@ljwei-stak/dsh-model-router 0.18.1 → 0.18.2

package/.dsh-plugin/client.js

@@ -77,6 +77,8 @@ function scriptMethod(id2, label, {
   scriptBinaryNames,
   registryEnv,
   installDirSubdir,
+  legacySharedInstallDir = false,
+  sharedDefaultBin = false,
   uninstallUnsupportedReason,
   scriptFallbackUrls
 }) {
@@ -97,6 +99,8 @@ function scriptMethod(id2, label, {
     installDirEnv,
     installDirSuffix,
     ...installDirSubdir ? { installDirSubdir } : {},
+    ...legacySharedInstallDir ? { legacySharedInstallDir: true } : {},
+    ...sharedDefaultBin ? { sharedDefaultBin: true } : {},
     ...uninstallUnsupportedReason ? { uninstallUnsupportedReason } : {},
     ...defaultScriptInstallDir ? { defaultScriptInstallDir } : {},
     ...defaultScriptInstallDirEnv ? { defaultScriptInstallDirEnv } : {},
@@ -131,6 +135,8 @@ var OFFICIAL_TOOLS = Object.freeze([
         supportsInstallDir: true,
         installDirEnv: "KIMI_INSTALL_DIR",
         installDirSuffix: "bin",
+        installDirSubdir: "kimi-code",
+        legacySharedInstallDir: true,
         env: ["KIMI_INSTALL_DIR"],
         scriptBinaryNames: ["kimi"],
         verify: Object.freeze({ mustInclude: ["kimi-code", "code.kimi.com/kimi-code"] })
@@ -142,6 +148,8 @@ var OFFICIAL_TOOLS = Object.freeze([
         supportsInstallDir: true,
         installDirEnv: "KIMI_INSTALL_DIR",
         installDirSuffix: "bin",
+        installDirSubdir: "kimi-code",
+        legacySharedInstallDir: true,
         env: ["KIMI_INSTALL_DIR"],
         scriptBinaryNames: ["kimi.exe"],
         verify: Object.freeze({ mustInclude: ["kimi-code", "code.kimi.com/kimi-code"] })
@@ -174,6 +182,7 @@ var OFFICIAL_TOOLS = Object.freeze([
         scriptFallbackUrls: ["https://downloads.claude.ai/claude-code-releases/bootstrap.sh"],
         platforms: ["linux", "darwin"],
         scriptBinaryNames: ["claude"],
+        sharedDefaultBin: true,
         verify: Object.freeze({ mustInclude: ["downloads.claude.ai/claude-code-releases", "manifest.json"] })
       }),
       scriptMethod("script-powershell", "irm | iex", {
@@ -182,6 +191,7 @@ var OFFICIAL_TOOLS = Object.freeze([
         scriptFallbackUrls: ["https://downloads.claude.ai/claude-code-releases/bootstrap.ps1"],
         platforms: ["win32"],
         scriptBinaryNames: ["claude.exe"],
+        sharedDefaultBin: true,
         verify: Object.freeze({ mustInclude: ["downloads.claude.ai/claude-code-releases", "manifest.json"] })
       })
     ])
@@ -210,6 +220,9 @@ var OFFICIAL_TOOLS = Object.freeze([
         supportsInstallDir: true,
         installDirEnv: "CODEX_INSTALL_DIR",
         env: ["CODEX_INSTALL_DIR"],
+        installDirSubdir: "codex/bin",
+        legacySharedInstallDir: true,
+        sharedDefaultBin: true,
         scriptBinaryNames: ["codex"],
         verify: Object.freeze({ mustInclude: ["releases.openai.com/codex", "CODEX_INSTALL_DIR"] })
       }),
@@ -259,6 +272,8 @@ var OFFICIAL_TOOLS = Object.freeze([
         supportsInstallDir: true,
         installDirEnv: "MCODE_INSTALL_DIR",
         installDirSuffix: "bin",
+        installDirSubdir: "minimax-code",
+        legacySharedInstallDir: true,
         registryEnv: "MCODE_NPM_REGISTRY",
         env: ["MCODE_INSTALL_DIR", "MCODE_NPM_REGISTRY"],
         verify: Object.freeze({ mustInclude: ["MiniMax Code CLI", "@minimax-ai/code"] })
@@ -269,6 +284,8 @@ var OFFICIAL_TOOLS = Object.freeze([
         platforms: ["win32"],
         supportsInstallDir: true,
         installDirEnv: "MCODE_INSTALL_DIR",
+        installDirSubdir: "minimax-code",
+        legacySharedInstallDir: true,
         registryEnv: "MCODE_NPM_REGISTRY",
         env: ["MCODE_INSTALL_DIR", "MCODE_NPM_REGISTRY"],
         defaultScriptInstallDir: ".minimax-code",
@@ -307,6 +324,8 @@ var OFFICIAL_TOOLS = Object.freeze([
         supportsInstallDir: true,
         installDirEnv: "MIMOCODE_INSTALL_DIR",
         env: ["MIMOCODE_INSTALL_DIR"],
+        installDirSubdir: "mimo-code",
+        legacySharedInstallDir: true,
         scriptBinaryNames: ["mimo.exe"],
         verify: Object.freeze({ mustInclude: ["mimo.xiaomi.com", ".mimocode"] })
       })
@@ -336,6 +355,8 @@ var OFFICIAL_TOOLS = Object.freeze([
         supportsInstallDir: true,
         installDirEnv: "GROK_BIN_DIR",
         env: ["GROK_BIN_DIR"],
+        installDirSubdir: "grok-build",
+        legacySharedInstallDir: true,
         scriptBinaryNames: ["grok", "agent"],
         verify: Object.freeze({ mustInclude: ["Grok CLI installer", "x.ai/cli"] })
       }),
@@ -346,6 +367,8 @@ var OFFICIAL_TOOLS = Object.freeze([
         supportsInstallDir: true,
         installDirEnv: "GROK_BIN_DIR",
         env: ["GROK_BIN_DIR"],
+        installDirSubdir: "grok-build",
+        legacySharedInstallDir: true,
         scriptBinaryNames: ["grok.exe", "agent.exe", "grove.exe", "grove-fsmonitor.exe", "grove-credential.exe"],
         verify: Object.freeze({ mustInclude: ["Grok CLI installer", "x.ai/cli"] })
       })
@@ -428,6 +451,10 @@ var OFFICIAL_TOOLS = Object.freeze([
         installArg: ["--install-dir"],
         env: ["STEP_INSTALL_DIR", "STEP_RELEASE_BASE_URL"],
         supportsInstallDir: true,
+        // The installer replaces its runtime directories, including the entire
+        // node_modules tree on Windows. It must own a dedicated directory.
+        installDirSubdir: "stepcode",
+        legacySharedInstallDir: true,
         verify: Object.freeze({
           mustInclude: ["static-openapi.stepfun.com", "stepcode installer"],
           mustNotInclude: ["anomalyco/opencode"]
@@ -440,6 +467,8 @@ var OFFICIAL_TOOLS = Object.freeze([
         installArg: ["-InstallDir"],
         env: ["STEP_INSTALL_DIR", "STEP_RELEASE_BASE_URL"],
         supportsInstallDir: true,
+        installDirSubdir: "stepcode",
+        legacySharedInstallDir: true,
         verify: Object.freeze({
           mustInclude: ["static-openapi.stepfun.com", "stepcode"],
           mustNotInclude: ["anomalyco/opencode"]
@@ -12704,7 +12733,7 @@ var xterm_default = `/**
 `;
 
