linkshell-cli 0.10.45 → 0.10.47

package/README.md

@@ -25,6 +25,8 @@ Connect your phone one of two ways:
   linkshell pair    # scan the QR code in the app
   ```
 
+Signed-in Free accounts can redeem a Pro activation code in the LinkShell phone app, Mac app or web workspace's account controls, or under Connection Settings → Membership & activation codes in Apple Watch independent mode. [Buy a code on Liandong Xiaopu](https://pay.ldxp.cn/item/7lgv1s). [iTool Settings → Upgrade to Pro](https://itool.tech/en/settings) remains available with the same account, including for renewing an active Pro membership.
+
 Start sessions from the phone, or launch agents from your terminal so they can be handed over at any time:
 
 ```bash

package/dist/cli/src/auth.d.ts

@@ -16,8 +16,12 @@ export { SUPABASE_URL, SUPABASE_ANON_KEY };
  * Refresh the access token using the refresh token.
  * Returns updated tokens or null if refresh failed.
  */
-export declare function refreshAccessToken(): Promise<AuthTokens | null>;
+export declare function refreshAccessToken(options?: {
+    signal?: AbortSignal;
+}): Promise<AuthTokens | null>;
 /**
  * Get a valid access token, refreshing if needed.
  */
-export declare function getValidToken(): Promise<string | null>;
+export declare function getValidToken(options?: {
+    signal?: AbortSignal;
+}): Promise<string | null>;

package/dist/cli/src/auth.js

@@ -43,7 +43,9 @@ let inflightRefresh = null;
  * Refresh the access token using the refresh token.
  * Returns updated tokens or null if refresh failed.
  */
-export async function refreshAccessToken() {
+export async function refreshAccessToken(options = {}) {
+    if (options.signal?.aborted)
+        return null;
     if (inflightRefresh)
         return inflightRefresh;
     inflightRefresh = (async () => {
@@ -60,7 +62,7 @@ export async function refreshAccessToken() {
                     apikey: SUPABASE_ANON_KEY,
                 },
                 body: JSON.stringify({ refresh_token: auth.refreshToken }),
-                signal: AbortSignal.timeout(30_000),
+                signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(30_000)]) : AbortSignal.timeout(30_000),
             });
             if (!res.ok)
                 return null;
@@ -72,6 +74,10 @@ export async function refreshAccessToken() {
                 userId: body.user.id,
                 email: body.user.email ?? auth.email,
             };
+            // A login or logout may finish while the refresh is in flight.
+            const current = loadAuth();
+            if (options.signal?.aborted || tokens.userId !== auth.userId || current?.userId !== auth.userId || current.refreshToken !== auth.refreshToken)
+                return null;
             saveAuth(tokens);
             return tokens;
         }
@@ -86,13 +92,15 @@ export async function refreshAccessToken() {
 /**
  * Get a valid access token, refreshing if needed.
  */
-export async function getValidToken() {
+export async function getValidToken(options = {}) {
+    if (options.signal?.aborted)
+        return null;
     const auth = loadAuth();
     if (!auth)
         return null;
     // If token expires in less than 120s, refresh
     if (auth.expiresAt - Date.now() < 120_000) {
-        const refreshed = await refreshAccessToken();
+        const refreshed = await refreshAccessToken(options);
         return refreshed?.accessToken ?? null;
     }
     return auth.accessToken;

