@harness-mix/cli 0.1.4 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-mix/cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "license": "Apache-2.0",
   "description": "Harness Mix native Codex UI bridge for Codex, Pi, Claude Code, DeepSeek Harness, Antigravity, CodeBuddy, Kiro CLI, Cursor CLI and other native coding harnesses.",
   "keywords": [
@@ -69,6 +69,9 @@
     "node": ">=22.19.0 <23 || >=24 <25"
   },
   "scripts": {
+    "test:integrations": "node scripts/integrations-test.cjs",
+    "smoke:integrations-ui": "electron scripts/integrations-ui-smoke.cjs",
+    "e2e:integrations": "node scripts/e2e-integrations.cjs",
     "health:harnesses": "node scripts/harness-health-check.cjs",
     "test:dsh-collaboration-acp": "node scripts/dsh-collaboration-acp-test.cjs",
     "test:codebuddy-migration": "node scripts/codebuddy-migration-test.cjs",
@@ -82,6 +85,7 @@
     "test:collaboration": "node scripts/collaboration-test.cjs",
     "test:switch-harness": "node scripts/switch-harness-test.cjs",
     "smoke:collaboration-ui": "electron scripts/collaboration-ui-smoke.cjs",
+    "smoke:chatgpt-context-ui": "electron scripts/chatgpt-context-ui-smoke.cjs",
     "e2e:collaboration": "node scripts/e2e-collaboration.cjs",
     "test:native-rollback": "node scripts/native-rollback-test.cjs",
     "test:native-images": "node scripts/native-images-test.cjs",
@@ -95,6 +99,7 @@
     "test:native-config": "node scripts/native-config-test.cjs",
     "test:native-compatibility": "node scripts/native-compatibility-test.cjs",
     "e2e:native": "node scripts/e2e-native-host.cjs",
+    "e2e:native:codex": "node scripts/e2e-native-host.cjs --live-codex",
     "e2e:native:pi": "node scripts/e2e-native-host.cjs --live --harness=pi",
     "e2e:native:dsh": "node scripts/e2e-native-host.cjs --live --harness=deepseek-harness",
     "e2e:native:claude": "node scripts/e2e-native-host.cjs --live --harness=claude-code",
@@ -114,7 +119,10 @@
     "test:openclaw-adapter": "node scripts/openclaw-adapter-test.cjs",
     "test:core-concurrency": "node scripts/core-concurrency-test.cjs",
     "test:thread-title": "node scripts/thread-title-test.cjs",
-    "test:core-all": "node scripts/contracts-test.cjs && node scripts/projector-test.cjs && node scripts/turn-manager-test.cjs && node scripts/sequence-test.cjs && node scripts/shadow-test.cjs && node scripts/architecture-test.cjs && node scripts/adapters-test.cjs && node scripts/dsh-adapter-test.cjs && node scripts/codex-adapter-test.cjs && node scripts/antigravity-adapter-test.cjs && node scripts/openclaw-adapter-test.cjs && node scripts/core-replay-test.cjs && node scripts/determinism-test.cjs && node scripts/core-runtime-test.cjs && node scripts/core-services-test.cjs && node scripts/native-file-change-test.cjs && node scripts/native-updater-test.cjs && node scripts/native-update-apply-test.cjs && node scripts/native-vendor-adapters-test.cjs && node scripts/core-concurrency-test.cjs && node scripts/concurrency-layers-test.cjs && node scripts/tool-concurrency-regression-test.cjs && node scripts/switch-harness-test.cjs && node scripts/native-acp-depth-test.cjs && node scripts/thread-title-test.cjs && node scripts/native-job-object-test.cjs",
+    "test:handoff": "node scripts/handoff-checkpoint-test.cjs && node scripts/switch-harness-test.cjs",
+    "test:core-all": "node scripts/contracts-test.cjs && node scripts/projector-test.cjs && node scripts/turn-manager-test.cjs && node scripts/sequence-test.cjs && node scripts/shadow-test.cjs && node scripts/architecture-test.cjs && node scripts/adapters-test.cjs && node scripts/dsh-adapter-test.cjs && node scripts/codex-adapter-test.cjs && node scripts/codex-accounts-test.cjs && node scripts/antigravity-adapter-test.cjs && node scripts/openclaw-adapter-test.cjs && node scripts/core-replay-test.cjs && node scripts/determinism-test.cjs && node scripts/core-runtime-test.cjs && node scripts/core-services-test.cjs && node scripts/native-file-change-test.cjs && node scripts/native-updater-test.cjs && node scripts/native-update-apply-test.cjs && node scripts/native-vendor-adapters-test.cjs && node scripts/core-concurrency-test.cjs && node scripts/concurrency-layers-test.cjs && node scripts/tool-concurrency-regression-test.cjs && node scripts/handoff-checkpoint-test.cjs && node scripts/switch-harness-test.cjs && node scripts/native-acp-depth-test.cjs && node scripts/thread-title-test.cjs && node scripts/native-job-object-test.cjs && node scripts/integrations-test.cjs",
+    "test:codex-accounts": "node scripts/codex-accounts-test.cjs",
+    "smoke:codex-accounts-ui": "electron scripts/codex-accounts-ui-smoke.cjs",
     "test:transcript": "node scripts/transcript-test.cjs",
     "test:workspace": "node scripts/workspace-test.cjs",
     "e2e:pi": "node scripts/e2e-pi.cjs",
@@ -151,7 +159,8 @@
     "test:collaboration-recovery": "node scripts/collaboration-recovery-test.cjs",
     "test:tool-concurrency": "node scripts/tool-concurrency-regression-test.cjs",
     "test:platform": "node scripts/platform-test.cjs",
-    "test:shim": "node scripts/native-shim-test.cjs"
+    "test:shim": "node scripts/native-shim-test.cjs",
+    "publish:native": "node scripts/publish-native-package.cjs"
   },
   "devDependencies": {
     "@types/node": "24.13.3",
@@ -167,11 +176,11 @@
     "zod": "4.4.3"
   },
   "optionalDependencies": {
-    "@harness-mix/native-win32-x64": "0.1.4",
