@walkhi/code-relax 0.1.0-beta.50 → 0.1.0-beta.59

package/dist/src/platform/linux/process.mjs

@@ -1,53 +1,53 @@
-import fs from 'node:fs';
-import { managedEndpointUrl } from '../../managed-endpoint.mjs';
-
-const gone = error => ['ENOENT', 'ESRCH'].includes(error.code);
-let bootId;
-export function processInfo(pid) {
-  if (!Number.isSafeInteger(pid) || pid <= 0) throw new Error('无效的进程 ID。');
-  const root = `/proc/${pid}`;
-  try {
-    if (fs.statSync(root).uid !== process.getuid()) return null;
-    const stat = fs.readFileSync(`${root}/stat`, 'utf8');
-    const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
-    if (fields[0] === 'Z') return null;
-    const ticks = fields[19];
-    bootId ??= fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
-    const created = `${bootId}:${ticks}`;
-    const executable = fs.readlinkSync(`${root}/exe`);
-    const args = fs.readFileSync(`${root}/cmdline`, 'utf8').split('\0').filter(Boolean);
-    const after = fs.readFileSync(`${root}/stat`, 'utf8');
-    if (after.slice(after.lastIndexOf(')') + 2).split(' ')[19] !== ticks) return null;
-    return { pid, created, executable, args, command: args.join(' ') };
-  } catch (error) { if (gone(error)) return null; throw error; }
-}
-export const sameProcess = (a, b) => !!a && !!b && a.pid === b.pid && a.created === b.created
-  && a.executable === b.executable && JSON.stringify(a.args) === JSON.stringify(b.args);
-export function stopProcess(pid, expected) {
-  if (expected?.pid !== pid || !sameProcess(expected, processInfo(pid))) throw new Error('进程身份已变化，未结束进程。');
-  process.kill(pid, 'SIGTERM');
-  return { stopped: true };
-}
-function hasManagedSocket(pid, url, listener) {
-  const endpoint = managedEndpointUrl(url);
-  if (!endpoint) return false;
-  const port = Number(endpoint.slice(endpoint.lastIndexOf(':') + 1)).toString(16).toUpperCase().padStart(4, '0');
-  try {
-    const sockets = new Set(fs.readdirSync(`/proc/${pid}/fd`).flatMap(fd => {
-      try { return /^socket:\[(\d+)\]$/.exec(fs.readlinkSync(`/proc/${pid}/fd/${fd}`))?.slice(1) || []; }
-      catch (error) { if (gone(error)) return []; throw error; }
-    }));
-    return ['tcp', 'tcp6'].some(table => fs.readFileSync(`/proc/${pid}/net/${table}`, 'utf8').trim().split('\n').slice(1).some(line => {
-      const fields = line.trim().split(/\s+/);
-      return fields[3] === (listener ? '0A' : '01') && sockets.has(fields[9])
-        && [`0100007F:${port}`, `0000000000000000FFFF00000100007F:${port}`].includes(fields[listener ? 1 : 2]);
-    }));
-  } catch (error) { if (gone(error)) return false; throw error; }
-}
-
-export const connectedToManagedServer = (pid, url) => hasManagedSocket(pid, url, false);
-export function ownsManagedListener(expected, url) {
-  return !!expected && sameProcess(expected, processInfo(expected.pid))
-    && hasManagedSocket(expected.pid, url, true)
-    && sameProcess(expected, processInfo(expected.pid));
-}
+import fs from 'node:fs';
+import { managedEndpointUrl } from '../../managed-endpoint.mjs';
+
+const gone = error => ['ENOENT', 'ESRCH'].includes(error.code);
+let bootId;
+export function processInfo(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) throw new Error('无效的进程 ID。');
+  const root = `/proc/${pid}`;
+  try {
+    if (fs.statSync(root).uid !== process.getuid()) return null;
+    const stat = fs.readFileSync(`${root}/stat`, 'utf8');
+    const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+    if (fields[0] === 'Z') return null;
+    const ticks = fields[19];
+    bootId ??= fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+    const created = `${bootId}:${ticks}`;
+    const executable = fs.readlinkSync(`${root}/exe`);
+    const args = fs.readFileSync(`${root}/cmdline`, 'utf8').split('\0').filter(Boolean);
+    const after = fs.readFileSync(`${root}/stat`, 'utf8');
+    if (after.slice(after.lastIndexOf(')') + 2).split(' ')[19] !== ticks) return null;
+    return { pid, created, executable, args, command: args.join(' ') };
+  } catch (error) { if (gone(error)) return null; throw error; }
+}
+export const sameProcess = (a, b) => !!a && !!b && a.pid === b.pid && a.created === b.created
+  && a.executable === b.executable && JSON.stringify(a.args) === JSON.stringify(b.args);
+export function stopProcess(pid, expected) {
+  if (expected?.pid !== pid || !sameProcess(expected, processInfo(pid))) throw new Error('进程身份已变化，未结束进程。');
+  process.kill(pid, 'SIGTERM');