package/dist/cli/src/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAU9C,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAe,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAkB;IACzC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QAC/D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,YAAY,GAAG,0CAA0C,CAAC;AAChE,MAAM,iBAAiB,GACrB,kNAAkN,CAAC;AAErN,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAE3C,IAAI,eAAe,GAAsC,IAAI,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,YAAY;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,YAAY,yCAAyC,EACxD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAC;YACF,MAAM,MAAM,GAAe;gBACzB,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBAC9C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK;aACrC,CAAC;YACF,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAChB,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,8CAA8C;IAC9C,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,OAAO,SAAS,EAAE,WAAW,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAU9C,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAe,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAkB;IACzC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QAC/D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,YAAY,GAAG,0CAA0C,CAAC;AAChE,MAAM,iBAAiB,GACrB,kNAAkN,CAAC;AAErN,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAE3C,IAAI,eAAe,GAAsC,IAAI,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAoC,EAAE;IAC7E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,YAAY;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,YAAY,yCAAyC,EACxD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1D,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACtH,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAC;YACF,MAAM,MAAM,GAAe;gBACzB,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBAC9C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK;aACrC,CAAC;YACF,+DAA+D;YAC/D,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC3J,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAChB,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAoC,EAAE;IACxE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,8CAA8C;IAC9C,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,SAAS,EAAE,WAAW,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC"}

package/dist/cli/src/commands/desktop-workspace-state.d.ts

@@ -0,0 +1,19 @@
+import { type Identity } from "@linkshell/wire";
+interface DesktopState {
+    schema: 1;
+    identity: Identity;
+    storage: Record<string, unknown>;
+}
+export declare function validStorageKey(key: unknown): key is string;
+/** The browser origin changes on every launch; paired identity and drafts must not. */
+export declare class DesktopClientState {
+    private readonly file;
+    private value;
+    private writes;
+    private constructor();
+    static open(home: string): Promise<DesktopClientState>;
+    snapshot(): Pick<DesktopState, "identity" | "storage">;
+    set(key: string, value: unknown): Promise<void>;
+    flush(): Promise<void>;
+}
+export {};

package/dist/cli/src/commands/desktop-workspace-state.js

@@ -0,0 +1,92 @@
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { createIdentity, idOf, sign, verifySignature } from "@linkshell/wire";
+const MAX_STATE_BYTES = 8 * 1024 * 1024;
+const MAX_KEYS = 2048;
+export function validStorageKey(key) {
+    return typeof key === "string" && key.length > 0 && key.length <= 1024 &&
+        [...key].every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127) &&
+        !["__proto__", "prototype", "constructor"].includes(key);
+}
+function validIdentity(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const identity = value;
+    if (![identity.id, identity.signKey, identity.boxKey, identity.signSecret, identity.boxSecret]
+        .every((part) => typeof part === "string" && /^[A-Za-z0-9_-]{16,128}$/.test(part)))
+        return false;
+    try {
+        return idOf(identity.signKey) === identity.id &&
+            verifySignature(identity.signKey, "linkshell-desktop-identity", sign(identity, "linkshell-desktop-identity"));
+    }
+    catch {
+        return false;
+    }
+}
+/** The browser origin changes on every launch; paired identity and drafts must not. */
+export class DesktopClientState {
+    file;
+    value;
+    writes = Promise.resolve();
+    constructor(file, value) {
+        this.file = file;
+        this.value = value;
+    }
+    static async open(home) {
+        await mkdir(home, { recursive: true, mode: 0o700 });
+        const file = join(home, "desktop-client.json");
+        try {
+            const initial = { schema: 1, identity: createIdentity(), storage: {} };
+            await writeFile(file, JSON.stringify(initial), { flag: "wx", mode: 0o600 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        if ((await stat(file)).size > MAX_STATE_BYTES)
+            throw new Error("桌面偏好文件过大，请检查本地存储");
+        const value = JSON.parse(await readFile(file, "utf8"));
+        if (value.schema !== 1 || !validIdentity(value.identity) || !value.storage || typeof value.storage !== "object" ||
+            Array.isArray(value.storage) || Object.keys(value.storage).some((key) => !validStorageKey(key))) {
+            // Replacing a damaged identity would silently lose every existing pairing.
+            throw new Error("桌面设备身份文件无法读取，请保留此文件并检查本地存储");
+        }
+        await chmod(file, 0o600);
+        return new DesktopClientState(file, value);
+    }
+    snapshot() {
+        return { identity: this.value.identity, storage: this.value.storage };
+    }
+    set(key, value) {
+        if (!validStorageKey(key))
+            return Promise.reject(new Error("无效的偏好名称"));
+        const write = this.writes.then(async () => {
+            const storage = { ...this.value.storage };
+            if (value === null)
+                delete storage[key];
+            else
+                storage[key] = value;
+            if (Object.keys(storage).length > MAX_KEYS)
+                throw new Error("桌面偏好条目过多");
+            const next = { ...this.value, storage };
+            const text = JSON.stringify(next);
+            if (Buffer.byteLength(text) > MAX_STATE_BYTES)
+                throw new Error("桌面偏好存储空间已满");
+            const temporary = `${this.file}.${randomBytes(12).toString("hex")}.tmp`;
+            try {
+                await writeFile(temporary, text, { flag: "wx", mode: 0o600 });
+                await rename(temporary, this.file);
+                this.value = next;
+            }
+            finally {
+                await rm(temporary, { force: true });
+            }
+        });
+        // A rejected write must not prevent later, smaller preferences from saving.
+        this.writes = write.catch(() => { });
+        return write;
+    }
+    async flush() { await this.writes; }
+}
+//# sourceMappingURL=desktop-workspace-state.js.map

