@walkhi/code-relax 0.1.0-beta.3 → 0.1.0-beta.30

package/dist/src/platform/windows/start-hidden-console.ps1

@@ -1,49 +1,49 @@
-$ErrorActionPreference = 'Stop'
-[Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false)
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-try {
-    $spec = [Console]::In.ReadToEnd() | ConvertFrom-Json
-    # WMI owns this launch, not the caller's kill-on-close Desktop job hierarchy.
-    $instance = [Guid]::NewGuid().ToString()
-    $launchRoot = [IO.Path]::GetFullPath((Join-Path $env:LOCALAPPDATA 'CodexRemote\process-launch'))
-    New-Item -ItemType Directory -Path $launchRoot -Force | Out-Null
-    Add-Type -Path (Join-Path $PSScriptRoot 'IsolatedProcess.cs')
-    $launchRoot = [IsolatedProcess]::ResolvePath($launchRoot)
-    $ready = Join-Path $launchRoot ($instance + '.json')
-    $request = Join-Path $launchRoot ($instance + '.request.json')
-    $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
-    $spec | Add-Member -NotePropertyName instance -NotePropertyValue $instance
-    $spec | Add-Member -NotePropertyName diagnostic -NotePropertyValue $diagnostic
-    $requestTemporary = $request + '.tmp'
-    [IO.File]::WriteAllText($requestTemporary, ($spec | ConvertTo-Json -Compress -Depth 10), (New-Object Text.UTF8Encoding($false)))
-    [IO.File]::Move($requestTemporary, $request)
-    $startup = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
-        ShowWindow=[uint16]0; CreateFlags=[uint32]0x1000010
-    }
-    $worker = Join-Path $PSScriptRoot 'launch-worker.mjs'
-    $command = '"' + [string]$spec.brokerExecutable + '" "' + $worker + '" "' + $request + '" "' + $ready + '" "' + $instance + '" "' + $diagnostic + '"'
-    $broker = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
-        CommandLine=$command; CurrentDirectory=$env:USERPROFILE; ProcessStartupInformation=$startup
-    }
-    if ($broker.ReturnValue -ne 0) { throw ('Windows process broker failed: ' + $broker.ReturnValue) }
-    $deadline = [DateTime]::UtcNow.AddSeconds(30)
-    while (-not (Test-Path -LiteralPath $ready)) {
-        if ([DateTime]::UtcNow -gt $deadline) {
-            $detail = if (Test-Path -LiteralPath $diagnostic) { (Get-Content -LiteralPath $diagnostic -Raw -Encoding UTF8).Trim() } else { 'broker did not create a diagnostic log' }
-            throw ('Windows process broker handoff timed out (broker PID ' + $broker.ProcessId + '): ' + $detail)
-        }
-        Start-Sleep -Milliseconds 50
-    }
-    $result = Get-Content -LiteralPath $ready -Raw -Encoding UTF8 | ConvertFrom-Json
-    Remove-Item -LiteralPath $ready
-    if ($result.instance -ne $instance -or $result.brokerPid -ne $broker.ProcessId) { throw 'Windows process broker identity mismatch.' }
-    if ($result.error) { throw [string]$result.error }
-    if (Test-Path -LiteralPath $diagnostic) { Remove-Item -LiteralPath $diagnostic -Force }
-    [Console]::WriteLine([int]$result.pid)
-} catch {
-    [Console]::Error.WriteLine($_.Exception.Message)
-    exit 1
-} finally {
-    if ($request -and (Test-Path -LiteralPath $request)) { Remove-Item -LiteralPath $request -Force }
