vcorp-chrome 1.8.1 → 2.2.0

package/native-host/full.js

@@ -0,0 +1,217 @@
+// 桌面完全模式 —— 云端任务在这台电脑上拿到和本机 agent（goose 一类）一样的能力：
+// 跑命令、读写任意文件、agent-desktop 的全部命令。
+//
+// 只有用户在本机运行过 `vcorp-chrome desktop full on` 才开（见 paths.js 的 fullMode），
+// 原生宿主每条命令都现读开关。这一层不做「哪个能碰」的判断——那是第二阶段安全方案的事。
+//
+// 原生消息回包上限 1MB：大结果先落到临时文件，扩展再用 page 一段一段取回（见 pageOut / pageRead）。
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+const OUT_MAX = 4 * 1024 * 1024;          // shell 的 stdout / stderr 各留这么多
+const SHELL_TIMEOUT_MAX = 7 * 60 * 1000;  // 服务器那边一条命令等 8 分钟
+export const FILE_READ_MAX = 16 * 1024 * 1024;
+const LIST_MAX = 2000;
+
+const fail = (code, message) => ({ ok: false, error: { code, message, disposition: { delivery: 'not_delivered', retry: 'safe' } } });
+
+// ~ 和相对路径都从用户主目录算起
+export function resolvePath(p) {
+  const s = String(p ?? '').trim();
+  if (!s || s.includes('\0')) return '';
+  if (s === '~') return os.homedir();
+  if (s.startsWith('~/') || s.startsWith('~\\')) return path.join(os.homedir(), s.slice(2));
+  return path.resolve(os.homedir(), s);
+}
+
+// 用哪个壳。Windows 默认 PowerShell，并把输出编码钉成 UTF-8，中文不乱码。
+export function shellArgv(command, which = '') {
+  const win = process.platform === 'win32';
+  const sh = String(which || (win ? 'powershell' : 'sh')).toLowerCase();
+  if (sh === 'powershell' || sh === 'pwsh') {
+    const exe = sh === 'pwsh' ? 'pwsh' : win ? 'powershell.exe' : 'pwsh';
+    const pre = '[Console]::OutputEncoding=[Text.Encoding]::UTF8;$OutputEncoding=[Text.Encoding]::UTF8;$ProgressPreference="SilentlyContinue";';
+    return [exe, ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', pre + command]];
+  }
+  if (sh === 'cmd') return ['cmd.exe', ['/d', '/s', '/c', `chcp 65001 >nul & ${command}`]];
+  if (sh === 'bash') return ['bash', ['-lc', command]];
+  if (sh === 'sh') return ['/bin/sh', ['-c', command]];
+  return null;
+}
+
+export function runShell(p = {}) {
+  const command = String(p.command ?? '');
+  if (!command.trim()) return Promise.resolve(fail('BAD_PARAMS', 'shell 要给 command'));
+  const argv = shellArgv(command, p.shell);
+  if (!argv) return Promise.resolve(fail('BAD_PARAMS', 'shell 只认 powershell / pwsh / cmd / bash / sh'));
+  const cwd = p.cwd ? resolvePath(p.cwd) : os.homedir();
+  if (!cwd || !fs.existsSync(cwd)) return Promise.resolve(fail('NOT_FOUND', `没有这个目录：${String(p.cwd).slice(0, 200)}`));
+  const timeoutMs = Math.min(Math.max(Number(p.timeout) || 60000, 1000), SHELL_TIMEOUT_MAX);
+  const env = { ...process.env, ...(p.env && typeof p.env === 'object' ? Object.fromEntries(Object.entries(p.env).map(([k, v]) => [k, String(v)])) : {}) };
+
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const out = { stdout: [], stderr: [], n: { stdout: 0, stderr: 0 }, cut: false };
+    let timedOut = false;
+    let child;
+    try {
+      child = spawn(argv[0], argv[1], { cwd, env, windowsHide: true, stdio: [p.stdin !== undefined ? 'pipe' : 'ignore', 'pipe', 'pipe'] });
+    } catch (e) {
+      resolve(fail('SPAWN_FAILED', e.message));
+      return;
+    }
+    const keep = (which) => (b) => {
+      if (out.n[which] >= OUT_MAX) { out.cut = true; return; }
+      const room = OUT_MAX - out.n[which];
+      const part = b.length > room ? b.subarray(0, room) : b;
+      if (part.length < b.length) out.cut = true;
+      out[which].push(part);
