feat(wework): add Windows desktop support

docs/en/developer-guide/wework-windows.md

@@ -0,0 +1,152 @@
+---
+sidebar_position: 45
+---
+
+# Wework Windows Desktop Build Guide
+
+This guide covers how to build and run the Wework desktop app (`wework`) on Windows, and how to cross-compile a Windows installer from macOS.
+
+---
+
+## Prerequisites
+
+### Native Windows build
+
+- **Windows 10/11**
+- **Rust 1.77+** with the `x86_64-pc-windows-msvc` target installed
+- **Node.js 20+** and **pnpm**
+- **Visual Studio Build Tools** (provides the MSVC toolchain)
+- **Git**
+
+### Cross-compiling the Windows installer from macOS
+
+- **macOS** (Apple Silicon or Intel)
+- **Rust 1.77+**
+- **cargo-xwin**: `cargo install cargo-xwin`
+- **LLVM** (for `clang`): `brew install llvm`, and ensure `/opt/homebrew/opt/llvm/bin` is on your `PATH`
+- **NSIS** (for installer generation): `brew install nsis`
+- **Node.js 20+** and **pnpm**
+
+---
+
+## Summary of changes for Windows support
+
+The main portability changes are:
+
+1. **Local IPC switched from Unix domain sockets to TCP loopback**: The Executor sidecar binds to `127.0.0.1:0` and the OS assigns an available port. The bound address is written to `~/.wegent-executor/app-ipc.addr`, which the Tauri front-end reads to discover the port.
+2. **Portable home directory resolution**: All Rust code uses `dirs::home_dir()`, which falls back to `USERPROFILE` on Windows instead of relying on the `HOME` environment variable.
+3. **File permission calls are Unix-only**: `chmod` / `set_mode` calls are gated with `#[cfg(unix)]` and ignored on Windows.
+4. **Local terminal defaults to PowerShell on Windows**: `pwsh.exe` is preferred, with `powershell.exe` as the fallback.
+5. **New Windows build script and Tauri config**: `wework/scripts/build-windows-app.sh` and `wework/src-tauri/tauri.windows.conf.json`.
+
+---
+
+## Native Windows development
+
+### 1. Install dependencies
+
+```powershell
+# Add the Windows target
+rustup target add x86_64-pc-windows-msvc
+
+# Install pnpm
+npm install -g pnpm
+
+# Install frontend dependencies
+pnpm install
+```
+
+### 2. Build the local Executor sidecar
+
+```powershell
+cd executor
+cargo build --release --target x86_64-pc-windows-msvc
+```
+
+Copy the resulting binary to the location Tauri expects:
+
+```powershell
+$target = "x86_64-pc-windows-msvc"
+cp "executor\target\$target\release\wegent-executor.exe" "wework\src-tauri\binaries\wegent-executor-$target.exe"
+```
+
+Or use the convenience helper from the repository root on macOS to cross-compile the sidecar only (faster than a full installer build):
+
+```bash
+cd wework
+pnpm run build:windows:sidecar
+```
+
+### 3. Prepare the bundled Codex binary
+
+```powershell
+cd wework
+$env:WEWORK_CODEX_TARGET = "x86_64-pc-windows-msvc"
+pnpm run prepare:codex
+```
+
+### 4. Start the dev mode
+
+```powershell
+pnpm exec tauri dev --target x86_64-pc-windows-msvc
+```
+
+---
+
+## Cross-compiling the Windows installer from macOS
+
+Use the repository build script:
+
+```bash
+bash wework/scripts/build-windows-app.sh
+```
+
+The script will:
+
+1. Build the Executor sidecar for `x86_64-pc-windows-msvc` using `cargo xwin build`.
+2. Copy `wegent-executor.exe` to `wework/src-tauri/binaries/wegent-executor-x86_64-pc-windows-msvc.exe`.
+3. Prepare the Windows Codex binary.
+4. Build Tauri with `cargo-xwin` and produce an NSIS installer.
+
+The installer is written to:
+
+```
+wework/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/
+```
+
+### Repository convenience command
+
+```bash
+cd wework
+pnpm run build:windows
+```
+
+This is equivalent to `bash scripts/build-windows-app.sh`.
+
+---
+
+## Runtime behavior
+
+- When the Executor sidecar starts it writes the bound TCP address (e.g. `127.0.0.1:54321`) to `~/.wegent-executor/app-ipc.addr`.
+- The Tauri front-end reads that file and connects over TCP.
+- If the default port is in use, the Executor binds to an OS-assigned port; Tauri discovers it dynamically through the address file.
+
+---
+
+## Known limitations
+
+- **Local terminal uses PowerShell** on Windows instead of `/bin/zsh`.
+- **IPC uses TCP loopback instead of Unix domain sockets**: other local processes on the same machine can theoretically connect to the `127.0.0.1` port. Use this only in trusted local environments.
+- **Stale process cleanup**: Windows does not enumerate and terminate leftover Executor processes via `/proc` like Unix does; cleanup relies on the Tauri app lifecycle.
+- **Some backend/sandbox paths remain Unix-oriented**: Docker socket paths, `/home/user`, `/workspace`, etc. are used by the remote Linux/macOS Executor Manager and are not part of the Windows desktop installer path.
+
+---
+
+## Troubleshooting
+
+- **`cargo xwin` cannot find a C compiler**: make sure LLVM is installed and `clang` is on your `PATH`.
+- **Tauri cannot find the sidecar**: verify that `wework/src-tauri/binaries/wegent-executor-x86_64-pc-windows-msvc.exe` exists.
+- **NSIS build fails**: confirm NSIS is installed (on either Windows or macOS).
+- **Runtime cannot connect to the Executor**: check that `~/.wegent-executor/app-ipc.addr` exists and is readable, and that no firewall is blocking the `127.0.0.1` loopback interface.
+- **"Program not found" when sending a message**: the local Executor sidecar may be missing or stale. Rebuild it with `pnpm run build:windows:sidecar` (cross-compile from macOS) or `cargo build --release --target x86_64-pc-windows-msvc` followed by copying `wegent-executor.exe` to `wework/src-tauri/binaries/wegent-executor-x86_64-pc-windows-msvc.exe`.
+- **Locally installed Codex reports "program not found"**: on Windows, resolving a bare `codex` name automatically tries executable extensions (`codex.exe`, `codex.cmd`, `codex.bat`, etc.) and falls back to common user directories such as `%APPDATA%\npm` and `~/.cargo/bin`, because GUI-launched processes may not inherit the shell `PATH`. If Codex is installed elsewhere, set the full path via environment variable: `$env:CODEX_BINARY_PATH = "C:\Path\To\codex.exe"`.

