@walkhi/code-relax 0.1.0-beta.5 → 0.1.0-beta.50

package/dist/src/managed-app-server.mjs

@@ -1,49 +1,73 @@
 import fs from 'node:fs';
+import { executableKey } from './platform/path-identity.mjs';
 import net from 'node:net';
+import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 import { EventEmitter } from 'node:events';
 import { setTimeout as delay } from 'node:timers/promises';
 import { readRecord, writeRecord } from './service-lifecycle.mjs';
 import { SharedAppServer } from './shared-app-server.mjs';
+import { pruneRetainedDesktopRuntimes, resolveCodexRuntime, runtimeFilesAvailable } from './platform/codex-runtime.mjs';
 
-export const managedAppServerUrl = 'ws://127.0.0.1:45839';
-export const managedAppServerReadyUrl = 'http://127.0.0.1:45839/readyz';
+import { defaultManagedPort, managedProcessUrl } from './managed-endpoint.mjs';
+import { configureManagedEnvironment } from './platform/user-environment.mjs';
+export const managedAppServerLauncherRevision = 3;
 const retryDelays = [1_000, 2_000, 5_000, 10_000, 20_000];
 
-export function managedPortAvailable() {
+export function managedPortAvailable(port = defaultManagedPort) {
   return new Promise(resolve => {
     const server = net.createServer();
     server.once('error', () => resolve(false));
-    server.listen(45839, '127.0.0.1', () => server.close(() => resolve(true)));
+    server.listen(port, '127.0.0.1', () => server.close(() => resolve(true)));
+  });
+}
+export function availableManagedPort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const port = server.address().port;
+      server.close(error => error ? reject(error) : resolve(port));
+    });
   });
 }
 
 export class ManagedAppServer extends EventEmitter {
   constructor({ stateRoot, host, environment = process.env, available = managedPortAvailable,
-    wait = delay, timeout = 30_000, now = Date.now, client = new SharedAppServer(managedAppServerUrl) }) {
+    wait = delay, timeout = 30_000, now = Date.now, client = new SharedAppServer(`ws://127.0.0.1:${defaultManagedPort}`),
+    selectPort = availableManagedPort, configureEnvironment = configureManagedEnvironment, resolveRuntime = resolveCodexRuntime }) {
     super();
     this.stateRoot = stateRoot;
     this.host = host;
     this.environment = environment;
     this.available = available;
+    this.selectPort = selectPort;
+    this.configureEnvironment = configureEnvironment;
+    this.resolveRuntime = resolveRuntime;
     this.wait = wait;
     this.timeout = timeout;
     this.now = now;
     this.recordPath = path.join(stateRoot, 'managed-app-server.json');
-    this.legacyRecordPath = path.join(stateRoot, 'shared-desktop.json');
+    this.pendingPath = path.join(stateRoot, 'managed-app-server.pending.json');
+    this.lockPath = path.join(stateRoot, 'managed-app-server.lock');
     this.client = client;
     this.state = { state: 'absent', ready: false, error: null };
+    this.client.diagnosticIdentity = () => ({ kernelPid: this.state.pid ?? null, kernelCreated: this.state.created ?? null });
     this.restartStatus = null;
     this.stopped = true;
     this.restarting = false;
     this.retryAttempt = 0;
     this.retryAfter = 0;
     this.client.on('disconnected', () => {
-      if (!this.stopped && !this.restarting) this.failed('Codex 内核连接断开。');
+      if (!this.stopped && !this.restarting && !this.work) this.failed('Codex 内核连接断开。');
     });
   }
 
-  snapshot() { return { ...this.state, ...(this.restartStatus ? { restart: { ...this.restartStatus } } : {}) }; }
+  snapshot() {
+    return { ...this.state,
+      version: this.state.ready && this.client.ready ? this.client.serverVersion || null : null,
+      ...(this.restartStatus ? { restart: { ...this.restartStatus } } : {}) };
+  }
 
   async start() {
     this.stopped = false;
@@ -59,56 +83,183 @@ export class ManagedAppServer extends EventEmitter {
     return this.work;
   }
 
