@walkhi/code-relax 0.1.0-beta.1 → 0.1.0-beta.10

package/dist/src/managed-app-server.mjs

@@ -5,9 +5,11 @@ import { EventEmitter } from 'node:events';
 import { setTimeout as delay } from 'node:timers/promises';
 import { readRecord, writeRecord } from './service-lifecycle.mjs';
 import { SharedAppServer } from './shared-app-server.mjs';
+import { resolveCodexRuntime } from './platform/windows/codex-runtime.mjs';
 
 export const managedAppServerUrl = 'ws://127.0.0.1:45839';
 export const managedAppServerReadyUrl = 'http://127.0.0.1:45839/readyz';
+export const managedAppServerLauncherRevision = 2;
 const retryDelays = [1_000, 2_000, 5_000, 10_000, 20_000];
 
 export function managedPortAvailable() {
@@ -65,36 +67,46 @@ export class ManagedAppServer extends EventEmitter {
     if (!this.state.ready) this.publish({ state: 'starting', ready: false, error: null });
     try {
       fs.mkdirSync(this.stateRoot, { recursive: true });
-      const info = await this.host.inspect();
-      if (!info.cli) throw new Error('未找到 Desktop 管理的 codex.exe，请先安装并登录 Codex Desktop。');
       let record = null, actual = null;
       for (const candidate of [readRecord(this.recordPath), readRecord(this.legacyRecordPath)].filter(Boolean)) {
         const process = candidate.pid ? await this.host.process(candidate.pid) : null;
         if (sameManagedProcess(candidate, process)) { record = candidate; actual = process; break; }
       }
+      const runtime = actual
+        ? readRecord(path.join(this.stateRoot, 'codex-runtime.json')) || { executable: actual.executable }
+        : await resolveCodexRuntime(this.stateRoot, { environment: this.environment });
       if (!actual) {
         if (!await this.available()) throw new Error('45839 被未识别进程占用，未启动或结束任何进程。');
         const childEnvironment = { ...this.environment };
+        childEnvironment.CODEX_HOME = runtime.codexHome;
         for (const key of ['CODEX_APP_SERVER_WS_URL', 'CODEX_APP_SERVER_FORCE_CLI', 'CODEX_APP_TOOLS_PIPE_PATH']) delete childEnvironment[key];
-        const pid = await this.host.start(info.cli, ['app-server', '--listen', managedAppServerUrl], childEnvironment,
+        for (const key of Object.keys(childEnvironment)) {
+          if (/^npm_/iu.test(key) || key.toUpperCase() === 'INIT_CWD') delete childEnvironment[key];
+        }
+        const pid = await this.host.start(runtime.executable, ['app-server', '--listen', managedAppServerUrl], childEnvironment,
           [path.join(this.stateRoot, 'managed-app-server.stdout.log'), path.join(this.stateRoot, 'managed-app-server.stderr.log')]);
         const started = await this.host.process(pid);
         if (!sameManagedProcess(started, started)) throw new Error('Codex 内核启动后进程身份无法确认。');
-        record = actual = started;
+        actual = started;
+        record = { ...started, launcherRevision: managedAppServerLauncherRevision };
         writeRecord(this.recordPath, record);
       } else if (!readRecord(this.recordPath)) {
-        writeRecord(this.recordPath, actual);
+        record = { ...actual, launcherRevision: Number.isSafeInteger(record?.launcherRevision) ? record.launcherRevision : 0 };
+        writeRecord(this.recordPath, record);
       }
       await this.waitUntilReady(actual);
       await this.client.connect();
       if (!this.client.ready) throw new Error('Codex 内核协议初始化未完成。');
-      const preferredExecutable = path.resolve(info.cli);
+      const preferredExecutable = path.resolve(runtime.executable);
       const updatePending = path.resolve(actual.executable).toLowerCase() !== preferredExecutable.toLowerCase();
+      const launcherRevision = Number.isSafeInteger(record?.launcherRevision) ? record.launcherRevision : 0;
       this.retryAttempt = 0;
       this.retryAfter = 0;
       this.publish({ state: 'ready', ready: true, error: null, pid: actual.pid,
         created: actual.created, executable: actual.executable, preferredExecutable,
-        updatePending, url: managedAppServerUrl });
+        updatePending, launcherRevision, selectedVersion: runtime.version, source: runtime.source,
+        launcherRestartRequired: launcherRevision !== managedAppServerLauncherRevision,
+        url: managedAppServerUrl });
       return true;
     } catch (error) {
       this.failed(error instanceof Error ? error.message : String(error));
@@ -138,7 +150,11 @@ export class ManagedAppServer extends EventEmitter {
       if (actual && !sameManagedProcess(record, actual)) {
         throw new Error('Codex 内核进程身份已经变化，未结束任何进程。');
       }
+      if (!actual && !await this.available()) throw new Error('45839 被未识别进程占用，未结束任何进程。');
       this.restartStage('stopping');
+      // Resolve the replacement before stopping the current working process.
+      const runtime = await resolveCodexRuntime(this.stateRoot, { refresh: true, environment: this.environment });
+      const desktop = await this.host.prepareKernelRestart?.();
       this.client.close();
       if (actual) {
         await this.host.stop(actual.pid);
@@ -152,6 +168,10 @@ export class ManagedAppServer extends EventEmitter {
       this.restartStage('starting');
       const ready = await this.ensureNow();
       if (!ready) throw new Error(this.state.error || 'Codex 内核未能重新启动。');
+      const desktopEnvironment = { ...this.environment, CODEX_HOME: runtime.codexHome, CODEX_APP_SERVER_WS_URL: managedAppServerUrl };
+      delete desktopEnvironment.CODEX_APP_SERVER_FORCE_CLI;
+      delete desktopEnvironment.CODEX_APP_TOOLS_PIPE_PATH;
+      await this.host.resumeAfterKernelRestart?.(desktop, desktopEnvironment);
       this.restartStatus = { ...this.restartStatus, status: 'completed', stage: 'ready',
         completedAt: new Date(this.now()).toISOString() };
       this.emit('state', this.snapshot());