package/dist/cli/src/commands/desktop-workspace-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-workspace-state.js","sourceRoot":"","sources":["../../../../src/commands/desktop-workspace-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAiB,MAAM,iBAAiB,CAAC;AAE7F,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,QAAQ,GAAG,IAAI,CAAC;AAQtB,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI;QACpE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QAC/F,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAiB,CAAC;IACnC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC;SAC3F,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnG,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE;YAC3C,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,4BAA4B,EAAE,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,uFAAuF;AACvF,MAAM,OAAO,kBAAkB;IAGQ;IAAsB;IAFnD,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAElD,YAAqC,IAAY,EAAU,KAAmB;QAAzC,SAAI,GAAJ,IAAI,CAAQ;QAAU,UAAK,GAAL,KAAK,CAAc;IAAG,CAAC;IAElF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAY;QAC5B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,OAAO,GAAiB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACrF,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAiB,CAAC;QACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YAC3G,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpG,2EAA2E;YAC3E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACxE,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAc;QAC7B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;;gBACnC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC1B,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;YACxE,MAAM,IAAI,GAAiB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9D,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,4EAA4E;QAC5E,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;CACpD"}

package/dist/cli/src/commands/desktop-workspace.d.ts

@@ -0,0 +1,12 @@
+import type { Readable } from "node:stream";
+export interface DesktopWorkspace {
+    url: string;
+    stop(): Promise<void>;
+}
+/** A capability-protected UI server owned by the native application's lifetime. */
+export declare function startDesktopWorkspace(options: {
+    assets: string;
+    home?: string;
+    hostSocket?: string;
+}): Promise<DesktopWorkspace>;
+export declare function runDesktopWorkspace(assets: string, input?: Readable): Promise<void>;

