@harness-mix/cli 0.1.3

package/src/main/native/redact.js

@@ -0,0 +1,35 @@
+// Best-effort redaction for log lines and diagnostics bundles. Pattern based and
+// deliberately conservative: false positives are acceptable, leaks are not.
+const PATTERNS = [
+  /bearer\s+[A-Za-z0-9._~+/=-]{8,}/gi,
+  /sk-[A-Za-z0-9_-]{10,}/g,
+  /ghp_[A-Za-z0-9]{20,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /xox[abpsr]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, // JWT
+];
+const SECRET_KEY = /(token|secret|password|passwd|api[_-]?key|authorization|credential|cookie)/i;
+const REDACTED = '[redacted]';
+
+function redactText(value) {
+  if (typeof value !== 'string') return value;
+  let out = value;
+  for (const pattern of PATTERNS) out = out.replace(pattern, REDACTED);
+  return out;
+}
+
+// Deep-walks plain objects/arrays. Keys that look secret are replaced wholesale.
+function redact(value, depth = 0) {
+  if (depth > 8) return REDACTED;
+  if (typeof value === 'string') return redactText(value);
+  if (Array.isArray(value)) return value.map(item => redact(item, depth + 1));
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+      key,
+      SECRET_KEY.test(key) ? REDACTED : redact(item, depth + 1),
+    ]));
+  }
+  return value;
+}
+
+module.exports = { redact, redactText };

package/src/main/native/rs/Cargo.lock

@@ -0,0 +1,15 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "harness-mix-appx"
+version = "0.2.0"
+
+[[package]]
+name = "harness-mix-secret"
+version = "0.1.0"
+
+[[package]]
+name = "harness-mix-shim"
+version = "0.2.0"

package/src/main/native/rs/Cargo.toml

@@ -0,0 +1,9 @@
+[workspace]
+members = ["crates/shim", "crates/appx", "crates/secret"]
+resolver = "2"
+
+[profile.release]
+opt-level = 2
+lto = true
+codegen-units = 1
+strip = true

package/src/main/native/rs/crates/appx/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "harness-mix-appx"
+version = "0.2.0"
+edition = "2021"
+description = "Harness Mix Windows AppX activation boundary (IApplicationActivationManager / IPackageDebugSettings)"
+license = "Apache-2.0"
+
+[[bin]]
+name = "harness-mix-appx"
+path = "src/main.rs"
+
+# Zero external dependencies: COM and kernel32 are declared by hand so the build
+# needs nothing beyond a stock Rust toolchain (no dlltool, no crates.io fetch).

