codexpanel 0.1.0 → 0.1.2

package/bin/codexpanel.cjs

@@ -4,12 +4,19 @@
 const fs = require("fs");
 const http = require("http");
 const https = require("https");
+const net = require("net");
 const os = require("os");
 const path = require("path");
-const { spawnSync } = require("child_process");
+const crypto = require("crypto");
+const readline = require("readline");
+const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.1.0";
-const DEFAULT_RELAY_URL = "https://jd.6a.gs";
+const VERSION = "0.1.2";
+const PROD_URL = "https://codexpanel.com";
+const TEST_URL = "https://jd.6a.gs";
+const LOCAL_HOST = "127.0.0.1";
+const LOCAL_PORT_START = 0;
+const DEFAULT_PANEL_PORT_START = 4971;
 
 function usage() {
   return `
@@ -17,23 +24,28 @@ CodexPanel desktop agent installer
 
 Usage:
   npx -y codexpanel [install] [options]
-  npx -y codexpanel --relay http://127.0.0.1:4871
+  npx -y codexpanel login [options]
+  npx -y codexpanel status [options]
 
 Options:
-  --relay, --url <url>          Relay URL. Defaults to CODEXPANEL_RELAY_URL or ${DEFAULT_RELAY_URL}
-  --user, --user-id <id>        CodexPanel user id. Defaults to CODEXPANEL_USER_ID or demo_user_a
-  --device, --device-id <id>    Stable device id. Defaults to the relay bootstrap script's generated id
-  --name, --device-name <name>  Device display name
+  --server <name|url>           production/prod, test/jd, local, or a relay URL. Defaults to production
   --workspace, --cwd <path>     Default workspace for Codex Desktop/app-server
-  --access-code <code>          Access code for protected relay deployments
-  --mode <mode>                 Agent mode. Defaults to desktop-agent
-  --app-server-listen <url>     Local Codex app-server WebSocket URL
+  --device-name, --name <name>  Device display name shown in CodexPanel
+  --terminal-login              Ask for username and password in this terminal
+  --token-login                 Ask for a one-time terminal token from the setup page
+  --no-browser                  Do not open a browser; print the login URL instead
   --no-autostart                Do not enable Windows login autostart
   --no-tunnel                   Disable Cloudflare WSS direct tunnel
-  --print-command               Print the equivalent PowerShell bootstrap command
-  --dry-run                     Print resolved installer details without running PowerShell
+  --dry-run                     Print resolved installer details without installing
+  --print-command               Print the equivalent PowerShell bootstrap command after login approval
   -h, --help                    Show help
   -v, --version                 Show version
+
+Examples:
+  npx -y codexpanel
+  npx -y codexpanel --server test
+  npx -y codexpanel --server local
+  npx -y codexpanel --server https://example.com
 `.trim();
 }
 
@@ -41,19 +53,16 @@ function parseArgs(argv) {
   const args = [...argv];
   const options = {
     command: "install",
-    relayUrl: process.env.CODEXPANEL_RELAY_URL || process.env.BRIDGECODEX_RELAY_URL || DEFAULT_RELAY_URL,
-    userId: process.env.CODEXPANEL_USER_ID || process.env.BRIDGECODEX_USER_ID || "demo_user_a",
-    deviceId: process.env.CODEXPANEL_DEVICE_ID || process.env.BRIDGECODEX_DEVICE_ID || "",
-    deviceName: process.env.CODEXPANEL_DEVICE_NAME || process.env.BRIDGECODEX_DEVICE_NAME || "",
-    workspace: process.env.CODEXPANEL_WORKSPACE || process.env.BRIDGECODEX_WORKSPACE || "",
-    accessCode: process.env.CODEXPANEL_ACCESS_CODE || process.env.BRIDGECODEX_ACCESS_CODE || "",
-    mode: process.env.CODEXPANEL_AGENT_MODE || process.env.BRIDGECODEX_AGENT_MODE || "desktop-agent",
-    appServerListen: process.env.CODEX_APP_SERVER_LISTEN || "",
+    server: process.env.CODEXPANEL_SERVER || "production",
+    workspace: process.env.CODEXPANEL_WORKSPACE || "",
+    deviceName: process.env.CODEXPANEL_DEVICE_NAME || "",
+    terminalLogin: false,
+    tokenLogin: false,
+    browser: true,
     autoStart: true,
     tunnelEnabled: true,
     dryRun: false,
     printCommand: false,
-    keepScript: false,
   };
 
