));}catch{return null;}}
+export function lockStatus(p,{alive=pid=>{try{process.kill(pid,0);return true;}catch(e){return e.code==='ESRCH'?false:null;}}}={}){
+ const file=path.join(p.manager,'operation.lock');
+ if(!fs.existsSync(file))return {exists:false};
+ rejectLinks(file);const s=fs.statSync(file),v=readJSON(file),valid=Number.isSafeInteger(v?.pid)&&v.pid>0;
+ return {exists:true,pid:valid?v.pid:null,time:typeof v?.time==='string'?v.time:null,alive:valid?alive(v.pid):null,fingerprint:{ino:s.ino,size:s.size,mtimeMs:s.mtimeMs}};
+}
+export function incompleteTransactions(p){return fs.existsSync(p.manager)?fs.readdirSync(p.manager).filter(n=>/^transaction-.*\.json$/.test(n)&&!n.endsWith('.complete.json')&&!fs.existsSync(path.join(p.manager,n.replace('.json','.complete.json')))):[];}
+function size(file){const s=fs.lstatSync(file);if(s.isSymbolicLink())return s.size;if(s.isFile())return s.size;if(!s.isDirectory())return 0;return fs.readdirSync(file).reduce((n,x)=>n+size(path.join(file,x)),0);}
+export function temporaryStages(p){
+ const items=[];
+ for(const dir of [p.manager,path.join(p.root,'runtimes')]){
+  rejectLinks(dir);if(!fs.existsSync(dir))continue;
+  for(const n of fs.readdirSync(dir).filter(n=>/^stage-[A-Za-z0-9_-]+$/.test(n))){const f=path.join(dir,n);const st=fs.lstatSync(f);if(st.isDirectory()&&!st.isSymbolicLink())items.push({path:f,bytes:size(f),kind:'stage'});}
+ }
+ if(fs.existsSync(p.manager))for(const n of fs.readdirSync(p.manager).filter(n=>new RegExp('^temporary-'+uuid+'\\.json$').test(n))){
+  const receipt=path.join(p.manager,n);rejectLinks(receipt);const r=readJSON(receipt),id=n.slice(10,-5),expected=path.join(path.dirname(p.target),'.codex-own-next-'+id);
+  if(r?.package!=='@petercjl/codex-own'||r.kind!=='next'||r.path!==expected||r.target!==p.target||!fs.existsSync(expected))continue;
+  rejectLinks(expected);items.push({path:expected,bytes:size(expected),kind:'next',receipt});
+ }
+ return items;
+}
+export function repairPlan({p=paths(),isRunning=running}={}){
+ const lock=lockStatus(p),pending=incompleteTransactions(p),active=isRunning(p);
+ const reason=pending.length?'INCOMPLETE_TRANSACTION':active.length?'APP_RUNNING':lock.exists&&lock.alive!==false?'LOCK_OWNER_UNCERTAIN_OR_ALIVE':null;
+ return {ok:true,allowed:!reason,reason,lock,pendingTransactions:pending,orphanStages:temporaryStages(p),policy:'only inactive staging and receipted next copies; preserve applications, credentials, conversations, caches and rollback'};
+}
+export async function repairRun({p=paths(),isRunning=running}={}){
+ rejectLinks(p.root);fs.mkdirSync(p.manager,{recursive:true,mode:0o700});
+ const guard=path.join(p.manager,'recovery.lock');rejectLinks(guard);let fd;
+ try{fd=fs.openSync(guard,'wx',0o600);}catch{fail('BUSY','Another recovery is active; inspect recovery.lock before recovery');}
+ try{
+  fs.writeSync(fd,JSON.stringify({pid:process.pid,time:new Date().toISOString()}));const plan=repairPlan({p,isRunning});
+  if(!plan.allowed)fail(plan.reason,'Recovery is deferred; preserve the lock and transaction evidence');
+  let recoveredLock=null;
+  if(plan.lock.exists){const f=path.join(p.manager,'operation.lock'),now=lockStatus(p);if(JSON.stringify(now.fingerprint)!==JSON.stringify(plan.lock.fingerprint)||now.alive!==false)fail('BUSY','Lock changed during recovery');
+   recoveredLock=path.join(p.manager,'recovered-lock-'+crypto.randomUUID()+'.json');fs.renameSync(f,recoveredLock);
+  }
+  return await locked(p,async()=>{
+   const removed=[],warnings=[];let reclaimedBytes=0;
+   for(const item of temporaryStages(p)){
+    rejectLinks(item.path);try{await fs.promises.rm(item.path,{recursive:true,maxRetries:3,retryDelay:200});if(item.receipt)fs.unlinkSync(item.receipt);removed.push(item.path);reclaimedBytes+=item.bytes;}
+    catch(e){warnings.push({path:item.path,code:e.code||'CLEANUP_FAILED'});}
+   }
+   return {ok:true,recoveredLock,removed,reclaimedBytes,warnings};
+  },{recovery:true});