-    if ($requestTemporary -and (Test-Path -LiteralPath $requestTemporary)) { Remove-Item -LiteralPath $requestTemporary -Force }
-}
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false)
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+try {
+    $spec = [Console]::In.ReadToEnd() | ConvertFrom-Json
+    # WMI owns this launch, not the caller's kill-on-close Desktop job hierarchy.
+    $instance = [Guid]::NewGuid().ToString()
+    $launchRoot = [IO.Path]::GetFullPath((Join-Path $env:LOCALAPPDATA 'CodexRemote\process-launch'))
+    New-Item -ItemType Directory -Path $launchRoot -Force | Out-Null
+    Add-Type -Path (Join-Path $PSScriptRoot 'IsolatedProcess.cs')
+    $launchRoot = [IsolatedProcess]::ResolvePath($launchRoot)
+    $ready = Join-Path $launchRoot ($instance + '.json')
+    $request = Join-Path $launchRoot ($instance + '.request.json')
+    $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
+    $spec | Add-Member -NotePropertyName instance -NotePropertyValue $instance
+    $spec | Add-Member -NotePropertyName diagnostic -NotePropertyValue $diagnostic
+    $requestTemporary = $request + '.tmp'
+    [IO.File]::WriteAllText($requestTemporary, ($spec | ConvertTo-Json -Compress -Depth 10), (New-Object Text.UTF8Encoding($false)))
+    [IO.File]::Move($requestTemporary, $request)
+    $startup = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
+        ShowWindow=[uint16]0; CreateFlags=[uint32]0x1000010
+    }
+    $worker = Join-Path $PSScriptRoot 'launch-worker.mjs'
+    $command = '"' + [string]$spec.brokerExecutable + '" "' + $worker + '" "' + $request + '" "' + $ready + '" "' + $instance + '" "' + $diagnostic + '"'
+    $broker = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
+        CommandLine=$command; CurrentDirectory=$env:USERPROFILE; ProcessStartupInformation=$startup
+    }
+    if ($broker.ReturnValue -ne 0) { throw ('Windows process broker failed: ' + $broker.ReturnValue) }
+    $deadline = [DateTime]::UtcNow.AddSeconds(30)
+    while (-not (Test-Path -LiteralPath $ready)) {
+        if ([DateTime]::UtcNow -gt $deadline) {
+            $detail = if (Test-Path -LiteralPath $diagnostic) { (Get-Content -LiteralPath $diagnostic -Raw -Encoding UTF8).Trim() } else { 'broker did not create a diagnostic log' }
+            throw ('Windows process broker handoff timed out (broker PID ' + $broker.ProcessId + '): ' + $detail)
+        }
+        Start-Sleep -Milliseconds 50
+    }
+    $result = Get-Content -LiteralPath $ready -Raw -Encoding UTF8 | ConvertFrom-Json
+    Remove-Item -LiteralPath $ready
+    if ($result.instance -ne $instance -or $result.brokerPid -ne $broker.ProcessId) { throw 'Windows process broker identity mismatch.' }
+    if ($result.error) { throw [string]$result.error }
+    if (Test-Path -LiteralPath $diagnostic) { Remove-Item -LiteralPath $diagnostic -Force }
+    [Console]::WriteLine([int]$result.pid)
+} catch {
+    [Console]::Error.WriteLine($_.Exception.Message)
+    exit 1
+} finally {
+    if ($request -and (Test-Path -LiteralPath $request)) { Remove-Item -LiteralPath $request -Force }
+    if ($requestTemporary -and (Test-Path -LiteralPath $requestTemporary)) { Remove-Item -LiteralPath $requestTemporary -Force }
+}