package/src/main/native/rs/crates/appx/src/main.rs

@@ -0,0 +1,309 @@
+// Windows activation boundary. Rust port of appx.cs: identical COM contract.
+// See Microsoft IApplicationActivationManager and IPackageDebugSettings.
+// The temporary debugging environment is removed before exit on every path.
+//
+// Dependency-free on purpose: only ole32/kernel32 imports from Rust's bundled
+// self-contained libraries, so any stock Rust toolchain can build this crate.
+#![cfg(windows)]
+#![allow(non_snake_case)]
+
+use std::env;
+use std::ffi::c_void;
+use std::process::ExitCode;
+
+type Hresult = i32;
+type Handle = *mut c_void;
+type WidePtr = *const u16;
+
+const S_OK_MIN: Hresult = 0;
+const COINIT_APARTMENTTHREADED: u32 = 0x2;
+const CLSCTX_ALL: u32 = 0x17;
+const THREAD_SUSPEND_RESUME: u32 = 0x0002;
+const THREAD_QUERY_INFORMATION: u32 = 0x0800;
+const ACTIVATEOPTIONS_VALUE: u32 = 2; // same ACTIVATEOPTIONS value as the C# build
+
+#[repr(C)]
+struct Guid {
+    data1: u32,
+    data2: u16,
+    data3: u16,
+    data4: [u8; 8],
+}
+
+// B1AEC16F-2383-4852-B0E9-8F0B1DC66B4D
+const CLSID_PACKAGE_DEBUG_SETTINGS: Guid = Guid {
+    data1: 0xB1AEC16F,
+    data2: 0x2383,
+    data3: 0x4852,
+    data4: [0xB0, 0xE9, 0x8F, 0x0B, 0x1D, 0xC6, 0x6B, 0x4D],
+};
+// 45BA127D-10A8-46EA-8AB7-56EA9078943C
+const CLSID_APPLICATION_ACTIVATION_MANAGER: Guid = Guid {
+    data1: 0x45BA127D,
+    data2: 0x10A8,
+    data3: 0x46EA,
+    data4: [0x8A, 0xB7, 0x56, 0xEA, 0x90, 0x78, 0x94, 0x3C],
+};
+// F27C3930-8029-4AD1-94E3-3DBA417810C1
+const IID_PACKAGE_DEBUG_SETTINGS: Guid = Guid {
+    data1: 0xF27C3930,
+    data2: 0x8029,
+    data3: 0x4AD1,
+    data4: [0x94, 0xE3, 0x3D, 0xBA, 0x41, 0x78, 0x10, 0xC1],
+};
+// 2E941141-7F97-4756-BA1D-9DECDE894A3D
+const IID_APPLICATION_ACTIVATION_MANAGER: Guid = Guid {
+    data1: 0x2E941141,
+    data2: 0x7F97,
+    data3: 0x4756,
+    data4: [0xBA, 0x1D, 0x9D, 0xEC, 0xDE, 0x89, 0x4A, 0x3D],
+};
+
+type QueryInterface = unsafe extern "system" fn(*mut c_void, *const Guid, *mut *mut c_void) -> Hresult;
+type AddRef = unsafe extern "system" fn(*mut c_void) -> u32;
+type Release = unsafe extern "system" fn(*mut c_void) -> u32;
+type EnableDebugging =
+    unsafe extern "system" fn(*mut c_void, WidePtr, WidePtr, WidePtr) -> Hresult;
+type DisableDebugging = unsafe extern "system" fn(*mut c_void, WidePtr) -> Hresult;
+type ActivateApplication =
+    unsafe extern "system" fn(*mut c_void, WidePtr, WidePtr, u32, *mut u32) -> Hresult;
+
+#[repr(C)]
+struct PackageDebugSettingsVtbl {
+    query_interface: QueryInterface,
+    add_ref: AddRef,
+    release: Release,
+    enable_debugging: EnableDebugging,
+    disable_debugging: DisableDebugging,
+}
+
+#[repr(C)]
+struct ApplicationActivationManagerVtbl {
+    query_interface: QueryInterface,
+    add_ref: AddRef,
+    release: Release,
+    activate_application: ActivateApplication,
+}
+
+#[repr(C)]
+struct ComObject {
+    vtbl: *const c_void,
+}
+
+struct DebugSettings(*mut c_void);
+impl DebugSettings {
+    fn vtbl(&self) -> &PackageDebugSettingsVtbl {
+        unsafe { &*((*(self.0 as *const ComObject)).vtbl as *const PackageDebugSettingsVtbl) }
+    }
+    fn disable(&self, package: WidePtr) {
+        let _ = unsafe { (self.vtbl().disable_debugging)(self.0, package) };
+    }
+}
+impl Drop for DebugSettings {
+    fn drop(&mut self) {
+        unsafe { (self.vtbl().release)(self.0) };