+  return { stopped: true };
+}
+function hasManagedSocket(pid, url, listener) {
+  const endpoint = managedEndpointUrl(url);
+  if (!endpoint) return false;
+  const port = Number(endpoint.slice(endpoint.lastIndexOf(':') + 1)).toString(16).toUpperCase().padStart(4, '0');
+  try {
+    const sockets = new Set(fs.readdirSync(`/proc/${pid}/fd`).flatMap(fd => {
+      try { return /^socket:\[(\d+)\]$/.exec(fs.readlinkSync(`/proc/${pid}/fd/${fd}`))?.slice(1) || []; }
+      catch (error) { if (gone(error)) return []; throw error; }
+    }));
+    return ['tcp', 'tcp6'].some(table => fs.readFileSync(`/proc/${pid}/net/${table}`, 'utf8').trim().split('\n').slice(1).some(line => {
+      const fields = line.trim().split(/\s+/);
+      return fields[3] === (listener ? '0A' : '01') && sockets.has(fields[9])
+        && [`0100007F:${port}`, `0000000000000000FFFF00000100007F:${port}`].includes(fields[listener ? 1 : 2]);
+    }));
+  } catch (error) { if (gone(error)) return false; throw error; }
+}
+
+export const connectedToManagedServer = (pid, url) => hasManagedSocket(pid, url, false);
+export function ownsManagedListener(expected, url) {
+  return !!expected && sameProcess(expected, processInfo(expected.pid))
+    && hasManagedSocket(expected.pid, url, true)
+    && sameProcess(expected, processInfo(expected.pid));
+}

package/dist/src/platform/linux/system.mjs

@@ -1,50 +1,50 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { installedDesktop, verifyDesktopPackage } from './desktop-installation.mjs';
-import { processInfo, sameProcess, stopProcess, connectedToManagedServer, ownsManagedListener } from './process.mjs';
-import { startBackground } from '../../background-process.mjs';
-
-// Package upgrades unlink the old executable while its process stays alive.
-// Match that process for Desktop discovery, but retain its exact /proc identity
-// for sameProcess/stopProcess so a changed process is never signalled blindly.
-const desktopExecutableMatches = (actual, installed) => actual === installed || actual === `${installed} (deleted)`;
-
-export async function systemRequest(request) {
-  if (request.operation === 'owns-listener') return ownsManagedListener(request.expected, request.url);
-  if (request.operation === 'process') return processInfo(request.pid);
-  if (request.operation === 'stop') return stopProcess(request.expected?.pid, request.expected);
-  const installed = installedDesktop();
-  if (request.operation === 'desktop-info') {
-    const running = [];
-    if (installed) for (const name of fs.readdirSync('/proc').filter(name => /^\d+$/.test(name))) {
-      try {
-        if (fs.statSync(`/proc/${name}`).uid !== process.getuid()
-            || !desktopExecutableMatches(fs.readlinkSync(`/proc/${name}/exe`), installed.executable)) continue;
-      } catch (error) { if (['ENOENT', 'ESRCH', 'EACCES'].includes(error.code)) continue; throw error; }
-      const info = processInfo(Number(name));
-      if (info && desktopExecutableMatches(info.executable, installed.executable) && !info.args.some(arg => arg.startsWith('--type='))) running.push(info);
-    }
-    if (running.length > 1) throw new Error('发现多个 ChatGPT 桌面实例，请先关闭多余实例。');
-    const info = running[0] || null;
-    const connected = info ? connectedToManagedServer(info.pid, request.url) : false;
-    if (info && !sameProcess(info, processInfo(info.pid))) throw new Error('核对期间桌面进程发生变化。');
-    return { ...(installed || { desktop: null, version: '', build: '' }), running: !!info,
-      finishedLaunching: connected, connectedToManagedServer: connected, process: info };
-  }
-  if (!installed || installed.desktop !== request.bundlePath) throw new Error('桌面版安装位置已变化。');
-  if (request.operation === 'desktop-start') {
-    verifyDesktopPackage(installed.desktop);
-    if (!process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) throw new Error('请在 Linux 图形桌面的当前用户会话中运行 relax setup。');
-    const environment = { ...process.env, ...request.environment };
-    delete environment.CODEX_APP_SERVER_FORCE_CLI;
-    delete environment.CODEX_APP_TOOLS_PIPE_PATH;
-    const pid = await startBackground(path.join(installed.desktop, 'codex-launcher'), [], environment);
-    return { pid, started: true };
-  }
-  if (request.operation === 'desktop-close') {
-    // Electron's POSIX signal handler calls Browser::Quit for SIGTERM. Wait
-    // for exit before touching the store; never escalate to SIGKILL.
