codex-partner 0.0.5__tar.gz → 0.0.7__tar.gz

{codex_partner-0.0.5 → codex_partner-0.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-partner
-Version: 0.0.5
+Version: 0.0.7
 Summary: A self-hosted web interface for managing persistent Codex tasks.
 Project-URL: Homepage, https://github.com/froststeam/Codex-Partner
 Project-URL: Repository, https://github.com/froststeam/Codex-Partner.git
@@ -9,6 +9,8 @@ Keywords: codex,agent,task-management,self-hosted
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Web Environment
 Classifier: Framework :: FastAPI
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
@@ -20,6 +22,7 @@ Requires-Dist: uvicorn[standard]>=0.27
 Requires-Dist: tomli>=2.0; python_version < "3.11"
 Requires-Dist: PyYAML>=6.0
 Requires-Dist: pexpect>=4.8; platform_system != "Windows"
+Requires-Dist: pywinpty>=2.0.13; platform_system == "Windows"
 Requires-Dist: python-dotenv>=1.0
 Requires-Dist: Pillow>=10.0
 
@@ -45,6 +48,19 @@ Codex Partner is a self-hosted control panel for long-running Codex work. It kee
 - Model and API provider management with health checks and failover
 - Codex memories, Skills, archive, recycle bin, and SSH workspace support
 - Default YOLO mode for newly created sessions
+- Safe terminal-to-web takeover: normal web sends ask before stopping a terminal turn; `Alt+Enter` keeps the message queued without interruption
+
+## Platform support
+
+Codex Partner runs natively on Linux, macOS, and Windows with Python 3.10 or newer.
+
+| Platform | Codex sessions | Workspace tools | Browser terminal | Background service |
+| --- | --- | --- | --- | --- |
+| Linux | Yes | Yes | POSIX PTY | systemd user service |
+| macOS | Yes | Yes | zsh/bash PTY | Run directly or use launchd |
+| Windows 10/11 | Yes | Yes | PowerShell through ConPTY | Run directly or use Task Scheduler |
+
+Windows terminal support uses `pywinpty`, which is installed automatically. Key-based remote SSH works when the OpenSSH client is installed. Browser password prompts for remote SSH are not available on native Windows; configure an SSH key first.
 
 ## Install
 
@@ -69,12 +85,49 @@ codex-partner
 
 Open <http://127.0.0.1:8787>.
 
-For access from other devices, set `CODEX_DASHBOARD_HOST=0.0.0.0`. Codex Partner signs browsers in with a username and password accepted by this server's SSH service; the password is verified by OpenSSH and is never stored. Put HTTPS in front of the service before entering an SSH password over an untrusted network.
+Linux keeps SSH browser authentication enabled by default. macOS and Windows default to unauthenticated loopback access because desktop installations normally do not run an SSH server. For access from other devices, set `CODEX_DASHBOARD_HOST=0.0.0.0`, configure `CODEX_DASHBOARD_AUTH=ssh`, and put HTTPS in front of the service. When authentication is handled by a reverse proxy, explicitly set `CODEX_DASHBOARD_AUTH=none`; Codex Partner rejects a non-loopback bind with an implicit unauthenticated default.
+
+### macOS
+
+Install Python and Node.js with Homebrew if they are not already available, then install and authenticate Codex:
+
+```bash
+brew install python node
+npm install --global @openai/codex
+codex login
+python3 -m pip install --user --upgrade codex-partner
+python3 -m codex_partner
+```
+
+Open <http://127.0.0.1:8787>. Application data defaults to `~/Library/Application Support/CodexPartner`; native Codex state remains in `~/.codex`.
+
+### Windows
+
+Run these commands in PowerShell. Install Python and Node.js first if they are not already available:
+
+```powershell
+winget install --id Python.Python.3.12 -e
+winget install --id OpenJS.NodeJS.LTS -e
+npm install --global @openai/codex
+codex login
+py -m pip install --user --upgrade codex-partner
+py -m codex_partner
+```
+
+Open <http://127.0.0.1:8787>. Application data defaults to `%LOCALAPPDATA%\CodexPartner`; native Codex state remains in `%USERPROFILE%\.codex`. If `codex` is not found after installing Node.js, close and reopen PowerShell so its `PATH` is refreshed.
+
+For local desktop use, keep the default `127.0.0.1` bind address. To set options for one PowerShell session:
+
+```powershell
+$env:CODEX_DASHBOARD_PORT = "8787"
+$env:CODEX_DASHBOARD_AUTH = "none"
+py -m codex_partner
+```
 
