desktop-pet-app 0.3.5 → 0.3.24

package/out/main/index.js

@@ -80,7 +80,17 @@ function writeMainLog(line) {
   }
 }
 const logger = new Logger(levelFromEnv(), writeMainLog);
-const PORT_FILE = process.env.DESKTOP_PET_PORT_FILE?.trim() || path.join(os.homedir(), ".desktop-pet-port");
+function resolvePortFile(env = process.env, homeDirectory = os.homedir()) {
+  const explicit = env.DESKTOP_PET_PORT_FILE?.trim();
+  if (explicit) return path.resolve(explicit);
+  const profile = env.DESKTOP_PET_PROFILE?.trim();
+  if (profile) return `${path.resolve(profile)}.port`;
+  if (env.NODE_ENV_ELECTRON_VITE === "development") {
+    return path.join(homeDirectory, ".desktop-pet-development.port");
+  }
+  return path.join(homeDirectory, ".desktop-pet-port");
+}
+const PORT_FILE = resolvePortFile();
 const LOCAL_PET_PROTOCOL_VERSION = "1.0";
 const LOCAL_PET_MAX_BODY_BYTES = 64 * 1024;
 const MAX_PETS = 4;
@@ -345,6 +355,17 @@ function center(bounds) {
   return { x: bounds.x + bounds.width / 2, y: bounds.y + bounds.height / 2 };
 }
 const petManager = new PetManager();
+const OFFICIAL_SERVER_ROOT = "https://api.xinbit.top/desktop-pet";
+const OFFICIAL_PORTAL_ORIGIN = "https://deskpalai.com";
+const LEGACY_OFFICIAL_SERVER_HOSTS = "47.94.20.104".split(",").map((host) => host.trim()).filter(Boolean);
+function isLegacyOfficialServerURL(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" && LEGACY_OFFICIAL_SERVER_HOSTS.includes(url.hostname);
+  } catch {
+    return false;
+  }
+}
 function credentialPath() {
   return node_path.join(electron.app.getPath("userData"), "device-credentials.enc");
 }
@@ -361,10 +382,18 @@ function loadDeviceCredentials() {
   const path2 = credentialPath();
   if (!node_fs.existsSync(path2)) return void 0;
   if (!electron.safeStorage.isEncryptionAvailable()) return void 0;
-  const credentials = JSON.parse(electron.safeStorage.decryptString(node_fs.readFileSync(path2)));
+  const credentials = migrateLegacyOfficialServer(
+    JSON.parse(electron.safeStorage.decryptString(node_fs.readFileSync(path2)))
+  );
   validate(credentials);
   return credentials;
 }
+function migrateLegacyOfficialServer(credentials) {
+  if (isLegacyOfficialServerURL(credentials.serverUrl)) {
+    return { ...credentials, serverUrl: OFFICIAL_SERVER_ROOT };
+  }
+  return credentials;
+}
 function clearDeviceCredentials() {
   node_fs.rmSync(credentialPath(), { force: true });
 }
@@ -377,11 +406,39 @@ function validate(credentials) {
     throw new Error("设备配置的 serverUrl 必须使用 http 或 https");
   }
 }
-const DEFAULT_DESKTOP_PET_HOST = "https://deskpalai.com";
-function configuredRelayURL() {
-  const host = process.env.DESKTOP_PET_HOST?.trim();
-  if (host) return relayURLFromHost(host);
-  return process.env.DESKTOP_PET_SERVER?.trim() || relayURLFromHost(DEFAULT_DESKTOP_PET_HOST);
+function configuredRelayURL(options = {}) {
+  if (options.allowRuntimeOverrides !== false) {
+    const host = process.env.DESKTOP_PET_HOST?.trim();
+    if (host) return relayURLFromHost(host);
+    const server = process.env.DESKTOP_PET_SERVER?.trim();
+    if (server) return server;
+  }
+  return relayURLFromHost(OFFICIAL_SERVER_ROOT);
+}
+function hasRuntimeServerOverride(options = {}) {
+  return options.allowRuntimeOverrides !== false && Boolean(
+    process.env.DESKTOP_PET_HOST?.trim() || process.env.DESKTOP_PET_SERVER?.trim()
+  );
+}
+function relayHTTPRootURL(relayURL = configuredRelayURL()) {
+  const url = new URL(relayURL);
+  if (url.protocol === "wss:") url.protocol = "https:";
+  else if (url.protocol === "ws:") url.protocol = "http:";
+  else throw new Error("中转地址必须使用 ws:// 或 wss://");
+  url.pathname = url.pathname.replace(/\/ws\/?$/, "").replace(/\/+$/, "");
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+function canonicalHTTPRootURL(value) {
+  const url = new URL(value);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("设备服务器地址必须使用 http:// 或 https://");
+  }
+  url.pathname = url.pathname.replace(/\/+$/, "");
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
 }
 function relayURLFromHost(value) {
   const source = value.includes("://") ? value : `${isLocalHost(value) ? "http" : "https"}://${value}`;
@@ -396,7 +453,7 @@ function relayURLFromHost(value) {
   if (url.protocol !== "ws:" && url.protocol !== "wss:") {
     throw new Error("DESKTOP_PET_HOST 必须使用 http:// 或 https://");
   }
-  url.pathname = "/ws";
+  url.pathname = `${url.pathname.replace(/\/+$/, "")}/ws`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -405,9 +462,20 @@ function isLocalHost(value) {
   return /^(localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(?:\/|$)/i.test(value.trim());
 }
 const TASK_PROTOCOL_VERSION = "1.0";
+const WORKSPACE_SNAPSHOT_MIME = "application/vnd.desktop-pet.git-workspace-bundle";
+function taskParticipantRole(task, authenticatedUserId) {
+  const current = authenticatedUserId.trim().toLowerCase();
+  if (!current) return void 0;
+  if (task.envelope.from.userId.trim().toLowerCase() === current) return "requester";
+  if (task.envelope.to.userId.trim().toLowerCase() === current) return "executor";
+  return void 0;
+}
 const sensitivePathPatterns = [
   /(^|\/)\.env(?:\.|$)/i,
+  /(^|\/)(?:\.npmrc|\.pypirc|\.netrc)(?:$|\/)/i,
+  /(^|\/)(?:\.aws|\.azure|\.kube)(?:$|\/)/i,
   /(^|\/)(?:id_rsa|id_ed25519|known_hosts|credentials)(?:$|\/)/i,
+  /(?:^|\/)[^/]+\.(?:pem|key|p12|pfx|keystore)(?:$|\/)/i,
   /(^|\/)\.ssh(?:$|\/)/i,
   /(^|\/)\.gnupg(?:$|\/)/i,
   /(^|\/)node_modules(?:$|\/)/i,
@@ -459,6 +527,9 @@ function inlineResultArtifact(input) {
     inlineText: input.text
   };
 }
+function isWorkspaceSnapshotContextItem(item) {
+  return item.kind === "file" && item.mimeType === WORKSPACE_SNAPSHOT_MIME && item.encoding === "binary" && item.transport === "relay-blob" && item.required && Boolean(item.artifactRef);
+}
 function isTerminalTaskStatus(status2) {
   return status2 === "completed" || status2 === "failed" || status2 === "cancelled" || status2 === "expired";
 }
@@ -478,6 +549,37 @@ function showDesktopNotification(title, body) {
   if (!electron.Notification.isSupported()) return;
   new electron.Notification({ title, body }).show();
 }
+const PRODUCT_DATA_DIRECTORY = "Desktop Pet";
+const DEVELOPMENT_DATA_DIRECTORY = "Desktop Pet Development";
+const LEGACY_NPM_DATA_DIRECTORY = "desktop-pet-app";
+function developmentRuntimeOverridesAllowed() {
+  return !electron.app?.isPackaged || Boolean(process.env.DESKTOP_PET_PROFILE?.trim());
+}
+function configureRuntimeIdentity() {
+  const profileDirectory = process.env.DESKTOP_PET_PROFILE?.trim();
+  if (profileDirectory) {
+    electron.app.setPath("userData", node_path.resolve(profileDirectory));
+    return;
+  }
+  const appDataDirectory = electron.app.getPath("appData");