package/dist/src/message-images.mjs

@@ -1,8 +1,3 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import sharp from 'sharp';
-
 export function validateInlineImage(value) {
   const data = typeof value === 'string' ? value.slice(value.indexOf(',') + 1) : '';
   if (typeof value !== 'string' || value.length > Math.ceil(8 * 1024 * 1024 / 3) * 4 + 64 ||
@@ -12,16 +7,3 @@ export function validateInlineImage(value) {
   }
   return value;
 }
-
-// Only the Desktop tool compatibility path needs a file visible to the host.
-export async function persistLegacyImage(value, directory) {
-  validateInlineImage(value);
-  const input = Buffer.from(value.slice(value.indexOf(',') + 1), 'base64');
-  const buffer = await sharp(input, { limitInputPixels: 40_000_000 }).rotate()
-    .resize({ width: 2560, height: 2560, fit: 'inside', withoutEnlargement: true }).webp({ quality: 88 }).toBuffer();
-  const id = crypto.createHash('sha256').update(buffer).digest('hex');
-  await fs.mkdir(directory, { recursive: true });
-  const file = path.join(directory, `${id}.webp`);
-  await fs.writeFile(file, buffer);
-  return file;
-}

package/dist/src/onboarding.mjs

@@ -1,12 +1,12 @@
 export const connectionModesText = [
   '可选连接模式：',
   '• 局域网：启动时会把当前 Wi-Fi/有线网络候选临时发给已配对设备；App 验证后保存，也可手动输入 IP。',
-  '• 私有中继：同一设备授权可跨网络长期重连；基础控制/完整控制能力由电脑当前 Bridge 状态决定。',
+  '• 私有中继：同一设备授权可跨网络长期重连；Codex 内核就绪后才能进入聊天。',
   '• OpenAI 官方中继：在已配对电脑内使用官方账号和设备授权；认证仍直连 OpenAI。',
 ].join('\n');
 
 export function phonePairingSteps(transportMode, paired = false) {
-  const mode = transportMode === 'lan-shared' ? '局域网 · 完整控制' : transportMode === 'lan-legacy' ? '局域网 · 基础控制' : '局域网（按电脑实际控制方式选择）';
+  const mode = transportMode === 'lan-shared' ? '局域网 · Codex 内核已就绪' : '局域网（Codex 内核未就绪）';
   return paired ? [
     `已有移动设备授权。手机可继续使用私有中继；${mode} 会显示验证成功的当前网络和历史记录。`,
     '添加另一台设备时执行 relax pair；每台设备只需扫码配对一次。',
@@ -19,10 +19,8 @@ export function phonePairingSteps(transportMode, paired = false) {
 export const desktopSetupSteps = [
   'Code Relax Skill 已随 npm 包自动安装。',
   '安装完成后 Bridge 和受管 app-server 已启动，并默认在当前用户登录时启动。',
-  '如果安装时 Codex 仍在运行，手机完整控制仍可使用；可选择立即或稍后重启，让 Desktop 也接入同一受管服务。',
-  '基础控制首次聊天需要在 Codex 对话启动一次 Code Relax 绑定上下文；完整控制不需要。',
+  'CLI 用户无需安装 Desktop；已安装 Desktop 时，安装器负责将运行中的 Desktop 接入同一内核。',
   '尚无设备授权时执行 relax pair，打开并扫描配对二维码。',
-  '若工作站提示 Desktop 尚未接入受管服务，可在手机确认重新打开 Desktop，无需电脑脚本或快捷方式。',
   '统一配对先建立电脑记录；进入该电脑后可另行完成 OpenAI 官方 Remote 配对。',
 ];
 

