linkshell-cli 0.10.45 → 0.10.47

package/src/commands/desktop-workspace.ts

@@ -0,0 +1,353 @@
+import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { readFile, readdir, realpath } from "node:fs/promises";
+import { extname, isAbsolute, join } from "node:path";
+import { homedir } from "node:os";
+import type { Readable } from "node:stream";
+import type { Socket } from "node:net";
+import WebSocket, { WebSocketServer } from "ws";
+import { isMethodName, machineInfoSchema, rpcMessageSchema, type MachineEntry } from "@linkshell/wire";
+import { getValidToken, loadAuth } from "../auth.js";
+import { runLogin } from "./login.js";
+import { runLogout } from "./logout.js";
+import { silenceSqliteWarning } from "./host.js";
+import { DesktopClientState, validStorageKey } from "./desktop-workspace-state.js";
+
+const MAX_REQUEST_BYTES = 1024 * 1024;
+const MAX_PROXY_BYTES = 40 * 1024 * 1024;
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8", ".svg": "image/svg+xml", ".png": "image/png",
+  ".jpg": "image/jpeg", ".webp": "image/webp", ".ico": "image/x-icon",
+  ".woff": "font/woff", ".woff2": "font/woff2", ".json": "application/json",
+};
+
+interface LocalComputer {
+  key: "desktop:local";
+  gateway: "desktop:local";
+  machine: MachineEntry;
+}
+
+export interface DesktopWorkspace {
+  url: string;
+  stop(): Promise<void>;
+}
+
+class HttpError extends Error {
+  constructor(readonly status: number, message: string) { super(message); }
+}
+
+function json(response: ServerResponse, status: number, value: unknown): void {
+  if (response.destroyed || response.writableEnded) return;
+  response.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store", "x-content-type-options": "nosniff",
+    "referrer-policy": "no-referrer", "x-frame-options": "DENY",
+  });
+  response.end(JSON.stringify(value));
+}
+
+async function body(request: IncomingMessage): Promise<Record<string, unknown>> {
+  if (request.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
+    throw new HttpError(415, "请求需要使用 JSON 格式");
+  }
+  if (Number(request.headers["content-length"]) > MAX_REQUEST_BYTES) throw new HttpError(413, "偏好内容过长");
+  let length = 0;
+  const chunks: Buffer[] = [];
+  for await (const chunk of request) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    length += bytes.length;
+    if (length > MAX_REQUEST_BYTES) throw new HttpError(413, "偏好内容过长");
+    chunks.push(bytes);
+  }
+  try {
+    const value: unknown = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (value && typeof value === "object" && !Array.isArray(value)) return value as Record<string, unknown>;
+  } catch { /* Request contents may contain private drafts; never echo them. */ }
+  throw new HttpError(400, "无效的 JSON 请求");
+}
+
+async function loadAssets(directory: string): Promise<Map<string, Buffer>> {
+  if (!isAbsolute(directory)) throw new Error("桌面工作台资源目录必须使用绝对路径");
+  const assets = new Map<string, Buffer>();
+  const root = await realpath(directory);
+  const walk = async (path: string, prefix = "") => {
+    for (const entry of await readdir(path, { withFileTypes: true })) {
+      if (entry.isDirectory()) await walk(join(path, entry.name), `${prefix}/${entry.name}`);
+      else if (entry.isFile()) assets.set(`${prefix}/${entry.name}`, await readFile(join(path, entry.name)));
+    }
+  };
+  await walk(root);
+  if (!assets.has("/index.html")) throw new Error("桌面工作台资源缺失，请重新安装 LinkShell");
+  return assets;
+}
+
+async function localComputer(target: string, upstreams: Set<WebSocket>): Promise<LocalComputer | undefined> {
+  // Query the existing socket directly: discovering this computer never starts a host.
+  return new Promise((resolve) => {
+    const client = new WebSocket(`ws+unix://${target}:/`, { perMessageDeflate: false, handshakeTimeout: 1_500, maxPayload: MAX_PROXY_BYTES });
+    upstreams.add(client);
+    const finish = (computer?: LocalComputer) => {
+      clearTimeout(timeout);
+      resolve(computer);
+      client.terminate();
+    };
+    const timeout = setTimeout(() => finish(), 3_000);
+    client.on("error", () => finish());
+    client.on("close", () => { upstreams.delete(client); clearTimeout(timeout); resolve(undefined); });