package/dist/cli/src/commands/desktop-workspace.js

@@ -0,0 +1,415 @@
+import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { readFile, readdir, realpath } from "node:fs/promises";
+import { extname, isAbsolute, join } from "node:path";
+import { homedir } from "node:os";
+import WebSocket, { WebSocketServer } from "ws";
+import { isMethodName, machineInfoSchema, rpcMessageSchema } from "@linkshell/wire";
+import { getValidToken, loadAuth } from "../auth.js";
+import { runLogin } from "./login.js";
+import { runLogout } from "./logout.js";
+import { silenceSqliteWarning } from "./host.js";
+import { DesktopClientState, validStorageKey } from "./desktop-workspace-state.js";
+const MAX_REQUEST_BYTES = 1024 * 1024;
+const MAX_PROXY_BYTES = 40 * 1024 * 1024;
+const MIME = {
+    ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8", ".svg": "image/svg+xml", ".png": "image/png",
+    ".jpg": "image/jpeg", ".webp": "image/webp", ".ico": "image/x-icon",
+    ".woff": "font/woff", ".woff2": "font/woff2", ".json": "application/json",
+};
+class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+function json(response, status, value) {
+    if (response.destroyed || response.writableEnded)
+        return;
+    response.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store", "x-content-type-options": "nosniff",
+        "referrer-policy": "no-referrer", "x-frame-options": "DENY",
+    });
+    response.end(JSON.stringify(value));
+}
+async function body(request) {
+    if (request.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
+        throw new HttpError(415, "请求需要使用 JSON 格式");
+    }
+    if (Number(request.headers["content-length"]) > MAX_REQUEST_BYTES)
+        throw new HttpError(413, "偏好内容过长");
+    let length = 0;
+    const chunks = [];
+    for await (const chunk of request) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        length += bytes.length;
+        if (length > MAX_REQUEST_BYTES)
+            throw new HttpError(413, "偏好内容过长");
+        chunks.push(bytes);
+    }
+    try {
+        const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (value && typeof value === "object" && !Array.isArray(value))
+            return value;
+    }
+    catch { /* Request contents may contain private drafts; never echo them. */ }
+    throw new HttpError(400, "无效的 JSON 请求");
+}
+async function loadAssets(directory) {
+    if (!isAbsolute(directory))
+        throw new Error("桌面工作台资源目录必须使用绝对路径");
+    const assets = new Map();
+    const root = await realpath(directory);
+    const walk = async (path, prefix = "") => {
+        for (const entry of await readdir(path, { withFileTypes: true })) {
+            if (entry.isDirectory())
+                await walk(join(path, entry.name), `${prefix}/${entry.name}`);
+            else if (entry.isFile())
+                assets.set(`${prefix}/${entry.name}`, await readFile(join(path, entry.name)));
+        }
+    };
+    await walk(root);
+    if (!assets.has("/index.html"))
+        throw new Error("桌面工作台资源缺失，请重新安装 LinkShell");
+    return assets;
+}
+async function localComputer(target, upstreams) {
+    // Query the existing socket directly: discovering this computer never starts a host.
+    return new Promise((resolve) => {
+        const client = new WebSocket(`ws+unix://${target}:/`, { perMessageDeflate: false, handshakeTimeout: 1_500, maxPayload: MAX_PROXY_BYTES });
+        upstreams.add(client);
+        const finish = (computer) => {
+            clearTimeout(timeout);
+            resolve(computer);
+            client.terminate();
+        };
+        const timeout = setTimeout(() => finish(), 3_000);
+        client.on("error", () => finish());
+        client.on("close", () => { upstreams.delete(client); clearTimeout(timeout); resolve(undefined); });
+        client.on("open", () => client.send(JSON.stringify({ jsonrpc: "2.0", id: "desktop-info", method: "machine.info", params: {} })));
+        client.on("message", (raw) => {
+            try {
+                const response = JSON.parse(raw.toString());
+                if (!response || typeof response !== "object" || !("id" in response) || response.id !== "desktop-info")
+                    return;
+                const parsed = machineInfoSchema.safeParse("result" in response ? response.result : undefined);
+                if (!parsed.success) {
+                    finish();
+                    return;
+                }
+                const info = parsed.data;
