@walkhi/code-relax 0.1.0-beta.65 → 0.1.0-beta.68

package/dist/src/platform/windows/rustdesk-video-probe.mjs

@@ -1,168 +1,168 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import net from 'node:net';
-import os from 'node:os';
-import path from 'node:path';
-import { spawn } from 'node:child_process';
-import { brotliDecompressSync } from 'node:zlib';
-
-export const RUSTDESK_PROBE_HOST_SHA256 = '8555777215510d83d2d61c9dc984e4fcc838bd7e79f9d18a42585431f5e8bb47';
-const leaseMs = 60_000;
-const pause = ms => new Promise(resolve => setTimeout(resolve, ms));
-const failure = code => Object.assign(new Error('桌面视频测试尚未就绪'), { code, statusCode: 503 });
-
-// The official EXE is a launcher. Extract its verified Brotli payload into our
-// own runtime directory and launch the actual process, so leases own its PID.
-export function prepareRustDeskProbeHost(root) {
-  const bytes = fs.readFileSync(path.join(root, 'rustdesk-1.5.0-x86_64.exe'));
-  if (crypto.createHash('sha256').update(bytes).digest('hex') !== RUSTDESK_PROBE_HOST_SHA256) throw failure('desktop_video_host_hash');
-  const magic = Buffer.from('rustdesk'), decoder = new TextDecoder('utf-8', { fatal: true });
-  let search = 0, entries;
-  while (search < bytes.length) {
-    const at = bytes.indexOf(magic, search); if (at < 0) break; search = at + magic.length;
-    try {
-      let offset = at + magic.length; const files = [];
-      while (!bytes.subarray(offset, offset + magic.length).equals(magic)) {
-        const length = bytes.readUInt32BE(offset); offset += 4;
-        if (length < 1 || length > 512) throw new Error('payload');
-        const name = decoder.decode(bytes.subarray(offset, offset + length)).replaceAll('\\', '/'); offset += length;
-        if (/[\x00-\x1f]/.test(name) || path.posix.isAbsolute(name) || name.includes(':') || name.split('/').includes('..')) throw new Error('payload_path');
-        const size = bytes.readUInt32BE(offset); offset += 4;
-        if (size < 1 || offset + size + 32 > bytes.length) throw new Error('payload');
-        const data = bytes.subarray(offset, offset + size); offset += size;
-        const md5 = bytes.subarray(offset, offset + 32).toString(); offset += 32;
-        if (!/^[a-f0-9]{32}$/.test(md5)) throw new Error('payload');
-        files.push({ name: path.posix.normalize(name), data, md5 });
-        if (files.length > 5000) throw new Error('payload');
-      }
-      if (files.length !== 104 || !files.some(file => file.name === 'rustdesk.exe')) continue;
-      const suffix = Buffer.from('.\\rustdesk.exe');
-      if (!bytes.subarray(offset + 8, offset + 8 + suffix.length).equals(suffix)) continue;
-      entries = files; break;
-    } catch { /* Non-payload occurrences of the ASCII magic are expected in PE strings. */ }
-  }
-  if (!entries) throw failure('desktop_video_host_payload');
-  const runtime = path.resolve(root, 'runtime');
-  for (const file of entries) {
-    const target = path.resolve(runtime, file.name);
-    if (!target.startsWith(runtime + path.sep)) throw failure('desktop_video_host_path');
-    let existing;
-    try { existing = crypto.createHash('md5').update(fs.readFileSync(target)).digest('hex'); } catch {}
-    if (existing === file.md5) continue;
-    const data = brotliDecompressSync(file.data, { maxOutputLength: 128 * 1024 * 1024 });
-    if (crypto.createHash('md5').update(data).digest('hex') !== file.md5) throw failure('desktop_video_host_payload');
-    fs.mkdirSync(path.dirname(target), { recursive: true }); fs.writeFileSync(target, data);
-  }
-  return path.join(runtime, 'rustdesk.exe');
-}
-
-// A read-only, LAN-only prototype. The normal desktop helper and input path are independent.
