ccem 2.26.0 → 2.28.0

package/dist/index.js

@@ -7,8 +7,8 @@ import inquirer from "inquirer";
 import chalk7 from "chalk";
 import Table3 from "cli-table3";
 import { spawn as spawn3 } from "child_process";
-import * as fs10 from "fs";
-import * as path8 from "path";
+import * as fs11 from "fs";
+import * as path9 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../packages/core/dist/chunk-DFS6BUXP.js
@@ -400,24 +400,57 @@ import crypto from "crypto";
 import fs from "fs";
 import os from "os";
 import path from "path";
-var ALGORITHM = "aes-256-cbc";
-var SECRET_KEY = crypto.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var LEGACY_ALGORITHM = "aes-256-cbc";
+var LEGACY_KEY = crypto.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var V2_ALGORITHM = "aes-256-gcm";
+var _installKey = null;
+function getOrCreateInstallKey() {
+  if (_installKey) return _installKey;
+  const keyPath = path.join(getCcemConfigDir(), ".install-key");
+  if (fs.existsSync(keyPath)) {
+    _installKey = Buffer.from(fs.readFileSync(keyPath, "utf-8").trim(), "hex");
+    return _installKey;
+  }
+  ensureCcemDir();
+  _installKey = crypto.randomBytes(32);
+  fs.writeFileSync(keyPath, _installKey.toString("hex"), { mode: 384 });
+  return _installKey;
+}
 var encrypt = (text) => {
   if (!text) return text;
-  const iv = crypto.randomBytes(16);
-  const cipher = crypto.createCipheriv(ALGORITHM, SECRET_KEY, iv);
+  const key = getOrCreateInstallKey();
+  const nonce = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv(V2_ALGORITHM, key, nonce);
   let encrypted = cipher.update(text, "utf8", "hex");
   encrypted += cipher.final("hex");
-  return `enc:${iv.toString("hex")}:${encrypted}`;
+  const tag = cipher.getAuthTag();
+  return `enc:v2:${nonce.toString("hex")}:${encrypted}:${tag.toString("hex")}`;
 };
 var decrypt = (text) => {
   if (!text || !text.startsWith("enc:")) return text;
+  if (text.startsWith("enc:v2:")) {
+    const parts = text.split(":");
+    if (parts.length !== 5) return text;
+    try {
+      const key = getOrCreateInstallKey();
+      const nonce = Buffer.from(parts[2], "hex");
+      const ciphertext = parts[3];
+      const tag = Buffer.from(parts[4], "hex");
+      const decipher = crypto.createDecipheriv(V2_ALGORITHM, key, nonce);
+      decipher.setAuthTag(tag);
+      let decrypted = decipher.update(ciphertext, "hex", "utf8");
+      decrypted += decipher.final("utf8");
+      return decrypted;
+    } catch {
+      throw new Error("Failed to decrypt enc:v2: data (tampered or wrong install key)");
+    }
+  }
   try {
     const parts = text.split(":");
     if (parts.length !== 3) return text;
     const iv = Buffer.from(parts[1], "hex");
     const encryptedText = parts[2];
-    const decipher = crypto.createDecipheriv(ALGORITHM, SECRET_KEY, iv);
+    const decipher = crypto.createDecipheriv(LEGACY_ALGORITHM, LEGACY_KEY, iv);
     let decrypted = decipher.update(encryptedText, "hex", "utf8");
     decrypted += decipher.final("utf8");
     return decrypted;
@@ -946,10 +979,10 @@ var renderLogoWithEnvPanel = (envName, env, defaultMode) => {
       const parsed = new URL(url);
       const protocol = parsed.protocol + "//";
       const host = parsed.host;
-      const path9 = parsed.pathname + parsed.search;
+      const path10 = parsed.pathname + parsed.search;
       const hostStart = host.slice(0, 8);
       const hostEnd = host.slice(-4);
-      const pathPart = path9.length > 10 ? path9.slice(0, 7) + "..." : path9;
+      const pathPart = path10.length > 10 ? path10.slice(0, 7) + "..." : path10;
       return `${protocol}${hostStart}...${hostEnd}${pathPart}`;
     } catch {
