feat(exe): 数据存 exe 旁的 Windsurf_data + 首次运行自动开面板

打包 exe 下原来 DATA_DIR/.env 落在只读快照 C:\snapshot\...(pkg 虚拟路径)→
"Cannot mkdir in a snapshot",状态存不下、还去启 Linux 专用 LS。

- config.js:检测 process.pkg,packaged 时以 exe 所在目录(process.execPath)
  为基准:.env 从 exe 旁读;DATA_DIR 未设时默认 <exe目录>/Windsurf_data
  (accounts/stats/logs 全落这,和快照隔离)。packaged 默认补 DEVIN_CONNECT=1
  (跳过 LS)+ HOST=127.0.0.1(不暴露局域网)。
- config.js:mkdir 前记 isFirstRun(Windsurf_data 尚不存在=首次部署)。
- index.js:仅首次运行自动 `cmd /c start` 打开 dashboard;之后不再开;
  WINDSURFAPI_NO_OPEN=1 可关(CI smoke 已设)。
- 非 packaged(源码/Docker)路径完全不变(process.pkg 未定义)。
- README 补 Windsurf_data + 首次自动开面板说明。

Author: dwgx

.github/workflows/release.yml

@@ -151,6 +151,7 @@ jobs:
         run: |
           $env:DEVIN_CONNECT = '1'; $env:HOST = '127.0.0.1'; $env:PORT = '3999'
           $env:API_KEY = 'ci-smoke'; $env:DATA_DIR = "$env:RUNNER_TEMP\wa-smoke"
+          $env:WINDSURFAPI_NO_OPEN = '1'  # don't try to launch a browser on the headless runner
           $out = "$env:RUNNER_TEMP\exe-out.log"; $err = "$env:RUNNER_TEMP\exe-err.log"
           $p = Start-Process -FilePath dist-windows\windsurfapi.exe -PassThru -WindowStyle Hidden -RedirectStandardOutput $out -RedirectStandardError $err
           $ok = $false

deploy/windows/README.md

@@ -5,10 +5,12 @@
 ## 两种跑法
 
 **A. 单 exe(开箱即用,无需装 Node)** —— 类似 KiroStudio 的 `kirostudio.exe`。
-从 [GitHub Releases](https://github.com/dwgx/WindsurfAPI/releases) 下载 `windsurfapi.exe`(每个 `v*` tag 由 CI 的 windows runner 用 pkg 打包,已 smoke 验证能起 + 出面板),放进任意空文件夹,双击即跑:
-  - 首次运行读同目录 `.env`(没有则用内置默认:`PORT=3003` / `HOST=127.0.0.1` / `DEVIN_CONNECT=1`,但**没有 API_KEY/密码**,建议先照下面 B 的 `start.bat` 生成一份 `.env` 或手写)。
-  - 面板 `http://127.0.0.1:3003/dashboard`,dashboard 静态资源已打进 exe(pkg 快照 FS),无需额外文件。
-  - 关窗口 = 停止。换新版 = 下载新 exe 覆盖重跑,`.env`/数据不动。
+从 [GitHub Releases](https://github.com/dwgx/WindsurfAPI/releases) 下载 `windsurfapi.exe`(每个 `v*` tag 由 CI 的 windows runner 打包,已 smoke 验证能起 + 出面板),放进任意空文件夹,双击即跑:
+  - exe 内置默认:`DEVIN_CONNECT=1`(纯 HTTP 路,不需要 Linux 专用的 language server)、`HOST=127.0.0.1`(仅本机,不暴露局域网)、`PORT=3003`。
+  - **所有状态存到 exe 同目录的 `Windsurf_data/` 文件夹**(accounts.json / stats / logs),与程序内部的只读快照隔离。想换位置可在同目录 `.env` 里设 `DATA_DIR=`。
+  - **首次运行会自动打开** `http://127.0.0.1:3003/dashboard`(之后启动不再自动开;`WINDSURFAPI_NO_OPEN=1` 可关掉)。
+  - ⚠️ 内置默认**没有 API_KEY / 面板密码**。要加认证,在 exe 同目录放个 `.env` 写 `API_KEY=xxx` 和 `DASHBOARD_PASSWORD=xxx`(或用下面 B 的 `start.bat` 生成一份再拷过来)。
+  - 关窗口 = 停止。换新版 = 下载新 exe 覆盖,`Windsurf_data/` 与 `.env` 不动。
 
 **B. 源码 + 脚本(需装 Node 20+,零 npm 依赖)** —— 开发/自更新首选,`git pull` 即拉最新。
 双击 `start.bat`(见下),它生成 `.env` + 打印密钥 + 前台监督循环。

src/config.js

@@ -5,9 +5,19 @@ import { fileURLToPath } from 'url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = resolve(__dirname, '..');
 