 ## Docker
 
 ```bash
-docker build -t codex-partner:0.0.5 .
+docker build -t codex-partner:0.0.7 .
 docker run -d --name codex-partner \
   -p 8787:8787 \
   --add-host=host.docker.internal:host-gateway \
@@ -83,11 +136,11 @@ docker run -d --name codex-partner \
   -v codex-partner-data:/var/lib/codex-partner \
   -v codex-home:/home/codex/.codex \
   -v codex-workspace:/workspace \
-  codex-partner:0.0.5
+  codex-partner:0.0.7
 docker exec -it codex-partner codex login
 ```
 
-## systemd
+## Linux systemd
 
 After completing the source installation above, stop the foreground process and install the user service:
 

{codex_partner-0.0.5 → codex_partner-0.0.7}/README.md

@@ -20,6 +20,19 @@ Codex Partner is a self-hosted control panel for long-running Codex work. It kee
 - Model and API provider management with health checks and failover
 - Codex memories, Skills, archive, recycle bin, and SSH workspace support
 - Default YOLO mode for newly created sessions
+- Safe terminal-to-web takeover: normal web sends ask before stopping a terminal turn; `Alt+Enter` keeps the message queued without interruption
+
+## Platform support
+
+Codex Partner runs natively on Linux, macOS, and Windows with Python 3.10 or newer.
+
+| Platform | Codex sessions | Workspace tools | Browser terminal | Background service |
+| --- | --- | --- | --- | --- |
+| Linux | Yes | Yes | POSIX PTY | systemd user service |
+| macOS | Yes | Yes | zsh/bash PTY | Run directly or use launchd |
+| Windows 10/11 | Yes | Yes | PowerShell through ConPTY | Run directly or use Task Scheduler |
+
+Windows terminal support uses `pywinpty`, which is installed automatically. Key-based remote SSH works when the OpenSSH client is installed. Browser password prompts for remote SSH are not available on native Windows; configure an SSH key first.
 
 ## Install
 
@@ -44,12 +57,49 @@ codex-partner
 
 Open <http://127.0.0.1:8787>.
 
-For access from other devices, set `CODEX_DASHBOARD_HOST=0.0.0.0`. Codex Partner signs browsers in with a username and password accepted by this server's SSH service; the password is verified by OpenSSH and is never stored. Put HTTPS in front of the service before entering an SSH password over an untrusted network.
+Linux keeps SSH browser authentication enabled by default. macOS and Windows default to unauthenticated loopback access because desktop installations normally do not run an SSH server. For access from other devices, set `CODEX_DASHBOARD_HOST=0.0.0.0`, configure `CODEX_DASHBOARD_AUTH=ssh`, and put HTTPS in front of the service. When authentication is handled by a reverse proxy, explicitly set `CODEX_DASHBOARD_AUTH=none`; Codex Partner rejects a non-loopback bind with an implicit unauthenticated default.
+
+### macOS
+
+Install Python and Node.js with Homebrew if they are not already available, then install and authenticate Codex:
+
+```bash
+brew install python node
+npm install --global @openai/codex
+codex login
+python3 -m pip install --user --upgrade codex-partner
+python3 -m codex_partner
+```
+
+Open <http://127.0.0.1:8787>. Application data defaults to `~/Library/Application Support/CodexPartner`; native Codex state remains in `~/.codex`.
+
+### Windows
+
+Run these commands in PowerShell. Install Python and Node.js first if they are not already available:
+
+```powershell
+winget install --id Python.Python.3.12 -e
+winget install --id OpenJS.NodeJS.LTS -e
+npm install --global @openai/codex
+codex login
+py -m pip install --user --upgrade codex-partner
+py -m codex_partner
+```
+
+Open <http://127.0.0.1:8787>. Application data defaults to `%LOCALAPPDATA%\CodexPartner`; native Codex state remains in `%USERPROFILE%\.codex`. If `codex` is not found after installing Node.js, close and reopen PowerShell so its `PATH` is refreshed.
+
+For local desktop use, keep the default `127.0.0.1` bind address. To set options for one PowerShell session:
+
+```powershell
+$env:CODEX_DASHBOARD_PORT = "8787"
+$env:CODEX_DASHBOARD_AUTH = "none"
+py -m codex_partner
+```
 
