@walkhi/code-relax 0.1.0-beta.1

package/dist/src/skill-install.mjs

@@ -0,0 +1,64 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { createHash } from 'node:crypto';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+
+const owner = '@walkhi/code-relax';
+const markerName = '.code-relax-install.json';
+const legacyOwner = '@closedhi/codex-remote';
+const legacyMarkerName = '.codex-remote-install.json';
+const digest = value => createHash('sha256').update(value).digest('hex');
+export const skillDirectory = (home = os.homedir()) => path.join(home, '.agents/skills/code-relax');
+const legacySkillDirectory = (home = os.homedir()) => path.join(home, '.agents/skills/codex-remote');
+
+// Refuse junctions/symlinks along managed paths before writing or removing files.
+export function assertPlainPath(target) {
+  for (let item = path.resolve(target); ; item = path.dirname(item)) {
+    try { if (fs.lstatSync(item).isSymbolicLink()) throw new Error(`不自动修改链接路径：${item}`); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (path.dirname(item) === item) break;
+  }
+}
+
+export function inspectSkill(target = skillDirectory()) {
+  assertPlainPath(target);
+  if (!fs.existsSync(target)) return { installed: false, managed: false, target };
+  const markerPath = path.join(target, markerName), file = path.join(target, 'SKILL.md');
+  assertPlainPath(markerPath); assertPlainPath(file);
+  const marker = readRecord(markerPath);
+  const managed = marker?.owner === owner && fs.existsSync(file)
+    && marker.sha256 === digest(fs.readFileSync(file))
+    && fs.readdirSync(target).every(name => ['SKILL.md', markerName].includes(name));
+  return { installed: true, managed, target };
+}
+
+export function removeLegacyManagedSkill(target = legacySkillDirectory()) {
+  const marker = readRecord(path.join(target, legacyMarkerName));
+  const file = path.join(target, 'SKILL.md');
+  if (marker?.owner !== legacyOwner || !fs.existsSync(file) || marker.sha256 !== digest(fs.readFileSync(file))
+    || !fs.readdirSync(target).every(name => ['SKILL.md', legacyMarkerName].includes(name))) return false;
+  fs.unlinkSync(file); fs.unlinkSync(path.join(target, legacyMarkerName)); fs.rmdirSync(target);
+  return true;
+}
+
+export function installSkill(source, target = skillDirectory()) {
+  const state = inspectSkill(target);
+  if (state.installed && !state.managed) throw new Error(`同名 Skill 非本包管理或已被修改，请保留并手动处理：${target}`);
+  const content = fs.readFileSync(source);
+  fs.mkdirSync(target, { recursive: true });
+  fs.writeFileSync(path.join(target, 'SKILL.md'), content);
+  writeRecord(path.join(target, markerName), { owner, sha256: digest(content) });
+  if (path.resolve(target) === path.resolve(skillDirectory())) removeLegacyManagedSkill();
+  return { installed: true, target, message: 'Skill 已安装/更新；若 Codex 尚未显示，请重新打开 Codex。' };
+}
+
+export function removeSkill(target = skillDirectory()) {
+  const state = inspectSkill(target);
+  if (!state.installed) return { removed: false, target, message: 'Skill 未安装。' };
+  if (!state.managed) throw new Error(`同名 Skill 非本包管理或已被修改，未删除：${target}`);
+  fs.unlinkSync(path.join(target, 'SKILL.md'));
+  fs.unlinkSync(path.join(target, markerName));
+  fs.rmdirSync(target);
+  return { removed: true, target, message: '已移除本包安装的 Skill。' };
+}