+  if (electron.app.isPackaged || process.env.DESKTOP_PET_NPM_DISTRIBUTION === "1") {
+    electron.app.setPath("userData", node_path.join(appDataDirectory, PRODUCT_DATA_DIRECTORY));
+    return;
+  }
+  const developmentDirectory = node_path.join(appDataDirectory, DEVELOPMENT_DATA_DIRECTORY);
+  migrateLegacyData(node_path.join(appDataDirectory, LEGACY_NPM_DATA_DIRECTORY), developmentDirectory);
+  electron.app.setPath("userData", developmentDirectory);
+}
+function migrateLegacyData(legacyDirectory, canonicalDirectory) {
+  if (!node_fs.existsSync(legacyDirectory) || node_fs.existsSync(canonicalDirectory)) return false;
+  try {
+    node_fs.renameSync(legacyDirectory, canonicalDirectory);
+    return true;
+  } catch (error) {
+    console.warn(`无法迁移 Desktop Pet 用户数据：${String(error)}`);
+    return false;
+  }
+}
 function p2pSigningPayload(message, fromDeviceId) {
   const signalJSON = JSON.stringify(message.signal ?? null);
   const signalHash = node_crypto.createHash("sha256").update(signalJSON).digest("hex");
@@ -504,11 +606,12 @@ function verifyP2PSignal(message) {
     return false;
   }
 }
-let serverURL = configuredRelayURL();
-let userID = process.env.DESKTOP_PET_USER ?? os.hostname();
+const allowDevelopmentOverrides = developmentRuntimeOverridesAllowed();
+let serverURL = configuredRelayURL({ allowRuntimeOverrides: allowDevelopmentOverrides });
+let userID = allowDevelopmentOverrides ? process.env.DESKTOP_PET_USER ?? os.hostname() : os.hostname();
 const SKIN = process.env.DESKTOP_PET_SKIN ?? "";
-let authToken = process.env.DESKTOP_PET_TOKEN?.trim();
-let deviceID = process.env.DESKTOP_PET_DEVICE_ID?.trim() || "";
+let authToken = allowDevelopmentOverrides ? process.env.DESKTOP_PET_TOKEN?.trim() : void 0;
+let deviceID = allowDevelopmentOverrides ? process.env.DESKTOP_PET_DEVICE_ID?.trim() || "" : "";
 let signingPrivateKey = "";
 const pendingTasks = /* @__PURE__ */ new Map();
 const pendingAnswers = /* @__PURE__ */ new Map();
@@ -523,13 +626,41 @@ let ws = null;
 let connectPromise = null;
 let intentionalClose = false;
 let protocolV1Available = false;
+let workspaceSnapshotStagingAvailable = false;
 let mcpRegistration;
+const RETRY_BASE_DELAY_MS = 3e3;
+const RETRY_MAX_DELAY_MS = 5 * 6e4;
+let reconnectTimer = null;
+let retryAttempt = 0;
+function scheduleRelayReconnect() {
+  if (reconnectTimer) return;
+  const delay = Math.min(RETRY_BASE_DELAY_MS * 2 ** Math.min(retryAttempt, 10), RETRY_MAX_DELAY_MS);
+  retryAttempt += 1;
+  logger.info("relay reconnect scheduled", { attempt: retryAttempt, delayMs: delay });
+  reconnectTimer = setTimeout(() => {
+    reconnectTimer = null;
+    void ensureConnected().catch(() => {
+    });
+  }, delay);
+}
+function cancelRelayReconnect() {
+  if (reconnectTimer) {
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  }
+}
 function getAuthenticatedRelayUserId() {
   return authToken ? userID : void 0;
 }
+function getPresentedRelayUserId() {
+  return authToken || allowDevelopmentOverrides && process.env.DESKTOP_PET_USER?.trim() ? userID : void 0;
+}
 function isProtocolV1Available() {
   return protocolV1Available;
 }
+function isWorkspaceSnapshotStagingAvailable() {
+  return protocolV1Available && workspaceSnapshotStagingAvailable;
+}
 function getRelayHTTPAuth() {
   if (!authToken) throw new Error("relay device access token is unavailable");
   const url = new URL(serverURL);
@@ -547,6 +678,14 @@ function configureRelayIdentity(config) {
   authToken = config.accessToken;
   signingPrivateKey = config.signingPrivateKey ?? "";
 }
+function clearRelayIdentity() {
+  if (ws || connectPromise) throw new Error("stop relay before clearing identity");
+  serverURL = configuredRelayURL({ allowRuntimeOverrides: allowDevelopmentOverrides });
+  userID = allowDevelopmentOverrides ? process.env.DESKTOP_PET_USER ?? os.hostname() : os.hostname();
+  deviceID = allowDevelopmentOverrides ? process.env.DESKTOP_PET_DEVICE_ID?.trim() || "" : "";
+  authToken = allowDevelopmentOverrides ? process.env.DESKTOP_PET_TOKEN?.trim() : void 0;
+  signingPrivateKey = "";
+}
 async function registerMcpClient(agentHost, capabilities = {}) {
   mcpRegistration = { agentHost, capabilities };
   await ensureConnected();
@@ -561,6 +700,7 @@ async function registerMcpClient(agentHost, capabilities = {}) {
 }
 function startRelay() {
   intentionalClose = false;
+  retryAttempt = 0;
   void ensureConnected().catch((err) => {
     logger.warn("relay connect failed on startup", { error: String(err) });
   });
@@ -568,6 +708,9 @@ function startRelay() {
 function stopRelay() {
   intentionalClose = true;
   protocolV1Available = false;
+  workspaceSnapshotStagingAvailable = false;
+  cancelRelayReconnect();
+  retryAttempt = 0;
   connectPromise = null;
   if (ws) {
     ws.close();
@@ -611,6 +754,7 @@ function ensureConnected() {
   if (connectPromise) return connectPromise;
   connectPromise = new Promise((resolve, reject) => {
     let settled = false;
+    let authRejected = false;
     const sock = new WebSocket(serverURL, {
       ...authToken ? { headers: { Authorization: `Bearer ${authToken}` } } : {}
     });
@@ -634,8 +778,12 @@ function ensureConnected() {
       } catch {
         return;
       }
+      if (msg.task) msg.task = withParticipantRole(msg.task);
+      if (msg.tasks) msg.tasks = msg.tasks.map(withParticipantRole);
       if (msg.type === "registered") {
+        retryAttempt = 0;
         protocolV1Available = msg.protocolVersion === TASK_PROTOCOL_VERSION;
+        workspaceSnapshotStagingAvailable = msg.capabilities?.workspaceSnapshotStaging === true;
         logger.info("registered to relay", { userId: userID, server: serverURL });
         if (!settled) {
           settled = true;
@@ -729,6 +877,7 @@ function ensureConnected() {
       }
     });
     sock.on("error", (err) => {
+      if (/Unexpected server response: 40\d/.test(String(err))) authRejected = true;
       logger.warn("relay socket error", { error: String(err) });
       if (!settled) {
         settled = true;
@@ -755,10 +904,14 @@ function ensureConnected() {
         reject(new Error(`relay connection closed before registration (${code})`));
       }
       if (isCurrentSocket && !intentionalClose) {
-        setTimeout(() => {
-          void ensureConnected().catch(() => {
+        if (authRejected) {
+          logger.warn("relay rejected by server authentication; auto reconnect paused until identity changes", {
+            server: serverURL,
+            authenticated: Boolean(authToken)
           });
-        }, 3e3);
+        } else {
+          scheduleRelayReconnect();
+        }
       }
     });
   });
@@ -887,6 +1040,14 @@ async function delegateTask(envelope) {
   }
   return { task: response.task, warning: response.warning };
 }