-    "@harness-mix/native-win32-arm64": "0.1.4",
-    "@harness-mix/native-darwin-x64": "0.1.4",
-    "@harness-mix/native-darwin-arm64": "0.1.4",
-    "@harness-mix/native-linux-x64": "0.1.4",
-    "@harness-mix/native-linux-arm64": "0.1.4"
+    "@harness-mix/native-win32-x64": "0.1.5",
+    "@harness-mix/native-win32-arm64": "0.1.5",
+    "@harness-mix/native-darwin-x64": "0.1.5",
+    "@harness-mix/native-darwin-arm64": "0.1.5",
+    "@harness-mix/native-linux-x64": "0.1.5",
+    "@harness-mix/native-linux-arm64": "0.1.5"
   }
 }

package/scripts/chatgpt-context-ui-smoke.cjs

@@ -0,0 +1,16 @@
+const { app, BrowserWindow } = require('electron');
+const assert = require('node:assert/strict');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+app.disableHardwareAcceleration();
+app.whenReady().then(async () => {
+  const bundle = await require('esbuild').build({ stdin: { contents: "export * from './src/native-ui/renderer-extension/src/renderer-chatgpt-context.ts';", resolveDir: process.cwd() }, bundle: true, platform: 'browser', format: 'iife', globalName: 'ChatGptContext', write: false });
+  const win = new BrowserWindow({ show: false, width: 1100, height: 720, webPreferences: { sandbox: true, contextIsolation: true, offscreen: true } });
+  try {
+    const html = `<!doctype html><meta charset="utf-8"><style>body{margin:0;font:14px system-ui}.composer{position:fixed;left:40px;bottom:36px;width:52%;padding:14px;border:1px solid #ccc;border-radius:14px}.composer textarea{width:100%;height:110px}.quick{position:fixed;right:12px;top:60px;bottom:12px;width:38%;border:1px solid #ddd;border-radius:22px;background:white;overflow:hidden}.quick header{height:54px;display:flex;align-items:center;padding:0 18px;border-bottom:1px solid #eee}.turns{padding:24px}.turn{margin:16px 0;padding:12px;background:#f3f3f0}.assistant{background:#eef5ff}.chat-composer{position:absolute;left:16px;right:16px;bottom:16px}</style><main><div class="composer"><textarea id="draft" placeholder="发送消息"></textarea></div></main><aside class="quick" data-chatgpt-quick-chat-panel><header><span>聊天</span></header><a data-chat-title aria-current="page" href="https://chatgpt.com/c/design?private=1">额度设计讨论</a><section class="turns"><div class="turn" data-message-author-role="user">帮我设计多账号</div><div class="turn assistant" data-message-author-role="assistant">账号应绑定原生运行时。sk-abcdefghijklmnopqrstuvwxyz123456</div></section><textarea class="chat-composer" placeholder="给 ChatGPT 发消息"></textarea></aside>`;
+    await win.loadURL('data:text/html;charset=utf-8,' + encodeURIComponent(html)); await win.webContents.executeJavaScript(bundle.outputFiles[0].text);
+    const result = await win.webContents.executeJavaScript(`(() => { const api=ChatGptContext.installChatGptContextBridge({locale:()=> 'zh-CN',resolveTarget:()=>({editor:document.querySelector('#draft'),kind:'codex',label:'Codex',accountLabel:'work@example.com'})}); document.querySelector('[data-harness-mix-chatgpt-context-action]').click(); const value=document.querySelector('#draft').value; const status=document.querySelector('[data-harness-mix-chatgpt-context-status]').textContent; document.querySelector('[data-harness-mix-chatgpt-context-action]').click(); const duplicate=document.querySelector('[data-harness-mix-chatgpt-context-status]').textContent; globalThis.chatGptContextApi=api; return {value,status,duplicate}; })()`);
+    assert.match(result.value, /不可信历史资料/); assert.match(result.value, /User: 帮我设计多账号/); assert.match(result.value, /Assistant: 账号应绑定原生运行时/); assert.doesNotMatch(result.value, /sk-abcdefghijklmnopqrstuvwxyz/); assert.match(result.status, /Codex（work@example.com）/); assert.match(result.duplicate, /已经包含/);
+    const out = path.resolve('output/chatgpt-context-ui'); await fs.mkdir(out, { recursive: true }); await fs.writeFile(path.join(out, 'add-to-task.png'), (await win.webContents.capturePage()).toPNG()); await win.webContents.executeJavaScript('chatGptContextApi.dispose()'); assert.equal(await win.webContents.executeJavaScript('document.querySelectorAll("[data-harness-mix-chatgpt-context-action]").length'), 0); console.log('PASS: Quick chat context button, target account, redaction, draft insertion, duplicate guard and cleanup');
+  } finally { win.destroy(); app.quit(); }
+}).catch((error) => { console.error(error); app.exit(1); });

package/scripts/codex-accounts-test.cjs

@@ -0,0 +1,81 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { CodexAccountManager } = require('../src/main/native/codex-accounts');
+
+async function main() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-mix-codex-accounts-'));
+  const servers = new Map();
+  const emitted = [];
+  const acquireServer = async (_diagnostic, codexHome) => {
+    let server = servers.get(codexHome);
+    if (!server) {
+      const listeners = new Set();
+      server = {
+        refs: 0,
+        account: null,
+        requests: [],
+        async request(method, params) {
+          this.requests.push({ method, params });
+          if (method === 'account/read') return { account: this.account };
+          if (method === 'account/rateLimits/read') return { rateLimits: { primary: { usedPercent: 24, windowDurationMins: 300, resetsAt: 1_800_000_000 }, secondary: { usedPercent: 41, windowDurationMins: 10080, resetsAt: 1_800_604_800 } } };
+          if (method === 'account/login/start') return { type: 'chatgptDeviceCode', loginId: 'login-isolated', verificationUrl: 'https://auth.example/device', userCode: 'WXYZ-1234' };