-export class RustDeskVideoProbe {
-  constructor({ stateRoot, appData = process.env.APPDATA, platform = process.platform } = {}) {
-    this.platform = platform;
-    this.root = path.join(stateRoot, 'desktop-video-probe');
-    this.configRoot = path.join(appData || os.tmpdir(), 'RustDesk', 'config');
-    this.process = null; this.lease = null; this.timer = null; this.starting = false; this.stopped = Promise.resolve(); this.preparedExecutable = null;
-  }
-  configuration(port, password) {
-    const options = {
-      'direct-server': 'Y', 'direct-access-port': String(port),
-      'custom-rendezvous-server': '127.0.0.1:9', 'relay-server': '127.0.0.1:9', 'api-server': 'http://127.0.0.1:9',
-      'enable-hwcodec': 'N', 'access-mode': 'view', 'approve-mode': 'password', 'verification-method': 'use-permanent-password',
-      'enable-keyboard': 'N', 'enable-clipboard': 'N', 'enable-file-transfer': 'N', 'enable-audio': 'N',
-      'enable-tunnel': 'N', 'enable-terminal': 'N', 'enable-record-session': 'N',
-      'allow-auto-record-incoming': 'N', 'allow-auto-record-outgoing': 'N'
-    };
-    return {
-      main: `password = '${password}'\nsalt = '${crypto.randomBytes(16).toString('hex')}'\n`,
-      secondary: "rendezvous_server = '127.0.0.1:9'\n\n[options]\n" + Object.entries(options).map(([key, value]) => `${key} = '${value}'`).join('\n') + '\n'
-    };
-  }
-  async begin() {
-    if (this.platform !== 'win32') throw failure('desktop_video_platform');
-    if (this.starting || this.lease) throw failure('desktop_video_busy');
-    this.starting = true;
-    try {
-      await this.stopped;
-      const executable = path.join(this.root, 'rustdesk-1.5.0-x86_64.exe');
-      let binary;
-      try { binary = fs.readFileSync(executable); } catch { throw failure('desktop_video_host_missing'); }
-      if (crypto.createHash('sha256').update(binary).digest('hex') !== RUSTDESK_PROBE_HOST_SHA256) throw failure('desktop_video_host_hash');
-      const ownerFile = path.join(this.root, 'config-owner.json');
-      let owner;
-      try { owner = JSON.parse(fs.readFileSync(ownerFile, 'utf8')); } catch {}
-      const entries = fs.existsSync(this.configRoot) ? fs.readdirSync(this.configRoot) : [];
-      if (entries.length && (owner?.configRoot !== this.configRoot || !owner.hashes
-        || JSON.stringify(owner.hashes) !== JSON.stringify(this.configHashes()))) throw failure('desktop_video_existing_rustdesk');
-      const port = await new Promise((resolve, reject) => {
-        const server = net.createServer(); server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => { const port = server.address().port; server.close(error => error ? reject(error) : resolve(port)); });
-      });
-      const actualExecutable = this.preparedExecutable ||= prepareRustDeskProbeHost(this.root);
-      const password = crypto.randomBytes(24).toString('hex'), leaseId = crypto.randomBytes(16).toString('hex');
-      const config = this.configuration(port, password);
-      fs.mkdirSync(this.root, { recursive: true, mode: 0o700 });
-      fs.mkdirSync(this.configRoot, { recursive: true, mode: 0o700 });
-      fs.writeFileSync(path.join(this.configRoot, 'RustDesk.toml'), config.main, { mode: 0o600 });
-      fs.writeFileSync(path.join(this.configRoot, 'RustDesk2.toml'), config.secondary, { mode: 0o600 });
-      this.saveOwner();
-      this.process = spawn(actualExecutable, ['--server'], { cwd: path.dirname(actualExecutable),
-        env: { ...process.env, RUSTDESK_APPNAME: 'rustdesk-1.5.0-x86_64.exe' }, windowsHide: true, stdio: 'ignore' });
-      const child = this.process; let launchError = false;
-      console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'spawn', pid: child.pid }));
-      this.stopped = new Promise(resolve => {
-        let ended = false;
-        const finished = () => {
-          console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'exit', pid: child.pid, code: child.exitCode }));
-          if (ended) return; ended = true;
-          try { this.saveOwner(); } catch { console.error(JSON.stringify({ event: 'desktop-video-owner', state: 'failed' })); }
-          if (this.process === child) { clearTimeout(this.timer); this.process = null; this.lease = null; }
-          resolve();
-        };
-        child.once('error', () => { launchError = true; finished(); });
-        child.once('exit', finished);
-      });
-      const deadline = Date.now() + 8_000;
-      let ready = false;
-      while (Date.now() < deadline && child.exitCode === null && !launchError) {
-        ready = await new Promise(resolve => {
-          const socket = net.connect({ host: '127.0.0.1', port });
-          let settled = false;
-          const finish = value => { if (settled) return; settled = true; socket.destroy(); resolve(value); };
-          socket.once('connect', () => finish(true)); socket.once('error', () => finish(false)); socket.setTimeout(300, () => finish(false));
-        });