+ }finally{fs.closeSync(fd);fs.unlinkSync(guard);}
+}

package/lib/manager.mjs

@@ -11,6 +11,9 @@ import {ensureRuntime,validateRuntime,restoreRuntimeSelection} from './tool-runt
 import {validateBinding,packageManifest,sameDesktop,identity as bindingHash} from './binding.mjs';
 import {deepseekConfiguration} from './model-configuration.mjs';
 import windowsAgentShell from './windows-agent-shell.cjs';
+import {extractChecked} from './extraction.mjs';
+import {copyNewDirectory,removeTemporary,removeNewTreeSync} from './file-operations.mjs';
+import {lockStatus,temporaryStages} from './maintenance.mjs';
 
 export const packageRoot = path.resolve(import.meta.dirname, '..');
 export const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot,'package.json'),'utf8'));
@@ -52,14 +55,7 @@ export function tarExecutable(platform=process.platform,env=process.env,exists=f
   return executable;
 }
 export function unpack(archive,dest) {
-  // Older Windows tar builds convert absolute argv paths through the ANSI code
-  // page. CreateProcessW's cwd supports Unicode; sibling relative args avoid it.
-  const cwd=path.dirname(path.resolve(archive)),source=path.basename(archive),target=path.relative(cwd,path.resolve(dest));
-  const names=execFileSync(tarExecutable(),['-tf',source],{cwd,encoding:'utf8',maxBuffer:30*1024*1024}).split('\n').filter(Boolean);checkEntries(names);
-  fs.mkdirSync(dest);execFileSync(tarExecutable(),['-xf',source,'-C',target],{cwd,stdio:'pipe'});
-  // Bundled framework links may be relative but must stay within the extracted tree.
-  function walk(p){for(const x of fs.readdirSync(p,{withFileTypes:true})){const f=path.join(p,x.name);if(x.isSymbolicLink()){const resolved=path.resolve(path.dirname(f),fs.readlinkSync(f));if(!resolved.startsWith(dest+path.sep))fail('UNSAFE_ARCHIVE','Escaping symlink');}else if(x.isDirectory())walk(f);}}
-  walk(dest);
+  return extractChecked(archive,dest,{tar:tarExecutable(),report:progress});
 }
 export function macOwnProcessIds(lines) {
   return lines.filter(l=>l.includes('codex-own.app/Contents/')&&!l.includes(' ps -')&&!l.includes('/Contents/Resources/cua_node/')&&!/\/Contents\/MacOS\/WinAppHelper(?:\s|$)/.test(l)).map(l=>l.trim().split(/\s+/)[0]);
@@ -91,17 +87,22 @@ export function switchApp({p,source,version,manifest,runtimeSelection,adopt=fals
   const id=crypto.randomUUID(),backup=path.join(p.manager,'backups',id);fs.mkdirSync(backup,{recursive:true,mode:0o700});
   if(exists)backupData(p,path.join(backup,'data'));
   const old=path.join(path.dirname(p.target),'.codex-own-backup-'+id), next=path.join(path.dirname(p.target),'.codex-own-next-'+id);
-  fs.mkdirSync(path.dirname(p.target),{recursive:true});fs.cpSync(source,next,{recursive:true,force:false,errorOnExist:true,dereference:false,verbatimSymlinks:true});
-  const journal=path.join(p.manager,'transaction-'+id+'.json');exclusive(journal,{target:p.target,old,next,version,previous,backup});
+  const ownership=path.join(p.manager,'temporary-'+id+'.json');
+  const journal=path.join(p.manager,'transaction-'+id+'.json');let preparedNext=false;
+  try{
+   fs.mkdirSync(path.dirname(p.target),{recursive:true});copyNewDirectory(source,next,{onCreate:()=>{preparedNext=true;exclusive(ownership,{package:pkg.name,kind:'next',path:next,target:p.target});}});
+   exclusive(journal,{target:p.target,old,next,version,previous,backup});
+  }catch(e){if(preparedNext&&fs.existsSync(next))try{removeNewTreeSync(next);}catch{e.partialTarget=next;}throw e;}
   let moved=false,activated=false;
   try {if(exists){fs.renameSync(p.target,old);moved=true;}fs.renameSync(next,p.target);activated=true;
     const active=path.join(p.root,'runtimes','active.json');
     writeState(p,{schema:1,identity:'local.codex-own',version,...(manifest?{desktop:{version,identity:manifest.platforms[p.platform].sha256},releaseManifest:manifest}:{}),target:p.target,installedAt:new Date().toISOString(),previous:exists?{app:old,data:path.join(backup,'data'),state:previous,runtimeSelection:runtimeSelection===undefined?(fs.existsSync(active)?read(active):null):runtimeSelection}:null});