-  async ensureNow() {
+  async ensureNow(lockHeld = false) {
     // Keep an already verified instance available while the periodic identity
     // check runs; publishing "starting" every three seconds makes health flicker.
     if (!this.state.ready) this.publish({ state: 'starting', ready: false, error: null });
     try {
       fs.mkdirSync(this.stateRoot, { recursive: true });
-      const info = await this.host.inspect();
-      if (!info.cli) throw new Error('未找到 Desktop 管理的 codex.exe，请先安装并登录 Codex Desktop。');
-      let record = null, actual = null;
-      for (const candidate of [readRecord(this.recordPath), readRecord(this.legacyRecordPath)].filter(Boolean)) {
-        const process = candidate.pid ? await this.host.process(candidate.pid) : null;
-        if (sameManagedProcess(candidate, process)) { record = candidate; actual = process; break; }
+      const release = lockHeld ? () => {} : await this.acquireLock();
+      if (!release) return false;
+      try {
+      const pending = readRecord(this.pendingPath);
+      if (pending?.phase === 'spawning') throw new Error('上次内核启动的进程交接未完成，已停止自动启动以避免重复内核；请检查内核启动日志与 managed-app-server.pending.json。');
+      let record = pending || readRecord(this.recordPath);
+      let actual = record?.pid ? await this.host.process(record.pid) : null;
+      if (actual && !sameManagedProcess(record, actual)) {
+        // Stale PID now belongs to someone else: leave it untouched and select
+        // another available endpoint rather than adopting or stopping it.
+        actual = null;
+        record = null;
+      }
+      const startedHere = !actual;
+      const savedRuntime = actual ? readRecord(path.join(this.stateRoot, 'codex-runtime.json')) : null;
+      const runtime = actual && savedRuntime?.executable && runtimeFilesAvailable(savedRuntime.executable)
+        ? savedRuntime
+        : await this.resolveRuntime(this.stateRoot, { refresh: !actual, environment: this.environment });
+      if (actual && !runtimeFilesAvailable(actual.executable)) {
+        throw new Error(`运行中的 Codex 内核目录已被移除或缺少配套 code-mode-host：${actual.executable}；请确认重启内核。`);
       }
       if (!actual) {
-        if (!await this.available()) throw new Error('45839 被未识别进程占用，未启动或结束任何进程。');
-        const childEnvironment = { ...this.environment };
+        fs.rmSync(this.pendingPath, { force: true });
+        const childEnvironment = { ...this.environment, CODEX_HOME: runtime.codexHome, RUST_LOG: 'warn' };
         for (const key of ['CODEX_APP_SERVER_WS_URL', 'CODEX_APP_SERVER_FORCE_CLI', 'CODEX_APP_TOOLS_PIPE_PATH']) delete childEnvironment[key];
-        const pid = await this.host.start(info.cli, ['app-server', '--listen', managedAppServerUrl], childEnvironment,
-          [path.join(this.stateRoot, 'managed-app-server.stdout.log'), path.join(this.stateRoot, 'managed-app-server.stderr.log')]);
-        const started = await this.host.process(pid);
-        if (!sameManagedProcess(started, started)) throw new Error('Codex 内核启动后进程身份无法确认。');
-        record = actual = started;
-        writeRecord(this.recordPath, record);
-      } else if (!readRecord(this.recordPath)) {
-        writeRecord(this.recordPath, actual);
+        for (const key of Object.keys(childEnvironment)) {
+          if (/^npm_/iu.test(key) || key.toUpperCase() === 'INIT_CWD') delete childEnvironment[key];
+        }
+        // A probe cannot reserve a port for another process. Retry only when our
+        // previous child has definitely exited, never on a live unready kernel.
+        for (let attempt = 0; attempt < 5; attempt++) {
+          const preferred = attempt === 0 ? Number(managedProcessUrl(record)?.split(':').at(-1)) || defaultManagedPort : 0;
+          const port = preferred && await this.available(preferred) ? preferred : await this.selectPort();
+          const url = `ws://127.0.0.1:${port}`;
+          // Commit intent before spawning: if the launcher dies before it can
+          // record the child PID, a successor must fail closed, not duplicate it.
+          writeRecord(this.pendingPath, { phase: 'spawning', url, executable: runtime.executable, startedAt: new Date().toISOString() });
+          const pid = await this.host.start(runtime.executable, ['app-server', '--listen', url], childEnvironment,
+            [path.join(this.stateRoot, 'managed-app-server.stdout.log'), path.join(this.stateRoot, 'managed-app-server.stderr.log')]);
+          const started = await this.host.process(pid);
+          if (!started) {
+            fs.rmSync(this.pendingPath, { force: true });
+            if (attempt < 4) continue;
+            throw new Error('Codex 内核启动后退出，动态端口尝试已用完。');
+          }
+          record = { ...started, url, launcherRevision: managedAppServerLauncherRevision };
+          if (!sameManagedProcess(record, started) || executableKey(started.executable) !== executableKey(runtime.executable)) {
+            throw new Error('Codex 内核启动后进程身份无法确认，未启动第二个实例。');
+          }
+          // Private ownership journal is not a published endpoint. It prevents
+          // duplicate children even if the launcher crashes before readiness.
+          writeRecord(this.pendingPath, record);
+          actual = started;
+          try { await this.connectReady(record); break; }
+          catch (error) {
+            const remaining = await this.host.process(pid);
+            if (remaining || attempt === 4) throw error;
+            fs.rmSync(this.pendingPath, { force: true });
+            actual = null;
+          }
+        }
+      } else await this.connectReady(record);
+      const url = managedProcessUrl(record);
+      // Do not publish a guessed port or update Desktop before ownership,
+      // readiness and protocol initialization have all succeeded.
+      if (this.publishedUrl !== url) await this.configureEnvironment(this.stateRoot, url);
+      this.environment.CODEX_APP_SERVER_WS_URL = url;
+      process.env.CODEX_APP_SERVER_WS_URL = url;
+      if (this.publishedUrl !== url || readRecord(this.pendingPath)) writeRecord(this.recordPath, { ...record, url });
+      this.publishedUrl = url;
+      fs.rmSync(this.pendingPath, { force: true });
+      if (startedHere) {
+        try { await pruneRetainedDesktopRuntimes(this.stateRoot, actual.executable); }
+        catch (error) { console.error('旧版 Codex 内核文件清理失败：', error); }
       }
-      await this.waitUntilReady(actual);
-      await this.client.connect();
-      if (!this.client.ready) throw new Error('Codex 内核协议初始化未完成。');
-      const preferredExecutable = path.resolve(info.cli);
-      const updatePending = path.resolve(actual.executable).toLowerCase() !== preferredExecutable.toLowerCase();
+      const preferredExecutable = path.resolve(runtime.executable);
+      const updatePending = executableKey(actual.executable) !== executableKey(preferredExecutable);
+      const launcherRevision = Number.isSafeInteger(record?.launcherRevision) ? record.launcherRevision : 0;
       this.retryAttempt = 0;
       this.retryAfter = 0;
       this.publish({ state: 'ready', ready: true, error: null, pid: actual.pid,
         created: actual.created, executable: actual.executable, preferredExecutable,
-        updatePending, url: managedAppServerUrl });
+        updatePending, launcherRevision, selectedVersion: runtime.version, source: runtime.source,
+        launcherRestartRequired: launcherRevision !== managedAppServerLauncherRevision,
+        url });
       return true;
+      } finally { release(); }
     } catch (error) {
       this.failed(error instanceof Error ? error.message : String(error));
       return false;
     }
   }
 
