@walkhi/code-relax 0.1.0-beta.10 → 0.1.0-beta.101

package/dist/src/platform/windows/project-locations.mjs

@@ -0,0 +1,16 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import path from 'node:path';
+import { powershell } from './desktop-host.mjs';
+
+const exec = promisify(execFile);
+
+export async function projectLocations() {
+  const command = "[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false); $projectDocuments = [Environment]::GetFolderPath('MyDocuments'); $projectUserDirectory = [Environment]::GetFolderPath('UserProfile'); $projectDownloads = [Environment]::ExpandEnvironmentVariables((Get-ItemPropertyValue -LiteralPath 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders' -Name '{374DE290-123F-4565-9164-39C4925E467B}' -ErrorAction Stop)); $projectDriveRoots = @(Get-PSDrive -PSProvider FileSystem | ForEach-Object { $_.Root }); @{ documents = $projectDocuments; home = $projectUserDirectory; downloads = $projectDownloads; roots = $projectDriveRoots } | ConvertTo-Json -Compress";
+  const { stdout } = await exec(powershell, ['-NoProfile', '-NonInteractive', '-Command', command],
+    { windowsHide: true, encoding: 'utf8', timeout: 10000 });
+  const locations = JSON.parse(stdout);
+  if (!path.isAbsolute(locations.documents)) throw new Error('无法取得电脑的文档目录。');
+  if (!path.isAbsolute(locations.downloads)) throw new Error('无法取得电脑的下载目录。');
+  return { defaultParent: path.join(locations.documents, 'ChatGPT'), home: locations.home, downloads: locations.downloads, roots: locations.roots };
+}

package/dist/src/platform/windows/resident-start.js

@@ -0,0 +1,20 @@
+// Windows Script Host has no console. Keep the login task alive until the
+// short-lived CLI has handed the resident service to the background broker.
+if (WScript.Arguments.length !== 2) WScript.Quit(2);
+var shell = new ActiveXObject('WScript.Shell');
+var files = new ActiveXObject('Scripting.FileSystemObject');
+var node = WScript.Arguments.Item(0);
+var entry = WScript.Arguments.Item(1);
+if (!files.FileExists(node)) {
+  var directories = shell.Environment('PROCESS').Item('PATH').split(';');
+  node = '';
+  for (var i = 0; i < directories.length; i++) {
+    var directory = directories[i].replace(/^"|"$/g, '');
+    if (!directory) continue;
+    var candidate = files.BuildPath(directory, 'node.exe');
+    if (files.FileExists(candidate)) { node = candidate; break; }
+  }
+  if (!node) WScript.Quit(2);
+}
+var command = '"' + node + '" "' + entry + '" start --json';
+WScript.Quit(shell.Run(command, 0, true));

package/dist/src/platform/windows/resident-startup.ps1

@@ -1,20 +1,27 @@
-param([string]$NodePath, [string]$Entry, [ValidateSet('enable','disable','status')][string]$Action='status')
+param([string]$NodePath, [string]$Entry, [ValidateSet('enable','disable','status')][string]$Action='status')
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
 
-$taskName = 'Code Relax Bridge'
+$taskName = 'Code Relax 桌面服务'
+$legacyTaskName = 'Code Relax Bridge'
 $taskSource = '@walkhi/code-relax'
 $taskPath = '\' + $taskName
-$arguments = '"' + $Entry + '" start --json'
+$launcher = Join-Path $PSScriptRoot 'resident-start.js'
+$wscript = Join-Path $env:WINDIR 'System32\wscript.exe'
+$arguments = '//B //Nologo "' + $launcher + '" "' + $NodePath + '" "' + $Entry + '"'
 $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
 
 $scheduler = New-Object -ComObject 'Schedule.Service'
 $scheduler.Connect()
 $root = $scheduler.GetFolder('\')
 $registered = @($root.GetTasks(1) | Where-Object { $_.Name -eq $taskName } | Select-Object -First 1)
+$legacyRegistered = @($root.GetTasks(1) | Where-Object { $_.Name -eq $legacyTaskName } | Select-Object -First 1)
 if ($registered.Count -gt 0 -and $registered[0].Definition.RegistrationInfo.Source -ne $taskSource) {
     throw 'Scheduled task is not owned by this installation.'
 }
+if ($legacyRegistered.Count -gt 0 -and $legacyRegistered[0].Definition.RegistrationInfo.Source -ne $taskSource) {
+    throw 'Legacy scheduled task is not owned by this installation.'
+}
 