package/dist/src/platform/windows/stop-desktop.ps1

@@ -1,19 +1,22 @@
-param([Parameter(Mandatory=$true)][string]$Executable)
-$ErrorActionPreference = 'Stop'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
-if (-not $package -or $Executable -ne (Join-Path $package.InstallLocation 'app/ChatGPT.exe')) {
-    throw 'Desktop executable identity changed; recovery stopped.'
-}
-# This action is only reached after explicit whole-workstation recovery confirmation.
-# Never kill an app-server process tree: the independent recovery worker must survive.
-$workers = @(Get-CimInstance Win32_Process -Filter "Name='ChatGPT.exe'" | Where-Object { $_.ExecutablePath -eq $Executable })
-foreach ($worker in $workers) {
-    $actual = Get-CimInstance Win32_Process -Filter "ProcessId=$($worker.ProcessId)"
-    if ($actual -and $actual.ExecutablePath -eq $worker.ExecutablePath -and $actual.CreationDate -eq $worker.CreationDate) {
-        Stop-Process -Id $worker.ProcessId -Force -ErrorAction Stop
-    }
-}
-if (Get-Process ChatGPT -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $Executable }) {
-    throw 'Desktop did not exit; recovery stopped.'
-}
+param([Parameter(Mandatory=$true)][string]$Executable)
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
+if (-not $package -or $Executable -ne (Join-Path $package.InstallLocation 'app/ChatGPT.exe')) {
+    throw 'Desktop executable identity changed; recovery stopped.'
+}
+# Never kill another user's Desktop or an app-server process tree. The independent
+# installer/recovery worker must survive and relaunch only in this interactive session.
+$currentSessionId = (Get-Process -Id $PID -ErrorAction Stop).SessionId
+$workers = @(Get-CimInstance Win32_Process -Filter "Name='ChatGPT.exe'" | Where-Object {
+    $_.ExecutablePath -eq $Executable -and $_.SessionId -eq $currentSessionId
+})
+foreach ($worker in $workers) {
+    $actual = Get-CimInstance Win32_Process -Filter "ProcessId=$($worker.ProcessId)"
+    if ($actual -and $actual.ExecutablePath -eq $worker.ExecutablePath -and $actual.CreationDate -eq $worker.CreationDate) {
+        Stop-Process -Id $worker.ProcessId -Force -ErrorAction Stop
+    }
+}
+if (Get-Process ChatGPT -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $Executable -and $_.SessionId -eq $currentSessionId }) {
+    throw 'Desktop did not exit; recovery stopped.'
+}

package/dist/src/platform/windows/user-environment.mjs

@@ -1,50 +1,50 @@
-import path from 'node:path';
-import fs from 'node:fs';
-import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
-import { runScript } from './desktop-host.mjs';
-import { managedAppServerUrl } from '../../managed-app-server.mjs';
-
-const ownershipFile = 'managed-environment.json';
-
-export async function readManagedEnvironment() {
-  return JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Read']));
-}
-
-export async function configureManagedEnvironment(stateRoot) {
-  const current = await readManagedEnvironment();
-  const ownershipPath = path.join(stateRoot, ownershipFile);
-  const ownership = readRecord(ownershipPath);
-  if (current.forceCliUser === '1' || current.forceCliMachine === '1') {
-    throw new Error('CODEX_APP_SERVER_FORCE_CLI=1 会让 Codex 忽略受管 app-server；未修改该配置。');
-  }
-  if (current.userValue && current.userValue !== managedAppServerUrl) {
-    throw new Error(`用户已有 CODEX_APP_SERVER_WS_URL=${current.userValue}；未覆盖该配置。`);
-  }
-  if (current.userValue === managedAppServerUrl) {
-    const owned = ownership?.value === managedAppServerUrl;
-    return { configured: true, value: current.userValue, changed: false, owned };
-  }
-  const applied = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Set', '-Value', managedAppServerUrl]));