+    }
+}
+
+struct ActivationManager(*mut c_void);
+impl ActivationManager {
+    fn vtbl(&self) -> &ApplicationActivationManagerVtbl {
+        unsafe { &*((*(self.0 as *const ComObject)).vtbl as *const ApplicationActivationManagerVtbl) }
+    }
+}
+impl Drop for ActivationManager {
+    fn drop(&mut self) {
+        unsafe { (self.vtbl().release)(self.0) };
+    }
+}
+
+#[link(name = "ole32")]
+extern "system" {
+    fn CoInitializeEx(reserved: *mut c_void, coinit: u32) -> Hresult;
+    fn CoUninitialize();
+    fn CoCreateInstance(
+        clsid: *const Guid,
+        outer: *mut c_void,
+        clsctx: u32,
+        iid: *const Guid,
+        out: *mut *mut c_void,
+    ) -> Hresult;
+}
+
+#[link(name = "kernel32")]
+extern "system" {
+    fn OpenThread(access: u32, inherit: i32, thread_id: u32) -> Handle;
+    fn ResumeThread(thread: Handle) -> u32;
+    fn GetProcessIdOfThread(thread: Handle) -> u32;
+    fn CloseHandle(handle: Handle) -> i32;
+}
+
+fn check(hr: Hresult, what: &str) -> Result<(), String> {
+    if hr >= S_OK_MIN {
+        Ok(())
+    } else {
+        Err(format!("{what} failed (HRESULT 0x{hr:08X})"))
+    }
+}
+
+fn wide(value: &str) -> Vec<u16> {
+    value.encode_utf16().chain(std::iter::once(0)).collect()
+}
+
+fn base64_value(byte: u8) -> Result<u32, String> {
+    match byte {
+        b'A'..=b'Z' => Ok((byte - b'A') as u32),
+        b'a'..=b'z' => Ok((byte - b'a' + 26) as u32),
+        b'0'..=b'9' => Ok((byte - b'0' + 52) as u32),
+        b'+' | b'-' => Ok(62),
+        b'/' | b'_' => Ok(63),
+        _ => Err(format!("Invalid base64 byte 0x{byte:02X}")),
+    }
+}
+
+fn base64_decode(input: &str) -> Result<Vec<u8>, String> {
+    let mut out = Vec::with_capacity(input.len() * 3 / 4);
+    let mut acc: u32 = 0;
+    let mut bits: u32 = 0;
+    for &byte in input.as_bytes() {
+        if byte == b'=' || byte == b'\r' || byte == b'\n' || byte == b' ' {
+            continue;
+        }
+        acc = (acc << 6) | base64_value(byte)?;
+        bits += 6;
+        if bits >= 8 {
+            bits -= 8;
+            out.push((acc >> bits) as u8);
+        }
+    }
+    Ok(out)
+}
+
+fn resume_thread(args: &[String]) -> Result<(), String> {
+    let tid = args
+        .windows(2)
+        .find(|pair| pair[0] == "-tid")
+        .and_then(|pair| pair[1].parse::<u32>().ok())
+        .ok_or_else(|| "Missing AppX process/thread identity".to_string())?;
+    let pid = args
+        .windows(2)
+        .find(|pair| pair[0] == "-p")
+        .and_then(|pair| pair[1].parse::<u32>().ok())
+        .ok_or_else(|| "Missing AppX process/thread identity".to_string())?;
+    unsafe {
+        let thread = OpenThread(THREAD_SUSPEND_RESUME | THREAD_QUERY_INFORMATION, 0, tid);
+        if thread.is_null() {
+            return Err("Cannot open AppX thread".to_string());
+        }
+        let result = (|| {
+            if GetProcessIdOfThread(thread) != pid {
+                return Err("AppX thread ownership mismatch".to_string());
+            }
+            if ResumeThread(thread) == u32::MAX {
+                return Err("Cannot resume AppX thread".to_string());
+            }
+            Ok(())
+        })();
+        CloseHandle(thread);
+        result
+    }
+}
+
+fn co_create(clsid: &Guid, iid: &Guid) -> Result<*mut c_void, String> {
+    let mut object: *mut c_void = std::ptr::null_mut();