+async function finalizeRemoteTaskWorkspace(taskId) {
+  const response = await relayRPC(
+    { type: "task.workspace.ready", protocolVersion: TASK_PROTOCOL_VERSION, taskId },
+    15e3
+  );
+  if (!response.task) throw new Error("relay did not return the finalized task");
+  return { task: response.task, warning: response.warning };
+}
 function relayCapabilities() {
   return {
     agentHost: mcpRegistration?.agentHost ?? (process.env.DESKTOP_PET_AGENT_HOST || "desktop-pet-mcp"),
@@ -1095,6 +1256,9 @@ function stopLease(taskId) {
   if (timer) clearInterval(timer);
   leaseTimers.delete(taskId);
 }
+function withParticipantRole(task) {
+  return { ...task, participantRole: taskParticipantRole(task, userID) };
+}
 function onAsk(msg) {
   if (!msg.questionId || !msg.from || !msg.text) return;
   const task = {
@@ -1168,11 +1332,21 @@ function getDeviceIceServers() {
   return deviceIceServers;
 }
 async function activateStoredDevice() {
-  if (process.env.DESKTOP_PET_TOKEN?.trim()) {
+  const allowRuntimeOverrides = developmentRuntimeOverridesAllowed();
+  if (allowRuntimeOverrides && process.env.DESKTOP_PET_TOKEN?.trim()) {
     startRelay();
     return true;
   }
   const credentials = loadDeviceCredentials();
+  const configuredServer = configuredRelayURL({ allowRuntimeOverrides });
+  if (!allowRuntimeOverrides && credentials && canonicalHTTPRootURL(credentials.serverUrl) !== relayHTTPRootURL(configuredServer)) {
+    logger.warn("stored device credentials belong to a different runtime environment");
+    return false;
+  }
+  if (hasRuntimeServerOverride({ allowRuntimeOverrides }) && (!credentials || canonicalHTTPRootURL(credentials.serverUrl) !== relayHTTPRootURL(configuredServer))) {
+    startRelay();
+    return true;
+  }
   if (!credentials) return false;
   await activateDevice(credentials, false);
   return true;
@@ -1215,7 +1389,7 @@ async function activateDevice(credentials, restart) {
   if (restart) stopRelay();
   const httpURL = new URL(base);
   httpURL.protocol = httpURL.protocol === "https:" ? "wss:" : "ws:";
-  httpURL.pathname = "/ws";
+  httpURL.pathname = `${httpURL.pathname.replace(/\/+$/, "")}/ws`;
   configureRelayIdentity({
     serverUrl: httpURL.toString(),
     userId: credentials.userId,
@@ -1260,14 +1434,20 @@ const deviceAuth = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
 function defaultAccountServerURL(relayURL = configuredRelayURL()) {
   const url = new URL(relayURL);
   url.protocol = url.protocol === "wss:" ? "https:" : "http:";
-  url.pathname = "";
+  url.pathname = url.pathname.replace(/\/ws$/, "");
   url.search = "";
   url.hash = "";
   return url.toString().replace(/\/$/, "");
 }
-function defaultAccountPortalURL(serverUrl) {
-  const override = process.env.DESKTOP_PET_PORTAL_URL?.trim();
-  return override ? normalizeServerURL(override) : serverUrl;
+function defaultAccountPortalURL(allowRuntimeOverrides = true) {
+  const override = allowRuntimeOverrides ? process.env.DESKTOP_PET_PORTAL_URL?.trim() : void 0;
+  if (override) return normalizeServerURL(override);
+  return hasRuntimeServerOverride({ allowRuntimeOverrides }) ? defaultAccountServerURL(configuredRelayURL({ allowRuntimeOverrides })) : OFFICIAL_PORTAL_ORIGIN;
+}
+function preferredAccountServerURL(storedServerURL2, allowRuntimeOverrides = true) {
+  const configured = defaultAccountServerURL(configuredRelayURL({ allowRuntimeOverrides }));
+  if (!allowRuntimeOverrides) return configured;
+  return hasRuntimeServerOverride({ allowRuntimeOverrides }) ? configured : storedServerURL2 ?? configured;
 }
 async function bindDesktopPetToWebSession(server, accessToken) {
   const serverUrl = normalizeServerURL(server);
@@ -1307,7 +1487,7 @@ function normalizeServerURL(value) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new Error("中转服务器地址必须以 http:// 或 https:// 开头");
   }
-  url.pathname = "";
+  url.pathname = url.pathname.replace(/\/+$/, "");
   url.search = "";
   url.hash = "";
   return url.toString().replace(/\/$/, "");
@@ -1408,10 +1588,11 @@ function stopAccountCallbackRouter() {
   callbackNonce = void 0;
 }
 function openAccountWindow(mode) {
-  const serverUrl = storedServerURL() ?? defaultAccountServerURL();
+  const allowRuntimeOverrides = developmentRuntimeOverridesAllowed();
+  const serverUrl = preferredAccountServerURL(storedServerURL(), allowRuntimeOverrides);
   let portalBase;
   try {
-    portalBase = defaultAccountPortalURL(serverUrl);
+    portalBase = defaultAccountPortalURL(allowRuntimeOverrides);
   } catch (error) {
     electron.dialog.showErrorBox("门户地址无效", error instanceof Error ? error.message : "请检查 DESKTOP_PET_PORTAL_URL 配置");
     return;
@@ -1454,15 +1635,16 @@ function handleAccountCallback(url) {
 }
 function logoutDesktopPet() {
   stopRelay();
+  clearRelayIdentity();
   clearDeviceCredentials();
   petManager.refreshLocalIdentityBadges();
   dispatch({ type: "bubble", text: "已退出当前账号" });
 }
 function currentAccountUsername() {
   try {
-    return loadDeviceCredentials()?.userId ?? getAuthenticatedRelayUserId();
+    return getPresentedRelayUserId() ?? loadDeviceCredentials()?.userId ?? getAuthenticatedRelayUserId();
   } catch {
-    return getAuthenticatedRelayUserId();
+    return getPresentedRelayUserId() ?? getAuthenticatedRelayUserId();
   }
 }
 function storedServerURL() {
@@ -1515,22 +1697,27 @@ async function finishWebAuthentication(callbackURL) {
   }
 }
 function copyMcpConfig() {
-  const serverEntry = path.join(electron.app.getAppPath(), "out", "mcp-server", "index.js");
+  const serverEntry = resolveMcpServerEntry(electron.app.isPackaged, electron.app.getAppPath(), process.resourcesPath);
   if (!fs.existsSync(serverEntry)) {
     return { ok: false, message: "MCP server 尚未构建，请先在 app 目录执行 npm run build" };
   }
-  const customPortFile = process.env.DESKTOP_PET_PORT_FILE?.trim();
-  const config = {
+  const config = createMcpConfig(serverEntry, PORT_FILE);
+  electron.clipboard.writeText(JSON.stringify(config, null, 2));
+  return { ok: true, message: "MCP 配置已复制，直接粘贴到 Agent 的 MCP 配置里即可" };
+}
+function createMcpConfig(serverEntry, portFile) {
+  return {
     mcpServers: {
       "desktop-pet": {
         command: "node",
         args: [serverEntry],
-        ...customPortFile ? { env: { DESKTOP_PET_PORT_FILE: PORT_FILE } } : {}
+        env: { DESKTOP_PET_PORT_FILE: portFile }
       }
     }
   };
-  electron.clipboard.writeText(JSON.stringify(config, null, 2));
-  return { ok: true, message: "MCP 配置已复制，直接粘贴到 Agent 的 MCP 配置里即可" };
+}
+function resolveMcpServerEntry(packaged, appPath, resourcesPath) {
+  return packaged ? path.join(resourcesPath, "mcp-server", "index.js") : path.join(appPath, "out", "mcp-server", "index.js");
 }
 const P2P_CHAT_CONNECT_TIMEOUT_MS = 2500;
 let transportWindow;