+          if (method === 'account/login/cancel') return { status: 'cancelled' };
+          throw new Error(`Unexpected fake Account request: ${method}`);
+        },
+        onNotification(listener) { listeners.add(listener); return () => listeners.delete(listener); },
+        notify(message) { for (const listener of listeners) listener(message); },
+        release() { this.refs--; },
+      };
+      servers.set(codexHome, server);
+    }
+    server.refs++;
+    return server;
+  };
+  const official = async (method) => {
+    if (method === 'account/read') return { account: { type: 'chatgpt', email: 'owner@example.com', planType: 'plus' } };
+    throw new Error(`Unexpected official request: ${method}`);
+  };
+  const manager = new CodexAccountManager({ dataDirectory: root, requestOfficial: official, emit: message => emitted.push(message), acquireServer });
+  try {
+    const initial = await manager.list();
+    assert.equal(initial.accounts.length, 1);
+    assert.equal(initial.accounts[0].email, 'owner@example.com');
+    assert.equal(initial.accounts[0].management, 'native');
+
+    const created = await manager.create('工作账号');
+    assert.equal(created.account.management, 'isolated');
+    assert.equal(created.account.authenticated, false);
+    const context = manager.executionContext(created.account.accountId);
+    assert.ok(context.codexHome.startsWith(path.join(root, 'codex-accounts', 'profiles') + path.sep));
+    const server = servers.get(context.codexHome);
+    server.account = { type: 'chatgpt', email: 'work@example.com', planType: 'pro' };
+
+    const activated = await manager.activate(created.account.accountId);
+    assert.equal(activated.account.active, true);
+    const accounts = await manager.list(true);
+    assert.equal(accounts.accounts.find(account => account.isDefault).active, false);
+    assert.equal(accounts.accounts.find(account => account.accountId === created.account.accountId).email, 'work@example.com');
+    const usage = await manager.usage(created.account.accountId);
+    assert.equal(usage.usage.planFiveHourUsedPercent, 24);
+    assert.equal(usage.accountCredits.productUsage[0].usagePercent, 41);
+
+    const login = await manager.startLogin(created.account.accountId);
+    assert.equal(login.userCode, 'WXYZ-1234');
+    server.notify({ method: 'account/login/completed', params: { loginId: login.loginId, success: true, error: null } });
+    assert.deepEqual(emitted.at(-1), { method: 'codexhost/account/login/completed', params: { accountId: created.account.accountId, loginId: login.loginId, success: true, error: null } });
+
+    const registry = fs.readFileSync(path.join(root, 'codex-accounts', 'accounts.json'), 'utf8');
+    assert.equal(registry.includes('owner@example.com'), false, 'Registry must not persist native identity or credentials');
+    assert.equal(registry.includes('work@example.com'), false, 'Registry must not persist isolated identity or credentials');
+    await manager.delete(created.account.accountId);
+    assert.equal(fs.existsSync(context.codexHome), false);
+  } finally {
+    manager.close();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+  console.log('Codex multi-account isolation, switching, usage and login lifecycle passed');
+}
+
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/scripts/codex-accounts-ui-smoke.cjs

@@ -0,0 +1,70 @@
+const { app, BrowserWindow } = require('electron');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const esbuild = require('esbuild');
+
+app.disableHardwareAcceleration();
+
+app.whenReady().then(async () => {
+  const output = path.resolve('output/codex-accounts-ui-smoke');
+  fs.mkdirSync(output, { recursive: true });
+  const bundle = await esbuild.build({
+    stdin: {
+      contents: `export { createAccountsSettingsPage } from './src/native-ui/renderer-extension/src/settings/accounts-page.ts'; export { rendererSettingsMessages } from './src/native-ui/renderer-extension/src/settings/localization.ts'; export { installRendererSettingsShell } from './src/native-ui/renderer-extension/src/settings/shell.ts';`,
+      resolveDir: process.cwd(),
+    },
+    bundle: true,
+    alias: { '@codexhost/shared-contracts': path.resolve('src/native-ui/shared-contracts/src/index.ts') },
+    platform: 'browser',
+    format: 'iife',
+    globalName: 'AccountUI',
+    write: false,
+    loader: { '.svg': 'dataurl', '.png': 'dataurl', '.css': 'text' },
+    logLevel: 'silent',
+  });
+  const win = new BrowserWindow({ show: false, width: 1080, height: 720, webPreferences: { contextIsolation: true, sandbox: true, offscreen: true, backgroundThrottling: false } });
+  await win.loadURL('data:text/html,<html><body></body></html>');
+  await win.webContents.executeJavaScript(bundle.outputFiles[0].text);
+  const result = await win.webContents.executeJavaScript(`(async () => {
+    const accounts = [
+      { accountId:'official-codex', label:'owner@example.com', email:'owner@example.com', planType:'plus', codexHome:'C:/Users/test/.codex', active:false, isDefault:true, authenticated:true, management:'native' },
+      { accountId:'account-work', label:'work@example.com', email:'work@example.com', planType:'pro', codexHome:'C:/Profiles/work', active:true, isDefault:false, authenticated:true, management:'isolated' },
+    ];
+    const usage = {