package/dist/src/thread-catalog.mjs

@@ -0,0 +1,42 @@
+import { DatabaseSync } from 'node:sqlite';
+import path from 'node:path';
+
+function normalizedPath(value) {
+  return String(value || '').replace(/^\\\\\?\\/, '').replaceAll('\\', '/').replace(/\/+$/, '').toLowerCase();
+}
+
+export function supplementThreadCatalog(data, projects, codexRoot, limit) {
+  const db = new DatabaseSync(path.join(codexRoot, 'state_5.sqlite'), { readOnly: true });
+  try {
+    const rows = db.prepare(`SELECT id, name, title, cwd, project_id, archived,
+      COALESCE(updated_at_ms, updated_at * 1000) AS updated_ms,
+      MAX(recency_at_ms, recency_at * 1000, COALESCE(updated_at_ms, updated_at * 1000)) AS sort_ms
+      FROM threads WHERE source IN ('vscode', 'cli') ORDER BY sort_ms DESC`).all();
+    const indexed = new Map(rows.map(row => [row.id, row]));
+    const localProjects = projects.filter(project => project.hostId === 'local' && project.path)
+      .sort((a, b) => normalizedPath(b.path).length - normalizedPath(a.path).length);
+    const assignProject = thread => {
+      if (thread.projectId || thread.hostId !== 'local') return thread;
+      const cwd = normalizedPath(thread.cwd);
+      const project = localProjects.find(project => cwd === normalizedPath(project.path) || cwd.startsWith(normalizedPath(project.path) + '/'));
+      return { ...thread, projectId: project?.projectId || null };
+    };
+    const visible = thread => thread.kind === 'codex'
+      && (thread.hostId !== 'local' || !indexed.get(thread.id)?.archived);
+    const pinnedThreads = (data.pinnedThreads || []).filter(visible).map(assignProject);
+    const pinned = new Set(pinnedThreads.map(thread => thread.id));
+    const threads = new Map((data.threads || []).filter(visible).map(thread => [thread.id, assignProject(thread)]));
+    for (const row of rows) {
+      if (row.archived || pinned.has(row.id) || threads.has(row.id)) continue;
+      threads.set(row.id, assignProject({ id: row.id, kind: 'codex', hostId: 'local',
+        title: row.name || row.title, cwd: row.cwd, projectId: row.project_id,
+        updatedAt: row.updated_ms / 1000, status: 'unknown' }));
+    }
+    const recency = thread => thread.hostId === 'local' && indexed.has(thread.id)
+      ? indexed.get(thread.id).sort_ms : Number(thread.updatedAt || 0) * 1000;
+    return { ...data, pinnedThreads, threads: [...threads.values()]
+      .sort((a, b) => recency(b) - recency(a)).slice(0, limit) };
+  } finally {
+    db.close();
+  }
+}