 ## Docker
 
 ```bash
-docker build -t codex-partner:0.0.5 .
+docker build -t codex-partner:0.0.7 .
 docker run -d --name codex-partner \
   -p 8787:8787 \
   --add-host=host.docker.internal:host-gateway \
@@ -58,11 +108,11 @@ docker run -d --name codex-partner \
   -v codex-partner-data:/var/lib/codex-partner \
   -v codex-home:/home/codex/.codex \
   -v codex-workspace:/workspace \
-  codex-partner:0.0.5
+  codex-partner:0.0.7
 docker exec -it codex-partner codex login
 ```
 
-## systemd
+## Linux systemd
 
 After completing the source installation above, stop the foreground process and install the user service:
 

{codex_partner-0.0.5 → codex_partner-0.0.7}/app.py

@@ -7,7 +7,6 @@ import binascii
 import codecs
 import errno
 import getpass
-import fcntl
 import glob
 import hashlib
 import io
@@ -16,7 +15,6 @@ import json
 import mimetypes
 import os
 import posixpath
-import pty
 import platform
 import re
 import signal
@@ -27,7 +25,6 @@ import sqlite3
 import socket
 import struct
 import subprocess
-import termios
 import time
 import uuid
 import urllib.error
@@ -43,7 +40,20 @@ from fastapi.responses import FileResponse, JSONResponse, StreamingResponse
 from starlette.middleware.gzip import GZipMiddleware
 from dotenv import load_dotenv
 import yaml
-import pexpect
+try:
+    import fcntl
+    import pty
+    import termios
+except ImportError:  # Native Windows has no POSIX PTY APIs.
+    fcntl = pty = termios = None
+try:
+    import pexpect
+except ImportError:  # Password-driven SSH prompts are optional on Windows.
+    pexpect = None
+try:
+    from winpty import PtyProcess as WindowsPtyProcess
+except ImportError:  # Installed through the Windows-only pywinpty dependency.
+    WindowsPtyProcess = None
 from PIL import Image, ImageOps, ImageSequence, UnidentifiedImageError
 
 from codex_partner import APP_NAME, APP_VERSION
@@ -59,6 +69,14 @@ from codex_partner.discovery import (
     official_candidates,
     vscode_candidates,
 )
+from codex_partner.platform_support import (
+    IS_WINDOWS,
+    default_auth_mode,
+    default_data_dir,
+    local_shell_command,
+    prepare_subprocess_command,
+    validate_bind_auth,
+)
 from codex_partner.schemas import (
     ApprovalResolveIn,
     AvatarIn,
@@ -91,12 +109,12 @@ except ModuleNotFoundError:  # Python 3.10
 ROOT = Path(__file__).resolve().parent
 load_dotenv(ROOT / ".env", override=False)
 STATIC = ROOT / "static"
-DATA_DIR = Path(os.getenv("CODEX_DASHBOARD_DATA", str(ROOT / "data")))
+DATA_DIR = default_data_dir(ROOT)
 DATA_DIR.mkdir(parents=True, exist_ok=True)
 DB_PATH = DATA_DIR / "dashboard.sqlite3"
 CODEX_HOME = Path(os.getenv("CODEX_HOME", str(Path.home() / ".codex"))).expanduser().resolve()
 CODEX_MEMORY_DIR = CODEX_HOME / "memories"
-AUTH_MODE = os.getenv("CODEX_DASHBOARD_AUTH", "ssh").strip().lower()
+AUTH_MODE = os.getenv("CODEX_DASHBOARD_AUTH", default_auth_mode()).strip().lower()
 if AUTH_MODE not in {"ssh", "none"}:
     raise RuntimeError("CODEX_DASHBOARD_AUTH must be 'ssh' or 'none'")
 AUTH_COOKIE = "codex_partner_session"
@@ -128,6 +146,7 @@ def configured_port(name: str, default: int) -> int:
 