package/dist/src/platform/README.md

@@ -3,7 +3,7 @@
 当前只实现 Windows Codex：
 
 - `windows/runtime-paths.mjs`：固定服务、用户状态、Codex 数据、附件和长期凭据路径。
-- `windows/service-host.mjs`、`desktop-tools.mjs`：网卡、Desktop 工具管道、共享连接检测和旧状态迁移。
+- `windows/service-host.mjs`：网卡、Bridge 进程环境和旧状态迁移。
 - `windows/desktop-host.mjs`、PowerShell 脚本：普通/共享 Desktop、快捷方式和隐藏控制台启动。
 - `windows/credential-store.mjs/.ps1`：私有中继电脑凭据的 DPAPI 与 ACL。
 

package/dist/src/platform/windows/IsolatedProcess.cs

@@ -48,8 +48,8 @@ public static class IsolatedProcess {
         if(handle==new IntPtr(-1)) throw new Win32Exception(Marshal.GetLastWin32Error());
         return handle;
     }
-    public static int Start(string executable,string[] arguments,string stdout,string stderr) {
-        IntPtr input=IntPtr.Zero,output=IntPtr.Zero,error=IntPtr.Zero,list=IntPtr.Zero,handles=IntPtr.Zero;
+    public static int Start(string executable,string[] arguments,string stdout,string stderr,string[] environment) {
+        IntPtr input=IntPtr.Zero,output=IntPtr.Zero,error=IntPtr.Zero,list=IntPtr.Zero,handles=IntPtr.Zero,environmentBlock=IntPtr.Zero;
         bool initialized=false;
         try {
             input=File("NUL",true); output=File(String.IsNullOrEmpty(stdout)?"NUL":stdout,false); error=File(String.IsNullOrEmpty(stderr)?"NUL":stderr,false);
@@ -63,12 +63,16 @@ public static class IsolatedProcess {
             startup.startup.flags=0x101; startup.startup.show=0;
             startup.startup.input=input; startup.startup.output=output; startup.startup.error=error; startup.attributes=list;
             var command=new StringBuilder(Quote(executable)); foreach(var argument in arguments) command.Append(' ').Append(Quote(argument));
+            Array.Sort(environment,StringComparer.OrdinalIgnoreCase);
+            var environmentBytes=Encoding.Unicode.GetBytes(String.Join("\0",environment)+"\0\0");
+            environmentBlock=Marshal.AllocHGlobal(environmentBytes.Length); Marshal.Copy(environmentBytes,0,environmentBlock,environmentBytes.Length);
             ProcessInfo info;
-            if(!CreateProcessW(executable,command,IntPtr.Zero,IntPtr.Zero,true,0x80010,IntPtr.Zero,null,ref startup,out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
+            if(!CreateProcessW(executable,command,IntPtr.Zero,IntPtr.Zero,true,0x80410,environmentBlock,null,ref startup,out info)) throw new Win32Exception(Marshal.GetLastWin32Error());
             CloseHandle(info.thread); CloseHandle(info.process); return info.pid;
         } finally {
             if(initialized) DeleteProcThreadAttributeList(list);
             if(list!=IntPtr.Zero) Marshal.FreeHGlobal(list); if(handles!=IntPtr.Zero) Marshal.FreeHGlobal(handles);
+            if(environmentBlock!=IntPtr.Zero) Marshal.FreeHGlobal(environmentBlock);
             if(input!=IntPtr.Zero) CloseHandle(input); if(output!=IntPtr.Zero) CloseHandle(output); if(error!=IntPtr.Zero) CloseHandle(error);
         }
     }

package/dist/src/platform/windows/background-process.mjs

@@ -5,9 +5,14 @@ import path from 'node:path';
 export function startWindowsProcess(executable, args, environment, logs = []) {
   return new Promise((resolve, reject) => {
     const powershell = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe');
+    const helperEnvironment = {};
+    for (const name of ['SystemRoot', 'windir', 'LOCALAPPDATA', 'USERPROFILE', 'TEMP', 'TMP', 'PSModulePath']) {
+      const key = Object.keys(process.env).find(item => item.toLowerCase() === name.toLowerCase());
+      if (key) helperEnvironment[key] = process.env[key];
+    }
     const helper = spawn(powershell, ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File',
       fileURLToPath(new URL('./start-hidden-console.ps1', import.meta.url))], {
-      windowsHide: true, env: environment, stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true, env: helperEnvironment, stdio: ['pipe', 'pipe', 'pipe'],
     });
     let output = '', error = '';
     helper.stdout.setEncoding('utf8').on('data', chunk => { output += chunk; });
@@ -20,6 +25,6 @@ export function startWindowsProcess(executable, args, environment, logs = []) {
       if (!Number.isSafeInteger(pid) || pid <= 0) return reject(new Error('后台启动未返回有效 PID'));
       resolve(pid);
     });
-    helper.stdin.end(JSON.stringify({ executable, args, logs }));
+    helper.stdin.end(JSON.stringify({ brokerExecutable: process.execPath, executable, args, logs, environment }));
   });
 }