+  async acquireLock() {
+    const token = randomUUID();
+    const temporary = `${this.lockPath}.${token}.tmp`;
+    const owner = await this.host.process(process.pid);
+    if (!owner) throw new Error('启动器进程身份无法确认。');
+    try {
+      // Publish a fully written record atomically; a crash cannot leave an
+      // empty lock that has no identifiable owner.
+      fs.writeFileSync(temporary, JSON.stringify({ ...owner, token }), { flag: 'wx', mode: 0o600 });
+      try { fs.linkSync(temporary, this.lockPath); }
+      catch (error) {
+        if (error.code !== 'EEXIST') throw error;
+        const previous = readRecord(this.lockPath);
+        if (!previous?.token) throw new Error('内核启动锁无法识别，请检查 managed-app-server.lock。');
+        const actual = await this.host.process(previous.pid);
+        if (!actual || actual.created !== previous.created || executableKey(actual.executable) !== executableKey(previous.executable)) {
+          // One permanent tombstone per abandoned generation means two stale
+          // observers cannot delete a replacement owner's lock (ABA race).
+          if (await this.claimRecovery(previous, this.lockPath, temporary)) {
+            if (readRecord(this.lockPath)?.token === previous.token) fs.rmSync(this.lockPath, { force: true });
+          }
+        }
+        return null;
+      }
+      return () => { if (readRecord(this.lockPath)?.token === token) fs.rmSync(this.lockPath, { force: true }); };
+    } finally { fs.rmSync(temporary, { force: true }); }
+  }
+
+  async claimRecovery(previous, target, ownerFile, depth = 0) {
+    if (depth > 16) throw new Error('内核启动锁多次异常中断，请检查启动器日志。');
+    const recovered = `${this.lockPath}.${previous.token}.recovered`;
+    try { fs.linkSync(ownerFile, recovered); return true; }
+    catch (error) { if (error.code !== 'EEXIST') throw error; }
+    const claimant = readRecord(recovered);
+    if (!claimant?.token) throw new Error('内核启动锁回收记录无法识别。');
+    const actual = await this.host.process(claimant.pid);
+    if (actual && actual.created === claimant.created && executableKey(actual.executable) === executableKey(claimant.executable)) return false;
+    // A reclaimer can itself crash. Keep an append-only ownership chain so its
+    // successor can complete cleanup without allowing two live reclaimers.
+    return this.claimRecovery(claimant, recovered, ownerFile, depth + 1);
+  }
+
+  async connectReady(expected) {
+    const url = managedProcessUrl(expected);
+    if (!url) throw new Error('Codex 内核地址无效。');
+    await this.waitUntilReady(expected);
+    if (this.client.url !== url) {
+      await this.disconnectClient();
+      this.client.url = url;
+    }
+    await this.client.connect();
+    if (!this.client.ready || !sameManagedProcess(expected, await this.host.process(expected.pid))
+        || !await this.host.ownsListener(expected, url)) {
+      this.client.close();
+      throw new Error('Codex 内核协议初始化或监听进程验证未完成。');
+    }
+  }
+
+  async disconnectClient() {
+    const socket = this.client.socket;
+    this.client.close();
+    if (socket && socket.readyState !== 3) {
+      await new Promise(resolve => {
+        const timer = setTimeout(() => { socket.terminate(); }, 1000);
+        socket.once('close', () => { clearTimeout(timer); resolve(); });
+      });
+    }
+    this.client.ready = false;
+  }
+
   async waitUntilReady(expected) {
+    const url = managedProcessUrl(expected);
     const deadline = this.now() + this.timeout;
     while (true) {
       const actual = await this.host.process(expected.pid);
       if (!sameManagedProcess(expected, actual)) throw new Error('Codex 内核在就绪前退出。');
-      if (await this.host.ready(managedAppServerReadyUrl)) return;
-      if (this.now() >= deadline) throw new Error('Codex 内核未在 30 秒内就绪，请查看工作站诊断日志。');
+      if (await this.host.ownsListener(expected, url) && await this.host.ready(url.replace('ws:', 'http:') + '/readyz')) return;
+      if (this.now() >= deadline) throw new Error('Codex 内核未在 30 秒内就绪；保留已启动实例，不会另起重复内核。');
       await this.wait(250);
     }
   }
@@ -130,28 +281,40 @@ export class ManagedAppServer extends EventEmitter {
 