       return truncate(url, max);
@@ -1396,7 +1429,7 @@ import crypto2 from "crypto";
 import fs3 from "fs";
 import os3 from "os";
 import path3 from "path";
-var SECRET_KEY2 = crypto2.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var SECRET_KEY = crypto2.scryptSync("claude-code-env-manager-secret", "salt", 32);
 var findProjectRoot = () => {
   let currentDir = process.cwd();
   const root = path3.parse(currentDir).root;
@@ -2691,13 +2724,17 @@ var getUniqueName = (baseName, existingNames) => {
   }
   return newName;
 };
-var loadFromRemote = async (url, secret) => {
+var loadFromRemote = async (url, key, secret) => {
   console.log(chalk6.gray("Fetching from remote..."));
+  const headerKey = key || secret;
+  if (!key) {
+    console.log(chalk6.yellow("Warning: --key not provided; using --secret for authentication (deprecated). Use --key <access-key> --secret <encryption-secret>."));
+  }
   let response;
   try {
     response = await fetch(url, {
       headers: {
-        "X-CCEM-Key": secret
+        "X-CCEM-Key": headerKey
       }
     });
   } catch (err) {
@@ -3003,6 +3040,27 @@ function parseStringList(value) {
   }
   return trimmed.split(",").map((item) => item.trim()).filter(Boolean);
 }
+function normalizeWecomNotification(value) {
+  if (!value) {
+    return null;
+  }
+  return {
+    botId: value.botId?.trim() || null,
+    peerId: value.peerId?.trim() || null,
+    enabled: value.enabled ?? true
+  };
+}
+function parseWecomNotification(value) {
+  if (typeof value !== "object" || value === null) {
+    return null;
+  }
+  const record = value;
+  return {
+    botId: typeof record.botId === "string" ? record.botId : typeof record.bot_id === "string" ? record.bot_id : null,
+    peerId: typeof record.peerId === "string" ? record.peerId : typeof record.peer_id === "string" ? record.peer_id : null,
+    enabled: typeof record.enabled === "boolean" ? record.enabled : true
+  };
+}
 function createCronTask(input, tasksPath = getCronTasksPath()) {
   const name = input.name?.trim();
   if (!name) {
@@ -3040,6 +3098,7 @@ function createCronTask(input, tasksPath = getCronTasksPath()) {
     enabled: input.enabled ?? true,
     timeoutSecs,
     templateId: input.templateId?.trim() || null,
+    wecomNotification: normalizeWecomNotification(input.wecomNotification),
     triggerType: "schedule",
     parentTaskId: null,
     createdAt: now,
@@ -3078,6 +3137,7 @@ function resolveJsonInput(raw) {
 }
 function parseCronCreateJson(raw) {
   const parsed = JSON.parse(resolveJsonInput(raw));
+  const wecomNotification = parsed.wecomNotification ?? parsed.wecom_notification;
   return {
     name: String(parsed.name ?? ""),
     cronExpression: String(parsed.cronExpression ?? parsed.schedule ?? ""),
@@ -3090,7 +3150,8 @@ function parseCronCreateJson(raw) {
     disallowedTools: Array.isArray(parsed.disallowedTools) ? parsed.disallowedTools.map(String) : null,
     enabled: typeof parsed.enabled === "boolean" ? parsed.enabled : null,
     timeoutSecs: typeof parsed.timeoutSecs === "number" ? parsed.timeoutSecs : null,
-    templateId: typeof parsed.templateId === "string" ? parsed.templateId : null
+    templateId: typeof parsed.templateId === "string" ? parsed.templateId : null,
+    wecomNotification: parseWecomNotification(wecomNotification)
   };
 }
 function formatCronTaskTableRows(tasks) {
@@ -3104,11 +3165,61 @@ function formatCronTaskTableRows(tasks) {
   ]);
 }
 
+// src/desktopControl.ts
+import fs10 from "fs";
+import path8 from "path";
+function getDesktopControlDescriptorPath() {
+  return process.env.CCEM_CONTROL_FILE?.trim() || path8.join(getCcemConfigDir(), "control.json");
+}