package/dist/src/thread-title-generation.mjs

@@ -0,0 +1,150 @@
+import { randomUUID } from 'node:crypto';
+
+const TITLE_MODEL = 'gpt-5.6-luna';
+const TITLE_TIMEOUT_MS = 30_000;
+const TITLE_SCHEMA = Object.freeze({
+  type: 'object',
+  properties: {
+    title: { type: 'string', minLength: 1, maxLength: 36 },
+    description: { type: 'string', minLength: 1, maxLength: 100 },
+  },
+  required: ['title', 'description'],
+  additionalProperties: false,
+});
+
+function titlePrompt(prompt) {
+  return [
+    'You are a helpful assistant. You will be presented with a user prompt, and your job is to provide a short title for a task that will be created from that prompt.',
+    'The title will be shown in the UI to represent the prompt.',
+    'Generate a concise UI title of at most 36 characters and fill the structured title field with plain text.',
+    'Fill the structured description field with a compact, search-oriented summary of at most 100 characters.',
+    'Write both values in the user\'s locale. Do not include quotes, markdown, formatting characters, or trailing punctuation.',
+    'Capture the question or core change requested instead of copying the whole prompt.',
+    'Do not respond to the user or attempt to solve the problem; only fill the structured fields.',
+    '',
+    'User prompt:',
+    prompt,
+  ].join('\n');
+}
+
+function normalizeTitle(value) {
+  let title = String(value || '').replace(/\r\n/g, '\n').split('\n').find(line => line.trim())?.trim() || '';
+  title = title.replace(/^title[:\s]+/i, '');
+  title = title.replace(/^[`"'“”‘’]+|[`"'“”‘’]+$/g, '');
+  title = title.replace(/\s+/g, ' ').replace(/[.?!。？！]+$/, '').trim();
+  if (!title) return null;
+  if (title.length <= 36) return title;
+  let end = 36;
+  if (title[end] !== ' ' && title[end - 1] !== ' ') {
+    const nextSpace = title.indexOf(' ', end);
+    end = nextSpace < 0 ? title.length : nextSpace;
+  }
+  const head = title.slice(0, end).trimEnd();
+  return title.slice(end).trim() ? `${head}…` : head;
+}
+
+function parseStructuredTitle(text) {
+  if (!text?.trim()) return null;
+  try {
+    const value = JSON.parse(text.trim());
+    return normalizeTitle(value?.title);
+  } catch {
+    return null;
+  }
+}
+
+export async function generateThreadTitle({ request, subscribe, prompt, cwd = null,
+  timeoutMs = TITLE_TIMEOUT_MS, uuid = randomUUID }) {
+  const source = String(prompt || '').trim();
+  if (!source) return null;
+  const { thread } = await request('thread/start', {
+    model: TITLE_MODEL,
+    modelProvider: null,
+    allowProviderModelFallback: true,
+    cwd,
+    approvalPolicy: 'never',
+    permissions: ':read-only',
+    runtimeWorkspaceRoots: [],
+    config: {
+      'features.enable_fanout': false,
+      'features.hooks': false,
+      'features.multi_agent': false,
+      'features.multi_agent_v2': false,
+      'features.plugins': false,
+      'features.shell_snapshot': false,
+      'features.tool_suggest': false,
+      'features.apps': false,
+      'mcp_servers.codex_app': { enabled: false, command: '' },
+      apps: { _default: { enabled: false, destructive_enabled: false, open_world_enabled: false } },
+      model_reasoning_effort: 'low',
+      web_search: 'disabled',
+    },
+    personality: null,
+    ephemeral: true,
+    threadSource: 'thread_title',
+    experimentalRawEvents: false,
+    dynamicTools: null,
+    serviceTier: null,
+  });
+  const threadId = thread.id;
+  let message = '';
+  let turnId = null;
+  let stop = () => {};
+  try {
+    const completed = new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error('生成对话标题超时。')), timeoutMs);
+      timer.unref?.();
+      const unsubscribe = subscribe(({ method, params }) => {
+        if (params.threadId !== threadId) return;
+        if (method === 'turn/started') turnId = params.turn?.id || turnId;
+        if (turnId && params.turnId && params.turnId !== turnId) return;
+        if (method === 'item/agentMessage/delta') message += params.delta || '';
+        if (method === 'item/completed' && params.item?.type === 'agentMessage') message = params.item.text || message;
+        if (method === 'error') {
+          clearTimeout(timer);
+          reject(new Error(params.error?.message || '生成对话标题失败。'));
+        }
+        if (method === 'turn/completed') {
+          clearTimeout(timer);
+          if (params.turn?.status !== 'completed') {
+            reject(new Error(params.turn?.error?.message || `生成对话标题失败：${params.turn?.status || 'unknown'}`));
+          } else resolve(parseStructuredTitle(message));
+        }
+      });
+      stop = () => { clearTimeout(timer); unsubscribe(); };
+    });
+    const started = await request('turn/start', {
+      threadId,
+      turnTrigger: 'thread_title',
+      clientUserMessageId: uuid(),
+      input: [{ type: 'text', text: titlePrompt(source), text_elements: [] }],
+      cwd: null,
+      approvalPolicy: null,
+      permissions: ':read-only',
+      runtimeWorkspaceRoots: [],
+      model: null,
+      effort: null,
+      serviceTier: null,
+      personality: null,
+      outputSchema: TITLE_SCHEMA,
+      collaborationMode: null,
+    });
+    turnId ||= started.turn?.id || null;
+    return await completed;
+  } finally {
+    stop();
+    await request('thread/unsubscribe', { threadId }).catch(() => {});
+  }
+}
+
+export async function generateAndSetThreadTitle({ request, subscribe, threadId, prompt, cwd = null,
+  timeoutMs, uuid }) {
+  const title = await generateThreadTitle({ request, subscribe, prompt, cwd, timeoutMs, uuid });
+  if (!title) return null;
+  const current = await request('thread/read', { threadId, includeTurns: false });
+  if (current.thread?.name?.trim()) return null;
+  await request('thread/name/set', { threadId, name: title });
+  return title;
+}
+
+export const threadTitleInternals = { normalizeTitle, parseStructuredTitle, TITLE_SCHEMA, TITLE_MODEL };

package/dist/tools/find-desktop-pipe.mjs

@@ -0,0 +1,10 @@
+import { findDesktopPipe } from '../src/platform/windows/desktop-tools.mjs';
+
+try {
+  const args = process.argv.slice(2);
+  if (args.length && (args.length !== 1 || args[0] !== '--wait')) throw new Error('Invalid pipe discovery arguments');
+  console.log(await findDesktopPipe({ timeout: args.length ? 120000 : 0 }));
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/dist/tools/rtc-route-helper.ps1

