@walkhi/code-relax 0.1.0-beta.42 → 0.1.0-beta.43

package/README.md

@@ -14,7 +14,7 @@ npm i -g @walkhi/code-relax@latest --allow-scripts=@walkhi/code-relax --foregrou
 
 以下目录与环境变量配置说明适用于 Windows；Mac/Linux 见下方跨平台入口。首次安装前先保存工作，并从 Codex 菜单或 Windows 托盘完全退出 Codex。更新无需先停止正在运行的桌面服务；安装器会短暂停止、替换并恢复服务。npm 全局安装会自动执行 `setup` 和 Skill 安装。`setup` 将完整服务部署到 `%LOCALAPPDATA%\Programs\CodexRemote\service`，记录安装所用 Node 的绝对路径，不复制 Node。配置、日志和二维码以 `installation.json.stateRoot` 为准，通常位于 `%LOCALAPPDATA%\CodexRemote`，MSIX 环境可能解析到包缓存目录；附件位于 `%ProgramData%\CodexRemote\attachments`。
 
-`setup` 立即启动桌面服务和固定 45839 Codex 内核，并启用当前用户登录自启；自启不打开 Codex。Codex 内核健康后配置当前用户 `CODEX_APP_SERVER_WS_URL`，之后正常启动的 Desktop 自动接入。若安装时 Desktop 仍未接入，安装器会关闭并重新打开 Desktop；安装前应保存工作。普通更新无接入或启动链迁移需求时复用现有内核。
+`setup` 立即启动桌面服务和自动选用可用回环端口的 Codex 内核，并启用当前用户登录自启；自启不打开 Codex。Codex 内核健康后配置当前用户 `CODEX_APP_SERVER_WS_URL`，之后正常启动的 Desktop 自动接入。若安装时 Desktop 仍未接入，安装器会关闭并重新打开 Desktop；安装前应保存工作。普通更新无接入或启动链迁移需求时复用现有内核。
 
 ## Linux 源码测试
 
@@ -32,9 +32,9 @@ relax diag        # 输出供客服或技术人员使用的详细诊断报告
 relax kernel-restart --confirm # 重启内核并启用已选更新，等待新内核就绪
 ```
 
-Codex 内核由官方 `codex app-server --listen ws://127.0.0.1:45839` 提供执行服务，Desktop 和桌面服务均可连接；它只监听回环地址。桌面服务独立报告内核健康、Desktop 接入和手机可写状态；Desktop 退出后，手机仍可操作内核中的任务。同一 thread 已被另一个实例持有时，手机只读且可重新检测。
+Codex 内核由官方 `codex app-server --listen ws://127.0.0.1:<实际端口>` 提供执行服务，Desktop 和桌面服务均可连接；它只监听回环地址。桌面服务独立报告内核健康、Desktop 接入和手机可写状态；Desktop 退出后，手机仍可操作内核中的任务。同一 thread 已被另一个实例持有时，手机只读且可重新检测。
 
-发现待启用内核更新时，手机“重启并更新”和 `relax kernel-restart --confirm` 复用同一受控停启流程：先验证候选，再停止旧内核，确认新内核协议就绪后恢复 Desktop，并按清单清理不再运行的旧版保留目录。手机工作站详情可确认让 Desktop 接入Codex 内核，独立进程逐步执行并保留桌面服务/中继连接，见[启用流程](../docs/shared-recovery.md)。本机恢复命令为 `relax desktop-recover --confirm`，查看恢复记录用 `relax diag`。桌面服务状态匹配且健康时直接复用；未知进程占用 45831/45839 时拒绝接管。
+发现待启用内核更新时，手机“重启并更新”和 `relax kernel-restart --confirm` 复用同一受控停启流程：先验证候选，再停止旧内核，确认新内核协议就绪后恢复 Desktop，并按清单清理不再运行的旧版保留目录。手机工作站详情可确认让 Desktop 接入Codex 内核，独立进程逐步执行并保留桌面服务/中继连接，见[启用流程](../docs/shared-recovery.md)。本机恢复命令为 `relax desktop-recover --confirm`，查看恢复记录用 `relax diag`。桌面服务状态匹配且健康时直接复用；未知进程占用 Bridge 端口 45831 时拒绝接管；内核默认尝试 45839，被占用则自动选择其他回环端口，不结束占用者。
 
 Codex 内核通过隐藏控制台启动，使后续控制台子进程继承隐藏窗口。手机的项目、任务列表和新建任务均使用Codex 内核，不依赖 Desktop 工具管道；项目和任务 ID 保持原生值。
 
@@ -93,3 +93,13 @@ registry 默认安装使用 `@walkhi/code-relax@latest`，主 CLI 为 `relax`，
 安装和启动成功后只显示结果与 `relax pair` 入口；配对成功显示二维码文件。`relax doctor` 报告工作站健康及实际问题，独立的 `relax diag` 默认用可读文本输出系统、Node、服务进程、逐项检查和 Desktop 接入排障记录；常规命令不再提供 `--detail`；`--json` 保留给安装器等现有程序调用。服务未运行或内核未就绪判为失败；未连接局域网只提示，不阻断中继使用。手机连通性不作为 CLI 检查项，doctor 不创建配对邀请。
 
 `doctor` 默认逐项说明安装文件、工作站服务和 Codex 内核的当前状态，问题集中给出处理方法。上次 Desktop 接入记录仅由 `diag` 读取，并明确标注排障用途；常规 `doctor` 不读取该记录，不参与当前健康判定，不拼接互相矛盾的阶段消息与最终错误。
+
+### 内核端口自动恢复（beta.43）
+
+无需手工设置端口。先复用记录中身份、监听与协议均验证通过的内核；没有可用内核时尝试上次端口／默认 45839，冲突后选择系统分配的空闲回环端口。端口抢占导致刚启动的进程退出时最多尝试五次；已启动但未就绪的内核保留身份记录，不创建第二个实例。
+
+只有进程身份、监听所有者、HTTP 就绪和 WebSocket 初始化全部通过后，才公布实际地址，并同步 Windows 当前用户的 `CODEX_APP_SERVER_WS_URL`。原值由 Code Relax 管理时自动更新；用户另行设置的值保留并明确报错。Mac/Linux 继续通过启动时环境传递实际地址，不修改 shell 配置。正常登录自启同样自动选端口。
+
+从旧版恢复可运行 `npm install -g @walkhi/code-relax@beta`，其安装流程自动部署并运行 setup；需要重试安装时运行 `relax setup`。不需要重启电脑或结束未知 PID。`relax status --json` 的 `managedAppServer.url` 显示实际地址。已经打开的终端和 Desktop 不能被外部原地修改环境；setup 沿用既有受控 Desktop 接入流程，新启动的进程使用更新后的值。
+
+实现依据与验证范围见 [动态端口审阅](../docs/managed-kernel-dynamic-port.md)。

package/dist/bin/codex-remote.mjs

@@ -22,7 +22,7 @@ import { resolveCodexRuntime } from '../src/platform/codex-runtime.mjs';
 import { controlRequest } from '../src/service-control.mjs';
 import { processAlive } from '../src/background-process.mjs';
 import { prepareNativePackage } from '../src/platform/native-package.mjs';
-import { managedAppServerUrl } from '../src/managed-app-server.mjs';
+import { readManagedEndpoint } from '../src/managed-endpoint.mjs';
 import { powerConfigPath, powerEnabled } from '../src/service-power.mjs';
 import { readDotsTasks } from '../src/dots-task-catalog.mjs';
 import { installDesktopHelper, desktopHelperStatus, removeDesktopHelper } from '../src/platform/windows/desktop-helper.mjs';
@@ -96,7 +96,9 @@ async function main() {
     return;
   }
   if (command === 'dots-tasks') {
-    const result = await readDotsTasks(managedAppServerUrl);
+    const url = readManagedEndpoint(runtimePaths().stateRoot);
+    if (!url) throw new Error('Codex 内核尚未就绪，请先运行 relax start。');
+    const result = await readDotsTasks(url);
     const statuses = { completed: '完成', inProgress: '进行中', failed: '失败', interrupted: '已中断' };
     console.log(json ? JSON.stringify(result) : result.tasks.length
       ? result.tasks.map(task => `${task.title || task.id} — ${statuses[task.latestTurn?.status] || task.status || '暂无轮次'}\n${task.cwd || ''}`).join('\n\n')
@@ -313,7 +315,7 @@ async function main() {
       throw new Error(bridge.managedAppServer?.error || '桌面服务已安装，但 Codex 内核未就绪；未写入 Desktop 环境变量。');
     }
     const environment = desktopBeforeSetup.desktop
-      ? await configureManagedEnvironment(physicalStateRoot) : { configured: false, reason: desktopHost.desktopIntegration === false ? 'desktop-integration-unsupported' : 'desktop-not-installed' };
+      ? await configureManagedEnvironment(physicalStateRoot, bridge.managedAppServer.url) : { configured: false, reason: desktopHost.desktopIntegration === false ? 'desktop-integration-unsupported' : 'desktop-not-installed' };
     let managedAppServerMigrated = false;
     const managedAppServerMigration = {
       required: bridge.managedAppServer.launcherRestartRequired === true || bridge.managedAppServer.updatePending === true,

package/dist/build-platform.json

@@ -1 +1 @@
-{"layout":"npm-platform-packages","version":"0.1.0-beta.42"}
+{"layout":"npm-platform-packages","version":"0.1.0-beta.43"}

package/dist/get-shared-service-url.ps1

@@ -1,6 +1,14 @@
-# Detect the Desktop connection, not merely a listening standalone server.