+function resolveDesktopControlDescriptor(descriptorPath = getDesktopControlDescriptorPath()) {
+  if (!fs10.existsSync(descriptorPath)) {
+    throw new Error(`CCEM Desktop control endpoint not found at ${descriptorPath}. Start CCEM Desktop first.`);
+  }
+  const parsed = JSON.parse(fs10.readFileSync(descriptorPath, "utf-8"));
+  const endpoint = parsed.endpoint?.trim();
+  const token = parsed.token?.trim();
+  if (!endpoint || !token) {
+    throw new Error(`Invalid CCEM Desktop control descriptor at ${descriptorPath}`);
+  }
+  return {
+    endpoint,
+    token,
+    pid: typeof parsed.pid === "number" ? parsed.pid : null
+  };
+}
+async function requestDesktopControl(method, params, descriptor = resolveDesktopControlDescriptor()) {
+  const id = `ccem-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const response = await fetch(descriptor.endpoint, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${descriptor.token}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id,
+      method,
+      params: params ?? {}
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`CCEM Desktop control request failed: HTTP ${response.status}`);
+  }
+  const payload = await response.json();
+  if (payload.error) {
+    throw new Error(payload.error.message || `CCEM Desktop control error ${payload.error.code ?? ""}`.trim());
+  }
+  return payload.result;
+}
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+
 // src/index.ts
 var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = path8.dirname(__filename2);
-var pkgPath = path8.resolve(__dirname2, "..", "package.json");
-var pkg = JSON.parse(fs10.readFileSync(pkgPath, "utf-8"));
+var __dirname2 = path9.dirname(__filename2);
+var pkgPath = path9.resolve(__dirname2, "..", "package.json");
+var pkg = JSON.parse(fs11.readFileSync(pkgPath, "utf-8"));
 var program = new Command();
 var DEFAULT_OFFICIAL_ENV = {
   ANTHROPIC_BASE_URL: "https://api.anthropic.com",
@@ -3164,6 +3275,29 @@ var config2 = new Conf2({
     defaultMode: null
   }
 });
+function outputDesktopResult(value, options) {
+  if (options.json) {
+    printJson(value);
+    return;
+  }
+  console.log(JSON.stringify(value, null, 2));
+}
+function parseOptionalBoolean(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value === "boolean") {
+    return value;
+  }
+  const normalized = String(value).trim().toLowerCase();
+  if (["1", "true", "yes", "y"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "n"].includes(normalized)) {
+    return false;
+  }
+  return void 0;
+}
 var recoverRegistriesFromLegacy = (registries) => {
   const currentAuthCount = Object.values(registries).filter(
     (env) => Boolean(env.ANTHROPIC_AUTH_TOKEN)
@@ -3172,11 +3306,11 @@ var recoverRegistriesFromLegacy = (registries) => {
     return registries;
   }
   const legacyConfigPath = getLegacyConfigPath();
-  if (!fs10.existsSync(legacyConfigPath)) {
+  if (!fs11.existsSync(legacyConfigPath)) {
     return registries;
   }
   try {
-    const legacyRaw = JSON.parse(fs10.readFileSync(legacyConfigPath, "utf-8"));
+    const legacyRaw = JSON.parse(fs11.readFileSync(legacyConfigPath, "utf-8"));
     const legacyRegistries = legacyRaw.registries ?? {};
     let changed = false;
     const recovered = { ...registries };
@@ -3370,15 +3504,15 @@ var switchEnvironment = async (name) => {
     exportCmds.forEach((cmd) => console.log(cmd));
   }
 };
-var getSessionsFilePath = () => path8.join(getCcemConfigDir(), "sessions.json");
-var getRuntimeStateFilePath = () => path8.join(getCcemConfigDir(), "runtime-state.json");
-var getBotBindRequestFilePath = () => path8.join(getCcemConfigDir(), "bot-bind-requests.jsonl");
