chore: deduplicate model selector, auto-extract chromium version, harden update pipeline

- Remove independent model dropdown from Anthropic SDK Setup; use shared Default Model from API Configuration
- Auto-extract Chromium version from Electron via electron-to-chromium in extract-fingerprint
- Add 5-min timeout kill timer for full-update child process to prevent permanent lock
- Add try/finally in model-fetcher initial timer to prevent refresh loop interruption
- Bump Codex Desktop to v26.228.1430 (build 760)
- Update poll interval from 30min to 3 days

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -15,6 +15,7 @@ scripts/extract-fingerprint.ts
 scripts/full-update.ts
 scripts/apply-update.ts
 scripts/check-update.ts
+scripts/types.ts
 scripts/test-*.ts
 scripts/cron-update.sh
 config/extraction-patterns.yaml

CHANGELOG.md

@@ -8,6 +8,7 @@
 
 ### Added
 
+- 自动提取 Chromium 版本：`extract-fingerprint.ts` 从 `package.json` 读取 Electron 版本，通过 `electron-to-chromium` 映射为 Chromium 大版本，`apply-update.ts` 自动更新 `chromium_version` 和 TLS impersonate profile
 - 动态模型列表：后台从 Codex 后端自动获取模型目录，与静态 YAML 合并（`src/models/model-store.ts`、`src/models/model-fetcher.ts`）
 - `/debug/models` 诊断端点，展示模型来源（static/backend）与刷新状态
 - 完整 Codex 模型目录：GPT-5.3/5.2/5.1 全系列 base/high/mid/low/max/mini 变体（23 个静态模型）
@@ -18,6 +19,7 @@
 
 ### Changed
 
+- Dashboard 模型选择器去重：移除 Anthropic SDK Setup 的独立模型下拉框，统一使用 API Configuration 的 Default Model
 - 模型管理从纯静态 YAML 迁移至静态+动态混合架构（后端优先，YAML 兜底）
 - 默认模型改为 `gpt-5.2-codex`
 - Dashboard "Claude Code Quick Setup" 重命名为 "Anthropic SDK Setup"
@@ -25,6 +27,11 @@
 
 ### Fixed
 
+- `apply-update.ts` 模型比较不再误报删除：静态提取只含 2 个硬编码模型，与 YAML 的 24 个比较会产生 22 个假删除，现在只报新增
+- `update-checker.ts` 子进程超时保护：`fork()` 添加 5 分钟 kill timer，防止挂起导致 `_updateInProgress` 永久锁定
+- `model-fetcher.ts` 初始定时器添加 try/finally，防止异常中断刷新循环
+- `apply-update.ts` 移除 `any` 类型（`mutateYaml` 回调参数）
+- `ExtractedFingerprint` 接口统一：提取到 `scripts/types.ts` 共享，`extract-fingerprint.ts` 和 `apply-update.ts` 共用
 - 强化提示词注入防护：`SUPPRESS_PROMPT` 从弱 "ignore" 措辞改为声明式覆盖（"NOT applicable"、"standard OpenAI API model"），解决 mini 模型仍泄露 Codex Desktop 身份的问题
 - 非流式请求错误处理：`collectTranslator` 抛出 generic Error 时返回 502 JSON 而非 500 HTML（`proxy-handler.ts`）
 - `desktop-context.md` 提取损坏修复：`extractPrompts()` 的 end marker 从 `` `; `` 改为 `` `[,;)] `` 正则，防止压缩 JS 代码注入 instructions 导致 tool_calls 失效（#13）

config/default.yaml

@@ -3,8 +3,8 @@ api:
   timeout_seconds: 60
 client:
   originator: Codex Desktop
-  app_version: 26.227.1448
-  build_number: "747"
+  app_version: 26.228.1430
+  build_number: "760"
   platform: darwin
   arch: arm64
   chromium_version: "137"

