@walkhi/code-relax 0.1.0-beta.31 → 0.1.0-beta.33

package/dist/bin/publish-android-release.mjs

@@ -7,11 +7,12 @@ import { readAndroidCatalog } from '../src/self-relay/android-releases.mjs';
 import { readPublicManifest, updatePublicAndroid } from '../src/self-relay/public-releases.mjs';
 
 // This administrative command runs only on the deployment host; no keys cross SSH.
-const [apkFile, metadataFile] = process.argv.slice(2);
+const [apkFile, metadataFile, mode] = process.argv.slice(2);
+if (mode && mode !== '--existing-object') throw new Error('Invalid publication mode');
 if (!apkFile || !metadataFile) throw new Error('Usage: publish-android-release.mjs APK METADATA');
 const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
 const metadata = JSON.parse(fs.readFileSync(metadataFile, 'utf8'));
-if (metadata.packageName !== 'cn.walkhi.coderelax' || !/^[a-f0-9]{64}$/.test(metadata.certificateSha256)) throw new Error('Invalid APK identity');
+if (metadata.packageName !== 'com.walkhi.codexremote' || !/^[a-f0-9]{64}$/.test(metadata.certificateSha256)) throw new Error('Invalid APK identity');
 const { certificateSha256: expectedCertificate } = JSON.parse(fs.readFileSync('/etc/codex-relay/android-releases.json', 'utf8'));
 if (!/^[a-f0-9]{64}$/.test(expectedCertificate) || metadata.certificateSha256 !== expectedCertificate) throw new Error('APK signing certificate does not match release configuration');
 const bytes = fs.readFileSync(apkFile), sha256 = createHash('sha256').update(bytes).digest('hex');
@@ -30,7 +31,7 @@ try {
   const next = { latestVersionCode: versionCode, releases: [...catalog.releases.filter(item => item.versionCode !== versionCode), release] };
   fs.writeFileSync(temporary, JSON.stringify(next, null, 2) + '\n', { mode: 0o640 });
   readAndroidCatalog(temporary);
-  if (!previous) {
+  if (!previous && mode !== '--existing-object') {
     await new Promise((resolve, reject) => storage.cos.putObject({ ...storage.object(release), Body: bytes,
       ContentLength: bytes.length, ContentType: 'application/vnd.android.package-archive',
       ContentDisposition: `attachment; filename="Code-Relax-${versionName}.apk"`

package/dist/bin/publish-harmony-release.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
+import { readHarmonyConfig, hapName, validateHarmonyMetadata, checkHarmonyVersion,
+  verifyHarmony, activateHarmony } from '../relay-admin/harmony-release.mjs';
+
+// Local PowerShell releases use the same verifier, COS objects and activation as GitHub CD.
+const directory = path.resolve(process.argv[2] || '');
+if (!process.argv[2]) throw Error('Usage: publish-harmony-release.mjs DIRECTORY');
+let stage = 'metadata';
+try {
+  const manifest = JSON.parse(fs.readFileSync(path.join(directory, 'manifest.json5'), 'utf8')).app;
+  const config = readHarmonyConfig();
+  const metadata = { packageName: manifest.bundleName, versionCode: manifest.versionCode,
+    versionName: manifest.versionName, certificateSha256: config.certificateSha256 };
+  if (!Number.isSafeInteger(metadata.versionCode) || metadata.versionCode <= 0
+    || !/^\d+\.\d+\.\d+$/.test(metadata.versionName)) throw Error();
+  metadata.files = [hapName(metadata), 'manifest.json5', 'icon.png'].map(name => {
+    const bytes = fs.readFileSync(path.join(directory, name));
+    return { name, size: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex'),
+      contentMd5: createHash('md5').update(bytes).digest('base64') };
+  });
+  Object.assign(metadata, { size: metadata.files[0].size, sha256: metadata.files[0].sha256,
+    contentMd5: metadata.files[0].contentMd5 });
+  validateHarmonyMetadata(metadata, config);
+  checkHarmonyVersion(metadata);
+  stage = 'signature';
+  await verifyHarmony(directory, metadata, config);
+  const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
+  const keys = metadata.files.map(f => `code-relax/harmony/${metadata.versionCode}/${f.name}`);
+  stage = 'upload';
+  for (const [i, file] of metadata.files.entries()) {
+    await new Promise((resolve, reject) => storage.cos.putObject({ ...storage.object({ objectKey: keys[i] }),
+      Body: fs.createReadStream(path.join(directory, file.name)), ContentLength: file.size,
+      ContentMD5: file.contentMd5, ContentType: i === 1 ? 'application/json' : i === 2 ? 'image/png' : 'application/octet-stream',
+      Headers: { 'x-cos-forbid-overwrite': 'true' }
+    }, (error, result) => error ? reject(error) : resolve(result)));
+  }
+  stage = 'publication';
+  console.log(JSON.stringify(await activateHarmony(metadata, storage, keys)));
+} catch {
+  console.error(`Harmony publication failed at ${stage}; inspect objects and current version before retrying.`);
+  process.exitCode = 1;
+}