 
 DASHBOARD_HOST = os.getenv("CODEX_DASHBOARD_HOST", "127.0.0.1").strip() or "127.0.0.1"
+validate_bind_auth(DASHBOARD_HOST, AUTH_MODE, "CODEX_DASHBOARD_AUTH" in os.environ)
 DASHBOARD_PORT = configured_port("CODEX_DASHBOARD_PORT", 8787)
 AUTH_SSH_PORT = configured_port("CODEX_DASHBOARD_AUTH_SSH_PORT", 22)
 SSH_BIN = shutil.which("ssh") or "ssh"
@@ -135,7 +154,12 @@ SSH_CONFIG = Path.home() / ".ssh/config"
 SSH_FIXED_HOST = os.getenv("CODEX_DASHBOARD_SSH_HOST", "").strip()
 SSH_FIXED_USER = os.getenv("CODEX_DASHBOARD_SSH_USER", "").strip()
 SSH_FIXED_PORT = configured_port("CODEX_DASHBOARD_SSH_PORT", 22)
-SSH_RUNTIME_DIR = Path(os.getenv("XDG_RUNTIME_DIR", f"/run/user/{os.getuid()}")) / "codex-dashboard-ssh"
+if os.getenv("XDG_RUNTIME_DIR"):
+    SSH_RUNTIME_DIR = Path(os.environ["XDG_RUNTIME_DIR"]) / "codex-dashboard-ssh"
+elif hasattr(os, "getuid") and platform.system() == "Linux":
+    SSH_RUNTIME_DIR = Path(f"/run/user/{os.getuid()}") / "codex-dashboard-ssh"
+else:
+    SSH_RUNTIME_DIR = DATA_DIR / "ssh-runtime"
 try:
     SSH_RUNTIME_DIR.mkdir(parents=True, exist_ok=True, mode=0o700)
     SSH_RUNTIME_DIR.chmod(0o700)
@@ -207,7 +231,7 @@ def codex_management_snapshot() -> dict[str, Any]:
     if CODEX_AVAILABLE:
         try:
             result = subprocess.run(
-                [CODEX_BIN, "--version"],
+                prepare_subprocess_command([CODEX_BIN, "--version"]),
                 stdin=subprocess.DEVNULL,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT,
@@ -1154,8 +1178,23 @@ def rollout_writer_pids(path: str, refresh: bool = False) -> set[int]:
     try:
         processes = os.scandir("/proc")
     except OSError:
+        lsof = shutil.which("lsof")
+        if lsof:
+            try:
+                result = subprocess.run(
+                    [lsof, "-t", "--", target],
+                    capture_output=True,
+                    text=True,
+                    encoding="utf-8",
+                    errors="replace",
+                    timeout=2,
+                    check=False,
+                )
+                writers = {int(value) for value in result.stdout.splitlines() if value.isdigit()}
+            except (OSError, subprocess.SubprocessError, ValueError):
+                pass
         rollout_writer_cache[target] = (stamp, writers)
-        return writers
+        return set(writers)
     with processes:
         for process in processes:
             if not process.name.isdigit():
@@ -1232,11 +1271,13 @@ def interrupt_rollout_writers(path: str) -> set[int]:
     writers = native_rollout_writer_pids(path, refresh=True)
     for pid in writers:
         try:
-            command = Path(f"/proc/{pid}/cmdline").read_bytes().replace(b"\0", b" ")
-            if b"app-server" in command:
-                continue
+            command_path = Path(f"/proc/{pid}/cmdline")
+            if command_path.is_file():
+                command = command_path.read_bytes().replace(b"\0", b" ")
+                if b"app-server" in command:
+                    continue
             os.kill(pid, signal.SIGINT)
-        except OSError:
+        except (OSError, ValueError):
             continue
     return writers
 