package/dist/src/platform/windows/codex-runtime.mjs

@@ -0,0 +1,117 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
+
+const exec = promisify(execFile);
+const requiredMethods = ['thread/start', 'thread/resume', 'thread/list', 'thread/turns/list',
+  'thread/items/list', 'turn/start', 'turn/steer', 'turn/interrupt', 'model/list', 'project/list',
+  'thread/settings/update', 'configRequirements/read', 'thread/queue/list', 'thread/queue/add',
+  'thread/queue/delete', 'thread/queue/start', 'thread/read', 'thread/unsubscribe', 'config/read', 'account/rateLimits/read'];
+const fingerprint = file => { const s = fs.statSync(file); return `${s.size}:${s.mtimeMs}`; };
+
+// Resolve native binaries, never execute a shell shim from a background task.
+export function discoverCodex(environment = process.env) {
+  const found = new Map();
+  const add = (file, source) => {
+    if (!fs.existsSync(file) || !fs.statSync(file).isFile()) return;
+    const executable = fs.realpathSync(file);
+    if (!found.has(executable.toLowerCase()) || source === 'desktop') found.set(executable.toLowerCase(), { executable, source });
+  };
+  if (environment.CODE_RELAX_CODEX_PATH) {
+    const file = environment.CODE_RELAX_CODEX_PATH;
+    if (!path.isAbsolute(file) || path.basename(file).toLowerCase() !== 'codex.exe') throw new Error('CODE_RELAX_CODEX_PATH 必须是 codex.exe 的绝对路径。');
+    add(file, 'explicit');
+    if (!found.size) throw new Error('CODE_RELAX_CODEX_PATH 指定的程序不存在。');
+    return [...found.values()];
+  }
+  const local = environment.LOCALAPPDATA || path.join(os.homedir(), 'AppData/Local');
+  const home = environment.CODEX_HOME || path.join(os.homedir(), '.codex');
+  const directories = [...String(environment.PATH || environment.Path || '').split(';').filter(Boolean),
+    environment.CODEX_INSTALL_DIR, path.join(local, 'Programs/OpenAI/Codex/bin'),
+    path.join(home, 'packages/standalone/current/bin')].filter(Boolean);
+  for (const directory of directories) {
+    add(path.join(directory, 'codex.exe'), 'cli');
+    const packageFile = path.join(directory, 'node_modules/@openai/codex/package.json');
+    if (!fs.existsSync(packageFile)) continue;
+    const root = path.dirname(fs.realpathSync(packageFile));
+    let vendor = path.join(root, 'vendor');
+    try { vendor = path.join(path.dirname(createRequire(packageFile).resolve('@openai/codex-win32-x64/package.json')), 'vendor'); }
+    catch (error) { if (error.code !== 'MODULE_NOT_FOUND') throw error; }
+    add(path.join(vendor, 'x86_64-pc-windows-msvc/bin/codex.exe'), 'npm');
+  }
+  const desktopRoot = path.join(local, 'OpenAI/Codex/bin');
+  add(path.join(desktopRoot, 'codex.exe'), 'desktop');
+  if (fs.existsSync(desktopRoot)) for (const entry of fs.readdirSync(desktopRoot, { withFileTypes: true })) {
+    if (entry.isDirectory()) add(path.join(desktopRoot, entry.name, 'codex.exe'), 'desktop');
+  }
+  return [...found.values()];
+}
+
+function compareVersions(a, b) {
+  const parse = v => v.split(/[.-]/).map(part => /^\d+$/.test(part) ? Number(part) : part);
+  const aa = parse(a), bb = parse(b);
+  for (let i = 0; i < Math.max(aa.length, bb.length); i++) {
+    if (aa[i] === bb[i]) continue;
+    if (aa[i] === undefined) return 1;
+    if (bb[i] === undefined) return -1;
+    return typeof aa[i] === 'number' && typeof bb[i] === 'number' ? aa[i] - bb[i] : String(aa[i]).localeCompare(String(bb[i]));
+  }
+  return 0;
+}
+
+async function verifyProtocol(executable, stateRoot) {
+  const directory = fs.mkdtempSync(path.join(stateRoot, 'cli-schema-'));
+  try {
+    await exec(executable, ['app-server', 'generate-json-schema', '--experimental', '--out', directory],
+      { windowsHide: true, timeout: 30000, maxBuffer: 4 * 1024 * 1024 });
+    const request = fs.readFileSync(path.join(directory, 'ClientRequest.json'), 'utf8');
+    const missing = requiredMethods.filter(method => !request.includes(`"${method}"`));
+    const turns = fs.readFileSync(path.join(directory, 'v2/ThreadTurnsListParams.json'), 'utf8');
+    if (!turns.includes('"itemsView"') || !turns.includes('"summary"')) missing.push('turn summary pagination');
+    if (missing.length) throw new Error(`缺少协议能力：${missing.join(', ')}`);
+  } finally {
+    const remove = dir => {
+      for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+        const file = path.join(dir, item.name);
+        if (item.isDirectory()) remove(file); else fs.unlinkSync(file);
+      }
+      fs.rmdirSync(dir);
+    };
+    remove(directory);
+  }
+}
+
+export async function resolveCodexRuntime(stateRoot, { refresh = false, environment = process.env } = {}) {
+  fs.mkdirSync(stateRoot, { recursive: true });
+  const recordFile = path.join(stateRoot, 'codex-runtime.json');
+  const saved = readRecord(recordFile);
+  environment = { ...environment,
+    CODEX_HOME: environment.CODEX_HOME || saved?.codexHome || path.join(os.homedir(), '.codex'),
+    CODE_RELAX_CODEX_PATH: environment.CODE_RELAX_CODEX_PATH || (saved?.source === 'explicit' ? saved.executable : '') };
+  if (!refresh && saved?.executable && fs.existsSync(saved.executable)
+    && saved.fingerprint === fingerprint(saved.executable)) return saved;
+  const candidates = [], rejected = [];
+  for (const candidate of discoverCodex(environment)) {
+    try {
+      const { stdout } = await exec(candidate.executable, ['--version'], { windowsHide: true, timeout: 10000 });
+      const version = /^codex-cli (\d+\.\d+\.\d+(?:-[\w.]+)?)/m.exec(stdout)?.[1];
+      if (!version) throw new Error('无法识别版本');
+      candidates.push({ ...candidate, version });
+    } catch (error) { rejected.push(`${candidate.executable}: ${error.message}`); }
+  }
+  candidates.sort((a, b) => Number(b.source === 'desktop') - Number(a.source === 'desktop') || compareVersions(b.version, a.version));
+  for (const candidate of candidates) {
+    try {
+      await verifyProtocol(candidate.executable, stateRoot);
+      const result = { ...candidate, fingerprint: fingerprint(candidate.executable),
+        codexHome: path.resolve(environment.CODEX_HOME || path.join(os.homedir(), '.codex')) };
+      writeRecord(recordFile, result);
+      return result;
+    } catch (error) { rejected.push(`${candidate.executable}: ${error.message}`); }
+  }
+  throw new Error(`未找到兼容的 Codex CLI，请安装或更新 Codex CLI 后执行 relax setup。${rejected.length ? '\n' + rejected.join('\n') : ''}`);
+}