 # Remove only the legacy shortcut created by this package. A Startup LNK that
 # launches hidden PowerShell with ExecutionPolicy Bypass triggers AV heuristics.
@@ -30,9 +37,10 @@ if ($Action -ne 'status' -and $legacyExists) {
 }
 
 if ($Action -eq 'enable') {
-    if (-not (Test-Path -LiteralPath $NodePath) -or -not (Test-Path -LiteralPath $Entry)) { throw 'Installed runtime is missing.' }
+    if (-not (Test-Path -LiteralPath $NodePath) -or -not (Test-Path -LiteralPath $Entry) -or
+        -not (Test-Path -LiteralPath $launcher) -or -not (Test-Path -LiteralPath $wscript)) { throw 'Installed runtime is missing.' }
     $definition = $scheduler.NewTask(0)
-    $definition.RegistrationInfo.Description = 'Start the Code Relax Bridge when this user signs in.'
+    $definition.RegistrationInfo.Description = 'Start the Code Relax desktop service when this user signs in.'
     $definition.RegistrationInfo.Source = $taskSource
     $definition.Principal.UserId = $currentUser
     $definition.Principal.LogonType = 3 # TASK_LOGON_INTERACTIVE_TOKEN
@@ -48,20 +56,28 @@ if ($Action -eq 'enable') {
     $trigger.UserId = $currentUser
     $trigger.Enabled = $true
     $exec = $definition.Actions.Create(0) # TASK_ACTION_EXEC
-    $exec.Path = $NodePath
+    $exec.Path = $wscript
     $exec.Arguments = $arguments
     $exec.WorkingDirectory = $env:USERPROFILE
     [void]$root.RegisterTaskDefinition($taskName, $definition, 6, $null, $null, 3, $null) # TASK_CREATE_OR_UPDATE
-} elseif ($Action -eq 'disable' -and $registered.Count -gt 0) {
-    $root.DeleteTask($taskName, 0)
+    if ($legacyRegistered.Count -gt 0) { $root.DeleteTask($legacyTaskName, 0) }
+} elseif ($Action -eq 'disable') {
+    if ($registered.Count -gt 0) { $root.DeleteTask($taskName, 0) }
+    if ($legacyRegistered.Count -gt 0) { $root.DeleteTask($legacyTaskName, 0) }
 }
 if ($Action -ne 'status' -and $legacyExists) { Remove-Item -LiteralPath $legacyPath }
 
 $active = @($root.GetTasks(1) | Where-Object { $_.Name -eq $taskName } | Select-Object -First 1)
 $taskEnabled = $active.Count -gt 0 -and $active[0].Enabled
+$taskCurrent = $false
+if ($taskEnabled) {
+    $taskAction = $active[0].Definition.Actions.Item(1)
+    $taskCurrent = $taskAction.Path -ieq $wscript -and $taskAction.Arguments -ieq $arguments
+}
 @{
-    enabled=($taskEnabled -or ($Action -eq 'status' -and $legacyExists))
-    path=$(if ($taskEnabled) { 'Task Scheduler:' + $taskPath } elseif ($legacyExists) { $legacyPath } else { 'Task Scheduler:' + $taskPath })
+    enabled=($taskCurrent -and $legacyRegistered.Count -eq 0)
+    taskPresent=$taskEnabled
+    path=$(if ($taskEnabled) { 'Task Scheduler:' + $taskPath } elseif ($legacyRegistered.Count -gt 0) { 'Task Scheduler:\' + $legacyTaskName } elseif ($legacyExists) { $legacyPath } else { 'Task Scheduler:' + $taskPath })
     scope='current-user-logon'
-    mechanism=$(if ($taskEnabled) { 'task-scheduler' } elseif ($legacyExists) { 'legacy-startup-shortcut' } else { 'task-scheduler' })
+    mechanism=$(if ($taskCurrent -and $legacyRegistered.Count -eq 0) { 'task-scheduler' } elseif ($taskEnabled -or $legacyRegistered.Count -gt 0) { 'stale-task-scheduler' } elseif ($legacyExists) { 'legacy-startup-shortcut' } else { 'task-scheduler' })
 } | ConvertTo-Json -Compress