   async restartNow() {
     this.restarting = true;
+    await this.work;
     const previous = this.state;
+    let release;
     this.publish({ ...previous, state: 'restarting', ready: false, error: null });
     try {
-      const record = readRecord(this.recordPath) || readRecord(this.legacyRecordPath);
+      release = await this.acquireLock();
+      if (!release) throw new Error('另一个内核启动操作正在进行，请稍后重试。');
+      const pending = readRecord(this.pendingPath);
+      if (pending?.phase === 'spawning') throw new Error('上次内核启动交接未完成，无法安全重启未知进程；请检查内核启动日志。');
+      const record = pending || readRecord(this.recordPath);
       const actual = record?.pid ? await this.host.process(record.pid) : null;
       if (actual && !sameManagedProcess(record, actual)) {
         throw new Error('Codex 内核进程身份已经变化，未结束任何进程。');
       }
       this.restartStage('stopping');
-      this.client.close();
+      // Resolve the replacement before stopping the current working process.
+      const runtime = await this.resolveRuntime(this.stateRoot, { refresh: true, environment: this.environment });
+      const desktop = await this.host.prepareKernelRestart?.();
+      await this.disconnectClient();
       if (actual) {
-        await this.host.stop(actual.pid);
+        await this.host.stop(actual.pid, actual);
         await this.waitUntilStopped(actual);
-      } else if (!await this.available()) {
-        throw new Error('45839 被未识别进程占用，未结束任何进程。');
       }
-      fs.rmSync(this.recordPath, { force: true });
+      fs.rmSync(this.pendingPath, { force: true });
+      this.publishedUrl = null;
       this.retryAttempt = 0;
       this.retryAfter = 0;
       this.restartStage('starting');
-      const ready = await this.ensureNow();
+      const ready = await this.ensureNow(true);
       if (!ready) throw new Error(this.state.error || 'Codex 内核未能重新启动。');
+      const desktopEnvironment = { ...this.environment, CODEX_HOME: runtime.codexHome, CODEX_APP_SERVER_WS_URL: this.state.url };
+      delete desktopEnvironment.CODEX_APP_SERVER_FORCE_CLI;
+      delete desktopEnvironment.CODEX_APP_TOOLS_PIPE_PATH;
+      await this.host.resumeAfterKernelRestart?.(desktop, desktopEnvironment);
       this.restartStatus = { ...this.restartStatus, status: 'completed', stage: 'ready',
         completedAt: new Date(this.now()).toISOString() };
       this.emit('state', this.snapshot());
@@ -162,6 +325,7 @@ export class ManagedAppServer extends EventEmitter {
         completedAt: new Date(this.now()).toISOString() };
       this.emit('state', this.snapshot());
     } finally {
+      release?.();
       this.restarting = false;
     }
   }
@@ -175,7 +339,7 @@ export class ManagedAppServer extends EventEmitter {
     const deadline = this.now() + 10_000;
     while (true) {
       const actual = await this.host.process(expected.pid);
-      if (!sameManagedProcess(expected, actual) && await this.available()) return;
+      if (!sameManagedProcess(expected, actual)) return;
       if (this.now() >= deadline) throw new Error('Codex 内核未在 10 秒内退出；不会启动第二个实例。');
       await this.wait(100);
     }
@@ -201,7 +365,9 @@ export class ManagedAppServer extends EventEmitter {
 