 // .dsh-plugin/client/host-version.mjs
-var ROUTER_CLIENT_VERSION = true ? "0.18.1" : "";
+var ROUTER_CLIENT_VERSION = true ? "0.18.2" : "";
 var STALE_HOST_MESSAGE = "\u63D2\u4EF6\u540E\u53F0\u7248\u672C\u8F83\u65E7\uFF0C\u8BF7\u5B8C\u5168\u9000\u51FA\u5E76\u91CD\u542F Harness\uFF08\u5305\u62EC\u6258\u76D8\u56FE\u6807\uFF09\u540E\u518D\u4F7F\u7528\u3002";
 function isMissingRemoteMethod(message) {
   const value = String(message ?? "");
@@ -13537,10 +13566,10 @@ function probeLabel(probe) {
 var INSTALL_SETTING_FIELDS = [
   {
     key: "toolInstallDir",
-    label: "\u7EDF\u4E00\u5B89\u88C5\u76EE\u5F55",
+    label: "\u7EDF\u4E00\u5B89\u88C5\u6839\u76EE\u5F55",
     fallback: "",
     placeholder: "\u7559\u7A7A = \u5404\u5382\u5546\u9ED8\u8BA4\u76EE\u5F55",
-    hint: "\u586B\u5199\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u4F8B\u5982 D:/AI/tools\u3002\u5404\u65B9\u5F0F\u7684\u5B9E\u9645\u76EE\u5F55\u4F1A\u663E\u793A\u5728\u5DE5\u5177\u547D\u4EE4\u65C1\uFF1B\u4E0D\u652F\u6301\u7EDF\u4E00\u76EE\u5F55\u7684\u65B9\u5F0F\u4F1A\u8BF4\u660E\u539F\u56E0\u3002"
+    hint: "\u4F8B\u5982 D:/AI/tools\u3002npm / pnpm \u4F7F\u7528\u8BE5\u6839\uFF1B\u5382\u5546\u811A\u672C\u4F7F\u7528\u5DE5\u5177\u4E13\u5C5E\u5B50\u76EE\u5F55\uFF0C\u5B9E\u9645\u5730\u5740\u89C1\u5DE5\u5177\u884C\u3002\u56FA\u5B9A\u5382\u5546\u5730\u5740\u7684\u65B9\u5F0F\u4F1A\u8BF4\u660E\u539F\u56E0\u3002"
   },
   {
     key: "toolNpmRegistry",
@@ -14876,8 +14905,8 @@ function RouterSettingsCard(props) {
     import_dsh_client_ui_primitives.SettingsValueField,
     {
       id: "model-router-tool-install-dir",
-      label: "\u7EDF\u4E00\u5B89\u88C5\u76EE\u5F55",
-      hint: "\u586B\u5199\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u7559\u7A7A\u4F7F\u7528\u5382\u5546\u9ED8\u8BA4\u4F4D\u7F6E\u3002npm / pnpm \u4F7F\u7528\u8BE5\u76EE\u5F55\u5B89\u88C5\uFF1B\u5382\u5546\u811A\u672C\u4E0D\u652F\u6301\u81EA\u5B9A\u4E49\u76EE\u5F55\u65F6\uFF0C\u5B98\u65B9\u5DE5\u5177\u9875\u4F1A\u663E\u793A\u5B9E\u9645\u76EE\u5F55\u4E0E\u539F\u56E0\u3002\u66F4\u65B0\u4F7F\u7528\u540C\u4E00\u5B89\u88C5\u65B9\u5F0F\u3001\u76EE\u5F55\u4E0E\u4E0B\u8F7D\u6E90\u3002",
+      label: "\u7EDF\u4E00\u5B89\u88C5\u6839\u76EE\u5F55",
+      hint: "\u586B\u5199\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u7559\u7A7A\u4F7F\u7528\u5382\u5546\u9ED8\u8BA4\u4F4D\u7F6E\u3002npm / pnpm \u5171\u7528\u8BE5\u6839\uFF1B\u53EF\u914D\u7F6E\u5382\u5546\u811A\u672C\u4F7F\u7528\u5DE5\u5177\u4E13\u5C5E\u5B50\u76EE\u5F55\uFF0C\u5B9E\u9645\u4F4D\u7F6E\u89C1\u5B98\u65B9\u5DE5\u5177\u9875\u3002\u66F4\u65B0\u590D\u7528\u6240\u9009\u65B9\u5F0F\u3001\u76EE\u5F55\u4E0E\u4E0B\u8F7D\u6E90\u3002",
       disabled,
       ...state.toolInstallDir,
       overriddenLabel: FIELD_COPY.overridden,

package/.dsh-plugin/shared/official-tool-executor.mjs

@@ -345,7 +345,7 @@ function nodeVersion(entry, pattern = /^v(\d+\.\d+\.\d+)/) {
   })
 }
 
-async function findNodeExecutable(workspace, minimum = [22, 19, 0], acceptedVersion = () => true) {
+export async function findNodeExecutable(workspace, minimum = [22, 19, 0], acceptedVersion = () => true) {
   await ensureNpmPrefixOnPath()
   const candidates = [process.execPath, ...pathDirectories().map(directory => join(directory, IS_WINDOWS ? 'node.exe' : 'node'))]
   for (const candidate of candidates) {
@@ -676,17 +676,17 @@ export function harnessSandboxBlocker(toolId, platform = process.platform) {
 /** Check the actual trusted launch entry without starting an account call. */
 export async function officialToolReadiness(toolId, workspace = process.cwd(), selectionOptions = {}) {
   const tool = getOfficialTool(toolId)
-  if (!tool) return { id: String(toolId), ready: false, reason: '工具不在固定官方注册表中。' }
+  if (!tool) return { id: String(toolId), supported: false, ready: false, reason: '工具不在固定官方注册表中。' }
   const capability = CAPABILITIES[tool.id]
-  if (!capability?.supported) return { id: tool.id, ready: false, reason: capability?.reason ?? '当前平台不支持托管执行。' }
+  if (!capability?.supported) return { id: tool.id, supported: false, ready: false, reason: capability?.reason ?? '当前平台不支持托管执行。' }
   try {
     const directory = await checkedWorkspace(workspace)
     const spec = await launchSpec(tool.id, directory, capability.modes[0], null, undefined, selectionOptions)
     return spec.unsupported
-      ? { id: tool.id, ready: false, reason: spec.unsupported }
-      : { id: tool.id, ready: true, source: spec.source, modes: capability.modes }
+      ? { id: tool.id, supported: true, ready: false, reason: spec.unsupported }
+      : { id: tool.id, supported: true, ready: true, source: spec.source, modes: capability.modes }
   } catch (error) {
-    return { id: tool.id, ready: false, reason: String(error?.message ?? error).slice(0, 300) }
+    return { id: tool.id, supported: true, ready: false, reason: String(error?.message ?? error).slice(0, 300) }
   }
 }
 