+                finish({
+                    key: "desktop:local", gateway: "desktop:local",
+                    machine: {
+                        id: info.machineId, name: info.hostname.replace(/\.local$/, ""), platform: info.platform,
+                        // Local transport uses a protected Unix socket, not a relay identity or tunnel.
+                        signKey: "", boxKey: "", online: true, via: "paired",
+                    },
+                });
+            }
+            catch {
+                finish();
+            }
+        });
+    });
+}
+async function account(signal) {
+    const accessToken = await getValidToken({ signal });
+    const current = loadAuth();
+    if (!current?.userId)
+        return {};
+    return {
+        userId: current.userId, email: current.email,
+        ...(accessToken && current.accessToken === accessToken ? { accessToken } : {}),
+    };
+}
+function proxyHost(client, target, upstreams) {
+    const host = new WebSocket(`ws+unix://${target}:/`, {
+        perMessageDeflate: false, handshakeTimeout: 3_000, maxPayload: MAX_PROXY_BYTES,
+    });
+    upstreams.add(host);
+    let pending = [];
+    let pendingBytes = 0;
+    const fail = (code, reason) => {
+        if (client.readyState === WebSocket.OPEN)
+            client.close(code, reason);
+        host.terminate();
+        pending = [];
+    };
+    const forward = (text) => {
+        if (host.bufferedAmount + Buffer.byteLength(text) > MAX_PROXY_BYTES) {
+            fail(1013, "连接繁忙，请重试");
+        }
+        else
+            host.send(text, (error) => { if (error)
+                fail(1011, "本机连接已断开"); });
+    };
+    client.on("message", (raw, binary) => {
+        if (binary) {
+            fail(1008, "不支持此消息格式");
+            return;
+        }
+        const text = raw.toString();
+        let message;
+        try {
+            message = rpcMessageSchema.safeParse(JSON.parse(text));
+        }
+        catch {
+            fail(1008, "无效的 RPC 请求");
+            return;
+        }
+        if (!message.success || typeof message.data.method !== "string") {
+            fail(1008, "无效的 RPC 请求");
+            return;
+        }
+        const { method, id } = message.data;
+        // Unix clients include privileged native-agent shims; this browser is only a normal client.
+        if (method.startsWith("desktop.") || !isMethodName(method)) {
+            if (id !== undefined && client.readyState === WebSocket.OPEN) {
+                client.send(JSON.stringify({ jsonrpc: "2.0", id, error: { code: -32601, message: "不支持此操作" } }));
+            }
+            return;
+        }
+        if (host.readyState === WebSocket.CONNECTING) {
+            pendingBytes += Buffer.byteLength(text);
+            if (pendingBytes > MAX_PROXY_BYTES) {
+                fail(1013, "连接繁忙，请重试");
+                return;
+            }
+            pending.push(text);
+        }
+        else if (host.readyState === WebSocket.OPEN)
+            forward(text);
+    });
+    host.on("open", () => {
+        if (client.readyState !== WebSocket.OPEN) {
+            host.terminate();
+            return;
+        }
+        for (const text of pending) {
+            if (host.readyState !== WebSocket.OPEN)
+                break;
+            forward(text);
+        }
+        pending = [];
+        pendingBytes = 0;
+    });
+    host.on("message", (data, binary) => {
+        if (client.readyState !== WebSocket.OPEN)
+            return;
+        const size = Array.isArray(data) ? data.reduce((total, part) => total + part.length, 0) : data.byteLength;
+        if (client.bufferedAmount + size > MAX_PROXY_BYTES) {
+            fail(1013, "连接繁忙，请重试");
+            return;
+        }
+        client.send(data, { binary }, (error) => { if (error)
+            host.terminate(); });
+    });
+    host.on("error", () => fail(1013, "本机服务未运行，请在本机服务中启动"));
+    host.on("close", () => {
+        upstreams.delete(host);
+        pending = [];
+        if (client.readyState === WebSocket.OPEN)
+            client.close(1013, "本机服务已断开");
+    });
+    client.on("error", () => host.terminate());
+    client.on("close", () => { pending = []; host.terminate(); });
+}
+/** A capability-protected UI server owned by the native application's lifetime. */
+export async function startDesktopWorkspace(options) {
+    silenceSqliteWarning();
+    const home = options.home ?? process.env.LINKSHELL_HOME ?? join(homedir(), ".linkshell");
