@walkhi/code-relax 0.1.0-beta.29 → 0.1.0-beta.30

package/dist/src/platform/windows/desktop-helper.mjs

@@ -0,0 +1,179 @@
+import net from 'node:net';
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const exec = promisify(execFile);
+const binary = fileURLToPath(new URL('../../../native/desktop-helper/CodeRelaxDesktop.exe', import.meta.url));
+const powershell = path.join(process.env.SystemRoot || 'C:/Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe');
+const quote = value => `'${String(value).replaceAll("'", "''")}'`;
+const encoded = script => Buffer.from(script, 'utf16le').toString('base64');
+const maxFrameBytes = 6 * 1024 * 1024;
+
+export async function desktopHelperStatus() {
+  if (process.platform !== 'win32' || !fs.existsSync(binary)) return { installed: false, running: false, state: 'unavailable' };
+  const { stdout } = await exec(binary, ['--status'], { windowsHide: true, encoding: 'utf8', timeout: 5000 });
+  const result = JSON.parse(stdout.trim());
+  if (result.error) throw new Error(result.error);
+  return result;
+}
+
+async function elevateHelper(argument) {
+  const script = `$ErrorActionPreference = 'Stop'; try { $child = Start-Process -FilePath ${quote(binary)} -ArgumentList ${quote(argument)} -Verb RunAs -PassThru -Wait; exit $child.ExitCode } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }`;
+  try { await exec(powershell, ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded(script)], { windowsHide: true, timeout: 180000 }); }
+  catch (error) { throw new Error(`桌面操作辅助服务配置未完成，需要在工作站确认 UAC：${error.stderr?.trim() || error.message}`); }
+}
+
+export async function removeDesktopHelper() {
+  const current = await desktopHelperStatus();
+  if (!current.installed) return { installed: false, removed: false };
+  await elevateHelper('--remove');
+  const result = await desktopHelperStatus();
+  if (result.installed) throw new Error('桌面操作辅助服务尚未移除。');
+  return { ...result, removed: true };
+}
+
+export async function installDesktopHelper() {
+  if (!fs.existsSync(binary)) throw new Error('缺少原生 桌面操作辅助组件，请先构建或安装完整 npm 包。');
+  const { stdout } = await exec(powershell, ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded('[Console]::OutputEncoding = New-Object Text.UTF8Encoding; [Security.Principal.WindowsIdentity]::GetCurrent().User.Value')], { windowsHide: true, encoding: 'utf8' });
+  const sid = stdout.trim();
+  if (!/^S-1-5-21-(?:\d+-){3}\d+$/.test(sid)) throw new Error('无法获取当前 Windows 用户 SID。');
+  const current = await desktopHelperStatus();
+  const hash = target => createHash('sha256').update(fs.readFileSync(target)).digest('hex');
+  if (current.running && current.userSid === sid && hash(binary) === hash(current.path)) return { ...current, changed: false };
+  // Only this installer is elevated. Node and the workstation remain user-level.
+  await elevateHelper(`--install ${sid}`);
+  const installed = await desktopHelperStatus();
+  if (!installed.running || installed.userSid !== sid) throw new Error('桌面操作辅助服务尚未就绪。');
+  return { ...installed, changed: true };
+}
+
+class PipeSession {
+  constructor() {
+    this.socket = net.createConnection('\\\\.\\pipe\\CodeRelax.Desktop.v1');
+    this.socket.setEncoding('utf8');
+    this.buffer = '';
+    this.waiter = null;
+    this.closed = false;
+    this.socket.on('data', data => {
+      this.buffer += data;
+      if (Buffer.byteLength(this.buffer) > maxFrameBytes) { this.fail(new Error('桌面画面超过大小限制')); return; }
+      const end = this.buffer.indexOf('\n');
+      if (end < 0) return;
+      try {
+        const result = JSON.parse(this.buffer.slice(0, end));
+        this.buffer = this.buffer.slice(end + 1);
+        if (!this.waiter) throw new Error('收到未请求的 桌面数据');
+        const waiter = this.waiter; this.waiter = null; clearTimeout(waiter.timer);
+        const complete = () => result.error
+          ? waiter.reject(Object.assign(new Error(result.error), { code: 'desktop_native_error' })) : waiter.resolve(result);
+        if (result.state === 'pending' || result.continuing === true) complete();
+        else this.socket.write('ACK\n', error => {
+          if (error) console.warn(JSON.stringify({ event: 'desktop-response-ack', code: error.code || 'write_failed' }));
+          // The parsed result remains authoritative even if cleanup disconnects.
+          complete();
+        });
+      } catch (error) { this.fail(error); }
+    });
+    this.socket.on('error', error => this.fail(error));
+    this.socket.on('close', () => { this.closed = true; this.fail(new Error('桌面操作辅助连接已关闭，请重新获取画面')); });
+  }
+  fail(error) {
