ccem 2.27.0 → 2.30.0

package/dist/index.js

@@ -7,8 +7,8 @@ import inquirer from "inquirer";
 import chalk7 from "chalk";
 import Table3 from "cli-table3";
 import { spawn as spawn3 } from "child_process";
-import * as fs10 from "fs";
-import * as path8 from "path";
+import * as fs11 from "fs";
+import * as path9 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../packages/core/dist/chunk-DFS6BUXP.js
@@ -979,10 +979,10 @@ var renderLogoWithEnvPanel = (envName, env, defaultMode) => {
       const parsed = new URL(url);
       const protocol = parsed.protocol + "//";
       const host = parsed.host;
-      const path9 = parsed.pathname + parsed.search;
+      const path10 = parsed.pathname + parsed.search;
       const hostStart = host.slice(0, 8);
       const hostEnd = host.slice(-4);
-      const pathPart = path9.length > 10 ? path9.slice(0, 7) + "..." : path9;
+      const pathPart = path10.length > 10 ? path10.slice(0, 7) + "..." : path10;
       return `${protocol}${hostStart}...${hostEnd}${pathPart}`;
     } catch {
       return truncate(url, max);
@@ -2702,16 +2702,70 @@ var config = new Conf({
   cwd: getCcemConfigDir()
   // 使用统一的配置目录
 });
-var decryptWithSecret = (encryptedBase64, secret) => {
-  const key = crypto3.scryptSync(secret, "ccem-salt", 32);
+var REMOTE_CRYPTO_ALGORITHM_V2 = "aes-256-gcm";
+var REMOTE_CRYPTO_ALGORITHM_V1 = "aes-256-cbc";
+var isEnvelopeV2 = (value) => {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return v.v === 2 && typeof v.nonce === "string" && typeof v.ciphertext === "string" && typeof v.tag === "string";
+};
+var deriveRemoteKey = (secret) => crypto3.scryptSync(secret, "ccem-salt", 32);
+var decryptV2Envelope = (envelope, key) => {
+  const nonce = Buffer.from(envelope.nonce, "base64");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  const tag = Buffer.from(envelope.tag, "base64");
+  if (nonce.length === 0 || ciphertext.length === 0 || tag.length === 0) {
+    throw new Error("v2 envelope has empty nonce/ciphertext/tag");
+  }
+  const decipher = crypto3.createDecipheriv(
+    REMOTE_CRYPTO_ALGORITHM_V2,
+    key,
+    nonce
+  );
+  decipher.setAuthTag(tag);
+  let decrypted = decipher.update(ciphertext);
+  decrypted = Buffer.concat([decrypted, decipher.final()]);
+  return decrypted.toString("utf8");
+};
+var decryptV1Legacy = (encryptedBase64, key) => {
   const combined = Buffer.from(encryptedBase64, "base64");
+  if (combined.length < 16) {
+    throw new Error("v1 payload too short");
+  }
   const iv = combined.subarray(0, 16);
   const encryptedHex = combined.subarray(16).toString("hex");
-  const decipher = crypto3.createDecipheriv("aes-256-cbc", key, iv);
+  const decipher = crypto3.createDecipheriv(REMOTE_CRYPTO_ALGORITHM_V1, key, iv);
   let decrypted = decipher.update(encryptedHex, "hex", "utf8");
   decrypted += decipher.final("utf8");
   return decrypted;
 };
+var decryptWithSecret = (encryptedBase64, secret) => {
+  const key = deriveRemoteKey(secret);
+  let parsedObj = null;
+  try {
+    const jsonStr = Buffer.from(encryptedBase64, "base64").toString("utf8");
+    parsedObj = JSON.parse(jsonStr);
+  } catch {
+  }
+  let envelopeV2 = null;
+  if (parsedObj !== null) {
+    if (isEnvelopeV2(parsedObj)) {
+      envelopeV2 = parsedObj;
+    } else if (parsedObj && typeof parsedObj === "object" && "v" in parsedObj) {
+      const version = parsedObj.v;
+      if (version === 2) {
+        throw new Error(
+          "Malformed v2 envelope: missing required fields (nonce, ciphertext, tag)"
+        );
+      }
+      throw new Error(`Unsupported remote envelope version: ${version}`);
+    }
+  }
+  if (envelopeV2) {