-$connections = @(Get-NetTCPConnection -RemotePort 45839 -State Established -ErrorAction SilentlyContinue | Where-Object {
+param([Parameter(Mandatory=$true)][string]$AppServerUrl)
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+if ($AppServerUrl -cnotmatch '^ws://127\.0\.0\.1:([1-9][0-9]{0,4})\z' -or [int]$Matches[1] -gt 65535) { throw 'Invalid managed app-server URL.' }
+$port = [int]$Matches[1]
+$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
+if (-not $package) { exit }
+$desktop = Join-Path $package.InstallLocation 'app/ChatGPT.exe'
+# Match an installed Desktop process connected to the selected loopback port.
+$connections = @(Get-NetTCPConnection -RemotePort $port -State Established -ErrorAction SilentlyContinue | Where-Object {
     $_.RemoteAddress -eq '127.0.0.1' -and
-    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName -eq 'ChatGPT'
+    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path -eq $desktop
 })
-if ($connections.Count) { 'ws://127.0.0.1:45839' }
+if ($connections.Count) { $AppServerUrl }

package/dist/src/desktop-launcher.mjs

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { readRecord } from './service-lifecycle.mjs';
-import { ManagedAppServer, managedAppServerUrl as sharedUrl, managedPortAvailable as portAvailable } from './managed-app-server.mjs';
+import { ManagedAppServer, managedPortAvailable as portAvailable } from './managed-app-server.mjs';
 export { portAvailable };
 export async function launchDesktop({ stateRoot, host, environment = process.env, available = portAvailable, wait = delay, timeout = 30000, recoveryId, progress = () => {} }) {
   fs.mkdirSync(stateRoot, { recursive: true });
@@ -31,7 +31,7 @@ export async function launchDesktop({ stateRoot, host, environment = process.env
     if (!await managed.start()) throw new Error(managed.snapshot().error || 'Codex 内核未就绪。');
     const runtime = readRecord(path.join(stateRoot, 'codex-runtime.json'));
     if (runtime?.codexHome) childEnv.CODEX_HOME = runtime.codexHome;
-    childEnv.CODEX_APP_SERVER_WS_URL = sharedUrl;
+    childEnv.CODEX_APP_SERVER_WS_URL = managed.snapshot().url;
     progress('starting-desktop');
     await host.startDesktop(info.desktop, childEnv);
     const deadline = Date.now() + timeout;

package/dist/src/dots-chat-server.mjs

@@ -242,6 +242,7 @@ export class DotsChatServer extends HostedHistoryAppServer {
       if (record.changeBytes > 8 * 1024 * 1024) { record.recoverAfter = sequence; record.changes.clear(); record.changeBytes = 0; }
       this.emit('turn', { thread: record.thread, turn, sequence, immediate: true });
     }
+    this.chatActivity.completeReply(threadId, changed);
     this.emit('notification', { method: 'thread/status/changed', params: { threadId, status: record.thread.status,
       updatedAt: record.thread.updatedAt, chatRevision: record.thread.chatRevision, chatMessageRevision: record.thread.chatMessageRevision } });
     this.saveHistoryWindow(threadId);

package/dist/src/dots-room-activity.mjs

@@ -1,12 +1,21 @@
 import { EventEmitter } from 'node:events';
 
-// Desktop's room-live SSE owns the watch; Celsius carries its revisioned state.
+// Desktop 26.1007.9446.0: room-live activity and responding heartbeats are
+// independent. Heartbeats expire after 10s; Dot reply handoff lasts at most 5s.
+const typingTimeout = 10000, handoffTimeout = 5000;
+const statusLabels = {
+  working: '正在处理…', searching: '正在搜索…', creating: '正在创建…',
+  payment: '等待支付', 'needs input': '等待你的输入', paused: '已暂停',
+};
+const waitingStates = new Set(['payment', 'needs input', 'paused']);
+
 export class DotsRoomActivity extends EventEmitter {
   constructor(server) {
     super(); this.server = server; this.watches = new Map();
     this.message = (topic, event) => {
-      if (event?.type !== 'calpico-room-live') return;
       for (const watch of this.watches.values()) {
+        if (topic === 'calpico-chatgpt-messaging') { this.roomEvent(watch, event); continue; }
+        if (event?.type !== 'calpico-room-live') continue;
         const value = event.payload;
         if (watch.topic !== topic || watch.roomId !== value?.room_id || value.version !== 1) continue;
         if (!watch.subscriptionId) {
@@ -37,6 +46,57 @@ export class DotsRoomActivity extends EventEmitter {
     watch.activity = activity;
     for (const listener of watch.listeners) listener({ threadId: watch.threadId, activity });
   }
+  refresh(watch) {
+    const activity = watch.typing ? { kind: 'replying', label: '正在回复…', spinning: true }
+      : watch.liveActivity || (watch.handoffTimer ? { kind: 'replying', label: '正在回复…', spinning: true }
+        : watch.unavailable ? { kind: 'unavailable', label: '活动状态暂不可用', spinning: false } : null);
+    this.publish(watch, activity);
+  }
+  clearReply(watch) {
+    clearTimeout(watch.typingTimer); clearTimeout(watch.handoffTimer);
+    watch.typingTimer = null; watch.handoffTimer = null; watch.typing = false; watch.handoffMessageId = null;
+  }
+  handoff(watch, messageId = null) {
+    const wasTyping = watch.typing;
+    clearTimeout(watch.typingTimer); watch.typingTimer = null; watch.typing = false;
+    if (messageId && (wasTyping || watch.handoffTimer)) watch.handoffMessageId = messageId;
+    if (wasTyping && !watch.handoffTimer) {
+      watch.handoffTimer = setTimeout(() => {
+        watch.handoffTimer = null; watch.handoffMessageId = null;
+        if (this.watches.get(watch.threadId) === watch) this.refresh(watch);
+      }, handoffTimeout);
+      watch.handoffTimer.unref();
+    }
+    this.refresh(watch);
+  }
+  completeReply(threadId, turns) {
+    const watch = this.watches.get(threadId);
+    if (!watch?.handoffMessageId || !turns.some(turn => turn.id === watch.handoffMessageId
+      && turn.items.some(item => item.type === 'agentMessage' && !item.dotsStreaming))) return;
+    // The matching formal message has entered the existing chat stream.