-  writeRecord(ownershipPath, { name: 'CODEX_APP_SERVER_WS_URL', value: managedAppServerUrl,
-    configuredAt: new Date().toISOString() });
-  return { configured: true, value: applied.userValue, changed: true, owned: true };
-}
-
-export async function clearManagedEnvironment(stateRoot) {
-  const ownershipPath = path.join(stateRoot, ownershipFile);
-  const ownership = readRecord(ownershipPath);
-  const current = await readManagedEnvironment();
-  if (!current.userValue) {
-    fs.rmSync(ownershipPath, { force: true });
-    return { removed: false, preserved: false, reason: 'already-empty' };
-  }
-  if (ownership?.value !== managedAppServerUrl || current.userValue !== managedAppServerUrl) {
-    fs.rmSync(ownershipPath, { force: true });
-    return { removed: false, preserved: true, value: current.userValue,
-      reason: ownership?.value === managedAppServerUrl ? 'user-modified' : 'not-owned' };
-  }
-  const result = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Clear']));
-  if (result.userValue) throw new Error('CODEX_APP_SERVER_WS_URL 清理后读回仍不为空。');
-  fs.rmSync(ownershipPath, { force: true });
-  return { removed: true, preserved: false, reason: 'removed' };
-}
+import path from 'node:path';
+import fs from 'node:fs';
+import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
+import { runScript } from './desktop-host.mjs';
+import { managedAppServerUrl } from '../../managed-app-server.mjs';
+
+const ownershipFile = 'managed-environment.json';
+
+export async function readManagedEnvironment() {
+  return JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Read']));
+}
+
+export async function configureManagedEnvironment(stateRoot) {
+  const current = await readManagedEnvironment();
+  const ownershipPath = path.join(stateRoot, ownershipFile);
+  const ownership = readRecord(ownershipPath);
+  if (current.forceCliUser === '1' || current.forceCliMachine === '1') {
+    throw new Error('CODEX_APP_SERVER_FORCE_CLI=1 会让 Codex 忽略当前内核地址；未修改该配置。');
+  }
+  if (current.userValue && current.userValue !== managedAppServerUrl) {
+    throw new Error(`用户已有 CODEX_APP_SERVER_WS_URL=${current.userValue}；未覆盖该配置。`);
+  }
+  if (current.userValue === managedAppServerUrl) {
+    const owned = ownership?.value === managedAppServerUrl;
+    return { configured: true, value: current.userValue, changed: false, owned };
+  }
+  const applied = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Set', '-Value', managedAppServerUrl]));
+  writeRecord(ownershipPath, { name: 'CODEX_APP_SERVER_WS_URL', value: managedAppServerUrl,
+    configuredAt: new Date().toISOString() });
+  return { configured: true, value: applied.userValue, changed: true, owned: true };
+}
+
+export async function clearManagedEnvironment(stateRoot) {
+  const ownershipPath = path.join(stateRoot, ownershipFile);
+  const ownership = readRecord(ownershipPath);
+  const current = await readManagedEnvironment();
+  if (!current.userValue) {
+    fs.rmSync(ownershipPath, { force: true });
+    return { removed: false, preserved: false, reason: 'already-empty' };
+  }
+  if (ownership?.value !== managedAppServerUrl || current.userValue !== managedAppServerUrl) {
+    fs.rmSync(ownershipPath, { force: true });
+    return { removed: false, preserved: true, value: current.userValue,
+      reason: ownership?.value === managedAppServerUrl ? 'user-modified' : 'not-owned' };
+  }
+  const result = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Clear']));
+  if (result.userValue) throw new Error('CODEX_APP_SERVER_WS_URL 清理后读回仍不为空。');
+  fs.rmSync(ownershipPath, { force: true });
+  return { removed: true, preserved: false, reason: 'removed' };
+}