+      'official-codex': { usedPercent:31, periodType:'five_hour', resetsAt:'2026-09-14T03:00:00.000Z', productUsage:[{product:'7-day window',usagePercent:22,resetsAt:'2026-09-20T03:00:00.000Z'}] },
+      'account-work': { usedPercent:68, periodType:'five_hour', resetsAt:'2026-09-14T05:00:00.000Z', productUsage:[{product:'7-day window',usagePercent:47,resetsAt:'2026-09-19T05:00:00.000Z'}] },
+    };
+    const client = {
+      listCodexAccounts: async () => ({accounts}), refreshCodexAccounts: async () => ({accounts}),
+      inspectCodexAccountUsage: async ({accountId}) => ({accountId,usage:null,accountCredits:usage[accountId]}),
+      createCodexAccount: async () => ({account:accounts[1]}), deleteCodexAccount: async ({accountId}) => ({deletedAccountId:accountId}),
+      activateCodexAccount: async ({accountId}) => ({account:accounts.find(account => account.accountId===accountId)}),
+      startCodexAccountLogin: async () => { throw new Error('not expected'); }, cancelCodexAccountLogin: async () => ({cancelled:true}),
+      logoutCodexAccount: async () => ({account:{...accounts[0],email:undefined,authenticated:false}}),
+    };
+    const messages=AccountUI.rendererSettingsMessages('zh-CN');
+    const shell=AccountUI.installRendererSettingsShell([AccountUI.createAccountsSettingsPage(messages,()=>client)],messages,document);
+    shell.openSettings(undefined,'accounts');
+    await new Promise(resolve=>setTimeout(resolve,250));
+    const shadow=shell.root.shadowRoot;
+    const content=shadow.querySelector('.settings-page__content');
+    const text=content.textContent;
+    const add=[...shadow.querySelectorAll('button')].find(button=>button.textContent.includes('添加账号'));
+    const rows=[...content.querySelectorAll('[data-account-id]')].map(row=>row.getAttribute('data-account-id'));
+    return {text,addVisible:add && !add.hidden,rows,pathsVisible:text.includes('C:/Profiles')||text.includes('.codex')};
+  })()`);
+  assert.equal(result.addVisible, true);
+  assert.deepEqual(result.rows, ['official-codex', 'account-work']);
+  assert.match(result.text, /owner.*example\.com/s);
+  assert.match(result.text, /work.*example\.com/s);
+  assert.match(result.text, /Plus/);
+  assert.match(result.text, /Pro/);
+  assert.match(result.text, /5 小时|5小时/);
+  assert.match(result.text, /7 天|7天/);
+  assert.equal(result.pathsVisible, false, result.text);
+  fs.writeFileSync(path.join(output, 'codex-multi-account.png'), (await win.webContents.capturePage()).toPNG());
+  win.destroy();
+  console.log('PASS: Codex multi-account settings, quota windows, refresh times and hidden CODEX_HOME render in Electron');
+  app.quit();
+}).catch(error => { console.error(error); app.exit(1); });

package/scripts/e2e-integrations.cjs

@@ -0,0 +1,52 @@
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const assert = require('node:assert/strict');
+const { randomUUID } = require('node:crypto');
+const { Integrations } = require('../src/main/host/integrations');
+const { buildAdapters } = require('../src/main/adapters');
+
+async function main() {
+  const id = process.argv.find(a => a.startsWith('--harness='))?.split('=')[1] || 'claude';
+  const root = path.resolve('output/integrations-e2e', `${id}-${Date.now()}`), cwd = path.join(root, 'project');
+  await fs.mkdir(cwd, { recursive: true });
+  const adapters = new Map(buildAdapters(() => {}).map(a => [a.manifest.id, a]));
+  const adapter = adapters.get(id); assert.ok(adapter?.manifest.integrations?.mcp);
+  const runtime = { adapters, status: {}, sessions: new Map(), store: { directory: path.join(root, 'data') }, resolveHarnessId: id => id };
+  const manager = new Integrations(runtime), selected = { harnessId: id, scope: 'project', cwd };
+  const log = path.join(root, 'mcp-methods.log');
+  await manager.save({ ...selected, server: { name: 'acceptance', command: process.execPath, args: [path.resolve('scripts/support/integrations-mcp-fixture.cjs'), log], enabled: true } });
+  if (adapter.manifest.integrations.skills) {
+    const source = path.join(root, 'skill'); await fs.mkdir(source);
+    await fs.writeFile(path.join(source, 'SKILL.md'), '---\nname: hm-integration-acceptance\ndescription: Read-only Harness Mix integration acceptance fixture.\n---\nReturn HARNESS_MIX_SKILL_OK.\n');
+    await manager.skillChange({ ...selected, name: 'hm-integration-acceptance', source, action: 'install' });
+  }
+  const thread = { id: randomUUID(), nativeSessionId: randomUUID(), cwd, title: 'Integration acceptance', options: {} };
+  const injected = await manager.forSession(thread, adapter);
+  let session;
+  const deadline = setTimeout(() => { console.error('Native acceptance timed out'); process.exit(1); }, 55000);
+  try {
+    session = await adapter.open({ thread, managedMcp: injected.servers, emit: () => {}, diagnostic: () => {} });
+    session.adapter = adapter; session.integrationServers = injected.records; session.integrationCwd = injected.cwd;
+    runtime.sessions.set(thread.id, session);
+    let native = [], methods = '';
+    for (let attempt = 0; attempt < 15; attempt++) {
+      native = adapter.inspectIntegrations ? await adapter.inspectIntegrations(session) : [];
+      try { methods = await fs.readFile(log, 'utf8'); } catch (e) { if (e.code !== 'ENOENT') throw e; }
+      if (native.some(s => s.name === 'hm-user-acceptance' && s.status === 'connected')) break;
+      if (!adapter.inspectIntegrations && methods.includes('tools/list')) break;