config/prompts/automation-response.md

@@ -48,4 +48,4 @@ Response MUST end with a remark-directive block.
 - Waiting on user decision:
   - \`::inbox-item{title="Choose API shape for filters" summary="Two options drafted; pick A vs B"}\`
 - Status update with next step:
-  - \`::inbox-item{title="PR comments addressed" summary="Ready for re-review; focus on auth edge case"}\`
+  - \`::inbox-item{title="PR comments addressed" summary="Ready for re-review; focus on auth edge case"}\

config/prompts/desktop-context.md

@@ -34,7 +34,7 @@
 - Keep automation prompts self-sufficient because the user may have limited availability to answer questions. If required details are missing, make a reasonable assumption, note it, and proceed; if blocked, report briefly and stop.
 - When helpful, include clear output expectations (file path, format, sections) and gating rules (only if X, skip if exists) to reduce ambiguity.
 - Automations should always open an inbox item.
-  - Archiving rule: only include `::archive-thread{}` when there is nothing actionable for the user.
+  - Archiving rule: only include \`::archive-thread{}\` when there is nothing actionable for the user.
   - Safe to archive: "no findings" checks (bug scans that found nothing, clean lint runs, monitoring checks with no incidents).
   - Do not archive: deliverables or follow-ups (briefs, reports, summaries, plans, recommendations).
   - If you do archive, include the archive directive after the inbox item.
@@ -67,4 +67,4 @@
 
 ### Archiving
 - If a user specifically asks you to end a thread/conversation, you can return the archive directive ::archive{...} to archive the thread/conversation.
-- Example: ::archive{reason="User requested to end conversation"}
+- Example: ::archive{reason="User requested to end conversation"}

package-lock.json

@@ -19,6 +19,7 @@
         "@electron/asar": "^3.2.0",
         "@types/js-yaml": "^4.0.0",
         "@types/node": "^22.0.0",
+        "electron-to-chromium": "^1.5.302",
         "js-beautify": "^1.15.0",
         "tsx": "^4.0.0",
         "typescript": "^5.5.0",
@@ -1310,6 +1311,13 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/electron-to-chromium": {
+      "version": "1.5.302",
+      "resolved": "https://registry.npmmirror.com/electron-to-chromium/-/electron-to-chromium-1.5.302.tgz",
+      "integrity": "sha512-sM6HAN2LyK82IyPBpznDRqlTQAtuSaO+ShzFiWTvoMJLHyZ+Y39r8VMfHzwbU8MVBzQ4Wdn85+wlZl2TLGIlwg==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/emoji-regex": {
       "version": "9.2.2",
       "resolved": "https://registry.npmmirror.com/emoji-regex/-/emoji-regex-9.2.2.tgz",

package.json

@@ -34,6 +34,7 @@
     "@electron/asar": "^3.2.0",
     "@types/js-yaml": "^4.0.0",
     "@types/node": "^22.0.0",
+    "electron-to-chromium": "^1.5.302",
     "js-beautify": "^1.15.0",
     "tsx": "^4.0.0",
     "typescript": "^5.5.0",

scripts/extract-fingerprint.ts

@@ -17,6 +17,7 @@ import { resolve, join } from "path";
 import { createHash } from "crypto";
 import { execSync } from "child_process";
 import yaml from "js-yaml";
+import type { ExtractedFingerprint } from "./types.js";
 
 const ROOT = resolve(import.meta.dirname, "..");
 const OUTPUT_PATH = resolve(ROOT, "data/extracted-fingerprint.json");
@@ -36,29 +37,6 @@ interface ExtractionPatterns {
   }>;
 }
 