+    clearTimeout(watch.handoffTimer); watch.handoffTimer = null; watch.handoffMessageId = null;
+    this.refresh(watch);
+  }
+  roomEvent(watch, event) {
+    if (!this.server.rooms.ready || !watch.roomId || event?.payload?.room_id !== watch.roomId) return;
+    const payload = event.payload, heartbeat = event.type === 'calpico-is-responding-heartbeat';
+    if (!heartbeat && event.type !== 'calpico-message-add') return;
+    const room = this.server.bindings.get(watch.threadId);
+    const sender = heartbeat ? payload.source : payload.message;
+    if (room?.id !== watch.roomId || !room.aeon_id || heartbeat && sender?.role !== 'user'
+      || !sender?.account_user_id
+      || !room.members.some(member => member.account_user_id === sender.account_user_id && member.aeon_id === room.aeon_id)) return;
+    if (!heartbeat || payload.typing === false) {
+      this.handoff(watch, heartbeat ? null : payload.message.id); return;
+    }
+    if (payload.typing != null && payload.typing !== true) return;
+    this.clearReply(watch); watch.typing = true;
+    watch.typingTimer = setTimeout(() => {
+      watch.typingTimer = null;
+      if (this.watches.get(watch.threadId) === watch) this.handoff(watch);
+    }, typingTimeout);
+    watch.typingTimer.unref(); this.refresh(watch);
+  }
   apply(watch, value) {
     if (value.subscription_id !== watch.subscriptionId || !Number.isSafeInteger(value.revision) || value.revision <= watch.revision) return;
     watch.revision = value.revision;
@@ -45,10 +105,23 @@ export class DotsRoomActivity extends EventEmitter {
     }
     if (value.type !== 'calpico-room-live-state' || !Array.isArray(value.threads)) return;
     const current = value.threads[0];
-    if (current?.stream_state !== 'attached' || current.turn_status !== 'in_progress') { this.publish(watch, null); return; }
-    watch.attempts = 0;
+    watch.attempts = 0; watch.unavailable = false; watch.liveActivity = null;
+    if (current?.stream_state !== 'attached') { this.refresh(watch); return; }
+    if (current.turn_status === 'failed') {
+      this.clearReply(watch); watch.liveActivity = { kind: 'error', label: '回复出错', spinning: false };
+      this.refresh(watch); return;
+    }
+    if (current.turn_status !== 'in_progress') { this.refresh(watch); return; }
+    const status = typeof current.activity_status?.status_type === 'string' ? current.activity_status.status_type.toLowerCase() : '';
     const label = current.activity_status?.status_label;
-    this.publish(watch, { kind: 'thinking', label: typeof label === 'string' && label.trim() ? label : '正在思考…' });
+    if (status !== 'ready') {
+      const waiting = waitingStates.has(status);
+      const fallback = Object.hasOwn(statusLabels, status) ? statusLabels[status] : null;
+      if (waiting) this.clearReply(watch);
+      watch.liveActivity = { kind: waiting ? 'waiting' : fallback ? 'operation' : 'thinking',
+        label: typeof label === 'string' && label.trim() ? label : fallback || '正在思考…', spinning: !waiting };
+    }
+    this.refresh(watch);
   }
   async start(watch) {
     const generation = ++watch.generation, controller = new AbortController();
@@ -77,15 +150,18 @@ export class DotsRoomActivity extends EventEmitter {
     } catch (error) { if (current()) this.fail(watch, error, ![401, 403, 404].includes(error.status)); }
   }
   fail(watch, error, retry) {
-    this.stop(watch); this.emit('unavailable', error);
+    this.stop(watch, true); watch.unavailable = true; this.refresh(watch); this.emit('unavailable', error);
     if (retry && watch.listeners.size && this.server.ready && watch.attempts < 5) {
       watch.timer = setTimeout(() => { watch.timer = null; void this.start(watch); }, Math.min(30000, 1000 * 2 ** watch.attempts++));
       watch.timer.unref();
     }
   }
-  stop(watch) {
+  stop(watch, keepReply = false) {
     watch.generation++; clearTimeout(watch.timer); watch.timer = null;
-    watch.controller?.abort(); watch.controller = null; watch.pending?.clear(); this.publish(watch, null);
+    watch.controller?.abort(); watch.controller = null; watch.pending?.clear(); watch.liveActivity = null;
+    watch.subscriptionId = null; watch.revision = -1;
+    if (!keepReply) { this.clearReply(watch); watch.unavailable = false; watch.roomId = null; }
+    if (!keepReply) this.publish(watch, null);
     // The SSE cancellation ends the server watch. The shared topic remains
     // subscribed while this account socket lives, avoiding unsubscribe races.
   }

package/dist/src/managed-app-server.mjs

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import { executableKey } from './platform/path-identity.mjs';
 import net from 'node:net';
+import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 import { EventEmitter } from 'node:events';
 import { setTimeout as delay } from 'node:timers/promises';
@@ -8,31 +9,47 @@ import { readRecord, writeRecord } from './service-lifecycle.mjs';
 import { SharedAppServer } from './shared-app-server.mjs';
 import { pruneRetainedDesktopRuntimes, resolveCodexRuntime, runtimeFilesAvailable } from './platform/codex-runtime.mjs';
 
-export const managedAppServerUrl = 'ws://127.0.0.1:45839';
-export const managedAppServerReadyUrl = 'http://127.0.0.1:45839/readyz';
+import { defaultManagedPort, managedProcessUrl } from './managed-endpoint.mjs';
+import { configureManagedEnvironment } from './platform/user-environment.mjs';
 export const managedAppServerLauncherRevision = 3;
 const retryDelays = [1_000, 2_000, 5_000, 10_000, 20_000];
 
-export function managedPortAvailable() {
+export function managedPortAvailable(port = defaultManagedPort) {
   return new Promise(resolve => {
     const server = net.createServer();
     server.once('error', () => resolve(false));
-    server.listen(45839, '127.0.0.1', () => server.close(() => resolve(true)));
+    server.listen(port, '127.0.0.1', () => server.close(() => resolve(true)));
+  });
+}
+export function availableManagedPort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const port = server.address().port;
+      server.close(error => error ? reject(error) : resolve(port));
+    });
   });
 }
 
 export class ManagedAppServer extends EventEmitter {
   constructor({ stateRoot, host, environment = process.env, available = managedPortAvailable,
-    wait = delay, timeout = 30_000, now = Date.now, client = new SharedAppServer(managedAppServerUrl) }) {
+    wait = delay, timeout = 30_000, now = Date.now, client = new SharedAppServer(`ws://127.0.0.1:${defaultManagedPort}`),
+    selectPort = availableManagedPort, configureEnvironment = configureManagedEnvironment, resolveRuntime = resolveCodexRuntime }) {
     super();
     this.stateRoot = stateRoot;
     this.host = host;
     this.environment = environment;
     this.available = available;
+    this.selectPort = selectPort;
+    this.configureEnvironment = configureEnvironment;
+    this.resolveRuntime = resolveRuntime;
     this.wait = wait;
     this.timeout = timeout;
     this.now = now;
     this.recordPath = path.join(stateRoot, 'managed-app-server.json');
+    this.pendingPath = path.join(stateRoot, 'managed-app-server.pending.json');
+    this.lockPath = path.join(stateRoot, 'managed-app-server.lock');
     this.client = client;
     this.state = { state: 'absent', ready: false, error: null };
     this.client.diagnosticIdentity = () => ({ kernelPid: this.state.pid ?? null, kernelCreated: this.state.created ?? null });
@@ -42,7 +59,7 @@ export class ManagedAppServer extends EventEmitter {
     this.retryAttempt = 0;
     this.retryAfter = 0;
     this.client.on('disconnected', () => {
-      if (!this.stopped && !this.restarting) this.failed('Codex 内核连接断开。');
+      if (!this.stopped && !this.restarting && !this.work) this.failed('Codex 内核连接断开。');
     });
   }
 
@@ -66,49 +83,83 @@ export class ManagedAppServer extends EventEmitter {
     return this.work;
   }
 
-  async ensureNow() {
+  async ensureNow(lockHeld = false) {
     // Keep an already verified instance available while the periodic identity
     // check runs; publishing "starting" every three seconds makes health flicker.
     if (!this.state.ready) this.publish({ state: 'starting', ready: false, error: null });
     try {
       fs.mkdirSync(this.stateRoot, { recursive: true });
-      let record = null, actual = null;
-      const candidate = readRecord(this.recordPath);
-      const process = candidate?.pid ? await this.host.process(candidate.pid) : null;
-      if (sameManagedProcess(candidate, process)) { record = candidate; actual = process; }
+      const release = lockHeld ? () => {} : await this.acquireLock();
+      if (!release) return false;
+      try {
+      const pending = readRecord(this.pendingPath);
+      if (pending?.phase === 'spawning') throw new Error('上次内核启动的进程交接未完成，已停止自动启动以避免重复内核；请检查内核启动日志与 managed-app-server.pending.json。');
+      let record = pending || readRecord(this.recordPath);
+      let actual = record?.pid ? await this.host.process(record.pid) : null;
+      if (actual && !sameManagedProcess(record, actual)) {
+        // Stale PID now belongs to someone else: leave it untouched and select
+        // another available endpoint rather than adopting or stopping it.