package/dist/src/platform/windows/user-environment.ps1

@@ -1,41 +1,41 @@
-param(
-    [ValidateSet('Read', 'Set', 'Clear')][string]$Action = 'Read',
-    [string]$Value = ''
-)
-$ErrorActionPreference = 'Stop'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-$name = 'CODEX_APP_SERVER_WS_URL'
-
-function Broadcast-EnvironmentChange {
-    if (-not ('CodeRelax.EnvironmentBroadcast' -as [type])) {
-        Add-Type -Namespace CodeRelax -Name EnvironmentBroadcast -MemberDefinition @'
-[System.Runtime.InteropServices.DllImport("user32.dll", CharSet=System.Runtime.InteropServices.CharSet.Unicode, SetLastError=true)]
-public static extern System.IntPtr SendMessageTimeout(
-    System.IntPtr hWnd, uint Msg, System.UIntPtr wParam, string lParam,
-    uint flags, uint timeout, out System.UIntPtr result);
-'@
-    }
-    [UIntPtr]$result = [UIntPtr]::Zero
-    [void][CodeRelax.EnvironmentBroadcast]::SendMessageTimeout(
-        [IntPtr]0xffff, 0x001A, [UIntPtr]::Zero, 'Environment', 0x0002, 5000, [ref]$result)
-}
-
-if ($Action -eq 'Set') {
-    if ([string]::IsNullOrWhiteSpace($Value)) { throw 'Environment value is required.' }
-    [Environment]::SetEnvironmentVariable($name, $Value, 'User')
-    Broadcast-EnvironmentChange
-} elseif ($Action -eq 'Clear') {
-    [Environment]::SetEnvironmentVariable($name, $null, 'User')
-    Broadcast-EnvironmentChange
-}
-
-$userValue = [Environment]::GetEnvironmentVariable($name, 'User')
-$result = @{
-    userValue = $userValue
-    machineValue = [Environment]::GetEnvironmentVariable($name, 'Machine')
-    forceCliUser = [Environment]::GetEnvironmentVariable('CODEX_APP_SERVER_FORCE_CLI', 'User')
-    forceCliMachine = [Environment]::GetEnvironmentVariable('CODEX_APP_SERVER_FORCE_CLI', 'Machine')
-}
-if ($Action -eq 'Set' -and $userValue -ne $Value) { throw 'Environment value verification failed.' }
-if ($Action -eq 'Clear' -and -not [string]::IsNullOrEmpty($userValue)) { throw 'Environment removal verification failed.' }
-$result | ConvertTo-Json -Compress
+param(
+    [ValidateSet('Read', 'Set', 'Clear')][string]$Action = 'Read',
+    [string]$Value = ''
+)
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$name = 'CODEX_APP_SERVER_WS_URL'
+
+function Broadcast-EnvironmentChange {
+    if (-not ('CodeRelax.EnvironmentBroadcast' -as [type])) {
+        Add-Type -Namespace CodeRelax -Name EnvironmentBroadcast -MemberDefinition @'
+[System.Runtime.InteropServices.DllImport("user32.dll", CharSet=System.Runtime.InteropServices.CharSet.Unicode, SetLastError=true)]
+public static extern System.IntPtr SendMessageTimeout(
+    System.IntPtr hWnd, uint Msg, System.UIntPtr wParam, string lParam,
+    uint flags, uint timeout, out System.UIntPtr result);
+'@
+    }
+    [UIntPtr]$result = [UIntPtr]::Zero
+    [void][CodeRelax.EnvironmentBroadcast]::SendMessageTimeout(
+        [IntPtr]0xffff, 0x001A, [UIntPtr]::Zero, 'Environment', 0x0002, 5000, [ref]$result)
+}
+
+if ($Action -eq 'Set') {
+    if ([string]::IsNullOrWhiteSpace($Value)) { throw 'Environment value is required.' }
+    [Environment]::SetEnvironmentVariable($name, $Value, 'User')
+    Broadcast-EnvironmentChange
+} elseif ($Action -eq 'Clear') {
+    [Environment]::SetEnvironmentVariable($name, $null, 'User')
+    Broadcast-EnvironmentChange
+}
+
+$userValue = [Environment]::GetEnvironmentVariable($name, 'User')
+$result = @{
+    userValue = $userValue
+    machineValue = [Environment]::GetEnvironmentVariable($name, 'Machine')
+    forceCliUser = [Environment]::GetEnvironmentVariable('CODEX_APP_SERVER_FORCE_CLI', 'User')
+    forceCliMachine = [Environment]::GetEnvironmentVariable('CODEX_APP_SERVER_FORCE_CLI', 'Machine')
+}
+if ($Action -eq 'Set' -and $userValue -ne $Value) { throw 'Environment value verification failed.' }
+if ($Action -eq 'Clear' -and -not [string]::IsNullOrEmpty($userValue)) { throw 'Environment removal verification failed.' }
+$result | ConvertTo-Json -Compress