@@ -0,0 +1,99 @@
+param(
+  [Parameter(Mandatory = $true)][string]$Token,
+  [int]$IdleSeconds = 1800
+)
+
+$ErrorActionPreference = 'Stop'
+$pipeName = 'CodeRelaxRtcRouteHelper'
+$leases = @{}
+$pipeSecurity = [System.IO.Pipes.PipeSecurity]::new()
+$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new($currentUser, [System.IO.Pipes.PipeAccessRights]::ReadWrite,
+  [System.Security.AccessControl.AccessControlType]::Allow))
+$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new([System.Security.Principal.SecurityIdentifier]::new('S-1-5-18'),
+  [System.IO.Pipes.PipeAccessRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow))
+$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new([System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'),
+  [System.IO.Pipes.PipeAccessRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow))
+
+function Test-PublicIpv4([string]$Address) {
+  $parts = $Address.Split('.')
+  if ($parts.Count -ne 4) { return $false }
+  try { $bytes = $parts | ForEach-Object { [byte]$_ } } catch { return $false }
+  $a = $bytes[0]; $b = $bytes[1]
+  return $a -ne 0 -and $a -ne 10 -and $a -ne 127 -and $a -lt 224 -and -not ($a -eq 169 -and $b -eq 254) -and
+    -not ($a -eq 172 -and $b -ge 16 -and $b -le 31) -and -not ($a -eq 192 -and $b -eq 168) -and
+    -not ($a -eq 100 -and $b -ge 64 -and $b -le 127) -and -not ($a -eq 198 -and ($b -eq 18 -or $b -eq 19))
+}
+
+function Get-PhysicalDefaultRoute {
+  $routes = Get-NetRoute -DestinationPrefix '0.0.0.0/0' -AddressFamily IPv4 | Where-Object {
+    $adapter = Get-NetAdapter -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue
+    $_.NextHop -and $_.NextHop -ne '0.0.0.0' -and $adapter.Status -eq 'Up' -and $adapter.HardwareInterface -eq $true -and $adapter.Virtual -ne $true
+  } | Sort-Object @{ Expression = { $_.RouteMetric + $_.InterfaceMetric } }
+  foreach ($route in $routes) {
+    $adapter = Get-NetAdapter -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue
+    if ($adapter.Name -notmatch 'Mihomo|Meta|Tunnel|VPN|TAP|Wintun') { return $route }
+  }
+  throw '找不到活动物理 IPv4 默认路由'
+}
+
+function Clear-ExpiredRoutes {
+  $now = Get-Date
+  foreach ($address in @($leases.Keys)) {
+    if ($leases[$address].expires -gt $now) { continue }
+    $lease = $leases[$address]
+    if ($lease.created) {
+      Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $lease.ifIndex -NextHop $lease.nextHop -ErrorAction SilentlyContinue |
+        Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue
+    }
+    $leases.Remove($address)
+  }
+}
+
+function Clear-AllRoutes {
+  foreach ($address in @($leases.Keys)) {
+    $lease = $leases[$address]
+    if ($lease.created) {
+      Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $lease.ifIndex -NextHop $lease.nextHop -ErrorAction SilentlyContinue |
+        Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue
+    }
+    $leases.Remove($address)
+  }
+}
+
+try {
+  $deadline = (Get-Date).AddSeconds($IdleSeconds)
+  while ((Get-Date) -lt $deadline) {
+    Clear-ExpiredRoutes
+    $server = [System.IO.Pipes.NamedPipeServerStream]::new($pipeName, [System.IO.Pipes.PipeDirection]::InOut, 1,
+      [System.IO.Pipes.PipeTransmissionMode]::Byte, [System.IO.Pipes.PipeOptions]::Asynchronous, 0, 0, $pipeSecurity)
+  $writer = $null
+  try {
+      $wait = $server.WaitForConnectionAsync()
+      if (-not $wait.Wait(1000)) { continue }
+      $reader = [System.IO.StreamReader]::new($server)
+      $writer = [System.IO.StreamWriter]::new($server); $writer.AutoFlush = $true
+      $request = $reader.ReadLine() | ConvertFrom-Json
+      if ($request.token -cne $Token -or $request.action -ne 'add') { throw '请求未授权' }
+      $ttl = [Math]::Min([Math]::Max([int]$request.ttlSeconds, 15), 180)
+      $route = Get-PhysicalDefaultRoute
+      $rawAddresses = @($request.addresses)
+      $addresses = @($rawAddresses | Where-Object { Test-PublicIpv4 $_ } | Select-Object -Unique)
+      if ($addresses.Count -ne $rawAddresses.Count -or $addresses.Count -gt 8) { throw '路由目标无效' }
+      foreach ($address in $addresses) {
+        $created = $leases[$address].created -eq $true
+        if (-not $leases.ContainsKey($address) -and -not (Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $route.InterfaceIndex -NextHop $route.NextHop -ErrorAction SilentlyContinue)) {
+          New-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $route.InterfaceIndex -NextHop $route.NextHop -RouteMetric 5 -PolicyStore ActiveStore | Out-Null
+          $created = $true
+        }
+        $leases[$address] = @{ expires = (Get-Date).AddSeconds($ttl); ifIndex = $route.InterfaceIndex; nextHop = $route.NextHop; created = $created }
+      }
+      $writer.WriteLine((@{ ok = $true; count = $addresses.Count } | ConvertTo-Json -Compress))
+    }
+    catch {
+      if ($writer) { $writer.WriteLine((@{ ok = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress)) }
+    }
+    finally { $server.Dispose() }
+  }
+}
+finally { Clear-AllRoutes }