package/dist/bin/release-upload-server.mjs

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { createHash, randomUUID } from 'node:crypto';
+import { pipeline } from 'node:stream/promises';
+import { Transform, Readable } from 'node:stream';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import { verifyReleaseIdentity, createUploadSigner } from '../relay-admin/release-oidc.mjs';
+import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
+import { readAndroidCatalog } from '../src/self-relay/android-releases.mjs';
+
+import { readHarmonyConfig, validateHarmonyMetadata, checkHarmonyVersion, verifyHarmony, activateHarmony } from '../relay-admin/harmony-release.mjs';
+
+const execute = promisify(execFile);
+const config = JSON.parse(fs.readFileSync('/etc/codex-relay/android-releases.json', 'utf8'));
+const credential = JSON.parse(fs.readFileSync('/etc/codex-relay/tencent-monitor.json', 'utf8'));
+const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
+const signUpload = createUploadSigner(config, { secretId: credential.secretId, secretKey: credential.secretKey });
+const stateDir = '/var/lib/codex-relay/release-publisher';
+fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+const cosCall = (method, args) => new Promise((resolve, reject) => storage.cos[method](args, (e, r) => e ? reject(e) : resolve(r)));
+const object = key => ({ Bucket: config.bucket, Region: config.region, Key: key });
+const identityKey = p => `${p.repository_id}/${p.run_id}/${p.run_attempt}/${p.sha}`;
+const filename = id => path.join(stateDir, id + '.json');
+function save(row) {
+  const temp = filename(row.intentId) + '.' + randomUUID();
+  fs.writeFileSync(temp, JSON.stringify(row), { mode: 0o600 }); fs.renameSync(temp, filename(row.intentId));
+}
+const read = id => fs.existsSync(filename(id)) ? JSON.parse(fs.readFileSync(filename(id))) : null;
+const publicState = row => ({ ok: true, intentId: row.intentId, status: row.status, result: row.result, error: row.error });
+async function readJson(req) {
+  const chunks = []; let size = 0;
+  for await (const chunk of req) { size += chunk.length; if (size > 16384) throw Error('Request too large'); chunks.push(chunk); }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+}
+function metadataFrom(data, claims, target) {
+  const { packageName, versionCode, versionName, size, sha256, contentMd5, certificateSha256, notes,
+    buildCommit, artifactId, runId, sourceCommit, verifyOnly } = data;
+  if (!Number.isSafeInteger(versionCode) || versionCode < 1 || versionCode > 2100000000
+    || !/^[a-f0-9]{64}$/.test(sha256)
+    || !Number.isSafeInteger(size) || size < 1 || size > 200 * 1024 * 1024
+    || typeof notes !== 'string' || notes.length > 2000 || !/^[A-Za-z0-9+/]{22}==$/.test(contentMd5)
+    || !/^\d+$/.test(artifactId) || runId !== claims.run_id || sourceCommit !== claims.sha
+    || typeof verifyOnly !== 'boolean' || !/^[a-f0-9]{40}$/.test(buildCommit)) throw Error('Invalid metadata');
+  if (target === 'hap') validateHarmonyMetadata(data, readHarmonyConfig());
+  else if (packageName !== 'com.walkhi.codexremote' || !/^\d+\.\d+\.\d+\.\d+$/.test(versionName)
+    || !versionName.endsWith('.' + versionCode) || certificateSha256 !== config.certificateSha256) throw Error('Invalid Android identity');
+  return { target, ...(target === 'hap' ? { files: data.files } : {}), packageName, versionCode, versionName, size, sha256, contentMd5, certificateSha256, notes,
+    buildCommit, artifactId, runId, sourceCommit, verifyOnly };
+}
+let busy = false;
+const server = http.createServer(async (req, res) => {
+  const reply = (code, data) => { if (!res.destroyed) { res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(data)); } };
+  let claims;
+  try { claims = await verifyReleaseIdentity((req.headers.authorization || '').replace(/^Bearer /, '')); }
+  catch { reply(401, { ok: false, error: 'OIDC_REJECTED' }); return; }