-        if (ready) break;
-        await pause(150);
-      }
-      if (!ready) throw failure('desktop_video_host_start');
-      this.lease = { leaseId, password, port, codec: 'vp9', fps: 5, viewOnly: true };
-      console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'ready', pid: child.pid }));
-      this.renew(leaseId);
-      return { ...this.lease, engine: 'rustdesk-probe', expiresInMs: leaseMs };
-    } catch (error) { this.stop(); throw error; }
-    finally { this.starting = false; }
-  }
-  configHashes() {
-    return ['RustDesk.toml', 'RustDesk2.toml'].map(name => {
-      try { return crypto.createHash('sha256').update(fs.readFileSync(path.join(this.configRoot, name))).digest('hex'); }
-      catch { return ''; }
-    });
-  }
-  saveOwner() {
-    fs.writeFileSync(path.join(this.root, 'config-owner.json'), JSON.stringify({ configRoot: this.configRoot, hashes: this.configHashes() }), { mode: 0o600 });
-  }
-  renew(leaseId) {
-    if (!this.lease || leaseId !== this.lease.leaseId) throw failure('desktop_video_lease');
-    clearTimeout(this.timer); this.timer = setTimeout(() => this.stop(), leaseMs); this.timer.unref();
-    return { active: true, expiresInMs: leaseMs };
-  }
-  release(leaseId) {
-    if (this.lease?.leaseId === leaseId) this.stop();
-    return { released: true };
-  }
-  stop() {
-    clearTimeout(this.timer); this.timer = null;
-    const child = this.process; this.process = null; this.lease = null;
-    if (child && child.exitCode === null) child.kill();
-  }
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { brotliDecompressSync } from 'node:zlib';
+
+export const RUSTDESK_PROBE_HOST_SHA256 = '8555777215510d83d2d61c9dc984e4fcc838bd7e79f9d18a42585431f5e8bb47';
+const leaseMs = 60_000;
+const pause = ms => new Promise(resolve => setTimeout(resolve, ms));
+const failure = code => Object.assign(new Error('桌面视频测试尚未就绪'), { code, statusCode: 503 });
+
+// The official EXE is a launcher. Extract its verified Brotli payload into our
+// own runtime directory and launch the actual process, so leases own its PID.
+export function prepareRustDeskProbeHost(root) {
+  const bytes = fs.readFileSync(path.join(root, 'rustdesk-1.5.0-x86_64.exe'));
+  if (crypto.createHash('sha256').update(bytes).digest('hex') !== RUSTDESK_PROBE_HOST_SHA256) throw failure('desktop_video_host_hash');
+  const magic = Buffer.from('rustdesk'), decoder = new TextDecoder('utf-8', { fatal: true });
+  let search = 0, entries;
+  while (search < bytes.length) {
+    const at = bytes.indexOf(magic, search); if (at < 0) break; search = at + magic.length;
+    try {
+      let offset = at + magic.length; const files = [];
+      while (!bytes.subarray(offset, offset + magic.length).equals(magic)) {
+        const length = bytes.readUInt32BE(offset); offset += 4;
+        if (length < 1 || length > 512) throw new Error('payload');
+        const name = decoder.decode(bytes.subarray(offset, offset + length)).replaceAll('\\', '/'); offset += length;
+        if (/[\x00-\x1f]/.test(name) || path.posix.isAbsolute(name) || name.includes(':') || name.split('/').includes('..')) throw new Error('payload_path');
+        const size = bytes.readUInt32BE(offset); offset += 4;
+        if (size < 1 || offset + size + 32 > bytes.length) throw new Error('payload');
+        const data = bytes.subarray(offset, offset + size); offset += size;
+        const md5 = bytes.subarray(offset, offset + 32).toString(); offset += 32;
+        if (!/^[a-f0-9]{32}$/.test(md5)) throw new Error('payload');
+        files.push({ name: path.posix.normalize(name), data, md5 });
+        if (files.length > 5000) throw new Error('payload');
+      }
+      if (files.length !== 104 || !files.some(file => file.name === 'rustdesk.exe')) continue;
+      const suffix = Buffer.from('.\\rustdesk.exe');
+      if (!bytes.subarray(offset + 8, offset + 8 + suffix.length).equals(suffix)) continue;
+      entries = files; break;
+    } catch { /* Non-payload occurrences of the ASCII magic are expected in PE strings. */ }
+  }
+  if (!entries) throw failure('desktop_video_host_payload');
+  const runtime = path.resolve(root, 'runtime');
+  for (const file of entries) {
+    const target = path.resolve(runtime, file.name);
+    if (!target.startsWith(runtime + path.sep)) throw failure('desktop_video_host_path');
+    let existing;
+    try { existing = crypto.createHash('md5').update(fs.readFileSync(target)).digest('hex'); } catch {}
+    if (existing === file.md5) continue;
+    const data = brotliDecompressSync(file.data, { maxOutputLength: 128 * 1024 * 1024 });
+    if (crypto.createHash('md5').update(data).digest('hex') !== file.md5) throw failure('desktop_video_host_payload');
+    fs.mkdirSync(path.dirname(target), { recursive: true }); fs.writeFileSync(target, data);
+  }
+  return path.join(runtime, 'rustdesk.exe');
+}
+
+// A read-only, LAN-only prototype. The normal desktop helper and input path are independent.