+var getSessionsFilePath = () => path9.join(getCcemConfigDir(), "sessions.json");
+var getRuntimeStateFilePath = () => path9.join(getCcemConfigDir(), "runtime-state.json");
+var getBotBindRequestFilePath = () => path9.join(getCcemConfigDir(), "bot-bind-requests.jsonl");
 var parseJsonFile = (filePath) => {
-  if (!fs10.existsSync(filePath)) {
+  if (!fs11.existsSync(filePath)) {
     return null;
   }
   try {
-    return JSON.parse(fs10.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs11.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -3470,8 +3604,8 @@ var resolveBotBindRuntimeId = (explicitRuntimeId) => {
 };
 var appendBotBindRequest = (payload) => {
   const requestPath = getBotBindRequestFilePath();
-  fs10.mkdirSync(path8.dirname(requestPath), { recursive: true });
-  fs10.appendFileSync(requestPath, `${JSON.stringify(payload)}
+  fs11.mkdirSync(path9.dirname(requestPath), { recursive: true });
+  fs11.appendFileSync(requestPath, `${JSON.stringify(payload)}
 `, "utf-8");
   return requestPath;
 };
@@ -3745,7 +3879,7 @@ cronCmd.command("list").description("List CCEM cron tasks").option("--json", "Ou
     process.exitCode = 1;
   }
 });
-cronCmd.command("create").description("Create a CCEM cron task").option("--from-json <json>", "Read task input from inline JSON, @file, or - for stdin").option("--name <name>", "Task name").option("--cron-expression <expr>", "5-field cron expression").option("--schedule <expr>", "Alias for --cron-expression").option("--prompt <prompt>", "Prompt to run when the task fires").option("--working-dir <dir>", "Task working directory").option("--env-name <name>", "CCEM environment name").option("--execution-profile <profile>", "conservative, standard, or autonomous").option("--max-budget-usd <amount>", "Optional max budget in USD").option("--allowed-tools <items>", "Comma-separated or JSON array of allowed tools").option("--disallowed-tools <items>", "Comma-separated or JSON array of disallowed tools").option("--timeout-secs <seconds>", "Task timeout in seconds").option("--template-id <id>", "Optional template id").option("--disabled", "Create task disabled").option("--json", "Output as JSON").action((options) => {
+cronCmd.command("create").description("Create a CCEM cron task").option("--from-json <json>", "Read task input from inline JSON, @file, or - for stdin").option("--name <name>", "Task name").option("--cron-expression <expr>", "5-field cron expression").option("--schedule <expr>", "Alias for --cron-expression").option("--prompt <prompt>", "Prompt to run when the task fires").option("--working-dir <dir>", "Task working directory").option("--env-name <name>", "CCEM environment name").option("--execution-profile <profile>", "conservative, standard, or autonomous").option("--max-budget-usd <amount>", "Optional max budget in USD").option("--allowed-tools <items>", "Comma-separated or JSON array of allowed tools").option("--disallowed-tools <items>", "Comma-separated or JSON array of disallowed tools").option("--timeout-secs <seconds>", "Task timeout in seconds").option("--template-id <id>", "Optional template id").option("--wecom-result", "Send cron result summary to the configured WeCom default target").option("--wecom-bot-id <id>", "WeCom bot id for cron result notifications").option("--wecom-peer-id <id>", "WeCom peer id for cron result notifications").option("--disabled", "Create task disabled").option("--json", "Output as JSON").action((options) => {
   try {
     const input = options.fromJson ? parseCronCreateJson(options.fromJson) : {
       name: options.name,
@@ -3759,7 +3893,12 @@ cronCmd.command("create").description("Create a CCEM cron task").option("--from-