 export function sameManagedProcess(record, actual) {
   if (!record || !actual || record.pid !== actual.pid || record.created !== actual.created) return false;
-  if (String(record.executable || '').toLowerCase() !== String(actual.executable || '').toLowerCase()) return false;
-  const command = String(actual.command || '').toLowerCase();
-  return command.includes('app-server') && command.includes(managedAppServerUrl);
+  if (!record.executable || !actual.executable || executableKey(record.executable) !== executableKey(actual.executable)) return false;
+  const url = managedProcessUrl(record);
+  if (!url || managedProcessUrl(actual) !== url) return false;
+  return Array.isArray(actual.args) ? JSON.stringify(record.args) === JSON.stringify(actual.args)
+    : record.command === actual.command;
 }

package/dist/src/managed-endpoint.mjs

@@ -0,0 +1,25 @@
+import path from 'node:path';
+import { readRecord } from './service-lifecycle.mjs';
+
+export const defaultManagedPort = 45839;
+export function managedEndpointUrl(value) {
+  if (typeof value !== 'string' || !/^ws:\/\/127\.0\.0\.1:[1-9][0-9]{0,4}$/.test(value)) return null;
+  const port = Number(value.slice(value.lastIndexOf(':') + 1));
+  return port <= 65535 ? `ws://127.0.0.1:${port}` : null;
+}
+export function managedProcessUrl(record) {
+  if (!record) return null;
+  let value;
+  if (Array.isArray(record.args)) {
+    if (record.args.length !== 4 || record.args[1] !== 'app-server' || record.args[2] !== '--listen') return null;
+    value = record.args[3];
+  } else {
+    const match = /^\s*(?:"[^"]+"|\S+)\s+app-server\s+--listen\s+(?:"(ws:\/\/127\.0\.0\.1:[0-9]+)"|(ws:\/\/127\.0\.0\.1:[0-9]+))\s*$/i.exec(record.command || '');
+    value = match?.[1] || match?.[2];
+  }
+  const url = managedEndpointUrl(value);
+  return url && (!record.url || record.url === url) ? url : null;
+}
+export function readManagedEndpoint(stateRoot) {
+  return managedProcessUrl(readRecord(path.join(stateRoot, 'managed-app-server.json')));
+}

package/dist/src/message-images.mjs

@@ -1,8 +1,3 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import sharp from 'sharp';
-
 export function validateInlineImage(value) {
   const data = typeof value === 'string' ? value.slice(value.indexOf(',') + 1) : '';
   if (typeof value !== 'string' || value.length > Math.ceil(8 * 1024 * 1024 / 3) * 4 + 64 ||
@@ -12,16 +7,3 @@ export function validateInlineImage(value) {
   }
   return value;
 }
-
-// Only the Desktop tool compatibility path needs a file visible to the host.
-export async function persistLegacyImage(value, directory) {
-  validateInlineImage(value);
-  const input = Buffer.from(value.slice(value.indexOf(',') + 1), 'base64');
-  const buffer = await sharp(input, { limitInputPixels: 40_000_000 }).rotate()
-    .resize({ width: 2560, height: 2560, fit: 'inside', withoutEnlargement: true }).webp({ quality: 88 }).toBuffer();
-  const id = crypto.createHash('sha256').update(buffer).digest('hex');
-  await fs.mkdir(directory, { recursive: true });
-  const file = path.join(directory, `${id}.webp`);
-  await fs.writeFile(file, buffer);
-  return file;
-}