+export class RustDeskVideoProbe {
+  constructor({ stateRoot, appData = process.env.APPDATA, platform = process.platform } = {}) {
+    this.platform = platform;
+    this.root = path.join(stateRoot, 'desktop-video-probe');
+    this.configRoot = path.join(appData || os.tmpdir(), 'RustDesk', 'config');
+    this.process = null; this.lease = null; this.timer = null; this.starting = false; this.stopped = Promise.resolve(); this.preparedExecutable = null;
+  }
+  configuration(port, password) {
+    const options = {
+      'direct-server': 'Y', 'direct-access-port': String(port),
+      'custom-rendezvous-server': '127.0.0.1:9', 'relay-server': '127.0.0.1:9', 'api-server': 'http://127.0.0.1:9',
+      'enable-hwcodec': 'N', 'access-mode': 'view', 'approve-mode': 'password', 'verification-method': 'use-permanent-password',
+      'enable-keyboard': 'N', 'enable-clipboard': 'N', 'enable-file-transfer': 'N', 'enable-audio': 'N',
+      'enable-tunnel': 'N', 'enable-terminal': 'N', 'enable-record-session': 'N',
+      'allow-auto-record-incoming': 'N', 'allow-auto-record-outgoing': 'N'
+    };
+    return {
+      main: `password = '${password}'\nsalt = '${crypto.randomBytes(16).toString('hex')}'\n`,
+      secondary: "rendezvous_server = '127.0.0.1:9'\n\n[options]\n" + Object.entries(options).map(([key, value]) => `${key} = '${value}'`).join('\n') + '\n'
+    };
+  }
+  async begin() {
+    if (this.platform !== 'win32') throw failure('desktop_video_platform');
+    if (this.starting || this.lease) throw failure('desktop_video_busy');
+    this.starting = true;
+    try {
+      await this.stopped;
+      const executable = path.join(this.root, 'rustdesk-1.5.0-x86_64.exe');
+      let binary;
+      try { binary = fs.readFileSync(executable); } catch { throw failure('desktop_video_host_missing'); }
+      if (crypto.createHash('sha256').update(binary).digest('hex') !== RUSTDESK_PROBE_HOST_SHA256) throw failure('desktop_video_host_hash');
+      const ownerFile = path.join(this.root, 'config-owner.json');
+      let owner;
+      try { owner = JSON.parse(fs.readFileSync(ownerFile, 'utf8')); } catch {}
+      const entries = fs.existsSync(this.configRoot) ? fs.readdirSync(this.configRoot) : [];
+      if (entries.length && (owner?.configRoot !== this.configRoot || !owner.hashes
+        || JSON.stringify(owner.hashes) !== JSON.stringify(this.configHashes()))) throw failure('desktop_video_existing_rustdesk');
+      const port = await new Promise((resolve, reject) => {
+        const server = net.createServer(); server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => { const port = server.address().port; server.close(error => error ? reject(error) : resolve(port)); });
+      });
+      const actualExecutable = this.preparedExecutable ||= prepareRustDeskProbeHost(this.root);
+      const password = crypto.randomBytes(24).toString('hex'), leaseId = crypto.randomBytes(16).toString('hex');
+      const config = this.configuration(port, password);
+      fs.mkdirSync(this.root, { recursive: true, mode: 0o700 });
+      fs.mkdirSync(this.configRoot, { recursive: true, mode: 0o700 });
+      fs.writeFileSync(path.join(this.configRoot, 'RustDesk.toml'), config.main, { mode: 0o600 });
+      fs.writeFileSync(path.join(this.configRoot, 'RustDesk2.toml'), config.secondary, { mode: 0o600 });
+      this.saveOwner();
+      this.process = spawn(actualExecutable, ['--server'], { cwd: path.dirname(actualExecutable),
+        env: { ...process.env, RUSTDESK_APPNAME: 'rustdesk-1.5.0-x86_64.exe' }, windowsHide: true, stdio: 'ignore' });
+      const child = this.process; let launchError = false;
+      console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'spawn', pid: child.pid }));
+      this.stopped = new Promise(resolve => {
+        let ended = false;
+        const finished = () => {
+          console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'exit', pid: child.pid, code: child.exitCode }));