+    const assets = await loadAssets(options.assets);
+    const state = await DesktopClientState.open(home);
+    const hostSocket = options.hostSocket ?? (await import("@linkshell/host")).hostPaths(home).hostSocket;
+    const capability = randomBytes(32).toString("base64url");
+    const secret = Buffer.from(capability);
+    const hasToken = (value) => {
+        const supplied = Buffer.from(value ?? "");
+        return supplied.length === secret.length && timingSafeEqual(supplied, secret);
+    };
+    let workspaceOrigin = "";
+    let workspaceHost = "";
+    let previewOrigin = "";
+    let previewHost = "";
+    let login;
+    let loginAbort;
+    let stopping;
+    const peers = new WebSocketServer({ noServer: true, perMessageDeflate: false, maxPayload: MAX_PROXY_BYTES });
+    const upstreams = new Set();
+    const sockets = new Set();
+    const accountAbort = new AbortController();
+    const serve = async (request, response) => {
+        const host = request.headers.host;
+        if (host !== workspaceHost && host !== previewHost)
+            throw new HttpError(403, "来源不受信任");
+        if (!request.url?.startsWith("/") || request.url.startsWith("//"))
+            throw new HttpError(400, "无效的请求地址");
+        const url = new URL(request.url, workspaceOrigin);
+        const path = url.pathname;
+        if (host === previewHost) {
+            // A preview service worker can only ever own this other origin and /preview/ scope.
+            if (!path.startsWith("/preview/"))
+                throw new HttpError(404, "未找到资源");
+        }
+        else {
+            const origin = request.headers.origin;
+            if (origin !== undefined && origin !== workspaceOrigin)
+                throw new HttpError(403, "来源不受信任");
+            if (path.startsWith("/desktop/")) {
+                if (!hasToken(request.headers.authorization?.replace(/^Bearer /, "")) ||
+                    !request.headers.authorization?.startsWith("Bearer "))
+                    throw new HttpError(401, "桌面连接已过期，请重新打开工作台");
+                // Same-origin GET fetches omit Origin. Mutations always send it in WebKit.
+                if (!["GET", "HEAD"].includes(request.method ?? "") && origin !== workspaceOrigin)
+                    throw new HttpError(403, "来源不受信任");
+                if (request.method === "GET" && path === "/desktop/bootstrap") {
+                    json(response, 200, { ...state.snapshot(), localComputer: await localComputer(hostSocket, upstreams) });
+                    return;
+                }
+                if (request.method === "GET" && path === "/desktop/local") {
+                    json(response, 200, { computer: await localComputer(hostSocket, upstreams) });
+                    return;
+                }
+                if (request.method === "GET" && path === "/desktop/account") {
+                    json(response, 200, await account(accountAbort.signal));
+                    return;
+                }
+                if (request.method === "PUT" && path === "/desktop/storage") {
+                    const input = await body(request);
+                    if (!validStorageKey(input.key) || !Object.hasOwn(input, "value"))
+                        throw new HttpError(400, "无效的偏好内容");
+                    try {
+                        await state.set(input.key, input.value);
+                    }
+                    catch {
+                        throw new HttpError(507, "桌面偏好保存失败，请检查可用空间或缩短内容");
+                    }
+                    json(response, 200, { ok: true });
+                    return;
+                }
+                if (request.method === "POST" && path === "/desktop/login") {
+                    if (!login) {
+                        loginAbort = new AbortController();
+                        login = runLogin({ signal: loginAbort.signal }).finally(() => { login = undefined; loginAbort = undefined; });
+                    }
+                    const result = await login;
+                    if (!result?.success)
+                        throw new HttpError(409, "登录未完成，请重试");
+                    json(response, 200, await account(accountAbort.signal));
+                    return;
+                }
+                if (request.method === "POST" && path === "/desktop/logout") {
+                    loginAbort?.abort();
+                    await login;
+                    await runLogout();
+                    json(response, 200, {});
+                    return;
