@danceiny/gotry 0.0.1-rc.9 → 0.2.0-rc.28

package/bin/gotry-inner.js

@@ -6,31 +6,42 @@
  *   gotry help                         # help
  *
  * 工作流程:
- *   1. 解析 argv + .env(provider-neutral → DEEPSEEK_API_KEY)
+ *   1. 解析 argv + .env(provider-neutral → DEEPSEEK_API_KEY/DEEPSEEK_BASE_URL)
  *   2. 定位 dsh runtime:
- *      a. repo checkout → vendored ts/dsh-runtime/node_modules/...
- *      b. npm 安装     → createRequire 解析依赖 @deepseek-ai/dsh(不走 npx:
- *         dsh cordis-loader 在子 cwd 求值 plugin name,必须绝对路径 patch)
+ *      a. repo checkout / npm 安装 → root package 解析锁定的 @deepseek-ai/dsh
+ *      b. legacy vendored fallback 已按 D-27 移除(issue #120)——root 缺失即
+ *         fail-closed 报错指重装,不再有「解析成功却跑不起来」的玄学形态
  *   3. 运行时生成 patch(os.tmpdir):把 gotry-tools 插件路径重写为按本包
  *      位置解析的绝对路径 —— 仓内 cordis.gotry-patch.yml 里的 name 行只是
  *      占位(本机绝对路径),随 tarball 分发后对其他机器必错。
  */
 
-import { spawn } from 'node:child_process'
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
+import { spawn, spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 import { dirname, join } from 'node:path'
-import { tmpdir } from 'node:os'
+import { homedir, tmpdir } from 'node:os'
 import { createRequire } from 'node:module'
+import {
+  benchmarkRuntimeSupported,
+  resolveDshPackage,
+  selectDshCwd,
+  selectDshRuntime,
+  supportsNodeVersion,
+} from './gotry-runtime-resolution.js'
+import { onboardingSkipReason, orchestrateWebLaunch } from './gotry-bootstrap.js'
+import { spawnOwnedChild, terminateOwnedChild } from './gotry-process-liveness.js'
 
 const here = dirname(fileURLToPath(import.meta.url))
 const repoRoot = join(here, '..')
+const sourceCheckoutMode = existsSync(join(repoRoot, '.git'))
 const require_ = createRequire(import.meta.url)
+const rootRequire = createRequire(join(repoRoot, 'package.json'))
 
 // --- 环境 .env 加载(provider-neutral) ---
 // npm 安装模式优先读用户当前目录的 .env(包目录内不该有凭证);repo 检出读仓根。
-const vendoredDshEarly = existsSync(join(repoRoot, 'ts/dsh-runtime/node_modules/@deepseek-ai/dsh/lib/bin.js'))
-const envCandidates = vendoredDshEarly
+const sourceDshEarly = resolveDshPackage(rootRequire)
+const envCandidates = sourceCheckoutMode || sourceDshEarly
   ? [join(repoRoot, '.env')]
   : [join(process.cwd(), '.env'), join(repoRoot, '.env')]
 const envLines = []
@@ -46,6 +57,22 @@ for (const line of envLines) {
 if (process.env.LLM_API_KEY && !process.env.DEEPSEEK_API_KEY) {
   process.env.DEEPSEEK_API_KEY = process.env.LLM_API_KEY
 }
+// base 同点映射(issue #48):dsh 侧 llm-deepseek 读 DEEPSEEK_BASE_URL 并拼
+// `${base}/chat/completions`(与 ts/src/dsh-llm.ts 同语义,自定义端点一般含 /v1);
+// 只映射 key 不映射 base 时,OpenAI 兼容 key 会被发往 DeepSeek 官方端点必然 401。
+if (process.env.LLM_BASE_URL && !process.env.DEEPSEEK_BASE_URL) {
+  process.env.DEEPSEEK_BASE_URL = process.env.LLM_BASE_URL
+}
+// model 映射(issue #77):LLM_MODEL 显式存在时让它真正驱动 dsh 会话面——
+// ① 这里映射为 GOTRY_LLM_MODEL 传给 gotry-tools 插件,在 agent/request 瀑布做
+//    内存覆盖(dsh settings 用户层 ~/.dsh 压过 composition 层,单靠 patch 不够;
+//    覆盖零持久化,进程退即散,不改写用户设置);
+// ② 下方运行时 patch 追加两条 by-id 覆盖:agent-default-model 默认模型 +
+//    llm-deepseek 目录条目(web UI 模型页可见、元数据可记账)。
+// 不设 LLM_MODEL 则两条都不动——默认路径(组合配置或用户 web 设置)面不变。
+if (process.env.LLM_MODEL && !process.env.GOTRY_LLM_MODEL) {
+  process.env.GOTRY_LLM_MODEL = process.env.LLM_MODEL
+}
 
 // --- argv 解析 ---
 const args = process.argv.slice(2)
@@ -56,53 +83,88 @@ if (help) {
 
 Usage:
   gotry web                          # dsh Web UI on http://127.0.0.1:3080
+    # (interactive TTY) 启动前若发现可自动安装的可选能力,问一次是否配置;
+    # 确认复用 doctor --fix 幂等安装,拒绝立即继续。CI/非 TTY/全健康不弹问。
+    # 跳过该问: --no-onboarding 或 GOTRY_ONBOARDING_SKIP=1
+  gotry setup                        # 扩展就位检查/指引(商店一键装)
+  gotry setup calendar               # 可选日历(CalDAV 工作窗口)挂载开关:默认关;--off 关闭;--status 查看
+  gotry doctor                       # 可选依赖体检:扩展/agent-reach/hbcli/flyai/sidebar 状态 + 补装指引
+  gotry doctor --fix                 # 体检 + 按报告补装(hbcli 官方脚本 / agent-reach pip / sidebar 插件)
   gotry "一段完整任务..."            # headless 一问一答
   gotry help                         # this help
-
-Prerequisites:
-  • Node 22+
-  • \`.env\` 里 LLM_API_KEY (DeepSeek / OpenAI 兼容均可)
+  gotry --version                    # 版本号(bug 报告必填项)
 
 Detail: https://github.com/Danceiny/gotry — README
 `)
   process.exit(0)
 }
 
-// mode 决定路径: 'web'/'help'/'help' 是字面命令;否则第一段 args[0] 是任务本身的一部分
-const literal = new Set(['web', 'help', '-h', '--help'])
+// repoRoot 在 npm 安装与源码检出两种形态下都是包根,version 统一从这里取
+if (args[0] === '-v' || args[0] === '--version') {
+  console.log(JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf-8')).version)
+  process.exit(0)
+}
+
+// mode 决定路径: 'web'/'setup'/'doctor'/'help' 是字面命令;否则第一段 args[0] 是任务本身的一部分
+const literal = new Set(['web', 'setup', 'doctor', 'help', '-h', '--help'])
 const isLiteral = literal.has(args[0])
 const mode = isLiteral ? args[0] : 'headless'
 const rest = isLiteral ? args.slice(1) : args
 