-interface ExtractedFingerprint {
-  app_version: string;
-  build_number: string;
-  api_base_url: string | null;
-  originator: string | null;
-  models: string[];
-  wham_endpoints: string[];
-  user_agent_contains: string;
-  sparkle_feed_url: string | null;
-  prompts: {
-    desktop_context_hash: string | null;
-    desktop_context_path: string | null;
-    title_generation_hash: string | null;
-    title_generation_path: string | null;
-    pr_generation_hash: string | null;
-    pr_generation_path: string | null;
-    automation_response_hash: string | null;
-    automation_response_path: string | null;
-  };
-  extracted_at: string;
-  source_path: string;
-}
-
 function sha256(content: string): string {
   return `sha256:${createHash("sha256").update(content, "utf-8").digest("hex").slice(0, 16)}`;
 }
@@ -123,6 +101,7 @@ function extractFromPackageJson(root: string): {
   version: string;
   buildNumber: string;
   sparkleFeedUrl: string | null;
+  electronVersion: string | null;
 } {
   const pkgPath = join(root, "package.json");
   const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
@@ -131,6 +110,7 @@ function extractFromPackageJson(root: string): {
     version: pkg.version ?? "unknown",
     buildNumber: String(pkg.codexBuildNumber ?? "unknown"),
     sparkleFeedUrl: pkg.codexSparkleFeedUrl ?? null,
+    electronVersion: pkg.devDependencies?.electron ?? null,
   };
 }
 
@@ -373,9 +353,32 @@ async function main() {
 
   // Step A: package.json
   console.log("[extract] Reading package.json...");
-  const { version, buildNumber, sparkleFeedUrl } = extractFromPackageJson(asarRoot);
-  console.log(`  version: ${version}`);
-  console.log(`  build:   ${buildNumber}`);
+  const { version, buildNumber, sparkleFeedUrl, electronVersion } = extractFromPackageJson(asarRoot);
+  console.log(`  version:  ${version}`);
+  console.log(`  build:    ${buildNumber}`);
+  console.log(`  electron: ${electronVersion ?? "not found"}`);
+
+  // Resolve Chromium version from Electron version
+  let chromiumVersion: string | null = null;
+  if (electronVersion) {
+    const electronMajor = parseInt(electronVersion.replace(/^[^0-9]*/, ""), 10);
+    if (!isNaN(electronMajor)) {
+      try {
+        const { versions } = await import("electron-to-chromium");
+        const versionMap = versions as Record<string, string>;
+        // versions keys use "major.minor" format (e.g. "40.0"), try both
+        const chromium = versionMap[`${electronMajor}.0`] ?? versionMap[electronMajor.toString()];
+        if (chromium) {
+          chromiumVersion = chromium;
+          console.log(`  chromium: ${chromiumVersion} (from electron ${electronMajor})`);
+        } else {
+          console.warn(`[extract] No Chromium mapping for Electron ${electronMajor}`);
+        }
+      } catch {
+        console.warn("[extract] electron-to-chromium not available, skipping chromium resolution");
+      }
+    }
+  }
 
   // Step B: main.js (or main-XXXXX.js chunk)
   console.log("[extract] Loading main.js...");
@@ -455,6 +458,8 @@ async function main() {
   const fingerprint: ExtractedFingerprint = {
     app_version: version,
     build_number: buildNumber,
+    electron_version: electronVersion,
+    chromium_version: chromiumVersion,
     api_base_url: mainJsResults.apiBaseUrl,
     originator: mainJsResults.originator,
     models: mainJsResults.models,

src/models/model-fetcher.ts

@@ -71,8 +71,11 @@ export function startModelRefresh(
 
   // Initial fetch after short delay
   _refreshTimer = setTimeout(async () => {
-    await fetchModelsFromBackend(accountPool, cookieJar);
-    scheduleNext(accountPool, cookieJar);
+    try {
+      await fetchModelsFromBackend(accountPool, cookieJar);
+    } finally {
+      scheduleNext(accountPool, cookieJar);
+    }
   }, INITIAL_DELAY_MS);
 
   console.log("[ModelFetcher] Scheduled initial model fetch in 5s");

src/update-checker.ts

@@ -15,7 +15,7 @@ import { mutateYaml } from "./utils/yaml-mutate.js";
 const CONFIG_PATH = resolve(process.cwd(), "config/default.yaml");
 const STATE_PATH = resolve(process.cwd(), "data/update-state.json");
 const APPCAST_URL = "https://persistent.oaistatic.com/codex-app-prod/appcast.xml";
-const POLL_INTERVAL_MS = 30 * 60 * 1000; // 30 minutes
+const POLL_INTERVAL_MS = 3 * 24 * 60 * 60 * 1000; // 3 days
 
