feat(settings): add Codex link controls and authenticated phone bridge

apps/desktop/electron/main.ts

@@ -36,6 +36,7 @@ import { WebSocket as RelayWebSocket } from 'ws'
 
 import { classifyActiveRuntime, needsPackagedRuntimeUpgrade } from './active-runtime-state'
 import { createAiturkCliRunner, createAiturkLogin } from './aiturk-login'
+import { createCodexLinkClient } from './codex-link-client'
 import { createMobileBackendResolver } from './mobile-backend'
 import {
   createMobileLink,
@@ -17266,6 +17267,16 @@ const aiturkLogin = createAiturkLogin({
   now: () => Date.now()
 })
 
+const codexLinkControl = createCodexLinkClient({ spawn, existsSync: fs.existsSync, env: process.env })
+ipcMain.handle('aiturk:codex-link:control', async (event, request) => {
+  const window = BrowserWindow.fromWebContents(event.sender)
+  if (!window || (window !== mainWindow && !instanceWindows.has(window)) ||
+      event.senderFrame !== event.sender.mainFrame) {
+    throw new Error('codex-link:unavailable')
+  }
+  return codexLinkControl(request)
+})
+
 // Only the primary window's top-level frame may drive a sign-in.
 function assertAiturkLoginSender(event) {
   const contents = mainWindow && !mainWindow.isDestroyed() ? mainWindow.webContents : null
@@ -17863,6 +17874,7 @@ function getMobileLink(): MobileLink {
   const directory = path.join(app.getPath('userData'), 'aiturk-mobile', 'mobile')
 
   mobileLink = createMobileLink({
+    codexLinkControl,
     // Same vault file as before (mobile-secrets.bin, safeStorage); older fields are kept.
     vault: new MobileVault(directory, safeStorage),
     store: createMobileLinkFileStore(directory, path.join(directory, 'lan-link.json'), fs.promises),