package/dist/src/message-upload-files.mjs

@@ -0,0 +1,109 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import sharp from 'sharp';
+import media from '../shared/code-browser.cjs';
+import { validateInlineImage } from './message-images.mjs';
+import { createFileUploadSession, FILE_CHUNK_BYTES, MAX_FILE_BYTES, MAX_FILE_COUNT, MAX_TOTAL_BYTES } from './file-upload-session.mjs';
+import { fileRevision } from './file-transfer-range.mjs';
+
+const mimeTypes = { pdf: 'application/pdf', txt: 'text/plain', md: 'text/markdown', csv: 'text/csv',
+  json: 'application/json', zip: 'application/zip', doc: 'application/msword',
+  docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  xls: 'application/vnd.ms-excel', xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  ppt: 'application/vnd.ms-powerpoint', pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation' };
+
+// Reuse the incoming-file contract without sending workstation bytes to the phone.
+export async function stageWorkstationMessageFile(file, uploadsRoot) {
+  const handle = await fs.open(file.path, 'r');
+  const session = createFileUploadSession(uploadsRoot);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size < 1 || stat.size > MAX_FILE_BYTES) throw new Error('附件为空或超过 20 MiB。');
+    const validate = async () => {
+      if (fileRevision(await handle.stat()) !== file.revision || fileRevision(await fs.stat(file.path)) !== file.revision) {
+        throw new Error('电脑文件已变化，请重新添加。');
+      }
+    };
+    await validate();
+    const bytes = Buffer.alloc(stat.size);
+    for (let offset = 0; offset < bytes.length;) {
+      const { bytesRead } = await handle.read(bytes, offset, bytes.length - offset, offset);
+      if (!bytesRead) throw new Error('电脑文件读取不完整，请重新添加。');
+      offset += bytesRead;
+    }
+    await validate();
+    const sha256 = crypto.createHash('sha256').update(bytes).digest('hex');
+    const started = await session.receive({ type: 'start', name: file.name, size: bytes.length, sha256 });
+    for (let offset = 0; offset < bytes.length; offset += FILE_CHUNK_BYTES) {
+      await session.receive({ type: 'chunk', id: started.id, offset, data: bytes.subarray(offset, offset + FILE_CHUNK_BYTES) });
+    }
+    await validate();
+    const result = await session.receive({ type: 'finish', id: started.id });
+    await session.receive({ type: 'commit' });
+    return { ...result, mediaKind: media.mediaKind(file),
+      mimeType: media.mediaMime(file) || mimeTypes[path.extname(file.name).slice(1).toLowerCase()] || 'application/octet-stream' };
+  } finally { await handle.close(); await session.close(); }
+}
+
+async function localFile(file, directory) {
+  if (typeof file?.path !== 'string' || typeof file.name !== 'string' || !file.name || /[\r\n\0]/.test(file.name)) {
+    throw new Error('附件信息无效，请重新选择。');
+  }
+  const root = await fs.realpath(directory), resolved = await fs.realpath(file.path);
+  if (path.relative(root, path.dirname(resolved)) !== '') throw new Error('附件必须来自本次工作站上传目录。');
+  const handle = await fs.open(resolved, 'r');
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size < 1 || stat.size > MAX_FILE_BYTES) throw new Error('附件为空或超过 20 MiB。');
+    const bytes = await handle.readFile();
+    if (bytes.length !== stat.size) throw new Error('附件在读取时发生变化，请重新上传。');
+    const mimeType = media.mediaMime(file) || mimeTypes[path.extname(file.name).slice(1).toLowerCase()] || 'application/octet-stream';
+    if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/i.test(mimeType)) throw new Error('附件类型无效。');
+    return { name: file.name, mimeType, bytes };
+  } finally { await handle.close(); }
+}
+
+export async function readMessageUploads(body, uploadsRoot) {
+  const images = body.images ?? [], originals = body.originalImages ?? [], files = body.files ?? [];
+  if (![images, originals, files].every(Array.isArray) || images.length + originals.length > 4 || files.length + originals.length > MAX_FILE_COUNT) {
+    throw new Error('每条消息最多 4 张图片、4 个文件。');
+  }
+  const uploads = [];
+  let imageBytes = 0, fileBytes = 0;
+  for (const image of images) {
+    let file;
+    if (typeof image === 'string' && image.startsWith('data:')) {
+      validateInlineImage(image);
+      const mimeType = image.slice(5, image.indexOf(';'));
+      file = { name: `image.${mimeType.split('/')[1]}`, mimeType, bytes: Buffer.from(image.slice(image.indexOf(',') + 1), 'base64') };
+    } else {
+      if (typeof image !== 'string' || !/^[a-f0-9]{64}$/.test(image)) throw new Error('图片标识无效。');
+      let extension = 'webp';
+      try { await fs.access(path.join(uploadsRoot, `${image}.webp`)); }
+      catch (error) { if (error.code !== 'ENOENT') throw error; extension = 'png'; }
+      file = await localFile({ path: path.join(uploadsRoot, `${image}.${extension}`), name: `image.${extension}` }, uploadsRoot);
+    }
+    imageBytes += file.bytes.length;
+    if (imageBytes > 8 * 1024 * 1024) throw new Error('压缩图片合计不能超过 8 MiB。');
+    uploads.push(file);
+  }
+  for (const original of originals) {
+    if (typeof original !== 'string' || !/\.(png|jpe?g|webp|gif)$/i.test(original)) throw new Error('原图路径无效。');
+  }
+  for (const file of [...originals.map(value => ({ path: value, name: path.basename(value) })), ...files]) {
+    const uploaded = await localFile(file, path.join(uploadsRoot, 'incoming'));
+    fileBytes += uploaded.bytes.length;
+    if (fileBytes > MAX_TOTAL_BYTES) throw new Error('文件合计不能超过 40 MiB。');
+    uploads.push(uploaded);
+  }
+  for (const file of uploads) {
+    if (/^image\/(?:png|jpeg|webp|gif)$/.test(file.mimeType)) {
+      const metadata = await sharp(file.bytes).metadata();
+      file.width = metadata.width; file.height = metadata.height;
+      if (!file.width || !file.height) throw new Error('无法读取 图片尺寸。');
+    }
+  }
+  if (uploads.filter(file => file.width).length > 4) throw new Error('每条消息最多 4 张图片。');
+  return uploads;
+}