+// When packaged as a single .exe (pkg), __dirname/ROOT point INSIDE the
+// read-only snapshot (C:\snapshot\...), so .env can't be read from there and
+// DATA_DIR would try to mkdir in the snapshot (fails). The real writable
+// location is the folder the .exe sits in. Use that as the base for .env and
+// the default data dir so a double-clicked exe keeps its state in a `data/`
+// folder next to itself — cleanly isolated from the bundled Linux snapshot.
+const IS_PACKAGED = !!process.pkg;
+const EXE_DIR = IS_PACKAGED ? dirname(process.execPath) : ROOT;
+
 // Load .env file manually (zero dependencies)
 function loadEnv() {
-  const envPath = resolve(ROOT, '.env');
+  // Packaged: read the .env sitting next to the .exe, not the snapshot copy.
+  const envPath = resolve(EXE_DIR, '.env');
   if (!existsSync(envPath)) return;
   const content = readFileSync(envPath, 'utf-8');
   for (const line of content.split('\n')) {
@@ -34,14 +44,32 @@ if (process.env.WINDSURFAPI_SKIP_DOTENV !== '1') {
   loadEnv();
 }
 
+// Packaged-exe sane defaults (only when the user hasn't set them). The Windows
+// exe has no bundled Language Server (Linux-only) and is meant for local
+// single-user use, so: DEVIN_CONNECT=1 (pure-HTTP path, skip the LS entirely),
+// HOST=127.0.0.1 (loopback — don't expose an unauthenticated gateway to the
+// LAN on first run). Both stay overridable via .env / env.
+if (IS_PACKAGED) {
+  if (!process.env.DEVIN_CONNECT && !process.env.DEVIN_ONLY) process.env.DEVIN_CONNECT = '1';
+  if (!process.env.HOST && !process.env.BIND_HOST) process.env.HOST = '127.0.0.1';
+}
+
 // `sharedDataDir` is the cluster-shared root: a single accounts.json lives
 // here so add-account writes from any replica are visible to every replica
 // after restart. `dataDir` is replica-local under REPLICA_ISOLATE=1 and is
 // safe to use for telemetry that does not need cross-replica visibility.
 // See issue #67 — when the two were collapsed into one path, every
 // docker-compose upgrade orphaned the user's accounts.json under a stale
 // `replica-${HOSTNAME}` subdir.
-const sharedDataDir = process.env.DATA_DIR ? resolve(ROOT, process.env.DATA_DIR) : ROOT;
+// Base that relative DATA_DIR / default data dir resolve against. Packaged:
+// the .exe's folder (writable) — NEVER the snapshot ROOT. Default (DATA_DIR
+// unset) for a packaged exe is `<exe-dir>/Windsurf_data` so a double-click
+// drops all state (accounts/stats/logs) into one tidy folder beside the
+// program, isolated from the bundled Linux snapshot.
+const DATA_BASE = IS_PACKAGED ? EXE_DIR : ROOT;
+const sharedDataDir = process.env.DATA_DIR
+  ? resolve(DATA_BASE, process.env.DATA_DIR)
+  : (IS_PACKAGED ? join(EXE_DIR, 'Windsurf_data') : ROOT);
 const dataDir = (() => {
   let base = sharedDataDir;
   if (process.env.REPLICA_ISOLATE === '1' && process.env.HOSTNAME) {
@@ -50,6 +78,11 @@ const dataDir = (() => {
   return base;
 })();
 
+// First-run detection (packaged only): capture whether the data folder exists
+// BEFORE we mkdir it, so index.js can decide to auto-open the dashboard only on
+// the very first launch (no Windsurf_data folder yet = fresh deploy).
+const isFirstRun = IS_PACKAGED && !existsSync(sharedDataDir);
+
 try {
   mkdirSync(sharedDataDir, { recursive: true });
   mkdirSync(dataDir, { recursive: true });
@@ -106,6 +139,13 @@ export const config = {
 
   // Proxy testing
   allowPrivateProxyHosts: process.env.ALLOW_PRIVATE_PROXY_HOSTS === '1',
+
+  // True when running as a packaged single-exe (pkg). Used to enable the
+  // double-click desktop UX: data folder beside the exe, auto-open dashboard.
+  isPackaged: IS_PACKAGED,
+  // True on the very first packaged launch (Windsurf_data didn't exist yet).
+  // index.js opens the dashboard in the browser only on this first deploy.
+  isFirstRun,
 };
 
 const levels = { debug: 0, info: 1, warn: 2, error: 3 };

src/index.js

@@ -177,6 +177,25 @@ async function main() {
 
   const server = startServer();
 
+  // Packaged single-exe desktop UX: on the FIRST deploy (no Windsurf_data folder
+  // existed yet), pop the dashboard in the default browser so the initial
+  // double-click lands on a usable setup page. Subsequent launches don't reopen
+  // it. Best effort — a headless/CI run (WINDSURFAPI_NO_OPEN=1) or a missing
+  // opener just skips it. Delayed slightly so the "Server on ..." line prints.
+  if (config.isFirstRun && process.env.WINDSURFAPI_NO_OPEN !== '1') {
+    const url = `http://127.0.0.1:${config.port}/dashboard`;
+    setTimeout(() => {
+      try {
+        // Windows: `cmd /c start "" <url>` opens the default browser without a
+        // shell window lingering. execFile avoids spawning a persistent shell.
+        import('child_process').then(({ execFile }) => {
+          execFile('cmd', ['/c', 'start', '', url], { windowsHide: true }, () => {});
+        }).catch(() => {});
+        log.info(`First run — opening dashboard in your browser: ${url}`);
+      } catch { /* opener unavailable — user can open the URL manually */ }
+    }, 800);
+  }
+
   let shuttingDown = false;
   const shutdown = (signal) => {
     if (shuttingDown) return;