package/dist/src/platform/windows/rustdesk-video-probe.mjs

@@ -0,0 +1,168 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { brotliDecompressSync } from 'node:zlib';
+
+export const RUSTDESK_PROBE_HOST_SHA256 = '8555777215510d83d2d61c9dc984e4fcc838bd7e79f9d18a42585431f5e8bb47';
+const leaseMs = 60_000;
+const pause = ms => new Promise(resolve => setTimeout(resolve, ms));
+const failure = code => Object.assign(new Error('桌面视频测试尚未就绪'), { code, statusCode: 503 });
+
+// The official EXE is a launcher. Extract its verified Brotli payload into our
+// own runtime directory and launch the actual process, so leases own its PID.
+export function prepareRustDeskProbeHost(root) {
+  const bytes = fs.readFileSync(path.join(root, 'rustdesk-1.5.0-x86_64.exe'));
+  if (crypto.createHash('sha256').update(bytes).digest('hex') !== RUSTDESK_PROBE_HOST_SHA256) throw failure('desktop_video_host_hash');
+  const magic = Buffer.from('rustdesk'), decoder = new TextDecoder('utf-8', { fatal: true });
+  let search = 0, entries;
+  while (search < bytes.length) {
+    const at = bytes.indexOf(magic, search); if (at < 0) break; search = at + magic.length;
+    try {
+      let offset = at + magic.length; const files = [];
+      while (!bytes.subarray(offset, offset + magic.length).equals(magic)) {
+        const length = bytes.readUInt32BE(offset); offset += 4;
+        if (length < 1 || length > 512) throw new Error('payload');
+        const name = decoder.decode(bytes.subarray(offset, offset + length)).replaceAll('\\', '/'); offset += length;
+        if (/[\x00-\x1f]/.test(name) || path.posix.isAbsolute(name) || name.includes(':') || name.split('/').includes('..')) throw new Error('payload_path');
+        const size = bytes.readUInt32BE(offset); offset += 4;
+        if (size < 1 || offset + size + 32 > bytes.length) throw new Error('payload');
+        const data = bytes.subarray(offset, offset + size); offset += size;
+        const md5 = bytes.subarray(offset, offset + 32).toString(); offset += 32;
+        if (!/^[a-f0-9]{32}$/.test(md5)) throw new Error('payload');
+        files.push({ name: path.posix.normalize(name), data, md5 });
+        if (files.length > 5000) throw new Error('payload');
+      }
+      if (files.length !== 104 || !files.some(file => file.name === 'rustdesk.exe')) continue;
+      const suffix = Buffer.from('.\\rustdesk.exe');
+      if (!bytes.subarray(offset + 8, offset + 8 + suffix.length).equals(suffix)) continue;
+      entries = files; break;
+    } catch { /* Non-payload occurrences of the ASCII magic are expected in PE strings. */ }
+  }
+  if (!entries) throw failure('desktop_video_host_payload');
+  const runtime = path.resolve(root, 'runtime');
+  for (const file of entries) {
+    const target = path.resolve(runtime, file.name);
+    if (!target.startsWith(runtime + path.sep)) throw failure('desktop_video_host_path');
+    let existing;
+    try { existing = crypto.createHash('md5').update(fs.readFileSync(target)).digest('hex'); } catch {}
+    if (existing === file.md5) continue;
+    const data = brotliDecompressSync(file.data, { maxOutputLength: 128 * 1024 * 1024 });
+    if (crypto.createHash('md5').update(data).digest('hex') !== file.md5) throw failure('desktop_video_host_payload');
+    fs.mkdirSync(path.dirname(target), { recursive: true }); fs.writeFileSync(target, data);
+  }
+  return path.join(runtime, 'rustdesk.exe');
+}
+
+// A read-only, LAN-only prototype. The normal desktop helper and input path are independent.
+export class RustDeskVideoProbe {
+  constructor({ stateRoot, appData = process.env.APPDATA, platform = process.platform } = {}) {
+    this.platform = platform;
+    this.root = path.join(stateRoot, 'desktop-video-probe');
+    this.configRoot = path.join(appData || os.tmpdir(), 'RustDesk', 'config');
+    this.process = null; this.lease = null; this.timer = null; this.starting = false; this.stopped = Promise.resolve(); this.preparedExecutable = null;
+  }
+  configuration(port, password) {
+    const options = {
+      'direct-server': 'Y', 'direct-access-port': String(port),
+      'custom-rendezvous-server': '127.0.0.1:9', 'relay-server': '127.0.0.1:9', 'api-server': 'http://127.0.0.1:9',
+      'enable-hwcodec': 'N', 'access-mode': 'view', 'approve-mode': 'password', 'verification-method': 'use-permanent-password',
+      'enable-keyboard': 'N', 'enable-clipboard': 'N', 'enable-file-transfer': 'N', 'enable-audio': 'N',
+      'enable-tunnel': 'N', 'enable-terminal': 'N', 'enable-record-session': 'N',
+      'allow-auto-record-incoming': 'N', 'allow-auto-record-outgoing': 'N'
+    };
+    return {
+      main: `password = '${password}'\nsalt = '${crypto.randomBytes(16).toString('hex')}'\n`,
+      secondary: "rendezvous_server = '127.0.0.1:9'\n\n[options]\n" + Object.entries(options).map(([key, value]) => `${key} = '${value}'`).join('\n') + '\n'
+    };
+  }
+  async begin() {
+    if (this.platform !== 'win32') throw failure('desktop_video_platform');