package/dist/src/onboarding.mjs

@@ -1,31 +1,12 @@
-export const connectionModesText = [
-  '可选连接模式：',
-  '• 局域网：启动时会把当前 Wi-Fi/有线网络候选临时发给已配对设备；App 验证后保存，也可手动输入 IP。',
-  '• 私有中继：同一设备授权可跨网络长期重连；基础控制/完整控制能力由电脑当前 Bridge 状态决定。',
-  '• OpenAI 官方中继：在已配对电脑内使用官方账号和设备授权；认证仍直连 OpenAI。',
-].join('\n');
-
-export function phonePairingSteps(transportMode, paired = false) {
-  const mode = transportMode === 'lan-shared' ? '局域网 · 完整控制' : transportMode === 'lan-legacy' ? '局域网 · 基础控制' : '局域网（按电脑实际控制方式选择）';
-  return paired ? [
-    `已有移动设备授权。手机可继续使用私有中继；${mode} 会显示验证成功的当前网络和历史记录。`,
-    '添加另一台设备时执行 relax pair；每台设备只需扫码配对一次。',
-  ] : [
-    '手机先安装 Code Relax。当前为鸿蒙 HarmonyOS 7 私测版，调试 HAP 需通过 DevEco/调试设备安装，尚无商店下载入口。',
-    '使用 App 扫描配对二维码；每台移动设备只需配对一次。',
-    `配对后可直接使用私有中继；${mode} 会接收并验证当前网络候选，也可手动输入 IP。`,
-  ];
+export function phonePairingSteps(_transportMode, paired = false) {
+  return paired ? ['已配对设备可直接连接。添加设备：relax pair']
+    : ['生成配对二维码：relax pair', '用 Code Relax App 扫码添加工作站。'];
 }
 export const desktopSetupSteps = [
-  'Code Relax Skill 已随 npm 包自动安装。',
-  '安装完成后 Bridge 和受管 app-server 已启动，并默认在当前用户登录时启动。',
-  '如果安装时 Codex 仍在运行，手机完整控制仍可使用；可选择立即或稍后重启，让 Desktop 也接入同一受管服务。',
-  '基础控制首次聊天需要在 Codex 对话启动一次 Code Relax 绑定上下文；完整控制不需要。',
-  '尚无设备授权时执行 relax pair，打开并扫描配对二维码。',
-  '若工作站提示 Desktop 尚未接入受管服务，可在手机确认重新打开 Desktop，无需电脑脚本或快捷方式。',
-  '统一配对先建立电脑记录；进入该电脑后可另行完成 OpenAI 官方 Remote 配对。',
-];
-
-export function pairingDisplayText(nextSteps, notice) {
-  return ['Bridge 已就绪，请在手机上完成连接。', connectionModesText, ...nextSteps.map((step, index) => `${index + 1}. ${step}`), notice].join('\n\n');
-}
+  '工作站服务和 Codex 内核已就绪，已启用登录自启。',
+  '生成配对二维码：relax pair',
+];
+
+export function pairingDisplayText(nextSteps) {
+  return ['Code Relax 工作站已启动。', ...nextSteps].join('\n');
+}

