feat(vnext): ship the Electron + Node architecture upgrade

.gitattributes

@@ -0,0 +1,5 @@
+package-lock.json text eol=lf
+apps/desktop/release/artifact-audit-policy.v1.json text eol=lf
+web/index.html text eol=lf
+web/dist/index.html text eol=lf
+web/dist/assets/*.js text eol=lf -whitespace

.github/workflows/publish-npm.yml

@@ -35,7 +35,29 @@ jobs:
           package-manager-cache: false
 
       - run: npm ci
+      - run: npm run workspaces:check
       - run: npm run web:build
+      - run: npx playwright install --with-deps chromium
+      - run: npm run web:test:e2e
       - run: npm test
-      - run: npm pack --dry-run --json
+      - run: npm run package:smoke
+      - run: npm audit --omit=dev --audit-level=moderate
+      - run: npm audit --audit-level=high
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "16.20.2"
+          package-manager-cache: false
+
+      - run: npm ci --workspaces=false --omit=dev
+      - run: npm run runtime:verify-node16
+      - run: npm run package:verify-root-tree
+      - run: npm run package:smoke:lifecycle
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
       - run: npm publish --access public

.github/workflows/publish.yml

@@ -1,9 +1,16 @@
 name: publish
 
 on:
-  push:
-    tags:
-      - "v*"
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing v-prefixed release tag to publish
+        required: true
+        type: string
+
+concurrency:
+  group: publish-${{ inputs.release_tag }}
+  cancel-in-progress: false
 
 permissions:
   contents: read
@@ -14,14 +21,22 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: refs/tags/${{ inputs.release_tag }}
           fetch-depth: 0
           persist-credentials: false
 
       - name: Verify release tag commit is on main
         shell: pwsh
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
+          if ($env:RELEASE_TAG -notmatch '^v[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$') {
+            Write-Error "release_tag must be a v-prefixed semantic version."
+            exit 1
+          }
           git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
-          git merge-base --is-ancestor "$env:GITHUB_SHA" "refs/remotes/origin/main"
+          $releaseCommit = git rev-parse HEAD
+          git merge-base --is-ancestor "$releaseCommit" "refs/remotes/origin/main"
           if ($LASTEXITCODE -ne 0) {
             Write-Error "Release tags must point to a commit contained in main."
             exit 1
@@ -35,7 +50,7 @@ jobs:
       - name: Verify release version consistency
         shell: pwsh
         env:
-          RELEASE_TAG: ${{ github.ref_name }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           node scripts/verify-release-version.js --tag $env:RELEASE_TAG
           node scripts/read-release-metadata.js --tag $env:RELEASE_TAG
@@ -45,8 +60,29 @@ jobs:
           dotnet-version: "10.0.x"
 
       - run: npm ci
+      - run: npm run workspaces:check
       - run: npm run web:build
+      - run: npx playwright install --with-deps chromium
+      - run: npm run web:test:e2e
       - run: npm test
+      - run: npm run package:smoke
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "16.20.2"
+          cache: npm
+
+      - run: npm ci --workspaces=false --omit=dev
+      - run: npm run runtime:verify-node16
+      - run: npm run package:verify-root-tree
+      - run: npm run package:smoke:lifecycle
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          cache: npm
+
+      - run: npm ci
       - run: dotnet build CodexProviderSync.sln --configuration Release
       - run: dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj --configuration Release --no-build
       - run: dotnet test desktop/CodexProviderSync.Application.Tests/CodexProviderSync.Application.Tests.csproj --configuration Release --no-build
@@ -62,7 +98,7 @@ jobs:
       - name: Package release assets
         shell: pwsh
         env:
-          RELEASE_TAG: ${{ github.ref_name }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           $version = $env:RELEASE_TAG.Substring(1)
           ./scripts/package-release-assets.ps1 -Version $version -PublishOutput artifacts/win-x64 -Output artifacts/release
@@ -83,6 +119,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: refs/tags/${{ inputs.release_tag }}
           persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.1
@@ -92,7 +129,9 @@ jobs:
       - name: Resolve versioned Chinese release announcement
         id: release_metadata
         shell: bash
-        run: node scripts/read-release-metadata.js --tag "$GITHUB_REF_NAME" --github-output "$GITHUB_OUTPUT"
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: node scripts/read-release-metadata.js --tag "$RELEASE_TAG" --github-output "$GITHUB_OUTPUT"
 
       - name: Download packaged assets
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -103,6 +142,7 @@ jobs:
       - name: Upload release assets
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
+          tag_name: ${{ inputs.release_tag }}
           name: ${{ steps.release_metadata.outputs.release_title }}
           body_path: ${{ steps.release_metadata.outputs.release_body_path }}
           files: |