package/dist/src/project-create.mjs

@@ -0,0 +1,119 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { projectRoots, projectSummary } from './project-management.mjs';
+import { projectLocations } from './platform/project-locations.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const uuid = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+const fail = message => { throw Object.assign(new Error(message), { statusCode: 400 }); };
+const pathKey = value => process.platform === 'win32' ? path.normalize(value).toLowerCase() : path.normalize(value);
+
+function defaultName(name) {
+  let value = path.basename(name).trim().replace(/[<>:"/\\|?*\x00-\x1f]/g, '_').replace(/[ .]+$/g, '') || 'New project';
+  if (/^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(value)) value = `_${value}`;
+  return value;
+}
+
+export async function createWorkstationProject(server, stateRoot, codexDataRoot, body, dependencies = {}) {
+  if (!uuid.test(body.idempotencyKey || '')) fail('项目创建标识无效。');
+  const name = typeof body.name === 'string' ? body.name.trim() : '';
+  if (!name) fail('请输入项目名称。');
+  if (!Array.isArray(body.roots) || body.roots.some(root => typeof root?.path !== 'string' || !path.isAbsolute(root.path.trim()))) {
+    fail('项目文件夹路径无效。');
+  }
+  const roots = body.roots.map(root => ({ path: path.normalize(root.path.trim()) }));
+  const signature = createHash('sha256').update(JSON.stringify({ name, roots })).digest('hex');
+  const directory = path.join(stateRoot, 'project-create-operations');
+  const record = path.join(directory, `${body.idempotencyKey}.json`);
+  const running = pending.get(record);
+  if (running) {
+    if (running.signature !== signature) fail('同一个创建请求不能修改项目名称或目录。');
+    return running.promise;
+  }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { signature, promise });
+  return promise;
+
+  async function perform() {
+    await fs.mkdir(directory, { recursive: true });
+    let operation = readRecord(record);
+    if (operation && operation.signature !== signature) fail('项目创建标识已用于其他内容，请重新打开项目编辑器。');
+    if (operation?.result) return operation.result;
+    operation ||= { signature, name, roots };
+    const save = () => writeRecord(record, operation);
+    const rpc = (method, params) => server.request(method, params);
+    const register = dependencies.registration || withDesktopProjectRegistration;
+    try {
+      return await register({ stateRoot, codexDataRoot, operationId: body.idempotencyKey,
+        confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+        // The restart confirmation and state checks happen before any
+        // directory or project write. Existing folders are never moved or copied.
+        if (!operation.resolvedRoots) {
+          operation.resolvedRoots = await projectRoots(rpc, roots);
+          if (!operation.resolvedRoots.length) {
+            const locations = await (dependencies.locations || projectLocations)();
+            await rpc('fs/createDirectory', { path: locations.defaultParent, recursive: true });
+            const entries = (await rpc('fs/readDirectory', { path: locations.defaultParent })).entries;
+            const names = new Set(entries.map(entry => entry.fileName.toLowerCase()));
+            const base = defaultName(name);
+            let folder = base;
+            for (let suffix = 2; names.has(folder.toLowerCase()); suffix++) folder = `${base} ${suffix}`;
+            operation.defaultDirectory = path.join(locations.defaultParent, folder);
+            operation.resolvedRoots = [{ path: operation.defaultDirectory }];
+          }
+          save();
+        }
+        if (operation.defaultDirectory && !operation.directoryCreated) {
+          if (operation.directoryAttempted) {
+            // On an explicit retry, keep the originally allocated directory. Never
+            // allocate another name after an interrupted createDirectory response.
+            await projectRoots(rpc, operation.resolvedRoots);
+          } else {
+            operation.directoryAttempted = true; save();
+            await rpc('fs/createDirectory', { path: operation.defaultDirectory, recursive: false });
+          }
+          operation.directoryCreated = true; save();
+          try {
+            const result = await rpc('command/exec', { command: ['git', 'init'], cwd: operation.defaultDirectory, timeoutMs: 10000 });
+            if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout || `退出码 ${result.exitCode}`);
+          } catch (error) { operation.gitWarning = `项目目录已创建，Git 初始化未完成：${error.message}`; save(); }
+        }
+        const resolvedRoots = await projectRoots(rpc, operation.resolvedRoots);
+        if (!operation.projectId) {
+          operation.createAttempted = true; save();
+          // Native project/create owns idempotency; a retry uses this exact key
+          // and original roots on the same server, never a second transport.
+          const created = await rpc('project/create', { name, roots: resolvedRoots, idempotencyKey: body.idempotencyKey });
+          operation.projectId = created.project.id; save();
+        }
+        const { project } = await rpc('project/read', { projectId: operation.projectId });
+        if (project.id !== operation.projectId || project.name !== name || project.roots.length !== resolvedRoots.length
+          || project.roots.some((root, index) => pathKey(root.path) !== pathKey(resolvedRoots[index].path))) {
+          throw new Error('已创建项目的名称或目录发生变化，未覆盖其内容。');
+        }
+        if (!operation.ordered) {
+          const first = (await rpc('project/list', { limit: 1, sortKey: 'position', sortDirection: 'asc' })).data[0];
+          if (first && first.id !== project.id) await rpc('project/move', { projectId: project.id, beforeProjectId: first.id });
+          operation.ordered = true; save();
+        }
+        const desktopRegistration = await desktop.register(project, operation, save);
+        operation.result = { project: projectSummary(project), desktopRegistration,
+          ...(operation.gitWarning ? { warning: operation.gitWarning } : {}) };
+        save();
+        return operation.result;
+      });
+    } catch (error) {
+      if (operation.projectId || operation.createAttempted || operation.directoryAttempted) {
+        error.details = { ...error.details, projectCreationPending: true,
+          ...(operation.projectId ? { createdProjectId: operation.projectId } : {}) };
+        error.message += operation.projectId
+          ? ' 项目已创建，请继续完成桌面登记；会沿用同一项目，不会重复创建。'
+          : ' 请继续核对本次创建；会沿用原请求标识和目录。';
+      } else error.details = { ...error.details, projectCreationPending: false };
+      throw error;
+    }
+  }
+}