@@ -1678,17 +1865,15 @@ async function fallbackChat(operationId) {
 }
 const REQUEST_TIMEOUT_MS = 6e3;
 const DOWNLOAD_TIMEOUT_MS = 10 * 6e4;
-const LEGACY_OFFICIAL_HTTP_HOST = "47.94.20.104";
+const MAX_ARTIFACT_BYTES = 2 * 1024 * 1024 * 1024;
 const MAC_BUNDLE_ID = "com.xinshu.desktoppet";
 const MAC_INSTALLED_APP = "/Applications/Desktop Pet.app";
 let status = { kind: "idle" };
 function updateCheckURL() {
-  const override = process.env.DESKTOP_PET_UPDATE_API?.trim();
+  const override = !electron.app.isPackaged ? process.env.DESKTOP_PET_UPDATE_API?.trim() : void 0;
   if (override) return validateUpdateAPIURL(override).toString();
-  const relayURL = updateRelayURL();
-  const url = new URL(relayURL);
-  url.protocol = url.protocol === "wss:" ? "https:" : "http:";
-  url.pathname = "/api/updates/check";
+  const url = updateServiceRootURL(updateServiceURL());
+  url.pathname = `${url.pathname.replace(/\/+$/, "")}/api/updates/check`;
   url.search = "";
   url.hash = "";
   return validateUpdateAPIURL(url.toString()).toString();
@@ -1704,8 +1889,10 @@ async function checkForUpdates(currentVersion = electron.app.getVersion()) {
     endpoint.searchParams.set("platform", process.platform);
     endpoint.searchParams.set("arch", process.arch);
     endpoint.searchParams.set("currentVersion", currentVersion);
+    endpoint.searchParams.set("channel", updateChannel());
+    endpoint.searchParams.set("installationId", await updateInstallationID());
     const response = await electron.net.fetch(endpoint.toString(), {
-      headers: updateCheckHeaders(endpoint),
+      headers: { accept: "application/json" },
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
       cache: "no-store"
     });
@@ -1714,6 +1901,7 @@ async function checkForUpdates(currentVersion = electron.app.getVersion()) {
       throw new Error(body.message || "更新服务器返回异常");
     }
     const update = parseUpdate(body.data.update);
+    if (update) verifyManifestSignature(update);
     if (!update || compareVersions(update.version, currentVersion) <= 0) {
       status = { kind: "up-to-date", checkedAt: Date.now() };
       return status;
@@ -1734,20 +1922,13 @@ async function checkForUpdates(currentVersion = electron.app.getVersion()) {
     return status;
   }
 }
-function updateCheckHeaders(endpoint) {
-  const headers = { accept: "application/json" };
-  try {
-    const auth = getRelayHTTPAuth();
-    if (new URL(auth.baseURL).origin === endpoint.origin) {
-      headers.authorization = `Bearer ${auth.accessToken}`;
-    }
-  } catch {
-  }
-  return headers;
-}
 async function downloadAvailableUpdate() {
   const available = status.kind === "available" ? status.update : void 0;
   if (!available) return status;
+  if (available.signature && (!available.expiresAt || Date.parse(available.expiresAt) < Date.now() - 6e4)) {
+    status = { kind: "error", message: "更新信息已过期，请重新检查", checkedAt: Date.now() };
+    return status;
+  }
   status = { kind: "downloading", update: available, downloadedBytes: 0 };
   const updateDirectory = node_path.join(electron.app.getPath("userData"), "updates");
   const artifactPath = updateArtifactPath(available);
@@ -1755,7 +1936,7 @@ async function downloadAvailableUpdate() {
   try {
     await promises.mkdir(updateDirectory, { recursive: true });
     const response = await electron.net.fetch(available.releaseUrl, {
-      headers: { accept: "application/octet-stream, application/wasm, */*" },
+      headers: { accept: "application/octet-stream, application/wasm, */*", "accept-encoding": "identity" },
       signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
       cache: "no-store",
       redirect: "follow"
@@ -1766,13 +1947,17 @@ async function downloadAvailableUpdate() {
       throw new Error("更新下载地址必须使用 HTTPS");
     }
     const totalBytes = parseContentLength(response.headers.get("content-length"));
+    if (totalBytes && available.sizeBytes && totalBytes !== available.sizeBytes) {
+      throw new Error("更新包大小与发布清单不一致");
+    }
     let downloadedBytes = 0;
     status = { kind: "downloading", update: available, downloadedBytes, totalBytes };
-    const digest = await saveAndHash(response.body, temporaryPath, (chunkBytes) => {
+    const saved = await saveAndHash(response.body, temporaryPath, available.sizeBytes, (chunkBytes) => {
       downloadedBytes += chunkBytes;
       status = { kind: "downloading", update: available, downloadedBytes, totalBytes };
     });
-    if (digest !== available.sha256) throw new Error("更新包校验失败，文件未安装");
+    if (available.sizeBytes && saved.bytes !== available.sizeBytes) throw new Error("更新包大小与发布清单不一致");
+    if (saved.sha256 !== available.sha256) throw new Error("更新包校验失败，文件未安装");
     await promises.rm(artifactPath, { force: true });
     await moveFile(temporaryPath, artifactPath);
     status = { kind: "downloaded", update: available, artifactPath, downloadedAt: Date.now() };
@@ -1843,10 +2028,16 @@ function sha256File(path2) {
     input.on("end", () => resolve(hash.digest("hex")));
   });
 }
-async function saveAndHash(body, destination, onChunk) {
+async function saveAndHash(body, destination, expectedBytes, onChunk) {
   const hash = node_crypto.createHash("sha256");
+  let bytes = 0;
   const meter = new node_stream.Transform({
     transform(chunk, _encoding, done) {
+      bytes += chunk.length;
+      if (bytes > (expectedBytes ?? MAX_ARTIFACT_BYTES)) {
+        done(new Error("更新包超过发布清单声明的大小"));
+        return;
+      }
       hash.update(chunk);
       onChunk(chunk.length);
       done(null, chunk);
@@ -1857,7 +2048,7 @@ async function saveAndHash(body, destination, onChunk) {
     meter,
     node_fs.createWriteStream(destination, { flags: "wx" })
   );
-  return hash.digest("hex");
+  return { sha256: hash.digest("hex"), bytes };
 }
 function parseContentLength(value) {
   if (!value) return void 0;
@@ -1895,12 +2086,50 @@ const { promisify } = require('node:util')
 const [, , parentPidText, sourcePath, expectedSHA256, platform, targetVersion, fallbackExecutable, fallbackArgsJSON] = process.argv
 const parentPid = Number(parentPidText)
 const fallbackArgs = JSON.parse(fallbackArgsJSON || '[]')
-const run = promisify(execFile)
+const tracePath = join(dirname(sourcePath), 'update-helper.log')
+const execute = promisify(execFile)
+
+const trace = (event, fields = {}) => fs.appendFile(
+  tracePath,
+  JSON.stringify({ ts: new Date().toISOString(), pid: process.pid, event, ...fields }) + '\n'
+).catch(() => undefined)
+
+const outputTail = (value) => String(value || '').slice(-2000)
+const run = async (name, executable, args) => {
+  await trace('command-start', { name, executable, args })
+  try {
+    const result = await execute(executable, args)
+    await trace('command-success', {
+      name,
+      stdout: outputTail(result.stdout),
