补齐 #1519 的 Hook 与显式项目保护 / Complete #1519 hook and explicit-project safeguards

[Yuimi-chaya]

中文

这是 #1519 的追加补丁

#1519 已经修复了供应商切换后的基础状态同步，并为 Codex App 原生“无需项目开始任务”失效提供了运行时兜底。随着新版 Codex App 的入口和插件 Hook 状态发生变化，真人测试又确认了两个仍会破坏该功能契约的遗漏，建议尽快合并本追加补丁。

否则用户仍可能遇到：

• 在主页已经明确选择项目，左下角也显示了目标项目，但首条消息仍被 Codex++ 改写成无项目任务；任务不会进入所选项目，部分情况下还会难以在预期任务列表中找到。
• 切换供应商后，依赖 Codex Plugin Hook 的工具仍显示为已安装，实际却因 Hook 信任状态丢失而返回 hook_unavailable。例如 Windows Attention 无法注入当前任务 ID，Codex 也就无法通过 Windows 通知联系用户。

根因

1. 新版 Codex App 的主页项目选择器使用 [data-composer-navigation-target="workspace-project"]。projectless v5 没有识别这个真实的用户意图，状态仍停留在 generic，后续 dispatcher/AppServer 包装器继续删除 projectAssignment 并执行 projectless 清理。
2. 修复供应商状态与无项目任务 / Preserve provider state and projectless tasks #1519 的配置写入会保留 [desktop]、沙盒和工作区状态，但插件 Hook 的信任哈希位于 config.toml 的 [hooks.state]。每个供应商快照因此保留了各自陈旧或缺失的 Hook 状态，切换时可能覆盖当前已经信任的 Hook。

修改内容

• projectless runtime 升级到 v6，识别新版项目选择器及中英文精确标签。
• 用户显式选择项目时立即切换为 project 意图，取消延迟中的 projectless 清理，并使旧草稿上下文失效。
• 将当前 live config 的完整 [hooks] 表视为全局 Codex App 状态，在供应商配置写入时同步到目标配置。
• 当前 live config 没有 [hooks] 时移除目标快照中残留的陈旧 Hook 状态。
• 将内部辅助函数重命名为 preserve_live_app_settings，反映其职责不再局限于 [desktop]。
• 不接管顶层 notify，避免与 Windows Computer Use guard 的通知入口冲突。
• 不读取或复制 auth.json、API Key、供应商 URL 等认证或供应商专属内容。

兼容边界

• 不能仅根据 thread/start 中出现 cwd、workspace roots 或 projectAssignment 判断用户显式选择了项目，因为 Codex App 原生错误继承最近项目时也会生成相同形状的请求。本补丁只以真实项目选择器交互作为权威信号。
• 未开启“无需项目开始任务”时保持 Codex App 原生行为。
• Hook 状态同步只发生在现有供应商配置替换流程中，不改变插件文件、Hook 命令或 Computer Use guard 的配置所有权。

验证

• node --check assets/inject/renderer-inject.js
• cargo fmt --all -- --check
• git diff --check
• cargo test -p codex-plus-core --test cdp_bridge --test relay_config --test relay_switch -j 2
• CDP：78/78
• relay config：102/102
• relay switch：5/5

已在 Codex App 26.707.12708.0 完成真人测试：

• 开启“无需项目开始任务”后，普通主页首条消息仍创建为无项目任务。
• 在主页显式选择项目后，首条消息正确创建到所选项目中。
• 切换到原本缺少 [hooks] 快照的供应商后，Windows Attention Hook 可继续正常绑定任务并发送通知。

English

Follow-up patch for #1519

#1519 preserved core Codex App state across provider switches and added a runtime fallback for the native projectless New Task regression. New Codex App entry points and plugin Hook state exposed two remaining gaps during human testing. This follow-up should be merged soon because both gaps can still break the user-facing contract fixed by #1519.

Without this patch, users may still see either of the following:

• A project is explicitly selected on the home composer and is visibly shown in the UI, but the first message is still rewritten as projectless. The task is not created under the selected project and may be difficult to find in the expected task lists.
• Hook-dependent tools remain installed after switching providers but fail with hook_unavailable because their trust state was lost. For example, Windows Attention can no longer inject the current thread ID, so Codex cannot notify the user through Windows.

Root causes

1. The current Codex App project chooser uses [data-composer-navigation-target="workspace-project"]. Projectless runtime v5 did not recognize this explicit user intent, so the dispatcher/AppServer wrappers continued removing projectAssignment and applying projectless cleanup.
2. 修复供应商状态与无项目任务 / Preserve provider state and projectless tasks #1519 preserved [desktop], sandbox, and workspace state during configuration writes, while plugin Hook trust hashes live under [hooks.state] in config.toml. Provider snapshots therefore retained independent stale or missing Hook state and could overwrite currently trusted Hooks during a switch.

Changes

• Upgrade the projectless runtime to v6 and recognize the current project chooser plus exact English and Chinese labels.
• Switch immediately to authoritative project intent after explicit selection, cancel pending projectless cleanup, and invalidate stale draft context.
• Treat the complete live [hooks] table as global Codex App state and copy it into the selected provider configuration.
• Remove stale target Hook state when the live configuration has no [hooks] table.
• Rename the internal helper to preserve_live_app_settings to reflect its broader responsibility.
• Leave top-level notify ownership unchanged to avoid conflicting with the Windows Computer Use guard.
• Do not read or copy auth.json, API keys, provider URLs, or other provider-specific credentials.

Compatibility boundaries

• A project-shaped thread/start request is not proof of explicit selection because the native stale-recent-project regression produces the same request shape. This patch uses interaction with the real project chooser as the authoritative signal.
• Native behavior remains unchanged when projectless New Task is disabled.
• Hook synchronization runs only inside the existing provider configuration replacement path and does not modify plugin files, Hook commands, or Computer Use guard ownership.

Verification

• node --check assets/inject/renderer-inject.js
• cargo fmt --all -- --check
• git diff --check
• cargo test -p codex-plus-core --test cdp_bridge --test relay_config --test relay_switch -j 2
• CDP: 78/78
• relay config: 102/102
• relay switch: 5/5

Human validation passed on Codex App 26.707.12708.0:

• A generic first message on the home screen remains projectless when the option is enabled.
• Explicitly selecting a project creates the task under that project.
• After switching to a provider snapshot that previously had no [hooks] table, Windows Attention continues binding the task and delivering notifications.