@@ -1826,7 +1867,7 @@ def ssh_config_aliases(path: Path = SSH_CONFIG, seen: Optional[set[Path]] = None
         return []
     for line in lines:
         try:
-            parts = shlex.split(line, comments=True, posix=True)
+            parts = shlex.split(line, comments=True, posix=not IS_WINDOWS)
         except ValueError:
             continue
         if not parts:
@@ -1995,6 +2036,8 @@ exit 1
 
 
 def password_ssh_connect(host: str, password: str) -> tuple[bool, str]:
+    if pexpect is None:
+        return False, "SSH password authentication is unavailable on this platform"
     args = [
         *ssh_options(host, batch=False),
         "-o", "ConnectTimeout=10",
@@ -3613,7 +3656,7 @@ def appserver_turn_inputs(task: dict, message: str) -> list[dict[str, Any]]:
             continue
         seen.add((kind, path))
         if kind == "mention":
-            inputs.append({"type": "mention", "name": PurePosixPath(path).name, "path": path})
+            inputs.append({"type": "mention", "name": Path(path).name, "path": path})
         else:
             item: dict[str, Any] = {"type": kind, "path": path}
             if kind == "localImage":
@@ -3867,6 +3910,13 @@ async def close_terminal_session(terminal_id: str) -> None:
     if not session:
         return
     session["closed"] = True
+    windows_pty = session.get("windows_pty")
+    if windows_pty is not None:
+        try:
+            await asyncio.to_thread(lambda: windows_pty.close(force=True))
+        except Exception:
+            pass
+        return
     fd, pid = session.get("fd"), session.get("pid")
     loop = session.get("loop")
     if loop and fd is not None:
@@ -3905,6 +3955,81 @@ def set_terminal_size(fd: int, cols: int, rows: int) -> None:
     fcntl.ioctl(fd, termios.TIOCSWINSZ, struct.pack("HHHH", rows, cols, 0, 0))
 