+      stderr: outputTail(result.stderr)
+    })
+    return result
+  } catch (error) {
+    await trace('command-failed', {
+      name,
+      error: String(error),
+      stdout: outputTail(error && error.stdout),
+      stderr: outputTail(error && error.stderr)
+    })
+    throw error
+  }
+}
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 const parentIsRunning = () => {
   try { process.kill(parentPid, 0); return true } catch { return false }
 }
+const waitForParentExit = async () => {
+  const startedAt = Date.now()
+  let checks = 0
+  await trace('waiting-for-parent-exit', { parentPid })
+  while (parentIsRunning()) {
+    checks += 1
+    await sleep(200)
+  }
+  await trace('parent-exited', { parentPid, waitMs: Date.now() - startedAt, checks })
+}
 const sha256 = (path) => new Promise((resolve, reject) => {
   const hash = createHash('sha256')
   const input = createReadStream(path)
@@ -1909,17 +2138,23 @@ const sha256 = (path) => new Promise((resolve, reject) => {
   input.on('end', () => resolve(hash.digest('hex')))
 })
 const restartFallback = () => {
+  void trace('fallback-spawn-requested', { fallbackExecutable, fallbackArgs })
   const env = { ...process.env }
   delete env.ELECTRON_RUN_AS_NODE
   const child = spawn(fallbackExecutable, fallbackArgs, { detached: true, stdio: 'ignore', env })
-  child.on('error', () => undefined)
+  child.on('spawn', () => { void trace('fallback-spawned', { childPid: child.pid }) })
+  child.on('error', (error) => { void trace('fallback-spawn-failed', { error: String(error) }) })
   child.unref()
 }
 const findInstalledMacApp = async () => {
   const plist = join('${MAC_INSTALLED_APP}', 'Contents', 'Info.plist')
-  const bundle = await run('/usr/libexec/PlistBuddy', ['-c', 'Print :CFBundleIdentifier', plist])
-  const version = await run('/usr/libexec/PlistBuddy', ['-c', 'Print :CFBundleShortVersionString', plist])
-  if (bundle.stdout.trim() !== '${MAC_BUNDLE_ID}' || version.stdout.trim() !== targetVersion) {
+  await trace('installed-app-check-start', { plist, expectedBundle: '${MAC_BUNDLE_ID}', expectedVersion: targetVersion })
+  const bundle = await run('read-bundle-id', '/usr/libexec/PlistBuddy', ['-c', 'Print :CFBundleIdentifier', plist])
+  const version = await run('read-bundle-version', '/usr/libexec/PlistBuddy', ['-c', 'Print :CFBundleShortVersionString', plist])
+  const actualBundle = bundle.stdout.trim()
+  const actualVersion = version.stdout.trim()
+  await trace('installed-app-check-result', { actualBundle, actualVersion })
+  if (actualBundle !== '${MAC_BUNDLE_ID}' || actualVersion !== targetVersion) {
     throw new Error('installed app identity or version does not match the verified update')
   }
   return '${MAC_INSTALLED_APP}'
@@ -1928,7 +2163,18 @@ const restartInstalledApp = async () => {
   if (platform === 'darwin') {
     // PKG 禁止重定位；安装后再次核对固定路径的 bundle ID 与版本再启动。
     const installedApp = await findInstalledMacApp()
-    await run('/usr/bin/open', ['-n', installedApp])
+    // 不要使用 open -n：它会强制创建第二个实例，而主进程的单实例锁
+    // 会让这个新进程立即退出，表现为 Dock 图标闪一下就消失。
+    // 后台更新助手调用 LaunchServices 时可能只返回成功但没有真正拉起应用。
+    // 直接启动已经核对过的 bundle executable，避免依赖 open 的 GUI 会话。
+    const executable = join(installedApp, 'Contents', 'MacOS', 'Desktop Pet')
+    await trace('direct-launch-requested', { installedApp, executable })
+    const env = { ...process.env }
+    delete env.ELECTRON_RUN_AS_NODE
+    const child = spawn(executable, [], { detached: true, stdio: 'ignore', env })
+    child.on('spawn', () => { void trace('direct-launch-spawned', { childPid: child.pid }) })
+    child.on('error', (error) => { void trace('direct-launch-failed', { error: String(error) }) })
+    child.unref()
     return
   }
   restartFallback()
@@ -1938,32 +2184,50 @@ const shellQuote = (value) => "'" + value.replace(/'/g, "'\\''") + "'"
 async function install() {
   if (platform === 'darwin') {
     const command = '/usr/sbin/installer -pkg ' + shellQuote(sourcePath) + ' -target /'
-    await run('/usr/bin/osascript', ['-e', 'do shell script ' + JSON.stringify(command) + ' with administrator privileges'])
+    await run('install-macos-pkg', '/usr/bin/osascript', ['-e', 'do shell script ' + JSON.stringify(command) + ' with administrator privileges'])
     return
   }
   if (platform === 'win32') {
     // 发布端须提供支持 /S 静默安装的签名 NSIS 安装器。
-    await run(sourcePath, ['/S'])
+    await run('install-windows-exe', sourcePath, ['/S'])
     return
   }
   throw new Error('unsupported platform')
 }
 
 async function main() {
-  while (parentIsRunning()) await sleep(200)
+  await trace('helper-start', {
+    parentPid,
+    sourcePath,
+    expectedSHA256,
+    platform,
+    targetVersion,
+    fallbackExecutable,
+    fallbackArgs
+  })
+  await waitForParentExit()
 
   let installed = false
   try {
-    if (await sha256(sourcePath) !== expectedSHA256) throw new Error('downloaded update hash changed')
+    await trace('hash-check-start', { sourcePath })
+    const actualSHA256 = await sha256(sourcePath)
+    await trace('hash-check-result', { matches: actualSHA256 === expectedSHA256 })
+    if (actualSHA256 !== expectedSHA256) throw new Error('downloaded update hash changed')
+    await trace('install-start', { platform, targetVersion })
     await install()
     installed = true
+    await trace('install-success', { platform, targetVersion })
   } catch (error) {
+    await trace('install-failed', { error: String(error) })
     await fs.writeFile(join(dirname(sourcePath), 'last-install-error.log'), String(error)).catch(() => undefined)
   } finally {
     if (installed) {
       try {
+        await trace('restart-start', { platform, targetVersion })
         await restartInstalledApp()
+        await trace('restart-command-finished', { platform, targetVersion })
       } catch (error) {
+        await trace('restart-failed', { error: String(error) })
         await fs.writeFile(join(dirname(sourcePath), 'last-restart-error.log'), String(error)).catch(() => undefined)
         restartFallback()
       }
@@ -1973,7 +2237,10 @@ async function main() {
   }
 }
 
-main().catch(() => restartFallback())
+main().catch(async (error) => {
+  await trace('helper-failed', { error: String(error) })
+  restartFallback()
+})
 `;
 function installerExtension(releaseUrl) {
   const pathname = new URL(releaseUrl).pathname.toLowerCase();
@@ -1989,23 +2256,30 @@ function storedRelayURL() {
     return void 0;
   }
 }
-function updateRelayURL() {
+function updateServiceURL() {
+  if (electron.app.isPackaged) return OFFICIAL_SERVER_ROOT;
+  if (hasRuntimeServerOverride()) return configuredRelayURL();
   const stored = storedRelayURL();
-  if (stored && !isLegacyOfficialHTTPURL(stored)) return stored;