   const readValue = (flag) => {
@@ -65,115 +74,169 @@ function parseArgs(argv) {
   while (args.length) {
     const arg = args.shift();
     if (!arg) continue;
-    if (arg === "install" || arg === "setup") {
-      options.command = "install";
-    } else if (arg === "help") {
-      options.help = true;
-    } else if (arg === "version") {
-      options.version = true;
-    } else if (arg === "-h" || arg === "--help") {
-      options.help = true;
-    } else if (arg === "-v" || arg === "--version") {
-      options.version = true;
-    } else if (arg === "--relay" || arg === "--url") {
-      options.relayUrl = readValue(arg);
-    } else if (arg === "--user" || arg === "--user-id") {
-      options.userId = readValue(arg);
-    } else if (arg === "--device" || arg === "--device-id") {
-      options.deviceId = readValue(arg);
-    } else if (arg === "--name" || arg === "--device-name") {
-      options.deviceName = readValue(arg);
-    } else if (arg === "--workspace" || arg === "--cwd") {
-      options.workspace = readValue(arg);
-    } else if (arg === "--access-code") {
-      options.accessCode = readValue(arg);
-    } else if (arg === "--mode") {
-      options.mode = readValue(arg);
-    } else if (arg === "--app-server-listen") {
-      options.appServerListen = readValue(arg);
-    } else if (arg === "--no-autostart") {
-      options.autoStart = false;
-    } else if (arg === "--no-tunnel") {
-      options.tunnelEnabled = false;
-    } else if (arg === "--print-command") {
-      options.printCommand = true;
-    } else if (arg === "--dry-run") {
-      options.dryRun = true;
-    } else if (arg === "--keep-script") {
-      options.keepScript = true;
-    } else {
+    if (["install", "setup", "login", "status"].includes(arg)) options.command = arg === "setup" ? "install" : arg;
+    else if (arg === "help" || arg === "-h" || arg === "--help") options.help = true;
+    else if (arg === "version" || arg === "-v" || arg === "--version") options.version = true;
+    else if (arg === "--server") options.server = readValue(arg);
+    else if (arg === "--workspace" || arg === "--cwd") options.workspace = readValue(arg);
+    else if (arg === "--device-name" || arg === "--name") options.deviceName = readValue(arg);
+    else if (arg === "--terminal-login") options.terminalLogin = true;
+    else if (arg === "--token-login") options.tokenLogin = true;
+    else if (arg === "--no-browser") options.browser = false;
+    else if (arg === "--no-autostart") options.autoStart = false;
+    else if (arg === "--no-tunnel") options.tunnelEnabled = false;
+    else if (arg === "--dry-run") options.dryRun = true;
+    else if (arg === "--print-command") options.printCommand = true; else {
       throw new Error(`Unknown option: ${arg}`);
     }
   }
-
+  if (options.terminalLogin && options.tokenLogin) throw new Error("Choose only one of --terminal-login or --token-login.");
   return options;
 }
 
-function normalizeRelayUrl(value) {
+function normalizeUrl(value) {
   const raw = String(value || "").trim().replace(/\/+$/, "");
-  if (!raw) throw new Error("Relay URL is empty");
+  if (!raw) throw new Error("Server URL is empty.");
   const withProtocol = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
   const url = new URL(withProtocol);
-  if (url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new Error(`Relay URL must use http or https: ${withProtocol}`);
-  }
+  if (!["http:", "https:"].includes(url.protocol)) throw new Error(`Server must use http or https: ${withProtocol}`);
   return url.toString().replace(/\/+$/, "");
 }
 