+    client.on("open", () => client.send(JSON.stringify({ jsonrpc: "2.0", id: "desktop-info", method: "machine.info", params: {} })));
+    client.on("message", (raw) => {
+      try {
+        const response: unknown = JSON.parse(raw.toString());
+        if (!response || typeof response !== "object" || !("id" in response) || response.id !== "desktop-info") return;
+        const parsed = machineInfoSchema.safeParse("result" in response ? response.result : undefined);
+        if (!parsed.success) { finish(); return; }
+        const info = parsed.data;
+        finish({
+          key: "desktop:local", gateway: "desktop:local",
+          machine: {
+            id: info.machineId, name: info.hostname.replace(/\.local$/, ""), platform: info.platform,
+            // Local transport uses a protected Unix socket, not a relay identity or tunnel.
+            signKey: "", boxKey: "", online: true, via: "paired",
+          },
+        });
+      } catch { finish(); }
+    });
+  });
+}
+
+async function account(signal: AbortSignal) {
+  const accessToken = await getValidToken({ signal });
+  const current = loadAuth();
+  if (!current?.userId) return {};
+  return {
+    userId: current.userId, email: current.email,
+    ...(accessToken && current.accessToken === accessToken ? { accessToken } : {}),
+  };
+}
+
+function proxyHost(client: WebSocket, target: string, upstreams: Set<WebSocket>): void {
+  const host = new WebSocket(`ws+unix://${target}:/`, {
+    perMessageDeflate: false, handshakeTimeout: 3_000, maxPayload: MAX_PROXY_BYTES,
+  });
+  upstreams.add(host);
+  let pending: string[] = [];
+  let pendingBytes = 0;
+  const fail = (code: number, reason: string) => {
+    if (client.readyState === WebSocket.OPEN) client.close(code, reason);
+    host.terminate();
+    pending = [];
+  };
+  const forward = (text: string) => {
+    if (host.bufferedAmount + Buffer.byteLength(text) > MAX_PROXY_BYTES) {
+      fail(1013, "连接繁忙，请重试");
+    } else host.send(text, (error) => { if (error) fail(1011, "本机连接已断开"); });
+  };
+  client.on("message", (raw, binary) => {
+    if (binary) { fail(1008, "不支持此消息格式"); return; }
+    const text = raw.toString();
+    let message;
+    try { message = rpcMessageSchema.safeParse(JSON.parse(text)); }
+    catch { fail(1008, "无效的 RPC 请求"); return; }
+    if (!message.success || typeof message.data.method !== "string") {
+      fail(1008, "无效的 RPC 请求"); return;
+    }
+    const { method, id } = message.data;
+    // Unix clients include privileged native-agent shims; this browser is only a normal client.
+    if (method.startsWith("desktop.") || !isMethodName(method)) {
+      if (id !== undefined && client.readyState === WebSocket.OPEN) {
+        client.send(JSON.stringify({ jsonrpc: "2.0", id, error: { code: -32601, message: "不支持此操作" } }));
+      }
+      return;
+    }
+    if (host.readyState === WebSocket.CONNECTING) {
+      pendingBytes += Buffer.byteLength(text);
+      if (pendingBytes > MAX_PROXY_BYTES) { fail(1013, "连接繁忙，请重试"); return; }
+      pending.push(text);
+    } else if (host.readyState === WebSocket.OPEN) forward(text);
+  });
+  host.on("open", () => {
+    if (client.readyState !== WebSocket.OPEN) { host.terminate(); return; }
+    for (const text of pending) {
+      if (host.readyState !== WebSocket.OPEN) break;
+      forward(text);
+    }
+    pending = [];
+    pendingBytes = 0;
+  });
+  host.on("message", (data, binary) => {
+    if (client.readyState !== WebSocket.OPEN) return;
+    const size = Array.isArray(data) ? data.reduce((total, part) => total + part.length, 0) : data.byteLength;
+    if (client.bufferedAmount + size > MAX_PROXY_BYTES) { fail(1013, "连接繁忙，请重试"); return; }
+    client.send(data, { binary }, (error) => { if (error) host.terminate(); });
+  });
+  host.on("error", () => fail(1013, "本机服务未运行，请在本机服务中启动"));
+  host.on("close", () => {
+    upstreams.delete(host);
+    pending = [];
+    if (client.readyState === WebSocket.OPEN) client.close(1013, "本机服务已断开");
+  });
+  client.on("error", () => host.terminate());
+  client.on("close", () => { pending = []; host.terminate(); });