+          if (ended) return; ended = true;
+          try { this.saveOwner(); } catch { console.error(JSON.stringify({ event: 'desktop-video-owner', state: 'failed' })); }
+          if (this.process === child) { clearTimeout(this.timer); this.process = null; this.lease = null; }
+          resolve();
+        };
+        child.once('error', () => { launchError = true; finished(); });
+        child.once('exit', finished);
+      });
+      const deadline = Date.now() + 8_000;
+      let ready = false;
+      while (Date.now() < deadline && child.exitCode === null && !launchError) {
+        ready = await new Promise(resolve => {
+          const socket = net.connect({ host: '127.0.0.1', port });
+          let settled = false;
+          const finish = value => { if (settled) return; settled = true; socket.destroy(); resolve(value); };
+          socket.once('connect', () => finish(true)); socket.once('error', () => finish(false)); socket.setTimeout(300, () => finish(false));
+        });
+        if (ready) break;
+        await pause(150);
+      }
+      if (!ready) throw failure('desktop_video_host_start');
+      this.lease = { leaseId, password, port, codec: 'vp9', fps: 5, viewOnly: true };
+      console.info(JSON.stringify({ event: 'desktop-video-host', stage: 'ready', pid: child.pid }));
+      this.renew(leaseId);
+      return { ...this.lease, engine: 'rustdesk-probe', expiresInMs: leaseMs };
+    } catch (error) { this.stop(); throw error; }
+    finally { this.starting = false; }
+  }
+  configHashes() {
+    return ['RustDesk.toml', 'RustDesk2.toml'].map(name => {
+      try { return crypto.createHash('sha256').update(fs.readFileSync(path.join(this.configRoot, name))).digest('hex'); }
+      catch { return ''; }
+    });
+  }
+  saveOwner() {
+    fs.writeFileSync(path.join(this.root, 'config-owner.json'), JSON.stringify({ configRoot: this.configRoot, hashes: this.configHashes() }), { mode: 0o600 });
+  }
+  renew(leaseId) {
+    if (!this.lease || leaseId !== this.lease.leaseId) throw failure('desktop_video_lease');
+    clearTimeout(this.timer); this.timer = setTimeout(() => this.stop(), leaseMs); this.timer.unref();
+    return { active: true, expiresInMs: leaseMs };
+  }
+  release(leaseId) {
+    if (this.lease?.leaseId === leaseId) this.stop();
+    return { released: true };
+  }
+  stop() {
+    clearTimeout(this.timer); this.timer = null;
+    const child = this.process; this.process = null; this.lease = null;
+    if (child && child.exitCode === null) child.kill();
+  }
 }

package/dist/src/platform/windows/start-hidden-console.ps1

@@ -1,58 +1,58 @@
-$ErrorActionPreference = 'Stop'
-[Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false)
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-$brokerStarted = $false
-try {
-    $spec = [Console]::In.ReadToEnd() | ConvertFrom-Json
-    # WMI owns this launch, not the caller's kill-on-close Desktop job hierarchy.
-    $instance = [Guid]::NewGuid().ToString()
-    $launchRoot = [IO.Path]::GetFullPath((Join-Path $env:LOCALAPPDATA 'CodexRemote\process-launch'))
-    New-Item -ItemType Directory -Path $launchRoot -Force | Out-Null
-    Add-Type -Path (Join-Path $PSScriptRoot 'IsolatedProcess.cs')
-    $launchRoot = [IsolatedProcess]::ResolvePath($launchRoot)
-    $ready = Join-Path $launchRoot ($instance + '.json')
-    $request = Join-Path $launchRoot ($instance + '.request.json')
-    $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
-    $spec | Add-Member -NotePropertyName instance -NotePropertyValue $instance
-    $requestTemporary = $request + '.tmp'
-    [IO.File]::WriteAllText($requestTemporary, ($spec | ConvertTo-Json -Compress -Depth 10), (New-Object Text.UTF8Encoding($false)))
-    [IO.File]::Move($requestTemporary, $request)
-    # MSIX can redirect a newly written file even when its existing parent
-    # resolves outside the package. Resolve the file handle, not just the folder.