+      out.n[which] += part.length;
+    };
+    child.stdout.on('data', keep('stdout'));
+    child.stderr.on('data', keep('stderr'));
+    if (p.stdin !== undefined) { child.stdin.on('error', () => {}); child.stdin.end(String(p.stdin)); }
+    const timer = setTimeout(() => {
+      timedOut = true;
+      // Windows 上 kill 只杀壳本身，它起的子进程还在；taskkill /t 连树一起收
+      if (process.platform === 'win32') spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore' }).on('error', () => {});
+      else child.kill('SIGKILL');
+    }, timeoutMs);
+    child.on('error', (e) => { clearTimeout(timer); resolve(fail(e.code === 'ENOENT' ? 'NOT_FOUND' : 'SPAWN_FAILED', `${argv[0]}：${e.message}`)); });
+    child.on('close', (code, signal) => {
+      clearTimeout(timer);
+      resolve({
+        ok: true,
+        data: {
+          exitCode: code, signal: signal || null, timedOut, truncated: out.cut, ms: Date.now() - started, cwd,
+          stdout: Buffer.concat(out.stdout).toString('utf8'),
+          stderr: Buffer.concat(out.stderr).toString('utf8'),
+        },
+      });
+    });
+  });
+}
+
+function statOf(abs, st) {
+  return {
+    path: abs,
+    type: st.isDirectory() ? 'dir' : st.isSymbolicLink() ? 'link' : st.isFile() ? 'file' : 'other',
+    size: st.size,
+    mtime: st.mtime.toISOString(),
+  };
+}
+
+export async function fileOp(p = {}) {
+  const action = String(p.action || '');
+  const abs = resolvePath(p.path);
+  if (!abs) return fail('BAD_PARAMS', 'file 要给 path');
+  const fsp = fs.promises;
+  try {
+    switch (action) {
+      case 'stat':
+        return { ok: true, data: statOf(abs, await fsp.lstat(abs)) };
+      case 'list': {
+        const depth = Math.min(Math.max(Math.floor(Number(p.depth) || 1), 1), 6);
+        const items = [];
+        let more = false;
+        const walk = async (dir, d) => {
+          let ents;
+          try { ents = await fsp.readdir(dir, { withFileTypes: true }); } catch (e) { if (dir === abs) throw e; return; }
+          for (const e of ents) {
+            if (items.length >= LIST_MAX) { more = true; return; }
+            const full = path.join(dir, e.name);
+            let st = null;
+            try { st = await fsp.lstat(full); } catch { /* 刚被删、没权限 */ }
+            items.push(st ? statOf(full, st) : { path: full, type: 'unknown' });
+            if (e.isDirectory() && d < depth) await walk(full, d + 1);
+          }
+        };
+        await walk(abs, 1);
+        return { ok: true, data: { path: abs, items, more } };
+      }
+      case 'read': {
+        const st = await fsp.stat(abs);
+        if (st.isDirectory()) return fail('IS_DIR', `${abs} 是目录：用 action:"list"`);
+        const offset = Math.max(Math.floor(Number(p.offset) || 0), 0);
+        const length = Math.min(Math.max(Math.floor(Number(p.length) || FILE_READ_MAX), 0), FILE_READ_MAX);
+        const fh = await fsp.open(abs, 'r');
+        try {
+          const buf = Buffer.alloc(Math.min(length, Math.max(st.size - offset, 0)));
+          const { bytesRead } = await fh.read(buf, 0, buf.length, offset);
+          const body = buf.subarray(0, bytesRead);
+          const enc = p.encoding === 'base64' ? 'base64' : 'utf8';
+          return { ok: true, data: { path: abs, size: st.size, offset, bytes: bytesRead, more: offset + bytesRead < st.size, encoding: enc, content: body.toString(enc) } };