+}
+
+/** A capability-protected UI server owned by the native application's lifetime. */
+export async function startDesktopWorkspace(options: { assets: string; home?: string; hostSocket?: string }): Promise<DesktopWorkspace> {
+  silenceSqliteWarning();
+  const home = options.home ?? process.env.LINKSHELL_HOME ?? join(homedir(), ".linkshell");
+  const assets = await loadAssets(options.assets);
+  const state = await DesktopClientState.open(home);
+  const hostSocket = options.hostSocket ?? (await import("@linkshell/host")).hostPaths(home).hostSocket;
+  const capability = randomBytes(32).toString("base64url");
+  const secret = Buffer.from(capability);
+  const hasToken = (value: string | undefined): boolean => {
+    const supplied = Buffer.from(value ?? "");
+    return supplied.length === secret.length && timingSafeEqual(supplied, secret);
+  };
+  let workspaceOrigin = "";
+  let workspaceHost = "";
+  let previewOrigin = "";
+  let previewHost = "";
+  let login: Promise<Awaited<ReturnType<typeof runLogin>>> | undefined;
+  let loginAbort: AbortController | undefined;
+  let stopping: Promise<void> | undefined;
+  const peers = new WebSocketServer({ noServer: true, perMessageDeflate: false, maxPayload: MAX_PROXY_BYTES });
+  const upstreams = new Set<WebSocket>();
+  const sockets = new Set<Socket>();
+  const accountAbort = new AbortController();
+
+  const serve = async (request: IncomingMessage, response: ServerResponse) => {
+    const host = request.headers.host;
+    if (host !== workspaceHost && host !== previewHost) throw new HttpError(403, "来源不受信任");
+    if (!request.url?.startsWith("/") || request.url.startsWith("//")) throw new HttpError(400, "无效的请求地址");
+    const url = new URL(request.url, workspaceOrigin);
+    const path = url.pathname;
+    if (host === previewHost) {
+      // A preview service worker can only ever own this other origin and /preview/ scope.
+      if (!path.startsWith("/preview/")) throw new HttpError(404, "未找到资源");
+    } else {
+      const origin = request.headers.origin;
+      if (origin !== undefined && origin !== workspaceOrigin) throw new HttpError(403, "来源不受信任");
+      if (path.startsWith("/desktop/")) {
+        if (!hasToken(request.headers.authorization?.replace(/^Bearer /, "")) ||
+            !request.headers.authorization?.startsWith("Bearer ")) throw new HttpError(401, "桌面连接已过期，请重新打开工作台");
+        // Same-origin GET fetches omit Origin. Mutations always send it in WebKit.
+        if (!["GET", "HEAD"].includes(request.method ?? "") && origin !== workspaceOrigin) throw new HttpError(403, "来源不受信任");
+        if (request.method === "GET" && path === "/desktop/bootstrap") {
+          json(response, 200, { ...state.snapshot(), localComputer: await localComputer(hostSocket, upstreams) }); return;
+        }
+        if (request.method === "GET" && path === "/desktop/local") {
+          json(response, 200, { computer: await localComputer(hostSocket, upstreams) }); return;
+        }
+        if (request.method === "GET" && path === "/desktop/account") {
+          json(response, 200, await account(accountAbort.signal)); return;
+        }
+        if (request.method === "PUT" && path === "/desktop/storage") {
+          const input = await body(request);
+          if (!validStorageKey(input.key) || !Object.hasOwn(input, "value")) throw new HttpError(400, "无效的偏好内容");
+          try { await state.set(input.key, input.value); }
+          catch { throw new HttpError(507, "桌面偏好保存失败，请检查可用空间或缩短内容"); }
+          json(response, 200, { ok: true }); return;
+        }
+        if (request.method === "POST" && path === "/desktop/login") {
+          if (!login) {
+            loginAbort = new AbortController();
+            login = runLogin({ signal: loginAbort.signal }).finally(() => { login = undefined; loginAbort = undefined; });
+          }
+          const result = await login;
+          if (!result?.success) throw new HttpError(409, "登录未完成，请重试");
+          json(response, 200, await account(accountAbort.signal)); return;
+        }
+        if (request.method === "POST" && path === "/desktop/logout") {