.gitignore

@@ -1,9 +1,23 @@
 node_modules/
+apps/*/dist/
+apps/desktop/out/
+apps/desktop/test-results/
+apps/desktop/playwright-report/
+dist-desktop/
+packages/*/dist/
+!packages/contracts/dist/
+!packages/contracts/dist/**
+apps/*/*.tsbuildinfo
+packages/*/*.tsbuildinfo
 coverage/
 *.tgz
 artifacts/
 desktop/**/bin/
 desktop/**/obj/
+test-support/**/obj/
 *.csproj.user
 test/*.exe
 WORKLOG*.md
+.playwright-cli/
+apps/web/test-results/
+apps/web/playwright-report/

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 本文件记录面向用户和集成方的重要变化。完整的发布叙事、升级说明和下载入口见对应版本的中文发布说明；实现证据和测试门禁见技术发布说明。
 
+## [Unreleased]
+
+### 新增
+
+- 有限 CLI 命令新增 opt-in `--json`，stdout 固定为一个 schema v1 终态对象；帮助、输入失败、成功、partial、recovery、busy 和取消共享同一顶层结构。
+- JSON Mode 固化 `0/1/2/3/4/5/130` 退出码矩阵，并使用 Canonical Core Error Code。
+
+### 兼容性
+
+- 未传入 `--json` 时继续使用既有 Human 输出和 `0/1` 行为；partial sync 在 Human Mode 仍为成功退出。
+- `watch` 与 `web` 暂不提供单文档 JSON 模式，并在创建长运行资源前返回结构化 `INVALID_INPUT`；未来流式机器接口需要独立协议。
+- npm tarball 或 Windows npm shim 使用短路径、长路径或符号链接形式启动 CLI 时，会对入口两侧做物理路径规范化，避免已安装的 `codex-provider` 被误判为模块导入而静默退出。
+
+### 安全
+
+- JSON 进度只写 stderr 且不报告 backup path；固定错误文案、命令级 result allowlist 和枚举化 details 会阻止非法参数值、未知异常、底层 warning、凭据样式字段、prompt 与消息正文进入 stdout。
+- stdout broken pipe 只尝试一次终态写入；stderr observer 失败不能改变已启动业务操作的结果。
+
 ## [0.5.0] - 2026-08-15
 
 ### 新增

CONTRIBUTING.md

@@ -16,15 +16,21 @@ This project welcomes issues, pull requests, documentation, and tests in either
 
 ## 项目结构
 
+当前公开发布的桌面端仍是 .NET Windows GUI；`apps/desktop` 是 vNext Electron 未发布候选。只有 Phase 6 退出门槛和单独发布授权闭合后，文档才会切换为 Electron 主入口并把 .NET 标记为 Legacy。贡献和评审中不得提前把候选描述为默认、Stable 或已发布产品。
+
 | 路径 | 内容 |
 | --- | --- |
-| `src/` | Node.js CLI、Web 服务和共享同步逻辑 |
-| `web/` | Local Web UI 前端 |
+| `src/` | 兼容 Node.js CLI、Local Web Host 与 Node Core 实现 |
+| `apps/cli/` | vNext CLI workspace 边界 |
+| `apps/web/` | 共享 React UI 的 Local Web 组合与浏览器 E2E |
+| `apps/desktop/` | vNext Electron 候选：Main、Preload、Renderer、Utility Process、打包与 E2E |
+| `packages/` | Core、Contracts、CoreClient、App UI、Design System 与脱敏 Test Fixtures |
+| `web/` | 根 npm 包携带的 Local Web UI production 输出与兼容入口 |
 | `test/` | Node.js 自动化测试 |
-| `desktop/CodexProviderSync.Core/` | Windows 与 macOS GUI 共用的 .NET 核心逻辑 |
-| `desktop/CodexProviderSync.Application/` | Windows GUI 与 Automation 共用的应用用例 |
-| `desktop/CodexProviderSync.App/` | Windows WinForms GUI |
-| `desktop/CodexProviderSync.Mac/` | macOS Avalonia GUI |
+| `desktop/CodexProviderSync.Core/` | 当前发布桌面端共用的 .NET 核心；迁移期保持锁协议和兼容维护 |
+| `desktop/CodexProviderSync.Application/` | 当前 Windows GUI 与 Automation 共用的应用用例 |
+| `desktop/CodexProviderSync.App/` | 当前已发布的 Windows WinForms GUI |
+| `desktop/CodexProviderSync.Mac/` | 迁移期保留的 macOS Avalonia 本地构建 |
 | `desktop/CodexProviderSync.Automation/` | 实验性的 Windows Automation 接口 |
 | `desktop/*Tests/` | .NET 自动化测试 |
 | `scripts/` | GUI 构建和 WSL 安全验证脚本 |
@@ -35,7 +41,7 @@ This project welcomes issues, pull requests, documentation, and tests in either
 基础开发需要：
 