+        } finally { await fh.close(); }
+      }
+      case 'write': {
+        if (p.content === undefined) return fail('BAD_PARAMS', 'write 要给 content');
+        const buf = Buffer.from(String(p.content), p.encoding === 'base64' ? 'base64' : 'utf8');
+        await fsp.mkdir(path.dirname(abs), { recursive: true });
+        if (p.append) await fsp.appendFile(abs, buf); else await fsp.writeFile(abs, buf);
+        return { ok: true, data: { path: abs, bytes: buf.length, appended: !!p.append } };
+      }
+      case 'mkdir':
+        await fsp.mkdir(abs, { recursive: true });
+        return { ok: true, data: { path: abs } };
+      case 'delete':
+        await fsp.rm(abs, { recursive: !!p.recursive, force: false });
+        return { ok: true, data: { path: abs, deleted: true } };
+      case 'move':
+      case 'copy': {
+        const to = resolvePath(p.to);
+        if (!to) return fail('BAD_PARAMS', `${action} 要给 to`);
+        await fsp.mkdir(path.dirname(to), { recursive: true });
+        if (action === 'move') await fsp.rename(abs, to);
+        else await fsp.cp(abs, to, { recursive: true, force: !!p.overwrite, errorOnExist: !p.overwrite });
+        return { ok: true, data: { from: abs, to } };
+      }
+      default:
+        return fail('BAD_PARAMS', 'file 的 action 只认 stat / list / read / write / mkdir / delete / move / copy');
+    }
+  } catch (e) {
+    const code = { ENOENT: 'NOT_FOUND', EACCES: 'PERM_DENIED', EPERM: 'PERM_DENIED', EEXIST: 'EXISTS', ENOTEMPTY: 'NOT_EMPTY', EISDIR: 'IS_DIR' }[e.code] || 'FS_ERROR';
+    return fail(code, `${e.code || ''} ${e.message}`.trim());
+  }
+}
+
+// ---------- 分页 ----------
+//
+// 宿主 → Chrome 一条最多 1MB。超出的回包整份写进临时目录，先回 { paged }，
+// 扩展再一段一段 page 取回、拼好再解析。最后一段取走时删文件；没取完的十分钟后清掉。
+
+const PAGE_DIR = path.join(os.tmpdir(), 'vcorp-desktop-pages');
+const PAGE_RAW = 600 * 1024;   // 每段原始字节，base64 后约 800KB
+const PAGE_TTL_MS = 10 * 60 * 1000;
+const PAGE_ID_RE = /^[a-f0-9]{24}$/;
+
+export function pageOut(body) {
+  fs.mkdirSync(PAGE_DIR, { recursive: true });
+  const now = Date.now();
+  for (const f of fs.readdirSync(PAGE_DIR)) {
+    try { if (now - fs.statSync(path.join(PAGE_DIR, f)).mtimeMs > PAGE_TTL_MS) fs.rmSync(path.join(PAGE_DIR, f), { force: true }); } catch { /* 别的进程在删 */ }
+  }
+  const id = crypto.randomBytes(12).toString('hex');
+  fs.writeFileSync(path.join(PAGE_DIR, `${id}.json`), body, { mode: 0o600 });
+  return { ok: true, paged: { id, size: body.length, chunk: PAGE_RAW } };
+}
+
+export function pageRead(id, offset) {
+  if (!PAGE_ID_RE.test(String(id))) return fail('BAD_PARAMS', 'page id 不合法');
+  const file = path.join(PAGE_DIR, `${id}.json`);
+  let fd;
+  try { fd = fs.openSync(file, 'r'); } catch { return fail('NOT_FOUND', '这一页已经过期或取完了'); }
+  try {
+    const size = fs.fstatSync(fd).size;
+    const at = Math.max(Math.floor(Number(offset) || 0), 0);
+    const buf = Buffer.alloc(Math.max(Math.min(PAGE_RAW, size - at), 0));
+    const n = fs.readSync(fd, buf, 0, buf.length, at);
+    const done = at + n >= size;
+    fs.closeSync(fd);
+    fd = null;
+    if (done) fs.rmSync(file, { force: true });
+    return { ok: true, page: { offset: at, data: buf.subarray(0, n).toString('base64'), done } };
+  } finally { if (fd !== null && fd !== undefined) fs.closeSync(fd); }
+}