+    if (this.waiter) { const waiter = this.waiter; this.waiter = null; clearTimeout(waiter.timer); waiter.reject(error); }
+    this.socket.destroy();
+  }
+  request(command) {
+    if (this.closed || this.socket.destroyed || this.waiter) return Promise.reject(new Error('桌面操作辅助连接不可用'));
+    return new Promise((resolve, reject) => {
+      this.waiter = { resolve, reject, timer: setTimeout(() => this.fail(new Error('桌面操作辅助请求超时；点击不会自动重发，请刷新画面核对')), 10000) };
+      this.socket.write(`${command}\n`);
+    });
+  }
+  close() { this.fail(new Error('桌面画面已释放')); }
+}
+
+// Frame and input share one worker pipe. Serialize them without replaying input.
+export class DesktopHelper {
+  constructor() { this.active = null; this.reading = false; this.queue = Promise.resolve(); this.version = 0; }
+  serial(operation) {
+    const version = this.version;
+    const result = this.queue.then(() => {
+      if (version !== this.version) throw Object.assign(new Error('桌面操作已取消，请刷新'), { code: 'desktop_session_invalid' });
+      return operation();
+    });
+    this.queue = result.catch(() => {});
+    return result;
+  }
+  clear(current = this.active) {
+    if (!current) return;
+    clearTimeout(current.timer); current.session.close();
+    if (this.active === current) this.active = null;
+  }
+  async frame({ preview = false } = {}) {
+    if (this.reading) throw new Error('正在获取桌面画面，请稍候');
+    this.reading = true;
+    try { return await this.serial(async () => {
+      if (!this.active || this.active.preview !== preview) {
+        this.clear();
+        const version = this.version;
+        const status = await desktopHelperStatus();
+        if (version !== this.version) throw new Error('桌面操作已取消');
+        if (!status.running) return { state: 'unavailable', message: '工作站桌面服务尚未就绪' };
+        this.active = { session: new PipeSession(), preview };
+      }
+      const current = this.active;
+      try {
+        clearTimeout(current.timer);
+        const frame = await current.session.request(current.frame ? 'FRAME' : preview ? 'PREVIEW' : 'FRAME');
+        if (this.active !== current) throw new Error('桌面画面已释放');
+        if (frame.state !== 'pending') { this.clear(current); return frame; }
+        if (!/^[a-f0-9]{32}$/.test(frame.frameId) || !/^[a-f0-9]{32}$/.test(frame.sessionId) || !Number.isSafeInteger(frame.width) || !Number.isSafeInteger(frame.height) ||
+            !['image/png', 'image/jpeg'].includes(frame.mimeType) || !frame.image?.startsWith('data:' + frame.mimeType + ';base64,') ||
+            frame.width < 1 || frame.height < 1 || frame.preview !== preview) throw new Error('桌面画面格式无效');
+        const image = Buffer.from(frame.image.slice(('data:' + frame.mimeType + ';base64,').length), 'base64');
+        delete frame.image;
+        current.sessionId = frame.sessionId;
+        frame.imagePath = '/api/desktop/frames/' + frame.frameId;
+        frame.size = image.length;
+        current.frame = frame; current.image = image; current.expires = Date.now() + 30000;
+        current.timer = setTimeout(() => this.release(undefined, current.sessionId), 30000);
+        return frame;
+      } catch (error) { this.clear(current); throw error; }
+    }); } finally { this.reading = false; }
+  }
+  input(sessionId, command) {
+    return this.serial(async () => {
+      const current = this.active;
+      if (!current?.frame || sessionId !== current.sessionId || Date.now() >= current.expires)
+        throw Object.assign(new Error('请刷新桌面后操作'), { code: 'desktop_session_invalid' });
+      try {
+        const result = await current.session.request(command);
+        if (result.continuing !== true) this.clear(current);
+        return result;
+      } catch (error) { this.clear(current); throw error; }
+    });
+  }
+  move({ sessionId, dx, dy }) {
+    if (!Number.isSafeInteger(dx) || !Number.isSafeInteger(dy) || Math.abs(dx) > 512 || Math.abs(dy) > 512 || (!dx && !dy))
+      throw new Error('无效的相对鼠标位移');
+    return this.input(sessionId, 'MOVE ' + sessionId + ' ' + dx + ' ' + dy);
+  }
+  click({ sessionId, button }) {
+    if (!['left', 'right'].includes(button)) throw new Error('无效的鼠标按键');
+    return this.input(sessionId, 'BUTTON ' + sessionId + ' ' + button);
+  }
+  image(frameId) {
+    const current = this.active;
+    if (!current?.frame || current.frame.frameId !== frameId || Date.now() >= current.expires)
+      throw new Error('桌面画面已释放或过期，请重新获取');
+    return current.image;
+  }
+  release(frameId, sessionId) {
+    if (frameId && this.active?.frame?.frameId !== frameId) return;
+    if (sessionId && this.active?.sessionId !== sessionId) return;
+    this.version++; this.clear();
+  }
+}