-function bootstrapUrl(options) {
-  const url = new URL("/agent/bootstrap.ps1", normalizeRelayUrl(options.relayUrl));
-  url.searchParams.set("userId", options.userId);
-  if (options.deviceId) url.searchParams.set("deviceId", options.deviceId);
-  if (options.deviceName) url.searchParams.set("deviceName", options.deviceName);
-  if (options.workspace) url.searchParams.set("workspace", options.workspace);
-  if (options.accessCode) url.searchParams.set("accessCode", options.accessCode);
-  if (options.mode) url.searchParams.set("mode", options.mode);
-  if (options.appServerListen) url.searchParams.set("appServerListen", options.appServerListen);
-  url.searchParams.set("autoStart", options.autoStart ? "1" : "0");
-  url.searchParams.set("tunnelEnabled", options.tunnelEnabled ? "1" : "0");
-  return url;
+async function resolveServer(server) {
+  const value = String(server || "production").trim();
+  const key = value.toLowerCase();
+  if (["", "prod", "production", "codexpanel", "codexpanel.com"].includes(key)) {
+    return { label: "production", relayUrl: PROD_URL, localPort: null };
+  }
+  if (["test", "jd", "jd.6a.gs"].includes(key)) return { label: "test", relayUrl: TEST_URL, localPort: null };
+  if (key === "local") {
+    const port = await findFreePort(LOCAL_PORT_START);
+    return { label: "local", relayUrl: `http://${LOCAL_HOST}:${port}`, localPort: port };
+  }
+  return { label: "custom", relayUrl: normalizeUrl(value), localPort: null };
 }
 
-function downloadText(url, redirects = 0) {
-  if (redirects > 5) return Promise.reject(new Error(`Too many redirects for ${url}`));
+function findFreePort(start) {
+  return new Promise((resolve, reject) => {
+    let port = Number(start) || 0;
+    let attempts = 0;
+    const tryPort = () => {
+      attempts += 1;
+      if (attempts > 200) {
+        reject(new Error(`No available local port found after ${attempts - 1} attempts.`));
+        return;
+      }
+      const server = net.createServer();
+      server.once("error", () => {
+        port += 1;
+        tryPort();
+      });
+      server.listen(port, LOCAL_HOST, () => {
+        const actual = server.address().port;
+        server.close(() => resolve(actual));
+      });
+    };
+    tryPort();
+  });
+}
+
+function defaultUsername() {
+  try { return os.userInfo().username || process.env.USERNAME || process.env.USER || "unknown-user"; }
+  catch { return process.env.USERNAME || process.env.USER || "unknown-user"; }
+}
+
+function stableDeviceId() {
+  const seed = [os.hostname(), process.env.USERDOMAIN || "", defaultUsername(), process.env.USERPROFILE || process.env.HOME || ""].join("|").toLowerCase();
+  return `bcx-${crypto.createHash("sha256").update(seed).digest("hex").slice(0, 16)}`;
+}
+
+function computerProfile(options, resolvedServer) {
+  return {
+    cliVersion: VERSION,
+    serverLabel: resolvedServer.label,
+    platform: process.platform,
+    arch: process.arch,
+    host: os.hostname(),
+    computerUser: defaultUsername(),
+    userDomain: process.env.USERDOMAIN || "",
+    deviceId: stableDeviceId(),
+    deviceName: options.deviceName || `${os.hostname()} / ${defaultUsername()} Codex Desktop Agent`,
+    workspace: options.workspace || process.env.USERPROFILE || process.env.HOME || process.cwd(),
+    autoStart: options.autoStart,
+    tunnelEnabled: options.tunnelEnabled,