+    if (this.starting || this.lease) throw failure('desktop_video_busy');
+    this.starting = true;
+    try {
+      await this.stopped;
+      const executable = path.join(this.root, 'rustdesk-1.5.0-x86_64.exe');
+      let binary;
+      try { binary = fs.readFileSync(executable); } catch { throw failure('desktop_video_host_missing'); }
+      if (crypto.createHash('sha256').update(binary).digest('hex') !== RUSTDESK_PROBE_HOST_SHA256) throw failure('desktop_video_host_hash');
+      const ownerFile = path.join(this.root, 'config-owner.json');
+      let owner;
+      try { owner = JSON.parse(fs.readFileSync(ownerFile, 'utf8')); } catch {}
+      const entries = fs.existsSync(this.configRoot) ? fs.readdirSync(this.configRoot) : [];
+      if (entries.length && (owner?.configRoot !== this.configRoot || !owner.hashes
+        || JSON.stringify(owner.hashes) !== JSON.stringify(this.configHashes()))) throw failure('desktop_video_existing_rustdesk');
+      const port = await new Promise((resolve, reject) => {
+        const server = net.createServer(); server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => { const port = server.address().port; server.close(error => error ? reject(error) : resolve(port)); });
+      });
+      const actualExecutable = this.preparedExecutable ||= prepareRustDeskProbeHost(this.root);
+      const password = crypto.randomBytes(24).toString('hex'), leaseId = crypto.randomBytes(16).toString('hex');
+      const config = this.configuration(port, password);
+      fs.mkdirSync(this.root, { recursive: true, mode: 0o700 });
+      fs.mkdirSync(this.configRoot, { recursive: true, mode: 0o700 });
+      fs.writeFileSync(path.join(this.configRoot, 'RustDesk.toml'), config.main, { mode: 0o600 });
+      fs.writeFileSync(path.join(this.configRoot, 'RustDesk2.toml'), config.secondary, { mode: 0o600 });
+      this.saveOwner();
+      this.process = spawn(actualExecutable, ['--server'], { cwd: path.dirname(actualExecutable),
+        env: { ...process.env, RUSTDESK_APPNAME: 'rustdesk-1.5.0-x86_64.exe' }, windowsHide: true, stdio: 'ignore' });
+      const child = this.process; let launchError = false;
+      console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'spawn', pid: child.pid }));
+      this.stopped = new Promise(resolve => {
+        let ended = false;
+        const finished = () => {
+          console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'exit', pid: child.pid, code: child.exitCode }));
+          if (ended) return; ended = true;
+          try { this.saveOwner(); } catch { console.error(JSON.stringify({ event: 'desktop-video-owner', state: 'failed' })); }
+          if (this.process === child) { clearTimeout(this.timer); this.process = null; this.lease = null; }
+          resolve();
+        };
+        child.once('error', () => { launchError = true; finished(); });
+        child.once('exit', finished);
+      });
+      const deadline = Date.now() + 8_000;
+      let ready = false;
+      while (Date.now() < deadline && child.exitCode === null && !launchError) {
+        ready = await new Promise(resolve => {
+          const socket = net.connect({ host: '127.0.0.1', port });
+          let settled = false;
+          const finish = value => { if (settled) return; settled = true; socket.destroy(); resolve(value); };
+          socket.once('connect', () => finish(true)); socket.once('error', () => finish(false)); socket.setTimeout(300, () => finish(false));
+        });
+        if (ready) break;
+        await pause(150);
+      }
+      if (!ready) throw failure('desktop_video_host_start');
+      this.lease = { leaseId, password, port, codec: 'vp9', fps: 5, viewOnly: true };
+      console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'ready', pid: child.pid }));
+      this.renew(leaseId);
+      return { ...this.lease, engine: 'rustdesk-probe', expiresInMs: leaseMs };
+    } catch (error) { this.stop(); throw error; }
+    finally { this.starting = false; }
+  }
+  configHashes() {
+    return ['RustDesk.toml', 'RustDesk2.toml'].map(name => {
+      try { return crypto.createHash('sha256').update(fs.readFileSync(path.join(this.configRoot, name))).digest('hex'); }
+      catch { return ''; }
+    });
+  }
+  saveOwner() {
+    fs.writeFileSync(path.join(this.root, 'config-owner.json'), JSON.stringify({ configRoot: this.configRoot, hashes: this.configHashes() }), { mode: 0o600 });
+  }
+  renew(leaseId) {
+    if (!this.lease || leaseId !== this.lease.leaseId) throw failure('desktop_video_lease');
+    clearTimeout(this.timer); this.timer = setTimeout(() => this.stop(), leaseMs); this.timer.unref();
+    return { active: true, expiresInMs: leaseMs };
+  }
+  release(leaseId) {
+    if (this.lease?.leaseId === leaseId) this.stop();
+    return { released: true };
+  }
+  stop() {
+    clearTimeout(this.timer); this.timer = null;
+    const child = this.process; this.process = null; this.lease = null;
+    if (child && child.exitCode === null) child.kill();
+  }
+}