package/dist/src/platform/windows/desktop-project-registration.mjs

@@ -1,153 +1,4 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { createHash, randomUUID } from 'node:crypto';
-import { setTimeout as delay } from 'node:timers/promises';
 import { desktopHost } from './desktop-host.mjs';
-import { processAlive } from '../../background-process.mjs';
-
-// This is a version-specific Desktop state adapter, not a second project store.
-// Desktop reads this file once and flushes its complete in-memory snapshot.
-const desktopVersion = '26.1002.7124.0';
-const digest = bytes => createHash('sha256').update(bytes).digest('hex');
-const key = value => path.win32.normalize(value).replace(/[\\/]+$/, '').toLowerCase();
-const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
-const fail = (message, details) => { throw Object.assign(new Error(message), { statusCode: 409, details }); };
-
-export const desktopProjectRestartWarning = '创建项目需要短暂关闭并重新打开 Codex Desktop，以完成桌面登记。请先保存桌面上未发送的内容；仅由旧桌面实例承接的任务可能中断。手机连接、工作站服务和 Codex 内核保持运行。';
-
-function parseState(bytes) {
-  const state = JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/, ''));
-  if (!object(state) || !object(state['local-projects']) || !Array.isArray(state['project-order'])
-    || state['project-order'].some(id => typeof id !== 'string')) {
-    fail('Codex Desktop 项目文件结构与已核对版本不符，未修改桌面文件。');
-  }
-  return state;
-}
-
-export function registerProjectInState(state, project, codexDataRoot) {
-  if (!Number.isFinite(project.createdAt) || !Number.isFinite(project.updatedAt)) {
-    fail('内核项目时间字段无效，未修改桌面文件。');
-  }
-  const projects = state['local-projects'];
-  const scope = state['app-server-project-id-by-legacy-project-id-by-host']?.[`local:${codexDataRoot}`];
-  if (scope !== undefined && !object(scope)) fail('Codex Desktop 项目映射结构无效，未修改桌面文件。');
-  for (const [legacyId, nativeId] of Object.entries(scope || {})) {
-    if ((legacyId === project.id || nativeId === project.id) && legacyId !== nativeId) {
-      fail('该项目已有不同的桌面身份映射，未覆盖已有登记。');
-    }
-  }
-  const previous = projects[project.id];
-  const rootPaths = project.roots.map(root => root.path);
-  if (previous && (previous.id !== project.id || previous.name !== project.name || !Array.isArray(previous.rootPaths)
-    || previous.rootPaths.length !== rootPaths.length || previous.rootPaths.some((root, index) => key(root) !== key(rootPaths[index])))) {
-    fail('该项目的桌面登记内容已变化，未覆盖已有登记。');
-  }
-  // With identical native/desktop IDs, Desktop storeProject adopts the native
-  // project at startup. No legacy mapping, thread reassignment or import is needed.
-  const result = { ...state, 'local-projects': { ...projects, [project.id]: previous || {
-    id: project.id, name: project.name, rootPaths,
-    createdAt: project.createdAt * 1000, updatedAt: project.updatedAt * 1000,
-  } } };
-  result['project-order'] = state['project-order'].includes(project.id)
-    ? state['project-order'] : [project.id, ...state['project-order']];
-  return result;
-}
-
-async function acquireLock(stateRoot, operationId) {
-  const file = path.join(stateRoot, 'desktop-launch.lock');
-  try {
-    const previous = JSON.parse(await fs.readFile(file, 'utf8') || 'null');
-    if (previous?.owner === 'project-registration' && Number.isInteger(previous.pid) && !processAlive(previous.pid)) {
-      await fs.unlink(file);
-    }
-  } catch (error) { if (error.code !== 'ENOENT' && !(error instanceof SyntaxError)) throw error; }
-  let handle;
-  try { handle = await fs.open(file, 'wx'); }
-  catch (error) { if (error.code === 'EEXIST') fail('Codex Desktop 正在启动或登记项目，请稍后再试。'); throw error; }
-  try { await handle.writeFile(JSON.stringify({ owner: 'project-registration', pid: process.pid, operationId })); }
-  catch (error) { await handle.close(); await fs.unlink(file); throw error; }
-  return async () => { await handle.close(); await fs.unlink(file); };
-}
-
-export async function withDesktopProjectRegistration(options, action) {
-  const { stateRoot, codexDataRoot, operationId, confirmed, serverUrl,
-    host = desktopHost, wait = delay, readyTimeoutMs = 30000 } = options;
-  const stateFile = path.join(codexDataRoot, '.codex-global-state.json');
-  const release = await acquireLock(stateRoot, operationId);
-  try {
-    try { await fs.access(path.join(stateRoot, 'shared-recovery.lock')); fail('Codex Desktop 正在恢复连接，请稍后创建项目。'); }
-    catch (error) { if (error.code !== 'ENOENT') throw error; }
-    const info = await host.inspect();
-    if (!info.desktop?.includes(`OpenAI.Codex_${desktopVersion}_`)) {