+    panelPortHint: DEFAULT_PANEL_PORT_START,
+  };
+}
+
+function requestJson(method, relayUrl, pathname, body, headers = {}, timeoutMs = 30000) {
+  const url = new URL(pathname, relayUrl);
+  const text = body === undefined ? "" : JSON.stringify(body);
   const client = url.protocol === "https:" ? https : http;
   return new Promise((resolve, reject) => {
-    const req = client.get(url, {
+    const req = client.request(url, {
+      method,
+      timeout: timeoutMs,
       headers: {
         "user-agent": `codexpanel-npm/${VERSION}`,
-        "accept": "text/plain, */*",
+        "accept": "application/json",
+        ...(text ? { "content-type": "application/json", "content-length": Buffer.byteLength(text) } : {}),
+        ...headers,
       },
-      timeout: 30000,
+    }, (res) => {
+      let data = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => data += chunk);
+      res.on("end", () => {
+        let parsed = {};
+        try { parsed = data ? JSON.parse(data) : {}; }
+        catch { parsed = { raw: data }; }
+        if ((res.statusCode || 0) < 200 || (res.statusCode || 0) >= 300 || parsed.ok === false) {
+          const error = new Error(parsed.error || `HTTP ${res.statusCode}`);
+          error.statusCode = res.statusCode;
+          error.data = parsed;
+          reject(error);
+          return;
+        }
+        resolve(parsed);
+      });
+    });
+    req.on("timeout", () => req.destroy(new Error(`Timeout calling ${url}`)));
+    req.on("error", reject);
+    if (text) req.write(text);
+    req.end();
+  });
+}
+
+function downloadText(url, timeoutMs = 30000) {
+  const parsed = new URL(url);
+  const client = parsed.protocol === "https:" ? https : http;
+  return new Promise((resolve, reject) => {
+    const req = client.get(parsed, {
+      headers: { "user-agent": `codexpanel-npm/${VERSION}`, "accept": "text/plain, application/json, */*" },
+      timeout: timeoutMs,
     }, (res) => {
       if ([301, 302, 303, 307, 308].includes(res.statusCode || 0) && res.headers.location) {
         res.resume();
-        const next = new URL(res.headers.location, url);
-        downloadText(next, redirects + 1).then(resolve, reject);
+        downloadText(new URL(res.headers.location, parsed).toString(), timeoutMs).then(resolve, reject);
         return;
       }
-      let body = "";
+      let data = "";
       res.setEncoding("utf8");
-      res.on("data", (chunk) => body += chunk);
+      res.on("data", (chunk) => data += chunk);
       res.on("end", () => {
-        if ((res.statusCode || 0) < 200 || (res.statusCode || 0) >= 300) {
-          const authHint = res.statusCode === 401 || res.statusCode === 403
-            ? " The relay requires an access code; re-run with --access-code <code> or set CODEXPANEL_ACCESS_CODE."
-            : "";
-          reject(new Error(`HTTP ${res.statusCode} while downloading ${url}.${authHint}`));
-          return;
-        }
-        resolve(body.replace(/^\uFEFF/, ""));
+        if ((res.statusCode || 0) < 200 || (res.statusCode || 0) >= 300) reject(new Error(`HTTP ${res.statusCode} while downloading ${parsed}`));
+        else resolve(data.replace(/^\uFEFF/, ""));
       });
     });
-    req.on("timeout", () => req.destroy(new Error(`Timeout downloading ${url}`)));
+    req.on("timeout", () => req.destroy(new Error(`Timeout downloading ${parsed}`)));
     req.on("error", reject);
   });
 }
 