package/dist/src/platform/windows/desktop-host.mjs

@@ -17,7 +17,22 @@ export const desktopHost = {
   sharedServiceUrl,
   start: startWindowsProcess,
   closeDesktop: executable => runScript('stop-desktop.ps1', ['-Executable', executable]),
-  stop: pid => process.kill(pid),
+  stop: pid => process.kill(pid),
+  async prepareKernelRestart() {
+    const info = await this.inspect();
+    if (!info.running || !await this.sharedServiceUrl()) return null;
+    await this.closeDesktop(info.desktop);
+    return info.desktop;
+  },
+  async resumeAfterKernelRestart(executable, environment) {
+    if (!executable) return;
+    await this.start(executable, [], environment, []);
+    const deadline = Date.now() + 30000;
+    while (!await this.sharedServiceUrl()) {
+      if (Date.now() >= deadline) throw new Error('Codex 内核已就绪，但 Desktop 未完成重新接入。');
+      await new Promise(resolve => setTimeout(resolve, 500));
+    }
+  },
   ready: async url => { try { return (await fetch(url, { signal: AbortSignal.timeout(1000) })).ok; } catch { return false; } },
 };
 export const resolveStateRoot = stateRoot => runScript('resolve-state-root.ps1', ['-StateRoot', stateRoot]);

package/dist/src/platform/windows/desktop-info.ps1

@@ -8,9 +8,7 @@ if ($ProcessId -gt 0) {
     exit
 }
 $package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
-if (-not $package) { throw '未找到 Codex Desktop，请先安装并登录。' }
+if (-not $package) { @{ desktop=$null; running=$false } | ConvertTo-Json -Compress; exit }
 $desktop = Join-Path $package.InstallLocation 'app/ChatGPT.exe'
 $running = @(Get-Process ChatGPT -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $desktop })
-$binaryRoot = Join-Path $env:LOCALAPPDATA 'OpenAI/Codex/bin'
-$cli = Get-ChildItem -LiteralPath $binaryRoot -Filter codex.exe -Recurse -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1
-@{ desktop=$desktop; cli=$cli.FullName; running=($running.Count -gt 0) } | ConvertTo-Json -Compress
+@{ desktop=$desktop; running=($running.Count -gt 0) } | ConvertTo-Json -Compress

package/dist/src/platform/windows/desktop-shortcut-run.ps1

@@ -1,4 +1,4 @@
-param([string]$NodePath, [string]$Entry, [ValidateSet('shared-start','desktop-start')][string]$Action)
+param([string]$NodePath, [string]$Entry, [ValidateSet('shared-start')][string]$Action)
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
 & $NodePath $Entry $Action

package/dist/src/platform/windows/desktop-shortcuts.ps1

@@ -4,7 +4,7 @@ $ErrorActionPreference = 'Stop'
 $shell = New-Object -ComObject WScript.Shell
 if (-not $Destination) { $Destination = $shell.SpecialFolders.Item('Desktop') }
 $launcher = Join-Path $PSScriptRoot 'desktop-shortcut-run.ps1'
-$items = @(@{Name='Code Relax - 完整控制'; Command='shared-start'}, @{Name='Code Relax - 基础控制'; Command='desktop-start'})
+$items = @(@{Name='Code Relax - Codex 内核'; Command='shared-start'})
 $results = @()
 foreach ($item in $items) {
     $target = Join-Path $Destination ($item.Name + '.lnk')