+  const target = /^\/code-relax\/publish\/(android|hap)\/intents(?:\/|$)/.exec(req.url || '')?.[1];
+  if (!target) { reply(404, { ok: false, error: 'NOT_FOUND' }); return; }
+  const prefix = `/code-relax/publish/${target}/intents`;
+  try {
+    if (req.method === 'POST' && req.url === prefix) {
+      let metadata;
+      try { metadata = metadataFrom(await readJson(req), claims, target); } catch { reply(400, { ok: false, error: 'INVALID_RELEASE' }); return; }
+      if (!metadata.verifyOnly && target === 'hap') {
+        try { checkHarmonyVersion(metadata); } catch { reply(409, { ok: false, error: 'VERSION_CONFLICT' }); return; }
+      }
+      if (!metadata.verifyOnly && target === 'android') {
+        const catalog = readAndroidCatalog(config.catalogFile);
+        const previous = catalog.releases.find(x => x.versionCode === metadata.versionCode);
+        if (catalog.latestVersionCode > metadata.versionCode || (previous && previous.sha256 !== metadata.sha256)) {
+          reply(409, { ok: false, error: 'VERSION_CONFLICT' }); return;
+        }
+      }
+      const identity = identityKey(claims);
+      const intentId = createHash('sha256').update(JSON.stringify({ identity, metadata })).digest('hex');
+      let row = read(intentId);
+      if (row && row.status !== 'prepared') { reply(200, publicState(row)); return; }
+      const key = metadata.verifyOnly ? `code-relax/android/ci-verification/${claims.run_id}/${intentId}.apk`
+        : `code-relax/android/${metadata.versionCode}/Code-Relax-${metadata.sha256.slice(0, 16)}.apk`;
+      const keys = target === 'hap' ? metadata.files.map(f => metadata.verifyOnly
+        ? `code-relax/harmony/ci-verification/${claims.run_id}/${intentId}/${f.name}`
+        : `code-relax/harmony/${metadata.versionCode}/${f.name}`) : [key];
+      row ??= { intentId, identity, metadata, key, keys, status: 'prepared' };
+      save(row);
+      const grant = target === 'hap' ? { uploads: await Promise.all(metadata.files.map(async (f, i) => ({ name: f.name,
+        ...await signUpload(keys[i], f, i === 1 ? 'application/json' : i === 2 ? 'image/png' : 'application/octet-stream') }))) }
+        : await signUpload(key, metadata);
+      reply(200, { ...publicState(row), ...grant }); return;
+    }
+    const match = new RegExp(`^${prefix}/([a-f0-9]{64})(/complete)?$`).exec(req.url || '');
+    if (!match || !((!match[2] && req.method === 'GET') || (match[2] && req.method === 'POST'))) {
+      reply(404, { ok: false, error: 'NOT_FOUND' }); return;
+    }
+    const row = read(match[1]);
+    if (!row || row.identity !== identityKey(claims) || (row.metadata.target || 'android') !== target) { reply(404, { ok: false, error: 'INTENT_NOT_FOUND' }); return; }
+    if (match[2] && row.status === 'prepared') {
+      if (busy) { reply(409, { ok: false, error: 'PUBLICATION_BUSY' }); return; }
+      busy = true; row.status = 'validating'; save(row);
+      void complete(row).finally(() => { busy = false; });
+    }
+    reply(row.status === 'validating' ? 202 : 200, publicState(row));
+  } catch (error) {
+    console.error(JSON.stringify({ event: 'release-api-failed', code: /^[A-Za-z.]+$/.test(error.code || '') ? error.code : 'io-or-provider' }));
+    reply(503, { ok: false, error: 'RELEASE_UNAVAILABLE' });
+  }
+});
+async function complete(row) {
+  const { metadata, key } = row;
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-relax-release-'));
+  const apk = path.join(dir, 'release.apk'), json = path.join(dir, 'release.json');
+  const hap = metadata.target === 'hap';
+  const files = hap ? metadata.files : [{ ...metadata, name: 'release.apk' }];
+  let stage = 'download';
+  try {
+    for (const [i, file] of files.entries()) {
+      const ticket = await cosCall('getObjectUrl', { ...object(row.keys?.[i] || key), Sign: true, Method: 'GET', Protocol: 'https:', Expires: 300 });