 
+async def windows_terminal_socket(websocket: WebSocket, task_id: str, cwd: str, ssh_host: str) -> None:
+    if WindowsPtyProcess is None:
+        await websocket.send_json({"type": "error", "message": "Windows terminal support requires pywinpty"})
+        await websocket.close(code=1011)
+        return
+    env = os.environ.copy()
+    env.update({"TERM": "xterm-256color", "COLORTERM": "truecolor"})
+    if ssh_host:
+        remote_command = f"cd -- {shlex.quote(cwd)} && exec \"${{SHELL:-/bin/sh}}\" -il"
+        command = [*ssh_options(ssh_host, batch=True, tty=True), ssh_destination(ssh_host), remote_command]
+        shell_label = f"ssh:{ssh_host}"
+    else:
+        command, shell_label = local_shell_command()
+    try:
+        spawn_cwd = cwd if not ssh_host else str(DEFAULT_WORKSPACE)
+        process = await asyncio.to_thread(WindowsPtyProcess.spawn, command, cwd=spawn_cwd, env=env)
+    except Exception as exc:
+        await websocket.send_json({"type": "error", "message": f"terminal start failed: {exc}"})
+        await websocket.close(code=1011)
+        return
+
+    terminal_id = str(uuid.uuid4())
+    session = {"windows_pty": process, "task_id": task_id, "closed": False}
+    terminal_sessions[terminal_id] = session
+    await websocket.send_json({"type": "ready", "terminal_id": terminal_id, "cwd": cwd, "shell": shell_label})
+
+    async def pump_output() -> None:
+        while not session["closed"]:
+            try:
+                data = await asyncio.to_thread(process.read, 65536)
+            except (EOFError, OSError):
+                data = ""
+            if data:
+                await websocket.send_json({"type": "output", "data": data})
+                continue
+            await websocket.send_json({"type": "exit", "code": getattr(process, "exitstatus", None)})
+            return
+
+    async def receive_input() -> None:
+        while True:
+            incoming = await websocket.receive_json()
+            kind = incoming.get("type")
+            if kind == "input":
+                value = incoming.get("data", incoming.get("input", ""))
+                if isinstance(value, str) and value:
+                    await asyncio.to_thread(process.write, value)
+            elif kind == "resize":
+                try:
+                    cols = max(20, min(int(incoming.get("cols", 120)), 400))
+                    rows = max(4, min(int(incoming.get("rows", 32)), 160))
+                    await asyncio.to_thread(process.setwinsize, rows, cols)
+                except (OSError, ValueError, TypeError):
+                    continue
+            elif kind == "ping":
+                await websocket.send_json({"type": "pong"})
+            elif kind == "close":
+                return
+
+    pump_task = asyncio.create_task(pump_output())
+    receive_task = asyncio.create_task(receive_input())
+    try:
+        _done, pending = await asyncio.wait({pump_task, receive_task}, return_when=asyncio.FIRST_COMPLETED)
+        for waiter in pending:
+            waiter.cancel()
+        await asyncio.gather(*pending, return_exceptions=True)
+    except WebSocketDisconnect:
+        pass
+    finally:
+        for waiter in (pump_task, receive_task):
+            if not waiter.done():
+                waiter.cancel()
+        await asyncio.gather(pump_task, receive_task, return_exceptions=True)
+        await close_terminal_session(terminal_id)
+
+
 @app.websocket("/ws/terminal/{task_id}")
 async def terminal_socket(websocket: WebSocket, task_id: str):
     if not websocket_auth_session(websocket):
@@ -3921,11 +4046,17 @@ async def terminal_socket(websocket: WebSocket, task_id: str):
             await websocket.close(code=4428, reason="SSH login required")
             return
     await websocket.accept()
-    terminal_id = str(uuid.uuid4())
     cwd = task["workspace"] if ssh_host else (task["workspace"] if Path(task["workspace"]).is_dir() else str(DEFAULT_WORKSPACE))
-    shell = f"ssh:{ssh_host}" if ssh_host else os.environ.get("SHELL", "/bin/bash")
-    if not ssh_host and not Path(shell).is_file():
-        shell = "/bin/bash"
+    if IS_WINDOWS:
+        await windows_terminal_socket(websocket, task_id, cwd, ssh_host)
+        return
+    terminal_id = str(uuid.uuid4())
+    shell_command, local_shell = local_shell_command()
+    shell = f"ssh:{ssh_host}" if ssh_host else local_shell
+    if pty is None or fcntl is None or termios is None:
+        await websocket.send_json({"type": "error", "message": "PTY support is unavailable on this platform"})
+        await websocket.close(code=1011)
+        return
     pid, fd = pty.fork()
     if pid == 0:
         try:
@@ -3937,7 +4068,7 @@ async def terminal_socket(websocket: WebSocket, task_id: str):
                 os.execvpe(command[0], command, env)
             else:
                 os.chdir(cwd)
-                os.execvpe(shell, [shell, "-i"], env)
+                os.execvpe(shell_command[0], shell_command, env)
         except Exception as exc:
             os.write(2, f"terminal start failed: {exc}\n".encode())
         os._exit(127)
@@ -4176,6 +4307,61 @@ async def enqueue_task_message(task_id: str, body: str, client_message_id: Optio
     return db.one("SELECT * FROM task_messages WHERE id=?", (message_id,)) or {"id": message_id, "status": "queued"}
 