package/.dsh-plugin/shared/official-tool-registry.mjs

@@ -45,7 +45,7 @@ function scriptMethod(id, label, {
   shell, scriptUrl, verify, installArg = [], env = [], platforms,
   supportsInstallDir = false, installDirEnv = '', installDirSuffix = '',
   defaultScriptInstallDir, defaultScriptInstallDirEnv, scriptBinaryNames,
-  registryEnv, installDirSubdir, uninstallUnsupportedReason, scriptFallbackUrls,
+  registryEnv, installDirSubdir, legacySharedInstallDir = false, sharedDefaultBin = false, uninstallUnsupportedReason, scriptFallbackUrls,
 }) {
   return Object.freeze({
     id,
@@ -64,6 +64,8 @@ function scriptMethod(id, label, {
     installDirEnv,
     installDirSuffix,
     ...(installDirSubdir ? { installDirSubdir } : {}),
+    ...(legacySharedInstallDir ? { legacySharedInstallDir: true } : {}),
+    ...(sharedDefaultBin ? { sharedDefaultBin: true } : {}),
     ...(uninstallUnsupportedReason ? { uninstallUnsupportedReason } : {}),
     ...(defaultScriptInstallDir ? { defaultScriptInstallDir } : {}),
     ...(defaultScriptInstallDirEnv ? { defaultScriptInstallDirEnv } : {}),
@@ -96,6 +98,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         shell: 'bash', scriptUrl: 'https://code.kimi.com/kimi-code/install.sh',
         platforms: ['linux', 'darwin'], supportsInstallDir: true,
         installDirEnv: 'KIMI_INSTALL_DIR', installDirSuffix: 'bin',
+        installDirSubdir: 'kimi-code', legacySharedInstallDir: true,
         env: ['KIMI_INSTALL_DIR'],
         scriptBinaryNames: ['kimi'],
         verify: Object.freeze({ mustInclude: ['kimi-code', 'code.kimi.com/kimi-code'] }),
@@ -104,6 +107,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         shell: 'powershell', scriptUrl: 'https://code.kimi.com/kimi-code/install.ps1',
         platforms: ['win32'], supportsInstallDir: true,
         installDirEnv: 'KIMI_INSTALL_DIR', installDirSuffix: 'bin',
+        installDirSubdir: 'kimi-code', legacySharedInstallDir: true,
         env: ['KIMI_INSTALL_DIR'],
         scriptBinaryNames: ['kimi.exe'],
         verify: Object.freeze({ mustInclude: ['kimi-code', 'code.kimi.com/kimi-code'] }),
@@ -135,6 +139,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         scriptFallbackUrls: ['https://downloads.claude.ai/claude-code-releases/bootstrap.sh'],
         platforms: ['linux', 'darwin'],
         scriptBinaryNames: ['claude'],
+        sharedDefaultBin: true,
         verify: Object.freeze({ mustInclude: ['downloads.claude.ai/claude-code-releases', 'manifest.json'] }),
       }),
       scriptMethod('script-powershell', 'irm | iex', {
@@ -142,6 +147,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         scriptFallbackUrls: ['https://downloads.claude.ai/claude-code-releases/bootstrap.ps1'],
         platforms: ['win32'],
         scriptBinaryNames: ['claude.exe'],
+        sharedDefaultBin: true,
         verify: Object.freeze({ mustInclude: ['downloads.claude.ai/claude-code-releases', 'manifest.json'] }),
       }),
     ]),
@@ -167,6 +173,8 @@ export const OFFICIAL_TOOLS = Object.freeze([
         shell: 'sh', scriptUrl: 'https://chatgpt.com/codex/install.sh',
         platforms: ['linux', 'darwin'], supportsInstallDir: true,
         installDirEnv: 'CODEX_INSTALL_DIR', env: ['CODEX_INSTALL_DIR'],
+        installDirSubdir: 'codex/bin', legacySharedInstallDir: true,
+        sharedDefaultBin: true,
         scriptBinaryNames: ['codex'],
         verify: Object.freeze({ mustInclude: ['releases.openai.com/codex', 'CODEX_INSTALL_DIR'] }),
       }),
@@ -210,6 +218,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         shell: 'bash', scriptUrl: 'https://filecdn.minimax.chat/public/install.sh',
         platforms: ['linux', 'darwin'], supportsInstallDir: true,
         installDirEnv: 'MCODE_INSTALL_DIR', installDirSuffix: 'bin',
+        installDirSubdir: 'minimax-code', legacySharedInstallDir: true,
         registryEnv: 'MCODE_NPM_REGISTRY', env: ['MCODE_INSTALL_DIR', 'MCODE_NPM_REGISTRY'],
         verify: Object.freeze({ mustInclude: ['MiniMax Code CLI', '@minimax-ai/code'] }),
       }),
@@ -217,6 +226,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         shell: 'powershell', scriptUrl: 'https://filecdn.minimax.chat/public/install.ps1',
         platforms: ['win32'], supportsInstallDir: true,
         installDirEnv: 'MCODE_INSTALL_DIR',
+        installDirSubdir: 'minimax-code', legacySharedInstallDir: true,
         registryEnv: 'MCODE_NPM_REGISTRY', env: ['MCODE_INSTALL_DIR', 'MCODE_NPM_REGISTRY'],
         defaultScriptInstallDir: '.minimax-code',
         scriptBinaryNames: ['mcode.cmd', 'mcode.ps1', 'mcode-tools.cmd', 'mcode-tools.ps1'],
@@ -250,6 +260,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         shell: 'powershell', scriptUrl: 'https://mimo.xiaomi.com/install.ps1',
         platforms: ['win32'], supportsInstallDir: true,
         installDirEnv: 'MIMOCODE_INSTALL_DIR', env: ['MIMOCODE_INSTALL_DIR'],
+        installDirSubdir: 'mimo-code', legacySharedInstallDir: true,
         scriptBinaryNames: ['mimo.exe'],
         verify: Object.freeze({ mustInclude: ['mimo.xiaomi.com', '.mimocode'] }),
       }),
@@ -276,6 +287,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         shell: 'bash', scriptUrl: 'https://x.ai/cli/install.sh',
         platforms: ['linux', 'darwin'], supportsInstallDir: true,
         installDirEnv: 'GROK_BIN_DIR', env: ['GROK_BIN_DIR'],
+        installDirSubdir: 'grok-build', legacySharedInstallDir: true,
         scriptBinaryNames: ['grok', 'agent'],
         verify: Object.freeze({ mustInclude: ['Grok CLI installer', 'x.ai/cli'] }),
       }),
@@ -283,6 +295,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         shell: 'powershell', scriptUrl: 'https://x.ai/cli/install.ps1',
         platforms: ['win32'], supportsInstallDir: true,
         installDirEnv: 'GROK_BIN_DIR', env: ['GROK_BIN_DIR'],
+        installDirSubdir: 'grok-build', legacySharedInstallDir: true,
         scriptBinaryNames: ['grok.exe', 'agent.exe', 'grove.exe', 'grove-fsmonitor.exe', 'grove-credential.exe'],
         verify: Object.freeze({ mustInclude: ['Grok CLI installer', 'x.ai/cli'] }),
       }),
@@ -365,6 +378,9 @@ export const OFFICIAL_TOOLS = Object.freeze([
         installArg: ['--install-dir'],
         env: ['STEP_INSTALL_DIR', 'STEP_RELEASE_BASE_URL'],
         supportsInstallDir: true,
+        // The installer replaces its runtime directories, including the entire
+        // node_modules tree on Windows. It must own a dedicated directory.
+        installDirSubdir: 'stepcode', legacySharedInstallDir: true,
         verify: Object.freeze({
           mustInclude: ['static-openapi.stepfun.com', 'stepcode installer'],
           mustNotInclude: ['anomalyco/opencode'],
@@ -377,6 +393,7 @@ export const OFFICIAL_TOOLS = Object.freeze([
         installArg: ['-InstallDir'],
         env: ['STEP_INSTALL_DIR', 'STEP_RELEASE_BASE_URL'],
         supportsInstallDir: true,
+        installDirSubdir: 'stepcode', legacySharedInstallDir: true,
         verify: Object.freeze({
           mustInclude: ['static-openapi.stepfun.com', 'stepcode'],
           mustNotInclude: ['anomalyco/opencode'],

package/.dsh-plugin/shared/official-tools-runtime.mjs

@@ -26,6 +26,7 @@ import {
 import {
   expandInstallDir,
   resolveInstallLocation,
+  resolveLegacyScriptLocation,
   resolveInstallPlan,
   resolveUninstallPlan,
 } from './tool-install-preferences.mjs'
@@ -308,16 +309,22 @@ async function fetchOfficialMiniMaxInstaller(signal) {
 }
 
 export function minimaxOfficialInstallDir(selectedPreferences = {}, home = homedir(), existingRoot = '') {
-  return selectedPreferences.installDir || existingRoot || join(home, '.minimax-code')
+  return selectedPreferences.installDir
+    ? resolveInstallPlan(getOfficialTool('minimax-code'), 'script-powershell', selectedPreferences, { platform: 'win32', home }).installDir
+    : existingRoot || join(home, '.minimax-code')
 }
 
 /** Keep a discovered native installation in place when its legacy updater runs. */
 export function miniMaxFallbackPlan(selectedPreferences, beforeProbe, prefix, options = currentInstallOptions()) {
   const installDir = minimaxOfficialInstallDir(selectedPreferences, options.home,
     beforeProbe?.installed ? beforeProbe.installDir : '')
-  const executionPreferences = { ...selectedPreferences, installDir,
+  const executionPreferences = { ...selectedPreferences,
     methods: { ...selectedPreferences.methods, 'minimax-code': 'script-powershell' } }
-  return { plan: resolveInstallPlan(getOfficialTool('minimax-code'), 'script-powershell', executionPreferences, options), executionPreferences }
+  const plan = resolveInstallPlan(getOfficialTool('minimax-code'), 'script-powershell', selectedPreferences, options)
+  // installDir is already the discovered exclusive native root or the resolved
+  // child of the configured base. Never reinterpret it as another shared base.
+  return { plan: { ...plan, installDir, binDir: installDir,
+    env: { ...plan.env, MCODE_INSTALL_DIR: installDir } }, executionPreferences }
 }
 
 async function runOfficialMiniMaxInstaller(job, { reason } = {}) {
@@ -330,6 +337,7 @@ async function runOfficialMiniMaxInstaller(job, { reason } = {}) {
     pushLine(job, reason || '— npm 原生依赖未就绪；改用 MiniMax 官方 Windows 安装脚本（安装最新版）—')
     const { plan, executionPreferences } = miniMaxFallbackPlan(job.preferences, job.beforeProbe, '')
     const installDir = plan.installDir
+    await assertVendorInstallDirectory(job.tool, plan, job.preferences)
     await mkdir(installDir, { recursive: true })
     prefixRoot = await realpath(installDir)
     const script = await fetchOfficialMiniMaxInstaller(job.controller.signal)
@@ -354,6 +362,7 @@ async function runOfficialMiniMaxInstaller(job, { reason } = {}) {
       + 'Import-Module -Name $env:MODEL_ROUTER_UTILITY_MODULE -ErrorAction Stop; '
       + '& $env:MODEL_ROUTER_MINIMAX_INSTALL_SCRIPT'
     job.phase = 'installing'
+    await assertVendorInstallDirectory(job.tool, plan, job.preferences)
     const outcome = await runCapture(powershell,
       ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', command], {
         timeoutMs: INSTALL_TIMEOUT_MS, signal: job.controller.signal,
@@ -378,7 +387,7 @@ async function runOfficialMiniMaxInstaller(job, { reason } = {}) {
     probeCache.delete(job.tool.id)
     const probe = await probeToolWith(job.tool, defaultRunner, { preferences: executionPreferences, plan, cacheMs: 0 })
     job.postInstallProbe = probe
-    const readiness = await trustedExecutionReadiness(job.tool.id, { preferences: executionPreferences })
+    const readiness = await trustedExecutionReadiness(job.tool.id, { preferences: executionPreferences, plan })
     if (!probe.installed || !readiness.ready) {
       throw new Error(`官方安装器完成，但执行入口未通过 npm registry 摘要核验：${readiness.reason ?? probe.detail}`)
     }
@@ -516,6 +525,95 @@ export function vendorScriptInvocation(plan, scriptPath) {
   return { file: plan.shell === 'sh' ? 'sh' : 'bash', args: [scriptPath, ...directoryArgs] }
 }
 