+      const response = await fetch(ticket.Url, { signal: AbortSignal.timeout(120000) });
+      if (!response.ok || Number(response.headers.get('content-length')) !== file.size) throw Error();
+      let size = 0; const hash = createHash('sha256'), md5 = createHash('md5');
+      await pipeline(Readable.fromWeb(response.body), new Transform({ transform(chunk, encoding, next) {
+        size += chunk.length; if (size > file.size) return next(Error('Oversize'));
+        hash.update(chunk); md5.update(chunk); next(null, chunk);
+      } }), fs.createWriteStream(path.join(dir, file.name), { flags: 'wx', mode: 0o600 }));
+      if (size !== file.size || hash.digest('hex') !== file.sha256 || md5.digest('base64') !== file.contentMd5) throw Error();
+      const unsigned = new URL(ticket.Url); unsigned.search = '';
+      if (!hap && (await fetch(unsigned, { method: 'HEAD', signal: AbortSignal.timeout(15000) })).status !== 403) throw Error();
+    }
+    if (hap) {
+      stage = 'harmony-signature';
+      await verifyHarmony(dir, metadata, readHarmonyConfig());
+      row.result = { sha256: metadata.sha256, versionCode: metadata.versionCode, size: metadata.size };
+      if (metadata.verifyOnly) row.status = 'verified';
+      else { stage = 'harmony-publish'; row.result = await activateHarmony(metadata, storage, row.keys); row.status = 'published'; }
+      save(row); return;
+    }
+    stage = 'signature';
+    const { stdout: signature } = await execute('/usr/bin/apksigner', ['verify', '--print-certs', apk], {
+      timeout: 30000, env: { ...process.env, JAVA_TOOL_OPTIONS: '-Xmx256m' } });
+    const certificates = [...signature.matchAll(/^Signer #\d+ certificate SHA-256 digest: ([a-f0-9]{64})$/gm)];
+    if (certificates.length !== 1 || certificates[0][1] !== metadata.certificateSha256) throw Error();
+    stage = 'identity';
+    const { stdout: badging } = await execute('/usr/bin/aapt', ['dump', 'badging', apk], { timeout: 30000 });
+    const identity = /^package: name='([^']+)' versionCode='(\d+)' versionName='([^']+)'/m.exec(badging);
+    if (!identity || identity[1] !== metadata.packageName || Number(identity[2]) !== metadata.versionCode
+      || identity[3] !== metadata.versionName || /^application-debuggable/m.test(badging)) throw Error();
+    row.result = { sha256: metadata.sha256, versionCode: metadata.versionCode, size: metadata.size };
+    if (metadata.verifyOnly) row.status = 'verified';
+    else {
+      stage = 'publish';
+      fs.writeFileSync(json, JSON.stringify(metadata), { mode: 0o600 });
+      const { stdout } = await execute(process.execPath, [fileURLToPath(new URL('./publish-android-release.mjs', import.meta.url)), apk, json, '--existing-object'], { timeout: 240000 });
+      row.result = JSON.parse(stdout.trim()); row.status = 'published';
+    }
+    save(row);
+  } catch (error) {
+    row.status = 'failed'; row.error = `RELEASE_${stage.toUpperCase()}_FAILED`; save(row);
+    console.error(JSON.stringify({ event: 'release-validation-failed', intentId: row.intentId, stage, code: /^[A-Za-z0-9_.-]+$/.test(error.code || '') ? error.code : 'validation' }));
+  } finally {
+    for (const file of [...files.map(f => path.join(dir, f.name)), json]) fs.rmSync(file, { force: true }); fs.rmdirSync(dir);
+    // Verification objects remain private evidence; the deployment identity has no DeleteObject grant.
+  }
+}
+// A restart never blindly launches an interrupted publisher a second time.
+for (const name of fs.readdirSync(stateDir).filter(x => /^[a-f0-9]{64}\.json$/.test(x))) {
+  const row = read(name.slice(0, -5));
+  if (row.status === 'validating') { row.status = 'failed'; row.error = 'INTERRUPTED_CHECK_LATEST'; save(row); }
+}
+server.requestTimeout = 15000;
+server.listen(45852, '127.0.0.1');
+process.on('SIGTERM', () => { server.close(); const timer = setInterval(() => { if (!busy) { clearInterval(timer); process.exit(0); } }, 250); });

