Fix FreeOS Windows installer Chinese mojibake and noisy openXYOS provision

CHANGELOG.md

@@ -8,6 +8,8 @@
 
 ### 修复
 
+- Windows 安装预配不再把 Node 工作目录选到残留的嵌套 `openxyos\\openxyos`：顶层已有 `backend-dist/server.js` 与 `dist/index.html` 时必须用 live 根。嵌套 cwd 会让 `node backend-dist/server.js` 立刻退出且 stdout/stderr 为空，安装空等 90s 后以退出码 12 失败。`start-sidecar.ps1` / 预配 / 桌面 Go / Python 启动路径统一按此选择 cwd；每次启动截断 `start.log`；Shell.Application 若未刷新日志则改走 explorer / Start-Process，Node fail-fast 不再伪装成 livez 超时。
+- Windows 安装详情不再把 openXYOS 预配的 UTF-8 Node/PowerShell 控制台（`[Error] POST /api/auth`、`[seed]`、中文 Server/WebSocket 状态）按系统 ANSI/GBK 打成乱码。NSIS 只用 `nsExec::Exec` 等退出码，详情页只显示本地化步骤结果；完整日志写入 `%LOCALAPPDATA%\\FreeOS\\openxyos\\provision.log` / `start.log`（UTF-8）。解压前停止并等待旧的 FreeOS openXYOS Node 退出；livez 通过即成功，不把启动期 auth 日志当失败。
 - 组织页互生长通道两端都落到可选用状态：推送到 openXYOS 时员工/人才写成列表页能看到的 `active` / `internal` / `available`；从 openXYOS 回流时即使没有技能字段也会登记为同事，技能/插件/MCP 写入 `org-skills` / `org-plugins` / `org-mcps`，并把聊天专家挂到当前用户（修复 `user_id=NULL` 导致「专家」页看不见）。导入后跳到「专家」页，推送/循环后关闭管理抽屉并刷新预览。
 - 组织页内嵌浏览器补上后退 / 前进 / 刷新；openXYOS 首页卡通助手改为打包进前端资源（并保留 `/assets/xyai-mascot.webp` 回退），不再显示破碎图片。
 - 启动 FreeOS 时就会拉起本机 openXYOS 前后端（桌面 `startOrgSidecar` + 主机 `ensure_sidecar`），不必先进入组织页；登录不再因为 3780 未监听而 `Failed to fetch`。

desktop/README.md

@@ -29,13 +29,21 @@ Same precedence as the FreeOS CLI/server:
   `$INSTDIR\openxyos` as a sealed copy; the `openxyos-runtime` zip and folder
   are deleted after a successful provision), starts FE/BE
   at medium integrity (Node inherits `CORS_ORIGIN` / `NODE_ENV`; stdout/stderr
-  go to `start.log`), and writes `.install-ready` only after
-  `http://127.0.0.1:3780/api/health/livez` is healthy. Before extract it
+  go to UTF-8 `start.log`), and writes `.install-ready` only after
+  `http://127.0.0.1:3780/api/health/livez` is healthy. The Setup detail list
+  shows localized step results only (`nsExec::Exec`, not `ExecToLog`); full
+  PowerShell/Node console stays in `%LOCALAPPDATA%\FreeOS\openxyos\provision.log`
+  and `start.log` so UTF-8 Chinese is not misread as GBK. Before extract it
   stops only FreeOS openXYOS Node (`start.pid` / live and `$INSTDIR\openxyos`
-  paths), unpacks into a LocalAppData temp dir, logs tar stderr to
-  `provision.log`, and treats a non-zero tar as success when the layout
-  heals. If Node dies before livez, the provisioner exits 10 with a
-  `start.log` excerpt instead of waiting out a livez timeout. A failed
+  paths) and waits until that owned process is gone. After extract+heal, Node
+  starts with cwd at the live root when `backend-dist/server.js` and
+  `dist/index.html` exist there (a leftover nested `openxyos\openxyos` tree
+  must not win — that cwd exits immediately with an empty console). It unpacks into a LocalAppData
+  temp dir, logs tar stderr to `provision.log`, and treats a non-zero tar as
+  success when the layout heals. Transient `[Error] POST /api/auth` / `[seed]`
+  lines in `start.log` are not a provision failure when livez is healthy. If
+  Node dies before livez, the provisioner exits 10 with a `start.log` excerpt
+  in `provision.log` instead of waiting out a livez timeout. A failed
   subprocess is a failed install step (retry the provisioner). There is no
   Windows logon autostart: when FreeOS starts later, it brings local
   openXYOS up with it. Organization embeds `http://127.0.0.1:3780` directly.
@@ -53,11 +61,13 @@ with `makensis -INPUTCHARSET UTF8` from a UTF-8 BOM `project.nsi`.
 The install log is no longer only `FreeOS.exe` + shortcuts. A healthy package
 also copies `openxyos-runtime.zip` plus the provisioner (`provision-openxyos.ps1`
 / `.cmd`, `start-sidecar.ps1` / `.cmd`). Setup **nsExecs that provisioner as
-a child process** and waits for exit 0. The child extracts with Windows
+a child process** (`nsExec::Exec`, stdout discarded) and waits for exit 0.
+The child extracts with Windows
 `tar.exe` (quoted paths, so `Program Files` works) into a LocalAppData
 temp dir, then heals that tree into `%LOCALAPPDATA%\FreeOS\openxyos` after
-stopping only the FreeOS openXYOS Node that would lock those files. tar
-stdout/stderr go to `provision.log`. A non-zero tar is not exit 3 when the
+stopping only the FreeOS openXYOS Node that would lock those files and
+waiting until it is gone. tar
+stdout/stderr go to UTF-8 `provision.log`, not the NSIS detail list. A non-zero tar is not exit 3 when the
 layout is complete after heal. It then starts Node at medium integrity
 (IShellDispatch2 — never High-IL Node from the elevated installer), waits
 for livez, and writes `.install-ready` only when healthy. `$INSTDIR\openxyos`