package/dist/tools/start-rtc-route-helper.ps1

@@ -0,0 +1,15 @@
+$ErrorActionPreference = 'Stop'
+$roots = @(
+  (Join-Path $env:LOCALAPPDATA 'CodexRemote'),
+  (Join-Path $env:LOCALAPPDATA 'Packages\OpenAI.Codex_2p2nqsd0c76g0\LocalCache\Local\CodexRemote')
+)
+$config = $null
+foreach ($root in $roots) {
+  $path = Join-Path $root 'self-relay-config.json'
+  if (-not (Test-Path -LiteralPath $path)) { continue }
+  $value = Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json
+  if ($value.p2pWindowsRouteHelper -eq $true -and $value.p2pWindowsRouteHelperToken) { $config = $value; break }
+}
+if (-not $config) { throw '未找到已启用的 RTC 路由辅助配置' }
+$helper = Join-Path $PSScriptRoot 'rtc-route-helper.ps1'
+& $helper -Token $config.p2pWindowsRouteHelperToken -IdleSeconds 1800

package/dist/web/approval-ui.js

@@ -0,0 +1,188 @@
+(function (root) {
+  root.createApprovalPanel = function (host, respond, pendingChanged = () => {}) {
+    const cards = new Map();
+    let connected = false;
+    const titles = { accept: '允许本次', acceptForSession: '本会话允许', decline: '拒绝', cancel: '拒绝并停止' };
+    function content(text, label, collapsed = false) {
+      const full = document.createElement('pre'); full.textContent = text;
+      if (!text) full.hidden = true;
+      if (!collapsed && text.length <= 180 && text.split('\n').length <= 3) return full;
+      const details = document.createElement('details'); details.className = 'approval-details';
+      const summary = document.createElement('summary');
+      const title = document.createElement('span'); title.className = 'approval-details-title'; title.textContent = label;
+      const preview = document.createElement('span'); preview.className = 'approval-preview';
+      preview.textContent = text.split('\n').slice(0, 3).join('\n').slice(0, 180) + '…';
+      summary.append(title);
+      if (!collapsed) summary.append(preview);
+      details.append(summary, full);
+      return details;
+    }
+    function paragraph(text, className = '') {
+      const p = document.createElement('p'); p.textContent = text; p.className = className; return p;
+    }
+    function shellPresentation(command) {
+      if (typeof command !== 'string') return null;
+      const match = command.trim().match(/^(?:"([^"]+)"|'([^']+)'|(\S+))(?:\s+([\s\S]*))?$/);
+      if (!match) return null;
+      const executable = match[1] || match[2] || match[3];
+      const name = executable.replaceAll('\\', '/').split('/').at(-1)?.toLowerCase() || '';
+      const rest = match[4] || '';
+      const shells = [
+        { names: ['powershell', 'powershell.exe', 'pwsh', 'pwsh.exe'], label: 'PowerShell', marker: /(?:^|\s)-(?:command|c)\s+/i },
+        { names: ['cmd', 'cmd.exe'], label: '命令提示符', marker: /(?:^|\s)\/(?:c|k)\s+/i },
+        { names: ['bash', 'bash.exe', 'sh', 'sh.exe'], label: 'Shell', marker: /(?:^|\s)-(?:c|lc)\s+/i }
+      ];
+      const shell = shells.find(candidate => candidate.names.includes(name));
+      if (!shell) return null;
+      const marker = shell.marker.exec(rest);
+      const text = marker ? rest.slice(marker.index + marker[0].length).trim() : rest.trim();
+      return { label: shell.label, text };
+    }
+    function requestDetails(request) {
+      const p = request.params, body = document.createElement('div'); body.className = 'approval-body';
+      const network = p.networkApprovalContext;
+      if (network) body.append(paragraph(`目标：${network.protocol}://${network.host}`));
+      if (p.reason && network) body.append(paragraph(p.reason));
+      for (const action of p.commandActions || []) {
+        if (action.type === 'read') body.append(paragraph(`读取文件：${action.path || action.name}`));
+        else if (action.type === 'listFiles') body.append(paragraph(`列出文件：${action.path || p.cwd || '当前目录'}`));
+        else if (action.type === 'search') body.append(paragraph(`搜索${action.query ? `“${action.query}”` : '内容'}${action.path ? `：${action.path}` : ''}`));
+      }
+      const shell = shellPresentation(p.command);
+      if (shell) {
+        body.append(paragraph(`执行方式：${shell.label}`, 'approval-meta'));