+  if (stored && !isLegacyOfficialServerURL(stored)) return stored;
   return configuredRelayURL();
 }
-function isLegacyOfficialHTTPURL(value) {
-  try {
-    const url = new URL(value);
-    return url.protocol === "http:" && url.hostname === LEGACY_OFFICIAL_HTTP_HOST;
-  } catch {
-    return false;
+function updateServiceRootURL(value) {
+  const url = new URL(value);
+  if (url.protocol === "wss:") url.protocol = "https:";
+  else if (url.protocol === "ws:") url.protocol = "http:";
+  else if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error("更新服务器地址格式无效");
   }
+  url.pathname = url.pathname.replace(/\/ws\/?$/, "").replace(/\/+$/, "");
+  url.search = "";
+  url.hash = "";
+  return url;
 }
 function validateUpdateAPIURL(value) {
   const url = new URL(value);
   const local = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "::1";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && local && !electron.app.isPackaged)) {
+  const officialHTTPTunnel = isLegacyOfficialServerURL(value);
+  if (url.protocol !== "https:" && !(officialHTTPTunnel || url.protocol === "http:" && local && !electron.app.isPackaged)) {
     throw new Error("更新服务器必须使用 HTTPS");
   }
   return url;
@@ -2021,15 +2295,128 @@ function parseUpdate(value) {
   }
   const url = new URL(releaseUrl);
   if (url.protocol !== "https:") throw new Error("更新下载地址必须使用 HTTPS");
+  const sizeBytes = optionalPositiveInteger(value.sizeBytes);
+  if (sizeBytes && sizeBytes > MAX_ARTIFACT_BYTES) throw new Error("更新包超过客户端允许的最大大小");
+  const signature = parseManifestSignature(value.signature);
   return {
+    releaseId: optionalString(value.releaseId),
+    channel: optionalString(value.channel),
+    platform: optionalString(value.platform),
+    arch: optionalString(value.arch),
     version,
     releaseUrl: url.toString(),
     sha256: sha256.toLowerCase(),
+    sizeBytes,
     notes: optionalString(value.notes),
     publishedAt: optionalString(value.publishedAt),
-    mandatory: value.mandatory === true
+    expiresAt: optionalString(value.expiresAt),
+    mandatory: value.mandatory === true,
+    signature
   };
 }
+function optionalPositiveInteger(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (!Number.isSafeInteger(value) || Number(value) <= 0) {
+    throw new Error("更新信息包含无效的安装包大小");
+  }
+  return Number(value);
+}
+function parseManifestSignature(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (!isRecord(value)) throw new Error("更新清单签名格式无效");
+  const keyId = asString(value.keyId);
+  const algorithm = asString(value.algorithm);
+  const signature = asString(value.value);
+  if (!keyId || algorithm !== "ed25519" || !/^[A-Za-z0-9+/]{86}==$/.test(signature)) {
+    throw new Error("更新清单签名格式无效");
+  }
+  return { keyId, algorithm, value: signature };
+}
+function verifyManifestSignature(update) {
+  const trustedKeys = trustedManifestPublicKeys();
+  if (!update.signature) {
+    if (electron.app.isPackaged || Object.keys(trustedKeys).length > 0) throw new Error("更新清单缺少可信签名");
+    return;
+  }
+  if (!update.releaseId || !update.channel || !update.platform || !update.arch || !update.sizeBytes || !update.publishedAt || !update.expiresAt) {
+    throw new Error("签名更新清单缺少必要字段");
+  }
+  if (update.channel !== updateChannel() || update.platform !== process.platform || update.arch !== process.arch) {
+    throw new Error("更新清单与当前渠道或平台不匹配");
+  }
+  const expiresAt = Date.parse(update.expiresAt);
+  if (!Number.isFinite(expiresAt) || expiresAt < Date.now() - 6e4) {
+    throw new Error("更新清单已过期，请重新检查");
+  }
+  const encodedKey = trustedKeys[update.signature.keyId];
+  if (!encodedKey) throw new Error(`更新清单使用了不受信任的签名密钥：${update.signature.keyId}`);
+  try {
+    const publicKey = node_crypto.createPublicKey({ key: Buffer.from(encodedKey, "base64"), format: "der", type: "spki" });
+    const payload = JSON.stringify([
+      update.releaseId,
+      update.channel,
+      update.platform,
+      update.arch,
+      update.version,
+      update.releaseUrl,
+      update.sha256,
+      update.sizeBytes,
+      update.notes ?? "",
+      update.publishedAt,
+      update.expiresAt,
+      update.mandatory
+    ]).replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+    if (!node_crypto.verify(null, Buffer.from(payload), publicKey, Buffer.from(update.signature.value, "base64"))) {
+      throw new Error("signature mismatch");
+    }
+  } catch (error) {
+    logger.warn("update manifest signature rejected", { error: String(error), keyId: update.signature.keyId });
+    throw new Error("更新清单签名验证失败");
+  }
+}
+function trustedManifestPublicKeys() {
+  const embedded = '{"primary-2026":"MCowBQYDK2VwAyEAtXVi15v8FHIVJeGKf4Fjm94PGr1GzRFAStC7N2utTkc="}';
+  const encoded = !electron.app.isPackaged && embedded === "{}" ? process.env.DESKTOP_PET_UPDATE_PUBLIC_KEYS_JSON?.trim() || embedded : embedded;
+  try {
+    const parsed = JSON.parse(encoded);
+    if (!isRecord(parsed)) return {};
+    return Object.fromEntries(Object.entries(parsed).filter((entry) => entry[0].length > 0 && typeof entry[1] === "string" && entry[1].length > 0));
+  } catch {
+    return {};
+  }
+}
+function updateChannel() {
+  const channel = process.env.DESKTOP_PET_UPDATE_CHANNEL?.trim() || "stable";
+  return /^[a-z][a-z0-9-]{0,31}$/.test(channel) ? channel : "stable";
+}
+let cachedInstallationID;
+async function updateInstallationID() {
+  if (cachedInstallationID) return cachedInstallationID;
+  const path2 = node_path.join(electron.app.getPath("userData"), "update-installation-id");
+  let replaceInvalidFile = false;
+  try {
+    const stored = (await promises.readFile(path2, "utf8")).trim();
+    if (/^[0-9a-f-]{36}$/i.test(stored)) {
+      cachedInstallationID = stored;
+      return stored;
+    }
+    replaceInvalidFile = true;
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      logger.warn("could not read update installation id", { error: String(error) });
+    }
+  }
+  const created = node_crypto.randomUUID();
+  await promises.mkdir(electron.app.getPath("userData"), { recursive: true });
+  try {
+    await promises.writeFile(path2, created, { flag: replaceInvalidFile ? "w" : "wx", mode: 384 });
+    cachedInstallationID = created;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    cachedInstallationID = (await promises.readFile(path2, "utf8")).trim();
+  }
+  return cachedInstallationID;
+}
 function asString(value) {
   return typeof value === "string" ? value.trim() : "";
 }
@@ -2250,7 +2637,9 @@ function createPetWindow(skin, options) {
 }
 function updateMenuLabel() {
   const status2 = getUpdateStatus();
-  if (status2.kind === "available") return `软件更新（v${status2.update.version} 可下载）`;
+  if (status2.kind === "available") {
+    return status2.update.mandatory ? `软件更新（必须升级到 v${status2.update.version}）` : `软件更新（v${status2.update.version} 可下载）`;