docs/zh/developer-guide/wework-windows.md

@@ -0,0 +1,152 @@
+---
+sidebar_position: 45
+---
+
+# Wework Windows 桌面端构建指南
+
+本文档介绍如何在 Windows 上构建和运行 Wework 桌面端（`wework`），以及如何从 macOS 交叉编译 Windows 安装包。
+
+---
+
+## 前置要求
+
+### 在 Windows 本机构建
+
+- **Windows 10/11**
+- **Rust 1.77+** 并安装目标 `x86_64-pc-windows-msvc`
+- **Node.js 20+** 和 **pnpm**
+- **Visual Studio Build Tools**（提供 MSVC 工具链）
+- **Git**
+
+### 在 macOS 上交叉编译 Windows 安装包
+
+- **macOS**（Apple Silicon 或 Intel）
+- **Rust 1.77+**
+- **cargo-xwin**: `cargo install cargo-xwin`
+- **LLVM**（用于 `clang`）：`brew install llvm`，并确保 `/opt/homebrew/opt/llvm/bin` 在 `PATH` 中
+- **NSIS**（用于生成安装程序）：`brew install nsis`
+- **Node.js 20+** 和 **pnpm**
+
+---
+
+## 项目变更概要
+
+为支持 Windows，主要做了以下调整：
+
+1. **本地 IPC 从 Unix Domain Socket 改为 TCP 回环地址**：Executor sidecar 绑定到 `127.0.0.1:0`，OS 自动分配端口，并将实际地址写入 `~/.wegent-executor/app-ipc.addr`。Tauri 前端通过读取该文件发现端口。
+2. **统一使用 `dirs::home_dir()` 解析用户目录**：在 Windows 上回退到 `USERPROFILE`，不再依赖 `HOME` 环境变量。
+3. **文件权限操作仅保留在 Unix 平台**：Windows 忽略 `chmod` / `set_mode`。
+4. **本地终端默认使用 PowerShell**：在 Windows 上优先尝试 `pwsh.exe`，其次 `powershell.exe`。
+5. **新增 Windows 构建脚本和 Tauri 配置**：`wework/scripts/build-windows-app.sh` 与 `wework/src-tauri/tauri.windows.conf.json`。
+
+---
+
+## Windows 本机开发
+
+### 1. 安装依赖
+
+```powershell
+# 安装 Rust 目标
+rustup target add x86_64-pc-windows-msvc
+
+# 安装 pnpm
+npm install -g pnpm
+
+# 安装前端依赖
+pnpm install
+```
+
+### 2. 构建本地 Executor sidecar
+
+```powershell
+cd executor
+cargo build --release --target x86_64-pc-windows-msvc
+```
+
+将生成的二进制文件复制到 Tauri 期望的位置：
+
+```powershell
+$target = "x86_64-pc-windows-msvc"
+cp "executor\target\$target\release\wegent-executor.exe" "wework\src-tauri\binaries\wegent-executor-$target.exe"
+```
+
+也可以在 macOS 上通过仓库内的便捷命令只交叉编译 sidecar（比完整打包更快）：
+
+```bash
+cd wework
+pnpm run build:windows:sidecar
+```
+
+### 3. 准备 Codex 二进制
+
+```powershell
+cd wework
+$env:WEWORK_CODEX_TARGET = "x86_64-pc-windows-msvc"
+pnpm run prepare:codex
+```
+
+### 4. 启动开发模式
+
+```powershell
+pnpm exec tauri dev --target x86_64-pc-windows-msvc
+```
+
+---
+
+## 从 macOS 交叉编译 Windows 安装包
+
+使用仓库内的构建脚本：
+
+```bash
+bash wework/scripts/build-windows-app.sh
+```
+
+脚本会：
+