+    let hr = unsafe { CoCreateInstance(clsid, std::ptr::null_mut(), CLSCTX_ALL, iid, &mut object) };
+    check(hr, "CoCreateInstance")?;
+    if object.is_null() {
+        return Err("CoCreateInstance returned no object".to_string());
+    }
+    Ok(object)
+}
+
+fn activate(args: &[String]) -> Result<u32, String> {
+    if args.len() != 4 {
+        return Err("Expected package, app ID, environment block and launch arguments".to_string());
+    }
+    let package = wide(&args[0]);
+    let app_id = wide(&args[1]);
+    let arguments = wide(&args[3]);
+    // The launcher encodes the environment block as base64(utf16le double-null block).
+    let raw = base64_decode(&args[2])?;
+    let mut environment: Vec<u16> = raw
+        .chunks_exact(2)
+        .map(|pair| u16::from_le_bytes([pair[0], pair[1]]))
+        .collect();
+    if !matches!(environment.as_slice(), [.., 0, 0]) {
+        environment.push(0);
+        environment.push(0);
+    }
+
+    let hr = unsafe { CoInitializeEx(std::ptr::null_mut(), COINIT_APARTMENTTHREADED) };
+    check(hr, "CoInitializeEx")?;
+    let result = (|| {
+        let settings = DebugSettings(co_create(&CLSID_PACKAGE_DEBUG_SETTINGS, &IID_PACKAGE_DEBUG_SETTINGS)?);
+        let activation = ActivationManager(co_create(
+            &CLSID_APPLICATION_ACTIVATION_MANAGER,
+            &IID_APPLICATION_ACTIVATION_MANAGER,
+        )?);
+
+        // Clear stale debugging configuration first; the result is ignored, matching appx.cs.
+        settings.disable(package.as_ptr());
+        let current = env::current_exe().map_err(|e| e.to_string())?;
+        let debugger = wide(&format!("\"{}\" --resume", current.display()));
+        check(
+            unsafe {
+                ((settings.vtbl()).enable_debugging)(
+                    settings.0,
+                    package.as_ptr(),
+                    debugger.as_ptr(),
+                    environment.as_ptr(),
+                )
+            },
+            "EnableDebugging",
+        )?;
+        // Every path after EnableDebugging must restore DisableDebugging.
+        let activation_result = (|| {
+            let mut pid: u32 = 0;
+            check(
+                unsafe {
+                    ((activation.vtbl()).activate_application)(
+                        activation.0,
+                        app_id.as_ptr(),
+                        arguments.as_ptr(),
+                        ACTIVATEOPTIONS_VALUE,
+                        &mut pid,
+                    )
+                },
+                "ActivateApplication",
+            )?;
+            Ok(pid)
+        })();
+        settings.disable(package.as_ptr());
+        activation_result
+    })();
+    unsafe { CoUninitialize() };
+    result
+}
+
+fn main() -> ExitCode {
+    let args: Vec<String> = env::args().skip(1).collect();
+    if args.first().map(String::as_str) == Some("--resume") {
+        return match resume_thread(&args) {
+            Ok(()) => ExitCode::SUCCESS,
+            Err(message) => {
+                eprintln!("Harness Mix activation: {message}");
+                ExitCode::FAILURE
+            }
+        };
+    }
+    match activate(&args) {
+        Ok(pid) => {
+            println!("{pid}");
+            ExitCode::SUCCESS
+        }
+        Err(message) => {
+            eprintln!("Harness Mix activation: {message}");
+            ExitCode::FAILURE
+        }
+    }
+}