+                }
+                throw new HttpError(404, "未找到操作");
+            }
+            // Never install a preview service worker in the identity-bearing workspace origin.
+            if (path.startsWith("/preview/"))
+                throw new HttpError(404, "未找到资源");
+        }
+        if (!["GET", "HEAD"].includes(request.method ?? ""))
+            throw new HttpError(405, "不支持此请求方法");
+        const assetPath = path === "/" ? "/index.html" : path;
+        const content = path === "/config.js" ? Buffer.from(`window.__LINKSHELL_CONFIG__ = ${JSON.stringify({ desktop: true, deployment: "official", previewOrigin })};\n`) : assets.get(assetPath);
+        if (!content)
+            throw new HttpError(404, "未找到资源");
+        response.writeHead(200, {
+            "content-type": MIME[extname(assetPath)] ?? "application/octet-stream", "content-length": content.byteLength,
+            "cache-control": "no-store", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer",
+            ...(host === workspaceHost ? { "x-frame-options": "DENY", "content-security-policy": "frame-ancestors 'none'" } : {}),
+        });
+        response.end(request.method === "HEAD" ? undefined : content);
+    };
+    const server = createServer((request, response) => {
+        void serve(request, response).catch((error) => {
+            json(response, error instanceof HttpError ? error.status : 500, { error: error instanceof HttpError ? error.message : "桌面工作台暂时无法完成操作，请重试" });
+        });
+    });
+    server.requestTimeout = 6 * 60_000;
+    server.headersTimeout = 10_000;
+    server.on("connection", (socket) => { sockets.add(socket); socket.on("close", () => sockets.delete(socket)); });
+    server.on("upgrade", (request, socket, head) => {
+        let url;
+        try {
+            url = new URL(request.url ?? "", workspaceOrigin);
+        }
+        catch {
+            socket.destroy();
+            return;
+        }
+        if (request.headers.host !== workspaceHost || request.headers.origin !== workspaceOrigin ||
+            !request.url?.startsWith("/") || request.url.startsWith("//") || url.pathname !== "/desktop/host" ||
+            !hasToken(url.searchParams.get("token") ?? undefined)) {
+            socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+            return;
+        }
+        peers.handleUpgrade(request, socket, head, (client) => proxyHost(client, hostSocket, upstreams));
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(); });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("桌面工作台无法启动");
+    workspaceHost = `127.0.0.1:${address.port}`;
+    previewHost = `localhost:${address.port}`;
+    workspaceOrigin = `http://${workspaceHost}`;
+    previewOrigin = `http://${previewHost}`;
+    return {
+        url: `${workspaceOrigin}/#desktop=${capability}`,
+        stop() {
+            return stopping ??= (async () => {
+                accountAbort.abort();
+                loginAbort?.abort();
+                for (const client of peers.clients)
+                    client.terminate();
+                for (const upstream of upstreams)
+                    upstream.terminate();
+                for (const socket of sockets)
+                    socket.destroy();
+                await Promise.all([
+                    new Promise((resolve) => server.close(() => resolve())),
+                    new Promise((resolve) => peers.close(() => resolve())),
+                    state.flush(),
+                ]);
+            })();
+        },
+    };
+}
+export async function runDesktopWorkspace(assets, input = process.stdin) {
+    let close;
+    const ended = new Promise((resolve) => { close = resolve; });
+    input.once("end", close);
+    input.once("close", close);
+    input.once("error", close);
+    process.once("SIGINT", close);
+    process.once("SIGTERM", close);
+    input.resume();
+    if (input.readableEnded || input.destroyed)
+        close();
+    let workspace;
+    try {
+        workspace = await startDesktopWorkspace({ assets });
+        process.stdout.write(`${JSON.stringify({ url: workspace.url })}\n`);
+        await ended;
+    }
+    finally {
+        input.off("end", close);
+        input.off("close", close);
+        input.off("error", close);
+        input.pause();
+        process.off("SIGINT", close);
+        process.off("SIGTERM", close);
+        await workspace?.stop();
+    }
+}
+//# sourceMappingURL=desktop-workspace.js.map