package/native-host/host.js

@@ -0,0 +1,155 @@
+// 原生消息宿主 ai.vcorp.desktop —— 云端通道够到桌面的唯一一段。
+//
+// Chrome 每次 sendNativeMessage 起一个本进程：stdin 进一条消息（4 字节小端长度 + JSON），
+// stdout 回一条，Chrome 随即关管道。本进程只做两件事：
+//   hello：报出这台电脑的桌面设备身份（和本机 MCP 用同一个 machineId，所以两条通道里是同一台设备）
+//   run：把扩展审过的参数再审一遍，交给 agent-desktop，回它的信封
+// 扩展那一侧已经过了 desktop-policy.js；这里再审是因为扩展本身也可能出错，
+// 而真实输入（--headed）、截图、剪贴板读取这些不该因为一处疏漏就对云端打开。
+//
+// 完全模式（用户在本机 `vcorp-chrome desktop full on`）：run 不再查白名单，
+// 另有 shell / file 两种操作（见 full.js）；大回包分页，扩展用 page 取回。
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { runAgentDesktop, findBinary } from '../src/lib/desktop.js';
+import { machineId, desktopDeviceId, fullMode } from '../src/lib/paths.js';
+import {
+  DESKTOP_CMDS, REF_RE, filterWindows, checkObserved, recordOf, isBrowserMainTitle,
+} from '../extension/desktop-policy.js';
+import { VERSION } from '../src/lib/version.js';
+import { runShell, fileOp, pageOut, pageRead } from './full.js';
+
+// Chrome 收宿主回包的上限是 1MB，留出 JSON 外壳的余量
+const REPLY_MAX = 1000 * 1000;
+const IN_MAX = 1024 * 1024;
+
+const OPTS = new Set([
+  '--app', '--window-id', '--timeout-ms', '--role', '--name', '--text', '--nth', '--limit', '--property',
+  '--timeout', '--window', '--direction', '--amount', '--session', '--root', '--expected-app',
+]);
+const FLAGS = new Set(['-i', '--compact', '--skeleton']);
+const COMBO_RE = /^[a-z0-9][a-z0-9+_-]{0,39}$/i;
+const SESSION_RE = /^--session=cloud-[\w-]{1,64}$/;
+
+function denied(message) {
+  return { ok: false, error: { code: 'DESKTOP_DENIED', message, disposition: { delivery: 'not_delivered', retry: 'safe' } } };
+}
+
+// 返回 null 表示合规，否则是拒绝原因
+export function recheck(argv) {
+  if (!Array.isArray(argv) || !argv.length || argv.length > 40) return 'argv 不合法';
+  if (!argv.every((a) => typeof a === 'string' && a.length <= 20000 && !a.includes('\0'))) return 'argv 不合法';
+  const spec = DESKTOP_CMDS[argv[0]];
+  if (!spec || !spec.cloud) return `云端不能用 ${argv[0]}`;
+  const cut = argv.indexOf('--');
+  const head = cut < 0 ? argv.slice(1) : argv.slice(1, cut);
+  let session = false;
+  for (const a of head) {
+    if (FLAGS.has(a) || REF_RE.test(a) || /^\d{1,6}$/.test(a)) continue;
+    if (argv[0] === 'press' && COMBO_RE.test(a)) continue;
+    const eq = a.indexOf('=');
+    if (a.startsWith('--') && eq > 2 && OPTS.has(a.slice(0, eq))) {
+      if (a.startsWith('--session=')) { if (!SESSION_RE.test(a)) return 'session 不合法'; session = true; }
+      continue;
+    }
+    return `参数不在白名单里：${a.slice(0, 40)}`;
+  }
+  if (!session && !['list-apps', 'clipboard-set'].includes(argv[0])) return '缺少任务的 session';
+  return null;
+}
+
+function readMessage() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    process.stdin.on('data', (b) => {
+      chunks.push(b);
+      size += b.length;
+      if (size > IN_MAX + 4) reject(new Error('消息太大'));
+      const buf = Buffer.concat(chunks);
+      if (buf.length >= 4 && buf.length >= 4 + buf.readUInt32LE(0)) resolve(JSON.parse(buf.subarray(4, 4 + buf.readUInt32LE(0)).toString('utf8')));
+    });
+    process.stdin.on('end', () => reject(new Error('没有收到消息')));
+  });
+}
+
+// 完全模式下 argv 只查形状：是字符串数组、没有 NUL
+export function fullArgvOk(argv) {
+  return Array.isArray(argv) && argv.length > 0 && argv.length <= 200