+          loginAbort?.abort();
+          await login;
+          await runLogout();
+          json(response, 200, {}); return;
+        }
+        throw new HttpError(404, "未找到操作");
+      }
+      // Never install a preview service worker in the identity-bearing workspace origin.
+      if (path.startsWith("/preview/")) throw new HttpError(404, "未找到资源");
+    }
+    if (!["GET", "HEAD"].includes(request.method ?? "")) throw new HttpError(405, "不支持此请求方法");
+    const assetPath = path === "/" ? "/index.html" : path;
+    const content = path === "/config.js" ? Buffer.from(`window.__LINKSHELL_CONFIG__ = ${JSON.stringify({ desktop: true, deployment: "official", previewOrigin })};\n`) : assets.get(assetPath);
+    if (!content) throw new HttpError(404, "未找到资源");
+    response.writeHead(200, {
+      "content-type": MIME[extname(assetPath)] ?? "application/octet-stream", "content-length": content.byteLength,
+      "cache-control": "no-store", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer",
+      ...(host === workspaceHost ? { "x-frame-options": "DENY", "content-security-policy": "frame-ancestors 'none'" } : {}),
+    });
+    response.end(request.method === "HEAD" ? undefined : content);
+  };
+  const server = createServer((request, response) => {
+    void serve(request, response).catch((error: unknown) => {
+      json(response, error instanceof HttpError ? error.status : 500,
+        { error: error instanceof HttpError ? error.message : "桌面工作台暂时无法完成操作，请重试" });
+    });
+  });
+  server.requestTimeout = 6 * 60_000;
+  server.headersTimeout = 10_000;
+  server.on("connection", (socket) => { sockets.add(socket); socket.on("close", () => sockets.delete(socket)); });
+  server.on("upgrade", (request, socket, head) => {
+    let url: URL;
+    try { url = new URL(request.url ?? "", workspaceOrigin); }
+    catch { socket.destroy(); return; }
+    if (request.headers.host !== workspaceHost || request.headers.origin !== workspaceOrigin ||
+        !request.url?.startsWith("/") || request.url.startsWith("//") || url.pathname !== "/desktop/host" ||
+        !hasToken(url.searchParams.get("token") ?? undefined)) {
+      socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"); return;
+    }
+    peers.handleUpgrade(request, socket, head, (client) => proxyHost(client, hostSocket, upstreams));
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(); });
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") throw new Error("桌面工作台无法启动");
+  workspaceHost = `127.0.0.1:${address.port}`;
+  previewHost = `localhost:${address.port}`;
+  workspaceOrigin = `http://${workspaceHost}`;
+  previewOrigin = `http://${previewHost}`;
+  return {
+    url: `${workspaceOrigin}/#desktop=${capability}`,
+    stop() {
+      return stopping ??= (async () => {
+        accountAbort.abort();
+        loginAbort?.abort();
+        for (const client of peers.clients) client.terminate();
+        for (const upstream of upstreams) upstream.terminate();
+        for (const socket of sockets) socket.destroy();
+        await Promise.all([
+          new Promise<void>((resolve) => server.close(() => resolve())),
+          new Promise<void>((resolve) => peers.close(() => resolve())),
+          state.flush(),
+        ]);
+      })();
+    },
+  };
+}
+
+export async function runDesktopWorkspace(assets: string, input: Readable = process.stdin): Promise<void> {
+  let close!: () => void;
+  const ended = new Promise<void>((resolve) => { close = resolve; });
+  input.once("end", close);
+  input.once("close", close);
+  input.once("error", close);
+  process.once("SIGINT", close);
+  process.once("SIGTERM", close);
+  input.resume();
+  if (input.readableEnded || input.destroyed) close();
+  let workspace: DesktopWorkspace | undefined;
+  try {
+    workspace = await startDesktopWorkspace({ assets });
+    process.stdout.write(`${JSON.stringify({ url: workspace.url })}\n`);
+    await ended;
+  } finally {
+    input.off("end", close); input.off("close", close); input.off("error", close);
+    input.pause();
+    process.off("SIGINT", close); process.off("SIGTERM", close);
+    await workspace?.stop();
+  }
+}