+        actual = null;
+        record = null;
+      }
       const startedHere = !actual;
       const savedRuntime = actual ? readRecord(path.join(this.stateRoot, 'codex-runtime.json')) : null;
       const runtime = actual && savedRuntime?.executable && runtimeFilesAvailable(savedRuntime.executable)
         ? savedRuntime
-        : await resolveCodexRuntime(this.stateRoot, { refresh: !actual, environment: this.environment });
+        : await this.resolveRuntime(this.stateRoot, { refresh: !actual, environment: this.environment });
       if (actual && !runtimeFilesAvailable(actual.executable)) {
-        throw new Error(`运行中的 Codex 内核目录已被移除或缺少配套 code-mode-host：${actual.executable}；已找到可用内核 ${runtime.executable}，请确认重启内核。`);
+        throw new Error(`运行中的 Codex 内核目录已被移除或缺少配套 code-mode-host：${actual.executable}；请确认重启内核。`);
       }
       if (!actual) {
-        if (!await this.available()) throw new Error('45839 被未识别进程占用，未启动或结束任何进程。');
-        const childEnvironment = { ...this.environment };
-        childEnvironment.CODEX_HOME = runtime.codexHome;
-        // Desktop's inherited INFO tracing can emit enter/exit on every poll.
-        // The managed background kernel retains warnings and errors only.
-        childEnvironment.RUST_LOG = 'warn';
+        fs.rmSync(this.pendingPath, { force: true });
+        const childEnvironment = { ...this.environment, CODEX_HOME: runtime.codexHome, RUST_LOG: 'warn' };
         for (const key of ['CODEX_APP_SERVER_WS_URL', 'CODEX_APP_SERVER_FORCE_CLI', 'CODEX_APP_TOOLS_PIPE_PATH']) delete childEnvironment[key];
         for (const key of Object.keys(childEnvironment)) {
           if (/^npm_/iu.test(key) || key.toUpperCase() === 'INIT_CWD') delete childEnvironment[key];
         }
-        const pid = await this.host.start(runtime.executable, ['app-server', '--listen', managedAppServerUrl], childEnvironment,
-          [path.join(this.stateRoot, 'managed-app-server.stdout.log'), path.join(this.stateRoot, 'managed-app-server.stderr.log')]);
-        const started = await this.host.process(pid);
-        if (!sameManagedProcess(started, started)) throw new Error('Codex 内核启动后进程身份无法确认。');
-        actual = started;
-        record = { ...started, launcherRevision: managedAppServerLauncherRevision };
-        writeRecord(this.recordPath, record);
-      } else if (!readRecord(this.recordPath)) {
-        record = { ...actual, launcherRevision: Number.isSafeInteger(record?.launcherRevision) ? record.launcherRevision : 0 };
-        writeRecord(this.recordPath, record);
-      }
-      await this.waitUntilReady(actual);
-      await this.client.connect();
-      if (!this.client.ready) throw new Error('Codex 内核协议初始化未完成。');
+        // A probe cannot reserve a port for another process. Retry only when our
+        // previous child has definitely exited, never on a live unready kernel.
+        for (let attempt = 0; attempt < 5; attempt++) {
+          const preferred = attempt === 0 ? Number(managedProcessUrl(record)?.split(':').at(-1)) || defaultManagedPort : 0;
+          const port = preferred && await this.available(preferred) ? preferred : await this.selectPort();
+          const url = `ws://127.0.0.1:${port}`;
+          // Commit intent before spawning: if the launcher dies before it can
+          // record the child PID, a successor must fail closed, not duplicate it.
+          writeRecord(this.pendingPath, { phase: 'spawning', url, executable: runtime.executable, startedAt: new Date().toISOString() });
+          const pid = await this.host.start(runtime.executable, ['app-server', '--listen', url], childEnvironment,
+            [path.join(this.stateRoot, 'managed-app-server.stdout.log'), path.join(this.stateRoot, 'managed-app-server.stderr.log')]);
+          const started = await this.host.process(pid);
+          if (!started) {
+            fs.rmSync(this.pendingPath, { force: true });
+            if (attempt < 4) continue;
+            throw new Error('Codex 内核启动后退出，动态端口尝试已用完。');
+          }
+          record = { ...started, url, launcherRevision: managedAppServerLauncherRevision };
+          if (!sameManagedProcess(record, started) || executableKey(started.executable) !== executableKey(runtime.executable)) {
+            throw new Error('Codex 内核启动后进程身份无法确认，未启动第二个实例。');
+          }
+          // Private ownership journal is not a published endpoint. It prevents
+          // duplicate children even if the launcher crashes before readiness.
+          writeRecord(this.pendingPath, record);
+          actual = started;
+          try { await this.connectReady(record); break; }
+          catch (error) {
+            const remaining = await this.host.process(pid);
+            if (remaining || attempt === 4) throw error;
+            fs.rmSync(this.pendingPath, { force: true });
+            actual = null;
+          }
+        }
+      } else await this.connectReady(record);
+      const url = managedProcessUrl(record);
+      // Do not publish a guessed port or update Desktop before ownership,
+      // readiness and protocol initialization have all succeeded.
+      if (this.publishedUrl !== url) await this.configureEnvironment(this.stateRoot, url);
+      this.environment.CODEX_APP_SERVER_WS_URL = url;
+      process.env.CODEX_APP_SERVER_WS_URL = url;
+      if (this.publishedUrl !== url || readRecord(this.pendingPath)) writeRecord(this.recordPath, { ...record, url });
+      this.publishedUrl = url;
+      fs.rmSync(this.pendingPath, { force: true });
       if (startedHere) {
         try { await pruneRetainedDesktopRuntimes(this.stateRoot, actual.executable); }
         catch (error) { console.error('旧版 Codex 内核文件清理失败：', error); }
@@ -122,21 +173,93 @@ export class ManagedAppServer extends EventEmitter {
         created: actual.created, executable: actual.executable, preferredExecutable,
         updatePending, launcherRevision, selectedVersion: runtime.version, source: runtime.source,
         launcherRestartRequired: launcherRevision !== managedAppServerLauncherRevision,
-        url: managedAppServerUrl });
+        url });
       return true;
+      } finally { release(); }
     } catch (error) {
       this.failed(error instanceof Error ? error.message : String(error));
       return false;
     }
   }
 
+  async acquireLock() {
+    const token = randomUUID();
+    const temporary = `${this.lockPath}.${token}.tmp`;
+    const owner = await this.host.process(process.pid);
+    if (!owner) throw new Error('启动器进程身份无法确认。');
+    try {
+      // Publish a fully written record atomically; a crash cannot leave an
+      // empty lock that has no identifiable owner.
+      fs.writeFileSync(temporary, JSON.stringify({ ...owner, token }), { flag: 'wx', mode: 0o600 });
+      try { fs.linkSync(temporary, this.lockPath); }
+      catch (error) {
+        if (error.code !== 'EEXIST') throw error;
+        const previous = readRecord(this.lockPath);
+        if (!previous?.token) throw new Error('内核启动锁无法识别，请检查 managed-app-server.lock。');
+        const actual = await this.host.process(previous.pid);
+        if (!actual || actual.created !== previous.created || executableKey(actual.executable) !== executableKey(previous.executable)) {
+          // One permanent tombstone per abandoned generation means two stale
+          // observers cannot delete a replacement owner's lock (ABA race).
+          if (await this.claimRecovery(previous, this.lockPath, temporary)) {
+            if (readRecord(this.lockPath)?.token === previous.token) fs.rmSync(this.lockPath, { force: true });
+          }
+        }
+        return null;
+      }
+      return () => { if (readRecord(this.lockPath)?.token === token) fs.rmSync(this.lockPath, { force: true }); };
+    } finally { fs.rmSync(temporary, { force: true }); }
+  }
+
+  async claimRecovery(previous, target, ownerFile, depth = 0) {
+    if (depth > 16) throw new Error('内核启动锁多次异常中断，请检查启动器日志。');
+    const recovered = `${this.lockPath}.${previous.token}.recovered`;
+    try { fs.linkSync(ownerFile, recovered); return true; }
+    catch (error) { if (error.code !== 'EEXIST') throw error; }
+    const claimant = readRecord(recovered);
+    if (!claimant?.token) throw new Error('内核启动锁回收记录无法识别。');
+    const actual = await this.host.process(claimant.pid);
+    if (actual && actual.created === claimant.created && executableKey(actual.executable) === executableKey(claimant.executable)) return false;
+    // A reclaimer can itself crash. Keep an append-only ownership chain so its
+    // successor can complete cleanup without allowing two live reclaimers.