-      fail(`当前 Codex Desktop 版本尚未核对项目登记结构；已支持版本为 ${desktopVersion}。`);
-    }
-    parseState(await fs.readFile(stateFile));
-    if (info.running && confirmed !== true) fail(desktopProjectRestartWarning, { desktopRestartRequired: true });
-    if (info.running && await host.sharedServiceUrl() !== serverUrl) {
-      fail('Codex Desktop 尚未接入当前工作站内核，请先完成 Desktop 接入后创建项目。');
-    }
-    return await action({
-      async register(project, operation, saveOperation) {
-        let restartNeeded = operation.desktopWasRunning === true;
-        let registrationError;
-        const current = await host.inspect();
-        if (current.desktop !== info.desktop) fail('Codex Desktop 安装版本发生变化，项目保留，未修改桌面文件。');
-        if (current.running) {
-          if (confirmed !== true) fail(desktopProjectRestartWarning, { desktopRestartRequired: true });
-          if (await host.sharedServiceUrl() !== serverUrl) fail('Codex Desktop 内核连接已变化，未关闭桌面。');
-          restartNeeded = true;
-          operation.desktopWasRunning = true;
-          await saveOperation();
-        }
-        try {
-          if (current.running) await host.closeDesktop(info.desktop);
-          if ((await host.inspect()).running) fail('Codex Desktop 尚未退出，未修改桌面文件。');
-          const original = await fs.readFile(stateFile);
-          const state = parseState(original);
-          const updated = registerProjectInState(state, project, codexDataRoot);
-          if (JSON.stringify(updated) !== JSON.stringify(state)) {
-            const backupDirectory = path.join(stateRoot, 'desktop-project-backups');
-            await fs.mkdir(backupDirectory, { recursive: true });
-            const backup = path.join(backupDirectory, `${operationId}-${randomUUID()}.json`);
-            await fs.writeFile(backup, original, { flag: 'wx', mode: 0o600 });
-            operation.desktopBackup = backup;
-            await saveOperation();
-            const temporary = `${stateFile}.${operationId}.tmp`;
-            try {
-              const source = original.toString('utf8');
-              const replacement = Buffer.from(`${source.startsWith('\uFEFF') ? '\uFEFF' : ''}${JSON.stringify(updated)}${source.endsWith('\n') ? '\n' : ''}`);
-              await fs.writeFile(temporary, replacement, { flag: 'wx', mode: 0o600 });
-              if ((await host.inspect()).running || digest(await fs.readFile(stateFile)) !== digest(original)) {
-                fail('Codex Desktop 状态在登记期间发生变化，未覆盖原文件，请核对后重试。');
-              }
-              await fs.rename(temporary, stateFile);
-              if (digest(await fs.readFile(stateFile)) !== digest(replacement)) throw new Error('Codex Desktop 登记文件未能核对，原状态备份已保留。');
-            } finally { await fs.rm(temporary, { force: true }); }
-          }
-          operation.desktopRegistered = true;
-          await saveOperation();
-        } catch (error) { registrationError = error; }
-        // Restore the UI even if the registry write failed. This never starts or
-        // restarts a kernel and never changes the service's active connections.
-        if (restartNeeded) {
-          try {
-            if (!(await host.inspect()).running) await host.startDesktop(info.desktop, { CODEX_APP_SERVER_WS_URL: serverUrl });
-            const deadline = Date.now() + readyTimeoutMs;
-            while (!await host.desktopReady()) {
-              if (Date.now() >= deadline) throw new Error('Codex Desktop 尚未重新就绪。');
-              await wait(500);
-            }
-            if (await host.sharedServiceUrl() !== serverUrl) throw new Error('Desktop 未接入原工作站内核。');
-          } catch (error) {
-            throw new Error([registrationError?.message, `项目已保留，重新打开 Codex Desktop 未完成：${error.message}`].filter(Boolean).join(' '));
-          }
-        }
-        if (registrationError) throw registrationError;
-        const finalState = parseState(await fs.readFile(stateFile));
-        const verified = registerProjectInState(finalState, project, codexDataRoot);
-        if (JSON.stringify(verified) !== JSON.stringify(finalState)) throw new Error('项目已创建，但 Desktop 登记未能在最终文件中核对。');
-        return { status: 'registered', restarted: restartNeeded };
-      },
-    });
-  } finally { await release(); }
-}
+import { withDesktopProjectRegistration as register } from '../desktop-project-store.mjs';
+export { registerProjectInState, desktopProjectRestartWarning } from '../desktop-project-store.mjs';
+export const withDesktopProjectRegistration = (options, action) => register({ host: desktopHost, ...options }, action);