package/src/commands/desktop.ts

@@ -10,17 +10,22 @@ import { prepareDesktopUpdate, recoverDesktopUpdate } from "./desktop-update.js"
 import { sep } from "node:path";
 import { ensureHostRunning, silenceSqliteWarning, withRunningHost } from "./host.js";
 import { linkshellDir, readHostLaunch, readHostOwner, readPid, stopDaemonAndWait } from "../utils/daemon.js";
+import { cachedMembership, redeemDesktopPro, refreshMembership } from "../pro-membership.js";
 
 export function installationSource(path: string): "homebrew" | "npm" {
   return path.includes(`${sep}Cellar${sep}linkshell${sep}`) ? "homebrew" : "npm";
 }
 
+function desktopAccount() {
+  const auth = loadAuth();
+  return auth?.userId ? { state: "signed-in", email: auth.email, userId: auth.userId, ...cachedMembership(auth.userId) } : { state: "signed-out" };
+}
+
 /** A versioned, read-only snapshot. Missing sections stay unknown, never healthy. */
 export async function desktopSnapshot(version: string) {
   let executable = process.argv[1]!;
   try { executable = realpathSync(executable); } catch { /* Retain the launch path for diagnosis. */ }
-  const auth = loadAuth();
-  const account = auth?.userId ? { state: "signed-in", email: auth.email, userId: auth.userId } : { state: "signed-out" };
+  const account = desktopAccount();
   const base = { account, schema: 1, cliVersion: version, home: linkshellDir(), source: standaloneBundle() ? "standalone" : installationSource(executable), executable, hostOwner: readPid("host") ? readHostOwner(readPid("host")!) ?? "external" : "none", appBundle: standaloneBundle() };
   const result = await withRunningHost(async (client) => {
     const machine = await client.call("machine.info", {}, 5000);
@@ -33,10 +38,49 @@ export async function desktopSnapshot(version: string) {
   return result ? { ...base, status: "running", ...result } : { ...base, status: readPid("host") ? "unreachable" : "stopped" };
 }
 