package/dist/src/platform/windows/launch-worker.mjs

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import { spawn } from 'node:child_process';
+
+const [requestPath, readyPath, instance, diagnosticPath] = process.argv.slice(2);
+let result = { instance, brokerPid: process.pid };
+
+function diagnostic(message) {
+  if (!diagnosticPath) return;
+  fs.appendFileSync(diagnosticPath, `${new Date().toISOString()} ${message}\n`, 'utf8');
+}
+
+try {
+  const spec = JSON.parse(fs.readFileSync(requestPath, 'utf8').replace(/^\uFEFF/u, ''));
+  diagnostic('request loaded');
+  if (spec.instance !== instance) throw new Error('Windows process broker request identity mismatch.');
+  fs.rmSync(requestPath, { force: true });
+  const descriptors = (spec.logs || []).map(file => fs.openSync(file, 'a'));
+  try {
+    const child = spawn(spec.executable, spec.args || [], {
+      windowsHide: true,
+      env: spec.environment,
+      stdio: ['ignore', descriptors[0] ?? 'ignore', descriptors[1] ?? 'ignore'],
+    });
+    await new Promise((resolve, reject) => {
+      child.once('spawn', resolve);
+      child.once('error', reject);
+    });
+    // Keep this WMI-owned broker alive with the target so Codex tools inherit
+    // its hidden console instead of creating a visible console per command.
+    result.pid = child.pid;
+    diagnostic(`target started (PID ${child.pid})`);
+  } finally {
+    descriptors.forEach(descriptor => fs.closeSync(descriptor));
+  }
+} catch (error) {
+  result.error = error?.stack || error?.message || String(error);
+  try { diagnostic(`failed: ${result.error}`); } catch {}
+}
+
+const temporary = `${readyPath}.tmp`;
+fs.writeFileSync(temporary, JSON.stringify(result), 'utf8');
+fs.renameSync(temporary, readyPath);