+        if (shell.text) body.append(content(shell.text, '要执行的内容'));
+        body.append(content(p.command, '完整原始命令', true));
+      } else if (p.command) body.append(content(p.command, '完整命令'));
+      if (p.cwd) body.append(paragraph(`工作目录：${p.cwd}`, 'approval-meta'));
+      if (p.grantRoot) body.append(paragraph(`申请本会话写入目录：${p.grantRoot}`));
+      for (const change of request.fileChanges || []) {
+        const kind = change.kind?.type || change.kind;
+        const move = change.kind?.movePath;
+        const label = `${{ add: '新增', delete: '删除', update: '修改' }[kind] || '文件'}：${change.path}${move ? ` → ${move}` : ''}`;
+        body.append(change.diff ? content(change.diff, label, true) : paragraph(label));
+      }
+      if (request.method === CodexServerRequests.file && !request.fileChanges?.length) body.append(paragraph('尚未收到文件修改明细，请先在工作站查看。'));
+      const permissions = p.additionalPermissions || p.permissions;
+      if (permissions) {
+        if (permissions.network?.enabled === true) body.append(paragraph('额外权限：连接互联网'));
+        const files = permissions.fileSystem;
+        for (const path of files?.read || []) body.append(paragraph(`允许读取：${path}`));
+        for (const path of files?.write || []) body.append(paragraph(`允许写入：${path}`));
+        for (const entry of files?.entries || []) {
+          const path = entry.path?.path || entry.path?.pattern;
+          const action = { read: '允许读取', write: '允许写入', deny: '禁止访问' }[entry.access];
+          if (path && action) body.append(paragraph(`${action}：${path}`));
+        }
+        body.append(content(JSON.stringify(permissions, null, 2), '完整权限范围', true));
+      }
+      return body;
+    }
+    function decisionDescription(request, decision) {
+      if (decision === 'acceptForSession') return request.method === CodexServerRequests.file
+        ? '本次及本会话内对相同文件的后续修改无需再次询问。' : '本次及会话内匹配的后续操作无需再次询问，不是只允许这一次。';
+      if (decision?.applyNetworkPolicyAmendment) {
+        const rule = decision.applyNetworkPolicyAmendment.network_policy_amendment;
+        return `${rule.action === 'allow' ? '允许' : '禁止'}访问 ${rule.host}，并保存为后续网络规则。`;
+      }
+      return JSON.stringify(decision, null, 2);
+    }
+    const refresh = () => {
+      host.hidden = cards.size === 0;
+      for (const card of cards.values()) {
+        const status = card.request.status;
+        card.status.textContent = !connected ? '连接未恢复，暂不能操作' : card.error || (status === 'submitted' ? '决定已提交，等待工作站确认…' : status === 'unknown' ? '提交结果未确认，请检查工作站' : '等待你处理');
+        for (const control of card.form.querySelectorAll('button, input, textarea')) control.disabled = !connected || status !== 'pending' || card.busy;
+      }
+    };
+    const notifyPending = threadId => {
+      if (!threadId) return;
+      const pending = [...cards.values()].some(card => card.request.params.threadId === threadId
+        && card.request.status === 'pending');
+      pendingChanged(threadId, pending);
+    };
+    function create(request) {
+      const element = document.createElement('div'); element.className = 'approval-card';
+      const heading = document.createElement('strong');
+      const p = request.params;
+      heading.textContent = request.method === CodexServerRequests.input ? '需要你的回答'
+        : p.networkApprovalContext ? `允许连接 ${p.networkApprovalContext.host}？`
+        : p.reason?.trim() || (request.method === CodexServerRequests.file ? '允许修改以下文件？'
+          : request.method === CodexServerRequests.command
+            ? p.kind === 'writeStdin' ? '允许向正在运行的终端发送输入？'
+              : '允许执行此命令？'
+            : '需要你的批准');
+      const status = document.createElement('p'); status.setAttribute('role', 'status');
+      const detail = requestDetails(request);
+      const form = document.createElement('form');
+      const card = { element, status, detail, form, request, fileChangesKey: JSON.stringify(request.fileChanges), busy: false, error: '' };
+      const submit = async result => {
+        if (!connected || card.busy || card.request.status !== 'pending') return;
+        card.busy = true; card.error = '';