+    && argv.every((a) => typeof a === 'string' && a.length <= 100000 && !a.includes('\0'));
+}
+
+function reply(obj, { paging = false } = {}) {
+  let body = Buffer.from(JSON.stringify(obj), 'utf8');
+  if (body.length > REPLY_MAX && paging) {
+    try { body = Buffer.from(JSON.stringify(pageOut(body)), 'utf8'); } catch { /* 落不了盘就照旧报太大 */ }
+  }
+  if (body.length > REPLY_MAX) {
+    body = Buffer.from(JSON.stringify({
+      ok: false,
+      error: {
+        code: 'TOO_LARGE',
+        message: `结果有 ${Math.round(body.length / 1024)}KB，超过原生消息 1MB 的上限`,
+        suggestion: 'snapshot 加 skeleton:true 先看轮廓，再用 root 往某一块里钻',
+        disposition: { delivery: 'unknown', retry: 'unsafe' },
+      },
+    }), 'utf8');
+  }
+  const len = Buffer.alloc(4);
+  len.writeUInt32LE(body.length, 0);
+  return new Promise((resolve) => process.stdout.write(Buffer.concat([len, body]), resolve));
+}
+
+async function main() {
+  const msg = await readMessage();
+  const full = fullMode();
+  if (msg?.op === 'hello') {
+    const machine = machineId();
+    const probe = await runAgentDesktop(['list-apps'], { timeoutMs: 15000 });
+    return reply({
+      ok: true,
+      device: { id: desktopDeviceId(machine), kind: 'desktop', machine, caps: { platform: process.platform, version: VERSION, full } },
+      ready: !!probe.ok,
+      full,
+      ...(probe.ok ? {} : { error: probe.error }),
+      binary: findBinary(),
+    });
+  }
+  // 分页回包的后续段：不管完全模式，取的只是本宿主刚写下的那份
+  if (msg?.op === 'page') return reply(pageRead(msg.id, msg.offset));
+  // 扩展每条桌面命令前问一次：开关只在这台电脑上，扩展不缓存它
+  if (msg?.op === 'mode') return reply({ ok: true, full });
+  const offFull = () => reply(denied('这台电脑没有打开桌面完全模式。请用户在这台电脑的终端运行 npx vcorp-chrome desktop full on'));
+  if (msg?.op === 'shell') {
+    if (!full) return offFull();
+    return reply(await runShell(msg.params || {}), { paging: true });
+  }
+  if (msg?.op === 'file') {
+    if (!full) return offFull();
+    return reply(await fileOp(msg.params || {}), { paging: true });
+  }
+  if (msg?.op === 'run' && full) {
+    if (!fullArgvOk(msg.argv)) return reply(denied('argv 不合法'));
+    const timeoutMs = Math.min(Math.max(Number(msg.timeoutMs) || 30000, 1000), 7 * 60 * 1000);
+    return reply(await runAgentDesktop(msg.argv, { timeoutMs }), { paging: true });
+  }
+  if (msg?.op === 'run') {
+    const why = recheck(msg.argv);
+    if (why) return reply(denied(why));
+    const timeoutMs = Math.min(Math.max(Number(msg.timeoutMs) || 30000, 1000), 90000);
+    const env = await runAgentDesktop(msg.argv, { timeoutMs });
+    // 浏览器主窗口的标题和树不出这台电脑：扩展那侧也会滤，这里是第二道
+    if (env.ok && msg.argv[0] === 'list-windows') env.data = filterWindows(env.data, 'cloud');
+    if (env.ok && msg.argv[0] === 'snapshot') {
+      const rec = recordOf(env.data);
+      if (isBrowserMainTitle(rec?.window?.title)) return reply(denied('浏览器主窗口不出这台电脑'));
+      try { checkObserved(rec); } catch (e) { return reply(denied(e.message)); }
+    }
+    return reply(env);
+  }
+  return reply(denied(`未知操作 ${String(msg?.op).slice(0, 20)}`));
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().then(() => process.exit(0), async (e) => { await reply(denied(`宿主出错：${e.message}`)); process.exit(0); });
+}