 function powershellPath() {
   if (process.platform !== "win32") return "pwsh";
-  const candidates = ["pwsh.exe", "powershell.exe"];
-  for (const candidate of candidates) {
+  for (const candidate of ["pwsh.exe", "powershell.exe"]) {
     const result = spawnSync("where.exe", [candidate], { encoding: "utf8", windowsHide: true });
     const first = (result.stdout || "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean)[0];
     if (first) return first;
@@ -181,79 +244,306 @@ function powershellPath() {
   return "powershell.exe";
 }
 
+function openBrowser(url) {
+  const target = String(url);
+  if (process.platform === "win32") return spawn(powershellPath(), [
+    "-NoProfile",
+    "-ExecutionPolicy",
+    "Bypass",
+    "-Command",
+    "Start-Process -FilePath $args[0]",
+    target,
+  ], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+  if (process.platform === "darwin") return spawn("open", [target], { detached: true, stdio: "ignore" }).unref();
+  return spawn("xdg-open", [target], { detached: true, stdio: "ignore" }).unref();
+}
+
+function localAgentRoot() {
+  if (process.platform === "win32" && process.env.LOCALAPPDATA) return path.join(process.env.LOCALAPPDATA, "CodexPanelAgent");
+  return path.join(os.homedir() || process.cwd(), ".codexpanel-agent");
+}
+
+function readLocalRuntimeConfig() {
+  const root = localAgentRoot();
+  const configPath = path.join(root, "agent-runtime.json");
+  try {
+    const raw = fs.readFileSync(configPath, "utf8").replace(/^\uFEFF/, "");
+    return { root, configPath, config: JSON.parse(raw) };
+  } catch (error) {
+    error.configPath = configPath;
+    throw error;
+  }
+}
+
+function localPanelUrl(config = {}) {
+  const panelBase = config.panelUrl || (config.panelPort ? `http://${config.panelHost || "127.0.0.1"}:${config.panelPort}/` : "");
+  if (!panelBase) return "";
+  const url = new URL(panelBase);
+  if (config.panelToken) url.searchParams.set("token", String(config.panelToken));
+  return url.toString();
+}
+
+function createInterface() {
+  return readline.createInterface({ input: process.stdin, output: process.stdout });
+}
+
+function question(rl, text, { silent = false } = {}) {
+  if (!silent) return new Promise((resolve) => rl.question(text, resolve));
+  const input = process.stdin;
+  const output = process.stdout;
+  return new Promise((resolve) => {
+    const onData = (char) => {
+      char = String(char);
+      switch (char) {
+        case "\n": case "\r": case "\u0004":
+          input.setRawMode?.(false);
+          input.pause();
+          output.write("\n");
+          input.removeListener("data", onData);
+          resolve(buffer);
+          break;
+        case "\u0003":
+          process.exit(130);
+          break;
+        default:
+          buffer += char;
+          break;
+      }
+    };
+    let buffer = "";
+    output.write(text);
+    input.resume();
+    input.setRawMode?.(true);
+    input.on("data", onData);
+  });
+}
+
+async function preloadResources(relayUrl) {
+  const manifestUrl = new URL("/agent/version", relayUrl).toString();
+  console.log(`CodexPanel: 正在读取资源清单 / Reading resource manifest: ${manifestUrl}`);
+  const manifestText = await downloadText(manifestUrl, 30000);
+  let manifest = {};
+  try { manifest = JSON.parse(manifestText); }
+  catch { throw new Error("Server returned an invalid agent manifest."); }
+  const resources = [manifest.desktopAgent, manifest.connector, manifest.bootstrap].filter(Boolean);
+  for (const item of resources) {
+    const resourceUrl = new URL(item.path, relayUrl).toString();
+    console.log(`CodexPanel: 预下载资源 / Downloading ${item.fileName || item.path}`);
+    const text = await downloadText(resourceUrl, 60000);
+    const hash = crypto.createHash("sha256").update(Buffer.from(text, "utf8")).digest("hex");
+    if (item.sha256 && hash !== item.sha256) throw new Error(`Checksum mismatch for ${item.fileName || item.path}`);
+  }
+  console.log("CodexPanel: 资源已下载并校验完成 / Resources downloaded and verified.");
+  return manifest;
+}
+
 function powershellCommand(url) {
   const escaped = String(url).replace(/'/g, "''");
   return `powershell -NoProfile -ExecutionPolicy Bypass -Command "irm '${escaped}' | iex"`;
 }
 