-// --- dsh runtime 定位:repo checkout(vendored)优先,npm 安装走依赖解析 ---
-const vendoredDsh = join(repoRoot, 'ts/dsh-runtime/node_modules/@deepseek-ai/dsh/lib/bin.js')
-let dshBin = ''
-let dshCwd = ''
-if (existsSync(vendoredDsh)) {
-  dshBin = vendoredDsh
-  dshCwd = join(repoRoot, 'ts/dsh-runtime')
-} else {
-  try {
-    dshBin = require_.resolve('@deepseek-ai/dsh/lib/bin.js')
-    dshCwd = process.cwd() // npm 安装:gotry-state 落在用户调用目录
-  } catch {
-    dshBin = ''
-  }
+// setup/doctor:外部依赖自举与体检,不需要 dsh runtime 与 LLM key,同步分发后即退
+if (mode === 'setup' || mode === 'doctor') {
+  const r = spawnSync(process.execPath, [join(here, 'gotry-bootstrap.js'), mode, ...rest], { stdio: 'inherit' })
+  process.exit(r.status ?? (r.error ? 1 : 0))
 }
 
+const benchmarkEnvironmentConfig = process.env.GOTRY_BENCHMARK_ENV_CONFIG
+if (!supportsNodeVersion(process.versions.node)) {
+  console.error('[gotry] Node.js 22.15 or newer is required')
+  process.exit(1)
+}
+
+// --- dsh runtime 定位(D-27 清偿,issue #120):仅 root manifest/依赖解析;legacy vendored 回退已移除 ---
+const installedPackageMode = !sourceCheckoutMode
+const selectedDsh = selectDshRuntime({
+  repoRoot,
+  rootResolver: rootRequire,
+  benchmark: Boolean(benchmarkEnvironmentConfig),
+})
+let dshBin = selectedDsh?.bin ?? ''
+const dshSource = selectedDsh?.source ?? ''
+const dshCwd = selectedDsh
+  ? selectDshCwd({
+      repoRoot,
+      invocationCwd: process.cwd(),
+      sourceCheckoutMode,
+      benchmark: Boolean(benchmarkEnvironmentConfig),
+    })
+  : ''
+
 if (!dshBin) {
-  console.error(`[gotry] 找不到 dsh runtime(既无 vendored ${vendoredDsh},依赖里也没有 @deepseek-ai/dsh)。`)
-  console.error('repo checkout: cd ts/dsh-runtime && pnpm install;npm 安装: npm install(检查 node_modules)。')
+  if (benchmarkEnvironmentConfig) {
+    console.error('[gotry] benchmark dsh runtime unavailable')
+    process.exit(1)
+  }
+  console.error('[gotry] 找不到 dsh runtime(依赖里没有 @deepseek-ai/dsh;legacy vendored 回退已按 D-27 移除)。')
+  console.error('repo checkout: npm ci && npm --prefix ts ci && node scripts/build-dist.mjs;npm 安装: npm install(检查 node_modules)。')
+  process.exit(1)
+}
+if (benchmarkEnvironmentConfig && !benchmarkRuntimeSupported(selectedDsh)) {
+  console.error('[gotry] benchmark dsh runtime unavailable')
   process.exit(1)
 }
 