-  }catch(e){if(activated&&fs.existsSync(p.target))fs.renameSync(p.target,path.join(path.dirname(p.target),'.codex-own-failed-'+id));if(moved)fs.renameSync(old,p.target);throw e;}
+  }catch(e){if(activated&&fs.existsSync(p.target))fs.renameSync(p.target,path.join(path.dirname(p.target),'.codex-own-failed-'+id));if(moved)fs.renameSync(old,p.target);if(fs.existsSync(next))try{removeNewTreeSync(next);}catch{e.partialTarget=next;}throw e;}
   exclusive(path.join(p.manager,'transaction-'+id+'.complete.json'),{ok:true});
+  if(fs.existsSync(ownership))try{fs.unlinkSync(ownership);}catch{}
   return {ok:true,version,target:p.target,backup:exists?old:null,dataBackup:exists?path.join(backup,'data'):null};
 }
-export async function locked(p,fn){rejectLinks(p.root);fs.mkdirSync(p.manager,{recursive:true,mode:0o700});const lock=path.join(p.manager,'operation.lock');let fd;try{fd=fs.openSync(lock,'wx',0o600);}catch{fail('BUSY','Another operation or interrupted lock exists; inspect doctor before recovery');}try{fs.writeSync(fd,JSON.stringify({pid:process.pid,time:new Date().toISOString()}));return await fn();}finally{fs.closeSync(fd);fs.unlinkSync(lock);}}
+export async function locked(p,fn,{recovery=false}={}){rejectLinks(p.root);fs.mkdirSync(p.manager,{recursive:true,mode:0o700});const lock=path.join(p.manager,'operation.lock'),guard=path.join(p.manager,'recovery.lock');if(!recovery&&fs.existsSync(guard))fail('BUSY','Recovery is active');let fd;try{fd=fs.openSync(lock,'wx',0o600);}catch{fail('BUSY','Another operation or interrupted lock exists; inspect doctor and repair plan');}try{if(!recovery&&fs.existsSync(guard))fail('BUSY','Recovery is active');fs.writeSync(fd,JSON.stringify({pid:process.pid,time:new Date().toISOString()}));return await fn();}finally{fs.closeSync(fd);fs.unlinkSync(lock);}}
 export async function latest() {const r=await networkFetch('https://registry.npmjs.org/@petercjl%2fcodex-own/latest',{signal:AbortSignal.timeout(30000)});if(!r.ok)fail('REGISTRY_UNAVAILABLE',`Registry HTTP ${r.status}`);const p=await r.json();if(p.name!==pkg.name)fail('INVALID_MANIFEST','Registry package mismatch');return p.version;}
 export async function manifestFor(v){if(v===pkg.version){const local=read(path.join(packageRoot,'release.json'));if((local.binding?.managerVersion===v||local.version===v)&&Object.keys(local.platforms||{}).length){validateBinding(local,{managerVersion:v});return local;}}if(!/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(v))fail('INVALID_VERSION','Invalid version');const r=await networkFetch(`https://registry.npmjs.org/@petercjl%2fcodex-own/${v}`,{signal:AbortSignal.timeout(30000)});if(!r.ok)fail('MANIFEST_UNAVAILABLE',`npm HTTP ${r.status}`);return packageManifest(await r.json(),v);}
 export function installedBinding(p=paths()){const f=path.join(p.manager,'binding.json');return fs.existsSync(f)?read(f).manifest:null;}
@@ -119,7 +120,7 @@ export async function configure(keyFile,{p=paths(),isRunning=running}={}){if(!ke
  if(!fs.existsSync(models))fs.copyFileSync(path.join(packageRoot,'defaults','models.json'),models,fs.constants.COPYFILE_EXCL);
  if(previous!==updated){const next=config+'.new-'+crypto.randomUUID();fs.writeFileSync(next,updated,{flag:'wx',mode:0o600});fs.renameSync(next,config);if(fs.readFileSync(config,'utf8')!==updated)fail('VERIFY_FAILED','Model configuration did not match the requested provider');}
  return {ok:true,configured:true,backup,configBackup,configPreserved:previous===updated,settingsPreserved:true,modelProvider:'dashscope_deepseek'};});}
-export async function install({version,adopt=false,archive,manifest,expectedCurrent,p=paths(),runtimeInstaller=ensureRuntime,identify=appIdentity}={}) {
+export async function install({version,adopt=false,archive,manifest,expectedCurrent,p=paths(),runtimeInstaller=ensureRuntime,identify=appIdentity,isRunning=running}={}) {