package/dist/src/project-management.mjs

@@ -0,0 +1,69 @@
+import path from 'node:path';
+
+const fail = (message, statusCode = 400) => { throw Object.assign(new Error(message), { statusCode }); };
+const pathKey = value => process.platform === 'win32' ? value.toLowerCase() : value;
+
+function absoluteDirectory(value) {
+  if (typeof value !== 'string' || !value.trim() || !path.isAbsolute(value.trim())) fail('请输入电脑上的绝对文件夹路径。');
+  return path.normalize(value.trim());
+}
+
+async function directory(rpc, value) {
+  const target = absoluteDirectory(value);
+  const stat = await rpc('fs/getMetadata', { path: target });
+  if (!stat.isDirectory) fail(`此路径不是文件夹：${target}`);
+  return target;
+}
+
+function folderName(value) {
+  if (typeof value !== 'string' || !value.trim() || /[<>:"/\\|?*\x00-\x1f]/.test(value) || /[ .]$/.test(value)
+    || /^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(value) || ['.', '..'].includes(value)) {
+    fail('文件夹名称无效，请勿使用路径分隔符或系统保留名称。');
+  }
+  return value;
+}
+
+export async function projectRoots(rpc, roots) {
+  if (!Array.isArray(roots)) fail('项目文件夹列表无效。');
+  const result = [], seen = new Set();
+  for (const root of roots) {
+    const target = await directory(rpc, root?.path);
+    const key = pathKey(target);
+    if (seen.has(key)) fail(`重复的项目文件夹：${target}`);
+    seen.add(key); result.push({ path: target });
+  }
+  return result;
+}
+
+export function projectSummary(project) {
+  return { projectId: project.id, name: project.name, label: project.name, roots: project.roots,
+    path: project.roots[0]?.path || '', cwd: project.roots[0]?.path || '', hostId: 'local' };
+}
+
+export async function browseProjectFolders(rpc, locations, value) {
+  const target = await directory(rpc, value || locations.home);
+  const entries = (await rpc('fs/readDirectory', { path: target })).entries
+    .filter(entry => entry.isDirectory).map(entry => ({ name: entry.fileName, path: path.join(target, entry.fileName) }))
+    .sort((a, b) => a.name.localeCompare(b.name, 'zh-CN', { numeric: true }));
+  return { path: target, parent: path.dirname(target) === target ? null : path.dirname(target), entries, ...locations };
+}
+
+export async function createProjectFolder(rpc, body) {
+  const parent = await directory(rpc, body.parent);
+  const name = folderName(body.name);
+  const entries = (await rpc('fs/readDirectory', { path: parent })).entries;
+  if (entries.some(entry => pathKey(entry.fileName) === pathKey(name))) fail('同名文件夹已存在，请选择它或使用其他名称。', 409);
+  const target = path.join(parent, name);
+  await rpc('fs/createDirectory', { path: target, recursive: false });
+  return { path: target };
+}
+
+export async function saveProject(rpc, locations, body, projectId = null) {
+  // Native creation and Desktop registration are coordinated by project-create.mjs.
+  if (!projectId) fail('新建项目必须通过工作站项目创建流程。', 503);
+  const name = typeof body.name === 'string' ? body.name.trim() : '';
+  if (!name) fail('请输入项目名称。');
+  const roots = await projectRoots(rpc, body.roots);
+  const result = await rpc('project/update', { name, roots, projectId });
+  return { project: projectSummary(result.project) };
+}