-    $request = [IsolatedProcess]::ResolvePath($request)
-    $launchRoot = [IO.Path]::GetDirectoryName($request)
-    $ready = Join-Path $launchRoot ($instance + '.json')
-    $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
-    $startup = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
-        ShowWindow=[uint16]0; CreateFlags=[uint32]0x1000010
-    }
-    $worker = Join-Path $PSScriptRoot 'launch-worker.mjs'
-    $command = '"' + [string]$spec.brokerExecutable + '" "' + $worker + '" "' + $request + '" "' + $ready + '" "' + $instance + '" "' + $diagnostic + '"'
-    $broker = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
-        CommandLine=$command; CurrentDirectory=$env:USERPROFILE; ProcessStartupInformation=$startup
-    }
-    if ($broker.ReturnValue -ne 0) { throw ('Windows process broker failed: ' + $broker.ReturnValue) }
-    $brokerStarted = $true
-    $deadline = [DateTime]::UtcNow.AddSeconds(30)
-    while (-not (Test-Path -LiteralPath $ready)) {
-        if ([DateTime]::UtcNow -gt $deadline) {
-            $detail = if (Test-Path -LiteralPath $diagnostic) { (Get-Content -LiteralPath $diagnostic -Raw -Encoding UTF8).Trim() } else { 'broker did not create a diagnostic log' }
-            throw ('Windows process broker handoff timed out (broker PID ' + $broker.ProcessId + '): ' + $detail)
-        }
-        Start-Sleep -Milliseconds 50
-    }
-    $result = Get-Content -LiteralPath $ready -Raw -Encoding UTF8 | ConvertFrom-Json
-    Remove-Item -LiteralPath $ready
-    if ($result.instance -ne $instance -or $result.brokerPid -ne $broker.ProcessId) { throw 'Windows process broker identity mismatch.' }
-    if ($result.error) { throw [string]$result.error }
-    if (Test-Path -LiteralPath $diagnostic) { Remove-Item -LiteralPath $diagnostic -Force }
-    [Console]::WriteLine([int]$result.pid)
-} catch {
-    [Console]::Error.WriteLine($_.Exception.Message)
-    exit 1
-} finally {
-    # Once launched, the worker owns consumption. A slow broker must not lose
-    # its request merely because this caller timed out; never launch a retry.
-    if (-not $brokerStarted -and $request -and (Test-Path -LiteralPath $request)) { Remove-Item -LiteralPath $request -Force }
-    if ($requestTemporary -and (Test-Path -LiteralPath $requestTemporary)) { Remove-Item -LiteralPath $requestTemporary -Force }
-}
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false)
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$brokerStarted = $false
+try {
+    $spec = [Console]::In.ReadToEnd() | ConvertFrom-Json
+    # WMI owns this launch, not the caller's kill-on-close Desktop job hierarchy.
+    $instance = [Guid]::NewGuid().ToString()
+    $launchRoot = [IO.Path]::GetFullPath((Join-Path $env:LOCALAPPDATA 'CodexRemote\process-launch'))
+    New-Item -ItemType Directory -Path $launchRoot -Force | Out-Null
+    Add-Type -Path (Join-Path $PSScriptRoot 'IsolatedProcess.cs')
+    $launchRoot = [IsolatedProcess]::ResolvePath($launchRoot)
+    $ready = Join-Path $launchRoot ($instance + '.json')
+    $request = Join-Path $launchRoot ($instance + '.request.json')
+    $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
+    $spec | Add-Member -NotePropertyName instance -NotePropertyValue $instance
+    $requestTemporary = $request + '.tmp'
+    [IO.File]::WriteAllText($requestTemporary, ($spec | ConvertTo-Json -Compress -Depth 10), (New-Object Text.UTF8Encoding($false)))
+    [IO.File]::Move($requestTemporary, $request)
+    # MSIX can redirect a newly written file even when its existing parent
+    # resolves outside the package. Resolve the file handle, not just the folder.