   if(!['darwin-arm64','win32-x64'].includes(p.platform))fail('UNSUPPORTED_PLATFORM',p.platform);
   progress('准备安装：检查版本、平台与独立目录');
   return locked(p,async()=>{const m=manifest||await manifestFor(version||pkg.version);const a=validateManifest(m,p.platform);
@@ -132,8 +133,9 @@ export async function install({version,adopt=false,archive,manifest,expectedCurr
       if(m.binding){recordBinding(p,m);if(!prior.desktop||bindingHash(prior.releaseManifest)!==bindingHash(m))writeState(p,{...prior,desktop:{version:m.version,identity:a.sha256},releaseManifest:m});}
       return {ok:true,unchanged:true,version:m.version,managerVersion:m.binding?.managerVersion||pkg.version,runtimeVersion:m.runtimes?.version||null,runtimeChanged:!!tools&&!tools.unchanged,transfer:{downloadBytes:0,downloadBlocks:0},desktopActivated:false};
     }
-    if(running(p).length)fail('APP_RUNNING','Quit codex-own before install/update');
+    if(isRunning(p).length)fail('APP_RUNNING','Quit codex-own before install/update');
     const stage=fs.mkdtempSync(path.join(p.manager,'stage-'));let f=archive,transfer;
+    try{
     if(f){if(fs.statSync(f).size!==a.size||await digestFile(f)!==a.sha256)fail('CHECKSUM_MISMATCH','Local archive checksum mismatch');}
     else{if(m.schema!==2)fail('NPM_ASSETS_REQUIRED','Update @petercjl/codex-own to the latest npm-only release.');f=path.join(stage,'app.tar');const cache=path.join(p.manager,'npm-assets');rejectLinks(cache);
       if(state(p)?.identity==='local.codex-own'&&fs.existsSync(p.target)&&appIdentity(p.target)==='local.codex-own'){
@@ -143,12 +145,13 @@ export async function install({version,adopt=false,archive,manifest,expectedCurr
     progress('校验通过，正在解压桌面程序');
     const content=path.join(stage,'unpacked');unpack(f,content);const source=path.join(content,a.entry);
     if(process.platform==='darwin')execFileSync('codesign',['--verify','--deep','--strict',source],{stdio:'pipe'});
-    if(m.runtimes)await ensureRuntime(m.runtimes,{p,report:progress});
+    if(m.runtimes)await runtimeInstaller(m.runtimes,{p,report:progress});
     progress('正在安装到独立目录');
-    const result=switchApp({p,source,version:m.version,manifest:m,runtimeSelection:previousRuntime,adopt});if(m.binding)recordBinding(p,m);
+    const result=switchApp({p,source,version:m.version,manifest:m,runtimeSelection:previousRuntime,adopt,isRunning});if(m.binding)recordBinding(p,m);
     if(process.platform==='darwin')execFileSync('/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister',['-f',p.target],{stdio:'pipe'});
     else shortcut(p);
-    fs.rmSync(stage,{recursive:true,force:true});progress('安装完成');return {...result,downloadSource:archive?'local-archive':'registry.npmjs.org',...(transfer?{transfer}:{})};
+    progress('安装完成');return {...result,downloadSource:archive?'local-archive':'registry.npmjs.org',...(transfer?{transfer}:{})};
+    }finally{await removeTemporary(stage,{report:progress});}
   });
 }
 export function shortcut(p) {
@@ -165,4 +168,4 @@ export async function rollback({restoreData=false}={}){const p=paths();return lo
   if(prev.state?.releaseManifest){const m=prev.state.releaseManifest;if(!prev.runtimeSelection&&m.runtimes)await ensureRuntime(m.runtimes,{p,report:progress});if(m.binding)recordBinding(p,m);}
   else{const f=path.join(p.manager,'binding.json');if(fs.existsSync(f))fs.renameSync(f,f+'.before-legacy-rollback-'+crypto.randomUUID());}
   writeState(p,{...(prev.state||{schema:1,identity:'local.codex-own',version:'adopted-legacy',target:p.target}),previous:null});return {ok:true,preserved,dataBackup:backup};});}