 // --- 运行时 patch:插件路径按本包位置重写为绝对路径 ---
-// npm 模式指向 dist/ 纯 JS(Node 拒绝 strip node_modules 下的 .ts);
-// repo 检出指向 .ts 源码(vendored runtime 下天然可行)。
+// 安装包始终指向 dist/ 纯 JS(Node 拒绝 strip node_modules 下的 .ts)。
+// repo 检出仅在显式 tsx loader 可用时走 .ts；否则
+// 使用当前 worktree 已构建的 dist，避免 Node strip-only 拒绝参数属性语法。
 const distEntry = join(repoRoot, 'dist/src/index.js')
 const tsEntry = join(repoRoot, 'ts/src/index.ts')
-const npmMode = !existsSync(vendoredDsh)
-const pluginEntry = npmMode && existsSync(distEntry) ? distEntry : tsEntry
+const tsxLoaderActive = /(?:^|\s)--(?:import|loader)(?:=|\s)(?:"[^"]*tsx[^"]*"|'[^']*tsx[^']*'|\S*tsx\S*)/.test(process.env.NODE_OPTIONS ?? '')
+const sourceTypeScriptMode = !installedPackageMode && tsxLoaderActive
+const pluginEntry = !sourceTypeScriptMode && existsSync(distEntry) ? distEntry : tsEntry
+const distModuleMode = pluginEntry === distEntry
 const staticPatch = join(repoRoot, 'cordis.gotry-patch.yml')
 if (!existsSync(staticPatch)) {
   console.error(`[gotry] 找不到 patch 配置: ${staticPatch}`)
@@ -112,16 +174,242 @@ if (!existsSync(pluginEntry)) {
   console.error(`[gotry] 找不到插件入口: ${pluginEntry}(包不完整?)`)
   process.exit(1)
 }
-// dsh-map-tools 宿主插件(地图/路线/POI,零 key 走 OSM/OSRM):repo 用 vendored,
-// npm 用依赖解析;都找不到就整块剔除 patch 条目(缺地图不挡旅行规划)
+
+// Benchmark mode projects the patch before any optional host plugin is
+// resolved/imported. Non-GoTry (including unknown/future) insert entries are
+// safely discarded; a missing/duplicate gotry-tools entry fails closed.
+function projectBenchmarkPatch(raw, entryPath, configPath) {
+  const lines = raw.split('\n')
+  const rootInsertKey = /(?:^|[,{}]\s*)(?:insert|'insert'|"insert")\s*:/
+  const rootInsertLines = lines
+    .map((line, index) => {
+      const rootItem = line.match(/^-\s+(.*)$/)?.[1]?.trim()
+      const directProperty = line.match(/^ {2}(.*)$/)?.[1]?.trim()
+      return rootInsertKey.test(rootItem ?? '') || /^(?:insert|'insert'|"insert")\s*:/.test(directProperty ?? '') ? index : -1
+    })
+    .filter(index => index >= 0)
+  const canonicalInsertStarts = lines
+    .map((line, index) => /^- insert:\s*(?:#.*)?$/.test(line) ? index : -1)
+    .filter(index => index >= 0)
+  if (rootInsertLines.length !== 1 || canonicalInsertStarts.length !== 1 || rootInsertLines[0] !== canonicalInsertStarts[0]) {
+    throw new Error('benchmark insert block violation')
+  }
+  const start = canonicalInsertStarts[0]
+  let end = start + 1
+  while (end < lines.length) {
+    const line = lines[end]
+    if (line.trim() !== '' && !/^\s/.test(line) && !line.trim().startsWith('#')) break
+    end += 1
+  }
+  const body = lines.slice(start + 1, end)
+  const firstItem = body.find(line => line.trim() !== '' && !line.trim().startsWith('#'))
+  const firstItemMatch = firstItem?.match(/^(\s*)-\s+/)
+  if (!firstItemMatch) throw new Error('invalid insert sequence')
+  const itemIndent = firstItemMatch[1].length
+  const itemStarts = []
+  for (let index = 0; index < body.length; index += 1) {
+    const line = body[index]
+    if (line.trim() === '' || line.trim().startsWith('#')) continue
+    const indent = line.match(/^\s*/)?.[0].length ?? 0
+    if (indent < itemIndent || (indent === itemIndent && !/^\s*-\s+/.test(line))) {
+      throw new Error('invalid insert sequence')
+    }
+    if (indent === itemIndent) itemStarts.push(index)
+  }
+  if (itemStarts.length === 0) throw new Error('empty insert sequence')
+
+  const parseId = value => {
+    const quoted = value.trim().match(/^(['"])([A-Za-z0-9._-]+)\1(?:\s+#.*)?$/)
+    if (quoted) return quoted[2]
+    return value.trim().match(/^([A-Za-z0-9._-]+)(?:\s+#.*)?$/)?.[1] ?? null
+  }
+  const itemId = item => {
+    const header = item[0].slice(itemIndent + 2).trim()
+    const canonical = header.match(/^id:\s*(.+)$/)
+    if (canonical) return parseId(canonical[1])
+    if (header.startsWith('{')) {
+      const inline = header.match(/(?:^\{\s*|,\s*)id\s*:\s*(['"]?)([A-Za-z0-9._-]+)\1(?=\s*[,}])/)
+      if (inline) return inline[2]
+    }
+    const propertyIndent = ' '.repeat(itemIndent + 2)
+    const directIds = item.slice(1)
+      .map(line => line.startsWith(`${propertyIndent}id:`) ? parseId(line.slice(propertyIndent.length + 3)) : null)
+      .filter(Boolean)
+    if (directIds.length > 1) throw new Error('duplicate insert id')
+    return directIds[0] ?? null
+  }
+  const items = itemStarts.map((itemStart, index) => body.slice(itemStart, itemStarts[index + 1] ?? body.length))
+  const gotryItems = items.filter(item => itemId(item) === 'gotry-tools')
+  if (gotryItems.length !== 1) throw new Error('benchmark insert allowlist violation')
+  let gotry = gotryItems[0].join('\n')
+  gotry = rewriteBenchmarkPluginEntry(gotry, entryPath)
+  gotry = injectBenchmarkEnvironmentConfig(gotry, configPath)
+  const projected = [...lines.slice(0, start + 1), ...gotry.split('\n'), ...lines.slice(end)]
+  return projectBenchmarkSystemPrompt(projected).join('\n')
+}
+
+// The normal persona contains dynamic variables and product-only tool
+// instructions.  They are not meaningful in the minimal benchmark kernel and
+// can make dsh fail while assembling the first request.  Require the exact
+// source shape before replacing it; malformed or ambiguous prompt config must
+// fail closed rather than being partially interpreted.
+// Target dsh-system-prompt Config exposes only personaPrefix / personaSuffix;
+// the legacy `persona:` key does not project through. Validate against the
+// current personaPrefix key.
+function projectBenchmarkSystemPrompt(lines) {
+  const rootStarts = lines.map((line, index) => /^-\s+/.test(line) ? index : -1).filter(index => index >= 0)
+  const rootItems = rootStarts.map((itemStart, index) => lines.slice(itemStart, rootStarts[index + 1] ?? lines.length))
+  if (rootItems.length !== 2) throw new Error('benchmark system-prompt root shape violation')
+  const insertItems = rootItems.filter(item => /^- insert:\s*(?:#.*)?$/.test(item[0]))
+  const systemItems = rootItems.filter(item => /^- id:\s*system-prompt\s*(?:#.*)?$/.test(item[0]))
+  if (insertItems.length !== 1 || systemItems.length !== 1) throw new Error('benchmark system-prompt canonical shape violation')
+  const start = rootStarts[rootItems.indexOf(systemItems[0])]
+  let end = start + 1
+  while (end < lines.length && (lines[end].trim() === '' || /^\s/.test(lines[end]) || lines[end].trim().startsWith('#'))) end += 1
+  const item = lines.slice(start, end)
+  const configIndexes = item.map((line, index) => /^ {2}config:\s*$/.test(line) ? index : -1).filter(index => index >= 0)
+  const personaIndexes = item.map((line, index) => /^ {4}personaPrefix:\s*>-\s*$/.test(line) ? index : -1).filter(index => index >= 0)
+  // Reject any leftover legacy `persona:` field under config: — it would be
+  // silently dropped by the target Config and leave the kernel persona-less.
+  // The minimal kernel must project through personaPrefix only.
+  const legacyPersonaIndexes = item.map((line, index) => /^ {4}persona:\s*>-\s*$/.test(line) ? index : -1).filter(index => index >= 0)
+  if (legacyPersonaIndexes.length !== 0) throw new Error('benchmark system-prompt legacy persona key not allowed under target 0.2.0-rc.2')
+  if (configIndexes.length !== 1 || personaIndexes.length !== 1 || personaIndexes[0] <= configIndexes[0]) {
+    throw new Error('benchmark system-prompt config violation')
+  }
+  const persona = personaIndexes[0]
+  const blockEnd = item.slice(persona + 1).findIndex(line => line.trim() !== '' && !/^\s{6,}/.test(line))
+  const contentEnd = blockEnd < 0 ? item.length : persona + 1 + blockEnd
+  if (contentEnd === persona + 1 || item.slice(persona + 1, contentEnd).some(line => line.trim() !== '' && !/^\s{6,}/.test(line))) {
+    throw new Error('benchmark system-prompt personaPrefix block violation')
+  }
+  const before = item.slice(1, configIndexes[0]).filter(line => line.trim() !== '' && !line.trim().startsWith('#'))
+  const between = item.slice(configIndexes[0] + 1, persona).filter(line => line.trim() !== '' && !line.trim().startsWith('#'))