+/** Resolve an existing ancestor too, so a missing child under a junction is checked. */
+async function canonicalInstallPath(path) {
+  let current = resolve(path)
+  const suffix = []
+  for (;;) {
+    try { return join(await realpath(current), ...suffix) }
+    catch (error) {
+      if (error.code !== 'ENOENT') throw error
+      const parent = dirname(current)
+      if (parent === current) throw error
+      suffix.unshift(current.slice(parent.length).replace(/^[\\/]+/, ''))
+      current = parent
+    }
+  }
+}
+
+/** A vendor owns its target; its cleanup must never touch a shared npm prefix. */
+export async function assertVendorInstallDirectory(tool, plan, selectedPreferences = {}, options = currentInstallOptions()) {
+  const directory = plan.installDir || plan.binDir
+  if (!directory) throw new Error('官方脚本安装目录无法确定，已停止安装。')
+  const canonical = await canonicalInstallPath(directory)
+  if (canonical.split(/[\\/]+/).some(part => ['node_modules', '.pnpm'].includes(part.toLowerCase()))) {
+    throw new Error('官方脚本不能写入 npm/pnpm 的包目录或共享存储目录。')
+  }
+  if (canonical === dirname(canonical) || canonical === await canonicalInstallPath(homedir())) {
+    throw new Error('官方脚本不能在磁盘根目录或用户主目录中执行。')
+  }
+  let codexOwnedRelease = false
+  if (tool.id === 'codex' && plan.shell === 'powershell') {
+    // The official Windows script keeps releases under the user's existing
+    // CODEX_HOME. CODEX_INSTALL_DIR selects only the visible bin junction.
+    // Respect that documented layout without redirecting the user's config.
+    const codexHome = options.env?.CODEX_HOME || join(options.home || homedir(), '.codex')
+    const homeRoot = await canonicalInstallPath(codexHome)
+    const releases = join(homeRoot, 'packages', 'standalone', 'releases')
+    const member = relative(releases, canonical)
+    const expectedVisible = !selectedPreferences.installDir || resolve(directory) === resolve(join(selectedPreferences.installDir, plan.method.installDirSubdir))
+    codexOwnedRelease = Boolean(expectedVisible && member && member !== '..' && !member.startsWith(`..${sep}`) && !isAbsolute(member))
+  }
+  if (selectedPreferences.installDir && plan.method?.supportsInstallDir) {
+    const base = await canonicalInstallPath(selectedPreferences.installDir)
+    const child = relative(base, canonical)
+    if (!codexOwnedRelease && (!child || child === '..' || child.startsWith(`..${sep}`) || isAbsolute(child))) {
+      throw new Error('官方脚本必须使用统一安装根目录下的工具专属子目录；已拒绝覆盖共享目录。')
+    }
+    const owner = plan.method.installDirSubdir?.split(/[\\/]+/)[0]
+    const ownedRoot = owner ? join(base, owner) : null
+    const ownedChild = ownedRoot ? relative(ownedRoot, canonical) : '..'
+    if (!codexOwnedRelease && (ownedChild === '..' || ownedChild.startsWith(`..${sep}`) || isAbsolute(ownedChild))) {
+      throw new Error('官方脚本的目录联接必须留在本工具专属目录中，不能指向其他工具。')
+    }
+  }
+  // These fixed/default bin installers replace only their own launcher, not
+  // another CLI's runtime directory. Sharing ~/.local/bin is intentional.
+  if (plan.method?.sharedDefaultBin && (!selectedPreferences.installDir || !plan.method.supportsInstallDir)) return
+  const targetStat = await stat(directory).catch(error => {
+    if (error.code === 'ENOENT') return null
+    throw error
+  })
+  if (targetStat && !targetStat.isDirectory()) throw new Error('官方脚本安装目标不是目录。')
+  const packageText = await readFile(join(directory, 'package.json'), 'utf8').catch(error => {
+    if (error.code === 'ENOENT') return null
+    throw error
+  })
+  if (packageText) {
+    let name
+    try { name = JSON.parse(packageText).name } catch { throw new Error('安装目录已有无法核验归属的 package.json，已停止运行官方脚本。') }
+    const ownPackage = tool.package || (tool.id === 'stepcode' ? '@step-harness/coding-agent' : '')
+    if (!name || name !== ownPackage) throw new Error('安装目录已有其他工具或项目的 package.json，已停止运行官方脚本。')
+  }
+  for (const other of OFFICIAL_TOOLS) {
+    if (other.id === tool.id) continue
+    const commandDirectories = [...new Set([directory, plan.binDir].filter(Boolean))]
+    const candidates = commandDirectories.flatMap(dir => (other.probeExecutables ?? []).flatMap(name =>
+      [name, `${name}.exe`, `${name}.cmd`, `${name}.ps1`].map(file => join(dir, file))))
+    if (other.package) {
+      candidates.push(join(directory, 'node_modules', ...other.package.split('/'), 'package.json'))
+      candidates.push(join(directory, 'lib', 'node_modules', ...other.package.split('/'), 'package.json'))
+    }
+    for (const path of candidates) {
+      const found = await stat(path).catch(error => {
+        if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return null
+        throw error
+      })
+      if (found?.isFile()) throw new Error(`安装目录中已有 ${other.label} 的文件，已拒绝运行可能替换其资源的官方脚本。请使用独立目录。`)
+    }
+  }
+}
+
 /**
  * Install one tool from its vendor script: download, verify, stage, run the
  * staged copy. The binary lands in a directory the plugin appends to its own
@@ -527,6 +625,7 @@ async function runVendorScriptInstallJob(job, plan) {
   let staging = null
   try {
     job.phase = 'preflight'
+    await assertVendorInstallDirectory(job.tool, plan, job.preferences)
     const before = await probeToolWith(job.tool, defaultRunner, { plan, preferences: job.preferences, cacheMs: 0 })
     job.beforeProbe = before
     const latestBefore = before.installed ? await latestVersions.lookup(job.tool, { fresh: true }).catch(() => null) : null
@@ -548,6 +647,7 @@ async function runVendorScriptInstallJob(job, plan) {
     await writeFile(scriptPath, isPowerShell ? `\uFEFF${source}` : source, 'utf8')
     const invocation = vendorScriptInvocation(plan, scriptPath)
     job.phase = 'installing'
+    await assertVendorInstallDirectory(job.tool, plan, job.preferences)
     pushLine(job, `$ ${plan.label}${invocation.args.length > 1 ? ` ${invocation.args.slice(1).join(' ')}` : ''}`)
     const outcome = await runCapture(invocation.file, invocation.args, {
       timeoutMs: INSTALL_TIMEOUT_MS,
@@ -827,6 +927,22 @@ async function probeUncached(tool, runner, { selectedPreferences, plan, fileExis
           bannerLine: banner.split('\n').find(Boolean)?.slice(0, 200) ?? '' }
       }
     }
+    const legacy = resolveLegacyScriptLocation(tool, selectedPlan.method, selectedPreferences, currentInstallOptions())
+    if (legacy) {
+      for (const executable of tool.probeExecutables) {
+        const names = IS_WINDOWS ? [`${executable}.exe`, `${executable}.cmd`, executable] : [executable]
+        for (const name of names) {
+          const target = join(legacy.dir, name)
+          if (!(await fileExists(target))) continue
+          // Discovery is read-only. The old root can never satisfy a new job's
+          // target probe or become a script update/uninstall destination.
+          return { id: tool.id, installed: false, version: null, status: 'legacy-install',
+            installDir: selectedPlan.installDir, binDir: selectedPlan.binDir,
+            legacyExecutablePath: target,
+            detail: `发现旧共享目录中的 ${tool.label}：${target}。请安装到独立目录 ${selectedPlan.installDir}；旧文件会保留，不能用旧目录覆盖其他工具。` }
+        }
+      }
+    }
     return { id: tool.id, installed: false, version: null, status: 'not-installed',
       installDir: selectedPlan.installDir, binDir: selectedPlan.binDir,
       detail: `未在所选安装目录 ${selectedPlan.binDir} 中找到官方命令。` }
@@ -1006,6 +1122,7 @@ function jobView(job) {
     exitCode: job.exitCode,
     timedOut: job.timedOut,
     error: job.error,
+    executionReadiness: job.executionReadiness ?? null,
     outputTail: [...job.outputTail],
     outputTruncated: job.outputTruncated,
     postInstallProbe: job.postInstallProbe,
@@ -1272,8 +1389,10 @@ export function installEnvironment(plan, base = process.env) {
   return env
 }
 
-/** Mark the job succeeded only when the fresh probe is installed, ready, and not still older. */
-async function finishVerifiedInstall(job, probe) {
+/** Installation and version must pass; verify execution only where an adapter supports it. */
+export async function finishVerifiedInstall(job, probe, {
+  lookupLatest = tool => latestVersions.lookup(tool), readinessFor = trustedExecutionReadiness,
+} = {}) {
   job.postInstallProbe = probe
   if (job.cancelRequested) { markCancelled(job); return true }
   if (!probe.installed) {
@@ -1282,14 +1401,15 @@ async function finishVerifiedInstall(job, probe) {
     job.error = `安装命令已完成，但重探测失败：${probe.detail}`
     return true
   }
-  const latest = await latestVersions.lookup(job.tool).catch(() => null)
+  const latest = await lookupLatest(job.tool).catch(() => null)
   if (latest?.version && versionStillOlder(probe.version, latest.version)) {
     failBecauseStillOlder(job, probe, latest.version)
     return true
   }
-  const readiness = await trustedExecutionReadiness(job.tool.id, { preferences: job.preferences, plan: job.plan })
+  const readiness = await readinessFor(job.tool.id, { preferences: job.preferences, plan: job.plan })
+  job.executionReadiness = readiness
   if (job.cancelRequested) { markCancelled(job); return true }
-  if (!readiness.ready) {
+  if (!readiness.ready && readiness.supported !== false) {
     if (IS_WINDOWS && job.tool.id === 'minimax-code' && !job.configured) {
       await runOfficialMiniMaxInstaller(job)
       return true
@@ -1300,8 +1420,11 @@ async function finishVerifiedInstall(job, probe) {
     return true
   }
   job.status = 'succeeded'
+  job.error = null
   job.finishedAt = new Date().toISOString()
-  pushLine(job, `— 已安装 ${job.tool.label} ${probe.version ?? ''}，官方执行入口已核验（新版本未经插件测试）—`)
+  pushLine(job, readiness.supported === false
+    ? `— 已安装 ${job.tool.label} ${probe.version ?? ''}，版本探测已通过；受限执行未启用：${readiness.reason} —`
+    : `— 已安装 ${job.tool.label} ${probe.version ?? ''}，官方执行入口已核验（新版本未经插件测试）—`)
   return true
 }
 