package/dist/src/runtime-discovery.mjs

@@ -0,0 +1,47 @@
+import { discoverCodex, resolveCodexRuntime, runtimeFingerprint } from './platform/codex-runtime.mjs';
+
+// Advisory discovery is independent of execution health. Failure here must never
+// disable an already running app-server or cause an automatic process restart.
+export class RuntimeDiscovery {
+  constructor({ stateRoot, host, url, interval = 60000 }) {
+    Object.assign(this, { stateRoot, host, url, interval });
+    this.state = {};
+  }
+  start() { this.stopped = false; void this.tick(); }
+  stop() { this.stopped = true; clearTimeout(this.timer); }
+  async sample() {
+    const errors = [];
+    try {
+      const candidates = discoverCodex();
+      const signature = JSON.stringify(candidates.map(candidate => {
+        try { return [candidate.executable, runtimeFingerprint(candidate.executable)]; }
+        catch (error) { return [candidate.executable, error.message]; }
+      }));
+      if (signature !== this.signature) {
+        await resolveCodexRuntime(this.stateRoot, { refresh: true });
+        this.signature = signature;
+      }
+    } catch (error) { errors.push(error.message); }
+    try {
+      if (this.host.desktopIntegration === false) {
+        this.state = { desktop: { state: 'unsupported', integrationSupported: false }, checkedAt: new Date().toISOString() };
+        if (errors.length) this.state.discoveryError = errors.join('\n');
+        return this.state;
+      }
+      const desktop = await this.host.inspect();
+      const attached = desktop.running && await this.host.sharedServiceUrl() === this.url;
+      this.state = { desktop: { state: !desktop.running ? 'stopped' : attached ? 'managed' : 'ordinary',
+        installed: Boolean(desktop.desktop), attachedToManagedServer: Boolean(attached) },
+        desktopRestartRecommended: Boolean(desktop.running && !attached), checkedAt: new Date().toISOString() };
+    } catch (error) {
+      errors.push(error.message);
+      this.state = { checkedAt: new Date().toISOString() };
+    }
+    if (errors.length) this.state.discoveryError = errors.join('\n');
+    return this.state;
+  }
+  async tick() {
+    await this.sample();
+    if (!this.stopped) { this.timer = setTimeout(() => this.tick(), this.interval); this.timer.unref?.(); }
+  }
+}

package/dist/src/self-relay/account-cleanup.mjs

@@ -0,0 +1,30 @@
+// Process one account per transaction; foreign keys keep incomplete deletion atomic.
+export async function purgeCancelledAccounts(pool, scopeHash) {
+  let purged = 0;
+  for (;;) {
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [rows] = await db.query(`SELECT id FROM users WHERE status='cancelled'
+        AND cancelled_at <= UTC_TIMESTAMP(3) - INTERVAL 1 DAY
+        ORDER BY cancelled_at LIMIT 1 FOR UPDATE`);
+      if (!rows.length) { await db.commit(); return purged; }
+      const id = rows[0].id;
+      const [identities] = await db.execute("SELECT normalized_value FROM user_login_identities WHERE user_id=? AND kind='email'", [id]);
+      for (const { normalized_value: email } of identities) {
+        await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        await db.execute('DELETE FROM email_send_limits WHERE scope_hash=?', [scopeHash(`email:${email}`)]);
+        await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
+      }
+      for (const table of ['user_sessions', 'relay_usage_actions', 'relay_usage_sessions',
+        'relay_usage_user_days', 'relay_usage_budgets', 'relay_usage_entitlements',
+        'relay_usage_totals', 'user_login_identities']) {
+        await db.execute(`DELETE FROM ${table} WHERE user_id=?`, [id]);
+      }
+      await db.execute('UPDATE computers SET owner_user_id=NULL WHERE owner_user_id=?', [id]);
+      await db.execute('DELETE FROM users WHERE id=?', [id]);
+      await db.commit(); purged++;
+    } catch (error) { await db.rollback(); throw error; }
+    finally { db.release(); }
+  }
+}