package/dist/build-platform.json

@@ -1 +1 @@
-{"layout":"npm-platform-packages","version":"0.1.0-beta.31"}
+{"layout":"npm-platform-packages","version":"0.1.0-beta.33"}

package/dist/shared/p2p-file-channel.cjs

@@ -42,7 +42,11 @@
           if (this.io.send(item.frames[item.index]) === false) throw new Error('文件直连发送失败');
           if (++item.index === item.frames.length) { this.outbound.shift(); this.queued -= item.size; }
         }
-      } catch { this.close(1011); }
+      } catch { this.close(1011, 'send-failed'); }
+    }
+    waitForPartial() {
+      clearTimeout(this.timer);
+      this.timer = setTimeout(() => this.close(1008, 'partial-idle-timeout'), 30000);
     }
     receive(value) {
       if (this.readyState !== 1) return;
@@ -53,22 +57,22 @@
           if (frame.type !== 'rtc-file-bytes') { this.io.received?.(); this.emit('message', { data: value }); return; }
           if (!Number.isSafeInteger(frame.length) || frame.length < 1 || frame.length > MAX) throw new Error();
           this.io.received?.(); this.partial = { data: new Uint8Array(frame.length), offset: 0 };
-          this.timer = setTimeout(() => this.close(1008), 30000); return;
+          this.waitForPartial(); return;
         }
         const bytes = value instanceof Uint8Array ? value : new Uint8Array(value), part = this.partial;
         if (!part || bytes.length !== Math.min(PART, part.data.length - part.offset)) throw new Error();
-        this.io.received?.(); part.data.set(bytes, part.offset); part.offset += bytes.length;
+        this.waitForPartial(); this.io.received?.(); part.data.set(bytes, part.offset); part.offset += bytes.length;
         if (part.offset === part.data.length) {
           this.partial = null; clearTimeout(this.timer); this.timer = null;
           this.emit('message', { data: part.data.buffer });
         }
-      } catch { this.close(1008); }
+      } catch { this.close(1008, 'invalid-frame'); }
     }
-    close(code = 1000) {
+    close(code = 1000, reason = '') {
       if (this.readyState === 3) return;
       this.readyState = 3; clearTimeout(this.timer); this.timer = null;
       this.partial = null; this.outbound = []; this.queued = 0;
-      this.io.close(); this.emit('close', { code });
+      this.io.close(); this.emit('close', { code, reason });
     }
   };
 });

package/dist/shared/question-attention.cjs

@@ -36,5 +36,34 @@
     }
     return null;
   }
-  return { parseQuestionReply, questionIds, fromNotification };
+  // A successful submission is enough to dismiss a question; model consumption
+  // can happen later. Store identities only, never answers or replayable writes.
+  function createAnswerStore({ storage, scope, onError }) {
+    const records = new Map();
+    const key = thread => 'codexRemoteAnsweredQuestions:' + JSON.stringify([
+      scope(), thread.hostId || 'local', thread.id,
+    ]);
+    function read(owner) {
+      if (!records.has(owner)) {
+        try {
+          const ids = JSON.parse(storage.getItem(owner) || '[]');
+          records.set(owner, new Set(Array.isArray(ids) ? ids.filter(id => typeof id === 'string') : []));
+        } catch (error) { records.set(owner, new Set()); onError?.(error); }
+      }
+      return records.get(owner);
+    }
+    function remember(owner, ids) {
+      const answered = read(owner);
+      let changed = false;
+      for (const id of ids) if (typeof id === 'string' && !answered.has(id)) {
+        answered.add(id); changed = true;
+      }
+      if (changed) {
+        try { storage.setItem(owner, JSON.stringify([...answered])); }
+        catch (error) { onError?.(error); }
+      }
+    }
+    return { key, has: (thread, id) => read(key(thread)).has(id), remember };
+  }
+  return { parseQuestionReply, questionIds, fromNotification, createAnswerStore };
 });