+    return decryptV2Envelope(envelopeV2, key);
+  }
+  return decryptV1Legacy(encryptedBase64, key);
+};
 var getUniqueName = (baseName, existingNames) => {
   if (!existingNames.has(baseName)) {
     return baseName;
@@ -3165,11 +3219,271 @@ function formatCronTaskTableRows(tasks) {
   ]);
 }
 
+// src/desktopControl.ts
+import fs10 from "fs";
+import path8 from "path";
+var DEFAULT_REQUEST_TIMEOUT_MS = 5e3;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+var ENDPOINT_UNREACHABLE_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENOTCONN",
+  "EHOSTUNREACH",
+  "ECONNABORTED"
+]);
+var StaleDesktopControlDescriptorError = class extends Error {
+  name = "StaleDesktopControlDescriptorError";
+  reason;
+  descriptorPath;
+  pid;
+  cleanedUp;
+  cause;
+  constructor(details) {
+    const subject = details.pid !== null ? `process ${details.pid}` : "the publishing process";
+    const symptom = details.reason === "dead-pid" ? `${subject} is no longer running` : details.reason === "endpoint-unreachable" ? "the control endpoint refused the connection" : `the control request timed out after ${details.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS}ms`;
+    const remedy = details.cleanedUp ? "The stale descriptor was removed automatically; start CCEM Desktop and rerun the command." : details.pid !== null ? "Restart CCEM Desktop so it republishes a fresh control endpoint." : "Restart CCEM Desktop to refresh the descriptor, or remove the stale file manually if it is no longer managed.";
+    super(
+      `CCEM Desktop control descriptor at ${details.descriptorPath} is stale: ${symptom}. ${remedy}`
+    );
+    this.reason = details.reason;
+    this.descriptorPath = details.descriptorPath;
+    this.pid = details.pid;
+    this.cleanedUp = details.cleanedUp;
+    if (details.cause !== void 0) {
+      this.cause = details.cause;
+    }
+  }
+};
+function getDesktopControlDescriptorPath() {
+  return process.env.CCEM_CONTROL_FILE?.trim() || getDefaultControlDescriptorPath();
+}
+function getDefaultControlDescriptorPath() {
+  return path8.join(getCcemConfigDir(), "control.json");
+}
+function isDefaultDescriptorPath(descriptorPath) {
+  try {
+    return path8.resolve(descriptorPath) === path8.resolve(getDefaultControlDescriptorPath());
+  } catch {
+    return false;
+  }
+}
+function safeRemoveStaleDescriptor(descriptorPath) {
+  if (!isDefaultDescriptorPath(descriptorPath)) {
+    return false;
+  }
+  try {
+    fs10.rmSync(descriptorPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readErrnoCode(error) {
+  if (!error || typeof error !== "object") return void 0;
+  const candidate = error;
+  return candidate.code ?? candidate.cause?.code;
+}
+function readPid(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+}
+function isLoopbackHost(host) {
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (LOOPBACK_HOSTS.has(normalized)) {
+    return true;
+  }
+  if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized)) {
+    return true;
+  }
+  if (normalized === "::1" || normalized === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  return false;
+}
+function extractHost(endpoint) {
+  const withoutScheme = endpoint.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+  const hostPort = withoutScheme.split(/[\/?#]/)[0] || "";
+  if (hostPort.startsWith("[")) {
+    const end = hostPort.indexOf("]");
+    if (end === -1) return null;
+    return hostPort.slice(1, end);
+  }
+  const colonIndex = hostPort.lastIndexOf(":");
+  if (colonIndex === -1) return hostPort;
+  return hostPort.slice(0, colonIndex);
+}
+function validateLoopbackEndpoint(endpoint) {