-export async function runDesktop(version: string, action: string): Promise<void> {
+async function redemptionInput(input: AsyncIterable<string | Buffer>): Promise<{ code: string; userId: string }> {
+  const chunks: Buffer[] = [];
+  let length = 0;
+  for await (const chunk of input) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    length += buffer.length;
+    if (length > 4096) throw new Error("激活码内容过长，请检查后重试");
+    chunks.push(buffer);
+  }
+  try {
+    const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (typeof value?.code === "string" && typeof value?.userId === "string" && value.userId.trim()) return { code: value.code, userId: value.userId };
+  } catch { /* Never echo an input that contains the activation code. */ }
+  throw new Error("激活码请求无效，请刷新账号后重试");
+}
+
+export async function runDesktop(version: string, action: string, input: AsyncIterable<string | Buffer> = process.stdin): Promise<void> {
   silenceSqliteWarning();
   try {
-    if (action === "pair") {
+    if (action === "redeem-pro") {
+      const { code, userId } = await redemptionInput(input);
+      const result = await redeemDesktopPro(code, userId);
+      if (loadAuth()?.userId === userId) {
+        try {
+          const gateway = await refreshGateway(15_000);
+          if (gateway && gateway.status !== "online" && gateway.status !== "off") result.accountWarning ??= "兑换已成功，网关尚未连接，请稍后重新连接";
+        } catch {
+          result.accountWarning ??= "兑换已成功，本机服务暂未刷新，请稍后重新连接网关";
+        }
+      }
+      // A host query failing cannot turn a confirmed redemption into a failed redemption.
+      const snapshot = await desktopSnapshot(version).catch(() => {
+        result.accountWarning ??= "兑换已成功，本机服务状态暂时无法读取，请稍后刷新";
+        return { schema: 1, cliVersion: version, status: "unknown", account: desktopAccount() };
+      });
+      snapshot.account = desktopAccount();
+      if (snapshot.account.state === "signed-in" && "userId" in snapshot.account && snapshot.account.userId === userId) Object.assign(snapshot.account, { plan: "pro", planExpiresAt: result.redemption.planExpiresAt });
+      else result.accountWarning = "兑换已成功，登录账号已变更，请切回兑换时的账号查看会员状态";
+      process.stdout.write(`${JSON.stringify({ ...snapshot, ...result })}\n`);
+      return;
+    }
+    if (action === "account-refresh") await refreshMembership();
+    else if (action === "pair") {
       const result = await withRunningHost(async client => {
         const gateway = await client.call("gateway.status", {});
         if (gateway.status !== "online") throw new Error("请先连接网关。官方网关需要登录 Pro 账号；自建网关可以免登录配对。");
@@ -77,7 +121,7 @@ export async function runDesktop(version: string, action: string): Promise<void>
       const env = { ...process.env, ...(pid ? readHostLaunch(pid) : {}) };
       await stopDaemonAndWait("host", 30_000, pid ?? undefined);
       if (action === "restart") await ensureHostRunning(env);
-    } else if (action !== "snapshot") throw new Error("Unknown desktop action");
+    } else if (action !== "snapshot" && action !== "account-refresh") throw new Error("Unknown desktop action");
     process.stdout.write(`${JSON.stringify(await desktopSnapshot(version))}\n`);
   } catch (error) {
     process.stdout.write(`${JSON.stringify({ schema: 1, status: "unknown", error: error instanceof Error ? error.message : String(error) })}\n`);

package/src/commands/login.ts

@@ -2,6 +2,8 @@ import * as http from "node:http";
 import { execSync } from "node:child_process";
 import { saveAuth, SUPABASE_URL, SUPABASE_ANON_KEY } from "../auth.js";
 import type { AuthTokens } from "../auth.js";
+import { cacheMembership, type DesktopMembership } from "../pro-membership.js";
+import { fetchProMembership } from "../../../client-core/src/pro-membership.js";
 
 const ITOOL_AUTH_URL = "https://itool.tech/en/auth/linkshell";
 
@@ -22,12 +24,27 @@ export interface LoginResult {
   accessToken: string;
 }
 
-export async function runLogin(): Promise<LoginResult | null> {
+export async function runLogin(options: { signal?: AbortSignal } = {}): Promise<LoginResult | null> {
+  if (options.signal?.aborted) return null;
   process.stderr.write("\n  LinkShell Login\n\n");
 
   return new Promise<LoginResult | null>((resolve) => {
     let timeout: ReturnType<typeof setTimeout> | undefined;
+    let completion: ReturnType<typeof setTimeout> | undefined;
+    let finished = false;
+    const finish = (result: LoginResult | null) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timeout);
+      clearTimeout(completion);
+      options.signal?.removeEventListener("abort", abort);
+      server.closeAllConnections();
+      server.close();
+      resolve(result);
+    };
+    const abort = () => finish(null);
     const server = http.createServer(async (req, res) => {
+      if (finished) { res.destroy(); return; }
       const url = new URL(req.url ?? "/", "http://localhost");
 
       if (url.pathname === "/callback") {
@@ -76,13 +93,14 @@ export async function runLogin(): Promise<LoginResult | null> {
         let userId = "";
         let email = "";
         let plan = "free";
+        let membership: DesktopMembership = { plan: "unknown", planExpiresAt: null };
         try {
           const userRes = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
             headers: {
               Authorization: `Bearer ${accessToken}`,
               apikey: SUPABASE_ANON_KEY,
             },
-            signal: AbortSignal.timeout(10_000),
+            signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
           });
           if (userRes.ok) {
             const user = (await userRes.json()) as {
@@ -92,34 +110,14 @@ export async function runLogin(): Promise<LoginResult | null> {
             userId = user.id;
             email = user.email ?? "";
 