+  const after = item.slice(contentEnd).filter(line => line.trim() !== '' && !line.trim().startsWith('#'))
+  if (before.length !== 0 || between.length !== 0 || after.length !== 0) throw new Error('benchmark system-prompt shape violation')
+  const replacement = [
+    '- id: system-prompt',
+    '  config:',
+    '    personaPrefix: >-',
+    '      You are GoTry, a task-agnostic travel planning assistant.',
+    '      Use only the current conversation and tools available in this benchmark session.',
+  ]
+  return [...lines.slice(0, start), ...replacement, ...lines.slice(end)]
+}
+
+function rewriteBenchmarkPluginEntry(raw, entryPath) {
+  const itemIndent = raw.match(/^(\s*)-\s+/)?.[1].length
+  if (itemIndent === undefined) throw new Error('benchmark plugin item unavailable')
+  const propertyIndent = ' '.repeat(itemIndent + 2)
+  const anchorPattern = new RegExp(`^(${propertyIndent}name:\\s*)'[^'\\r\\n]*ts\\/src\\/index\\.ts'(\\s*(?:#.*)?)$`, 'gm')
+  const anchors = [...raw.matchAll(anchorPattern)]
+  if (anchors.length !== 1 || anchors[0].index === undefined) throw new Error('benchmark plugin anchor unavailable')
+  const anchor = anchors[0]
+  const escapedEntry = entryPath.replace(/'/g, "''")
+  const replacement = `${anchor[1]}'${escapedEntry}'${anchor[2]}`
+  const rewritten = `${raw.slice(0, anchor.index)}${replacement}${raw.slice(anchor.index + anchor[0].length)}`
+  if (!rewritten.includes(replacement)) throw new Error('benchmark plugin rewrite unavailable')
+  return rewritten
+}
+
+function injectBenchmarkEnvironmentConfig(raw, configPath) {
+  const itemIndent = raw.match(/^(\s*)-\s+/)?.[1].length
+  if (itemIndent === undefined) throw new Error('benchmark config item unavailable')
+  const propertyIndent = ' '.repeat(itemIndent + 2)
+  const configIndent = ' '.repeat(itemIndent + 4)
+  const configAnchors = raw.match(new RegExp(`^${propertyIndent}config:\\s*(?:#.*)?$`, 'gm')) ?? []
+  if (configAnchors.length !== 1) throw new Error('benchmark config block unavailable')
+  if (new RegExp(`^${propertyIndent}(?:inject|'inject'|"inject")\\s*:`, 'm').test(raw)) {
+    throw new Error('benchmark service injection already declared')
+  }
+  if ((raw.match(new RegExp(`^${configIndent}benchmarkEnvironmentConfigPath\\s*:`, 'gm')) ?? []).length !== 0) {
+    throw new Error('duplicate benchmark config path')
+  }
+  const anchorPattern = new RegExp(`^(${configIndent})hbcliBin:\\s*'[^'\\r\\n]*'\\s*(?:#.*)?$`, 'gm')
+  const anchors = [...raw.matchAll(anchorPattern)]
+  if (anchors.length !== 1 || anchors[0].index === undefined) throw new Error('benchmark config anchor unavailable')
+  const anchor = anchors[0]
+  const escapedPath = configPath.replace(/'/g, "''")
+  const insertAt = anchor.index + anchor[0].length
+  const injected = `${raw.slice(0, insertAt)}\n${anchor[1]}benchmarkEnvironmentConfigPath: '${escapedPath}'${raw.slice(insertAt)}`
+  if ((injected.match(new RegExp(`^${configIndent}benchmarkEnvironmentConfigPath\\s*:`, 'gm')) ?? []).length !== 1) {
+    throw new Error('benchmark config injection unavailable')
+  }
+  // Only benchmark opt-in requires this service. The loader merges this entry
+  // dependency with the plugin's tools/systemPrompt dependencies before apply.
+  // A one-time ctx.get() without this edge races the parallel profile loader.
+  return injected.replace(new RegExp(`^${propertyIndent}config:`, 'm'), `${propertyIndent}inject: [subprocess]\n${propertyIndent}config:`)
+}
+
+let benchmarkTerminalConfig = null
+let benchmarkPatchProjection = null
+let benchmarkChildDiagnostics = null
+if (benchmarkEnvironmentConfig !== undefined && benchmarkEnvironmentConfig !== '') {
+  let validBenchmarkEnvironmentConfig = false
+  try {
+    const bridgeModule = distModuleMode && existsSync(join(repoRoot, 'dist/src/benchmark-environment-bridge.js'))
+      ? join(repoRoot, 'dist/src/benchmark-environment-bridge.js')
+      : join(repoRoot, 'ts/src/benchmark-environment-bridge.ts')
+    const { loadBenchmarkEnvironmentConfig } = await import(pathToFileURL(bridgeModule).href)
+    const loadedConfig = benchmarkEnvironmentConfig.length > 0
+      && benchmarkEnvironmentConfig.length <= 4096
+      && !benchmarkEnvironmentConfig.includes('\0')
+      && !benchmarkEnvironmentConfig.includes('\r')
+      && !benchmarkEnvironmentConfig.includes('\n')
+      ? loadBenchmarkEnvironmentConfig(benchmarkEnvironmentConfig)
+      : null
+    validBenchmarkEnvironmentConfig = loadedConfig !== null
+    benchmarkTerminalConfig = loadedConfig?.terminal_output ?? null
+    if (validBenchmarkEnvironmentConfig) {
+      benchmarkPatchProjection = projectBenchmarkPatch(readFileSync(staticPatch, 'utf-8'), pluginEntry, benchmarkEnvironmentConfig)
+    }
+  } catch { validBenchmarkEnvironmentConfig = false }
+  if (!validBenchmarkEnvironmentConfig) {
+    console.error('[gotry] benchmark environment configuration unavailable')
+    process.exit(1)
+  }
+}
+if (benchmarkEnvironmentConfig && mode !== 'headless') {
+  console.error('[gotry] benchmark environment requires headless mode')
+  process.exit(1)
+}
+if (benchmarkEnvironmentConfig) {
+  try {
+    const diagnosticModule = distModuleMode && existsSync(join(repoRoot, 'dist/src/benchmark-headless-child-diagnostics.js'))
+      ? join(repoRoot, 'dist/src/benchmark-headless-child-diagnostics.js')
+      : join(repoRoot, 'ts/src/benchmark-headless-child-diagnostics.ts')
+    benchmarkChildDiagnostics = await import(pathToFileURL(diagnosticModule).href)
+  } catch {
+    console.error('[gotry] benchmark environment configuration unavailable')
+    process.exit(1)
+  }
+}
+// dsh-map-tools 宿主插件(地图/路线/POI,零 key 走 OSM/OSRM):tarball 随包 vendor,
+// repo 工作副本走 runtime workspace 链接/依赖解析;都找不到就整块剔除 patch 条目
+// (缺地图不挡旅行规划)。保持 vendored 形态而非 npm 依赖:历史上游 peerDependencies
+// (dsh-settings/dsh-tools >=0.1.2-rc.1)与锁定的 0.1.2-alpha.3 家族在 npm 严格 peer
+// 解析下 ERESOLVE;当前锁定 0.2.0-rc.2 家族;vendored 0.7.3 保留上游开区间
+// peers(>=0.1.2-rc.1),npm 解析与 0.2.0 起的运行时 peer 兼容闸均直接通过,继续以
+// vendored 形态随 tarball 分发并复用同一份七工具接线。
 let mapEntry = ''
-const vendoredMap = join(repoRoot, 'ts/dsh-runtime/node_modules/dsh-map-tools/lib/index.js')
-if (existsSync(vendoredMap)) {
-  mapEntry = vendoredMap
-} else {
-  // npm 布局:子路径可能被 exports 挡(resolve 抛错不能留下旧值),裸包名返回真实入口
-  try { mapEntry = require_.resolve('dsh-map-tools/lib/index.js') } catch { mapEntry = '' }
-  if (!mapEntry) { try { mapEntry = require_.resolve('dsh-map-tools') } catch { mapEntry = '' } }
+if (!benchmarkEnvironmentConfig) {
+  const vendoredMap = join(repoRoot, 'ts/dsh-runtime/vendor/dsh-map-tools/lib/index.js')
+    // (随 tarball 分发;source 布局同一份文件)
+  const runtimeMap = join(repoRoot, 'ts/dsh-runtime/node_modules/dsh-map-tools/lib/index.js')
+    // (ts/dsh-runtime pnpm workspace vendor/* 链接形态)
+  if (existsSync(vendoredMap)) {
+    mapEntry = vendoredMap
+  } else if (existsSync(runtimeMap)) {
+    mapEntry = runtimeMap
+  } else {
+    // npm 布局:子路径可能被 exports 挡(resolve 抛错不能留下旧值),裸包名返回真实入口
+    try { mapEntry = require_.resolve('dsh-map-tools/lib/index.js') } catch { mapEntry = '' }
+    if (!mapEntry) { try { mapEntry = require_.resolve('dsh-map-tools') } catch { mapEntry = '' } }
+    if (!mapEntry) {
+      // ts/node_modules 回退(source 模式:dsh-map-tools 安装在 ts/package.json)
+      try { mapEntry = require_.resolve(join(repoRoot, 'ts/node_modules/dsh-map-tools')) } catch { mapEntry = '' }
+    }
+  }
 }
 // 结构化澄清卡(T2):ask_user_question 工具 + user-questions 服务,从 dsh 包
 // 上下文解析(pnpm 嵌套布局下只有 dsh 自己看得见这些依赖);失败整块剔除
@@ -131,7 +419,7 @@ if (existsSync(vendoredMap)) {
 const stdioAsk = mode === 'headless' && (process.stdin.isTTY || process.env.GOTRY_ASK_STDIO === '1')
   ? join(here, 'gotry-stdio-ask.js') : ''
 let askUserInsert = ''
-if (mode === 'web' || stdioAsk) try {
+if (!benchmarkEnvironmentConfig && (mode === 'web' || stdioAsk)) try {
   const reqFromDsh = createRequire(dshBin)
   // 裸包名解析(这些包的 exports 不暴露 ./lib/index.js 子路径,但裸名返回真实入口)
   // userQuestions 服务默认树已注册(重复插入会崩),只插工具消费者
@@ -140,75 +428,437 @@ if (mode === 'web' || stdioAsk) try {
     + `    - id: dsh-tool-ask-user\n      name: '${at}'`
 } catch { /* 缺件不挡启动 */ }
 