package/package.json

@@ -1,49 +1,53 @@
-{
-  "name": "vcorp-chrome",
-  "version": "1.8.1",
-  "description": "让任何 AI agent 操控你自己的 Chrome——带着全部登录态。MCP + Chrome 扩展，Claude Code / Codex / Cursor / Gemini CLI 通用。",
-  "type": "module",
-  "bin": {
-    "vcorp-chrome": "src/cli.js"
-  },
-  "files": [
-    "src",
-    "extension",
-    "docs",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "scripts": {
-    "mcp": "node src/cli.js mcp",
-    "bridge": "node src/cli.js bridge --foreground",
-    "doctor": "node src/cli.js doctor",
-    "build:loads": "node scripts/build-loads.mjs",
-    "test": "node --test test/protocol.test.js test/mcp.test.js test/fetch-pages.test.js test/liveness.test.js test/redact.test.js test/audit-redact.test.js test/learnings.test.js test/risk.test.js test/identity.test.js test/host.test.js test/presence.test.js test/act-script.test.js test/multi-instance.test.js test/compat.test.js test/cloud-policy.test.js test/loads.test.js",
-    "test:live": "node --test test/scenarios.test.js"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.22.0",
-    "ws": "^8.18.3"
-  },
-  "keywords": [
-    "mcp",
-    "chrome",
-    "browser-automation",
-    "claude-code",
-    "codex",
-    "cursor",
-    "ai-agent"
-  ],
-  "license": "MIT",
-  "author": "Wizard",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/wizd/huashu-chrome.git"
-  },
-  "devDependencies": {
-    "esbuild": "^0.24.2",
-    "jszip": "^3.10.1"
-  }
-}
+{
+  "name": "vcorp-chrome",
+  "version": "2.2.0",
+  "description": "让任何 AI agent 操控你自己的 Chrome——带着全部登录态。MCP + Chrome 扩展，Claude Code / Codex / Cursor / Gemini CLI 通用。",
+  "type": "module",
+  "bin": {
+    "vcorp-chrome": "src/cli.js"
+  },
+  "files": [
+    "src",
+    "extension",
+    "native-host",
+    "docs",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "mcp": "node src/cli.js mcp",
+    "bridge": "node src/cli.js bridge --foreground",
+    "doctor": "node src/cli.js doctor",
+    "build:loads": "node scripts/build-loads.mjs",
+    "test": "node --test test/protocol.test.js test/mcp.test.js test/fetch-pages.test.js test/liveness.test.js test/redact.test.js test/audit-redact.test.js test/learnings.test.js test/risk.test.js test/identity.test.js test/host.test.js test/presence.test.js test/act-script.test.js test/multi-instance.test.js test/compat.test.js test/cloud-policy.test.js test/loads.test.js test/desktop-policy.test.js test/desktop-full.test.js",
+    "test:live": "node --test test/scenarios.test.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.22.0",
+    "ws": "^8.18.3"
+  },
+  "keywords": [
+    "mcp",
+    "chrome",
+    "browser-automation",
+    "claude-code",
+    "codex",
+    "cursor",
+    "ai-agent"
+  ],
+  "license": "MIT",
+  "author": "Wizard",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wizd/huashu-chrome.git"
+  },
+  "devDependencies": {
+    "esbuild": "^0.24.2",
+    "jszip": "^3.10.1"
+  },
+  "optionalDependencies": {
+    "agent-desktop": "1.0.2"
+  }
+}

package/src/bridge.js

@@ -8,7 +8,7 @@
 // 网页的 Origin 是自己的域名，扩展的是 chrome-extension://<id>。只放后者进来。
 import { WebSocketServer } from 'ws';
 import fs from 'node:fs';
-import { DEFAULT_PORT, writeBridgeInfo, newToken, tokenEquals, audit, ensureHome, ALLOWLIST_FILE } from './lib/paths.js';
+import { DEFAULT_PORT, writeBridgeInfo, newToken, tokenEquals, audit, ensureHome, ALLOWLIST_FILE, machineId } from './lib/paths.js';
 import { VERSION } from './lib/version.js';
 // 纯字符串判定、不碰 chrome API，所以桥这边直接复用，不再抄一份
 import { scrubProse } from '../extension/redact.js';
@@ -112,6 +112,8 @@ export function startBridge({ port = DEFAULT_PORT, token = newToken(), writeInfo
     return pool.reduce((a, b) => (a.lastRx >= b.lastRx ? a : b));
   }
   const extLabel = (ws) => `Chrome ${ws.chromeVersion || '?'}${ws.headless ? ' · headless' : ''} · 扩展 ${ws.extVersion}`;
+  let machineCache = null;
+  const machine = () => (machineCache ??= machineId());
 
   const wss = new WebSocketServer({
     host: '127.0.0.1',
@@ -216,6 +218,8 @@ export function startBridge({ port = DEFAULT_PORT, token = newToken(), writeInfo
       // 老扩展不报 instanceId。退回按扩展 id 认——行为和单槽那版一样
       // （同一份代码的两个实例仍会互相替换），但至少不会跟新扩展混着算。
       ws.instanceId = msg.instanceId || `ext:${msg.extId || '?'}`;
+      // 设备号由实例号派生：同一个 Chrome profile 重启、重载扩展都不变（见 extension/device.js）
+      ws.deviceId = `browser-${String(ws.instanceId).replace(/[^\w.-]/g, '').slice(0, 64) || 'unknown'}`;
 