+      await new Promise(resolve => setTimeout(resolve, 1000));
+    }
+    if (adapter.inspectIntegrations) assert.ok(native.some(s => s.name === 'hm-user-acceptance' && s.status === 'connected'), 'native Harness must report connected');
+    methods = await fs.readFile(log, 'utf8'); assert.match(methods, /initialize/); assert.match(methods, /tools\/list/);
+    let skillLoaded = null;
+    if (session.query?.supportedCommands) {
+      const commands = await session.query.supportedCommands();
+      skillLoaded = commands.some(c => c.name === 'hm-integration-acceptance');
+      assert.equal(skillLoaded, true, 'native Claude must discover the installed project skill');
+    }
+    const snapshot = await manager.list(selected); assert.equal(snapshot.servers[0].appliedSessions, 1);
+    const report = { harness: id, nativeMcpConnected: native.some(s => s.name === 'hm-user-acceptance' && s.status === 'connected') || null, nativeToolDiscovery: true, skillLoaded, modelTurnExecuted: false, automaticApproval: false };
+    await fs.writeFile(path.join(root, 'report.json'), JSON.stringify(report, null, 2)); console.log(JSON.stringify({ ...report, root }));
+  } finally { clearTimeout(deadline); if (session) await adapter.close(session); }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/scripts/e2e-native-host.cjs

@@ -41,7 +41,9 @@ async function main() {
     const ownership = await request('harness-mix/runtime/inspect', {});
     assert.equal(ownership.owner, 'harness-mix');
     assert.equal(ownership.core, 'src/main/protocol-core/protocol-core.js');
+    assert.deepEqual(ownership.codex, { mode: 'official-passthrough', managedRoute: 'codex-harness' });
     report.checks.push('Harness Mix HostRuntime and ProtocolCore own external execution');
+    report.checks.push('official Codex route is separate from the managed Codex worker');
     const plugins = await request('codexhost/harness/plugins/list', {});
     assert.ok(plugins.plugins.some(plugin => (plugin.id || plugin.manifest?.id) === 'pi'), 'Pi plugin registered');
     report.checks.push('external harness plugins registered');
@@ -54,6 +56,43 @@ async function main() {
     const officialModels = await request('model/list', {});
     assert.ok(Array.isArray(officialModels.data), 'Official model/list passes through');
     report.checks.push('official model/list passthrough');
+    const codexAccounts = await request('codexhost/account/refresh', {});
+    const officialAccount = codexAccounts.accounts?.find(account => account.management === 'native');
+    assert.ok(officialAccount, 'Official Codex account is projected into Account management');
+    assert.equal(officialAccount.authenticated, true, 'Current official Codex login is detected');
+    assert.ok(officialAccount.email, 'Current ChatGPT account identity is available from account/read');
+    const officialAccountUsage = await request('codexhost/account/usage/inspect', { accountId: officialAccount.accountId });
+    assert.ok(officialAccountUsage.accountCredits, 'Official Codex rate limits are projected');
+    report.account = {
+      authenticated: officialAccount.authenticated,
+      planType: officialAccount.planType || null,
+      fiveHourUsedPercent: officialAccountUsage.usage?.planFiveHourUsedPercent ?? null,
+      sevenDayUsedPercent: officialAccountUsage.usage?.planSevenDayUsedPercent ?? null,
+    };
+    report.checks.push('real official Codex account and rate-limit projection');
+    if (process.argv.includes('--live-codex')) {
+      const native = await request('thread/start', { cwd: directory });
+      const nativeThreadId = native.thread?.id;
+      assert.ok(nativeThreadId, 'Official Codex thread/start returns a native Thread');
+      const nativeTurn = await request('turn/start', {
+        threadId: nativeThreadId,
+        input: [{ type: 'text', text: 'Reply with exactly HARNESS_MIX_CODEX_PASSTHROUGH_OK. Do not use tools.' }],
+      });
+      const nativeTurnId = nativeTurn.turn?.id;
+      assert.ok(nativeTurnId, 'Official Codex turn/start returns a native Turn');
+      const deadline = Date.now() + 120000;
+      while (Date.now() < deadline && !events.some(event => event.method === 'turn/completed' && event.params?.threadId === nativeThreadId && event.params?.turn?.id === nativeTurnId)) {
+        await new Promise(resolve => setTimeout(resolve, 250));
+      }
+      const completed = events.find(event => event.method === 'turn/completed' && event.params?.threadId === nativeThreadId && event.params?.turn?.id === nativeTurnId);
+      assert.equal(completed?.params?.turn?.status, 'completed', 'Official Codex Turn completes through the passthrough path');
+      const text = events.filter(event => event.params?.threadId === nativeThreadId && event.params?.turnId === nativeTurnId)
+        .map(event => event.params?.delta || event.params?.item?.text || '').join('');
+      assert.ok(text.includes('HARNESS_MIX_CODEX_PASSTHROUGH_OK'), 'Official Codex response reaches Desktop protocol unchanged');
+      await request('thread/delete', { threadId: nativeThreadId }).catch(() => {});
+      report.codex = { threadId: nativeThreadId, turnId: nativeTurnId, status: completed.params.turn.status };
+      report.checks.push('real official Codex thread/turn passthrough');
+    }
     // Real Host + stock-server section catalog, with test threads isolated in output/.