-let patchRaw = readFileSync(staticPatch, 'utf-8')
-  .replace(/(name:\s*)'[^']*ts\/src\/index\.ts'/, `$1'${pluginEntry}'`)
-  .replace(/^\s*# \{ask-user-insert\}.*\n(\s*# .*\n)?/m, askUserInsert ? askUserInsert + '\n' : '')
+const unboundPatch = benchmarkPatchProjection ?? readFileSync(staticPatch, 'utf-8')
+let patchRaw = benchmarkPatchProjection ?? unboundPatch.replace(/(name:\s*)'[^']*ts\/src\/index\.ts'/, `$1'${pluginEntry}'`)
+patchRaw = patchRaw.replace(/^\s*# \{ask-user-insert\}.*\n(\s*# .*\n)?/m, askUserInsert ? askUserInsert + '\n' : '')
+
+// Owner-local benchmark environment opt-in. Keep the path out of tool input
+// and logs; it is only injected into the local plugin config as YAML data.
 if (mapEntry) {
   patchRaw = patchRaw.replace(/(name:\s*)'placeholder\/dsh-map-tools'/, `$1'${mapEntry}'`)
 } else {
   patchRaw = patchRaw.replace(/\n\s*- id: dsh-map-tools\n\s*name: 'placeholder\/dsh-map-tools'\n/, '\n')
 }
 