+    return this.claimRecovery(claimant, recovered, ownerFile, depth + 1);
+  }
+
+  async connectReady(expected) {
+    const url = managedProcessUrl(expected);
+    if (!url) throw new Error('Codex 内核地址无效。');
+    await this.waitUntilReady(expected);
+    if (this.client.url !== url) {
+      await this.disconnectClient();
+      this.client.url = url;
+    }
+    await this.client.connect();
+    if (!this.client.ready || !sameManagedProcess(expected, await this.host.process(expected.pid))
+        || !await this.host.ownsListener(expected, url)) {
+      this.client.close();
+      throw new Error('Codex 内核协议初始化或监听进程验证未完成。');
+    }
+  }
+
+  async disconnectClient() {
+    const socket = this.client.socket;
+    this.client.close();
+    if (socket && socket.readyState !== 3) {
+      await new Promise(resolve => {
+        const timer = setTimeout(() => { socket.terminate(); }, 1000);
+        socket.once('close', () => { clearTimeout(timer); resolve(); });
+      });
+    }
+    this.client.ready = false;
+  }
+
   async waitUntilReady(expected) {
+    const url = managedProcessUrl(expected);
     const deadline = this.now() + this.timeout;
     while (true) {
       const actual = await this.host.process(expected.pid);
       if (!sameManagedProcess(expected, actual)) throw new Error('Codex 内核在就绪前退出。');
-      if (await this.host.ready(managedAppServerReadyUrl)) return;
-      if (this.now() >= deadline) throw new Error('Codex 内核未在 30 秒内就绪，请查看工作站诊断日志。');
+      if (await this.host.ownsListener(expected, url) && await this.host.ready(url.replace('ws:', 'http:') + '/readyz')) return;
+      if (this.now() >= deadline) throw new Error('Codex 内核未在 30 秒内就绪；保留已启动实例，不会另起重复内核。');
       await this.wait(250);
     }
   }
@@ -158,33 +281,37 @@ export class ManagedAppServer extends EventEmitter {
 
   async restartNow() {
     this.restarting = true;
+    await this.work;
     const previous = this.state;
+    let release;
     this.publish({ ...previous, state: 'restarting', ready: false, error: null });
     try {
-      const record = readRecord(this.recordPath);
+      release = await this.acquireLock();
+      if (!release) throw new Error('另一个内核启动操作正在进行，请稍后重试。');
+      const pending = readRecord(this.pendingPath);
+      if (pending?.phase === 'spawning') throw new Error('上次内核启动交接未完成，无法安全重启未知进程；请检查内核启动日志。');
+      const record = pending || readRecord(this.recordPath);
       const actual = record?.pid ? await this.host.process(record.pid) : null;
       if (actual && !sameManagedProcess(record, actual)) {
         throw new Error('Codex 内核进程身份已经变化，未结束任何进程。');
       }
-      if (!actual && !await this.available()) throw new Error('45839 被未识别进程占用，未结束任何进程。');
       this.restartStage('stopping');
       // Resolve the replacement before stopping the current working process.
-      const runtime = await resolveCodexRuntime(this.stateRoot, { refresh: true, environment: this.environment });
+      const runtime = await this.resolveRuntime(this.stateRoot, { refresh: true, environment: this.environment });
       const desktop = await this.host.prepareKernelRestart?.();
-      this.client.close();
+      await this.disconnectClient();
       if (actual) {
         await this.host.stop(actual.pid, actual);
         await this.waitUntilStopped(actual);
-      } else if (!await this.available()) {
-        throw new Error('45839 被未识别进程占用，未结束任何进程。');
       }
-      fs.rmSync(this.recordPath, { force: true });
+      fs.rmSync(this.pendingPath, { force: true });
+      this.publishedUrl = null;
       this.retryAttempt = 0;
       this.retryAfter = 0;
       this.restartStage('starting');
-      const ready = await this.ensureNow();
+      const ready = await this.ensureNow(true);
       if (!ready) throw new Error(this.state.error || 'Codex 内核未能重新启动。');
-      const desktopEnvironment = { ...this.environment, CODEX_HOME: runtime.codexHome, CODEX_APP_SERVER_WS_URL: managedAppServerUrl };
+      const desktopEnvironment = { ...this.environment, CODEX_HOME: runtime.codexHome, CODEX_APP_SERVER_WS_URL: this.state.url };
       delete desktopEnvironment.CODEX_APP_SERVER_FORCE_CLI;
       delete desktopEnvironment.CODEX_APP_TOOLS_PIPE_PATH;
       await this.host.resumeAfterKernelRestart?.(desktop, desktopEnvironment);
@@ -198,6 +325,7 @@ export class ManagedAppServer extends EventEmitter {
         completedAt: new Date(this.now()).toISOString() };
       this.emit('state', this.snapshot());
     } finally {
+      release?.();
       this.restarting = false;
     }
   }
@@ -211,7 +339,7 @@ export class ManagedAppServer extends EventEmitter {
     const deadline = this.now() + 10_000;
     while (true) {
       const actual = await this.host.process(expected.pid);
-      if (!sameManagedProcess(expected, actual) && await this.available()) return;
+      if (!sameManagedProcess(expected, actual)) return;
       if (this.now() >= deadline) throw new Error('Codex 内核未在 10 秒内退出；不会启动第二个实例。');
       await this.wait(100);
     }
@@ -238,8 +366,8 @@ export class ManagedAppServer extends EventEmitter {
 export function sameManagedProcess(record, actual) {
   if (!record || !actual || record.pid !== actual.pid || record.created !== actual.created) return false;
   if (!record.executable || !actual.executable || executableKey(record.executable) !== executableKey(actual.executable)) return false;
-  if (Array.isArray(actual.args)) return JSON.stringify(record.args) === JSON.stringify(actual.args)
-    && JSON.stringify(actual.args.slice(1)) === JSON.stringify(['app-server', '--listen', managedAppServerUrl]);
-  const command = String(actual.command || '').toLowerCase();
-  return command.includes('app-server') && command.includes(managedAppServerUrl);
+  const url = managedProcessUrl(record);
+  if (!url || managedProcessUrl(actual) !== url) return false;
+  return Array.isArray(actual.args) ? JSON.stringify(record.args) === JSON.stringify(actual.args)
+    : record.command === actual.command;
 }

package/dist/src/managed-endpoint.mjs

@@ -0,0 +1,25 @@
+import path from 'node:path';
+import { readRecord } from './service-lifecycle.mjs';
+
+export const defaultManagedPort = 45839;
+export function managedEndpointUrl(value) {
+  if (typeof value !== 'string' || !/^ws:\/\/127\.0\.0\.1:[1-9][0-9]{0,4}$/.test(value)) return null;
+  const port = Number(value.slice(value.lastIndexOf(':') + 1));
+  return port <= 65535 ? `ws://127.0.0.1:${port}` : null;
+}
+export function managedProcessUrl(record) {
+  if (!record) return null;
+  let value;
+  if (Array.isArray(record.args)) {
+    if (record.args.length !== 4 || record.args[1] !== 'app-server' || record.args[2] !== '--listen') return null;
+    value = record.args[3];
+  } else {
+    const match = /^\s*(?:"[^"]+"|\S+)\s+app-server\s+--listen\s+(?:"(ws:\/\/127\.0\.0\.1:[0-9]+)"|(ws:\/\/127\.0\.0\.1:[0-9]+))\s*$/i.exec(record.command || '');
+    value = match?.[1] || match?.[2];
+  }
+  const url = managedEndpointUrl(value);
+  return url && (!record.url || record.url === url) ? url : null;
+}
+export function readManagedEndpoint(stateRoot) {
+  return managedProcessUrl(readRecord(path.join(stateRoot, 'managed-app-server.json')));
+}

package/dist/src/platform/linux/desktop-host.mjs

@@ -8,7 +8,7 @@ import { runtimePaths } from '../runtime-paths.mjs';
 import { readRecord } from '../../service-lifecycle.mjs';
 export { residentStartup } from './resident-startup.mjs';
 
-const managedUrl = 'ws://127.0.0.1:45839';
+import { managedEndpointUrl, readManagedEndpoint } from '../../managed-endpoint.mjs';
 export function createDesktopHost({ request = systemRequest, wait = delay, now = Date.now, timeout = 10000,
   stateRoot = () => runtimePaths().stateRoot, fingerprint = file => {
     const stat = fs.statSync(path.join(file, 'resources/linux-package-metadata.json'));
@@ -17,20 +17,24 @@ export function createDesktopHost({ request = systemRequest, wait = delay, now =
   return {
     desktopIntegration: true,
     async inspect() {
-      const info = await request({ operation: 'desktop-info' });
-      return { ...info, desktopIdentity: info.desktop ? `${info.desktop}:${info.version}:${info.build}:${fingerprint(info.desktop)}` : null };
+      const url = readManagedEndpoint(stateRoot());
+      const info = await request({ operation: 'desktop-info', url });
+      return { ...info, managedUrl: url, desktopIdentity: info.desktop ? `${info.desktop}:${info.version}:${info.build}:${fingerprint(info.desktop)}` : null };