package/src/main/native/rs/crates/secret/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "harness-mix-secret"
+version = "0.1.0"
+edition = "2021"
+description = "Harness Mix platform secret store: per-user DPAPI vault"
+license = "Apache-2.0"
+
+[[bin]]
+name = "harness-mix-secret"
+path = "src/main.rs"

package/src/main/native/rs/crates/secret/src/main.rs

@@ -0,0 +1,262 @@
+//! Platform secret store for Harness Mix: per-user DPAPI vault with a minimal
+//! line-based file format. Zero external crates; raw crypt32/kernel32 FFI.
+//!
+//! Vault: <data>/secrets.dat
+//!   # harness-mix-secrets v1
+//!   <name> <base64(dpapi blob)>
+//!
+//! CLI: set <name> (value on stdin) | get <name> | delete <name> | list
+//! Exit codes: 0 ok, 1 error, 2 not found.
+#![cfg(windows)]
+
+use std::env;
+use std::ffi::c_void;
+use std::fs;
+use std::io::{self, Read, Write};
+use std::path::PathBuf;
+
+#[repr(C)]
+struct DataBlob {
+    cb_data: u32,
+    pb_data: *mut u8,
+}
+
+#[link(name = "crypt32")]
+extern "system" {
+    fn CryptProtectData(
+        data_in: *const DataBlob,
+        description: *const u16,
+        entropy: *const DataBlob,
+        reserved: *mut c_void,
+        prompt: *mut c_void,
+        flags: u32,
+        data_out: *mut DataBlob,
+    ) -> i32;
+    fn CryptUnprotectData(
+        data_in: *const DataBlob,
+        description: *mut *mut u16,
+        entropy: *const DataBlob,
+        reserved: *mut c_void,
+        prompt: *mut c_void,
+        flags: u32,
+        data_out: *mut DataBlob,
+    ) -> i32;
+}
+
+#[link(name = "kernel32")]
+extern "system" {
+    fn LocalFree(memory: *mut c_void) -> *mut c_void;
+}
+
+const CRYPTPROTECT_UI_FORBIDDEN: u32 = 0x1;
+const MARKER: &str = "# harness-mix-secrets v1";
+
+fn protect(plain: &[u8]) -> Result<Vec<u8>, String> {
+    transform(plain, true)
+}
+
+fn unprotect(blob: &[u8]) -> Result<Vec<u8>, String> {
+    transform(blob, false)
+}
+
+// DPAPI round-trip, current user scope. The description pointer stays null so
+// no extra allocation needs freeing on the unprotect path.
+fn transform(input: &[u8], encrypt: bool) -> Result<Vec<u8>, String> {
+    let data_in = DataBlob { cb_data: input.len() as u32, pb_data: input.as_ptr() as *mut u8 };
+    let mut data_out = DataBlob { cb_data: 0, pb_data: std::ptr::null_mut() };
+    let ok: i32 = unsafe {
+        if encrypt {
+            CryptProtectData(&data_in, std::ptr::null(), std::ptr::null(), std::ptr::null_mut(), std::ptr::null_mut(), CRYPTPROTECT_UI_FORBIDDEN, &mut data_out)
+        } else {
+            let mut description: *mut u16 = std::ptr::null_mut();
+            CryptUnprotectData(&data_in, &mut description, std::ptr::null(), std::ptr::null_mut(), std::ptr::null_mut(), CRYPTPROTECT_UI_FORBIDDEN, &mut data_out)
+        }
+    };
+    if ok == 0 {
+        return Err("DPAPI 调用失败（数据可能由其他用户加密）".to_string());
+    }
+    let bytes = unsafe { std::slice::from_raw_parts(data_out.pb_data, data_out.cb_data as usize).to_vec() };
+    unsafe { LocalFree(data_out.pb_data as *mut c_void) };
+    Ok(bytes)
+}
+
+const B64: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+fn base64_encode(data: &[u8]) -> String {
+    let mut out = String::with_capacity((data.len() + 2) / 3 * 4);
+    for chunk in data.chunks(3) {
+        let bytes = [chunk[0], *chunk.get(1).unwrap_or(&0), *chunk.get(2).unwrap_or(&0)];
+        let packed = ((bytes[0] as u32) << 16) | ((bytes[1] as u32) << 8) | bytes[2] as u32;
+        out.push(B64[(packed >> 18) as usize & 63] as char);
+        out.push(B64[(packed >> 12) as usize & 63] as char);
+        out.push(if chunk.len() > 1 { B64[(packed >> 6) as usize & 63] as char } else { '=' });
+        out.push(if chunk.len() > 2 { B64[packed as usize & 63] as char } else { '=' });
+    }
+    out
+}
+
+fn base64_value(byte: u8) -> Result<u32, String> {
+    match byte {
+        b'A'..=b'Z' => Ok((byte - b'A') as u32),
+        b'a'..=b'z' => Ok((byte - b'a' + 26) as u32),
+        b'0'..=b'9' => Ok((byte - b'0' + 52) as u32),
+        b'+' => Ok(62),
+        b'/' => Ok(63),
+        _ => Err(format!("无效 base64 字节 0x{byte:02X}")),
+    }
+}
+
+fn base64_decode(text: &str) -> Result<Vec<u8>, String> {
+    let mut out = Vec::with_capacity(text.len() * 3 / 4);
+    let mut acc: u32 = 0;
+    let mut bits: u32 = 0;
+    for &byte in text.as_bytes() {
+        if byte == b'=' {
+            continue;
+        }
+        acc = (acc << 6) | base64_value(byte)?;
+        bits += 6;
+        if bits >= 8 {
+            bits -= 8;
+            out.push((acc >> bits) as u8);
+        }
+    }
+    Ok(out)
+}
+
+fn data_dir() -> Result<PathBuf, String> {
+    if let Ok(dir) = env::var("CODEXHOST_DATA_DIR") {
+        if !dir.trim().is_empty() {
+            return Ok(PathBuf::from(dir));
+        }
+    }
+    match env::var("APPDATA") {