-// dsh-calendar 宿主插件(CalDAV 工作窗口读取;未配置时工具报错降级,不挡启动)
+// dsh-calendar 宿主插件(CalDAV 工作窗口读取)——D-9 拍板(issue #106):默认不挂载。
+// 未配置的日历工具是纯负资产(会话中段才撞「未配置 username」报错),gotry 对它的
+// 唯一诉求(工作窗口)由访谈首轮覆盖。挂载与否由 **setup 状态面**决定(founder
+// 2026-09-03 纠偏:禁止环境变量控制产品行为;可选依赖进 setup 状态管理,与扩展
+// manifest 同居 ~/.gotry)——`npx @danceiny/gotry setup calendar` 写 ~/.gotry/calendar.json,
+// `--off` 删除恢复默认;doctor 报告三态。
+let calEnabled = false
+try {
+  calEnabled = JSON.parse(readFileSync(join(homedir(), '.gotry', 'calendar.json'), 'utf-8'))?.enabled === true
+} catch { /* 缺文件/坏文件 = 默认不挂载 */ }
 let calEntry = ''
-const vendoredCal = join(repoRoot, 'ts/dsh-runtime/node_modules/dsh-calendar/lib/index.js')
-if (existsSync(vendoredCal)) {
-  calEntry = vendoredCal
-} else {
-  try { calEntry = require_.resolve('dsh-calendar/lib/index.js') } catch { calEntry = '' }
-  if (!calEntry) { try { calEntry = require_.resolve('dsh-calendar') } catch { calEntry = '' } }
+if (!benchmarkEnvironmentConfig) {
+  const vendoredCal = join(repoRoot, 'ts/dsh-runtime/node_modules/dsh-calendar/lib/index.js')
+  if (existsSync(vendoredCal)) {
+    calEntry = vendoredCal
+  } else {
+    try { calEntry = require_.resolve('dsh-calendar/lib/index.js') } catch { calEntry = '' }
+    if (!calEntry) { try { calEntry = require_.resolve('dsh-calendar') } catch { calEntry = '' } }
+  }
 }
-if (calEntry) {
+if (calEntry && calEnabled) {
   patchRaw = patchRaw.replace(/(name:\s*)'placeholder\/dsh-calendar'/, `$1'${calEntry}'`)
 } else {
   patchRaw = patchRaw.replace(/\n\s*- id: dsh-calendar\n\s*name: 'placeholder\/dsh-calendar'\n/, '\n')
 }
-const patchPath = join(tmpdir(), `cordis.gotry.${process.pid}.yml`)
-writeFileSync(patchPath, patchRaw)
-if (!process.env.DEEPSEEK_API_KEY && mode !== 'help') {
-  console.error('[gotry] 缺少 LLM API key —— 两种方式任选其一后重跑:')
-  console.error(`  1) 在当前目录创建 .env 写入一行: LLM_API_KEY=<你的 DeepSeek key>(key 从 https://platform.deepseek.com 获取)`)
-  console.error('  2) 或临时环境变量: export LLM_API_KEY=<key>')
-  process.exit(1)
+
+// LLM_MODEL 指定模型(issue #77)②:composition 层 by-id 覆盖。cordis patch 语义
+// (dsh-app-boot applyEntryPatches):非 insert 的 {id, ...overrides} 对目标条目做浅层
+// 键赋值,config 整体替换;id 不存在只 warn+skip 不崩(上游改名时优雅退化)。
+// 两条目标在 headless/web profile 均有(dsh-base 声明 llm-deepseek、两 profile 均声明
+// agent-default-model)。llm-deepseek 目录整体替换为单条目:显式指定模型的场景多为
+// 中转/兼容端点,默认 v4-* 目录对其是误导;不硬编码上游 DEFAULT_MODELS 防漂移。
+let llmMaxTokens
+if (process.env.GOTRY_LLM_MODEL) {
+  const rawMax = process.env.LLM_MAX_TOKENS
+  if (rawMax !== undefined && rawMax !== '') {
+    llmMaxTokens = Number.parseInt(rawMax, 10)
+    if (!Number.isSafeInteger(llmMaxTokens) || llmMaxTokens <= 0) {
+      throw new Error(`invalid LLM_MAX_TOKENS: ${JSON.stringify(rawMax)} (expected a positive safe integer)`)
+    }
+  }
+  const modelYaml = `'${process.env.GOTRY_LLM_MODEL.replace(/'/g, "''")}'`
+  // LLM_MAX_TOKENS(Round 9,#100/#102):中转/兼容端点模型常带低于 dsh 未知模型
+  // 默认 256K 预算的输出上限(MiniMax 2013 实测);目录条目 maxTokens 元数据是
+  // dsh-llm-deepseek defaultMaxTokens 的官方通道(web UI 模型同源)。
+  const maxTokensYaml = llmMaxTokens === undefined ? '' : `\n        maxTokens: ${llmMaxTokens}`
+  patchRaw += `\n# LLM_MODEL 指定模型(issue #77):dsh 会话面默认模型 + 模型目录\n- id: agent-default-model\n  config:\n    provider: deepseek-official\n    model: ${modelYaml}\n- id: llm-deepseek\n  config:\n    models:\n      - id: ${modelYaml}\n        name: ${modelYaml}${maxTokensYaml}\n`
+}
+// Keep the patch private and short-lived. mkdtempSync creates a 0700 directory;
+// wx prevents accidental reuse/races if a process is started concurrently.
+const patchDir = mkdtempSync(join(tmpdir(), 'gotry-cordis-'))
+const patchPath = join(patchDir, 'patch.yml')
+writeFileSync(patchPath, patchRaw, { mode: 0o600, flag: 'wx' })
+let patchCleaned = false
+const cleanupPatch = () => {
+  if (patchCleaned) return
+  patchCleaned = true
+  rmSync(patchDir, { recursive: true, force: true })
+}
+process.once('exit', cleanupPatch)
+// 信号转发(issue #267 P1):spawnSync 阻塞 JS,信号处理器无法服务、finally 也跑不到。
+// 故 web-onboarding 子调用改 awaited spawn。SIGINT/SIGTERM 转发在 onboarding **之前**注册一次,
+// 并贯穿后续 dsh web 子进程的整个生命周期——服务管理器只向父进程发 SIGTERM 时,无论当前活跃的是
+// onboarding 子进程组还是 dsh 子,都收到同一信号。收到信号时:终止当前活跃子进程/进程组,
+// 等待 bounded close/reap,清 patch + 私有 result 目录(均幂等),移除本监听器,再向自己重发信号恢复原生终止语义。
+// signalHandling 护栏防递归/重复处理(重发信号不再二次进入本回调)。setup/doctor 的 spawnSync 不在此窗口,保持不变。
+let child = null                  // dsh web 子进程(launchWeb 后)
+let childGroupPid = null          // POSIX dsh child process-group leader
+let onboardingChild = null        // onboarding 子进程(运行中时);POSIX 下独立进程组
+let onboardingChildGroupPid = null
+let onboardingResultDir = null    // 私有结果目录;信号/正常/错误路径都清
+// outer grace 必须大于 bootstrap installer cleanup budget(2s TERM + 1s SIGKILL wait)。
+// 否则 stubborn installer 忽略 TERM 时,inner 可能先杀 bootstrap,导致 bootstrap 来不及 SIGKILL
+// 它自己 detached 出去的 installer 进程组。
+const ONBOARDING_TERM_GRACE_MS = 5_000
+const ONBOARDING_KILL_WAIT_MS = 1_000
+const cleanupOnboardingResult = () => {
+  if (!onboardingResultDir) return
+  const d = onboardingResultDir
+  onboardingResultDir = null
+  try { rmSync(d, { recursive: true, force: true }) } catch { /* ignore */ }
+}
+const onboardingChildTimeoutMs = (() => {
+  const raw = process.env.GOTRY_ONBOARDING_CHILD_TIMEOUT_MS
+  if (raw === undefined || raw === '') return 300_000
+  if (!/^[1-9]\d*$/.test(raw)) return 300_000
+  const n = Number(raw)
+  return Number.isSafeInteger(n) && n > 0 ? n : 300_000
+})()
+let signalHandling = false
+const signalListeners = new Map()
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
+const signalChild = (proc, sig, groupPid = null) => {
+  if (!proc) return
+  if (process.platform !== 'win32' && groupPid) {
+    try { process.kill(-groupPid, sig); return } catch { /* fallback */ }
+  }
+  try { proc.kill(sig) } catch { /* ignore */ }
+}
+const terminateChildBounded = async (proc, sig, groupPid = null, graceMs = ONBOARDING_TERM_GRACE_MS, killMs = ONBOARDING_KILL_WAIT_MS) => {
+  await terminateOwnedChild({ child: proc, groupPid, signal: sig, termGraceMs: graceMs, killWaitMs: killMs })
+}
+const registerSignalForwarding = () => {
+  if (signalListeners.size) return
+  for (const sig of ['SIGINT', 'SIGTERM']) {
+    const listener = () => {
+      if (signalHandling) return            // 防递归:重发信号不再二次进入
+      signalHandling = true
+      void (async () => {
+        const active = onboardingChild || child
+        const groupPid = onboardingChild ? onboardingChildGroupPid : childGroupPid
+        cleanupPatch()
+        cleanupOnboardingResult()
+        await terminateChildBounded(active, sig, groupPid)
+        for (const [s, l] of signalListeners) process.off(s, l)
+        signalListeners.clear()
+        process.kill(process.pid, sig)       // 移除监听器后重发 → 原生终止语义
+        await sleep(2_000)
+        process.exit(128 + (sig === 'SIGINT' ? 2 : 15))
+      })()
+    }
+    process.on(sig, listener)
+    signalListeners.set(sig, listener)
+  }
 }
 