-export function doctor(){const p=paths(),s=state(p);let tar=true;try{execFileSync(tarExecutable(),['--version'],{stdio:'pipe'});}catch{tar=false;}const pending=fs.existsSync(p.manager)?fs.readdirSync(p.manager).filter(n=>/^transaction-.*\.json$/.test(n)&&!n.endsWith('.complete.json')&&!fs.existsSync(path.join(p.manager,n.replace('.json','.complete.json')))):[];return {ok:tar&&!pending.length,managerVersion:pkg.version,platform:p.platform,supported:['darwin-arm64','win32-x64'].includes(p.platform),installed:s?.version||null,paths:p,tar,pendingTransactions:pending,lock:fs.existsSync(path.join(p.manager,'operation.lock')),configured:fs.existsSync(path.join(p.core,'auth.json')),agentShell:{...windowsAgentShell.discover(),desktopAdapterBundled:process.platform==='win32'&&fs.existsSync(path.join(p.target,'resources','own-updater','lib','windows-agent-shell.cjs')),policyContract:1},windowsGuiTested:false};}
+export function doctor(){const p=paths(),s=state(p);let tar=true;try{execFileSync(tarExecutable(),['--version'],{stdio:'pipe'});}catch{tar=false;}const pending=fs.existsSync(p.manager)?fs.readdirSync(p.manager).filter(n=>/^transaction-.*\.json$/.test(n)&&!n.endsWith('.complete.json')&&!fs.existsSync(path.join(p.manager,n.replace('.json','.complete.json')))):[];return {ok:tar&&!pending.length&&!fs.existsSync(path.join(p.manager,'operation.lock'))&&!fs.existsSync(path.join(p.manager,'recovery.lock')),bootstrap:{nodeVersion:process.version,executable:process.execPath,architecture:process.arch,supported:Number(process.versions.node.split('.')[0])>=22},lockDetails:lockStatus(p),orphanStages:temporaryStages(p),recoveryLock:fs.existsSync(path.join(p.manager,'recovery.lock')),managerVersion:pkg.version,platform:p.platform,supported:['darwin-arm64','win32-x64'].includes(p.platform),installed:s?.version||null,paths:p,tar,pendingTransactions:pending,lock:fs.existsSync(path.join(p.manager,'operation.lock')),configured:fs.existsSync(path.join(p.core,'auth.json')),agentShell:{...windowsAgentShell.discover(),desktopAdapterBundled:process.platform==='win32'&&fs.existsSync(path.join(p.target,'resources','own-updater','lib','windows-agent-shell.cjs')),policyContract:1},windowsGuiTested:false};}

package/lib/network.mjs

@@ -3,7 +3,9 @@ import crypto from 'node:crypto';
 import {EnvHttpProxyAgent, fetch} from 'undici';
 
 const dispatcher = new EnvHttpProxyAgent();
-export const progress = message => process.stderr.write(`[codex-own] ${message}\n`);
+let progressMode='stderr';
+export function setProgressMode(mode){if(!['stderr','stdout','quiet'].includes(mode))throw Object.assign(new Error('Progress must be stderr, stdout or quiet'),{code:'INVALID_ARGUMENT'});progressMode=mode;}
+export const progress = message => {if(progressMode!=='quiet')(progressMode==='stdout'?process.stdout:process.stderr).write(`[codex-own] ${message}\n`);};
 export function networkFetch(url, options = {}) {
   return fetch(url, {dispatcher, redirect: 'error', ...options});
 }

package/lib/npm-assets.mjs

@@ -50,6 +50,7 @@ export async function assembleNpmAsset(asset, dest, cache, tar, {download = veri
     const file = path.join(cache, `${part.sha256}.bin`);
     safeCache(file);
     if (cached.has(part.sha256)) {
+      const used=new Date();fs.utimesSync(file,used,used);
       report(`[${i+1}/${asset.parts.length}] 复用已校验分片`); return file;
     }
     if (fs.existsSync(file)) fs.unlinkSync(file);

package/lib/tool-runtime.mjs

@@ -5,6 +5,7 @@ import {execFileSync,spawnSync} from 'node:child_process';
 import {createRequire} from 'node:module';
 import {assembleNpmAsset,validateParts} from './npm-assets.mjs';
 import {paths,state,locked,rejectLinks,exclusive,unpack,fail,tarExecutable,digestFile} from './manager.mjs';
+import {copyNewDirectory,removeTemporary} from './file-operations.mjs';
 const require=createRequire(import.meta.url);
 export const toolEnv=require('./tool-env.cjs');
 export function validateRuntime(m,platform){
@@ -17,6 +18,8 @@ function writeActive(base,r){
  const f=path.join(base,'active.json');rejectLinks(f);
  if(fs.existsSync(f))fs.copyFileSync(f,f+'.backup-'+crypto.randomUUID(),fs.constants.COPYFILE_EXCL);
  const tmp=f+'.new-'+crypto.randomUUID();exclusive(tmp,r);fs.renameSync(tmp,f);
+ // Bound verified selection receipts, preserving every immutable tool version.