     const sidebarThread = await request('thread/start', { cwd: directory, model: 'codexhost/pi-native' });
     const sidebarId = sidebarThread.thread.id;

package/scripts/handoff-checkpoint-test.cjs

@@ -0,0 +1,83 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const { HandoffCheckpoints } = require('../src/main/host/handoff-checkpoints');
+const { HandoffAccess } = require('../src/main/host/handoff-access');
+const { dispatch } = require('../src/main/host/handoff-mcp.cjs');
+
+async function main() {
+  await fs.mkdir('output', { recursive: true });
+  const root = await fs.mkdtemp(path.resolve('output/handoff-checkpoint-'));
+  const runtime = {
+    store: { directory: path.join(root, 'data') },
+    adapters: new Map([['target', { manifest: { integrations: { mcp: true } } }]]),
+  };
+  runtime.handoffs = new HandoffCheckpoints(runtime);
+  await runtime.handoffs.initialize();
+
+  const thread = {
+    id: 'thread-a',
+    harnessId: 'source',
+    title: '修复登录模块',
+    cwd: process.cwd(),
+    messages: [
+      { id: 'user-1', role: 'user', text: '继续实现，api_key=supersecretvalue123' },
+      {
+        id: 'assistant-1', role: 'assistant', text: '先跑测试再修复', coreItems: [
+          { type: 'plan', entries: [{ text: '定位失败', status: 'completed' }, { text: '实现修复', status: 'in_progress' }] },
+          { type: 'tool_call', toolCallId: 'native-replay-id', title: 'npm test', state: 'error', input: 'token=anothersecretvalue', output: 'authorization: Bearer abcdefghijklmnop\n1 test failed' },
+          { type: 'file_change', path: 'src/login.js', changeType: 'modified', before: 'a', after: 'b' },
+        ],
+      },
+    ],
+  };
+
+  const checkpoint = await runtime.handoffs.create(thread, 'target', { intent: 'execute-plan' });
+  assert.match(checkpoint.checkpointId, /^handoff_[a-f0-9]{24}$/);
+  assert.equal(checkpoint.onDemandAccess, 'mcp');
+  assert.equal(checkpoint.intent, 'execute-plan');
+  assert.equal(checkpoint.plan.inProgress[0], '实现修复');
+  assert.equal(checkpoint.fileState.files[0].path, 'src/login.js');
+  assert.match(checkpoint.fileState.diffDigest, /^[a-f0-9]{64}$/);
+  assert.ok(checkpoint.fileState.gitHead === null || /^[a-f0-9]{40,64}$/.test(checkpoint.fileState.gitHead));
+  const serialized = JSON.stringify(checkpoint);
+  assert.doesNotMatch(serialized, /supersecretvalue123|anothersecretvalue|abcdefghijklmnop|native-replay-id/);
+  assert.match(serialized, /\[redacted\]/);
+
+  thread.messages[0].text = 'mutated after handoff';
+  assert.doesNotMatch(JSON.stringify(runtime.handoffs.owned(thread.id, checkpoint.checkpointId)), /mutated after handoff/);
+
+  const access = new HandoffAccess(runtime);
+  const connection = await access.connection({ ...thread, harnessId: 'target', pendingHandoff: { checkpointId: checkpoint.checkpointId } });
+  assert.ok(connection);
+  const oldUrl = process.env.HARNESS_MIX_HANDOFF_URL;
+  const oldKey = process.env.HARNESS_MIX_HANDOFF_KEY;
+  process.env.HARNESS_MIX_HANDOFF_URL = connection.env.HARNESS_MIX_HANDOFF_URL;
+  process.env.HARNESS_MIX_HANDOFF_KEY = connection.env.HARNESS_MIX_HANDOFF_KEY;
+  try {
+    const catalog = await dispatch({ id: 1, method: 'tools/list' });
+    assert.deepEqual(catalog.tools.map(tool => tool.name), [
+      'get_handoff_checkpoint', 'list_handoff_conversation', 'list_handoff_evidence',
+      'read_handoff_evidence', 'list_handoff_files', 'read_handoff_plan',
+    ]);
+    const result = await dispatch({ id: 2, method: 'tools/call', params: { name: 'get_handoff_checkpoint', arguments: { checkpoint_id: checkpoint.checkpointId } } });
+    const summary = JSON.parse(result.content[0].text);
+    assert.equal(summary.checkpointId, checkpoint.checkpointId);
+    assert.equal(summary.status, 'checkpoint-created');
+    const denied = await dispatch({ id: 3, method: 'tools/call', params: { name: 'get_handoff_checkpoint', arguments: { checkpoint_id: 'handoff_outside_scope' } } });
+    assert.equal(denied.isError, true);
+    assert.match(denied.content[0].text, /outside this native session scope/);
+  } finally {
+    if (oldUrl === undefined) delete process.env.HARNESS_MIX_HANDOFF_URL; else process.env.HARNESS_MIX_HANDOFF_URL = oldUrl;
+    if (oldKey === undefined) delete process.env.HARNESS_MIX_HANDOFF_KEY; else process.env.HARNESS_MIX_HANDOFF_KEY = oldKey;
+    await access.close();
+  }
+
+  const reloaded = new HandoffCheckpoints(runtime);
+  await reloaded.initialize();
+  assert.equal(reloaded.get(thread.id, checkpoint.checkpointId).contentDigest, checkpoint.contentDigest);
+  await reloaded.close();
+  console.log('PASS: immutable handoff checkpoint, redaction, persistence and scoped read-only MCP access');
+}
+
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/scripts/install-native.cjs

@@ -18,7 +18,10 @@ if (!fs.existsSync(packageRoot)) {
 fs.mkdirSync(destination, { recursive: true });
 for (const name of files) {
   const source = path.join(packageRoot, 'bin', name);
-  if (!fs.existsSync(source)) throw new Error(`${packageName} is missing bin/${name}`);
+  if (!fs.existsSync(source)) {
+    console.warn(`[Harness Mix] ${packageName} contains source-only platform metadata; run npm run build:native on this machine.`);
+    process.exit(0);
+  }
   const target = path.join(destination, name);
   fs.copyFileSync(source, target);
   if (platform !== 'win32') fs.chmodSync(target, 0o755);

package/scripts/integrations-test.cjs

@@ -0,0 +1,64 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const { Integrations } = require('../src/main/host/integrations');
+const { buildAdapters } = require('../src/main/adapters');
+const { NativeProtocol } = require('../src/main/native/protocol');
+const { acpServers, namedServers } = require('../src/main/adapters/managed-mcp');
+
+async function main() {
+  const root = path.resolve('output/integrations-test', `${Date.now()}`);
+  const project = path.join(root, 'project'), home = path.join(root, 'home');
+  await fs.mkdir(project, { recursive: true }); await fs.mkdir(home);
+  const adapters = new Map(buildAdapters(() => {}).map(a => [a.manifest.id, a]));