-    return stopProcess(request.expected?.pid, request.expected);
-  }
-  throw new Error(`不支持的 Linux 系统操作：${request.operation}`);
-}
+import fs from 'node:fs';
+import path from 'node:path';
+import { installedDesktop, verifyDesktopPackage } from './desktop-installation.mjs';
+import { processInfo, sameProcess, stopProcess, connectedToManagedServer, ownsManagedListener } from './process.mjs';
+import { startBackground } from '../../background-process.mjs';
+
+// Package upgrades unlink the old executable while its process stays alive.
+// Match that process for Desktop discovery, but retain its exact /proc identity
+// for sameProcess/stopProcess so a changed process is never signalled blindly.
+const desktopExecutableMatches = (actual, installed) => actual === installed || actual === `${installed} (deleted)`;
+
+export async function systemRequest(request) {
+  if (request.operation === 'owns-listener') return ownsManagedListener(request.expected, request.url);
+  if (request.operation === 'process') return processInfo(request.pid);
+  if (request.operation === 'stop') return stopProcess(request.expected?.pid, request.expected);
+  const installed = installedDesktop();
+  if (request.operation === 'desktop-info') {
+    const running = [];
+    if (installed) for (const name of fs.readdirSync('/proc').filter(name => /^\d+$/.test(name))) {
+      try {
+        if (fs.statSync(`/proc/${name}`).uid !== process.getuid()
+            || !desktopExecutableMatches(fs.readlinkSync(`/proc/${name}/exe`), installed.executable)) continue;
+      } catch (error) { if (['ENOENT', 'ESRCH', 'EACCES'].includes(error.code)) continue; throw error; }
+      const info = processInfo(Number(name));
+      if (info && desktopExecutableMatches(info.executable, installed.executable) && !info.args.some(arg => arg.startsWith('--type='))) running.push(info);
+    }
+    if (running.length > 1) throw new Error('发现多个 ChatGPT 桌面实例，请先关闭多余实例。');
+    const info = running[0] || null;
+    const connected = info ? connectedToManagedServer(info.pid, request.url) : false;
+    if (info && !sameProcess(info, processInfo(info.pid))) throw new Error('核对期间桌面进程发生变化。');
+    return { ...(installed || { desktop: null, version: '', build: '' }), running: !!info,
+      finishedLaunching: connected, connectedToManagedServer: connected, process: info };
+  }
+  if (!installed || installed.desktop !== request.bundlePath) throw new Error('桌面版安装位置已变化。');
+  if (request.operation === 'desktop-start') {
+    verifyDesktopPackage(installed.desktop);
+    if (!process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) throw new Error('请在 Linux 图形桌面的当前用户会话中运行 relax setup。');
+    const environment = { ...process.env, ...request.environment };
+    delete environment.CODEX_APP_SERVER_FORCE_CLI;
+    delete environment.CODEX_APP_TOOLS_PIPE_PATH;
+    const pid = await startBackground(path.join(installed.desktop, 'codex-launcher'), [], environment);
+    return { pid, started: true };
+  }
+  if (request.operation === 'desktop-close') {
+    // Electron's POSIX signal handler calls Browser::Quit for SIGTERM. Wait
+    // for exit before touching the store; never escalate to SIGKILL.