       disallowedTools: parseStringList(options.disallowedTools),
       enabled: options.disabled ? false : true,
       timeoutSecs: options.timeoutSecs === void 0 ? null : Number(options.timeoutSecs),
-      templateId: options.templateId
+      templateId: options.templateId,
+      wecomNotification: options.wecomResult || options.wecomBotId || options.wecomPeerId ? {
+        botId: options.wecomBotId ?? null,
+        peerId: options.wecomPeerId ?? null,
+        enabled: true
+      } : null
     };
     const task = createCronTask(input);
     if (options.json) {
@@ -3841,12 +3980,12 @@ setupCmd.command("migrate").description("\u8FC1\u79FB\u65E7\u7248\u914D\u7F6E\u5
   const newConfigPath = getCcemConfigPath();
   const legacyConfigPath = getLegacyConfigPath();
   console.log(chalk7.cyan("\n\u{1F504} \u914D\u7F6E\u8FC1\u79FB\n"));
-  if (!fs10.existsSync(legacyConfigPath)) {
+  if (!fs11.existsSync(legacyConfigPath)) {
     console.log(chalk7.yellow("\u672A\u627E\u5230\u65E7\u7248\u914D\u7F6E\u6587\u4EF6"));
     console.log(chalk7.gray(`  \u65E7\u8DEF\u5F84: ${legacyConfigPath}`));
     return;
   }
-  if (fs10.existsSync(newConfigPath) && !options.force) {
+  if (fs11.existsSync(newConfigPath) && !options.force) {
     console.log(chalk7.green("\u2713 \u914D\u7F6E\u5DF2\u5728\u65B0\u8DEF\u5F84"));
     console.log(chalk7.gray(`  \u8DEF\u5F84: ${newConfigPath}`));
     console.log(chalk7.gray("\n\u4F7F\u7528 --force \u5F3A\u5236\u91CD\u65B0\u8FC1\u79FB"));
@@ -3854,15 +3993,15 @@ setupCmd.command("migrate").description("\u8FC1\u79FB\u65E7\u7248\u914D\u7F6E\u5
   }
   try {
     ensureCcemDir();
-    fs10.copyFileSync(legacyConfigPath, newConfigPath);
+    fs11.copyFileSync(legacyConfigPath, newConfigPath);
     console.log(chalk7.green("\u2713 \u914D\u7F6E\u5DF2\u8FC1\u79FB"));
     console.log(chalk7.gray(`  \u4ECE: ${legacyConfigPath}`));
     console.log(chalk7.gray(`  \u5230: ${newConfigPath}`));
     if (options.clean) {
-      fs10.unlinkSync(legacyConfigPath);
-      const legacyDir = path8.dirname(legacyConfigPath);
+      fs11.unlinkSync(legacyConfigPath);
+      const legacyDir = path9.dirname(legacyConfigPath);
       try {
-        fs10.rmdirSync(legacyDir);
+        fs11.rmdirSync(legacyDir);
       } catch {
       }
       console.log(chalk7.green("\u2713 \u5DF2\u5220\u9664\u65E7\u914D\u7F6E\u6587\u4EF6"));
@@ -3873,13 +4012,13 @@ setupCmd.command("migrate").description("\u8FC1\u79FB\u65E7\u7248\u914D\u7F6E\u5
 });
 setupCmd.command("cron").description("\u5B89\u88C5 ccem-cron skill \u5230 Claude Code\uFF08~/.claude/skills/\uFF09").option("--force", "\u5F3A\u5236\u8986\u76D6\u5DF2\u6709\u6587\u4EF6").action(async function() {
   const options = this.opts();
-  const skillDir = path8.join(getHomeDir(), ".claude", "skills");
-  const targetPath = path8.join(skillDir, "ccem-cron.md");
-  if (!fs10.existsSync(skillDir)) {
-    fs10.mkdirSync(skillDir, { recursive: true });
+  const skillDir = path9.join(getHomeDir(), ".claude", "skills");
+  const targetPath = path9.join(skillDir, "ccem-cron.md");
+  if (!fs11.existsSync(skillDir)) {
+    fs11.mkdirSync(skillDir, { recursive: true });
     console.log(chalk7.gray(`\u521B\u5EFA\u76EE\u5F55: ${skillDir}`));
   }
-  if (fs10.existsSync(targetPath) && !options.force) {
+  if (fs11.existsSync(targetPath) && !options.force) {
     const { overwrite } = await inquirer.prompt([
       {
         type: "confirm",
@@ -3893,7 +4032,7 @@ setupCmd.command("cron").description("\u5B89\u88C5 ccem-cron skill \u5230 Claude
       return;
     }
   }
-  fs10.writeFileSync(targetPath, CCEM_CRON_SKILL_CONTENT, "utf-8");
+  fs11.writeFileSync(targetPath, CCEM_CRON_SKILL_CONTENT, "utf-8");