+  const runtime = { adapters, status: {}, sessions: new Map(), store: { directory: path.join(root, 'data') }, resolveHarnessId: id => id };
+  const manager = runtime.integrations = new Integrations(runtime, { home });
+  const global = { harnessId: 'claude', scope: 'global' }, local = { harnessId: 'claude', scope: 'project', cwd: project };
+  const server = { name: 'probe', command: process.execPath, args: ['probe.cjs'], enabled: true };
+  await Promise.all([manager.save({ ...global, server }), manager.save({ ...local, server: { ...server, enabled: false } })]);
+  assert.equal((await manager.forSession({ cwd: project }, adapters.get('claude'))).servers.length, 0, 'project disabled entry masks global');
+  let snapshot = await manager.list(local);
+  assert.equal(snapshot.servers.length, 2); assert.equal(snapshot.servers.filter(s => s.effective).length, 1);
+  await manager.remove({ ...local, id: snapshot.servers.find(s => s.scope === 'project').id });
+  const selected = await manager.forSession({ cwd: project }, adapters.get('claude'));
+  assert.equal(selected.servers[0].name, 'hm-user-probe');
+  runtime.sessions.set('s', { adapter: adapters.get('claude'), nativeSessionId: 'native-test', integrationCwd: await fs.realpath(project), integrationServers: selected.records,
+    query: { mcpServerStatus: async () => [{ name: 'hm-user-probe', status: 'connected', config: { token: 'DO_NOT_PROJECT' }, tools: [{ name: 'echo' }] }] } });
+  snapshot = await manager.list(local);
+  assert.equal(snapshot.servers[0].appliedSessions, 1); assert.equal(snapshot.native[0].status, 'connected'); assert.ok(!JSON.stringify(snapshot).includes('DO_NOT_PROJECT'));
+  await manager.save({ ...global, server: { ...server, args: ['changed.cjs'] } });
+  assert.equal((await manager.list(global)).servers[0].appliedSessions, 0, 'changed config not claimed as applied');
+  const reload = new Integrations(runtime, { home }); assert.equal((await reload.list(global)).servers.length, 1);
+  await assert.rejects(manager.save({ ...global, server: { ...server, env: { SECRET: 'never' } } }));
+  await assert.rejects(manager.save({ ...global, server: { ...server, args: ['--token', 'never'] } }));
+  await assert.rejects(manager.save({ ...global, harnessId: 'pi', server }), /no supported/);
+  await assert.rejects(manager.remove({ ...local, id: snapshot.servers[0].id }), /scope/);
+  await assert.rejects(manager.list({ ...local, cwd: 'relative' }));
+  const source = path.join(root, 'source'); await fs.mkdir(path.join(source, 'scripts'), { recursive: true });
+  await fs.writeFile(path.join(source, 'SKILL.md'), '---\nname: sample\ndescription: Sample skill\n---\n# Sample\n');
+  await fs.writeFile(path.join(source, 'scripts', 'sample.txt'), 'unchanged');
+  await manager.skillChange({ ...local, name: 'sample', source, action: 'install' });
+  const nativeFile = path.join(project, '.claude/skills/sample/SKILL.md'); assert.match(await fs.readFile(nativeFile, 'utf8'), /Sample/);
+  await assert.rejects(manager.skillChange({ ...local, name: 'sample', source, action: 'install' }), /already exists/);
+  await manager.skillChange({ ...local, name: 'sample', action: 'disable' });
+  await assert.rejects(fs.access(nativeFile)); assert.equal((await manager.list(local)).skills[0].enabled, false);
+  await manager.skillChange({ ...local, name: 'sample', action: 'enable' });
+  assert.equal(await fs.readFile(path.join(project, '.claude/skills/sample/scripts/sample.txt'), 'utf8'), 'unchanged');
+  await assert.rejects(manager.skillChange({ ...local, name: '../escape', source, action: 'install' }));
+  await assert.rejects(manager.skillChange({ ...local, name: 'sample', root, action: 'disable' }));
+  const link = path.join(project, '.claude/skills/linked');
+  await fs.symlink(source, link, process.platform === 'win32' ? 'junction' : 'dir');
+  assert.equal((await manager.list(local)).skills.find(s => s.name === 'linked').writable, false);
+  await assert.rejects(manager.skillChange({ ...local, name: 'linked', action: 'disable' }), /read-only/);
+  const collab = { command: 'native-node', args: ['bridge'], env: { LOCAL_BRIDGE: 'capability' } };
+  const acp = acpServers(selected.servers, collab);
+  assert.equal(acp.length, 2); assert.equal(acp[1].name, 'harness-mix'); assert.deepEqual(acp[0].env, []);
+  assert.ok(namedServers(selected.servers, collab)['hm-user-probe']);
+  const catalog = await manager.catalog(); assert.equal(catalog.harnesses.length, 16);
+  for (const a of adapters.values()) assert.equal(catalog.harnesses.find(h => h.id === a.manifest.id).mcp, a.manifest.integrations?.mcp === true);
+  // Exercise the real protocol dispatcher without starting native processes.
+  assert.equal((await NativeProtocol.prototype.request.call({ runtime }, 'codexhost/integrations/catalog', {})).harnesses.length, 16);
+  assert.equal((await NativeProtocol.prototype.request.call({ runtime }, 'codexhost/integrations/list', local)).skills.length, 2);
+  console.log('integrations: scope precedence, persistence, native status projection, no credential fields, unsupported capabilities, skill install/disable/restore, links, and protocol PASS');
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/scripts/integrations-ui-smoke.cjs

@@ -0,0 +1,63 @@
+const { app, BrowserWindow, ipcMain } = require('electron');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const assert = require('node:assert/strict');
+const esbuild = require('esbuild');
+const { Integrations } = require('../src/main/host/integrations');
+const { buildAdapters } = require('../src/main/adapters');
+const { NativeProtocol } = require('../src/main/native/protocol');
+app.disableHardwareAcceleration();
+
+app.whenReady().then(async () => {
+  const out = path.resolve('output/integrations-ui', `${Date.now()}`), project = path.join(out, 'project');
+  await fs.mkdir(project, { recursive: true });
+  const adapters = new Map(buildAdapters(() => {}).map(a => [a.manifest.id, a]));
+  const runtime = { adapters, sessions: new Map(), status: { claude: { available: true } }, store: { directory: path.join(out, 'data') }, resolveHarnessId: id => id };