package/dist/src/plan-pricing.mjs

@@ -0,0 +1,47 @@
+import http2 from 'node:http2';
+import pricing from '../shared/plan-pricing.cjs';
+
+export async function readPlanPricing(client) {
+  await client.connect();
+  const token = async () => (await client.request('getAuthStatus', { includeToken: true, refreshToken: false })).authToken;
+  const authToken = await token();
+  if (!authToken) return null;
+  const identity = value => {
+    const auth = JSON.parse(Buffer.from(value.split('.')[1], 'base64url'))['https://api.openai.com/auth'];
+    return JSON.stringify([auth?.chatgpt_account_id, auth?.chatgpt_user_id]);
+  };
+  const initialIdentity = identity(authToken), accountId = JSON.parse(initialIdentity)[0];
+  if (!accountId) return null;
+  const session = http2.connect('https://chatgpt.com');
+  session.on('error', () => {}); // Each stream reports its own request error.
+  try {
+    const get = route => new Promise((resolve, reject) => {
+      const request = session.request({ ':method': 'GET', ':path': '/backend-api' + route,
+        authorization: `Bearer ${authToken}`, 'chatgpt-account-id': accountId,
+        'user-agent': 'Code-Relax/0.1.0', accept: 'application/json' });
+      let body = '', status, size = 0, ended = false;
+      const timer = setTimeout(() => request.destroy(new Error('套餐费用查询超时。')), 15000);
+      request.setEncoding('utf8');
+      request.on('response', headers => { status = headers[':status']; });
+      request.on('data', chunk => {
+        size += Buffer.byteLength(chunk);
+        if (size > 1024 * 1024) request.destroy(new Error('套餐费用响应过大。'));
+        else body += chunk;
+      });
+      request.on('error', reject);
+      request.on('close', () => { clearTimeout(timer); if (!ended) reject(new Error('套餐费用连接已断开。')); });
+      request.on('end', () => {
+        ended = true;
+        try {
+          if (status !== 200) throw new Error(`套餐费用查询失败（HTTP ${status}）。`);
+          resolve(JSON.parse(body));
+        } catch (error) { reject(error); }
+      });
+      request.end();
+    });
+    const value = await pricing.read(accountId, get);
+    const current = await token();
+    if (!current || identity(current) !== initialIdentity) throw new Error('套餐查询期间账号已变化。');
+    return value;
+  } finally { session.destroy(); }
+}

package/dist/src/platform/README.md

@@ -3,10 +3,10 @@
 当前只实现 Windows Codex：
 
 - `windows/runtime-paths.mjs`：固定服务、用户状态、Codex 数据、附件和长期凭据路径。
-- `windows/service-host.mjs`、`desktop-tools.mjs`：网卡、Desktop 工具管道、共享连接检测和旧状态迁移。
+- `windows/service-host.mjs`：网卡、Bridge 进程环境和旧状态迁移。
 - `windows/desktop-host.mjs`、PowerShell 脚本：普通/共享 Desktop、快捷方式和隐藏控制台启动。
 - `windows/credential-store.mjs/.ps1`：私有中继电脑凭据的 DPAPI 与 ACL。
 
 Windows 专有脚本兼容系统自带 PowerShell 5.1。通用生命周期使用 Node 接口；系统检测和凭据保护不扩散到业务代码。
 
-macOS、Linux 目录仅保留规划说明，尚无路径、IPC、进程或安装实现。接入排在控制端扩展之后，并需分别验证 Codex Desktop/app-server 的可用连接方式；只有独立 app-server 时不能宣称接管 Desktop 当前任务。
+macOS、Linux 目录仅保留规划说明，尚无路径、IPC、进程或安装实现。接入排在控制端扩展之后，并需分别验证 Codex Desktop/app-server 的可用连接方式；只有独立 app-server 时不能宣称接管 Desktop 当前任务。