+        card.request = { ...card.request, status: 'submitted' };
+        notifyPending(card.request.params.threadId); refresh();
+        try { await respond(card.request, result); }
+        catch (error) {
+          card.request = { ...card.request, status: 'unknown' };
+          card.error = error.message;
+        } finally { notifyPending(card.request.params.threadId); refresh(); }
+      };
+      form.onsubmit = event => event.preventDefault();
+      if (request.method === CodexServerRequests.input) {
+        const inputs = (p.questions || []).map(q => {
+          const label = document.createElement('label'); label.textContent = q.question;
+          const input = document.createElement('input'); input.type = q.isSecret ? 'password' : 'text'; input.autocomplete = 'off';
+          label.append(input); form.append(label);
+          for (const option of q.options || []) {
+            const button = document.createElement('button'); button.type = 'button'; button.textContent = option.label;
+            button.title = option.description || ''; button.onclick = () => { input.value = option.label; }; form.append(button);
+          }
+          return { id: q.id, input };
+        });
+        const button = document.createElement('button'); button.textContent = '提交回答'; form.append(button);
+        form.onsubmit = event => { event.preventDefault(); submit({ answers: Object.fromEntries(inputs.map(({ id, input }) => [id, { answers: [input.value] }])) }); };
+      } else {
+        const choices = CodexServerRequests.decisions(request);
+        const actions = document.createElement('div'); actions.className = 'approval-actions';
+        for (const decision of choices) {
+          const button = document.createElement('button'); button.type = 'button';
+          button.textContent = typeof decision === 'string' ? titles[decision] || decision : decision.acceptWithExecpolicyAmendment ? '允许类似命令' : decision.applyNetworkPolicyAmendment ? '保存网络规则' : '应用所示决定';
+          button.onclick = () => submit({ decision });
+          if (decision === 'acceptForSession' || (typeof decision === 'object' && !decision.acceptWithExecpolicyAmendment)) {
+            const option = document.createElement('div'); option.className = 'approval-scope-option';
+            option.append(paragraph(decisionDescription(request, decision))); form.append(option);
+          }
+          actions.append(button);
+        }
+        if (choices.length) form.append(actions);
+        if (!choices.length) {
+          const unsupported = document.createElement('p'); unsupported.textContent = '此类请求暂不支持手机处理，请到工作站查看。'; form.append(unsupported);
+        }
+      }
+      const type = request.method === CodexServerRequests.input ? '问题'
+        : p.networkApprovalContext ? '互联网访问' : request.method === CodexServerRequests.file ? '编辑文件'
+          : request.method === CodexServerRequests.command ? '终端' : '请求权限';
+      element.append(paragraph(type, 'approval-kind'), heading, status, detail, form); return card;
+    }
+    return {
+      update(requests) {
+        const threadId = requests[0]?.params?.threadId || [...cards.values()][0]?.request.params.threadId;
+        const active = new Set();
+        for (const request of requests) {
+          const key = JSON.stringify([request.epoch, request.id]); active.add(key);
+          let card = cards.get(key);
+          if (!card) { card = create(request); cards.set(key, card); host.append(card.element); }
+          const fileChangesKey = JSON.stringify(request.fileChanges);
+          if (card.fileChangesKey !== fileChangesKey) {
+            card.detail.replaceChildren(...requestDetails(request).children); card.fileChangesKey = fileChangesKey;
+          }
+          card.request = request;
+        }
+        for (const [key, card] of cards) if (!active.has(key)) { card.element.remove(); cards.delete(key); }
+        notifyPending(threadId); refresh();
+      },
+      setConnected(value) { connected = value; refresh(); },
+      clear() { cards.clear(); host.replaceChildren(); refresh(); }
+    };
+  };
+})(globalThis);