-async function install(options) {
-  const url = bootstrapUrl(options);
+async function pollSetup(relayUrl, flowId, flowSecret) {
+  const started = Date.now();
+  let transientFailures = 0;
+  while (Date.now() - started < 10 * 60 * 1000) {
+    try {
+      const result = await requestJson("POST", relayUrl, "/api/desktop/setup/poll", { flowId, flowSecret }, {}, 30000);
+      transientFailures = 0;
+      if (result.status === "approved") return result;
+      if (result.status === "rejected") throw new Error(result.error || "Setup was rejected in the browser.");
+      if (result.status === "expired") throw new Error("Setup login expired. Run npx -y codexpanel again.");
+      const hint = result.message || "等待浏览器登录绑定 / Waiting for browser sign-in";
+      process.stdout.write(`\rCodexPanel: ${hint}...   `);
+    } catch (error) {
+      if (![429, 502, 503, 504].includes(Number(error.statusCode))) throw error;
+      transientFailures += 1;
+      const detail = error.data?.error || error.data?.raw || error.message || `HTTP ${error.statusCode}`;
+      process.stdout.write(`\rCodexPanel: 服务端暂时不可用，正在重试 / Server temporarily unavailable, retrying (${error.statusCode}, ${transientFailures}): ${detail}   `);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 2000));
+  }
+  throw new Error("Setup login timed out after 10 minutes.");
+}
+
+async function terminalLogin(relayUrl, flowId, flowSecret) {
+  const rl = createInterface();
+  try {
+    const username = (await question(rl, "CodexPanel username: ")).trim();
+    const password = await question(rl, "CodexPanel password: ", { silent: true });
+    try {
+      return await requestJson("POST", relayUrl, "/api/desktop/setup/login-token", { flowId, flowSecret, username, password }, {}, 30000);
+    } catch (error) {
+      if (error.data?.code !== "device_rebind_required") throw error;
+      console.log("这台电脑已绑定到其他账号，不会自动切换绑定。");
+      const answer = (await question(rl, "Type YES to rebind this computer to the current account / 输入 YES 切换绑定: ")).trim();
+      if (answer !== "YES") throw new Error("Setup kept the existing binding. Run npx -y codexpanel again if you want to switch later.");
+      return await requestJson("POST", relayUrl, "/api/desktop/setup/login-token", { flowId, flowSecret, username, password, confirmRebind: true }, {}, 30000);
+    }
+  } finally {
+    rl.close();
+  }
+}
+
+async function tokenLogin(relayUrl, flowId, flowSecret) {
+  const rl = createInterface();
+  try {
+    const token = (await question(rl, "One-time CodexPanel terminal token from setup page: ")).trim();
+    try {
+      return await requestJson("POST", relayUrl, "/api/desktop/setup/login-token", { flowId, flowSecret, token }, {}, 30000);
+    } catch (error) {
+      if (error.data?.code !== "device_rebind_required") throw error;
+      console.log("这台电脑已绑定到其他账号，不会自动切换绑定。");
+      const answer = (await question(rl, "Type YES to rebind this computer to the current account / 输入 YES 切换绑定: ")).trim();
+      if (answer !== "YES") throw new Error("Setup kept the existing binding. Run npx -y codexpanel again if you want to switch later.");
+      return await requestJson("POST", relayUrl, "/api/desktop/setup/login-token", { flowId, flowSecret, token, confirmRebind: true }, {}, 30000);
+    }
+  } finally {
+    rl.close();
+  }
+}
+
+async function runBootstrap(relayUrl, approval, options) {
+  const url = new URL("/agent/bootstrap.ps1", relayUrl);
+  url.searchParams.set("setupToken", approval.setupToken);
+  url.searchParams.set("manualDeviceId", "1");
+  url.searchParams.set("manualDeviceName", "1");
+  url.searchParams.set("deviceId", approval.deviceId || stableDeviceId());
+  if (approval.deviceName) url.searchParams.set("deviceName", approval.deviceName);
+  if (options.workspace) url.searchParams.set("workspace", options.workspace);
+  url.searchParams.set("mode", "desktop-agent");
+  url.searchParams.set("autoStart", options.autoStart ? "1" : "0");
+  url.searchParams.set("tunnelEnabled", options.tunnelEnabled ? "1" : "0");
+
   if (options.printCommand) console.log(powershellCommand(url));
+  if (process.platform !== "win32") throw new Error("CodexPanel desktop agent installation currently supports Windows. Use the login URL on Windows to bind this computer.");
+
+  console.log("\nCodexPanel: 正在下载最终安装脚本 / Downloading final bootstrap script...");
+  const script = await downloadText(url.toString(), 30000);
+  if (!/CodexPanel/i.test(script) || !/desktop-agent/i.test(script)) throw new Error("Downloaded bootstrap script did not look like the CodexPanel Windows installer.");
+  const tmp = path.join(os.tmpdir(), `codexpanel-bootstrap-${Date.now()}-${Math.random().toString(16).slice(2)}.ps1`);
+  fs.writeFileSync(tmp, Buffer.concat([Buffer.from([0xEF, 0xBB, 0xBF]), Buffer.from(script, "utf8")]));
+  console.log("CodexPanel: 正在启动 Windows 安装器 / Starting Windows installer...");
+  const result = spawnSync(powershellPath(), ["-NoLogo", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", tmp], { stdio: "inherit", windowsHide: false });
+  try { fs.unlinkSync(tmp); } catch {}
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`PowerShell installer exited with code ${result.status}`);
+}
+
+async function install(options) {
+  const resolved = await resolveServer(options.server);
+  const profile = computerProfile(options, resolved);
   if (options.dryRun) {
     console.log(JSON.stringify({
       ok: true,
-      platform: process.platform,
-      relayUrl: normalizeRelayUrl(options.relayUrl),
-      bootstrapUrl: String(url),
-      userId: options.userId,
-      mode: options.mode,
+      version: VERSION,
+      command: options.command,
+      server: resolved.label,
+      relayUrl: resolved.relayUrl,
+      localPort: resolved.localPort,
+      deviceId: profile.deviceId,
+      deviceName: profile.deviceName,
+      workspace: profile.workspace,
+      browserLogin: !options.terminalLogin && !options.tokenLogin,
+      terminalLogin: options.terminalLogin,
+      tokenLogin: options.tokenLogin,
       autoStart: options.autoStart,
       tunnelEnabled: options.tunnelEnabled,
     }, null, 2));
     return;
   }
 