package/dist/src/platform/windows/desktop-runtime.ps1

@@ -1,10 +1,10 @@
-$ErrorActionPreference = 'Stop'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
-if (-not $package) { 'null'; exit }
-$resources = Join-Path $package.InstallLocation 'app\resources'
-@{
-    package = $package.PackageFullName
-    executable = Join-Path $resources 'codex.exe'
-    codeModeHost = Join-Path $resources 'codex-code-mode-host.exe'
-} | ConvertTo-Json -Compress
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
+if (-not $package) { 'null'; exit }
+$resources = Join-Path $package.InstallLocation 'app\resources'
+@{
+    package = $package.PackageFullName
+    executable = Join-Path $resources 'codex.exe'
+    codeModeHost = Join-Path $resources 'codex-code-mode-host.exe'
+} | ConvertTo-Json -Compress

package/dist/src/platform/windows/desktop-shortcuts.ps1

@@ -1,21 +1,21 @@
-param([string]$NodePath, [string]$Entry, [string]$Destination)
+param([string]$NodePath, [string]$Entry, [string]$Destination)
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
 $shell = New-Object -ComObject WScript.Shell
 if (-not $Destination) { $Destination = $shell.SpecialFolders.Item('Desktop') }
-# Only identify and remove the retired shortcut; never create a new launcher.
-$launcher = Join-Path $PSScriptRoot 'desktop-shortcut-run.ps1'
-$items = @(@{Name='Code Relax - Codex 内核'; Command='shared-start'})
+# Only identify and remove the retired shortcut; never create a new launcher.
+$launcher = Join-Path $PSScriptRoot 'desktop-shortcut-run.ps1'
+$items = @(@{Name='Code Relax - Codex 内核'; Command='shared-start'})
 $results = @()
 foreach ($item in $items) {
     $target = Join-Path $Destination ($item.Name + '.lnk')
     $arguments = '-NoProfile -NoExit -ExecutionPolicy Bypass -File "' + $launcher + '" -NodePath "' + $NodePath + '" -Entry "' + $Entry + '" -Action ' + $item.Command
     if (Test-Path -LiteralPath $target) {
         $existing = $shell.CreateShortcut($target)
-        $powershell = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
-        if ($existing.Arguments -ne $arguments -or $existing.TargetPath -ne $powershell) { continue }
+        $powershell = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
+        if ($existing.Arguments -ne $arguments -or $existing.TargetPath -ne $powershell) { continue }
     }
-    if (Test-Path -LiteralPath $target) { Remove-Item -LiteralPath $target }
+    if (Test-Path -LiteralPath $target) { Remove-Item -LiteralPath $target }
     $results += $target
 }
 ConvertTo-Json -InputObject $results -Compress

package/dist/src/platform/windows/network-info.mjs

@@ -1,34 +1,34 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const exec = promisify(execFile);
-const bridgeRoot = fileURLToPath(new URL('../../../', import.meta.url));
-
-export async function lanNetworks() {
-  const executable = path.join(process.env.SystemRoot, 'System32/WindowsPowerShell/v1.0/powershell.exe');