 
+async def terminal_turn_active(task_id: str) -> bool:
+    """Refresh and report a terminal-owned turn without confusing dashboard work."""
+    await refresh_live_external_turn(task_id)
+    return bool(refresh_external_primary(task_id)) and not dashboard_owns_task(task_id)
+
+
+async def interrupt_browser_terminal(task_id: str) -> None:
+    """Send Ctrl+C to the foreground process in every matching browser terminal."""
+    matching = [session for session in terminal_sessions.values() if session.get("task_id") == task_id and not session.get("closed")]
+    for session in matching:
+        try:
+            if process := session.get("windows_pty"):
+                await asyncio.to_thread(process.write, "\x03")
+            elif session.get("fd") is not None:
+                os.write(session["fd"], b"\x03")
+        except (EOFError, OSError):
+            continue
+
+
+async def stop_terminal_for_web_takeover(task_id: str) -> bool:
+    """Stop terminal-owned turns without letting Goal auto-resume race the web message."""
+    await refresh_live_external_turn(task_id)
+    tracked = list((external_turn_sets.get(task_id) or {}).values())
+    if not tracked:
+        return False
+    await interrupt_browser_terminal(task_id)
+    paths = {str(turn.get("path") or "") for turn in tracked} - {""}
+    for path in paths:
+        await asyncio.to_thread(interrupt_rollout_writers, path)
+    clear_external_turns(task_id)
+    stamp = now()
+    for external in tracked:
+        session_id = str(external.get("session_id") or "")
+        if not session_id:
+            continue
+        db.execute(
+            "UPDATE sessions SET status='stopped',finished_at=COALESCE(finished_at,?),exit_code=COALESCE(exit_code,130),summary='Terminal turn stopped for web takeover' WHERE id=?",
+            (stamp, session_id),
+        )
+        payload = {"type": "turn_aborted", "status": "stopped", "reason": "Web session took over the terminal turn"}
+        db.execute(
+            "INSERT INTO events (session_id,ts,stream,payload) VALUES (?,?,?,?)",
+            (session_id, stamp, "rollout", json.dumps(payload, ensure_ascii=False)),
+        )
+        await broadcast_task(task_id, {"type": "event", "session_id": session_id, "stream": "rollout", "payload": payload, "ts": stamp})
+    db.execute(
+        "UPDATE tasks SET status='stopped',active_session_id=NULL,execution_source='',execution_turn_id='',run_mode='',last_error='',updated_at=? WHERE id=?",
+        (stamp, task_id),
+    )
+    result = task_or_404(task_id)
+    await broadcast_task(task_id, {"type": "task_status", "task": result, "source": {"kind": "web_takeover"}})
+    await broadcast_overview(task_id, {"kind": "web_takeover"})
+    return True
+
+
 def command_event_session(task: dict) -> str:
     if task.get("active_session_id") and db.one("SELECT id FROM sessions WHERE id=?", (task["active_session_id"],)):
         return task["active_session_id"]
@@ -4473,7 +4659,7 @@ async def install_codex(force: bool = False, _: Any = Depends(auth)):
         env["PATH"] = os.pathsep.join((str(Path(npm).parent), str(extra_bin), env.get("PATH", "")))
         try:
             process = await asyncio.create_subprocess_exec(
-                *command,
+                *prepare_subprocess_command(command),
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.STDOUT,
                 env=env,
@@ -5655,6 +5841,8 @@ async def supervise(task: dict, session_id: str, providers: list[Optional[dict]]
                 cwd = None
                 env.pop("OPENAI_API_KEY", None)
                 env.pop("OPENAI_BASE_URL", None)
+            else:
+                spawn_cmd = prepare_subprocess_command(spawn_cmd)
             process = await asyncio.create_subprocess_exec(*spawn_cmd, cwd=cwd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.STDOUT, env=env)
             async with running_lock:
                 running[task_id] = process
@@ -5802,6 +5990,16 @@ async def clear_task_messages(task_id: str, _: Any = Depends(auth)):
 
 @app.post("/api/tasks/{task_id}/messages")
 async def post_task_message(task_id: str, payload: TaskMessageIn, _: Any = Depends(auth)):
+    if payload.delivery != "queue" and await terminal_turn_active(task_id):
+        if not payload.takeover_terminal:
+            raise HTTPException(
+                409,
+                detail={
+                    "code": "terminal_turn_active",
+                    "message": "Codex 正在终端中运行。是否停止终端 turn 并由网页接管？",
+                },
+            )
+        await stop_terminal_for_web_takeover(task_id)
     return await enqueue_task_message(task_id, payload.message, payload.client_message_id, payload.delivery)
 