     },
     process: pid => request({ operation: 'process', pid }),
+    ownsListener: (expected, url) => request({ operation: 'owns-listener', expected, url }),
     start: startBackground,
     async stop(pid, expected) {
       if (!expected || expected.pid !== pid) throw new Error('停止内核前缺少进程身份，未结束任何进程。');
       return request({ operation: 'stop', expected });
     },
     async sharedServiceUrl() {
-      return (await this.inspect()).connectedToManagedServer ? managedUrl : '';
+      const info = await this.inspect();
+      return info.connectedToManagedServer ? info.managedUrl : '';
     },
     async startDesktop(bundlePath, environment) {
-      if (environment.CODEX_APP_SERVER_WS_URL !== managedUrl) throw new Error('Desktop 内核地址与工作站不一致。');
+      const managedUrl = managedEndpointUrl(environment.CODEX_APP_SERVER_WS_URL);
+      if (!managedUrl || managedUrl !== readManagedEndpoint(stateRoot())) throw new Error('Desktop 内核地址与工作站不一致。');
       const runtime = readRecord(path.join(stateRoot(), 'codex-runtime.json'));
       const codexHome = environment.CODEX_HOME || runtime?.codexHome;
       if (!codexHome || !path.isAbsolute(codexHome)) throw new Error('缺少已选内核的 CODEX_HOME，请先运行 relax setup。');

package/dist/src/platform/linux/process.mjs

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import { managedEndpointUrl } from '../../managed-endpoint.mjs';
 
 const gone = error => ['ENOENT', 'ESRCH'].includes(error.code);
 let bootId;
@@ -27,7 +28,10 @@ export function stopProcess(pid, expected) {
   process.kill(pid, 'SIGTERM');
   return { stopped: true };
 }
-export function connectedToManagedServer(pid) {
+function hasManagedSocket(pid, url, listener) {
+  const endpoint = managedEndpointUrl(url);
+  if (!endpoint) return false;
+  const port = Number(endpoint.slice(endpoint.lastIndexOf(':') + 1)).toString(16).toUpperCase().padStart(4, '0');
   try {
     const sockets = new Set(fs.readdirSync(`/proc/${pid}/fd`).flatMap(fd => {
       try { return /^socket:\[(\d+)\]$/.exec(fs.readlinkSync(`/proc/${pid}/fd/${fd}`))?.slice(1) || []; }
@@ -35,8 +39,15 @@ export function connectedToManagedServer(pid) {
     }));
     return ['tcp', 'tcp6'].some(table => fs.readFileSync(`/proc/${pid}/net/${table}`, 'utf8').trim().split('\n').slice(1).some(line => {
       const fields = line.trim().split(/\s+/);
-      return fields[3] === '01' && sockets.has(fields[9])
-        && ['0100007F:B30F', '0000000000000000FFFF00000100007F:B30F'].includes(fields[2]);
+      return fields[3] === (listener ? '0A' : '01') && sockets.has(fields[9])
+        && [`0100007F:${port}`, `0000000000000000FFFF00000100007F:${port}`].includes(fields[listener ? 1 : 2]);
     }));
   } catch (error) { if (gone(error)) return false; throw error; }
 }
+
+export const connectedToManagedServer = (pid, url) => hasManagedSocket(pid, url, false);
+export function ownsManagedListener(expected, url) {
+  return !!expected && sameProcess(expected, processInfo(expected.pid))
+    && hasManagedSocket(expected.pid, url, true)
+    && sameProcess(expected, processInfo(expected.pid));
+}

package/dist/src/platform/linux/system.mjs

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { installedDesktop, verifyDesktopPackage } from './desktop-installation.mjs';
-import { processInfo, sameProcess, stopProcess, connectedToManagedServer } from './process.mjs';
+import { processInfo, sameProcess, stopProcess, connectedToManagedServer, ownsManagedListener } from './process.mjs';
 import { startBackground } from '../../background-process.mjs';
 
 // Package upgrades unlink the old executable while its process stays alive.
@@ -10,6 +10,7 @@ import { startBackground } from '../../background-process.mjs';
 const desktopExecutableMatches = (actual, installed) => actual === installed || actual === `${installed} (deleted)`;
 
 export async function systemRequest(request) {
+  if (request.operation === 'owns-listener') return ownsManagedListener(request.expected, request.url);
   if (request.operation === 'process') return processInfo(request.pid);
   if (request.operation === 'stop') return stopProcess(request.expected?.pid, request.expected);
   const installed = installedDesktop();
@@ -25,7 +26,7 @@ export async function systemRequest(request) {
     }
     if (running.length > 1) throw new Error('发现多个 ChatGPT 桌面实例，请先关闭多余实例。');
     const info = running[0] || null;
-    const connected = info ? connectedToManagedServer(info.pid) : false;
+    const connected = info ? connectedToManagedServer(info.pid, request.url) : false;
     if (info && !sameProcess(info, processInfo(info.pid))) throw new Error('核对期间桌面进程发生变化。');
     return { ...(installed || { desktop: null, version: '', build: '' }), running: !!info,
       finishedLaunching: connected, connectedToManagedServer: connected, process: info };

package/dist/src/platform/linux/user-environment.mjs

@@ -1,7 +1,9 @@
+import { managedEndpointUrl } from '../../managed-endpoint.mjs';
 // Only the new Desktop process receives the managed connection settings.
 // Do not mutate shell profiles or the login session's global environment.
-export async function configureManagedEnvironment() {
+export async function configureManagedEnvironment(stateRoot, url) {
+  if (!managedEndpointUrl(url)) throw new Error('未确认 Codex 内核地址。');
   return { configured: true, changed: false, owned: false, persistent: false,
-    scope: 'application-launch', value: 'ws://127.0.0.1:45839' };
+    scope: 'application-launch', value: url };
 }
 export async function clearManagedEnvironment() { return { removed: false, preserved: false, reason: 'application-launch-only' }; }

package/dist/src/platform/macos/desktop-host.mjs

@@ -8,7 +8,7 @@ import { runtimePaths } from '../runtime-paths.mjs';
 import { readRecord } from '../../service-lifecycle.mjs';
 export { residentStartup } from './resident-startup.mjs';
 
-const managedUrl = 'ws://127.0.0.1:45839';
+import { managedEndpointUrl, readManagedEndpoint } from '../../managed-endpoint.mjs';
 export function createDesktopHost({ request = systemRequest, wait = delay, now = Date.now, timeout = 10000,
   stateRoot = () => runtimePaths().stateRoot, fingerprint = file => {
     const stat = fs.statSync(path.join(file, 'Contents/Info.plist'));
@@ -17,20 +17,24 @@ export function createDesktopHost({ request = systemRequest, wait = delay, now =
   return {
     desktopIntegration: true,
     async inspect() {
-      const info = await request({ operation: 'desktop-info' });
-      return { ...info, desktopIdentity: info.desktop ? `${info.desktop}:${info.version}:${info.build}:${fingerprint(info.desktop)}` : null };
+      const url = readManagedEndpoint(stateRoot());
+      const info = await request({ operation: 'desktop-info', url });
+      return { ...info, managedUrl: url, desktopIdentity: info.desktop ? `${info.desktop}:${info.version}:${info.build}:${fingerprint(info.desktop)}` : null };
     },
     process: pid => request({ operation: 'process', pid }),
+    ownsListener: (expected, url) => request({ operation: 'owns-listener', expected, url }),
     start: startBackground,
     async stop(pid, expected) {
       if (!expected || expected.pid !== pid) throw new Error('停止内核前缺少进程身份，未结束任何进程。');
       return request({ operation: 'stop', expected });
     },
     async sharedServiceUrl() {
-      return (await this.inspect()).connectedToManagedServer ? managedUrl : '';
+      const info = await this.inspect();
+      return info.connectedToManagedServer ? info.managedUrl : '';
     },
     async startDesktop(bundlePath, environment) {
-      if (environment.CODEX_APP_SERVER_WS_URL !== managedUrl) throw new Error('Desktop 内核地址与工作站不一致。');
+      const managedUrl = managedEndpointUrl(environment.CODEX_APP_SERVER_WS_URL);
+      if (!managedUrl || managedUrl !== readManagedEndpoint(stateRoot())) throw new Error('Desktop 内核地址与工作站不一致。');
       const runtime = readRecord(path.join(stateRoot(), 'codex-runtime.json'));
       const codexHome = environment.CODEX_HOME || runtime?.codexHome;
       if (!codexHome || !path.isAbsolute(codexHome)) throw new Error('缺少已选内核的 CODEX_HOME，请先运行 relax setup。');

package/dist/src/platform/macos/user-environment.mjs

@@ -1,7 +1,9 @@
+import { managedEndpointUrl } from '../../managed-endpoint.mjs';
 // Launch Services receives these settings for one new application instance.