package/dist/src/platform/windows/resident-startup.ps1

@@ -1,27 +1,67 @@
 param([string]$NodePath, [string]$Entry, [ValidateSet('enable','disable','status')][string]$Action='status')
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+
+$taskName = 'Code Relax Bridge'
+$taskSource = '@walkhi/code-relax'
+$taskPath = '\' + $taskName
+$arguments = '"' + $Entry + '" start --json'
+$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+
+$scheduler = New-Object -ComObject 'Schedule.Service'
+$scheduler.Connect()
+$root = $scheduler.GetFolder('\')
+$registered = @($root.GetTasks(1) | Where-Object { $_.Name -eq $taskName } | Select-Object -First 1)
+if ($registered.Count -gt 0 -and $registered[0].Definition.RegistrationInfo.Source -ne $taskSource) {
+    throw 'Scheduled task is not owned by this installation.'
+}
+
+# Remove only the legacy shortcut created by this package. A Startup LNK that
+# launches hidden PowerShell with ExecutionPolicy Bypass triggers AV heuristics.
 $shell = New-Object -ComObject WScript.Shell
-$target = Join-Path $shell.SpecialFolders.Item('Startup') 'Code Relax Bridge.lnk'
-$launcher = Join-Path $PSScriptRoot 'resident-start.ps1'
-$powershell = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
-$exists = Test-Path -LiteralPath $target
-if ($exists) {
-    $existing = $shell.CreateShortcut($target)
-    if ($existing.TargetPath -ne $powershell -or -not $existing.Arguments.Contains('"' + $launcher + '"')) {
-        throw 'Startup shortcut is not owned by this installation.'
+$legacyPath = Join-Path $shell.SpecialFolders.Item('Startup') 'Code Relax Bridge.lnk'
+$legacyLauncher = Join-Path $PSScriptRoot 'resident-start.ps1'
+$legacyExists = Test-Path -LiteralPath $legacyPath
+if ($Action -ne 'status' -and $legacyExists) {
+    $legacy = $shell.CreateShortcut($legacyPath)
+    if (-not $legacy.Arguments.Contains('"' + $legacyLauncher + '"')) {
+        throw 'Legacy startup shortcut is not owned by this installation.'
     }
 }
+
 if ($Action -eq 'enable') {
     if (-not (Test-Path -LiteralPath $NodePath) -or -not (Test-Path -LiteralPath $Entry)) { throw 'Installed runtime is missing.' }
-    $link = $shell.CreateShortcut($target)
-    $link.TargetPath = $powershell
-    $link.Arguments = '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "' + $launcher + '" -NodePath "' + $NodePath + '" -Entry "' + $Entry + '"'
-    $link.WorkingDirectory = $env:USERPROFILE
-    $link.WindowStyle = 7
-    $link.Description = 'Code Relax resident computer connection'
-    $link.Save()
-} elseif ($Action -eq 'disable' -and $exists) {
-    Remove-Item -LiteralPath $target
+    $definition = $scheduler.NewTask(0)
+    $definition.RegistrationInfo.Description = 'Start the Code Relax Bridge when this user signs in.'
+    $definition.RegistrationInfo.Source = $taskSource
+    $definition.Principal.UserId = $currentUser
+    $definition.Principal.LogonType = 3 # TASK_LOGON_INTERACTIVE_TOKEN
+    $definition.Principal.RunLevel = 0 # TASK_RUNLEVEL_LUA
+    $definition.Settings.Enabled = $true
+    $definition.Settings.Hidden = $true
+    $definition.Settings.StartWhenAvailable = $true
+    $definition.Settings.DisallowStartIfOnBatteries = $false
+    $definition.Settings.StopIfGoingOnBatteries = $false
+    $definition.Settings.ExecutionTimeLimit = 'PT5M'
+    $definition.Settings.MultipleInstances = 2 # TASK_INSTANCES_IGNORE_NEW
+    $trigger = $definition.Triggers.Create(9) # TASK_TRIGGER_LOGON
+    $trigger.UserId = $currentUser
+    $trigger.Enabled = $true
+    $exec = $definition.Actions.Create(0) # TASK_ACTION_EXEC
+    $exec.Path = $NodePath
+    $exec.Arguments = $arguments
+    $exec.WorkingDirectory = $env:USERPROFILE
+    [void]$root.RegisterTaskDefinition($taskName, $definition, 6, $null, $null, 3, $null) # TASK_CREATE_OR_UPDATE
+} elseif ($Action -eq 'disable' -and $registered.Count -gt 0) {
+    $root.DeleteTask($taskName, 0)
 }
-@{ enabled=(Test-Path -LiteralPath $target); path=$target; scope='current-user-logon' } | ConvertTo-Json -Compress
+if ($Action -ne 'status' -and $legacyExists) { Remove-Item -LiteralPath $legacyPath }
+
+$active = @($root.GetTasks(1) | Where-Object { $_.Name -eq $taskName } | Select-Object -First 1)
+$taskEnabled = $active.Count -gt 0 -and $active[0].Enabled
+@{
+    enabled=($taskEnabled -or ($Action -eq 'status' -and $legacyExists))
+    path=$(if ($taskEnabled) { 'Task Scheduler:' + $taskPath } elseif ($legacyExists) { $legacyPath } else { 'Task Scheduler:' + $taskPath })
+    scope='current-user-logon'
+    mechanism=$(if ($taskEnabled) { 'task-scheduler' } elseif ($legacyExists) { 'legacy-startup-shortcut' } else { 'task-scheduler' })
+} | ConvertTo-Json -Compress

package/dist/src/platform/windows/service-host.mjs

@@ -28,16 +28,13 @@ export function migrateState(stateRoot) {
     if (!fs.existsSync(target) && fs.existsSync(old)) fs.copyFileSync(old, target, fs.constants.COPYFILE_EXCL);
   }
 }
-export async function desktopEnvironment(context, sharedUrl) {
-  const environment = { ...process.env };
-  environment.CODEX_THREAD_ID ||= environment.CODEX_SESSION_ID || context?.sourceThreadId;
-  if (sharedUrl) environment.CODEX_REMOTE_SHARED_WS_URL = sharedUrl;
-  else delete environment.CODEX_REMOTE_SHARED_WS_URL;
-  const installation = readRecord(path.join(runtimePaths(environment).serviceRoot, 'installation.json'));
+export async function bridgeEnvironment() {
+  const environment = { ...process.env };
+  const installation = readRecord(path.join(runtimePaths(environment).serviceRoot, 'installation.json'));
   const executable = installation?.nodeExecutable;
   if (!executable || !fs.existsSync(executable)) throw new Error('安装时选用的 Node 不存在，请重新安装 Code Relax。');
   environment.CODEX_MCP_NODE_PATH = executable;
   environment.CODEX_REMOTE_LEGACY_UPLOADS_ROOTS = JSON.stringify(installation.legacyUploadsRoots || []);
-  if (sharedUrl) delete environment.CODEX_APP_TOOLS_PIPE_PATH;
+  delete environment.CODEX_APP_TOOLS_PIPE_PATH;
   return { executable, environment };
 }