package/dist/src/platform/windows/service-host.mjs

@@ -3,38 +3,33 @@ import { promisify } from 'node:util';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import fs from 'node:fs';
-import { runtimePaths } from './runtime-paths.mjs';
-import { readRecord } from '../../service-lifecycle.mjs';
-import { lanNetworks } from './network-info.mjs';
+import { runtimePaths } from './runtime-paths.mjs';
+import { readRecord } from '../../service-lifecycle.mjs';
+import { readManagedEndpoint } from '../../managed-endpoint.mjs';
+import { lanNetworks } from './network-info.mjs';
 
 const exec = promisify(execFile);
 const bridgeRoot = fileURLToPath(new URL('../../../', import.meta.url));
-async function detect(script) {
+async function detect(script, args = []) {
   const executable = path.join(process.env.SystemRoot, 'System32/WindowsPowerShell/v1.0/powershell.exe');
   const { stdout } = await exec(executable, ['-NoProfile', '-NonInteractive', '-File',
-    path.join(bridgeRoot, script)], { windowsHide: true, encoding: 'utf8' });
+    path.join(bridgeRoot, script), ...args], { windowsHide: true, encoding: 'utf8' });
   return stdout.trim();
 }
 
 // Windows-only network metadata stays here, outside the lifecycle implementation.
-export const sharedServiceUrl = () => detect('get-shared-service-url.ps1');
-export const lanAddress = async () => (await lanNetworks())[0]?.address || '';
-export { lanNetworks };
-export function migrateState(stateRoot) {
-  fs.mkdirSync(stateRoot, { recursive: true });
-  for (const name of ['bridge-config.json', 'bridge-session.json']) {
-    const target = path.join(stateRoot, name);
-    const old = path.join(bridgeRoot, '../.codex/bridge', name);
-    if (!fs.existsSync(target) && fs.existsSync(old)) fs.copyFileSync(old, target, fs.constants.COPYFILE_EXCL);
-  }
-}
-export async function bridgeEnvironment() {
-  const environment = { ...process.env };
-  const installation = readRecord(path.join(runtimePaths(environment).serviceRoot, 'installation.json'));
+export const sharedServiceUrl = () => {
+  const url = readManagedEndpoint(runtimePaths().stateRoot);
+  return url ? detect('get-shared-service-url.ps1', ['-AppServerUrl', url]) : '';
+};
+export const lanAddress = async () => (await lanNetworks())[0]?.address || '';
+export { lanNetworks };
+export async function bridgeEnvironment() {
+  const environment = { ...process.env };
+  const installation = readRecord(path.join(runtimePaths(environment).serviceRoot, 'installation.json'));
   const executable = installation?.nodeExecutable;
-  if (!executable || !fs.existsSync(executable)) throw new Error('安装时选用的 Node 不存在，请重新安装 Code Relax。');
+  if (!executable || !fs.existsSync(executable)) throw new Error('安装时选用的 Node 不存在，请重新安装 Code Relax。');
   environment.CODEX_MCP_NODE_PATH = executable;
-  environment.CODEX_REMOTE_LEGACY_UPLOADS_ROOTS = JSON.stringify(installation.legacyUploadsRoots || []);
-  delete environment.CODEX_APP_TOOLS_PIPE_PATH;
+  delete environment.CODEX_APP_TOOLS_PIPE_PATH;
   return { executable, environment };
 }