 
@@ -6249,7 +6447,7 @@ def git_diff_summary(task: dict) -> str:
     sections = []
     for index, command in enumerate(commands):
         try:
-            completed = ssh_capture(task["ssh_host"], shlex.join(command), 12) if task.get("ssh_host") else subprocess.run(command, capture_output=True, text=True, timeout=8, check=False)
+            completed = ssh_capture(task["ssh_host"], shlex.join(command), 12) if task.get("ssh_host") else subprocess.run(prepare_subprocess_command(command), capture_output=True, text=True, timeout=8, check=False)
         except (OSError, subprocess.TimeoutExpired) as exc:
             return f"无法读取 Git 变更：{exc}"
         output = (completed.stdout or completed.stderr).strip()
@@ -6805,6 +7003,8 @@ async def supervise_operation(task: dict, session_id: str, cmd: list[str]) -> No
             connection = await require_ssh_connection(task["ssh_host"], codex=True)
             spawn_cmd = [*ssh_options(task["ssh_host"], batch=True), ssh_destination(task["ssh_host"]), shlex.join([connection["codex_bin"], *cmd[1:]])]
             cwd = None
+        else:
+            spawn_cmd = prepare_subprocess_command(spawn_cmd)
         process = await asyncio.create_subprocess_exec(*spawn_cmd, cwd=cwd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.STDOUT, env=os.environ.copy())
         async with running_lock:
             running[task_id] = process

{codex_partner-0.0.5 → codex_partner-0.0.7}/codex_partner/__init__.py

@@ -1,4 +1,4 @@
 """Codex Partner application package."""
 
 APP_NAME = "Codex Partner"
-APP_VERSION = "0.0.5"
+APP_VERSION = "0.0.7"

{codex_partner-0.0.5 → codex_partner-0.0.7}/codex_partner/app_server.py

@@ -4,6 +4,8 @@ import asyncio
 import json
 from typing import Any, Awaitable, Callable, Optional
 
+from .platform_support import prepare_subprocess_command
+
 
 NotificationHandler = Callable[[str, dict], Awaitable[None]]
 
@@ -55,8 +57,9 @@ class AppServerClient:
                 await asyncio.wait_for(self.process.wait(), 1)
             except Exception:
                 pass
+        command = prepare_subprocess_command(self.command)
         self.process = await asyncio.create_subprocess_exec(
-            *self.command,
+            *command,
             stdin=asyncio.subprocess.PIPE,
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.DEVNULL,

{codex_partner-0.0.5 → codex_partner-0.0.7}/codex_partner/database.py

@@ -2,6 +2,7 @@
 
 import sqlite3
 import threading
+from contextlib import closing
 from pathlib import Path
 from typing import Callable, Optional
 
@@ -27,7 +28,7 @@ class Database:
         return connection
 
     def initialize(self) -> None:
-        with self.lock, self.connect() as connection:
+        with self.lock, closing(self.connect()) as connection:
             connection.executescript(
                 """
                 CREATE TABLE IF NOT EXISTS tasks (
@@ -262,15 +263,15 @@ class Database:
         )
 
     def one(self, sql: str, args: tuple = ()) -> Optional[dict]:
-        with self.lock, self.connect() as connection:
+        with self.lock, closing(self.connect()) as connection:
             row = connection.execute(sql, args).fetchone()
             return dict(row) if row else None
 
     def all(self, sql: str, args: tuple = ()) -> list[dict]:
-        with self.lock, self.connect() as connection:
+        with self.lock, closing(self.connect()) as connection:
             return [dict(row) for row in connection.execute(sql, args).fetchall()]
 
     def execute(self, sql: str, args: tuple = ()) -> None:
-        with self.lock, self.connect() as connection:
+        with self.lock, closing(self.connect()) as connection:
             connection.execute(sql, args)
             connection.commit()