+    return stopProcess(request.expected?.pid, request.expected);
+  }
+  throw new Error(`不支持的 Linux 系统操作：${request.operation}`);
+}

package/dist/src/platform/linux/user-environment.mjs

@@ -1,9 +1,9 @@
-import { managedEndpointUrl } from '../../managed-endpoint.mjs';
-// Only the new Desktop process receives the managed connection settings.
-// Do not mutate shell profiles or the login session's global environment.
-export async function configureManagedEnvironment(stateRoot, url) {
-  if (!managedEndpointUrl(url)) throw new Error('未确认 Codex 内核地址。');
-  return { configured: true, changed: false, owned: false, persistent: false,
-    scope: 'application-launch', value: url };
-}
-export async function clearManagedEnvironment() { return { removed: false, preserved: false, reason: 'application-launch-only' }; }
+import { managedEndpointUrl } from '../../managed-endpoint.mjs';
+// Only the new Desktop process receives the managed connection settings.
+// Do not mutate shell profiles or the login session's global environment.
+export async function configureManagedEnvironment(stateRoot, url) {
+  if (!managedEndpointUrl(url)) throw new Error('未确认 Codex 内核地址。');
+  return { configured: true, changed: false, owned: false, persistent: false,
+    scope: 'application-launch', value: url };
+}
+export async function clearManagedEnvironment() { return { removed: false, preserved: false, reason: 'application-launch-only' }; }

package/dist/src/platform/macos/codex-runtime.mjs

@@ -1,125 +1,125 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { createRequire } from 'node:module';
-import { execFile, execFileSync } from 'node:child_process';
-import { promisify } from 'node:util';
-import { compareVersions, verifyProtocol } from '../codex-protocol.mjs';
-import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
-import { retainRuntime, runtimeFingerprint, packageRoot } from './retained-runtime.mjs';
-export { runtimeFingerprint, pruneRetainedDesktopRuntimes } from './retained-runtime.mjs';
-
-const exec = promisify(execFile);
-export const codeModeHostPath = executable => path.join(packageRoot(executable), 'bin/codex-code-mode-host');
-const fileExists = file => { try { return fs.statSync(file).isFile(); } catch (error) { if (error.code === 'ENOENT') return false; throw error; } };
-export function nativeExecutable(file) {
-  if (!fileExists(file)) return false;
-  const descriptor = fs.openSync(file, 'r');
-  try {
-    const magic = Buffer.alloc(4);
-    if (fs.readSync(descriptor, magic, 0, 4, 0) !== 4) return false;
-    return [0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe, 0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca].includes(magic.readUInt32BE());
-  } finally { fs.closeSync(descriptor); }
-}
-export function runtimeFilesAvailable(executable) {
-  try { return nativeExecutable(executable) && nativeExecutable(codeModeHostPath(executable)); }
-  catch (error) { if (error.code === 'EACCES') throw error; return false; }
-}
-function nativeEntry(file) {
-  if (!fileExists(file)) return null;
-  file = fs.realpathSync(file);
-  if (nativeExecutable(file)) return file;
-  if (path.basename(path.dirname(file)) === 'bin') {
-    const bundle = path.resolve(file, '../../CodexCLI.app/Contents/MacOS/codex');
-    if (nativeExecutable(bundle)) return bundle;
-  }
-  return null;
-}
-
-// Match the official CLI's native package mapping. Never launch the npm JS shim as a kernel.