@@ -1378,11 +1501,13 @@ async function runInstallJob(installPlan, job) {
       // exactly the case the user pressed 修复 for.
       if (job.repair) {
         pushLine(job, `— ${job.tool.label} ${before.version} 已是最新版本，按修复流程重新安装 —`)
-      } else if (readiness.ready || !CAPABILITY_REPAIRABLE.has(job.tool.id)) {
+      } else if (readiness.ready || readiness.supported === false || !CAPABILITY_REPAIRABLE.has(job.tool.id)) {
         job.status = 'succeeded'
         job.finishedAt = new Date().toISOString()
         job.postInstallProbe = before
+        job.executionReadiness = readiness
         pushLine(job, `— ${job.tool.label} ${before.version} 已是最新版本，无需重复安装 —`)
+        if (readiness.supported === false) pushLine(job, `— 受限执行未启用：${readiness.reason} —`)
         return
       } else {
         pushLine(job, `— 已是最新版本 ${before.version}，但执行入口未就绪：${readiness.reason}；重新安装修复 —`)

package/.dsh-plugin/shared/task-executors.mjs

@@ -14,8 +14,11 @@
 import { spawn } from 'node:child_process'
 import { StringDecoder } from 'node:string_decoder'
 import { realpath, stat } from 'node:fs/promises'
-import { isAbsolute, win32 } from 'node:path'
+import { dirname, isAbsolute, join, relative, sep, win32 } from 'node:path'
 import { toolForProvider } from './official-tool-registry.mjs'
+import { findGlobalPackageEntries, findNodeExecutable, officialToolEntrySelection } from './official-tool-executor.mjs'
+import { installedModuleRoots } from './vendor-mimo-grok-adapter.mjs'
+import { CODE_FILE, npmAttestor } from './npm-attestation.mjs'
 import { normalizeExecutionPreference } from './model-profiles.mjs'
 import { BILLING_MODE_LABEL, billingPlan, detectQuotaExhaustion, vendorKey } from './subscription-billing.mjs'
 
@@ -666,6 +669,45 @@ function officialSuccess({ route, adapter, preference, answer, exitCode, version
   }
 }
 
+/** Gemini's Windows npm shim cannot be spawned without a shell; use its selected package bin. */
+export async function resolvePortableToolLaunch(adapter, workspace, {
+  selection = adapter?.id === 'gemini' ? officialToolEntrySelection('gemini') : null,
+  findEntries = findGlobalPackageEntries, findNode = findNodeExecutable, attestor = npmAttestor,
+} = {}) {
+  if (adapter?.id !== 'gemini') return { file: adapter.executable, args: [] }
+  const entries = await findEntries('@google/gemini-cli', 'gemini', 'dist/index.js', workspace, { selection })
+  const found = entries[0]
+  if (!found) return { reason: '未在所选安装目录中找到 @google/gemini-cli 的 gemini 入口；已回退模型目录 API。' }
+  const inside = (root, entry) => {
+    const part = relative(root, entry)
+    return part !== '' && part !== '..' && !part.startsWith(`..${sep}`) && !isAbsolute(part)
+  }
+  const roots = Array.isArray(selection?.plan?.packageModuleRoots) ? selection.plan.packageModuleRoots
+    : await installedModuleRoots(selection?.directories ?? [], { manager: selection?.plan?.manager })
+  const prefix = selection?.plan?.installDir ? await realpath(selection.plan.installDir).catch(() => null) : null
+  if (selection?.plan?.installDir && !prefix) return { reason: 'Gemini 所选安装根无法确认，已拒绝启动并回退模型目录 API。' }
+  let contained = false
+  for (const declared of roots) {
+    const boundary = await realpath(declared).catch(() => null)
+    const parent = await realpath(dirname(declared)).catch(() => null)
+    if (!boundary || !parent || !inside(parent, boundary) || (prefix && !inside(prefix, boundary))) continue
+    if (inside(boundary, found.packageRoot) && inside(found.packageRoot, found.entry)
+      && !inside(workspace, found.packageRoot) && found.packageRoot !== workspace) { contained = true; break }
+  }
+  if (!contained) return { reason: 'Gemini 包或入口离开了所选安装目录的包存储树，已拒绝启动并回退模型目录 API。' }
+  // The manifest controls bin/import resolution, so attest it as well as all
+  // package code. Checking name/version or a signed Node alone is insufficient.
+  const include = new RegExp(`${CODE_FILE.source}|(?:^|/)package\\.json$`, 'i')
+  const checked = await attestor.matchesPackage(found.packageRoot, '@google/gemini-cli', found.version, include)
+  if (!checked.ok) return { reason: `Gemini 安装文件未通过官方 npm 摘要核验：${checked.reason}；已回退模型目录 API。` }
+  const member = relative(found.packageRoot, found.entry).split(sep).join('/')
+  const entryChecked = await attestor.matches(found.entry, '@google/gemini-cli', found.version, member)
+  if (!entryChecked.ok) return { reason: `Gemini 入口未通过官方 npm 摘要核验：${entryChecked.reason}；已回退模型目录 API。` }
+  const node = await findNode(workspace, [20, 0, 0])
+  if (!node) return { reason: '未找到工作区外的 Node.js 20+ 可执行文件；已回退模型目录 API。' }
+  return { file: node, args: [found.entry], version: found.version, source: 'official-npm-registry-attested' }
+}
+
 /**
  * Run one assigned model task. `auto` and `official` try the vendor CLI first.
  * `api` skips the CLI. A missing tool or a failed process uses `apiFallback`.
@@ -673,6 +715,7 @@ function officialSuccess({ route, adapter, preference, answer, exitCode, version
 export async function executeAssignedTask({
   route, task, workspace, timeoutMs, signal, credentials = null, spawnImpl = spawn,
   apiFallback, runVerified = null, onChunk = null, skipOfficial = null, stopGraceMs, credentialMode = 'default',
+  resolvePortableLaunch = resolvePortableToolLaunch,
 } = {}) {
   const prompt = checkedTask(task)
   const preference = executionPreference(route)
@@ -734,7 +777,13 @@ export async function executeAssignedTask({
     })
   }
   const { env, secret, credentialSource } = childEnvironment(adapter, credentials, credentialMode)
-  const probe = await captureProcess(spawnImpl, adapter.executable, ['--version'], {
+  let launch
+  try { launch = await resolvePortableLaunch(adapter, cwd) } catch (error) {
+    launch = { reason: `${adapter.label} 的安装入口无法读取：${String(error?.message ?? error).slice(0, 200)}；已回退模型目录 API。` }
+  }
+  if (!launch?.file) return useApi(apiFallback, { route, task: prompt, signal, adapter, preference,
+    reason: launch?.reason ?? `${adapter.label} 未安装或无法启动，已回退模型目录 API。` })
+  const probe = await captureProcess(spawnImpl, launch.file, [...launch.args, '--version'], {
     cwd, env, stdin: '', timeoutMs: Math.min(PROBE_TIMEOUT_MS, timeout), signal, secret,
   })
   if (probe.spawnError || probe.cancelled || probe.timedOut || probe.exitCode !== 0) {
@@ -748,7 +797,7 @@ export async function executeAssignedTask({
     return useApi(apiFallback, { route, task: prompt, signal, adapter, preference, reason })
   }
   const args = adapter.buildArgs(modelId)
-  const run = await captureProcess(spawnImpl, adapter.executable, args, {
+  const run = await captureProcess(spawnImpl, launch.file, [...launch.args, ...args], {
     cwd, env, stdin: prompt, timeoutMs: timeout, signal, onChunk, secret,
     ...(Number.isSafeInteger(stopGraceMs) && stopGraceMs >= 10 && stopGraceMs <= STOP_GRACE_MS ? { stopGraceMs } : {}),
   })

package/.dsh-plugin/shared/tool-install-preferences.mjs

@@ -249,12 +249,17 @@ export function resolveInstallPlan(tool, methodId, preferences = {}, { platform
     const binDir = target
       ? (method.installDirSuffix ? joinPath(target, method.installDirSuffix) : target)
       : vendorScriptDir(tool, { home, env, method })
-    const notices = target ? [] : installDir
+    const notices = target && installDir && method.installDirSubdir
+      ? [`官方脚本在工具专属子目录 ${target} 维护资源，保护统一安装根中的其他工具。`]
+      : target ? [] : installDir
       ? [`${method.label} 无法使用自定义安装目录（官方脚本写死了安装路径），将安装到 ${vendorScriptDir(tool, { home, env, method })}。`]
       : []
     if (method.registryEnv === 'MCODE_NPM_REGISTRY' && preferences.registry && !minimaxScriptRegistry(preferences.registry)) {
       notices.push('MiniMax 官方脚本只接受 https://registry.npmjs.org/ 或 https://registry.npmmirror.com/，本次不改写它的 npm 源。')
     }
+    if (tool.id === 'codex' && method.id === 'script-powershell') {
+      notices.push('Codex Windows 脚本将命令目录联接到用户 Codex 资源目录；统一根控制命令位置，运行资源仍由厂商保存在用户目录。需要所有文件位于统一根时请选 npm/pnpm。')
+    }
     return {
       toolId: tool.id,
       method,
@@ -332,6 +337,20 @@ export function resolveInstallLocation(tool, method, preferences = {}, { home =
   return { kind: 'package-manager', dir: packageManagerBinDir(preferences?.installDir || '', { platform }), installDir: preferences?.installDir || '', binaries: [] }
 }
 