   console.log(chalk7.green(`\u2713 \u5DF2\u5B89\u88C5 ccem-cron skill`));
   console.log(chalk7.gray(`  \u8DEF\u5F84: ${targetPath}`));
   console.log(chalk7.cyan(`
@@ -3901,13 +4040,13 @@ setupCmd.command("cron").description("\u5B89\u88C5 ccem-cron skill \u5230 Claude
 });
 setupCmd.command("bot-bind").description("\u5B89\u88C5 ccem-bot-bind skill \u5230 Claude Code\uFF08~/.claude/skills/\uFF09").option("--force", "\u5F3A\u5236\u8986\u76D6\u5DF2\u6709\u6587\u4EF6").action(async function() {
   const options = this.opts();
-  const skillDir = path8.join(getHomeDir(), ".claude", "skills");
-  const targetPath = path8.join(skillDir, "ccem-bot-bind.md");
-  if (!fs10.existsSync(skillDir)) {
-    fs10.mkdirSync(skillDir, { recursive: true });
+  const skillDir = path9.join(getHomeDir(), ".claude", "skills");
+  const targetPath = path9.join(skillDir, "ccem-bot-bind.md");
+  if (!fs11.existsSync(skillDir)) {
+    fs11.mkdirSync(skillDir, { recursive: true });
     console.log(chalk7.gray(`\u521B\u5EFA\u76EE\u5F55: ${skillDir}`));
   }
-  if (fs10.existsSync(targetPath) && !options.force) {
+  if (fs11.existsSync(targetPath) && !options.force) {
     const { overwrite } = await inquirer.prompt([
       {
         type: "confirm",
@@ -3921,7 +4060,7 @@ setupCmd.command("bot-bind").description("\u5B89\u88C5 ccem-bot-bind skill \u523
       return;
     }
   }
-  fs10.writeFileSync(targetPath, CCEM_BOT_BIND_SKILL_CONTENT, "utf-8");
+  fs11.writeFileSync(targetPath, CCEM_BOT_BIND_SKILL_CONTENT, "utf-8");
   console.log(chalk7.green(`\u2713 \u5DF2\u5B89\u88C5 ccem-bot-bind skill`));
   console.log(chalk7.gray(`  \u8DEF\u5F84: ${targetPath}`));
   console.log(chalk7.cyan(`
@@ -3977,8 +4116,8 @@ skillCmd.command("ls").description("\u5217\u51FA\u5DF2\u5B89\u88C5\u7684 skills"
 skillCmd.command("rm <name>").description("\u5220\u9664\u5DF2\u5B89\u88C5\u7684 skill").action((name) => {
   removeSkill(name);
 });
-program.command("load <url>").description("\u4ECE\u8FDC\u7A0B\u670D\u52A1\u5668\u52A0\u8F7D\u73AF\u5883\u914D\u7F6E").requiredOption("--secret <secret>", "\u89E3\u5BC6\u5BC6\u94A5").option("--json", "\u4EE5 JSON \u683C\u5F0F\u8F93\u51FA\u7ED3\u679C\uFF08\u4F9B\u7A0B\u5E8F\u8C03\u7528\uFF09").action(async (url, options) => {
-  const results = await loadFromRemote(url, options.secret);
+program.command("load <url>").description("\u4ECE\u8FDC\u7A0B\u670D\u52A1\u5668\u52A0\u8F7D\u73AF\u5883\u914D\u7F6E").requiredOption("--secret <secret>", "\u89E3\u5BC6\u5BC6\u94A5\uFF08encryption secret\uFF09").option("--key <key>", "\u8BBF\u95EE\u5BC6\u94A5\uFF08access key\uFF0C\u7528\u4E8E\u8BA4\u8BC1\uFF1B\u4E0D\u586B\u5219\u56DE\u9000\u7528 --secret \u8BA4\u8BC1\uFF09").option("--json", "\u4EE5 JSON \u683C\u5F0F\u8F93\u51FA\u7ED3\u679C\uFF08\u4F9B\u7A0B\u5E8F\u8C03\u7528\uFF09").action(async (url, options) => {
+  const results = await loadFromRemote(url, options.key ?? "", options.secret);
   if (options.json) {
     console.log(JSON.stringify({
       count: results.length,
@@ -4012,6 +4151,68 @@ program.command("launch").description(false).option("--env <name>", "\u73AF\u588
     silent: true
   });
 });
+var desktopCmd = program.command("desktop").description("Control the running CCEM Desktop app");
+desktopCmd.command("health").description("Check the running CCEM Desktop control endpoint").option("--json", "Output JSON").action(async function() {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.health");