       // 同一个实例又连了一条：那是断线重连或重载扩展，旧的那条已经是死的，
       // 顶掉它。**只顶同实例的**——顶错了就退回单槽，每秒互踢的老毛病就回来了。
@@ -241,6 +245,10 @@ export function startBridge({ port = DEFAULT_PORT, token = newToken(), writeInfo
           + `命令路由到：${extLabel(primary())}`);
       }
       send(ws, { type: 'welcome', bridge: VERSION, v: PROTOCOL });
+      // 连上就给一份名单，哪怕是空的。扩展手里那份可能是上一个桥留下的：桥换过之后
+      // 旧连接不会再发 close，不推的话死会话要等下一条命令才被冲掉——面板就一直
+      // 显示着已经不在的 agent。
+      send(ws, { type: 'event', event: 'sessions', live: liveSessions() });
       broadcast({ type: 'event', event: 'extension_online' });
       flushWaiting();
       return;
@@ -265,6 +273,8 @@ export function startBridge({ port = DEFAULT_PORT, token = newToken(), writeInfo
       const ext = primary();
       send(ws, {
         type: 'welcome', bridge: VERSION, v: PROTOCOL,
+        // 设备目录与按 to.device 投递。老桥没有这一项：它会把指名的命令照样投给默认的那个 Chrome
+        devices: true,
         extensionOnline: !!ext,
         extensionVersion: ext?.extVersion,
         // 老 MCP 只认 versionMismatch：只在真需要人处理时置位，补丁号差异不再惊动它
@@ -286,6 +296,25 @@ export function startBridge({ port = DEFAULT_PORT, token = newToken(), writeInfo
     // agent → extension
     if (msg.type === 'cmd') {
       if (!agents.has(ws)) return;
+      // 本机设备目录：桥是唯一知道「有几个 Chrome 连着」的一方，这条由它自己答
+      if (msg.cmd === 'devices') {
+        const main = primary();
+        return send(ws, { type: 'res', id: msg.id, ok: true, data: { devices: liveExtensions().map((e) => ({
+          id: e.deviceId, kind: 'browser', name: extLabel(e), machine: machine(), online: true,
+          caps: { platform: 'chrome', version: e.extVersion, cmds: [] }, primary: e === main,
+        })) } });
+      }
+      // 指名道姓的命令只投给那一个实例。它不在就直说，不改投别的 Chrome——
+      // agent 指定设备正是因为它在意落在哪一台上
+      const want = msg.to?.device;
+      if (want) {
+        const hit = liveExtensions().find((e) => e.deviceId === want);
+        if (!hit) {
+          return send(ws, { type: 'res', id: msg.id, ok: false, error: { code: 'DEVICE_OFFLINE',
+            message: `浏览器设备 ${String(want).slice(0, 80)} 没有连着。用 devices 看看现在有哪些。` } });
+        }
+        return dispatch(ws, msg, hit);
+      }
       const target = primary();
       if (!target) return enqueue(ws, msg);
       return dispatch(ws, msg, target);
@@ -349,7 +378,7 @@ export function startBridge({ port = DEFAULT_PORT, token = newToken(), writeInfo
     // 只有 281 个不同的 id，最多的一个出现了 1088 次。
     // 路由用的一直是 connId:id，审计却记裸 id——「出事能查」这条承诺
     // 在数据结构层面就不成立。
-    audit({ ev: 'cmd', id: key, cmd: msg.cmd, client: ws.client, sid: ws.sid, params: redact(msg.params) });
+    audit({ ev: 'cmd', id: key, cmd: msg.cmd, client: ws.client, sid: ws.sid, device: target.deviceId, params: redact(msg.params) });
     // sid 盖章：扩展据此维护每个会话自己的受控 tab 槽（多 agent 并发隔离）。
     // live 是此刻还连着的会话，扩展拿它判断某个标签页「还有没有主」。
     // client / label 是给人看的：页面上的控制标记要写出「Codex CLI」而不是一串 sid。

package/src/cli.js

@@ -102,6 +102,42 @@ switch (cmd) {
     await doctor();
     break;
 