 // Do not mutate shell profiles or the login session's global environment.
-export async function configureManagedEnvironment() {
+export async function configureManagedEnvironment(stateRoot, url) {
+  if (!managedEndpointUrl(url)) throw new Error('未确认 Codex 内核地址。');
   return { configured: true, changed: false, owned: false, persistent: false,
-    scope: 'application-launch', value: 'ws://127.0.0.1:45839' };
+    scope: 'application-launch', value: url };
 }
 export async function clearManagedEnvironment() { return { removed: false, preserved: false, reason: 'application-launch-only' }; }

package/dist/src/platform/windows/activate-desktop.ps1

@@ -4,6 +4,7 @@
 )
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+if ($AppServerUrl -cnotmatch '^ws://127\.0\.0\.1:([1-9][0-9]{0,4})\z' -or [int]$Matches[1] -gt 65535) { throw 'Invalid managed app-server URL.' }
 $package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
 if (-not $package -or $Executable -ne (Join-Path $package.InstallLocation 'app/ChatGPT.exe')) {
     throw 'Desktop executable identity changed; activation stopped.'

package/dist/src/platform/windows/desktop-host.mjs

@@ -3,6 +3,8 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
+import { managedEndpointUrl, readManagedEndpoint } from '../../managed-endpoint.mjs';
+import { runtimePaths } from './runtime-paths.mjs';
 import { sharedServiceUrl } from './service-host.mjs';
 const exec = promisify(execFile);
 const directory = path.dirname(fileURLToPath(import.meta.url));
@@ -15,15 +17,20 @@ export const desktopHost = {
   inspect: async () => JSON.parse(await runScript('desktop-info.ps1')),
   process: async pid => JSON.parse(await runScript('desktop-info.ps1', ['-ProcessId', String(pid)])),
   sharedServiceUrl,
+  ownsListener: async (expected, url) => JSON.parse(await runScript('desktop-info.ps1', ['-ProcessId', String(expected.pid), '-Expected', JSON.stringify(expected), '-AppServerUrl', url, '-CheckListener'])),
   start: startWindowsProcess,
-  startDesktop: (executable, environment) => runScript('activate-desktop.ps1', [
-    '-Executable', executable, '-AppServerUrl', environment.CODEX_APP_SERVER_WS_URL,
-  ]),
+  startDesktop: (executable, environment) => {
+    const url = managedEndpointUrl(environment.CODEX_APP_SERVER_WS_URL);
+    if (!url || url !== readManagedEndpoint(runtimePaths().stateRoot)) throw new Error('Desktop 内核地址与工作站不一致。');
+    return runScript('activate-desktop.ps1', [
+      '-Executable', executable, '-AppServerUrl', url,
+    ]);
+  },
   async desktopReady() {
     return (await this.inspect()).hasWindow === true && Boolean(await this.sharedServiceUrl());
   },
   closeDesktop: executable => runScript('stop-desktop.ps1', ['-Executable', executable]),
-  stop: pid => process.kill(pid),
+  stop: (pid, expected) => runScript('desktop-info.ps1', ['-ProcessId', String(pid), '-Expected', JSON.stringify(expected), '-StopManagedProcess']),
   async prepareKernelRestart() {
     const info = await this.inspect();
     if (!info.running || !await this.sharedServiceUrl()) return null;

package/dist/src/platform/windows/desktop-info.ps1

@@ -1,6 +1,30 @@
-param([int]$ProcessId = 0)
+param([int]$ProcessId = 0, [string]$Expected, [string]$AppServerUrl, [switch]$CheckListener, [switch]$StopManagedProcess)
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+function Read-Identity([int]$Id) {
+    $item = Get-CimInstance Win32_Process -Filter "ProcessId=$Id"
+    if ($item) { return @{ pid=$item.ProcessId; executable=$item.ExecutablePath; command=$item.CommandLine; created=$item.CreationDate.ToUniversalTime().ToString('o') } }
+    return $null
+}
+function Same-Identity($a, $b) {
+    return $null -ne $a -and $null -ne $b -and $a.pid -eq $b.pid -and $a.executable -ceq $b.executable -and $a.command -ceq $b.command -and $a.created -ceq $b.created
+}
+if ($CheckListener -or $StopManagedProcess) {
+    if ($ProcessId -le 0 -or -not $Expected) { throw 'Missing managed process identity.' }
+    $identity = $Expected | ConvertFrom-Json
+    if ($identity.pid -ne $ProcessId) { throw 'Process identity mismatch.' }
+    $actual = Read-Identity $ProcessId
+    if (-not (Same-Identity $identity $actual)) {
+        if ($StopManagedProcess) { throw 'Process identity changed; nothing stopped.' }
+        'false'; exit
+    }
+    if ($StopManagedProcess) { Stop-Process -Id $ProcessId -ErrorAction Stop; '{"stopped":true}'; exit }
+    if ($AppServerUrl -cnotmatch '^ws://127\.0\.0\.1:([1-9][0-9]{0,4})\z' -or [int]$Matches[1] -gt 65535) { throw 'Invalid managed app-server URL.' }
+    $port = [int]$Matches[1]
+    $listeners = @(Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalAddress -eq '127.0.0.1' -and $_.OwningProcess -eq $ProcessId })
+    [bool]($listeners.Count -gt 0 -and (Same-Identity $identity (Read-Identity $ProcessId))) | ConvertTo-Json -Compress
+    exit
+}
 if ($ProcessId -gt 0) {
     $item = Get-CimInstance Win32_Process -Filter "ProcessId=$ProcessId"
     if ($item) { @{ pid=$item.ProcessId; executable=$item.ExecutablePath; command=$item.CommandLine; created=$item.CreationDate.ToUniversalTime().ToString('o') } | ConvertTo-Json -Compress }

package/dist/src/platform/windows/service-host.mjs

@@ -5,19 +5,23 @@ import { fileURLToPath } from 'node:url';
 import fs from 'node:fs';
 import { runtimePaths } from './runtime-paths.mjs';
 import { readRecord } from '../../service-lifecycle.mjs';
+import { readManagedEndpoint } from '../../managed-endpoint.mjs';
 import { lanNetworks } from './network-info.mjs';
 
 const exec = promisify(execFile);
 const bridgeRoot = fileURLToPath(new URL('../../../', import.meta.url));
-async function detect(script) {
+async function detect(script, args = []) {
   const executable = path.join(process.env.SystemRoot, 'System32/WindowsPowerShell/v1.0/powershell.exe');
   const { stdout } = await exec(executable, ['-NoProfile', '-NonInteractive', '-File',
-    path.join(bridgeRoot, script)], { windowsHide: true, encoding: 'utf8' });
+    path.join(bridgeRoot, script), ...args], { windowsHide: true, encoding: 'utf8' });
   return stdout.trim();
 }
 
 // Windows-only network metadata stays here, outside the lifecycle implementation.