+/**
+ * Read-only compatibility location for scripts installed directly into a
+ * configured shared root before dedicated script directories were introduced.
+ * Never use this result as an install/update target: those installers can
+ * replace a whole runtime tree belonging to another tool.
+ */
+export function resolveLegacyScriptLocation(tool, method, preferences = {}, options = {}) {
+  if (!preferences.installDir || !method?.legacySharedInstallDir || !methodHonoursInstallDir(method)) return null
+  return {
+    ...resolveInstallLocation(tool, { ...method, installDirSubdir: undefined }, preferences, options),
+    legacySharedInstallDir: true,
+  }
+}
+
 function scriptEnv(method, { installDir, scriptUrl, registry }) {
   const env = {}
   if (installDir && method.installDirEnv) env[method.installDirEnv] = installDir

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.18.2 — 2026-10-12
+
+Stable patch under the npm latest tag. Upgrade and fully restart Harness before using Step install, repair or update.
+
+- Treat the configured install directory as a shared base. Configurable vendor scripts use dedicated tool subdirectories; npm/pnpm retain their existing shared prefix. Step's official installer replaces its entire runtime directories, so passing the shared root could delete every other npm package there.
+- Check script targets before download or execution: refuse shared roots, other tool/project manifests and commands, package stores, and junctions into another tool's tree. Codex's junction within its own release tree and intentional shared default launcher directories remain supported. Legacy script roots are discovered read-only and cannot satisfy or redirect new install jobs.
+- Separate successful version/install verification from unsupported restricted execution capabilities. Gemini, OpenCode and Step can be installed successfully while retaining explicit execution limitations; supported tools still require their original trusted-entry checks.
+- Resolve Windows Gemini through its selected npm/pnpm package bin and a verified Node executable. Check package-tree containment and official registry file digests before launch, and preserve API fallback when the selected copy is missing or fails verification.
+- Add regressions for destructive vendor runtime replacement, shared-prefix sentinels, junctions, legacy discovery, install capability status and Windows Gemini entry selection. Release notes record validation and the original-version recovery performed on the reported machine.
+
 ## 0.18.1 — 2026-10-12
 
 Stable patch under the npm latest tag. Fully quit Harness, including the tray or WebUI host process, and restart after upgrading.

package/README.md

@@ -1,9 +1,11 @@
 # Model Router · DeepSeek Harness Desktop
 
-Version: **0.18.1**. See [routing research](docs/ROUTING_RESEARCH.zh.md), [mathematical derivation and experiments](docs/ROUTING_DERIVATION_EXPERIMENTS.zh.md), and the [LiveBench evidence audit and validation protocol](docs/ROUTING_LIVEBENCH_VALIDATION.zh.md). The latest public 2026-06-25 score/cost tables are aggregates; its paired question-quality/cost matrix has not been obtained, and no real routing gain is claimed.
+Version: **0.18.2**. See [routing research](docs/ROUTING_RESEARCH.zh.md), [mathematical derivation and experiments](docs/ROUTING_DERIVATION_EXPERIMENTS.zh.md), and the [LiveBench evidence audit and validation protocol](docs/ROUTING_LIVEBENCH_VALIDATION.zh.md). The latest public 2026-06-25 score/cost tables are aggregates; its paired question-quality/cost matrix has not been obtained, and no real routing gain is claimed.
 
 A cost-aware model-routing workbench for **DeepSeek Harness Desktop**. Describe a task, compare your configured models, inspect the plan, and explicitly choose when to execute it.
 
+**0.18.2:** isolates configurable vendor scripts beneath the shared install root, preventing Step from replacing other tools’ npm packages. Gemini/OpenCode installation success is separate from restricted execution support; Windows Gemini uses its verified package entry through Node. Upgrade and restart Harness before updating Step.
+
 **0.18.1:** fixes install-method selection stuck on saving. Saved volatile settings now update Host install preferences immediately; command previews refresh separately from tool inspection.
 
 **0.18.0:** expands official vendor installer choices alongside npm/pnpm, preserves the configured install destination during updates, and verifies the target copy instead of an older PATH copy. MiniMax Windows scripts beginning with PowerShell `<# ... #>` help comments are accepted; HTML error pages remain rejected. Save unified install settings before installing or updating.
@@ -18,7 +20,7 @@ A cost-aware model-routing workbench for **DeepSeek Harness Desktop**. Describe
 
 **0.16.0:** [dynamic data and adaptive feedback](docs/ROUTING_ADAPTIVE_LEARNING.zh.md) adds opt-in public benchmark/curated fixed-USD pricing refresh and task-specific, time-decayed, shrinkage-regularized subjective utility. Objective proxy quality floors remain separate. Public sources default off; preferences are shared within one local DSH_HOME and limited to the latest 200 runs. This is not a universal vendor-price scraper or evidence of real quality–cost gains.
 
-Current version: **0.18.1** (`@ljwei-stak/dsh-model-router`). Its declared host compatibility is **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2**. The router and [GAL](https://github.com/Alice-Marx/deepseek-harness-galgame) have been independent plugins since 0.12.0.
+Current version: **0.18.2** (`@ljwei-stak/dsh-model-router`). Its declared host compatibility is **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2**. The router and [GAL](https://github.com/Alice-Marx/deepseek-harness-galgame) have been independent plugins since 0.12.0.
 
 **0.15.0 changes:** a four-tab workbench with routing advice directly below task planning, protection against stale execution previews, preserved spending totals across history pruning and retries, and a standalone mock UI preview for source development.
 
@@ -50,16 +52,16 @@ Generating a route recommendation is local: it does not start a vendor CLI or ma
 Open **Plugins → Add plugin** and enter:
 
 ```text
-@ljwei-stak/dsh-model-router@0.18.1
+@ljwei-stak/dsh-model-router@0.18.2
 ```
 
-Use the official HTTPS npm source `https://registry.npmjs.org/` when a mirror lacks that exact version. Enable the plugin, then fully quit Harness (including its tray process) and restart it. Plugin details should show **0.18.1** and the sidebar should contain **模型路由** (Model Router). A global `npm install -g` alone does not register a Desktop plugin.
+Use the official HTTPS npm source `https://registry.npmjs.org/` when a mirror lacks that exact version. Enable the plugin, then fully quit Harness (including its tray process) and restart it. Plugin details should show **0.18.2** and the sidebar should contain **模型路由** (Model Router). A global `npm install -g` alone does not register a Desktop plugin.
 
 You can instead install a local `.tgz` archive or its extracted inner `package` directory through the plugin manager. Both must contain `package.json` and `.dsh-plugin`. See [releases](https://github.com/Alice-Marx/dsh-model-router/releases) for archived builds, or build your own checkout below.
 
 ### Upgrade from the old package name
 
-The old name `@ljwei-stak/model-router-galgame` ended at 0.13.0. Remove that plugin entry while retaining your profile/application data, then add `@ljwei-stak/dsh-model-router@0.18.1`. Do not keep both entries installed: they share the internal plugin id `model-router-galgame` and tool names. The retained id lets existing router settings and history carry over.
+The old name `@ljwei-stak/model-router-galgame` ended at 0.13.0. Remove that plugin entry while retaining your profile/application data, then add `@ljwei-stak/dsh-model-router@0.18.2`. Do not keep both entries installed: they share the internal plugin id `model-router-galgame` and tool names. The retained id lets existing router settings and history carry over.
 