-export function discoverCodex(environment = process.env, { home = os.homedir(), arch = process.arch } = {}) {
-  if (!['arm64', 'x64'].includes(arch)) throw new Error(`不支持的 Mac CPU：${arch}`);
-  const found = new Map();
-  const add = (file, source) => {
-    file = nativeEntry(file);
-    if (!file) return;
-    fs.accessSync(file, fs.constants.X_OK);
-    const executable = fs.realpathSync(file);
-    if (!found.has(executable)) found.set(executable, { executable, source });
-  };
-  if (environment.CODE_RELAX_CODEX_PATH) {
-    const file = environment.CODE_RELAX_CODEX_PATH;
-    if (!path.isAbsolute(file) || path.basename(file) !== 'codex') throw new Error('CODE_RELAX_CODEX_PATH 必须是原生 codex 程序的绝对路径。');
-    add(file, 'explicit');
-    if (!found.size) throw new Error('指定的 Codex 原生程序不存在或不是 Mach-O 可执行文件。');
-    return [...found.values()];
-  }
-  for (const directory of ['/Applications', path.join(home, 'Applications')]) {
-    for (const name of ['ChatGPT.app', 'Codex.app']) {
-      const bundle = path.join(directory, name);
-      if (!fileExists(path.join(bundle, 'Contents/Info.plist'))) continue;
-      const id = execFileSync('/usr/bin/plutil', ['-extract', 'CFBundleIdentifier', 'raw', '-o', '-', path.join(bundle, 'Contents/Info.plist')], { encoding: 'utf8', timeout: 5000 }).trim();
-      if (id !== 'com.openai.codex') continue;
-      add(path.join(bundle, 'Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex'), 'desktop');
-    }
-  }
-  const codexHome = environment.CODEX_HOME?.trim() || path.join(home, '.codex');
-  const directories = [...String(environment.PATH || '').split(path.delimiter), environment.CODEX_INSTALL_DIR,
-    path.join(home, '.local/bin'), path.join(codexHome, 'packages/standalone/current/bin')].filter(item => item && path.isAbsolute(item));
-  const target = `${arch === 'arm64' ? 'aarch64' : 'x86_64'}-apple-darwin`;
-  for (const directory of new Set(directories)) {
-    const entry = path.join(directory, 'codex');
-    if (!fileExists(entry)) continue;
-    if (nativeEntry(entry)) { add(entry, 'cli'); continue; }
-    let root = path.dirname(fs.realpathSync(entry));
-    while (true) {
-      const packageFile = path.join(root, 'package.json');
-      if (fileExists(packageFile) && readRecord(packageFile)?.name === '@openai/codex') {
-        let vendor = path.join(root, 'vendor');
-        try { vendor = path.join(path.dirname(createRequire(packageFile).resolve(`@openai/codex-darwin-${arch}/package.json`)), 'vendor'); }
-        catch (error) { if (error.code !== 'MODULE_NOT_FOUND') throw error; }
-        add(path.join(vendor, target, 'bin/codex'), 'npm');
-        break;
-      }
-      const parent = path.dirname(root);
-      if (parent === root) break;
-      root = parent;
-    }
-  }
-  return [...found.values()];
-}
-
-export async function resolveCodexRuntime(stateRoot, { refresh = false, environment = process.env } = {}) {
-  fs.mkdirSync(stateRoot, { recursive: true, mode: 0o700 });
-  const recordFile = path.join(stateRoot, 'codex-runtime.json');
-  const saved = readRecord(recordFile);
-  const codexHome = path.resolve(environment.CODEX_HOME?.trim() || saved?.codexHome || path.join(os.homedir(), '.codex'));
-  const explicit = environment.CODE_RELAX_CODEX_PATH || (saved?.source === 'explicit' ? saved.sourceExecutable : '');
-  if (!refresh && saved?.executable && (!explicit || explicit === saved.sourceExecutable) && codexHome === saved.codexHome
-      && runtimeFilesAvailable(saved.executable) && saved.fingerprint === runtimeFingerprint(saved.executable)) return saved;
-  const candidates = [], rejected = [];
-  for (const candidate of discoverCodex({ ...environment, CODEX_HOME: codexHome, CODE_RELAX_CODEX_PATH: explicit })) {
-    try {
-      if (candidate.source === 'desktop') {
-        const bundle = path.resolve(packageRoot(candidate.executable), '../../..');
-        await exec('/usr/bin/codesign', ['--verify', '--deep', '--strict', '-R=identifier \"com.openai.codex\" and anchor apple generic and certificate leaf[subject.OU] = \"2DC432GLL2\"', bundle], { timeout: 30000 });
-      }
-      if (!runtimeFilesAvailable(candidate.executable)) throw new Error('缺少配套原生 codex-code-mode-host');