package/dist/src/platform/windows/start-hidden-console.ps1

@@ -10,30 +10,40 @@ try {
     Add-Type -Path (Join-Path $PSScriptRoot 'IsolatedProcess.cs')
     $launchRoot = [IsolatedProcess]::ResolvePath($launchRoot)
     $ready = Join-Path $launchRoot ($instance + '.json')
+    $request = Join-Path $launchRoot ($instance + '.request.json')
+    $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
     $spec | Add-Member -NotePropertyName instance -NotePropertyValue $instance
-    $spec | Add-Member -NotePropertyName ready -NotePropertyValue $ready
-    $environment = @(Get-ChildItem Env: | Where-Object { $_.Name -ne 'CODEX_REMOTE_PROCESS_SPEC' } | ForEach-Object { $_.Name + '=' + $_.Value })
-    $environment += 'CODEX_REMOTE_PROCESS_SPEC=' + ($spec | ConvertTo-Json -Compress -Depth 10)
+    $spec | Add-Member -NotePropertyName diagnostic -NotePropertyValue $diagnostic
+    $requestTemporary = $request + '.tmp'
+    [IO.File]::WriteAllText($requestTemporary, ($spec | ConvertTo-Json -Compress -Depth 10), (New-Object Text.UTF8Encoding($false)))
+    [IO.File]::Move($requestTemporary, $request)
     $startup = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
-        ShowWindow=[uint16]0; CreateFlags=[uint32]0x1000010; EnvironmentVariables=[string[]]$environment
+        ShowWindow=[uint16]0; CreateFlags=[uint32]0x1000010
     }
-    $powershell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
-    $command = '"' + $powershell + '" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "' + (Join-Path $PSScriptRoot 'launch-worker.ps1') + '"'
+    $worker = Join-Path $PSScriptRoot 'launch-worker.mjs'
+    $command = '"' + [string]$spec.brokerExecutable + '" "' + $worker + '" "' + $request + '" "' + $ready + '" "' + $instance + '" "' + $diagnostic + '"'
     $broker = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
         CommandLine=$command; CurrentDirectory=$env:USERPROFILE; ProcessStartupInformation=$startup
     }
     if ($broker.ReturnValue -ne 0) { throw ('Windows process broker failed: ' + $broker.ReturnValue) }
-    $deadline = [DateTime]::UtcNow.AddSeconds(20)
+    $deadline = [DateTime]::UtcNow.AddSeconds(30)
     while (-not (Test-Path -LiteralPath $ready)) {
-        if ([DateTime]::UtcNow -gt $deadline) { throw 'Windows process broker handoff timed out.' }
+        if ([DateTime]::UtcNow -gt $deadline) {
+            $detail = if (Test-Path -LiteralPath $diagnostic) { (Get-Content -LiteralPath $diagnostic -Raw -Encoding UTF8).Trim() } else { 'broker did not create a diagnostic log' }
+            throw ('Windows process broker handoff timed out (broker PID ' + $broker.ProcessId + '): ' + $detail)
+        }
         Start-Sleep -Milliseconds 50
     }
     $result = Get-Content -LiteralPath $ready -Raw -Encoding UTF8 | ConvertFrom-Json
     Remove-Item -LiteralPath $ready
     if ($result.instance -ne $instance -or $result.brokerPid -ne $broker.ProcessId) { throw 'Windows process broker identity mismatch.' }
     if ($result.error) { throw [string]$result.error }
+    if (Test-Path -LiteralPath $diagnostic) { Remove-Item -LiteralPath $diagnostic -Force }
     [Console]::WriteLine([int]$result.pid)
 } catch {
     [Console]::Error.WriteLine($_.Exception.Message)
     exit 1
+} finally {
+    if ($request -and (Test-Path -LiteralPath $request)) { Remove-Item -LiteralPath $request -Force }
+    if ($requestTemporary -and (Test-Path -LiteralPath $requestTemporary)) { Remove-Item -LiteralPath $requestTemporary -Force }
 }

package/dist/src/platform/windows/stop-desktop.ps1

@@ -5,15 +5,18 @@ $package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
 if (-not $package -or $Executable -ne (Join-Path $package.InstallLocation 'app/ChatGPT.exe')) {
     throw 'Desktop executable identity changed; recovery stopped.'
 }
-# This action is only reached after explicit whole-workstation recovery confirmation.
-# Never kill an app-server process tree: the independent recovery worker must survive.
-$workers = @(Get-CimInstance Win32_Process -Filter "Name='ChatGPT.exe'" | Where-Object { $_.ExecutablePath -eq $Executable })
+# Never kill another user's Desktop or an app-server process tree. The independent
+# installer/recovery worker must survive and relaunch only in this interactive session.
+$currentSessionId = (Get-Process -Id $PID -ErrorAction Stop).SessionId
+$workers = @(Get-CimInstance Win32_Process -Filter "Name='ChatGPT.exe'" | Where-Object {
+    $_.ExecutablePath -eq $Executable -and $_.SessionId -eq $currentSessionId
+})
 foreach ($worker in $workers) {
     $actual = Get-CimInstance Win32_Process -Filter "ProcessId=$($worker.ProcessId)"
     if ($actual -and $actual.ExecutablePath -eq $worker.ExecutablePath -and $actual.CreationDate -eq $worker.CreationDate) {
         Stop-Process -Id $worker.ProcessId -Force -ErrorAction Stop
     }
 }
-if (Get-Process ChatGPT -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $Executable }) {
+if (Get-Process ChatGPT -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $Executable -and $_.SessionId -eq $currentSessionId }) {
     throw 'Desktop did not exit; recovery stopped.'
 }