+  }
   if (status2.kind === "downloading") {
     return `软件更新（v${status2.update.version} 下载 ${downloadProgressText(status2)}）`;
   }
@@ -2266,7 +2655,8 @@ function updateMenuItems(petId) {
       click: () => {
         void checkForUpdates().then((result) => {
           if (result.kind === "available") {
-            dispatch({ type: "bubble", text: `发现 v${result.update.version}，可从“软件更新”安装`, ttl: 6e3 }, petId);
+            const message = result.update.mandatory ? `v${result.update.version} 是必须安装的重要更新` : `发现 v${result.update.version}，可从“软件更新”安装`;
+            dispatch({ type: "bubble", text: message, ttl: result.update.mandatory ? 9e3 : 6e3 }, petId);
           } else if (result.kind === "up-to-date") {
             dispatch({ type: "bubble", text: "已经是最新版本啦", ttl: 4500 }, petId);
           } else if (result.kind === "downloading") {
@@ -2500,11 +2890,13 @@ function isRelayCommand(raw) {
   const t = raw.type;
   return t === "ask" || t === "list_tasks" || t === "wait_task" || t === "answer" || t === "delegate_task" || t === "get_task" || t === "wait_task_result" || t === "claim_task" || t === "submit_task_result" || t === "cancel_task" || t === "list_remote_tasks" || t === "request_task_context" || t === "supply_task_context" || t === "configure_device" || t === "register_mcp_client" || t === "upload_relay_artifact" || t === "download_relay_artifact";
 }
+const RELAY_BLOB_TRANSFER_TIMEOUT_MS = 10 * 6e4;
 async function uploadRelayBlob(input) {
   if (input.kind === "patch" && !input.baseCommit) throw new Error("patch artifact requires baseCommit");
   const auth = getRelayHTTPAuth();
   const peersResponse = await fetch(`${auth.baseURL}/api/tasks/${encodeURIComponent(input.taskId)}/peer-keys`, {
-    headers: { Authorization: `Bearer ${auth.accessToken}` }
+    headers: { Authorization: `Bearer ${auth.accessToken}` },
+    signal: AbortSignal.timeout(15e3)
   });
   const peersBody = await peersResponse.json();
   if (!peersResponse.ok) throw new Error(peersBody.message || "unable to load peer encryption keys");
@@ -2513,6 +2905,7 @@ async function uploadRelayBlob(input) {
   const encrypted = encryptForRecipients(input.bytes, peers);
   const artifactId = input.artifactId ?? node_crypto.randomUUID();
   const sha256 = node_crypto.createHash("sha256").update(input.bytes).digest("hex");
+  const normalizedKind = normalizeResultKind(input.kind);
   const response = await fetch(
     `${auth.baseURL}/api/tasks/${encodeURIComponent(input.taskId)}/artifacts/${encodeURIComponent(artifactId)}`,
     {
@@ -2523,17 +2916,18 @@ async function uploadRelayBlob(input) {
         "X-Artifact-Size": String(input.bytes.byteLength),
         "X-Artifact-SHA256": sha256,
         "X-Artifact-Direction": input.direction,
-        "X-Artifact-Kind": input.kind,
+        "X-Artifact-Kind": normalizedKind,
         "X-Artifact-Mime": input.mimeType,
         "X-Artifact-Key-Wraps": Buffer.from(JSON.stringify(encrypted.keyWraps)).toString("base64url")
       },
-      body: Buffer.from(encrypted.ciphertext)
+      body: Buffer.from(encrypted.ciphertext),
+      signal: AbortSignal.timeout(RELAY_BLOB_TRANSFER_TIMEOUT_MS)
     }
   );
   if (!response.ok) throw new Error(`relay blob upload failed (${response.status})`);
   return {
     id: artifactId,
-    kind: normalizeResultKind(input.kind),
+    kind: normalizedKind,
     path: input.path,
     mimeType: input.mimeType,
     size: input.bytes.byteLength,
@@ -2550,7 +2944,10 @@ async function downloadRelayBlob(taskId, artifact) {
   const auth = getRelayHTTPAuth();
   const response = await fetch(
     `${auth.baseURL}/api/tasks/${encodeURIComponent(taskId)}/artifacts/${encodeURIComponent(artifact.id)}`,
-    { headers: { Authorization: `Bearer ${auth.accessToken}` } }
+    {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+      signal: AbortSignal.timeout(RELAY_BLOB_TRANSFER_TIMEOUT_MS)
+    }
   );
   if (!response.ok) throw new Error(`relay blob download failed (${response.status})`);
   const metadataEncoded = response.headers.get("x-artifact-metadata") ?? "";
@@ -2848,8 +3245,59 @@ async function handleRelay(cmd, res) {
       return;
     }
     case "delegate_task": {
-      const { task, warning } = await delegateTask(cmd.envelope);
-      ok(res, { task, warning });
+      if (cmd.workspaceSnapshot && !isWorkspaceSnapshotStagingAvailable()) {
+        throw new Error("当前中转服务器尚未支持安全的工作区快照门控，请先升级服务端");
+      }
+      const created = await delegateTask(cmd.envelope);
+      if (!cmd.workspaceSnapshot) {
+        ok(res, created);
+        return;
+      }
+      if (created.task.taskId !== cmd.envelope.taskId) {
+        if (created.task.status !== "created") {
+          ok(res, created);
+          return;
+        }
+        throw new Error("idempotencyKey 对应的旧任务仍在等待原工作区快照；请使用新的 idempotencyKey 重新派发");
+      }
+      if (created.task.status !== "created") {
+        await cancelRemoteTask(created.task.taskId).catch(() => void 0);
+        throw new Error("当前中转服务器不支持工作区快照上传前门控；已取消任务，请先升级服务端");
+      }
+      const declared = created.task.envelope.context.items.find(isWorkspaceSnapshotContextItem);
+      if (!declared || declared.id !== cmd.workspaceSnapshot.artifactId) {
+        await cancelRemoteTask(created.task.taskId).catch(() => void 0);
+        throw new Error("本地工作区快照与任务声明不一致");
+      }
+      try {
+        const source = resolveWorkspaceFile(
+          cmd.workspaceSnapshot.workspaceRoot,
+          cmd.workspaceSnapshot.path,
+          true
+        );
+        const uploaded = await uploadRelayBlob({
+          taskId: created.task.taskId,
+          artifactId: cmd.workspaceSnapshot.artifactId,
+          bytes: fs.readFileSync(source),
+          direction: "context",
+          kind: "file",
+          mimeType: declared.mimeType,
+          path: declared.path
+        });
+        if (uploaded.id !== declared.id || uploaded.size !== declared.size || uploaded.sha256 !== declared.sha256 || uploaded.artifactRef !== declared.artifactRef) {
+          throw new Error("加密工作区快照上传结果与任务声明不一致");
+        }
+        const finalized = await finalizeRemoteTaskWorkspace(created.task.taskId);
+        ok(res, finalized);
+      } catch (err) {
+        const current = await getRemoteTask(created.task.taskId).catch(() => void 0);
+        if (current && current.status !== "created") {
+          ok(res, { task: current });
+          return;
+        }
+        await cancelRemoteTask(created.task.taskId).catch(() => void 0);
+        throw err;
+      }
       return;
     }
     case "register_mcp_client": {
@@ -3141,32 +3589,6 @@ async function dutyLoop(adapter) {
     }
   }
 }
-const PRODUCT_DATA_DIRECTORY = "Desktop Pet";
-const LEGACY_NPM_DATA_DIRECTORY = "desktop-pet-app";