-// --- 调 vendored dsh 二进制(不走 npx)---
-// headless: 第一个非 -- 之后的参数是 task —— gotry argv 0 是 headless 触发,其余都算 task;
+const unregisterSignalForwarding = () => {
+  for (const [s, l] of signalListeners) process.off(s, l)
+  signalListeners.clear()
+}
+// LLM key 由 dsh 宿主管理(凭证是用户资产,UI 在 dsh 里;gotry 不拦截启动期,
+// 不在用户面前展示任何 key 配置引导),此处直接放手 spawn dsh。
+const webPortArgs = (() => {
+  if (mode !== 'web') return []
+  const portIndex = rest.indexOf('--port')
+  const port = portIndex >= 0 ? rest[portIndex + 1] : undefined
+  return port !== undefined && /^(?:0|[1-9]\d*)$/.test(port) ? ['--port', port] : []
+})()
 const binJs = mode === 'web'
-  ? ['web', '--patch', patchPath, ...(process.argv.includes('--no-open') ? ['--no-open'] : [])]
+  ? ['web', '--patch', patchPath, ...(process.argv.includes('--no-open') ? ['--no-open'] : []), ...webPortArgs]
   : ['--profile', 'headless', '--patch', patchPath, ...rest]
 
-const child = spawn(process.execPath, [dshBin, ...binJs], {
-  stdio: 'inherit',
+const childEnv = { ...process.env }
+// The benchmark config is parent-only metadata. Never make its path visible to
+// dsh or any plugin loaded by the child.
+delete childEnv.GOTRY_BENCHMARK_ENV_CONFIG
+if (benchmarkEnvironmentConfig) {
+  for (const key of [
+    'GOTRY_BENCHMARK_BRIDGE_PARENT_SECRET',
+    'DATABASE_URL',
+    'SSH_AUTH_SOCK',
+    'AWS_PROFILE',
+    'HTTPS_PROXY',
+  ]) delete childEnv[key]
+}
+const benchmarkStdout = benchmarkEnvironmentConfig ? [] : null
+if (benchmarkEnvironmentConfig) childEnv.GOTRY_BENCHMARK_DIAGNOSTIC_FD = '3'
+const childStdio = mode === 'web'
+  ? 'inherit'
+  : benchmarkStdout
+    ? ['pipe', 'pipe', 'pipe', 'pipe']
+    : process.stdin.isTTY
+      ? 'inherit'
+      : ['pipe', 'inherit', 'inherit']
+let benchmarkCapturedBytes = 0
+let benchmarkDiagnosticBuffer = Buffer.alloc(0)
+let benchmarkOutputTruncated = false
+// issue #258:`gotry web` 启动前的交互式 onboarding——每次符合条件的启动评估一次、至多问一次,
+// 无跨启动持久确认(每次 web 启动独立判定;不写「已问过」标记)。仅交互式 TTY + 有可自动安装
+// 缺项时问一次;y 复用 doctor --fix 幂等安装器,不建第二套;n 立即继续 web)。
+// CI/benchmark/非 TTY/全健康/GOTRY_SETUP_SKIP=1/GOTRY_ONBOARDING_SKIP=1/--no-onboarding
+// 均零 prompt 零安装,仍启 web;永不 postinstall 或后台任务里安装。无 auto 但有需用户操作/
+// 不可用缺项时(如 win32 平台不支持自动安装),onboarding 渲染分类计划与原因、不 prompt 不安装,
+// 标记 reported;orchestrateWebLaunch 据此抑制重复的 detached doctor 摘要(design §3.1③,#114)。
+// 编排走 orchestrateWebLaunch(显式注入依赖的 E2E 边界缝,bootstrap-tests 跨边界单测同款):
+// bootstrap 以 `onboarding --result-file=…` 异步 inherit 跑(awaited spawn,POSIX 下独立进程组——
+// 使 JS 能服务 SIGINT/SIGTERM 并在信号路径清 patch+result 目录、reap installer 子树);result JSON 告知是否 prompt /
+// reported,用以抑制重复的启动摘要行。yes/no/失败/跳过/已 reported 均继续到 launchWeb(spawn dsh web)。
+const onboardingSkip = onboardingSkipReason({
+  mode,
+  benchmark: Boolean(benchmarkEnvironmentConfig),
   env: process.env,
-  cwd: dshCwd,
+  argv: process.argv,
+  isTTY: process.stdin.isTTY,
 })
+// 一次性注册信号转发,覆盖 onboarding + dsh child 全生命周期(dsh close/error 时注销)。
+registerSignalForwarding()
+await orchestrateWebLaunch({
+  onboardingSkip,
+  runOnboarding: async () => {
+    // result 通道硬化:不在 os.tmpdir 下放可预测文件名——mkdtempSync 建 0700 私有目录,
+    // result.json 放其内;bootstrap 以 mode 0600 + flag wx 写(存在路径/符号链接永不覆盖,
+    // 防 symlink 互换攻击)。子调用改 awaited spawn(非 spawnSync)使 JS 能服务信号;
+    // 信号/正常/错误路径都清目录(幂等),详见上方 registerSignalForwarding/cleanupOnboardingResult。
+    let resultDir = null
+    try {
+      resultDir = mkdtempSync(join(tmpdir(), 'gotry-onboarding-'))
+      onboardingResultDir = resultDir
+      const resultFile = join(resultDir, 'result.json')
+      // 信号转发在 onboarding 之前注册一次,贯穿后续 dsh web 整个生命周期(见上方 registerSignalForwarding);
+      // onboarding 正常结束后不注销——服务管理器只向父进程发信号时,当前活跃子进程(onboarding 或 dsh)均收到。
+      registerSignalForwarding()
+      const detachedOnboarding = process.platform !== 'win32'
+      const oc = spawn(process.execPath, [join(here, 'gotry-bootstrap.js'), 'onboarding', `--result-file=${resultFile}`], {
+        stdio: 'inherit',
+        detached: detachedOnboarding,
+      })
+      onboardingChild = oc
+      onboardingChildGroupPid = detachedOnboarding ? oc.pid : null
+      // onboarding 永不挡 web:保留 spawnSync 原有的 300s 上限(可经 GOTRY_ONBOARDING_CHILD_TIMEOUT_MS 注入以供
+      // 确定性测试,生产默认 300_000)。超时即 SIGTERM(2s 后 SIGKILL 兜底),settle 恰好一次于 close/error/timeout;
+      // 之后继续 web(prompted:false),不留进程/目录(finally 清 result,信号路径清 patch+result)。
+      await new Promise((resolve) => {
+        let done = false
+        let killTimer = null
+        const timer = setTimeout(() => {
+          process.stderr.write(`[gotry] onboarding child timeout after ${onboardingChildTimeoutMs}ms; continuing to web\n`)
+          signalChild(oc, 'SIGTERM', onboardingChildGroupPid)
+          killTimer = setTimeout(() => { if (!done) signalChild(oc, 'SIGKILL', onboardingChildGroupPid) }, ONBOARDING_TERM_GRACE_MS)
+        }, onboardingChildTimeoutMs)
+        const finish = () => { if (done) return; done = true; clearTimeout(timer); if (killTimer) clearTimeout(killTimer); resolve() }
+        oc.once('close', finish)
+        oc.once('error', (error) => {
+          process.stderr.write(`[gotry] onboarding child spawn failed: ${error.code || error.name || 'error'}; continuing to web\n`)
+          finish()
+        })
+      })
+      if (signalHandling) await new Promise(() => {})
+      onboardingChild = null
+      onboardingChildGroupPid = null
+      if (existsSync(resultFile)) {
+        try { return JSON.parse(readFileSync(resultFile, 'utf-8')) }
+        catch { return { prompted: false } }
+      }
+      return { prompted: false }
+    } catch {
+      process.stderr.write('[gotry] onboarding setup failed; continuing to web\n')
+      return { prompted: false }
+    } finally {
+      onboardingChild = null
+      onboardingChildGroupPid = null
+      if (resultDir) { try { rmSync(resultDir, { recursive: true, force: true }) } catch { /* ignore */ } }
+      onboardingResultDir = null
+    }
+  },
+  // 启动一次性 doctor 摘要(issue #114,design §3.1③):分离子进程后台跑只读体检,
+  // 有待处理项打一行 stderr(stderr 继承,不污染 stdout;benchmark 面保持零杂音)。
+  // onboarding 已 prompt 时 orchestrateWebLaunch 已抑制本回调(不重复)。
+  runSummary: () => {
+    if (benchmarkEnvironmentConfig) return
+    try {
+      spawn(process.execPath, [join(here, 'gotry-bootstrap.js'), 'doctor', '--summary'], {
+        detached: true,
+        stdio: ['ignore', 'ignore', 'inherit'],
+      }).unref()
+    } catch { /* 体检不可用不挡启动 */ }
+  },
+  // dsh web 启动边界:launchWeb 即 inner 跨过 onboarding 后到达的 web 启动标记。
+  launchWeb: async () => {
+    const owned = spawnOwnedChild(process.execPath, [dshBin, ...binJs], {
+      stdio: childStdio,
+      env: childEnv,
+      cwd: dshCwd,
+    })
+    child = owned.child
+    childGroupPid = owned.groupPid
+  },
+})
+if (benchmarkStdout) {
+  const maxBytes = Math.max(1, Number(benchmarkTerminalConfig?.max_bytes ?? 1))
+  child.stdout?.on('data', chunk => {