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("create").description("Create a workspace session in the running CCEM Desktop app").requiredOption("--provider <provider>", "Agent provider: claude or codex").requiredOption("--cwd <path>", "Working directory").requiredOption("--prompt <text>", "Initial prompt").option("--env <name>", "Environment name").option("--perm <mode>", "Permission mode").option("--runtime-perm <mode>", "Runtime permission mode").option("--provider-session-id <id>", "Provider session id to continue").option("--effort <level>", "Codex effort level").option("--open <value>", "Open the created session in Desktop (true/false)").option("--json", "Output JSON").action(async function() {
+  const opts = this.opts();
+  const provider = String(opts.provider).trim().toLowerCase();
+  if (provider !== "claude" && provider !== "codex") {
+    throw new Error("Unsupported provider. Use 'claude' or 'codex'.");
+  }
+  const result = await requestDesktopControl("ccem.workspace.createSession", {
+    provider,
+    cwd: opts.cwd,
+    prompt: opts.prompt,
+    envName: opts.env ?? null,
+    permissionMode: opts.perm ?? null,
+    runtimePermissionMode: opts.runtimePerm ?? null,
+    providerSessionId: opts.providerSessionId ?? null,
+    effort: opts.effort ?? null,
+    open: parseOptionalBoolean(opts.open)
+  });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("sessions").description("List CCEM Desktop workspace sessions").option("--cwd <path>", "Filter by working directory").option("--provider <provider>", "Filter by provider").option("--status <status>", "Filter by status").option("--json", "Output JSON").action(async function() {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.listSessions", {
+    cwd: opts.cwd ?? null,
+    provider: opts.provider ?? null,
+    status: opts.status ?? null
+  });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("status <runtimeId>").description("Get one CCEM Desktop workspace session").option("--json", "Output JSON").action(async function(runtimeId) {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.getSession", { runtimeId });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("events <runtimeId>").description("Read CCEM Desktop workspace session events").option("--since <seq>", "First event sequence after this value").option("--limit <count>", "Maximum events to return").option("--json", "Output JSON").action(async function(runtimeId) {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.getEvents", {
+    runtimeId,
+    sinceSeq: opts.since ? Number(opts.since) : null,
+    limit: opts.limit ? Number(opts.limit) : null
+  });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("send <runtimeId>").description("Send input to a CCEM Desktop workspace session").requiredOption("--text <text>", "Text to send").option("--display-text <text>", "Text to show in Desktop").option("--json", "Output JSON").action(async function(runtimeId) {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.sendInput", {
+    runtimeId,
+    text: opts.text,
+    displayText: opts.displayText ?? null
+  });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("open <link>").description("Open a ccem:// workspace session link in Desktop").option("--json", "Output JSON").action(async function(link) {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.openSession", { link });
+  outputDesktopResult(result, opts);
+});
 program.command("usage").description("\u663E\u793A\u4F7F\u7528\u7EDF\u8BA1\u5E76\u5237\u65B0\u7F13\u5B58").option("--json", "\u4EE5 JSON \u683C\u5F0F\u8F93\u51FA").action(async function() {
   const opts = this.opts();
   const stats = await getUsageStats();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccem",
-  "version": "2.26.0",
+  "version": "2.28.0",
   "type": "module",
   "description": "Claude Code Environment Manager",
   "repository": {