+  const host = extractHost(endpoint);
+  if (!host) {
+    throw new Error(
+      `CCEM Desktop control endpoint '${redactEndpoint(endpoint)}' is missing a host. Refusing to continue.`
+    );
+  }
+  if (!isLoopbackHost(host)) {
+    throw new Error(
+      `CCEM Desktop control endpoint '${redactEndpoint(endpoint)}' is not bound to loopback. Only 127.0.0.1, localhost, or ::1 are allowed.`
+    );
+  }
+}
+function isPidAlive(pid) {
+  if (!Number.isFinite(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = error.code;
+    if (code === "ESRCH") return false;
+    if (code === "EPERM") return true;
+    return false;
+  }
+}
+function redactEndpoint(endpoint) {
+  try {
+    const url = new URL(endpoint);
+    return `${url.protocol}//${url.host}${url.pathname}`;
+  } catch {
+    return "<invalid endpoint>";
+  }
+}
+function isDescriptor(value) {
+  return Boolean(
+    value && typeof value === "object" && typeof value.endpoint === "string" && typeof value.token === "string"
+  );
+}
+function resolveDesktopControlDescriptor(descriptorPath = getDesktopControlDescriptorPath()) {
+  if (!fs10.existsSync(descriptorPath)) {
+    throw new Error(`CCEM Desktop control endpoint not found at ${descriptorPath}. Start CCEM Desktop first.`);
+  }
+  const parsed = JSON.parse(fs10.readFileSync(descriptorPath, "utf-8"));
+  const endpoint = parsed.endpoint?.trim();
+  const token = parsed.token?.trim();
+  if (!endpoint || !token) {
+    throw new Error(`Invalid CCEM Desktop control descriptor at ${descriptorPath}`);
+  }
+  validateLoopbackEndpoint(endpoint);
+  const pid = readPid(parsed.pid);
+  if (pid !== null && !isPidAlive(pid)) {
+    const cleanedUp = safeRemoveStaleDescriptor(descriptorPath);
+    throw new StaleDesktopControlDescriptorError({
+      reason: "dead-pid",
+      descriptorPath,
+      pid,
+      cleanedUp
+    });
+  }
+  return { endpoint, token, pid };
+}
+async function requestDesktopControl(method, params, descriptorOrOptions, maybeOptions = {}) {
+  const descriptorPath = getDesktopControlDescriptorPath();
+  const hasInjectedDescriptor = isDescriptor(descriptorOrOptions);
+  const descriptor = hasInjectedDescriptor ? descriptorOrOptions : resolveDesktopControlDescriptor(descriptorPath);
+  const options = hasInjectedDescriptor ? maybeOptions : descriptorOrOptions ?? maybeOptions ?? {};
+  const timeoutMs = options.timeoutMs ?? options.fetchTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const pid = readPid(descriptor.pid);
+  validateLoopbackEndpoint(descriptor.endpoint);
+  if (pid !== null && !isPidAlive(pid)) {
+    const cleanedUp = hasInjectedDescriptor ? false : safeRemoveStaleDescriptor(descriptorPath);
+    throw new StaleDesktopControlDescriptorError({
+      reason: "dead-pid",
+      descriptorPath,
+      pid,
+      cleanedUp
+    });
+  }
+  const id = `ccem-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const externalSignal = options.signal;
+  const onExternalAbort = () => controller.abort();
+  if (externalSignal) {
+    if (externalSignal.aborted) {
+      clearTimeout(timer);
+      controller.abort();
+    } else {
+      externalSignal.addEventListener("abort", onExternalAbort, { once: true });
+    }
+  }
+  let response;
+  try {
+    response = await fetch(descriptor.endpoint, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${descriptor.token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        method,
+        params: params ?? {}
+      }),
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (controller.signal.aborted) {
+      throw new StaleDesktopControlDescriptorError({
+        reason: "request-timeout",