+ try{const history=fs.readdirSync(base).filter(n=>/^active\.json\.backup-[a-f0-9-]{36}$/.test(n)).map(n=>path.join(base,n)).filter(p=>{const s=fs.lstatSync(p);if(!s.isFile()||s.isSymbolicLink())return false;try{const v=JSON.parse(fs.readFileSync(p));return v.schema===1&&/^node[0-9.]+-python[0-9.]+-r\d+$/.test(v.version);}catch{return false;}}).sort((a,b)=>fs.statSync(b).mtimeMs-fs.statSync(a).mtimeMs);for(const p of history.slice(20))fs.unlinkSync(p);}catch{}
 }
 export function runtimeDoctor(base=toolEnv.runtimeRoot(),{version}={}){
  try{const r=toolEnv.active(base,process.platform,version);if(!r)return {ok:false,code:'RUNTIME_NOT_INSTALLED',root:base};
@@ -63,7 +66,7 @@ export async function ensureRuntime(m,{p=paths(),assemble=assembleNpmAsset,repor
   // Windows scanners may hold executables after execution. Never rename an
   // executed tool directory: copy to a fresh immutable final path, probe there,
   // and only then atomically switch the small active receipt.
-  fs.mkdirSync(target);created=true;fs.cpSync(candidate,target,{recursive:true,force:false,errorOnExist:true,verbatimSymlinks:true});
+  copyNewDirectory(candidate,target,{onCreate:()=>{created=true;}});
   if(process.platform==='darwin'){const shell=path.join(target,'shell');fs.mkdirSync(shell);for(const [name,body]of Object.entries(toolEnv.shellFiles(base,m.version)))fs.writeFileSync(path.join(shell,name),body,{flag:'wx',mode:0o600});}
   const tested=runtimeDoctor(base,{version:m.version});if(!tested.ok)fail('RUNTIME_PROBE_FAILED',tested.message||'Tool verification failed');
   const expected=m.version.match(/^node([0-9.]+)-python([0-9.]+)-/);
@@ -72,8 +75,8 @@ export async function ensureRuntime(m,{p=paths(),assemble=assembleNpmAsset,repor
   exclusive(path.join(target,'codex-own-runtime.json'),{schema:1,version:m.version,platform:p.platform,assets:{node:assets.node.sha256,python:assets.python.sha256},verified:tested});
   writeActive(base,{schema:1,version:m.version,platform:p.platform,previous:previous?.version||null,installedAt:new Date().toISOString()});
   committed=true;
-  return runtimeDoctor(base);
- }finally{for(const f of [stage,...(created&&!committed?[target]:[])])try{fs.rmSync(f,{recursive:true,force:true,maxRetries:10,retryDelay:200});}catch{report(`临时目录被系统占用，已保留：${f}`);}}
+  return tested;
+ }finally{for(const f of [stage,...(created&&!committed?[target]:[])])await removeTemporary(f,{report});}
 }
 export async function installRuntime(m,options={}){const p=options.p||paths();return locked(p,async()=>{const result=await ensureRuntime(m,{...options,p});if(options.selection){const base=path.join(p.root,'runtimes'),active=JSON.parse(fs.readFileSync(path.join(base,'active.json')));writeActive(base,{...active,selection:options.selection,selectedForDesktop:state(p)?.version||null});}return result;});}
 export function restoreRuntimeSelection(selected,{p=paths()}={}){