 For the combined 0.11.x package, back up the profile and export the GAL saves you want to preserve before upgrading. Story playback, artwork, music and saves now belong to the independent `@ljwei-stak/dsh-galgame` package. The detailed save limitations are in [MIGRATION.md](docs/archive/MIGRATION.md).
 

package/README.zh.md

@@ -1,9 +1,11 @@
 # Model Router · DeepSeek Harness 模型路由插件
 
-版本：**0.18.1**。选模求解器概览见[路由研究说明](docs/ROUTING_RESEARCH.zh.md)；公式、条件证明与实验见[数学推导与实验记录](docs/ROUTING_DERIVATION_EXPERIMENTS.zh.md)。[LiveBench 最新证据与验证协议](docs/ROUTING_LIVEBENCH_VALIDATION.zh.md)已核查 2026-06-25 聚合评分/费用；最新逐题质量—费用矩阵尚未取得，不声称真实路由收益。
+版本：**0.18.2**。选模求解器概览见[路由研究说明](docs/ROUTING_RESEARCH.zh.md)；公式、条件证明与实验见[数学推导与实验记录](docs/ROUTING_DERIVATION_EXPERIMENTS.zh.md)。[LiveBench 最新证据与验证协议](docs/ROUTING_LIVEBENCH_VALIDATION.zh.md)已核查 2026-06-25 聚合评分/费用；最新逐题质量—费用矩阵尚未取得，不声称真实路由收益。
 
 为 **DeepSeek Harness Desktop** 提供任务规划、成本感知的模型分配和官方工具执行工作台。输入任务，比较已配置模型，审阅计划，再明确选择是否执行。
 
+**0.18.2**：厂商脚本使用统一根目录下的工具专属子目录，修复 Step 安装替换其他 npm 工具包的问题。Gemini/OpenCode 安装成功与受限执行能力分别显示；Windows Gemini 使用核验后的包入口通过 Node 启动。先升级并重启 Harness，再更新 Step。
+
 **0.18.1**：修复安装方式切换卡在“保存方式中…”的问题。已保存设置立即同步到宿主安装配置，命令预览单独刷新；工具体检延迟时仍能继续切换方式。
 
 **0.18.0**：补齐厂商提供的 curl/irm 安装方式，安装与更新复用已保存的目录、方式和下载源，并核验目标目录里的版本。修复 MiniMax 官方 PowerShell 脚本以 `<# ... #>` 帮助注释开头时被误判为 HTML 的问题。统一安装设置改为明确保存后生效。
@@ -18,7 +20,7 @@
 
 **0.16.0 新增**：[动态数据与持续反馈](docs/ROUTING_ADAPTIVE_LEARNING.zh.md)：可选公开价格/LiveBench快照刷新；按任务类型、时间衰减和低样本收缩调整个人偏好，质量门槛独立保留。设置在“预算与安全”，公开源默认关闭；价格源需提供按官方文档核对的固定USD单价JSON，不是通用官网抓价器。本地DSH_HOME共享、最近200运行窗口，暂无真实收益证明。
 
-当前版本为 **0.18.1**，包名为 `@ljwei-stak/dsh-model-router`；声明兼容的宿主为 **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2**。自 0.12.0 起，路由与 [GAL](https://github.com/Alice-Marx/deepseek-harness-galgame) 已拆成两个独立插件。
+当前版本为 **0.18.2**，包名为 `@ljwei-stak/dsh-model-router`；声明兼容的宿主为 **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2**。自 0.12.0 起，路由与 [GAL](https://github.com/Alice-Marx/deepseek-harness-galgame) 已拆成两个独立插件。
 
 **0.15.0 更新**：工作台分为四页，路由建议紧接任务规划展示；执行输入变化时丢弃旧预览；裁剪历史或重试后仍保留费用累计；源码开发新增独立模拟 UI 预览。
 
@@ -50,16 +52,16 @@
 打开 **插件 → 添加插件**，填写：
 
 ```text
-@ljwei-stak/dsh-model-router@0.18.1
+@ljwei-stak/dsh-model-router@0.18.2
 ```
 
-镜像缺少该精确版本时使用官方 HTTPS npm 源 `https://registry.npmjs.org/`。安装并启用后，完全退出 Harness（包括托盘进程）再启动。插件详情应显示 **0.18.1**，侧栏出现**模型路由**。仅运行全局 `npm install -g` 不会把插件注册到桌面版 profile。
+镜像缺少该精确版本时使用官方 HTTPS npm 源 `https://registry.npmjs.org/`。安装并启用后，完全退出 Harness（包括托盘进程）再启动。插件详情应显示 **0.18.2**，侧栏出现**模型路由**。仅运行全局 `npm install -g` 不会把插件注册到桌面版 profile。
 
 也可在插件管理器填写本地 `.tgz` 文件的绝对路径，或解压后的内层 `package` 目录；其中应包含 `package.json` 与 `.dsh-plugin`。[历史发布页](https://github.com/Alice-Marx/dsh-model-router/releases)提供归档；已克隆源码的开发方式见下文。
 
 ### 从旧包名升级
 
-`@ljwei-stak/model-router-galgame` 的最后版本为 0.13.0。保留 profile 与应用数据，移除旧插件条目，再添加 `@ljwei-stak/dsh-model-router@0.18.1`。不要同时安装两个包：它们共用内部插件 id `model-router-galgame` 与工具名；id 保留使已有路由设置和执行历史能够延续。
+`@ljwei-stak/model-router-galgame` 的最后版本为 0.13.0。保留 profile 与应用数据，移除旧插件条目，再添加 `@ljwei-stak/dsh-model-router@0.18.2`。不要同时安装两个包：它们共用内部插件 id `model-router-galgame` 与工具名；id 保留使已有路由设置和执行历史能够延续。
 
 从 0.11.x 合并版迁移时，先备份 profile 并导出希望保留的 GAL 进度。剧情、立绘、音乐、自由模式和存档属于独立 `@ljwei-stak/dsh-galgame` 插件。导出范围及同 profile 迁移的限制见 [MIGRATION.md](docs/archive/MIGRATION.md)。
 

package/docs/INSTALLATION_GUIDE.zh.md

@@ -2,7 +2,7 @@
 
 模型路由从 **0.12.0** 起独立发布；GAL 是新的 **0.1.0** 插件。两者均声明支持官方 **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2**，可分别安装和更新。
 
-当前路由正式版为 **0.18.1**。本版修复安装方式切换卡在“保存方式中…”及宿主继续使用旧安装设置的问题。方式保存和命令预览不再等待全量工具体检。保留 0.18.0 的官方安装方法、MiniMax 脚本校验和统一目录改进。统一安装设置需点击保存，再选择工具的安装方式。公开数据默认关闭；安装时选择下方精确版本。
+当前路由正式版为 **0.18.2**。本版修复 Step 安装覆盖共享 npm 包目录的问题：统一目录是安装根，厂商脚本使用工具专属子目录。Gemini 安装状态与受限执行能力分开，Windows 无界面启动使用核验后的包入口。先升级并完全退出 Harness 后重启，再使用 Step 更新/修复。保留 0.18.0 的官方安装方法、MiniMax 脚本校验和统一目录改进。统一安装设置需点击保存，再选择工具的安装方式。公开数据默认关闭；安装时选择下方精确版本。
 
 [路由 README](../README.zh.md) · [迁移说明](archive/MIGRATION.md) · [独立 GAL README](https://github.com/Alice-Marx/deepseek-harness-galgame#readme)
 
@@ -10,7 +10,7 @@
 
 | 需求 | 添加插件输入框 | 安装后的入口 |
 | --- | --- | --- |
-| 分析复杂度、按质量和费用选模型、调用官方工具 | `@ljwei-stak/dsh-model-router@0.18.1` | 模型路由 |
+| 分析复杂度、按质量和费用选模型、调用官方工具 | `@ljwei-stak/dsh-model-router@0.18.2` | 模型路由 |
 | 剧情、立绘、音乐、存档、自由对话 | `@ljwei-stak/dsh-galgame@0.1.0` | Gal 模块 |
 | 两者都要 | 分别安装上面两个包 | 模型路由 + Gal 模块 |
 
@@ -24,7 +24,7 @@
 2. 在“包名、GitHub 仓库地址或本地目录路径”输入框填一个完整包名，例如：
 
    ```text
-   @ljwei-stak/dsh-model-router@0.18.1
+   @ljwei-stak/dsh-model-router@0.18.2
    ```
 
    只想安装 GAL 时填写：
@@ -40,7 +40,7 @@
    ```
 
 4. 核对预览的包名、版本和宿主兼容信息，安装并启用。完全退出 Harness（包括托盘进程）再启动，确保 Host 加载新代码。
-5. 检查插件详情与侧边栏：路由应为 **0.18.1 / 模型路由**；GAL 应为 **0.1.0 / Gal 模块**。仅装路由时没有 GAL 入口是预期行为。
+5. 检查插件详情与侧边栏：路由应为 **0.18.2 / 模型路由**；GAL 应为 **0.1.0 / Gal 模块**。仅装路由时没有 GAL 入口是预期行为。
 
 普通用户无需 `npm install -g`，该命令不会把插件注册到当前 Harness profile。
 
@@ -48,13 +48,13 @@
 
 进入对应 Release 下载 `.tgz`：
 
-- [模型路由 Releases](https://github.com/Alice-Marx/dsh-model-router/releases)（也可运行 `npm pack @ljwei-stak/dsh-model-router@0.18.1` 获取同一安装包）
+- [模型路由 Releases](https://github.com/Alice-Marx/dsh-model-router/releases)（也可运行 `npm pack @ljwei-stak/dsh-model-router@0.18.2` 获取同一安装包）
 - [独立 GAL v0.1.0](https://github.com/Alice-Marx/deepseek-harness-galgame/releases/tag/v0.1.0)
 
 在“添加插件”填写下载文件的**绝对路径**，例如：
 
 ```text
-D:\Plugins\ljwei-stak-dsh-model-router-0.18.1.tgz
+D:\Plugins\ljwei-stak-dsh-model-router-0.18.2.tgz
 ```
 
 ```text
@@ -64,7 +64,7 @@ D:\Plugins\ljwei-stak-dsh-galgame-0.1.0.tgz
 如附有 `.sha256` 文件，用 PowerShell 计算并比较摘要：
 