desktop/src/build/windows/nsis/project.nsi

@@ -58,6 +58,8 @@ LangString OPENXYOS_COPY_ZIP ${LANG_SIMPCHINESE} "复制 openXYOS 运行包（
 LangString OPENXYOS_COPY_ZIP ${LANG_ENGLISH} "Copy the openXYOS runtime payload and provisioner subprocess"
 LangString OPENXYOS_PROVISION ${LANG_SIMPCHINESE} "正在以子进程部署 openXYOS（解压、启动前后端、等待健康检查）"
 LangString OPENXYOS_PROVISION ${LANG_ENGLISH} "Running the openXYOS provisioner subprocess (extract, start FE/BE, wait for health)"
+LangString OPENXYOS_PROVISION_DETAIL ${LANG_SIMPCHINESE} "完整日志：%LOCALAPPDATA%\\FreeOS\\openxyos\\provision.log（UTF-8）；此处只显示步骤结果"
+LangString OPENXYOS_PROVISION_DETAIL ${LANG_ENGLISH} "Full log: %LOCALAPPDATA%\\FreeOS\\openxyos\\provision.log (UTF-8); this list shows step results only"
 LangString OPENXYOS_PROVISION_CODE ${LANG_SIMPCHINESE} "openXYOS 预配子进程退出码 "
 LangString OPENXYOS_PROVISION_CODE ${LANG_ENGLISH} "openXYOS provisioner subprocess exit code "
 LangString OPENXYOS_PROVISION_OK ${LANG_SIMPCHINESE} "本机 openXYOS 已就绪（http://127.0.0.1:3780 健康检查通过）"

desktop/src/build/windows/nsis/provision-openxyos.cmd

@@ -1,6 +1,9 @@
 @echo off
 setlocal EnableExtensions
-rem NSIS nsExec/ExecWait target. Real provisioner is provision-openxyos.ps1.
+rem NSIS nsExec target. Real provisioner is provision-openxyos.ps1.
+rem Hide PowerShell/Node stdout from the installer detail list: UTF-8
+rem Chinese would mojibake as system ANSI (GBK on Chinese Windows).
+rem Full logs: %LOCALAPPDATA%\FreeOS\openxyos\provision.log and start.log
 rem Pass-through only. No cmd labels.
-"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0provision-openxyos.ps1" %*
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0provision-openxyos.ps1" %* >nul 2>&1
 exit /b %ERRORLEVEL%