+        descriptorPath,
+        pid,
+        cleanedUp: false,
+        timeoutMs,
+        cause: error
+      });
+    }
+    const code = readErrnoCode(error);
+    if (code && ENDPOINT_UNREACHABLE_CODES.has(code)) {
+      throw new StaleDesktopControlDescriptorError({
+        reason: "endpoint-unreachable",
+        descriptorPath,
+        pid,
+        cleanedUp: false,
+        cause: error
+      });
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+    if (externalSignal) {
+      externalSignal.removeEventListener("abort", onExternalAbort);
+    }
+  }
+  if (!response.ok) {
+    throw new Error(`CCEM Desktop control request failed: HTTP ${response.status}`);
+  }
+  const payload = await response.json();
+  if (payload.error) {
+    throw new Error(payload.error.message || `CCEM Desktop control error ${payload.error.code ?? ""}`.trim());
+  }
+  return payload.result;
+}
+function parseSinceOption(raw) {
+  if (raw === void 0 || raw === null || raw === "") return null;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value < 0 || !Number.isInteger(value)) {
+    throw new Error(
+      `Invalid --since value '${raw}'. Expected a non-negative integer sequence number (e.g. 0, 42).`
+    );
+  }
+  return value;
+}
+function parseLimitOption(raw) {
+  if (raw === void 0 || raw === null || raw === "") return null;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {
+    throw new Error(
+      `Invalid --limit value '${raw}'. Expected a positive integer (e.g. 1, 100).`
+    );
+  }
+  return value;
+}
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+
 // src/index.ts
 var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = path8.dirname(__filename2);
-var pkgPath = path8.resolve(__dirname2, "..", "package.json");
-var pkg = JSON.parse(fs10.readFileSync(pkgPath, "utf-8"));
+var __dirname2 = path9.dirname(__filename2);
+var pkgPath = path9.resolve(__dirname2, "..", "package.json");
+var pkg = JSON.parse(fs11.readFileSync(pkgPath, "utf-8"));
 var program = new Command();
 var DEFAULT_OFFICIAL_ENV = {
   ANTHROPIC_BASE_URL: "https://api.anthropic.com",
@@ -3225,6 +3539,29 @@ var config2 = new Conf2({
     defaultMode: null
   }
 });
+function outputDesktopResult(value, options) {
+  if (options.json) {
+    printJson(value);
+    return;
+  }
+  console.log(JSON.stringify(value, null, 2));
+}
+function parseOptionalBoolean(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value === "boolean") {
+    return value;
+  }
+  const normalized = String(value).trim().toLowerCase();
+  if (["1", "true", "yes", "y"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "n"].includes(normalized)) {
+    return false;
+  }
+  return void 0;
+}
 var recoverRegistriesFromLegacy = (registries) => {
   const currentAuthCount = Object.values(registries).filter(
     (env) => Boolean(env.ANTHROPIC_AUTH_TOKEN)
@@ -3233,11 +3570,11 @@ var recoverRegistriesFromLegacy = (registries) => {
     return registries;
   }
   const legacyConfigPath = getLegacyConfigPath();
-  if (!fs10.existsSync(legacyConfigPath)) {
+  if (!fs11.existsSync(legacyConfigPath)) {
     return registries;
   }
   try {
-    const legacyRaw = JSON.parse(fs10.readFileSync(legacyConfigPath, "utf-8"));
+    const legacyRaw = JSON.parse(fs11.readFileSync(legacyConfigPath, "utf-8"));
     const legacyRegistries = legacyRaw.registries ?? {};
     let changed = false;
     const recovered = { ...registries };
@@ -3431,15 +3768,15 @@ var switchEnvironment = async (name) => {
     exportCmds.forEach((cmd) => console.log(cmd));
   }
 };
-var getSessionsFilePath = () => path8.join(getCcemConfigDir(), "sessions.json");