-function configureRuntimeIdentity() {
-  const profileDirectory = process.env.DESKTOP_PET_PROFILE?.trim();
-  if (profileDirectory) {
-    electron.app.setPath("userData", node_path.resolve(profileDirectory));
-    return;
-  }
-  if (!electron.app.isPackaged && process.env.DESKTOP_PET_NPM_DISTRIBUTION !== "1") return;
-  const appDataDirectory = electron.app.getPath("appData");
-  const canonicalDirectory = node_path.join(appDataDirectory, PRODUCT_DATA_DIRECTORY);
-  if (process.env.DESKTOP_PET_NPM_DISTRIBUTION === "1") {
-    migrateLegacyNpmData(node_path.join(appDataDirectory, LEGACY_NPM_DATA_DIRECTORY), canonicalDirectory);
-  }
-  electron.app.setPath("userData", canonicalDirectory);
-}
-function migrateLegacyNpmData(legacyDirectory, canonicalDirectory) {
-  if (!node_fs.existsSync(legacyDirectory) || node_fs.existsSync(canonicalDirectory)) return false;
-  try {
-    node_fs.renameSync(legacyDirectory, canonicalDirectory);
-    return true;
-  } catch (error) {
-    console.warn(`无法迁移 Desktop Pet 用户数据：${String(error)}`);
-    return false;
-  }
-}
 const trayIcon1xPath = path.join(__dirname, "./chunks/tray-iconTemplate-BIK86F-0.png");
 const trayIcon2xPath = path.join(__dirname, "./chunks/tray-iconTemplate@2x-B19HpcaE.png");
 let tray;
@@ -3201,20 +3623,46 @@ function createPetTemplateImage() {
   return image;
 }
 configureRuntimeIdentity();
+function errorFields(error) {
+  if (error instanceof Error) return { error: error.toString(), stack: error.stack };
+  return { error: String(error) };
+}
+logger.info("app bootstrap", {
+  pid: process.pid,
+  ppid: process.ppid,
+  platform: process.platform,
+  arch: process.arch,
+  isPackaged: electron.app.isPackaged,
+  execPath: process.execPath,
+  resourcesPath: process.resourcesPath,
+  argv: process.argv.slice(1),
+  userData: electron.app.getPath("userData")
+});
+process.on("uncaughtException", (error) => {
+  logger.error("uncaught exception", errorFields(error));
+});
+process.on("unhandledRejection", (reason) => {
+  logger.error("unhandled rejection", errorFields(reason));
+});
 if (process.platform !== "win32") {
   process.once("SIGTERM", () => electron.app.quit());
 }
 registerAccountProtocol();
 const singleInstance = electron.app.requestSingleInstanceLock();
+let activationRequestedBeforeReady = false;
 if (!singleInstance) {
-  logger.warn("another instance is running, quitting");
+  logger.warn("another instance is running, quitting", {
+    pid: process.pid,
+    execPath: process.execPath,
+    argv: process.argv.slice(1)
+  });
   electron.app.quit();
 } else {
   electron.app.on("second-instance", (_event, argv) => {
+    logger.warn("second instance received", { argv });
     const callback = argv.find((value) => value.startsWith("desktop-pet://"));
     if (callback) handleAccountCallback(callback);
-    petManager.setPetsVisible(true);
-    ensurePrimaryPet();
+    restorePetsOnAppActivation();
   });
 }
 function ensurePrimaryPet() {
@@ -3223,30 +3671,84 @@ function ensurePrimaryPet() {
     identity: { kind: "primary" }
   });
 }
+function hideMacDockIcon() {
+  if (process.platform !== "darwin") return;
+  if (electron.app.dock.isVisible()) electron.app.dock.hide();
+}
+function restorePetsOnAppActivation() {
+  if (!electron.app.isReady()) {
+    activationRequestedBeforeReady = true;
+    logger.info("app activation deferred until ready");
+    return;
+  }
+  const visibleBefore = petManager.arePetsVisible();
+  const petsBefore = petManager.count();
+  const appHiddenBefore = process.platform === "darwin" ? electron.app.isHidden() : void 0;
+  if (process.platform === "darwin") electron.app.show();
+  petManager.setPetsVisible(true);
+  const firstPet = ensurePrimaryPet();
+  hideMacDockIcon();
+  logger.info("pets restored on app activation", {
+    appHiddenBefore,
+    appHiddenAfter: process.platform === "darwin" ? electron.app.isHidden() : void 0,
+    dockVisibleAfter: process.platform === "darwin" ? electron.app.dock.isVisible() : void 0,
+    visibleBefore,
+    visibleAfter: petManager.arePetsVisible(),
+    petsBefore,
+    petsAfter: petManager.count(),
+    firstPet
+  });
+}
+if (process.platform === "darwin") {
+  electron.app.on("activate", () => {
+    logger.info("app activated");
+    restorePetsOnAppActivation();
+  });
+}
 electron.app.whenReady().then(async () => {
+  logger.info("app ready");
+  hideMacDockIcon();
+  logger.info("macOS dock icon state", {
+    visible: process.platform === "darwin" ? electron.app.dock.isVisible() : void 0
+  });
   createMenuBar();
+  logger.info("menu bar created");
   await startAccountCallbackRouter();
+  logger.info("account callback router started");
   startEventServer(electron.app.getVersion());
+  logger.info("event server start requested");
   const activated = await activateStoredDevice().catch((err) => {
     logger.warn("device authentication failed", { error: String(err) });
     return false;
   });
+  logger.info("device activation finished", { activated });
   if (!activated) startRelay();
+  logger.info("relay start requested", { authenticated: activated });
   if (process.env.DESKTOP_PET_P2P !== "0") startP2PWindow(getDeviceIceServers());
+  logger.info("p2p start requested", { enabled: process.env.DESKTOP_PET_P2P !== "0" });
   void startRunnerManager();
   const id = ensurePrimaryPet();
+  logger.info("primary pet initialization finished", { firstPet: id });
+  if (activationRequestedBeforeReady) {
+    activationRequestedBeforeReady = false;
+    restorePetsOnAppActivation();
+  }
   setTimeout(() => {
     void checkForUpdates().then((result) => {
+      logger.info("update check finished", { kind: result.kind });
       if (id && result.kind === "available") {
         dispatch({
           type: "bubble",
-          text: `发现 v${result.update.version}，右键“软件更新”可请求下载`,
-          ttl: 7e3
+          text: result.update.mandatory ? `v${result.update.version} 是必须安装的重要更新，请从右键“软件更新”完成升级` : `发现 v${result.update.version}，右键“软件更新”可请求下载`,
+          ttl: result.update.mandatory ? 12e3 : 7e3
         }, id);
       }
     });
   }, 1200);
   logger.info("app started", { firstPet: id });
+}).catch((error) => {
+  logger.error("app startup failed", errorFields(error));
+  electron.app.exit(1);
 });
 electron.app.on("window-all-closed", () => {
   if (process.platform !== "darwin") electron.app.quit();
@@ -3260,3 +3762,10 @@ electron.app.on("quit", () => {
   void stopEventServer().catch((err) => logger.warn("event server shutdown failed", { error: String(err) }));
   logger.info("app quit");
 });
+electron.app.on("render-process-gone", (_event, webContents, details) => {
+  logger.error("render process gone", {
+    reason: details.reason,
+    exitCode: details.exitCode,
+    url: webContents.getURL()
+  });
+});