-            // Check subscription from profiles table
-            const profileRes = await fetch(
-              `${SUPABASE_URL}/rest/v1/profiles?id=eq.${userId}&select=plan,plan_expires_at&limit=1`,
-              {
-                headers: {
-                  Authorization: `Bearer ${accessToken}`,
-                  apikey: SUPABASE_ANON_KEY,
-                },
-                signal: AbortSignal.timeout(5_000),
-              },
-            );
-            if (profileRes.ok) {
-              const profiles = (await profileRes.json()) as {
-                plan: string;
-                plan_expires_at: string | null;
-              }[];
-              if (
-                profiles.length > 0 &&
-                profiles[0]!.plan === "pro" &&
-                profiles[0]!.plan_expires_at &&
-                new Date(profiles[0]!.plan_expires_at) > new Date()
-              ) {
-                plan = "pro";
-              }
-            }
+            const profile = await fetchProMembership({ userId, accessToken, supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON_KEY, signal: options.signal });
+            plan = profile.plan;
+            membership = { plan: profile.plan, planExpiresAt: profile.expiresAt ?? null };
           }
         } catch {}
 
+        if (finished || options.signal?.aborted) { res.destroy(); return; }
+
         if (!userId) {
           res.writeHead(401);
           res.end("无法验证账号，请重新登录。");
@@ -134,6 +132,7 @@ export async function runLogin(): Promise<LoginResult | null> {
           email,
         };
         saveAuth(tokens);
+        try { cacheMembership(userId, membership); } catch { /* A cache write cannot invalidate a completed login. */ }
 
         res.writeHead(200);
         res.end("ok");
@@ -145,9 +144,8 @@ export async function runLogin(): Promise<LoginResult | null> {
 
         // Left pending, the five-minute limit would keep the command alive long after the login.
         clearTimeout(timeout);
-        setTimeout(() => {
-          server.close();
-          resolve({
+        completion = setTimeout(() => {
+          finish({
             success: true,
             plan: plan as "pro" | "free",
             email,
@@ -162,15 +160,17 @@ export async function runLogin(): Promise<LoginResult | null> {
       res.end("Not found");
     });
 
-    server.on("error", () => { clearTimeout(timeout); resolve(null); });
+    server.on("error", () => finish(null));
+    options.signal?.addEventListener("abort", abort, { once: true });
 
     server.listen(0, "127.0.0.1", () => {
+      if (finished) return;
       const addr = server.address();
       if (!addr || typeof addr === "string") {
         process.stderr.write(
           "  \x1b[31m✗\x1b[0m Failed to start local server\n\n",
         );
-        resolve(null);
+        finish(null);
         return;
       }
 
@@ -195,8 +195,7 @@ export async function runLogin(): Promise<LoginResult | null> {
       // Timeout after 5 minutes
       timeout = setTimeout(() => {
         process.stderr.write("  Login timed out.\n\n");
-        server.close();
-        resolve(null);
+        finish(null);
       }, 5 * 60 * 1000);
     });
   });

package/src/index.ts

@@ -32,6 +32,22 @@ program.command("desktop", { hidden: true })
   .option("--action <action>", "snapshot, start, stop or restart", "snapshot")
   .action(async (options) => { const { runDesktop } = await import("./commands/desktop.js"); await runDesktop(pkg.version, options.action); });
 
+program.command("desktop-workspace", { hidden: true })
+  .requiredOption("--assets <directory>", "Absolute path to the bundled workspace assets")
+  .action(async (options) => {
+    const { runDesktopWorkspace } = await import("./commands/desktop-workspace.js");
+    try {
+      await runDesktopWorkspace(options.assets);
+      // This owned command has flushed persistent writes and closed its servers. Legacy
+      // account/Host probes may still hold sockets; none should outlive the desktop UI.
+      process.exit(0);
+    }
+    catch {
+      process.stderr.write("桌面工作台无法启动，请检查安装资源与本地存储后重试。\n");
+      process.exitCode = 1;
+    }
+  });
+
 // ── host ────────────────────────────────────────────────────────────
 
 const hostCmd = program