+  // 云端任务够到桌面要经原生消息宿主；本机 MCP 的 desktop 工具不需要这一步
+  case 'desktop': {
+    const nat = await import('./lib/native-install.js');
+    const sub = process.argv[3];
+    if (sub === 'install') {
+      const r = nat.install();
+      console.log(`已登记原生消息宿主 ${nat.HOST_NAME}（只允许扩展 ${r.id} 调用）`);
+      for (const p of r.placed) console.log(`  ✅ ${p}`);
+      if (!r.placed.length) console.log('  ⚠️ 没找到已安装的 Chrome / Edge / Chromium 配置目录');
+      console.log('\n回到扩展侧栏点「启用桌面能力」。');
+      for (const l of (await nat.status()).lines) console.log(`  ${l}`);
+    } else if (sub === 'uninstall') {
+      const r = nat.uninstall();
+      console.log(r.removed.length ? `已移除：\n  ${r.removed.join('\n  ')}` : '本来就没有登记。');
+    } else if (sub === 'status') {
+      const { fullMode } = await import('./lib/paths.js');
+      for (const l of (await nat.status()).lines) console.log(`  ${l}`);
+      console.log(`  完全模式：${fullMode() ? '开（云端任务可以跑命令、读写文件、用全部桌面命令）' : '关'}`);
+    } else if (sub === 'full') {
+      const { setFullMode, FULL_FILE } = await import('./lib/paths.js');
+      const v = process.argv[4];
+      if (v !== 'on' && v !== 'off') {
+        console.log('用法：vcorp-chrome desktop full on | off');
+        break;
+      }
+      if (setFullMode(v === 'on')) {
+        console.log(`已打开桌面完全模式（${FULL_FILE}）。`);
+        console.log('配对服务器上的任务现在可以在这台电脑上跑任意命令、读写任意文件、操作任何应用。');
+        console.log('关掉：npx vcorp-chrome desktop full off');
+      } else console.log('已关闭桌面完全模式。');
+    } else {
+      console.log('用法：vcorp-chrome desktop install | uninstall | status | full on|off');
+    }
+    break;
+  }
+
   case 'extension':
     printExtension();
     // --reveal：在访达 / 资源管理器里选中扩展文件夹，用户拖进 chrome://extensions 就装好了。
@@ -133,6 +169,8 @@ switch (cmd) {
   vcorp-chrome audit --stats [--days 7]   真实 agent 的用法统计：回合数、哪类调用最多、在哪儿浪费
   vcorp-chrome bridge --foreground   前台跑桥（调试用）
   vcorp-chrome install --dry-run     只看会改哪些配置，不写
+  vcorp-chrome desktop install|uninstall|status   让云端任务也能操作桌面应用（登记原生消息宿主）
+  vcorp-chrome desktop full on|off   完全模式：云端任务能跑命令、读写文件、用全部桌面命令
 
 配置目录 ${HOME}`);
 }
@@ -204,7 +242,6 @@ async function doctor() {
   fs.existsSync(mf)
     ? ok(`${path.join(ROOT, 'extension')}${alive ? '' : ''}（这只说明文件在；Chrome 是否从这里加载了，看上面「扩展在线」那行）`)
     : bad('扩展目录缺失', '重装 vcorp-chrome');
-
   // bridge.log 里最近一次断连：用户体感的「插件消失」到底是什么时候、断了多久
   try {
     const lines = fs.readFileSync(LOG_FILE, 'utf8').trim().split('\n').slice(-400);
@@ -216,6 +253,18 @@ async function doctor() {
     if (lastDown) console.log(`  ·  最近一次断开 ${lastDown}${lastUp ? `，最近一次连上 ${lastUp}` : '，之后没再连上'}（bridge.log，只有时分秒）`);
   } catch { /* 没日志就没日志 */ }
 
+  console.log('\n桌面');
+  {
+    const { findBinary, runAgentDesktop } = await import('./lib/desktop.js');
+    const bin = findBinary();
+    const t0 = Date.now();
+    const env = await runAgentDesktop(['list-apps'], { bin, timeoutMs: 15000 });
+    if (env.ok) ok(`agent-desktop 可用 · ${(env.data?.apps || []).length} 个应用 · ${Date.now() - t0}ms（${bin}）`);
+    else if (env.error?.code === 'PERM_DENIED') bad(`agent-desktop 没有辅助功能权限：${env.error.message}`, env.error.suggestion);
+    else bad(`desktop 工具用不了：[${env.error?.code}] ${env.error?.message}`,
+      '在 vcorp-chrome 的安装目录里补装 agent-desktop（npm i agent-desktop@1.0.2），或设 AGENT_DESKTOP_BIN 指到它的可执行文件');
+  }
+
   // 经验库里 agent 记下的「vcorp-chrome 的 X 不生效」——产品 bug 住在经验库里，
   // 没有这一栏就永远回不到开发者手上（screenshot 的 savePath 就是这么躺了一周的）
   try {