 - Git
-- Node.js 16.20.2 或更高版本；CI 验证最低版本和当前发布矩阵
+- Node.js 16.20.2 或更高版本用于根 CLI 包；现代 workspace、Web 构建和 Electron 使用 Node 24
 - npm
 - .NET 10 SDK（修改 .NET Core 或 GUI 时）
 - PowerShell 7（修改或验证 Windows 打包脚本时）
@@ -46,6 +52,7 @@ This project welcomes issues, pull requests, documentation, and tests in either
 npm ci
 npm test
 npm run web:build
+npm run workspaces:check
 ```
 
 运行共享 Core 和 Windows GUI 测试：
@@ -85,6 +92,7 @@ dotnet build desktop/CodexProviderSync.Mac/CodexProviderSync.Mac.csproj --config
 | 文档 | 检查链接、路径和命令；同一内容有多个语言版本时保持一致 |
 | Node.js CLI | `npm test` |
 | Local Web UI | `npm run web:build`、`npm test`；界面改动附浏览器截图或说明未手测原因 |
+| vNext Electron 候选 | `npm run desktop:test`、`npm run desktop:test:e2e`、production bundle 审计；界面自动化默认 hidden，平台打包改动还需原生候选容器 smoke |
 | 共享 .NET Core | Core Tests；涉及 CLI 时同时运行 `npm test` |
 | Windows GUI | Core Tests、App Tests；布局改动附 Windows 截图或说明未手测原因 |
 | macOS GUI | Core Tests、macOS Release build；真实 macOS GUI 手测无法完成时，在 PR 中明确记录 |
@@ -113,13 +121,13 @@ PR 中请特别说明：
 
 ## 准备发布
 
-CLI/Web npm 包和 Windows GitHub Release 独立发布，版本号可能不同。
+CLI/Web npm 包、当前 .NET Windows GitHub Release 和未来 Electron Release 是不同的受控发布路径，版本号可能不同。任何贡献或 CI 候选都不会自动授权公开发布。
 
 ### CLI / Web npm 包
 
 按 [npm 发布维护指南](docs/NPM_PUBLISHING.md) 更新 `package.json` 与 `package-lock.json`、完成构建和测试，并从 `main` 手动运行受信发布工作流。仅发布 CLI/Web 时不创建 Git tag 或 Windows Release。
 
-### Windows GitHub Release
+### 当前 .NET Windows GitHub Release
 
 发布 tag 前需要：
 
@@ -131,18 +139,21 @@ CLI/Web npm 包和 Windows GitHub Release 独立发布，版本号可能不同
 
 发布工作流会读取与 tag 同名的中文发布说明，并生成单文件 GUI、独立 Automation ZIP、Windows 完整包和对应 SHA-256。缺少发布说明、标题与 tag 不匹配，或遗漏固定的下载、安全和限制声明时会直接停止。
 
+这一流程只描述当前 .NET Windows Release，不授权发布 `apps/desktop` Electron。Electron 候选固定使用 `--publish never`；公开 tag、GitHub Release、签名、公证、更新 metadata 和跨版本升级验证都必须在 C10 证据闭合后另行授权。
+
 ## English quick guide
 
 - Small fixes, tests, and documentation updates can be submitted directly as a PR. Please open an Issue before starting a large feature, behavior change, or refactor.
 - If you do not have write access, fork the repository, push your branch to your fork, and open a PR against this repository's `main` branch.
-- Use Node.js 16.20.2 or later and run `npm ci`, `npm test`, and `npm run web:build`. Changes to shared .NET or desktop code also require the relevant .NET 10 tests listed above.
+- Use Node.js 16.20.2 or later for the compatible root CLI package. Modern workspaces, Web builds, and Electron use Node 24; run `npm ci`, `npm test`, `npm run workspaces:check`, and the affected Web or Electron gates. Changes to shared .NET code also require the relevant .NET 10 tests listed above.
 - Automated tests and reproduction scripts must use temporary directories or fixtures and must not depend on, read, or modify a real user's `~/.codex`. Prefer a dedicated test Codex Home for manual validation and describe its scope in the PR.
 - Never include unredacted credentials, `auth.json`, Codex sessions, SQLite databases, backups, logs, tokens, or personal data.
 - Keep each PR focused. Explain why the change is needed, what it writes, which platforms it affects, what was tested, and what was not tested.
 - GUI changes should include screenshots and the platform and display scaling used. If real macOS GUI testing is unavailable, say so clearly; it is not automatically a reason to reject the contribution.
 - Update affected documentation when user-visible behavior, command options, or safety boundaries change.
 - All changes go through a PR and must pass `ci-gate`.
 - The CLI/Web npm package and Windows GitHub Release are independent release channels; follow `docs/NPM_PUBLISHING.md` for npm releases.
+- The published desktop product is still the Windows .NET GUI. `apps/desktop` is an unreleased Electron candidate and must not be called default, Stable, or released until Phase 6 and separately authorized release validation close.
 
 ## License