-  const { stdout } = await exec(executable, ['-NoProfile', '-NonInteractive', '-File', path.join(bridgeRoot, 'get-lan-networks.ps1')],
-    { windowsHide: true, encoding: 'utf8' });
-  const records = JSON.parse(stdout.trim() || '[]');
-  if (!Array.isArray(records) || records.length > 8) throw new Error('Windows 返回了无效的局域网信息');
-  return records.map(record => {
-    if (!privateIpv4(record.address) || !['wifi', 'ethernet'].includes(record.networkType) ||
-        !plainLabel(record.networkName) || !plainLabel(record.interfaceName)) throw new Error('Windows 返回了无效的局域网信息');
-    return { address: record.address, networkType: record.networkType,
-      networkName: record.networkName.trim(), interfaceName: record.interfaceName.trim() };
-  });
-}
-
-function privateIpv4(value) {
-  if (typeof value !== 'string') return false;
-  const parts = value.split('.').map(Number);
-  if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return false;
-  return parts[0] === 10 || (parts[0] === 192 && parts[1] === 168) ||
-    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||
-    (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127);
-}
-
-function plainLabel(value) {
-  return typeof value === 'string' && value.trim().length > 0 && value.trim().length <= 80 && !/[\u0000-\u001f\u007f]/.test(value);
-}
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const exec = promisify(execFile);
+const bridgeRoot = fileURLToPath(new URL('../../../', import.meta.url));
+
+export async function lanNetworks() {
+  const executable = path.join(process.env.SystemRoot, 'System32/WindowsPowerShell/v1.0/powershell.exe');
+  const { stdout } = await exec(executable, ['-NoProfile', '-NonInteractive', '-File', path.join(bridgeRoot, 'get-lan-networks.ps1')],
+    { windowsHide: true, encoding: 'utf8' });
+  const records = JSON.parse(stdout.trim() || '[]');
+  if (!Array.isArray(records) || records.length > 8) throw new Error('Windows 返回了无效的局域网信息');
+  return records.map(record => {
+    if (!privateIpv4(record.address) || !['wifi', 'ethernet'].includes(record.networkType) ||
+        !plainLabel(record.networkName) || !plainLabel(record.interfaceName)) throw new Error('Windows 返回了无效的局域网信息');
+    return { address: record.address, networkType: record.networkType,
+      networkName: record.networkName.trim(), interfaceName: record.interfaceName.trim() };
+  });
+}
+
+function privateIpv4(value) {
+  if (typeof value !== 'string') return false;
+  const parts = value.split('.').map(Number);
+  if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return false;
+  return parts[0] === 10 || (parts[0] === 192 && parts[1] === 168) ||
+    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||
+    (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127);
+}
+
+function plainLabel(value) {
+  return typeof value === 'string' && value.trim().length > 0 && value.trim().length <= 80 && !/[\u0000-\u001f\u007f]/.test(value);
+}