package/dist/src/platform/windows/start-hidden-console.ps1

@@ -1,6 +1,7 @@
 $ErrorActionPreference = 'Stop'
 [Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false)
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$brokerStarted = $false
 try {
     $spec = [Console]::In.ReadToEnd() | ConvertFrom-Json
     # WMI owns this launch, not the caller's kill-on-close Desktop job hierarchy.
@@ -13,10 +14,15 @@ try {
     $request = Join-Path $launchRoot ($instance + '.request.json')
     $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
     $spec | Add-Member -NotePropertyName instance -NotePropertyValue $instance
-    $spec | Add-Member -NotePropertyName diagnostic -NotePropertyValue $diagnostic
     $requestTemporary = $request + '.tmp'
     [IO.File]::WriteAllText($requestTemporary, ($spec | ConvertTo-Json -Compress -Depth 10), (New-Object Text.UTF8Encoding($false)))
     [IO.File]::Move($requestTemporary, $request)
+    # MSIX can redirect a newly written file even when its existing parent
+    # resolves outside the package. Resolve the file handle, not just the folder.
+    $request = [IsolatedProcess]::ResolvePath($request)
+    $launchRoot = [IO.Path]::GetDirectoryName($request)
+    $ready = Join-Path $launchRoot ($instance + '.json')
+    $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
     $startup = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
         ShowWindow=[uint16]0; CreateFlags=[uint32]0x1000010
     }
@@ -26,6 +32,7 @@ try {
         CommandLine=$command; CurrentDirectory=$env:USERPROFILE; ProcessStartupInformation=$startup
     }
     if ($broker.ReturnValue -ne 0) { throw ('Windows process broker failed: ' + $broker.ReturnValue) }
+    $brokerStarted = $true
     $deadline = [DateTime]::UtcNow.AddSeconds(30)
     while (-not (Test-Path -LiteralPath $ready)) {
         if ([DateTime]::UtcNow -gt $deadline) {
@@ -44,6 +51,8 @@ try {
     [Console]::Error.WriteLine($_.Exception.Message)
     exit 1
 } finally {
-    if ($request -and (Test-Path -LiteralPath $request)) { Remove-Item -LiteralPath $request -Force }
+    # Once launched, the worker owns consumption. A slow broker must not lose
+    # its request merely because this caller timed out; never launch a retry.
+    if (-not $brokerStarted -and $request -and (Test-Path -LiteralPath $request)) { Remove-Item -LiteralPath $request -Force }
     if ($requestTemporary -and (Test-Path -LiteralPath $requestTemporary)) { Remove-Item -LiteralPath $requestTemporary -Force }
 }

package/dist/src/platform/windows/user-environment.mjs

@@ -1,50 +1,56 @@
-import path from 'node:path';
-import fs from 'node:fs';
-import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
-import { runScript } from './desktop-host.mjs';
-import { managedAppServerUrl } from '../../managed-app-server.mjs';
-
-const ownershipFile = 'managed-environment.json';
-
-export async function readManagedEnvironment() {
-  return JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Read']));
-}
-
-export async function configureManagedEnvironment(stateRoot) {
-  const current = await readManagedEnvironment();
-  const ownershipPath = path.join(stateRoot, ownershipFile);
-  const ownership = readRecord(ownershipPath);
-  if (current.forceCliUser === '1' || current.forceCliMachine === '1') {
-    throw new Error('CODEX_APP_SERVER_FORCE_CLI=1 会让 Codex 忽略受管 app-server；未修改该配置。');
-  }
-  if (current.userValue && current.userValue !== managedAppServerUrl) {
-    throw new Error(`用户已有 CODEX_APP_SERVER_WS_URL=${current.userValue}；未覆盖该配置。`);
-  }
-  if (current.userValue === managedAppServerUrl) {
-    const owned = ownership?.value === managedAppServerUrl;
-    return { configured: true, value: current.userValue, changed: false, owned };
-  }
-  const applied = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Set', '-Value', managedAppServerUrl]));
-  writeRecord(ownershipPath, { name: 'CODEX_APP_SERVER_WS_URL', value: managedAppServerUrl,