-      const { stdout } = await exec(candidate.executable, ['--version'], { timeout: 10000, env: { ...environment, CODEX_HOME: codexHome } });
-      const version = /^codex-cli (\d+\.\d+\.\d+(?:-[\w.]+)?)/m.exec(stdout)?.[1];
-      if (!version) throw new Error('无法识别 Codex 版本');
-      candidates.push({ ...candidate, version });
-    } catch (error) { rejected.push(`${candidate.executable}: ${error.message}`); }
-  }
-  candidates.sort((a, b) => Number(b.source === 'desktop') - Number(a.source === 'desktop') || compareVersions(b.version, a.version));
-  for (const candidate of candidates) {
-    try {
-      const retained = await retainRuntime(candidate.executable, stateRoot, candidate.version);
-      await verifyProtocol(retained.executable, stateRoot);
-      const result = { ...candidate, ...retained, codexHome, fingerprint: runtimeFingerprint(retained.executable) };
-      writeRecord(recordFile, result);
-      return result;
-    } catch (error) { rejected.push(`${candidate.executable}: ${error.message}`); }
-  }
-  throw new Error(`未找到具备所需协议能力的 Mac Codex 内核，请安装官方 Codex 应用或完整 CLI 并登录账号。${rejected.length ? '\n' + rejected.join('\n') : ''}`);
-}
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { execFile, execFileSync } from 'node:child_process';
+import { promisify } from 'node:util';
+import { compareVersions, verifyProtocol } from '../codex-protocol.mjs';
+import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
+import { retainRuntime, runtimeFingerprint, packageRoot } from './retained-runtime.mjs';
+export { runtimeFingerprint, pruneRetainedDesktopRuntimes } from './retained-runtime.mjs';
+
+const exec = promisify(execFile);
+export const codeModeHostPath = executable => path.join(packageRoot(executable), 'bin/codex-code-mode-host');
+const fileExists = file => { try { return fs.statSync(file).isFile(); } catch (error) { if (error.code === 'ENOENT') return false; throw error; } };
+export function nativeExecutable(file) {
+  if (!fileExists(file)) return false;
+  const descriptor = fs.openSync(file, 'r');
+  try {
+    const magic = Buffer.alloc(4);
+    if (fs.readSync(descriptor, magic, 0, 4, 0) !== 4) return false;
+    return [0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe, 0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca].includes(magic.readUInt32BE());
+  } finally { fs.closeSync(descriptor); }
+}
+export function runtimeFilesAvailable(executable) {
+  try { return nativeExecutable(executable) && nativeExecutable(codeModeHostPath(executable)); }
+  catch (error) { if (error.code === 'EACCES') throw error; return false; }
+}
+function nativeEntry(file) {
+  if (!fileExists(file)) return null;
+  file = fs.realpathSync(file);
+  if (nativeExecutable(file)) return file;
+  if (path.basename(path.dirname(file)) === 'bin') {
+    const bundle = path.resolve(file, '../../CodexCLI.app/Contents/MacOS/codex');
+    if (nativeExecutable(bundle)) return bundle;
+  }
+  return null;
+}
+
+// Match the official CLI's native package mapping. Never launch the npm JS shim as a kernel.
+export function discoverCodex(environment = process.env, { home = os.homedir(), arch = process.arch } = {}) {
+  if (!['arm64', 'x64'].includes(arch)) throw new Error(`不支持的 Mac CPU：${arch}`);
+  const found = new Map();
+  const add = (file, source) => {
+    file = nativeEntry(file);
+    if (!file) return;
+    fs.accessSync(file, fs.constants.X_OK);
+    const executable = fs.realpathSync(file);
+    if (!found.has(executable)) found.set(executable, { executable, source });
+  };
+  if (environment.CODE_RELAX_CODEX_PATH) {
+    const file = environment.CODE_RELAX_CODEX_PATH;
+    if (!path.isAbsolute(file) || path.basename(file) !== 'codex') throw new Error('CODE_RELAX_CODEX_PATH 必须是原生 codex 程序的绝对路径。');
+    add(file, 'explicit');
+    if (!found.size) throw new Error('指定的 Codex 原生程序不存在或不是 Mach-O 可执行文件。');
+    return [...found.values()];
+  }
+  for (const directory of ['/Applications', path.join(home, 'Applications')]) {
+    for (const name of ['ChatGPT.app', 'Codex.app']) {
+      const bundle = path.join(directory, name);
+      if (!fileExists(path.join(bundle, 'Contents/Info.plist'))) continue;