-var getRuntimeStateFilePath = () => path8.join(getCcemConfigDir(), "runtime-state.json");
-var getBotBindRequestFilePath = () => path8.join(getCcemConfigDir(), "bot-bind-requests.jsonl");
+var getSessionsFilePath = () => path9.join(getCcemConfigDir(), "sessions.json");
+var getRuntimeStateFilePath = () => path9.join(getCcemConfigDir(), "runtime-state.json");
+var getBotBindRequestFilePath = () => path9.join(getCcemConfigDir(), "bot-bind-requests.jsonl");
 var parseJsonFile = (filePath) => {
-  if (!fs10.existsSync(filePath)) {
+  if (!fs11.existsSync(filePath)) {
     return null;
   }
   try {
-    return JSON.parse(fs10.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs11.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -3531,8 +3868,8 @@ var resolveBotBindRuntimeId = (explicitRuntimeId) => {
 };
 var appendBotBindRequest = (payload) => {
   const requestPath = getBotBindRequestFilePath();
-  fs10.mkdirSync(path8.dirname(requestPath), { recursive: true });
-  fs10.appendFileSync(requestPath, `${JSON.stringify(payload)}
+  fs11.mkdirSync(path9.dirname(requestPath), { recursive: true });
+  fs11.appendFileSync(requestPath, `${JSON.stringify(payload)}
 `, "utf-8");
   return requestPath;
 };
@@ -3907,12 +4244,12 @@ setupCmd.command("migrate").description("\u8FC1\u79FB\u65E7\u7248\u914D\u7F6E\u5
   const newConfigPath = getCcemConfigPath();
   const legacyConfigPath = getLegacyConfigPath();
   console.log(chalk7.cyan("\n\u{1F504} \u914D\u7F6E\u8FC1\u79FB\n"));
-  if (!fs10.existsSync(legacyConfigPath)) {
+  if (!fs11.existsSync(legacyConfigPath)) {
     console.log(chalk7.yellow("\u672A\u627E\u5230\u65E7\u7248\u914D\u7F6E\u6587\u4EF6"));
     console.log(chalk7.gray(`  \u65E7\u8DEF\u5F84: ${legacyConfigPath}`));
     return;
   }
-  if (fs10.existsSync(newConfigPath) && !options.force) {
+  if (fs11.existsSync(newConfigPath) && !options.force) {
     console.log(chalk7.green("\u2713 \u914D\u7F6E\u5DF2\u5728\u65B0\u8DEF\u5F84"));
     console.log(chalk7.gray(`  \u8DEF\u5F84: ${newConfigPath}`));
     console.log(chalk7.gray("\n\u4F7F\u7528 --force \u5F3A\u5236\u91CD\u65B0\u8FC1\u79FB"));
@@ -3920,15 +4257,15 @@ setupCmd.command("migrate").description("\u8FC1\u79FB\u65E7\u7248\u914D\u7F6E\u5
   }
   try {
     ensureCcemDir();
-    fs10.copyFileSync(legacyConfigPath, newConfigPath);
+    fs11.copyFileSync(legacyConfigPath, newConfigPath);
     console.log(chalk7.green("\u2713 \u914D\u7F6E\u5DF2\u8FC1\u79FB"));
     console.log(chalk7.gray(`  \u4ECE: ${legacyConfigPath}`));
     console.log(chalk7.gray(`  \u5230: ${newConfigPath}`));
     if (options.clean) {
-      fs10.unlinkSync(legacyConfigPath);
-      const legacyDir = path8.dirname(legacyConfigPath);
+      fs11.unlinkSync(legacyConfigPath);
+      const legacyDir = path9.dirname(legacyConfigPath);
       try {
-        fs10.rmdirSync(legacyDir);
+        fs11.rmdirSync(legacyDir);
       } catch {
       }
       console.log(chalk7.green("\u2713 \u5DF2\u5220\u9664\u65E7\u914D\u7F6E\u6587\u4EF6"));
@@ -3939,13 +4276,13 @@ setupCmd.command("migrate").description("\u8FC1\u79FB\u65E7\u7248\u914D\u7F6E\u5
 });
 setupCmd.command("cron").description("\u5B89\u88C5 ccem-cron skill \u5230 Claude Code\uFF08~/.claude/skills/\uFF09").option("--force", "\u5F3A\u5236\u8986\u76D6\u5DF2\u6709\u6587\u4EF6").action(async function() {
   const options = this.opts();
-  const skillDir = path8.join(getHomeDir(), ".claude", "skills");
-  const targetPath = path8.join(skillDir, "ccem-cron.md");
-  if (!fs10.existsSync(skillDir)) {
-    fs10.mkdirSync(skillDir, { recursive: true });
+  const skillDir = path9.join(getHomeDir(), ".claude", "skills");