-  if (process.platform !== "win32") {
-    throw new Error("CodexPanel desktop agent installation currently supports Windows. Use --print-command on Windows, or open the relay setup page for this platform.");
+  console.log(`CodexPanel ${VERSION}`);
+  console.log(`Server / 服务端: ${resolved.relayUrl} (${resolved.label})`);
+  if (resolved.label === "local") {
+    console.log(`Local relay port / 本地 relay 端口: ${resolved.localPort} (dynamic, not fixed)`);
   }
 
-  console.log(`CodexPanel: downloading installer from ${normalizeRelayUrl(options.relayUrl)}`);
-  const script = await downloadText(url);
-  if (!/CodexPanel/i.test(script) || !/desktop-agent/i.test(script)) {
-    throw new Error("Downloaded bootstrap script did not look like the CodexPanel Windows installer.");
-  }
-
-  const tmp = path.join(os.tmpdir(), `codexpanel-bootstrap-${Date.now()}-${Math.random().toString(16).slice(2)}.ps1`);
-  fs.writeFileSync(tmp, Buffer.concat([Buffer.from([0xEF, 0xBB, 0xBF]), Buffer.from(script, "utf8")]));
+  const manifest = await preloadResources(resolved.relayUrl);
+  const start = await requestJson("POST", resolved.relayUrl, "/api/desktop/setup/start", {
+    ...profile,
+    agentVersion: manifest.agentVersion || "",
+  }, {}, 30000);
+  console.log("\n资源已准备好。按 Enter 拉起浏览器登录并绑定这台电脑。");
+  console.log("Resources are ready. Press Enter to open your browser and sign in.");
+  console.log(`Login URL / 登录链接: ${start.loginUrl}`);
+  if (start.oneTimeCode) console.log(`One-time code / 一次性确认码: ${start.oneTimeCode}`);
 
-  console.log("CodexPanel: starting Windows installer");
-  const result = spawnSync(powershellPath(), [
-    "-NoLogo",
-    "-NoProfile",
-    "-ExecutionPolicy",
-    "Bypass",
-    "-File",
-    tmp,
-  ], {
-    stdio: "inherit",
-    windowsHide: false,
-  });
-
-  if (!options.keepScript) {
-    try { fs.unlinkSync(tmp); } catch {}
+  let approval;
+  if (options.terminalLogin) {
+    approval = await terminalLogin(resolved.relayUrl, start.flowId, start.flowSecret);
+  } else if (options.tokenLogin) {
+    approval = await tokenLogin(resolved.relayUrl, start.flowId, start.flowSecret);
   } else {
-    console.log(`CodexPanel: kept bootstrap script at ${tmp}`);
+    if (options.browser) {
+      const rl = createInterface();
+      await question(rl, "Press Enter to open browser / 按 Enter 拉起浏览器登录...");
+      rl.close();
+      try { openBrowser(start.loginUrl); }
+      catch (error) { console.log(`CodexPanel: browser open failed, please open manually: ${error.message}`); }
+    } else {
+      console.log("CodexPanel: --no-browser enabled. Open the URL above in your browser.");
+    }
+    approval = await pollSetup(resolved.relayUrl, start.flowId, start.flowSecret);
+  }
+  console.log("\nCodexPanel: 登录绑定成功 / Sign-in and binding approved.");
+  console.log(`User / 用户: ${approval.user?.name || approval.userId || "unknown"}`);
+  console.log(`Device / 设备: ${approval.deviceName || approval.deviceId}`);
+  await runBootstrap(resolved.relayUrl, approval, options);
+  if (approval.panelUrl) {
+    console.log(`CodexPanel local status panel / 本地状态面板: ${approval.panelUrl}`);
+    try { openBrowser(approval.panelUrl); } catch {}
   }
+}
 