+    if (benchmarkCapturedBytes + Buffer.byteLength(chunk) > maxBytes) benchmarkOutputTruncated = true
+    if (benchmarkCapturedBytes < maxBytes) {
+      const bytes = Buffer.from(chunk)
+      benchmarkStdout.push(bytes.subarray(0, Math.max(0, maxBytes - benchmarkCapturedBytes)))
+      benchmarkCapturedBytes += Math.min(bytes.length, maxBytes - benchmarkCapturedBytes)
+    }
+  })
+  child.stderr?.resume()
+  child.stdio?.[3]?.on('data', chunk => {
+    benchmarkDiagnosticBuffer = benchmarkChildDiagnostics.appendBoundedChildDiagnostic(
+      benchmarkDiagnosticBuffer,
+      Buffer.from(chunk),
+    )
+  })
+}
 if (process.env.GOTRY_DEBUG) {
-  console.error('[gotry-debug] exec:', process.execPath, dshBin)
-  console.error('[gotry-debug] argv:', binJs)
-  console.error('[gotry-debug] cwd:', dshCwd)
-  console.error('[gotry-debug] patch exists:', existsSync(patchPath), patchPath)
+  if (benchmarkEnvironmentConfig) {
+    console.error('[gotry-debug] benchmark headless child configured(details redacted)')
+  } else {
+    console.error('[gotry-debug] exec:', process.execPath, dshBin)
+    console.error('[gotry-debug] argv:', binJs)
+    console.error('[gotry-debug] cwd:', dshCwd)
+    console.error('[gotry-debug] patch exists:', existsSync(patchPath), patchPath)
+  }
+}
+let benchmarkFailureReported = false
+const reportBenchmarkFailure = reason => {
+  if (benchmarkFailureReported) return
+  benchmarkFailureReported = true
+  process.exitCode = 1
+  process.stderr.write(`[gotry] benchmark terminal output unavailable (${reason})\n`)
+}
+
+let childLifecycleHandled = false
+let childCleanupPromise = null
+// `close` may be delayed by a descendant which inherited dsh's stdio pipe.
+// Always start bounded TERM→KILL cleanup from `exit` so the owned group is
+// reaped before any close/parser wait. The benchmark zero-success close path
+// still parses the already-captured stdout buffer unchanged; cleanup runs
+// fire-and-forget in the background and stays bounded by ONBOARDING bounds.
+const startChildCleanup = () => {
+  if (childCleanupPromise || !child) return childCleanupPromise
+  childCleanupPromise = terminateOwnedChild({
+    child,
+    groupPid: childGroupPid,
+    signal: 'SIGTERM',
+    termGraceMs: ONBOARDING_TERM_GRACE_MS,
+    killWaitMs: ONBOARDING_KILL_WAIT_MS,
+  })
+  return childCleanupPromise
 }
 child.on('exit', (code, signal) => {
+  void startChildCleanup()
+})
+child.on('close', async (code, signal) => {
+  if (childLifecycleHandled) return
+  childLifecycleHandled = true
+  cleanupPatch()
+  if (signalHandling) return
+  unregisterSignalForwarding()
+  // Non-benchmark web/headless children are owned through both normal and
+  // anomalous exits. The promise was normally started by `exit`; retaining
+  // this close fallback covers runtimes that report close without exit.
+  if (!benchmarkStdout || code !== 0 || signal) await startChildCleanup()
+  if (benchmarkStdout) {
+    const captured = Buffer.concat(benchmarkStdout).toString('utf8')
+    if (code !== 0 || signal || benchmarkOutputTruncated) {
+      const reason = benchmarkChildDiagnostics.classifyBenchmarkChildFailure({
+        code,
+        signal,
+        diagnostic: benchmarkDiagnosticBuffer.toString('utf8'),
+        outputTruncated: benchmarkOutputTruncated,
+      })
+      reportBenchmarkFailure(reason)
+      return
+    }
+    const parserModule = distModuleMode && existsSync(join(repoRoot, 'dist/src/benchmark-agent-conformance.js'))
+      ? join(repoRoot, 'dist/src/benchmark-agent-conformance.js')
+      : join(repoRoot, 'ts/src/benchmark-agent-conformance.ts')
+    import(pathToFileURL(parserModule).href).then(async ({ parseBenchmarkTerminal }) => {
+      const parsed = parseBenchmarkTerminal(captured, benchmarkTerminalConfig)
+      if (!parsed || parsed.ok !== true) {
+        reportBenchmarkFailure('child_terminal_invalid')
+        return
+      }
+      await new Promise((resolve, reject) => {
+        const onError = error => {
+          process.stdout.off('error', onError)
+          reject(error)
+        }
+        process.stdout.once('error', onError)
+        process.stdout.write(captured, () => {
+          process.stdout.off('error', onError)
+          resolve()
+        })
+      })
+      process.exitCode = 0
+    }).catch(() => {
+      reportBenchmarkFailure('child_lifecycle_failure')
+    })
+    return
+  }
   if (code !== 0 || signal) {
     // D-NEW 护栏:dsh 异常退出也写一条 incident,留现场而非沉默
-    // npm 模式 import dist JS(node_modules 下的 .ts 会被 Node 拒 strip)
-    const incidentModule = npmMode && existsSync(join(repoRoot, 'dist/capabilities/incident-log.js'))
-      ? '../dist/capabilities/incident-log.js'
-      : '../ts/capabilities/incident-log.ts'
-    import(incidentModule).then(({ recordIncident }) => {
+    // dist 模式 import JS(node_modules 下的 .ts 会被 Node 拒 strip)
+    const incidentModule = distModuleMode && existsSync(join(repoRoot, 'dist/capabilities/incident-log.js'))
+      ? join(repoRoot, 'dist/capabilities/incident-log.js')
+      : join(repoRoot, 'ts/capabilities/incident-log.ts')
+    try {
+      const { recordIncident } = await import(pathToFileURL(incidentModule).href)
       recordIncident({
         ts: new Date().toISOString(),
         kind: 'plugin_error',
         message: `gotry spawn exit: ${mode} code=${code} signal=${signal}`,
         source: 'gotry-cli',
-      }, repoRoot).catch(() => {})
-    }).catch(() => {}) // module 找不到时静默
+      }, repoRoot)
+    } catch { /* diagnostics remain best-effort; fatal exit is preserved */ }
+  }
+  if (signal) {
+    try { process.kill(process.pid, signal) } catch { process.exit(1) }
+    return
   }
   process.exit(code ?? 1)
 })
-child.on('error', (e) => {
+child.on('error', async (e) => {
+  if (childLifecycleHandled) return
+  childLifecycleHandled = true
+  cleanupPatch()
+  if (signalHandling) return
+  unregisterSignalForwarding()
+  await startChildCleanup()
+  try {
+    const incidentModule = distModuleMode && existsSync(join(repoRoot, 'dist/capabilities/incident-log.js'))
+      ? join(repoRoot, 'dist/capabilities/incident-log.js')
+      : join(repoRoot, 'ts/capabilities/incident-log.ts')
+    const { recordIncident } = await import(pathToFileURL(incidentModule).href)
+    recordIncident({
+      ts: new Date().toISOString(),
+      kind: 'plugin_error',
+      message: `gotry spawn error: ${e instanceof Error ? e.message : String(e)}`,
+      source: 'gotry-cli',
+    }, repoRoot)
+  } catch { /* diagnostics remain best-effort; fatal exit is preserved */ }
+  if (benchmarkEnvironmentConfig) {
+    reportBenchmarkFailure('child_spawn_failure')
+    return
+  }
   console.error(`[gotry] dsh 启动失败: ${e.message}`)
-  console.error('尝试: node -v 看 Node 版本(需 22+),或查看 ts/dsh-runtime/node_modules/。')
+  console.error('尝试: node -v 看 Node 版本(需 22.15+),或查看 ts/dsh-runtime/node_modules/。')
   process.exit(1)
 })