 export interface UpdateState {
   last_check: string;
@@ -77,6 +77,8 @@ function applyVersionUpdate(version: string, build: string): void {
  * Downloads new Codex.app, extracts fingerprint, and applies config updates.
  * Protected by a lock to prevent concurrent runs.
  */
+const UPDATE_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+
 function triggerFullUpdate(): void {
   if (_updateInProgress) {
     console.log("[UpdateChecker] Full update already in progress, skipping");
@@ -95,6 +97,12 @@ function triggerFullUpdate(): void {
     },
   );
 
+  // Kill the child if it hangs beyond the timeout
+  const killTimer = setTimeout(() => {
+    console.warn("[UpdateChecker] Full update timed out, killing child");
+    child.kill("SIGTERM");
+  }, UPDATE_TIMEOUT_MS);
+
   let output = "";
   child.stdout?.on("data", (chunk: Buffer) => {
     output += chunk.toString();
@@ -104,6 +112,7 @@ function triggerFullUpdate(): void {
   });
 
   child.on("exit", (code) => {
+    clearTimeout(killTimer);
     _updateInProgress = false;
     if (code === 0) {
       console.log("[UpdateChecker] Full update completed. Reloading config...");
@@ -125,6 +134,7 @@ function triggerFullUpdate(): void {
   });
 
   child.on("error", (err) => {
+    clearTimeout(killTimer);
     _updateInProgress = false;
     console.error("[UpdateChecker] Failed to spawn full-update:", err.message);
   });

web/src/App.tsx

@@ -39,7 +39,6 @@ function Dashboard() {
           />
           <AnthropicSetup
             apiKey={status.apiKey}
-            models={status.models}
             selectedModel={status.selectedModel}
           />
           <CodeExamples

web/src/components/AnthropicSetup.tsx

@@ -1,24 +1,22 @@
-import { useState, useMemo, useCallback } from "preact/hooks";
+import { useMemo, useCallback } from "preact/hooks";
 import { useT } from "../i18n/context";
 import { CopyButton } from "./CopyButton";
 
 interface AnthropicSetupProps {
   apiKey: string;
-  models: string[];
   selectedModel: string;
 }
 
-export function AnthropicSetup({ apiKey, models, selectedModel }: AnthropicSetupProps) {
+export function AnthropicSetup({ apiKey, selectedModel }: AnthropicSetupProps) {
   const t = useT();
-  const [model, setModel] = useState(selectedModel);
 
   const origin = typeof window !== "undefined" ? window.location.origin : "http://localhost:8080";
 
   const envLines = useMemo(() => ({
     ANTHROPIC_BASE_URL: origin,
     ANTHROPIC_API_KEY: apiKey,
-    ANTHROPIC_MODEL: model,
-  }), [origin, apiKey, model]);
+    ANTHROPIC_MODEL: selectedModel,
+  }), [origin, apiKey, selectedModel]);
 
   const allEnvText = useMemo(
     () => Object.entries(envLines).map(([k, v]) => `${k}=${v}`).join("\n"),
@@ -39,15 +37,6 @@ export function AnthropicSetup({ apiKey, models, selectedModel }: AnthropicSetup
           </svg>
           <h2 class="text-[0.95rem] font-bold">{t("anthropicSetup")}</h2>
         </div>
-        <select
-          class="px-3 py-1.5 text-xs font-mono rounded-lg bg-slate-100 dark:bg-bg-dark border border-gray-200 dark:border-border-dark text-slate-700 dark:text-text-main outline-none"
-          value={model}
-          onChange={(e) => setModel((e.target as HTMLSelectElement).value)}
-        >
-          {models.map((m) => (
-            <option key={m} value={m}>{m}</option>
-          ))}
-        </select>
       </div>
 
       {/* Env vars */}