+        Ok(appdata) if !appdata.trim().is_empty() => Ok(PathBuf::from(appdata).join("harness-mix").join("codexhost")),
+        _ => Err("无法确定数据目录（缺少 APPDATA / CODEXHOST_DATA_DIR）".to_string()),
+    }
+}
+
+fn vault_path() -> Result<PathBuf, String> {
+    Ok(data_dir()?.join("secrets.dat"))
+}
+
+fn load_entries() -> Result<Vec<(String, Vec<u8>)>, String> {
+    let path = vault_path()?;
+    let text = match fs::read_to_string(&path) {
+        Ok(text) => text,
+        Err(_) => return Ok(Vec::new()),
+    };
+    let mut entries = Vec::new();
+    for raw in text.lines() {
+        let line = raw.trim();
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        let mut parts = line.splitn(2, ' ');
+        let name = parts.next().unwrap_or_default().trim().to_string();
+        let encoded = parts.next().unwrap_or_default().trim();
+        if name.is_empty() || encoded.is_empty() {
+            return Err(format!("损坏的保险箱条目：{line}"));
+        }
+        entries.push((name, base64_decode(encoded)?));
+    }
+    Ok(entries)
+}
+
+fn save_entries(entries: &[(String, Vec<u8>)]) -> Result<(), String> {
+    let path = vault_path()?;
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+    }
+    let mut text = String::from(MARKER);
+    text.push('\n');
+    for (name, blob) in entries {
+        text.push_str(name);
+        text.push(' ');
+        text.push_str(&base64_encode(blob));
+        text.push('\n');
+    }
+    let temp = path.with_extension("dat.tmp");
+    fs::write(&temp, text).map_err(|error| error.to_string())?;
+    fs::rename(&temp, &path).map_err(|error| error.to_string())?;
+    Ok(())
+}
+
+fn valid_name(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= 64
+        && name.bytes().all(|byte| byte.is_ascii_alphanumeric() || byte == b'.' || byte == b'_' || byte == b'-')
+}
+
+fn run() -> Result<i32, String> {
+    let args: Vec<String> = env::args().skip(1).collect();
+    match args.first().map(String::as_str) {
+        Some("set") => {
+            let name = args.get(1).ok_or_else(|| "用法：harness-mix-secret set <name>（值从 stdin 读入）".to_string())?;
+            if !valid_name(name) {
+                return Err("名称只允许 [A-Za-z0-9._-]{1,64}".to_string());
+            }
+            let mut value = Vec::new();
+            io::stdin().read_to_end(&mut value).map_err(|error| error.to_string())?;
+            if value.is_empty() {
+                return Err("拒绝写入空值".to_string());
+            }
+            let mut entries = load_entries()?;
+            let blob = protect(&value)?;
+            match entries.iter_mut().find(|(existing, _)| existing == name) {
+                Some(entry) => entry.1 = blob,
+                None => entries.push((name.to_string(), blob)),
+            }
+            save_entries(&entries)?;
+            Ok(0)
+        }
+        Some("get") => {
+            let name = args.get(1).ok_or_else(|| "用法：harness-mix-secret get <name>".to_string())?;
+            let entries = load_entries()?;
+            match entries.iter().find(|(existing, _)| existing == name) {
+                Some((_, blob)) => {
+                    let value = unprotect(blob)?;
+                    io::stdout().write_all(&value).map_err(|error| error.to_string())?;
+                    Ok(0)
+                }
+                None => {
+                    eprintln!("未找到：{name}");
+                    Ok(2)
+                }
+            }
+        }
+        Some("delete") => {
+            let name = args.get(1).ok_or_else(|| "用法：harness-mix-secret delete <name>".to_string())?;
+            let mut entries = load_entries()?;
+            let before = entries.len();
+            entries.retain(|(existing, _)| existing != name);
+            if entries.len() == before {
+                eprintln!("未找到：{name}");
+                return Ok(2);
+            }
+            save_entries(&entries)?;
+            Ok(0)
+        }
+        Some("list") => {
+            let entries = load_entries()?;
+            let mut out = String::new();
+            for (name, _) in entries {
+                out.push_str(&name);
+                out.push('\n');
+            }
+            io::stdout().write_all(out.as_bytes()).map_err(|error| error.to_string())?;
+            Ok(0)
+        }
+        _ => Err("用法：harness-mix-secret <set|get|delete|list> [name]".to_string()),
+    }
+}
+
+fn main() {
+    match run() {
+        Ok(code) => std::process::exit(code),
+        Err(message) => {
+            eprintln!("Harness Mix secret: {message}");
+            std::process::exit(1);
+        }
+    }
+}

package/src/main/native/rs/crates/shim/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "harness-mix-shim"
+version = "0.2.0"
+edition = "2021"
+description = "Harness Mix executable bridge: routes Codex Desktop app-server traffic to the local HostRuntime"
+license = "Apache-2.0"
+
+[[bin]]
+name = "harness-mix-shim"
+path = "src/main.rs"