package/dist/src/self-relay/public-releases.mjs

@@ -14,16 +14,34 @@ export function updatePublicAndroid(release, file = publicManifestFile) {
     || !/^\d+\.\d+\.\d+\.\d+$/.test(release.versionName)
     || !Number.isSafeInteger(release.size) || release.size <= 0
     || !/^[a-f0-9]{64}$/.test(release.sha256)) throw new Error('Invalid public Android release');
+  return updateMobileManifest('android', release, file);
+}
+
+export function updatePublicHarmony(release, file = publicManifestFile) {
+  if (!Number.isSafeInteger(release.versionCode) || !/^\d+\.\d+\.\d+$/.test(release.versionName)
+    || !/^[a-f0-9]{64}$/.test(release.sha256) || !Number.isSafeInteger(release.size) || release.size <= 0
+    || release.manifestUrl !== `https://download.coderelax.cn/code-relax/harmony/${release.versionCode}/manifest.json5`)
+    throw Error('Invalid public Harmony release');
+  return updateMobileManifest('harmonyos', release, file);
+}
+
+function updateMobileManifest(platform, release, file) {
   const lock = file + '.lock', temporary = file + '.new';
   const handle = fs.openSync(lock, 'wx', 0o600);
   try {
     const manifest = readPublicManifest(file);
-    if (manifest.android.versionCode > release.versionCode) throw new Error('Public Android version would go backwards');
-    manifest.android = { status: 'published', statusText: { zh: '', en: '' }, version: release.versionName,
+    if (manifest[platform].versionCode > release.versionCode) throw new Error('Public Android version would go backwards');
+    manifest[platform] = { status: 'published', statusText: { zh: '', en: '' }, version: release.versionName,
       versionCode: release.versionCode, size: release.size, sha256: release.sha256,
       url: `https://api.coderelax.cn/code-relax/android/download?versionCode=${release.versionCode}&redirect=1`, action: 'download' };
+    if (platform === 'harmonyos') {
+      manifest.harmonyos.statusText = { zh: '指定设备测试版', en: 'Registered-device test' };
+      manifest.harmonyos.url = 'https://www.coderelax.cn/code-relax/install';
+      manifest.harmonyos.manifestUrl = release.manifestUrl;
+    }
     const owner = fs.statSync(file);
     fs.writeFileSync(temporary, JSON.stringify(manifest, null, 2) + '\n', { mode: owner.mode & 0o777 });
+    fs.chmodSync(temporary, owner.mode & 0o777);
     if (process.platform !== 'win32') fs.chownSync(temporary, owner.uid, owner.gid);
     fs.renameSync(temporary, file);
   } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@walkhi/code-relax",
-  "version": "0.1.0-beta.31",
+  "version": "0.1.0-beta.33",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",
@@ -41,8 +41,8 @@
     "tag": "beta"
   },
   "optionalDependencies": {
-    "@walkhi/code-relax-native-win32-x64": "0.1.0-beta.31",
-    "@walkhi/code-relax-native-darwin-arm64": "0.1.0-beta.31",
-    "@walkhi/code-relax-native-darwin-x64": "0.1.0-beta.31"
+    "@walkhi/code-relax-native-win32-x64": "0.1.0-beta.33",
+    "@walkhi/code-relax-native-darwin-arm64": "0.1.0-beta.33",
+    "@walkhi/code-relax-native-darwin-x64": "0.1.0-beta.33"
   }
 }

package/tools/postinstall.mjs

@@ -53,14 +53,52 @@ export function formatSetupOutput(output) {
   try {
     const result = JSON.parse(output);
     const migration = result.managedAppServerMigration || {};
-    return `Code Relax ${result.version || '未知版本'} 安装成功。\n`
+    return `Code Relax ${result.version || '未知版本'} 服务安装完成。\n`
       + '工作站服务和 Codex 内核已就绪，已启用登录自启。\n'
       + (migration.restarted ? 'Codex 内核已更新并重启；请检查安装前正在进行的任务。\n' : '')
-      + (result.desktopRestartRecommended ? 'Codex Desktop：请完全退出后重新打开。\n' : '')
-      + '生成配对二维码：relax pair\n';
+      + (result.desktopRestartRecommended ? 'Codex Desktop：请完全退出后重新打开。\n' : '');
   } catch { return output; }
 }
 