+  const targetPath = path9.join(skillDir, "ccem-cron.md");
+  if (!fs11.existsSync(skillDir)) {
+    fs11.mkdirSync(skillDir, { recursive: true });
     console.log(chalk7.gray(`\u521B\u5EFA\u76EE\u5F55: ${skillDir}`));
   }
-  if (fs10.existsSync(targetPath) && !options.force) {
+  if (fs11.existsSync(targetPath) && !options.force) {
     const { overwrite } = await inquirer.prompt([
       {
         type: "confirm",
@@ -3959,7 +4296,7 @@ setupCmd.command("cron").description("\u5B89\u88C5 ccem-cron skill \u5230 Claude
       return;
     }
   }
-  fs10.writeFileSync(targetPath, CCEM_CRON_SKILL_CONTENT, "utf-8");
+  fs11.writeFileSync(targetPath, CCEM_CRON_SKILL_CONTENT, "utf-8");
   console.log(chalk7.green(`\u2713 \u5DF2\u5B89\u88C5 ccem-cron skill`));
   console.log(chalk7.gray(`  \u8DEF\u5F84: ${targetPath}`));
   console.log(chalk7.cyan(`
@@ -3967,13 +4304,13 @@ setupCmd.command("cron").description("\u5B89\u88C5 ccem-cron skill \u5230 Claude
 });
 setupCmd.command("bot-bind").description("\u5B89\u88C5 ccem-bot-bind skill \u5230 Claude Code\uFF08~/.claude/skills/\uFF09").option("--force", "\u5F3A\u5236\u8986\u76D6\u5DF2\u6709\u6587\u4EF6").action(async function() {
   const options = this.opts();
-  const skillDir = path8.join(getHomeDir(), ".claude", "skills");
-  const targetPath = path8.join(skillDir, "ccem-bot-bind.md");
-  if (!fs10.existsSync(skillDir)) {
-    fs10.mkdirSync(skillDir, { recursive: true });
+  const skillDir = path9.join(getHomeDir(), ".claude", "skills");
+  const targetPath = path9.join(skillDir, "ccem-bot-bind.md");
+  if (!fs11.existsSync(skillDir)) {
+    fs11.mkdirSync(skillDir, { recursive: true });
     console.log(chalk7.gray(`\u521B\u5EFA\u76EE\u5F55: ${skillDir}`));
   }
-  if (fs10.existsSync(targetPath) && !options.force) {
+  if (fs11.existsSync(targetPath) && !options.force) {
     const { overwrite } = await inquirer.prompt([
       {
         type: "confirm",
@@ -3987,7 +4324,7 @@ setupCmd.command("bot-bind").description("\u5B89\u88C5 ccem-bot-bind skill \u523
       return;
     }
   }
-  fs10.writeFileSync(targetPath, CCEM_BOT_BIND_SKILL_CONTENT, "utf-8");
+  fs11.writeFileSync(targetPath, CCEM_BOT_BIND_SKILL_CONTENT, "utf-8");
   console.log(chalk7.green(`\u2713 \u5DF2\u5B89\u88C5 ccem-bot-bind skill`));
   console.log(chalk7.gray(`  \u8DEF\u5F84: ${targetPath}`));
   console.log(chalk7.cyan(`
@@ -4078,6 +4415,70 @@ program.command("launch").description(false).option("--env <name>", "\u73AF\u588
     silent: true
   });
 });
+var desktopCmd = program.command("desktop").description("Control the running CCEM Desktop app");
+desktopCmd.command("health").description("Check the running CCEM Desktop control endpoint").option("--json", "Output JSON").action(async function() {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.health");
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("create").description("Create a workspace session in the running CCEM Desktop app").requiredOption("--provider <provider>", "Agent provider: claude or codex").requiredOption("--cwd <path>", "Working directory").requiredOption("--prompt <text>", "Initial prompt").option("--env <name>", "Environment name").option("--perm <mode>", "Permission mode").option("--runtime-perm <mode>", "Runtime permission mode").option("--provider-session-id <id>", "Provider session id to continue").option("--effort <level>", "Codex effort level").option("--open <value>", "Open the created session in Desktop (true/false)").option("--json", "Output JSON").action(async function() {
+  const opts = this.opts();
+  const provider = String(opts.provider).trim().toLowerCase();
+  if (provider !== "claude" && provider !== "codex") {