-    configuredAt: new Date().toISOString() });
-  return { configured: true, value: applied.userValue, changed: true, owned: true };
-}
-
-export async function clearManagedEnvironment(stateRoot) {
-  const ownershipPath = path.join(stateRoot, ownershipFile);
-  const ownership = readRecord(ownershipPath);
-  const current = await readManagedEnvironment();
-  if (!current.userValue) {
-    fs.rmSync(ownershipPath, { force: true });
-    return { removed: false, preserved: false, reason: 'already-empty' };
-  }
-  if (ownership?.value !== managedAppServerUrl || current.userValue !== managedAppServerUrl) {
-    fs.rmSync(ownershipPath, { force: true });
-    return { removed: false, preserved: true, value: current.userValue,
-      reason: ownership?.value === managedAppServerUrl ? 'user-modified' : 'not-owned' };
-  }
-  const result = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Clear']));
-  if (result.userValue) throw new Error('CODEX_APP_SERVER_WS_URL 清理后读回仍不为空。');
-  fs.rmSync(ownershipPath, { force: true });
-  return { removed: true, preserved: false, reason: 'removed' };
-}
+import path from 'node:path';
+import fs from 'node:fs';
+import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
+import { runScript } from './desktop-host.mjs';
+import { managedEndpointUrl } from '../../managed-endpoint.mjs';
+import { configureDesktopBrowserEnvironment, restoreDesktopBrowserEnvironment } from './desktop-browser-environment.mjs';
+
+const ownershipFile = 'managed-environment.json';
+
+export async function readManagedEnvironment() {
+  return JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Read']));
+}
+
+export async function configureManagedEnvironment(stateRoot, url) {
+  const current = await readManagedEnvironment();
+  if (!managedEndpointUrl(url)) throw new Error('未确认 Codex 内核地址，未修改环境变量。');
+  const ownershipPath = path.join(stateRoot, ownershipFile);
+  const ownership = readRecord(ownershipPath);
+  if (current.forceCliUser === '1' || current.forceCliMachine === '1') {
+    throw new Error('CODEX_APP_SERVER_FORCE_CLI=1 会让 Codex 忽略当前内核地址；未修改该配置。');
+  }
+  if (current.userValue && current.userValue !== url && current.userValue !== ownership?.value) {
+    throw new Error(`用户已有 CODEX_APP_SERVER_WS_URL=${current.userValue}；未覆盖该配置。`);
+  }
+  if (current.userValue === url) {
+    await configureDesktopBrowserEnvironment(stateRoot);
+    const owned = ownership?.value === url;
+    return { configured: true, value: current.userValue, changed: false, owned };
+  }
+  const applied = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Set', '-Value', url]));
+  if (applied.userValue !== url) throw new Error('CODEX_APP_SERVER_WS_URL 写入后读回不一致。');
+  writeRecord(ownershipPath, { name: 'CODEX_APP_SERVER_WS_URL', value: url,
+    configuredAt: new Date().toISOString() });
+  await configureDesktopBrowserEnvironment(stateRoot);
+  return { configured: true, value: applied.userValue, changed: true, owned: true };
+}
+
+export async function clearManagedEnvironment(stateRoot) {
+  await restoreDesktopBrowserEnvironment(stateRoot);
+  const ownershipPath = path.join(stateRoot, ownershipFile);
+  const ownership = readRecord(ownershipPath);
+  const current = await readManagedEnvironment();
+  if (!current.userValue) {
+    fs.rmSync(ownershipPath, { force: true });
+    return { removed: false, preserved: false, reason: 'already-empty' };
+  }
+  if (!managedEndpointUrl(ownership?.value) || current.userValue !== ownership.value) {
+    fs.rmSync(ownershipPath, { force: true });
+    return { removed: false, preserved: true, value: current.userValue,
+      reason: managedEndpointUrl(ownership?.value) ? 'user-modified' : 'not-owned' };
+  }
+  const result = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Clear']));
+  if (result.userValue) throw new Error('CODEX_APP_SERVER_WS_URL 清理后读回仍不为空。');
+  fs.rmSync(ownershipPath, { force: true });
+  return { removed: true, preserved: false, reason: 'removed' };
+}