package/dist/src/platform/windows/resident-start.js

@@ -1,20 +1,20 @@
-// Windows Script Host has no console. Keep the login task alive until the
-// short-lived CLI has handed the resident service to the background broker.
-if (WScript.Arguments.length !== 2) WScript.Quit(2);
-var shell = new ActiveXObject('WScript.Shell');
-var files = new ActiveXObject('Scripting.FileSystemObject');
-var node = WScript.Arguments.Item(0);
-var entry = WScript.Arguments.Item(1);
-if (!files.FileExists(node)) {
-  var directories = shell.Environment('PROCESS').Item('PATH').split(';');
-  node = '';
-  for (var i = 0; i < directories.length; i++) {
-    var directory = directories[i].replace(/^"|"$/g, '');
-    if (!directory) continue;
-    var candidate = files.BuildPath(directory, 'node.exe');
-    if (files.FileExists(candidate)) { node = candidate; break; }
-  }
-  if (!node) WScript.Quit(2);
-}
-var command = '"' + node + '" "' + entry + '" start --json';
-WScript.Quit(shell.Run(command, 0, true));
+// Windows Script Host has no console. Keep the login task alive until the
+// short-lived CLI has handed the resident service to the background broker.
+if (WScript.Arguments.length !== 2) WScript.Quit(2);
+var shell = new ActiveXObject('WScript.Shell');
+var files = new ActiveXObject('Scripting.FileSystemObject');
+var node = WScript.Arguments.Item(0);
+var entry = WScript.Arguments.Item(1);
+if (!files.FileExists(node)) {
+  var directories = shell.Environment('PROCESS').Item('PATH').split(';');
+  node = '';
+  for (var i = 0; i < directories.length; i++) {
+    var directory = directories[i].replace(/^"|"$/g, '');
+    if (!directory) continue;
+    var candidate = files.BuildPath(directory, 'node.exe');
+    if (files.FileExists(candidate)) { node = candidate; break; }
+  }
+  if (!node) WScript.Quit(2);
+}
+var command = '"' + node + '" "' + entry + '" start --json';
+WScript.Quit(shell.Run(command, 0, true));

package/dist/src/platform/windows/resident-start.ps1

@@ -1,7 +1,7 @@
-param([Parameter(Mandatory=$true)][string]$NodePath, [Parameter(Mandatory=$true)][string]$Entry)
-$ErrorActionPreference = 'Stop'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-$state = Join-Path $env:LOCALAPPDATA 'CodexRemote'
-New-Item -ItemType Directory -Path $state -Force | Out-Null
-& $NodePath $Entry start --json >> (Join-Path $state 'resident-start.log') 2>&1
-exit $LASTEXITCODE
+param([Parameter(Mandatory=$true)][string]$NodePath, [Parameter(Mandatory=$true)][string]$Entry)
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$state = Join-Path $env:LOCALAPPDATA 'CodexRemote'
+New-Item -ItemType Directory -Path $state -Force | Out-Null
+& $NodePath $Entry start --json >> (Join-Path $state 'resident-start.log') 2>&1
+exit $LASTEXITCODE