+    $request = [IsolatedProcess]::ResolvePath($request)
+    $launchRoot = [IO.Path]::GetDirectoryName($request)
+    $ready = Join-Path $launchRoot ($instance + '.json')
+    $diagnostic = Join-Path $launchRoot ($instance + '.broker.log')
+    $startup = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
+        ShowWindow=[uint16]0; CreateFlags=[uint32]0x1000010
+    }
+    $worker = Join-Path $PSScriptRoot 'launch-worker.mjs'
+    $command = '"' + [string]$spec.brokerExecutable + '" "' + $worker + '" "' + $request + '" "' + $ready + '" "' + $instance + '" "' + $diagnostic + '"'
+    $broker = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
+        CommandLine=$command; CurrentDirectory=$env:USERPROFILE; ProcessStartupInformation=$startup
+    }
+    if ($broker.ReturnValue -ne 0) { throw ('Windows process broker failed: ' + $broker.ReturnValue) }
+    $brokerStarted = $true
+    $deadline = [DateTime]::UtcNow.AddSeconds(30)
+    while (-not (Test-Path -LiteralPath $ready)) {
+        if ([DateTime]::UtcNow -gt $deadline) {
+            $detail = if (Test-Path -LiteralPath $diagnostic) { (Get-Content -LiteralPath $diagnostic -Raw -Encoding UTF8).Trim() } else { 'broker did not create a diagnostic log' }
+            throw ('Windows process broker handoff timed out (broker PID ' + $broker.ProcessId + '): ' + $detail)
+        }
+        Start-Sleep -Milliseconds 50
+    }
+    $result = Get-Content -LiteralPath $ready -Raw -Encoding UTF8 | ConvertFrom-Json
+    Remove-Item -LiteralPath $ready
+    if ($result.instance -ne $instance -or $result.brokerPid -ne $broker.ProcessId) { throw 'Windows process broker identity mismatch.' }
+    if ($result.error) { throw [string]$result.error }
+    if (Test-Path -LiteralPath $diagnostic) { Remove-Item -LiteralPath $diagnostic -Force }
+    [Console]::WriteLine([int]$result.pid)
+} catch {
+    [Console]::Error.WriteLine($_.Exception.Message)
+    exit 1
+} finally {
+    # Once launched, the worker owns consumption. A slow broker must not lose
+    # its request merely because this caller timed out; never launch a retry.
+    if (-not $brokerStarted -and $request -and (Test-Path -LiteralPath $request)) { Remove-Item -LiteralPath $request -Force }
+    if ($requestTemporary -and (Test-Path -LiteralPath $requestTemporary)) { Remove-Item -LiteralPath $requestTemporary -Force }
+}

package/dist/src/platform/windows/stop-desktop.ps1

@@ -1,22 +1,22 @@
-param([Parameter(Mandatory=$true)][string]$Executable)
-$ErrorActionPreference = 'Stop'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
-if (-not $package -or $Executable -ne (Join-Path $package.InstallLocation 'app/ChatGPT.exe')) {
-    throw 'Desktop executable identity changed; recovery stopped.'
-}
-# Never kill another user's Desktop or an app-server process tree. The independent
-# installer/recovery worker must survive and relaunch only in this interactive session.
-$currentSessionId = (Get-Process -Id $PID -ErrorAction Stop).SessionId
-$workers = @(Get-CimInstance Win32_Process -Filter "Name='ChatGPT.exe'" | Where-Object {
-    $_.ExecutablePath -eq $Executable -and $_.SessionId -eq $currentSessionId
-})
-foreach ($worker in $workers) {
-    $actual = Get-CimInstance Win32_Process -Filter "ProcessId=$($worker.ProcessId)"
-    if ($actual -and $actual.ExecutablePath -eq $worker.ExecutablePath -and $actual.CreationDate -eq $worker.CreationDate) {
-        Stop-Process -Id $worker.ProcessId -Force -ErrorAction Stop
-    }
-}
-if (Get-Process ChatGPT -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $Executable -and $_.SessionId -eq $currentSessionId }) {
-    throw 'Desktop did not exit; recovery stopped.'
-}
+param([Parameter(Mandatory=$true)][string]$Executable)
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
+if (-not $package -or $Executable -ne (Join-Path $package.InstallLocation 'app/ChatGPT.exe')) {
+    throw 'Desktop executable identity changed; recovery stopped.'
+}
+# Never kill another user's Desktop or an app-server process tree. The independent
+# installer/recovery worker must survive and relaunch only in this interactive session.
+$currentSessionId = (Get-Process -Id $PID -ErrorAction Stop).SessionId
+$workers = @(Get-CimInstance Win32_Process -Filter "Name='ChatGPT.exe'" | Where-Object {
+    $_.ExecutablePath -eq $Executable -and $_.SessionId -eq $currentSessionId
+})
+foreach ($worker in $workers) {
+    $actual = Get-CimInstance Win32_Process -Filter "ProcessId=$($worker.ProcessId)"
+    if ($actual -and $actual.ExecutablePath -eq $worker.ExecutablePath -and $actual.CreationDate -eq $worker.CreationDate) {
+        Stop-Process -Id $worker.ProcessId -Force -ErrorAction Stop
+    }
+}
+if (Get-Process ChatGPT -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $Executable -and $_.SessionId -eq $currentSessionId }) {
+    throw 'Desktop did not exit; recovery stopped.'