-  if (result.error) throw result.error;
-  if (result.status !== 0) throw new Error(`PowerShell installer exited with code ${result.status}`);
+async function status(options) {
+  let runtime;
+  try {
+    runtime = readLocalRuntimeConfig();
+  } catch (error) {
+    throw new Error(`No local CodexPanel install found at ${error.configPath}. Run npx -y codexpanel first.`);
+  }
+  const { root, configPath, config } = runtime;
+  const panelUrl = localPanelUrl(config);
+  console.log(`CodexPanel ${VERSION} local status`);
+  console.log(`Install dir / 安装目录: ${root}`);
+  console.log(`Config / 配置文件: ${configPath}`);
+  console.log(`Server / 服务端: ${config.relayUrl || "unknown"}`);
+  console.log(`User / 用户: ${config.userId || "unknown"}`);
+  console.log(`Device / 设备: ${config.deviceName || config.deviceId || "unknown"}`);
+  console.log(`Device ID: ${config.deviceId || "unknown"}`);
+  if (panelUrl) console.log(`Local status panel / 本地状态面板: ${panelUrl}`);
+  else console.log("Local status panel / 本地状态面板: not configured");
+
+  if (panelUrl) {
+    try {
+      const panel = new URL(panelUrl);
+      const statusPath = `/api/status${panel.search || ""}`;
+      const data = await requestJson("GET", panel.origin, statusPath, undefined, {}, 5000);
+      console.log(`Agent / 本机 agent: ${data.running ? "running" : "unknown"} (PID ${data.pid || "unknown"})`);
+      console.log(`Agent version / agent 版本: ${data.agentVersion || "unknown"}`);
+      console.log(`NPM package / npm 包版本: ${data.npmPackageVersion || VERSION}`);
+      console.log(`Latest agent / 服务端最新版本: ${data.serverLatestAgentVersion || "unknown"}`);
+      console.log(`Update / 更新: ${data.updateAvailable ? data.updateCommand || "npx -y codexpanel" : "up to date"}`);
+      console.log(`Heartbeat / 最近心跳: ${data.lastHeartbeatAt || data.lastHeartbeatError || "waiting"}`);
+      if (options.browser) openBrowser(panelUrl);
+    } catch (error) {
+      console.log(`Agent / 本机 agent: not reachable (${error.message})`);
+      if (config.startupScriptPath) console.log(`Start command / 启动命令: powershell -NoProfile -ExecutionPolicy Bypass -File "${config.startupScriptPath}"`);
+    }
+  }
 }
 
 async function main() {
   const options = parseArgs(process.argv.slice(2));
-  if (options.version) {
-    console.log(VERSION);
-    return;
-  }
-  if (options.help) {
-    console.log(usage());
-    return;
-  }
-  if (options.command !== "install") throw new Error(`Unknown command: ${options.command}`);
+  if (options.version) return console.log(VERSION);
+  if (options.help) return console.log(usage());
+  if (!["install", "login", "status"].includes(options.command)) throw new Error(`Unknown command: ${options.command}`);
+  if (options.command === "status") return status(options);
   await install(options);
 }
 
 main().catch((error) => {
   console.error(`codexpanel: ${error.message}`);
+  if (error.data) console.error(JSON.stringify(error.data, null, 2));
   process.exitCode = 1;
 });