fix: Tauri runtime guard + market-script sha256 verification (+ architecture notes)

[keevingfu]

Overview

This PR bundles three related pieces of work from a source walkthrough of the codebase. They are split into self-contained commits, so it reads cleanly commit-by-commit:

1. Fix — guard the Tauri runtime before invoke in the manager.
2. Hardening — verify a market script's sha256 before installing it.
3. Docs — an architecture walkthrough (docs/architecture-notes.md, 11 chapters with file:line references).

If a maintainer would prefer the docs and/or the hardening split into separate PRs, happy to do that — just say the word.

---

1. Fix: guard Tauri runtime before invoke (923188b)

Backend commands in the manager are all reached through one call/invoke path. When the UI runs outside the Tauri webview (a browser, tauri dev opened directly, or a devtools/automation context), window.__TAURI_INTERNALS__ is undefined, so @tauri-apps/api's invoke throws:

Cannot read properties of undefined (reading 'invoke')

This was reported as "Restart Codex++" failing, but it affects every command — restart just happened to be the one clicked. The backend command (restart_codex_plus) is correctly registered and is not at fault.

Change: add a tauriRuntimeAvailable() runtime check; guard call and logDiagnostic so a missing runtime rejects with a clear, actionable message instead of the opaque TypeError (and logDiagnostic becomes a no-op so it can't re-trigger the same error). The popup now reads "Tauri 运行时不可用：请在已安装的「Codex++ 管理工具」窗口中操作…".

2. Hardening: verify market-script sha256 before install (c097924)

Market scripts are JS that get injected into the Codex page, so their integrity is security-relevant. The market manifest already carried a per-script sha256, but install_market_script_content wrote the downloaded bytes without checking it (the prior behavior was even pinned by a test that ignored mismatches).

Change: add verify_script_checksum — before writing, hash the downloaded content and compare (case-insensitive hex) against the manifest sha256. On mismatch the install aborts with a clear error: no file written, no install recorded, any existing version left intact. An empty sha256 skips the check, so hash-less legacy manifests still install. Pulls in sha2 + hex (both already resolved in Cargo.lock).

3. Docs: architecture walkthrough notes (74de9ca, 1681ffc, baffc04, db1f5c3)

docs/architecture-notes.md — a new-contributor map of the core mechanisms, each section carrying file:line references:

1–8. CDP injection · the Runtime-Binding bridge · React hooking in the injected script · the Responses⇄Chat protocol proxy (incl. apply_patch codec) · the macOS launcher · GitHub-release auto-update · Zed Remote open · upstream worktree creation.
9. Relay config & profile switching (mode × protocol, the three auth/config layouts).
10. Background consistency — provider_sync (history visibility across a provider switch) + watcher (keep-alive / stale recovery).
11. User scripts & the script market (which is where the §2 hardening was found).

Testing

• npm run check (tsc --noEmit) passes.
• cargo check -p codex-plus-core -p codex-plus-launcher -p codex-plus-data passes; no new warnings.
• Rust suites run locally, all green:
  • bridge_routes 22 passed (incl. the new sha256 reject/accept/skip-when-empty cases)
  • protocol_proxy 35 · relay_config 67 · provider_sync 7 · watcher 9

🤖 Generated with Claude Code