package/dist/src/platform/windows/user-environment.ps1

@@ -1,10 +1,11 @@
-param(
+param(
     [ValidateSet('Read', 'Set', 'Clear')][string]$Action = 'Read',
-    [string]$Value = ''
+    [string]$Value = '',
+    [ValidateSet('CODEX_APP_SERVER_WS_URL', 'CODEX_APP_SERVER_USE_LOCAL_DAEMON')]
+    [string]$Name = 'CODEX_APP_SERVER_WS_URL'
 )
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-$name = 'CODEX_APP_SERVER_WS_URL'
 
 function Broadcast-EnvironmentChange {
     if (-not ('CodeRelax.EnvironmentBroadcast' -as [type])) {

package/dist/src/project-create.mjs

@@ -0,0 +1,121 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { projectRoots, projectSummary } from './project-management.mjs';
+import { projectLocations } from './platform/project-locations.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const uuid = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+const fail = message => { throw Object.assign(new Error(message), { statusCode: 400 }); };
+const pathKey = value => process.platform === 'win32' ? path.normalize(value).toLowerCase() : path.normalize(value);
+
+function defaultName(name) {
+  let value = path.basename(name).trim().replace(/[<>:"/\\|?*\x00-\x1f]/g, '_').replace(/[ .]+$/g, '') || 'New project';
+  if (/^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(value)) value = `_${value}`;
+  return value;
+}
+
+export async function createWorkstationProject(server, stateRoot, codexDataRoot, body, dependencies = {}) {
+  if (!uuid.test(body.idempotencyKey || '')) fail('项目创建标识无效。');
+  const name = typeof body.name === 'string' ? body.name.trim() : '';
+  if (!name) fail('请输入项目名称。');
+  if (!Array.isArray(body.roots) || body.roots.some(root => typeof root?.path !== 'string' || !path.isAbsolute(root.path.trim()))) {
+    fail('项目文件夹路径无效。');
+  }
+  const roots = body.roots.map(root => ({ path: path.normalize(root.path.trim()) }));
+  const signature = createHash('sha256').update(JSON.stringify({ name, roots })).digest('hex');
+  const directory = path.join(stateRoot, 'project-create-operations');
+  const record = path.join(directory, `${body.idempotencyKey}.json`);
+  const running = pending.get(record);
+  if (running) {
+    if (running.signature !== signature) fail('同一个创建请求不能修改项目名称或目录。');
+    return running.promise;
+  }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { signature, promise });
+  return promise;
+
+  async function perform() {
+    await fs.mkdir(directory, { recursive: true });
+    let operation = readRecord(record);
+    if (operation && operation.signature !== signature) fail('项目创建标识已用于其他内容，请重新打开项目编辑器。');
+    if (operation?.result) return operation.result;
+    operation ||= { signature, name, roots };
+    const save = () => writeRecord(record, operation);
+    const rpc = (method, params) => server.request(method, params);
+    const register = dependencies.registration || withDesktopProjectRegistration;
+    try {
+      return await register({ stateRoot, codexDataRoot, operationId: body.idempotencyKey,
+        confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+        // The restart confirmation and state checks happen before any
+        // directory or project write. Existing folders are never moved or copied.
+        let validatedRoots;
+        if (!operation.resolvedRoots) {
+          validatedRoots = await projectRoots(rpc, roots);
+          operation.resolvedRoots = validatedRoots;
+          if (!operation.resolvedRoots.length) {
+            const locations = await (dependencies.locations || projectLocations)();
+            await rpc('fs/createDirectory', { path: locations.defaultParent, recursive: true });
+            const entries = (await rpc('fs/readDirectory', { path: locations.defaultParent })).entries;
+            const names = new Set(entries.map(entry => entry.fileName.toLowerCase()));
+            const base = defaultName(name);
+            let folder = base;
+            for (let suffix = 2; names.has(folder.toLowerCase()); suffix++) folder = `${base} ${suffix}`;
+            operation.defaultDirectory = path.join(locations.defaultParent, folder);
+            operation.resolvedRoots = [{ path: operation.defaultDirectory }];
+          }
+          save();
+        }
+        if (operation.defaultDirectory && !operation.directoryCreated) {
+          if (operation.directoryAttempted) {
+            // On an explicit retry, keep the originally allocated directory. Never
+            // allocate another name after an interrupted createDirectory response.
+            await projectRoots(rpc, operation.resolvedRoots);
+          } else {
+            operation.directoryAttempted = true; save();
+            await rpc('fs/createDirectory', { path: operation.defaultDirectory, recursive: false });
+          }
+          operation.directoryCreated = true; save();
+          try {
+            const result = await rpc('command/exec', { command: ['git', 'init'], cwd: operation.defaultDirectory, timeoutMs: 10000 });
+            if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout || `退出码 ${result.exitCode}`);
+          } catch (error) { operation.gitWarning = `项目目录已创建，Git 初始化未完成：${error.message}`; save(); }
+        }
+        const resolvedRoots = validatedRoots?.length ? validatedRoots : await projectRoots(rpc, operation.resolvedRoots);
+        if (!operation.projectId) {
+          operation.createAttempted = true; save();
+          // Native project/create owns idempotency; a retry uses this exact key
+          // and original roots on the same server, never a second transport.
+          const created = await rpc('project/create', { name, roots: resolvedRoots, idempotencyKey: body.idempotencyKey });
+          operation.projectId = created.project.id; save();
+        }
+        const { project } = await rpc('project/read', { projectId: operation.projectId });
+        if (project.id !== operation.projectId || project.name !== name || project.roots.length !== resolvedRoots.length
+          || project.roots.some((root, index) => pathKey(root.path) !== pathKey(resolvedRoots[index].path))) {
+          throw new Error('已创建项目的名称或目录发生变化，未覆盖其内容。');
+        }
+        if (!operation.ordered) {
+          const first = (await rpc('project/list', { limit: 1, sortKey: 'position', sortDirection: 'asc' })).data[0];
+          if (first && first.id !== project.id) await rpc('project/move', { projectId: project.id, beforeProjectId: first.id });
+          operation.ordered = true; save();
+        }
+        const desktopRegistration = await desktop.register(project, operation, save);
+        operation.result = { project: projectSummary(project), desktopRegistration,
+          ...(operation.gitWarning ? { warning: operation.gitWarning } : {}) };
+        save();
+        return operation.result;
+      });
+    } catch (error) {
+      if (operation.projectId || operation.createAttempted || operation.directoryAttempted) {
+        error.details = { ...error.details, projectCreationPending: true,
+          ...(operation.projectId ? { createdProjectId: operation.projectId } : {}) };
+        error.message += operation.projectId
+          ? ' 项目已创建，请继续完成桌面登记；会沿用同一项目，不会重复创建。'
+          : ' 请继续核对本次创建；会沿用原请求标识和目录。';
+      } else error.details = { ...error.details, projectCreationPending: false };
+      throw error;
+    }
+  }
+}