package/dist/web/capabilities.js

@@ -0,0 +1,57 @@
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.CodexCapabilities = factory();
+})(globalThis, function () {
+  // Execution semantics belong to a connection/task, never to a client OS.
+  const profiles = {
+    'lan-legacy': { input: 'markdown-path', history: 'recent', settings: 'next-message', updates: 'snapshot-poll',
+      stop: 'none', queueOwner: 'bridge', desktopNavigation: true },
+    'lan-shared': { input: 'inline-image', history: 'paged', settings: 'immediate', updates: 'events',
+      stop: 'primary', queueOwner: 'codex', archive: true, approvals: true, desktopNavigation: true, syncBeforeWrite: true, sharedRecovery: true },
+    relay: { input: 'inline-image', history: 'paged', settings: 'immediate', updates: 'events',
+      stop: 'primary', queueOwner: 'codex', archive: true, approvals: true, syncBeforeWrite: true, historyCache: true, remoteImages: true, remoteFiles: true, managedConnection: true },
+    'app-server': { input: 'inline-image', history: 'recent', settings: 'next-message', updates: 'events',
+      stop: 'separate', queueOwner: 'bridge' },
+  };
+  const unknown = Object.freeze({ input: 'unknown', history: 'unknown', settings: 'unknown', updates: 'unknown',
+    stop: 'none', queueOwner: 'none' });
+  for (const profile of Object.values(profiles)) Object.freeze(profile);
+  Object.freeze(profiles);
+
+  function describe(mode) { return profiles[mode] || unknown; }
+  function has(mode, feature) {
+    const p = describe(mode);
+    switch (feature) {
+      case 'queue': return p.queueOwner !== 'none';
+      case 'nativeInput': return ['local-image', 'inline-image'].includes(p.input);
+      case 'primaryStop': return p.stop === 'primary';
+      case 'separateStop': return p.stop === 'separate';
+      case 'immediateSettings': return p.settings === 'immediate';
+      case 'pagedHistory': return p.history === 'paged';
+      case 'recentHistory': return p.history === 'recent';
+      case 'archive': return p.archive === true;
+      // The independent adapter keeps its existing snapshot-based UI contract.
+      case 'incrementalEvents': return p.updates === 'events' && mode !== 'app-server';
+      default: return p[feature] === true;
+    }
+  }
+
+  /** Support is stable; availability is recalculated for the current task. */
+  function actionState(mode, action, context = {}) {
+    const p = describe(mode);
+    const supported = action === 'interrupt' ? p.stop !== 'none'
+      : action === 'queue' ? has(mode, 'queue')
+      : action === 'settings' ? has(mode, 'immediateSettings')
+      : action === 'send' && p.input !== 'unknown';
+    if (!supported) return { visible: false, enabled: false, reason: '当前连接不支持此操作' };
+    if (context.connected === false) return { visible: true, enabled: false, reason: '连接尚未恢复' };
+    if (context.writable === false) return { visible: true, enabled: false, reason: context.readOnlyReason || '当前对话为只读' };
+    if (context.busy) return { visible: true, enabled: false, reason: '操作正在提交' };
+    if ((action === 'interrupt' || action === 'settings') && context.syncing) {
+      return { visible: true, enabled: false, reason: '请等待对话同步完成' };
+    }
+    if (action === 'interrupt' && !context.active) return { visible: true, enabled: false, reason: '当前没有运行中的轮次' };
+    return { visible: true, enabled: true, reason: '' };
+  }
+  return { describe, has, actionState };
+});