+    throw new Error("Unsupported provider. Use 'claude' or 'codex'.");
+  }
+  const result = await requestDesktopControl("ccem.workspace.createSession", {
+    provider,
+    cwd: opts.cwd,
+    prompt: opts.prompt,
+    envName: opts.env ?? null,
+    permissionMode: opts.perm ?? null,
+    runtimePermissionMode: opts.runtimePerm ?? null,
+    providerSessionId: opts.providerSessionId ?? null,
+    effort: opts.effort ?? null,
+    open: parseOptionalBoolean(opts.open)
+  });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("sessions").description("List CCEM Desktop workspace sessions").option("--cwd <path>", "Filter by working directory").option("--provider <provider>", "Filter by provider").option("--status <status>", "Filter by status").option("--json", "Output JSON").action(async function() {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.listSessions", {
+    cwd: opts.cwd ?? null,
+    provider: opts.provider ?? null,
+    status: opts.status ?? null
+  });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("status <runtimeId>").description("Get one CCEM Desktop workspace session").option("--json", "Output JSON").action(async function(runtimeId) {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.getSession", { runtimeId });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("events <runtimeId>").description("Read CCEM Desktop workspace session events").option("--since <seq>", "First event sequence after this value").option("--limit <count>", "Maximum events to return").option("--json", "Output JSON").action(async function(runtimeId) {
+  const opts = this.opts();
+  const sinceSeq = parseSinceOption(opts.since);
+  const limit = parseLimitOption(opts.limit);
+  const result = await requestDesktopControl("ccem.workspace.getEvents", {
+    runtimeId,
+    sinceSeq,
+    limit
+  });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("send <runtimeId>").description("Send input to a CCEM Desktop workspace session").requiredOption("--text <text>", "Text to send").option("--display-text <text>", "Text to show in Desktop").option("--json", "Output JSON").action(async function(runtimeId) {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.sendInput", {
+    runtimeId,
+    text: opts.text,
+    displayText: opts.displayText ?? null
+  });
+  outputDesktopResult(result, opts);
+});
+desktopCmd.command("open <link>").description("Open a ccem:// workspace session link in Desktop").option("--json", "Output JSON").action(async function(link) {
+  const opts = this.opts();
+  const result = await requestDesktopControl("ccem.workspace.openSession", { link });
+  outputDesktopResult(result, opts);
+});
 program.command("usage").description("\u663E\u793A\u4F7F\u7528\u7EDF\u8BA1\u5E76\u5237\u65B0\u7F13\u5B58").option("--json", "\u4EE5 JSON \u683C\u5F0F\u8F93\u51FA").action(async function() {
   const opts = this.opts();
   const stats = await getUsageStats();
@@ -4285,4 +4686,16 @@ Editing environment '${result.name}'`));
     }
   }
 });
-program.parse(process.argv);
+function handleCliError(error) {
+  if (error instanceof StaleDesktopControlDescriptorError) {
+    console.error(chalk7.red(error.message));
+    process.exit(1);
+  }
+  if (error instanceof Error) {
+    console.error(chalk7.red(error.message));
+    process.exit(1);
+  }
+  console.error(chalk7.red(String(error)));
+  process.exit(1);
+}
+await program.parseAsync(process.argv).catch(handleCliError);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccem",
-  "version": "2.27.0",
+  "version": "2.30.0",
   "type": "module",
   "description": "Claude Code Environment Manager",
   "repository": {