+  runtime.integrations = new Integrations(runtime, { home: path.join(out, 'home') });
+  const source = path.join(out, 'skill-source'); await fs.mkdir(source); await fs.writeFile(path.join(source, 'SKILL.md'), '---\nname: ui-skill\ndescription: UI fixture\n---\n# Test\n');
+  const preload = path.join(out, 'preload.cjs');
+  await fs.writeFile(preload, `const {contextBridge,ipcRenderer}=require('electron');contextBridge.exposeInMainWorld('integrationTest',{request:(method,params)=>ipcRenderer.invoke('integrations-test',method,params)});`);
+  ipcMain.handle('integrations-test', (_event, method, params) => {
+    assert.ok(method.startsWith('codexhost/integrations/'));
+    return NativeProtocol.prototype.request.call({ runtime }, method, params);
+  });
+  const build = await esbuild.build({ stdin: { contents: `export {createIntegrationsSettingsPage} from './src/native-ui/renderer-extension/src/settings/integrations-page.ts'; export {mountRendererSettingsShell} from './src/native-ui/renderer-extension/src/settings/shell.ts'; export {createRendererSettingsPageRegistry} from './src/native-ui/renderer-extension/src/settings/core.ts'; export {rendererSettingsMessages} from './src/native-ui/renderer-extension/src/settings/localization.ts'; export {createRendererIntegrationsClient} from './src/native-ui/renderer-extension/src/renderer-integrations-client.ts';`, resolveDir: process.cwd() }, bundle: true, platform: 'browser', format: 'iife', globalName: 'IntegrationUI', write: false, alias: { '@codexhost/shared-contracts': path.resolve('src/native-ui/shared-contracts/src/index.ts') }, loader: { '.svg': 'dataurl', '.png': 'dataurl', '.css': 'text' } });
+  const consoleProblems = [];
+  const win = new BrowserWindow({ show: false, width: 1100, height: 900, webPreferences: { preload, contextIsolation: true, sandbox: true, offscreen: true } });
+  win.webContents.on('console-message', (_event, details) => { if (details.level === 'error' || details.level === 'warning') consoleProblems.push(details.message); });
+  try {
+    await win.loadURL('data:text/html,<html><head><title>Harness Mix Integrations QA</title><meta http-equiv="Content-Security-Policy" content="default-src %27none%27; script-src %27none%27; style-src %27unsafe-inline%27; img-src data:"></head><body style="background:%23191919;color:white;font-family:Arial"></body></html>');
+    await win.webContents.executeJavaScript(build.outputFiles[0].text);
+    const result = await win.webContents.executeJavaScript(`(async()=>{
+      const messages=IntegrationUI.rendererSettingsMessages('zh-CN');
+      const client=IntegrationUI.createRendererIntegrationsClient((m,p)=>window.integrationTest.request(m,p));
+      const registry=IntegrationUI.createRendererSettingsPageRegistry([IntegrationUI.createIntegrationsSettingsPage(messages,()=>client)]);
+      const shell=IntegrationUI.mountRendererSettingsShell(registry,document,messages); shell.openSettings();
+      const root=shell.root.shadowRoot;
+      const wait=async predicate=>{for(let i=0;i<100;i++){if(predicate())return;await new Promise(r=>setTimeout(r,30));}throw Error('UI timed out');};
+      await wait(()=>root.querySelector('select')?.options.length===16 && !root.querySelector('select').disabled);
+      const [harness,scope]=root.querySelectorAll('select');harness.value='claude';harness.dispatchEvent(new Event('change'));
+      await wait(()=>root.querySelector('.settings-integrations-form')&&!harness.disabled);
+      scope.value='project';scope.dispatchEvent(new Event('change'));
+      const cwd=root.querySelector('.settings-integrations-controls input');cwd.value=${JSON.stringify(project)};cwd.dispatchEvent(new Event('change'));
+      await wait(()=>root.querySelector('.settings-integrations-form')&&!harness.disabled);
+      const form=root.querySelector('form'); const fields=form.querySelectorAll('input');fields[0].value='ui-probe';fields[1].value='node';form.querySelector('textarea').value='["probe.cjs"]';form.requestSubmit();
+      await wait(()=>root.textContent.includes('ui-probe')&&!harness.disabled&&!!root.querySelector('.settings-integrations-row'));
+      const mcpRow=()=>Array.from(root.querySelectorAll('.settings-integrations-row')).find(r=>r.querySelector('strong')?.textContent==='ui-probe');
+      mcpRow().querySelector('button').click();await wait(()=>mcpRow()?.textContent.includes('已停用')&&!harness.disabled);
+      mcpRow().querySelector('button').click();await wait(()=>mcpRow()?.textContent.includes('已配置')&&!harness.disabled);
+      const skillForm=root.querySelectorAll('form')[1];const skillFields=skillForm.querySelectorAll('input');skillFields[0].value='ui-skill';skillFields[1].value=${JSON.stringify(source)};skillForm.requestSubmit();
+      const skillRow=()=>Array.from(root.querySelectorAll('.settings-integrations-row')).find(r=>r.querySelector('strong')?.textContent==='ui-skill');
+      await wait(()=>skillRow()&&!harness.disabled);skillRow().querySelector('button').click();await wait(()=>skillRow()?.textContent.includes('已停用')&&!harness.disabled);
+      skillRow().querySelector('button').click();await wait(()=>skillRow()?.textContent.includes('已发现')&&!harness.disabled);
+      return {mcpSaved:true,mcpToggled:true,skillInstalled:true,skillRestored:true,scope:scope.value,text:root.textContent.slice(-2000)};
+    })()`);
+    assert.equal(await win.webContents.executeJavaScript('document.title'), 'Harness Mix Integrations QA');
+    assert.ok(result.mcpSaved && result.skillRestored); assert.deepEqual(consoleProblems, []);
+    const list = await runtime.integrations.list({ harnessId: 'claude', scope: 'project', cwd: project });
+    assert.equal(list.servers[0].enabled, true); assert.equal(list.skills[0].enabled, true);
+    await fs.writeFile(path.join(out, 'settings.png'), (await win.webContents.capturePage()).toPNG());
+    await fs.writeFile(path.join(out, 'report.json'), JSON.stringify(result, null, 2));
+    console.log(`Integrations rendered UI -> typed client -> NativeProtocol -> real files PASS: ${out}`);
+  } finally { win.destroy(); app.quit(); }
+}).catch(error => { console.error(error); app.exit(1); });