+1. 使用 `cargo xwin build` 为 `x86_64-pc-windows-msvc` 构建 Executor sidecar。
+2. 将 `wegent-executor.exe` 复制到 `wework/src-tauri/binaries/wegent-executor-x86_64-pc-windows-msvc.exe`。
+3. 准备 Windows 版 Codex 二进制。
+4. 使用 `cargo-xwin` 构建 Tauri 并生成 NSIS 安装包。
+
+安装包默认输出路径：
+
+```
+wework/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/
+```
+
+### 使用仓库内的便捷命令
+
+```bash
+cd wework
+pnpm run build:windows
+```
+
+该命令等价于调用 `bash scripts/build-windows-app.sh`。
+
+---
+
+## 运行时行为
+
+- Executor sidecar 启动后会在 `~/.wegent-executor/app-ipc.addr` 写入监听的 TCP 地址（如 `127.0.0.1:54321`）。
+- Tauri 前端读取该文件并建立 TCP 连接。
+- 如果端口冲突，Executor 会绑定到 OS 分配的可用端口；Tauri 通过地址文件动态发现。
+
+---
+
+## 已知限制
+
+- **本地终端默认使用 PowerShell**：不再调用 `/bin/zsh`。
+- **IPC 不再使用 Unix Domain Socket**：同一台机器上的其他本地进程理论上可以连接到 `127.0.0.1` 端口；生产环境建议仅在可信本地环境使用。
+- **进程孤儿清理**：Windows 暂不支持像 Unix 那样通过 `/proc` 枚举并清理遗留 Executor 进程；依赖 Tauri 应用生命周期关闭 sidecar。
+- **部分后端/沙箱路径仍为 Unix 语义**：例如 Docker socket 路径、`/home/user`、`/workspace` 等仅在远端 Linux/macOS Executor Manager 中使用，不进入 Windows 桌面安装包路径。
+
+---
+
+## 故障排查
+
+- **`cargo xwin` 找不到 C 编译器**：确保 LLVM 已安装且 `clang` 在 `PATH` 中。
+- **Tauri 找不到 sidecar**：确认 `wework/src-tauri/binaries/wegent-executor-x86_64-pc-windows-msvc.exe` 存在。
+- **NSIS 构建失败**：确认已安装 NSIS（Windows 或 macOS 均可）。
+- **运行时无法连接 Executor**：检查 `~/.wegent-executor/app-ipc.addr` 是否存在且可被读取，以及是否有防火墙拦截 `127.0.0.1` 回环地址。
+- **发送消息时提示 "program not found"**：本地 Executor sidecar 可能缺失或已过期。请使用 `pnpm run build:windows:sidecar`（在 macOS 上交叉编译）重新构建，或在 Windows 本机执行 `cargo build --release --target x86_64-pc-windows-msvc` 后将 `wegent-executor.exe` 复制到 `wework/src-tauri/binaries/wegent-executor-x86_64-pc-windows-msvc.exe`。
+- **本地已安装 Codex 提示 "program not found"**：在 Windows 上解析 `codex` 时会自动尝试 `codex.exe`、`codex.cmd`、`codex.bat` 等可执行扩展名；同时会兜底搜索 `%APPDATA%\npm` 和 `~/.cargo/bin` 等常见用户目录（因为 GUI 启动的进程可能无法继承 shell 的 `PATH`）。如果 Codex 安装在其他位置，可设置完整路径的环境变量：`$env:CODEX_BINARY_PATH = "C:\Path\To\codex.exe"`。

executor/Cargo.toml

@@ -29,6 +29,7 @@ base64 = "0.22"
 cbc = "0.1"
 chrono = { version = "0.4", default-features = false, features = ["clock"] }
 ctrlc = { version = "3.4", features = ["termination"], optional = true }
+dirs = "5"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
 futures-util = "0.3"
 flate2 = "1.0"