+// npm owns command links. Inspect them without changing the user's shell configuration.
+export function commandDiagnostics(entry, { prefix, env = process.env, platform = process.platform } = {}) {
+  const windows = platform === 'win32';
+  const bin = windows ? prefix : path.join(prefix, 'bin');
+  const command = path.join(bin, windows ? 'relax.cmd' : 'relax');
+  const lines = [`命令入口：${command}`];
+  let linkReady = false;
+  try {
+    if (windows) {
+      const shim = fs.readFileSync(command, 'utf8');
+      linkReady = shim.replaceAll('\\', '/').includes('node_modules/@walkhi/code-relax/dist/bin/codex-remote.mjs') && fs.existsSync(entry);
+    } else {
+      linkReady = fs.realpathSync(command) === fs.realpathSync(entry);
+      fs.accessSync(command, fs.constants.X_OK);
+    }
+    lines.push(linkReady ? '命令链接：正常' : '命令链接：目标与本次安装不一致');
+  } catch (error) {
+    linkReady = false;
+    lines.push(`命令链接：不可用（${error.code || error.message}）`);
+  }
+  const normalize = value => {
+    let resolved;
+    try { resolved = fs.realpathSync(value); } catch { resolved = path.resolve(value); }
+    return windows ? resolved.toLowerCase() : resolved;
+  };
+  const pathValue = Object.entries(env).find(([key]) => key.toLowerCase() === 'path')?.[1] || '';
+  const onPath = pathValue.split(windows ? ';' : ':').filter(Boolean)
+    .some(value => normalize(value.replace(/^"|"$/g, '')) === normalize(bin));
+  lines.push(`安装进程 PATH：${onPath ? '包含' : '未包含'}全局命令目录`);
+  lines.push('注：npm 会调整安装进程 PATH；当前终端能否直接找到命令仍以终端为准。');
+  if (!linkReady) lines.push('CLI 入口异常；服务状态请以上方健康检查为准，请保留本次诊断输出。');
+  else if (!onPath) lines.push('全局命令目录未在 PATH 中，可先使用下方完整路径命令。');
+  const quote = value => "'" + value.replaceAll("'", windows ? "''" : "'\"'\"'") + "'";
+  const direct = `${windows ? '& ' : ''}${quote(process.execPath)} ${quote(entry)}`;
+  lines.push(`无需依赖 relax 命令的检查入口${windows ? '（PowerShell）' : ''}：`, `${direct} doctor`);
+  lines.push('生成配对二维码：', `${direct} pair`);
+  return lines.join('\n') + '\n';
+}
+
 function installationSnapshot() {
   const recordPath = path.join(serviceRoot, 'installation.json');
   if (!fs.existsSync(serviceRoot)) return { exists: false, valid: false };
@@ -113,8 +151,13 @@ if (invokedDirectly && process.env.npm_config_global === 'true') {
     prepareNativePackage(fileURLToPath(new URL('../', import.meta.url)));
     setupStarted = true;
     runStage(entry, 'setup', ['setup', '--json'], output => formatSetupOutput(output));
+    try { runStage(entry, 'doctor', ['doctor']); }
+    catch (error) {
+      console.error('服务安装已完成，但安装后健康检查未通过；请查看上方诊断与安装日志。');
+      process.exitCode = 1;
+    }
     console.log(`安装日志：${installLog}`);
-    appendLog('[postinstall] success');
+    appendLog(process.exitCode ? '[postinstall] failed stage=doctor' : '[postinstall] success');
   } catch (error) {
     const current = installationSnapshot();
     if (!setupStarted) console.error(`平台组件检查失败：${error.message}`);
@@ -123,5 +166,16 @@ if (invokedDirectly && process.env.npm_config_global === 'true') {
     console.error(`安装日志：${installLog}`);
     appendLog('[postinstall] failed stage=setup');
     process.exitCode = Number.isInteger(error?.status) && error.status > 0 ? error.status : 1;
+  } finally {
+    try {
+      const prefix = execFileSync(process.execPath, [process.env.npm_execpath, 'prefix', '--global'],
+        { encoding: 'utf8', windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+      const output = commandDiagnostics(entry, { prefix });
+      process.stdout.write(output);
+      appendLog(`[command-diagnostics]\n${output}`);
+    } catch (error) {
+      console.error(`命令入口诊断失败：${error.message}`);
+      appendLog(`[command-diagnostics] failed: ${error.message}`);
+    }
   }
 }