+}

package/dist/src/platform/windows/user-environment.ps1

@@ -1,41 +1,41 @@
-param(
-    [ValidateSet('Read', 'Set', 'Clear')][string]$Action = 'Read',
-    [string]$Value = ''
-)
-$ErrorActionPreference = 'Stop'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-$name = 'CODEX_APP_SERVER_WS_URL'
-
-function Broadcast-EnvironmentChange {
-    if (-not ('CodeRelax.EnvironmentBroadcast' -as [type])) {
-        Add-Type -Namespace CodeRelax -Name EnvironmentBroadcast -MemberDefinition @'
-[System.Runtime.InteropServices.DllImport("user32.dll", CharSet=System.Runtime.InteropServices.CharSet.Unicode, SetLastError=true)]
-public static extern System.IntPtr SendMessageTimeout(
-    System.IntPtr hWnd, uint Msg, System.UIntPtr wParam, string lParam,
-    uint flags, uint timeout, out System.UIntPtr result);
-'@
-    }
-    [UIntPtr]$result = [UIntPtr]::Zero
-    [void][CodeRelax.EnvironmentBroadcast]::SendMessageTimeout(
-        [IntPtr]0xffff, 0x001A, [UIntPtr]::Zero, 'Environment', 0x0002, 5000, [ref]$result)
-}
-
-if ($Action -eq 'Set') {
-    if ([string]::IsNullOrWhiteSpace($Value)) { throw 'Environment value is required.' }
-    [Environment]::SetEnvironmentVariable($name, $Value, 'User')
-    Broadcast-EnvironmentChange
-} elseif ($Action -eq 'Clear') {
-    [Environment]::SetEnvironmentVariable($name, $null, 'User')
-    Broadcast-EnvironmentChange
-}
-
-$userValue = [Environment]::GetEnvironmentVariable($name, 'User')
-$result = @{
-    userValue = $userValue
-    machineValue = [Environment]::GetEnvironmentVariable($name, 'Machine')
-    forceCliUser = [Environment]::GetEnvironmentVariable('CODEX_APP_SERVER_FORCE_CLI', 'User')
-    forceCliMachine = [Environment]::GetEnvironmentVariable('CODEX_APP_SERVER_FORCE_CLI', 'Machine')
-}
-if ($Action -eq 'Set' -and $userValue -ne $Value) { throw 'Environment value verification failed.' }
-if ($Action -eq 'Clear' -and -not [string]::IsNullOrEmpty($userValue)) { throw 'Environment removal verification failed.' }
-$result | ConvertTo-Json -Compress
+param(
+    [ValidateSet('Read', 'Set', 'Clear')][string]$Action = 'Read',
+    [string]$Value = ''
+)
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$name = 'CODEX_APP_SERVER_WS_URL'
+
+function Broadcast-EnvironmentChange {
+    if (-not ('CodeRelax.EnvironmentBroadcast' -as [type])) {
+        Add-Type -Namespace CodeRelax -Name EnvironmentBroadcast -MemberDefinition @'
+[System.Runtime.InteropServices.DllImport("user32.dll", CharSet=System.Runtime.InteropServices.CharSet.Unicode, SetLastError=true)]
+public static extern System.IntPtr SendMessageTimeout(
+    System.IntPtr hWnd, uint Msg, System.UIntPtr wParam, string lParam,
+    uint flags, uint timeout, out System.UIntPtr result);
+'@
+    }
+    [UIntPtr]$result = [UIntPtr]::Zero
+    [void][CodeRelax.EnvironmentBroadcast]::SendMessageTimeout(
+        [IntPtr]0xffff, 0x001A, [UIntPtr]::Zero, 'Environment', 0x0002, 5000, [ref]$result)
+}
+
+if ($Action -eq 'Set') {
+    if ([string]::IsNullOrWhiteSpace($Value)) { throw 'Environment value is required.' }
+    [Environment]::SetEnvironmentVariable($name, $Value, 'User')
+    Broadcast-EnvironmentChange
+} elseif ($Action -eq 'Clear') {
+    [Environment]::SetEnvironmentVariable($name, $null, 'User')
+    Broadcast-EnvironmentChange
+}
+
+$userValue = [Environment]::GetEnvironmentVariable($name, 'User')
+$result = @{
+    userValue = $userValue
+    machineValue = [Environment]::GetEnvironmentVariable($name, 'Machine')
+    forceCliUser = [Environment]::GetEnvironmentVariable('CODEX_APP_SERVER_FORCE_CLI', 'User')
+    forceCliMachine = [Environment]::GetEnvironmentVariable('CODEX_APP_SERVER_FORCE_CLI', 'Machine')
+}
+if ($Action -eq 'Set' -and $userValue -ne $Value) { throw 'Environment value verification failed.' }
+if ($Action -eq 'Clear' -and -not [string]::IsNullOrEmpty($userValue)) { throw 'Environment removal verification failed.' }
+$result | ConvertTo-Json -Compress