-export const sharedServiceUrl = () => detect('get-shared-service-url.ps1');
+export const sharedServiceUrl = () => {
+  const url = readManagedEndpoint(runtimePaths().stateRoot);
+  return url ? detect('get-shared-service-url.ps1', ['-AppServerUrl', url]) : '';
+};
 export const lanAddress = async () => (await lanNetworks())[0]?.address || '';
 export { lanNetworks };
 export async function bridgeEnvironment() {

package/dist/src/platform/windows/user-environment.mjs

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
 import { runScript } from './desktop-host.mjs';
-import { managedAppServerUrl } from '../../managed-app-server.mjs';
+import { managedEndpointUrl } from '../../managed-endpoint.mjs';
 
 const ownershipFile = 'managed-environment.json';
 
@@ -10,22 +10,24 @@ export async function readManagedEnvironment() {
   return JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Read']));
 }
 
-export async function configureManagedEnvironment(stateRoot) {
+export async function configureManagedEnvironment(stateRoot, url) {
   const current = await readManagedEnvironment();
+  if (!managedEndpointUrl(url)) throw new Error('未确认 Codex 内核地址，未修改环境变量。');
   const ownershipPath = path.join(stateRoot, ownershipFile);
   const ownership = readRecord(ownershipPath);
   if (current.forceCliUser === '1' || current.forceCliMachine === '1') {
     throw new Error('CODEX_APP_SERVER_FORCE_CLI=1 会让 Codex 忽略当前内核地址；未修改该配置。');
   }
-  if (current.userValue && current.userValue !== managedAppServerUrl) {
+  if (current.userValue && current.userValue !== url && current.userValue !== ownership?.value) {
     throw new Error(`用户已有 CODEX_APP_SERVER_WS_URL=${current.userValue}；未覆盖该配置。`);
   }
-  if (current.userValue === managedAppServerUrl) {
-    const owned = ownership?.value === managedAppServerUrl;
+  if (current.userValue === url) {
+    const owned = ownership?.value === url;
     return { configured: true, value: current.userValue, changed: false, owned };
   }
-  const applied = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Set', '-Value', managedAppServerUrl]));
-  writeRecord(ownershipPath, { name: 'CODEX_APP_SERVER_WS_URL', value: managedAppServerUrl,
+  const applied = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Set', '-Value', url]));
+  if (applied.userValue !== url) throw new Error('CODEX_APP_SERVER_WS_URL 写入后读回不一致。');
+  writeRecord(ownershipPath, { name: 'CODEX_APP_SERVER_WS_URL', value: url,
     configuredAt: new Date().toISOString() });
   return { configured: true, value: applied.userValue, changed: true, owned: true };
 }
@@ -38,10 +40,10 @@ export async function clearManagedEnvironment(stateRoot) {
     fs.rmSync(ownershipPath, { force: true });
     return { removed: false, preserved: false, reason: 'already-empty' };
   }
-  if (ownership?.value !== managedAppServerUrl || current.userValue !== managedAppServerUrl) {
+  if (!managedEndpointUrl(ownership?.value) || current.userValue !== ownership.value) {
     fs.rmSync(ownershipPath, { force: true });
     return { removed: false, preserved: true, value: current.userValue,
-      reason: ownership?.value === managedAppServerUrl ? 'user-modified' : 'not-owned' };
+      reason: managedEndpointUrl(ownership?.value) ? 'user-modified' : 'not-owned' };
   }
   const result = JSON.parse(await runScript('user-environment.ps1', ['-Action', 'Clear']));
   if (result.userValue) throw new Error('CODEX_APP_SERVER_WS_URL 清理后读回仍不为空。');

package/dist/src/runtime-discovery.mjs

@@ -29,7 +29,7 @@ export class RuntimeDiscovery {
         return this.state;
       }
       const desktop = await this.host.inspect();
-      const attached = desktop.running && await this.host.sharedServiceUrl() === this.url;
+      const attached = desktop.running && await this.host.sharedServiceUrl() === (typeof this.url === 'function' ? this.url() : this.url);
       this.state = { desktop: { state: !desktop.running ? 'stopped' : attached ? 'managed' : 'ordinary',
         installed: Boolean(desktop.desktop), attachedToManagedServer: Boolean(attached) },
         desktopRestartRecommended: Boolean(desktop.running && !attached), checkedAt: new Date().toISOString() };

package/dist/src/self-relay/device-info.mjs

@@ -1,7 +1,7 @@
 export function deviceInfo(value = {}) {
   const info = {};
   if (value.platform !== undefined && value.platform !== null) {
-    if (!['android', 'harmony'].includes(value.platform)) throw new Error('Invalid mobile platform');
+    if (!['android', 'harmony', 'ios'].includes(value.platform)) throw new Error('Invalid mobile platform');
     info.platform = value.platform;
   }
   if (value.deviceName !== undefined && value.deviceName !== null) {

package/dist/src/server.mjs

@@ -13,7 +13,7 @@ import fileMentions from '../shared/file-mentions.cjs';
 import fileCitations from '../shared/file-citations.cjs';
 import { validateInlineImage } from './message-images.mjs';
 import { ThreadWriterConflictError } from './shared-app-server.mjs';
-import { ManagedAppServer, managedAppServerUrl } from './managed-app-server.mjs';
+import { ManagedAppServer } from './managed-app-server.mjs';
 import { RuntimeDiscovery } from './runtime-discovery.mjs';
 import { streamSharedThread, threadListNotificationMethods } from './shared-thread-stream.mjs';
 import appServerEvents from '../shared/app-server-events.cjs';
@@ -118,7 +118,7 @@ const dotsServer = new DotsAppServer(managedAppServer.client, desktopDotsProfile
 const dotsImages = new DotsMessageImages({ localServer: managedAppServer.client, identity: () => dotsServer.profileIdentity,
   cache: attachmentCache, capabilityKey: imageCapabilityKey, maxEntries: MAX_CACHED_ATTACHMENTS, maxBytes: MAX_ATTACHMENT_BYTES });
 const dotsChat = new DotsChatServer(dotsServer, undefined, { uploadsRoot });
-const runtimeDiscovery = new RuntimeDiscovery({ stateRoot, host: desktopHost, url: managedAppServerUrl });
+const runtimeDiscovery = new RuntimeDiscovery({ stateRoot, host: desktopHost, url: () => managedAppServer.snapshot().url });
 const relayManager = createRelayManager(stateRoot);
 let sharedCatalog = null, executionMode = 'ordinary';
 function selectSharedExecution(enabled) {
@@ -1892,3 +1892,4 @@ function boundedInteger(value, fallback, minimum, maximum) {
   const parsed = Number.parseInt(value || '', 10);
   return Number.isFinite(parsed) ? Math.min(maximum, Math.max(minimum, parsed)) : fallback;
 }
+

package/dist/src/shared-recovery.mjs

@@ -8,7 +8,7 @@ import { startBackground } from './background-process.mjs';
 import { desktopHost } from './platform/desktop-host.mjs';
 import * as serviceHost from './platform/service-host.mjs';
 import { launchDesktop, portAvailable } from './desktop-launcher.mjs';
-import { configureManagedEnvironment } from './platform/user-environment.mjs';
+import { sameManagedProcess } from './managed-app-server.mjs';
 
 const script = fileURLToPath(import.meta.url);
 const recordPath = root => path.join(root, 'shared-recovery.json');
@@ -45,10 +45,9 @@ export async function planRecovery(stateRoot, host, available = portAvailable) {
   if (!info.desktop) throw new Error('未找到 Codex Desktop；CLI 用户无需执行 Desktop 接入。');
   const record = readRecord(path.join(stateRoot, 'managed-app-server.json'));
   const actual = record ? await host.process(record.pid) : null;
-  if (actual && (!sameProcess(record, actual) || !actual.command?.includes('app-server') || !actual.command.includes('ws://127.0.0.1:45839'))) {
+  if (actual && !sameManagedProcess(record, actual)) {
     throw new Error('Codex 内核进程身份与记录不符，未结束任何进程。');
   }
-  if (!actual && !await available()) throw new Error('45839 被未识别进程占用，未关闭 Desktop 或结束任何进程。');
   return { desktop: info.desktop, action };
 }
 
@@ -102,7 +101,6 @@ export async function runRecovery(stateRoot, operationId, dependencies = {}) {
   try {
     stage('checking');
     const planned = await planRecovery(stateRoot, host, available);
-    await configureManagedEnvironment(stateRoot);
     record = { ...record, ...planned };
     if (fs.existsSync(path.join(stateRoot, 'desktop-launch.lock'))) throw new Error('Desktop 正在启动，未与启动操作并行恢复。');
     stage('stopping-desktop'); await host.closeDesktop(record.desktop);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@walkhi/code-relax",
-  "version": "0.1.0-beta.42",
+  "version": "0.1.0-beta.43",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",
@@ -41,8 +41,8 @@
     "tag": "beta"
   },
   "optionalDependencies": {
-    "@walkhi/code-relax-native-win32-x64": "0.1.0-beta.42",
-    "@walkhi/code-relax-native-darwin-arm64": "0.1.0-beta.42",
-    "@walkhi/code-relax-native-darwin-x64": "0.1.0-beta.42"
+    "@walkhi/code-relax-native-win32-x64": "0.1.0-beta.43",
+    "@walkhi/code-relax-native-darwin-arm64": "0.1.0-beta.43",
+    "@walkhi/code-relax-native-darwin-x64": "0.1.0-beta.43"
   }
 }