+      const id = execFileSync('/usr/bin/plutil', ['-extract', 'CFBundleIdentifier', 'raw', '-o', '-', path.join(bundle, 'Contents/Info.plist')], { encoding: 'utf8', timeout: 5000 }).trim();
+      if (id !== 'com.openai.codex') continue;
+      add(path.join(bundle, 'Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex'), 'desktop');
+    }
+  }
+  const codexHome = environment.CODEX_HOME?.trim() || path.join(home, '.codex');
+  const directories = [...String(environment.PATH || '').split(path.delimiter), environment.CODEX_INSTALL_DIR,
+    path.join(home, '.local/bin'), path.join(codexHome, 'packages/standalone/current/bin')].filter(item => item && path.isAbsolute(item));
+  const target = `${arch === 'arm64' ? 'aarch64' : 'x86_64'}-apple-darwin`;
+  for (const directory of new Set(directories)) {
+    const entry = path.join(directory, 'codex');
+    if (!fileExists(entry)) continue;
+    if (nativeEntry(entry)) { add(entry, 'cli'); continue; }
+    let root = path.dirname(fs.realpathSync(entry));
+    while (true) {
+      const packageFile = path.join(root, 'package.json');
+      if (fileExists(packageFile) && readRecord(packageFile)?.name === '@openai/codex') {
+        let vendor = path.join(root, 'vendor');
+        try { vendor = path.join(path.dirname(createRequire(packageFile).resolve(`@openai/codex-darwin-${arch}/package.json`)), 'vendor'); }
+        catch (error) { if (error.code !== 'MODULE_NOT_FOUND') throw error; }
+        add(path.join(vendor, target, 'bin/codex'), 'npm');
+        break;
+      }
+      const parent = path.dirname(root);
+      if (parent === root) break;
+      root = parent;
+    }
+  }
+  return [...found.values()];
+}
+
+export async function resolveCodexRuntime(stateRoot, { refresh = false, environment = process.env } = {}) {
+  fs.mkdirSync(stateRoot, { recursive: true, mode: 0o700 });
+  const recordFile = path.join(stateRoot, 'codex-runtime.json');
+  const saved = readRecord(recordFile);
+  const codexHome = path.resolve(environment.CODEX_HOME?.trim() || saved?.codexHome || path.join(os.homedir(), '.codex'));
+  const explicit = environment.CODE_RELAX_CODEX_PATH || (saved?.source === 'explicit' ? saved.sourceExecutable : '');
+  if (!refresh && saved?.executable && (!explicit || explicit === saved.sourceExecutable) && codexHome === saved.codexHome
+      && runtimeFilesAvailable(saved.executable) && saved.fingerprint === runtimeFingerprint(saved.executable)) return saved;
+  const candidates = [], rejected = [];
+  for (const candidate of discoverCodex({ ...environment, CODEX_HOME: codexHome, CODE_RELAX_CODEX_PATH: explicit })) {
+    try {
+      if (candidate.source === 'desktop') {
+        const bundle = path.resolve(packageRoot(candidate.executable), '../../..');
+        await exec('/usr/bin/codesign', ['--verify', '--deep', '--strict', '-R=identifier \"com.openai.codex\" and anchor apple generic and certificate leaf[subject.OU] = \"2DC432GLL2\"', bundle], { timeout: 30000 });
+      }
+      if (!runtimeFilesAvailable(candidate.executable)) throw new Error('缺少配套原生 codex-code-mode-host');
+      const { stdout } = await exec(candidate.executable, ['--version'], { timeout: 10000, env: { ...environment, CODEX_HOME: codexHome } });
+      const version = /^codex-cli (\d+\.\d+\.\d+(?:-[\w.]+)?)/m.exec(stdout)?.[1];
+      if (!version) throw new Error('无法识别 Codex 版本');
+      candidates.push({ ...candidate, version });
+    } catch (error) { rejected.push(`${candidate.executable}: ${error.message}`); }
+  }
+  candidates.sort((a, b) => Number(b.source === 'desktop') - Number(a.source === 'desktop') || compareVersions(b.version, a.version));
+  for (const candidate of candidates) {
+    try {
+      const retained = await retainRuntime(candidate.executable, stateRoot, candidate.version);
+      await verifyProtocol(retained.executable, stateRoot);
+      const result = { ...candidate, ...retained, codexHome, fingerprint: runtimeFingerprint(retained.executable) };
+      writeRecord(recordFile, result);
+      return result;
+    } catch (error) { rejected.push(`${candidate.executable}: ${error.message}`); }
+  }
+  throw new Error(`未找到具备所需协议能力的 Mac Codex 内核，请安装官方 Codex 应用或完整 CLI 并登录账号。${rejected.length ? '\n' + rejected.join('\n') : ''}`);
+}