 ```powershell
-Get-FileHash -Algorithm SHA256 -LiteralPath 'D:\Plugins\ljwei-stak-dsh-model-router-0.18.1.tgz'
+Get-FileHash -Algorithm SHA256 -LiteralPath 'D:\Plugins\ljwei-stak-dsh-model-router-0.18.2.tgz'
 Get-FileHash -Algorithm SHA256 -LiteralPath 'D:\Plugins\ljwei-stak-dsh-galgame-0.1.0.tgz'
 ```
 
@@ -74,7 +74,7 @@ Get-FileHash -Algorithm SHA256 -LiteralPath 'D:\Plugins\ljwei-stak-dsh-galgame-0
 
 1. 在旧合并插件的 GAL 播放器导出需要保留的剧情进度，并备份整个 Harness profile。每份 JSON 仅保存**当前剧情状态**，不含所有手动槽、设置、已读记录或本地音乐；重要槽位可依次读档再导出。
 2. 在**同一个 profile**安装独立 `@ljwei-stak/dsh-galgame@0.1.0`。
-3. 0.13.0 起包名改为 `@ljwei-stak/dsh-model-router`（旧包名最后版本为 0.13.0，内容相同，之后不再更新）：在插件管理器卸载原 `@ljwei-stak/model-router-galgame`（保留 profile 与应用数据），再添加 `@ljwei-stak/dsh-model-router@0.18.1`。不要两个同时安装（条目 id 与工具名相同）；条目 id 未变，路由设置与执行记录会保留。完成两项更新后再玩剧情，避免同时操作旧合并入口和新入口。
+3. 0.13.0 起包名改为 `@ljwei-stak/dsh-model-router`（旧包名最后版本为 0.13.0，内容相同，之后不再更新）：在插件管理器卸载原 `@ljwei-stak/model-router-galgame`（保留 profile 与应用数据），再添加 `@ljwei-stak/dsh-model-router@0.18.2`。不要两个同时安装（条目 id 与工具名相同）；条目 id 未变，路由设置与执行记录会保留。完成两项更新后再玩剧情，避免同时操作旧合并入口和新入口。
 4. 现在路由与 GAL 各有一个入口。独立 GAL 沿用旧存档 localStorage 键，核对当前进度和三槽；更换 profile 或进度未恢复时，先切换到匹配剧目，再导入 JSON 备份。
 5. 后续分别更新需要的插件；只用路由可以不启用或不安装 GAL。保留 profile 与应用数据，卸载插件时不要清理故事数据。
 
@@ -82,7 +82,7 @@ GAL 核心只包含**《回声之城·正篇》**与**《旧城迁移篇：未
 
 ## 5. 模型路由第一次使用
 
-工作台自 0.15.0 起分成**任务与执行、模型配置、官方工具、预算与安全**四页；0.18.1 沿用该布局。切换页面保留安装任务、终端会话和未完成的输入。
+工作台自 0.15.0 起分成**任务与执行、模型配置、官方工具、预算与安全**四页；0.18.2 沿用该布局。切换页面保留安装任务、终端会话和未完成的输入。
 
 1. 在 Harness 官方**模型**页配置供应商、模型与凭据。插件读取准确的 `provider/model` 目录，模型档案不保存 API Key。
 2. 在**模型配置**刷新目录，逐条填写自报质量评分、核对过的输入/输出单价（USD / 百万 token）和擅长方向；缺价留空。可选 `cliModel` 必须是该厂商 CLI 已验证接受的名字。可选 LiveBench 名称须准确对应版本与推理档位；它是用户确认的映射，不自动证明实际执行档位。
@@ -114,7 +114,7 @@ GAL 核心只包含**《回声之城·正篇》**与**《旧城迁移篇：未
 | 检查 | 预期 |
 | --- | --- |
 | 宿主版本 | 0.2.0-rc.1 或 0.2.0-rc.2；包括 `rc` 后缀。 |
-| 路由独立安装 | 0.18.1 详情、模型路由入口、目录和模型档案可用；不出现旧合并 GAL 入口。 |
+| 路由独立安装 | 0.18.2 详情、模型路由入口、目录和模型档案可用；不出现旧合并 GAL 入口。 |
 | GAL 独立安装 | 0.1.0 详情、Gal 模块入口、标题与两部核心剧情可用；不要求安装路由。 |
 | 共同安装 | 两个入口各一份，路由工具和 GAL 播放器均能使用。 |
 | 存档迁移 | 同 profile 可读旧键；跨 profile 用匹配剧目 JSON 导入；旧篇目的数据不覆盖。 |
@@ -125,11 +125,11 @@ GAL 核心只包含**《回声之城·正篇》**与**《旧城迁移篇：未
 | 动态公开数据 | 默认关闭；自行启用后核对快照版本、校验时间及失败/过期状态；人工单价仍优先。 |
 | 可编辑执行 | 在干净测试仓库核对审批、隔离工作区、补丁整合、厂商实际模型与计费。 |
 
-历史 0.15.0 的自动测试验证为 220 项通过、3 项 Windows 平台跳过；组件 UI 预览检查使用模拟数据。**0.18.1 的发布验证见[更新记录](CHANGELOG.md)**，不把模拟公开源/模型流和组件预览当作真实付费调用或 Harness Desktop 端到端验收；上表中的实际安装、账号和工作区检查仍需在使用环境中完成。
+历史 0.15.0 的自动测试验证为 220 项通过、3 项 Windows 平台跳过；组件 UI 预览检查使用模拟数据。**0.18.2 的发布验证见[更新记录](CHANGELOG.md)**，不把模拟公开源/模型流和组件预览当作真实付费调用或 Harness Desktop 端到端验收；上表中的实际安装、账号和工作区检查仍需在使用环境中完成。
 
 ## 8. 开发者从完整源码构建
 
-路由需要 Node.js **22.19+** 与 **pnpm 10.34.6**。从完整源码仓库根目录构建；复现正式版 0.18.1 时检出对应发布标签。旧版（如 0.15.0）标签保留其当时内容。运行：
+路由需要 Node.js **22.19+** 与 **pnpm 10.34.6**。从完整源码仓库根目录构建；复现正式版 0.18.2 时检出对应发布标签。旧版（如 0.15.0）标签保留其当时内容。运行：
 
 ```powershell
 pnpm install --frozen-lockfile --strict-peer-dependencies

package/docs/WORKBENCH_USER_GUIDE.zh.md

@@ -1,6 +1,6 @@
 # 模型路由工作台：配置、规划与实际执行
 
-适用版本：正式版 `@ljwei-stak/dsh-model-router@0.18.1`；声明兼容 DeepSeek Harness Desktop `0.2.0-rc.1 / 0.2.0-rc.2`。安装与开发见[中文 README](../README.zh.md)，旧包迁移见[迁移说明](archive/MIGRATION.md)。
+适用版本：正式版 `@ljwei-stak/dsh-model-router@0.18.2`；声明兼容 DeepSeek Harness Desktop `0.2.0-rc.1 / 0.2.0-rc.2`。安装与开发见[中文 README](../README.zh.md)，旧包迁移见[迁移说明](archive/MIGRATION.md)。
 
 0.15.0 新增四页布局、规划后直接展示路由建议、执行输入变化时丢弃旧预览，以及历史裁剪和重试后的费用累计保留。源码中的独立 UI 预览使用模拟数据，用于组件检查，不代表真实账号调用或桌面端到端验收。
 
@@ -113,11 +113,13 @@
 
 | 设置 | 作用 | 限制 |
 | --- | --- | --- |
-| 统一安装目录 | 所有一键安装的目标目录 | 必须是绝对路径，不能是磁盘或共享根目录；留空=各厂商默认位置 |
+| 统一安装根目录 | npm/pnpm 使用该根；可配置厂商脚本使用各工具子目录 | 必须是绝对路径，不能是磁盘或共享根目录；留空=各厂商默认位置 |
 | npm 源地址 | npm / pnpm 方式的下载源 | 必须 https，可填国内镜像 |
 | 安装脚本源覆盖 | 按工具 ID 指定厂商安装脚本的镜像 | JSON，键是官方工具 ID，值是 https 链接 |
 | 允许 curl / irm 安装脚本 | 是否允许执行厂商安装脚本 | 关闭后只剩 npm / pnpm |
 
+0.18.2 起，以 `D:/AI/tools` 为根时，Step 脚本安装到 `D:/AI/tools/stepcode`，MiniMax 脚本安装到 `D:/AI/tools/minimax-code`，其他可配置脚本同样使用专属子目录。厂商脚本可能替换整个运行资源目录，不能直接交给共享 npm 根。旧共享目录中的文件仅供识别并保留，不用于新脚本更新；可重新安装到独立目录。升级并重启 Host 后再操作 Step。
+
 几个容易踩的点：
 
 - **不同工具对"自定义目录"的支持不一样。** npm 使用 `--prefix`；pnpm 使用自身的全局包目录、命令目录和存储目录参数。阶跃的安装脚本接受 `--install-dir`（Windows 上是 `-InstallDir`），也生效。OpenCode 的官方脚本把路径写死成 `~/.opencode/bin`，**无法**接受自定义目录——如果设置里填了目录，它的行内会明确写出将装到哪里。
@@ -132,20 +134,20 @@ MiniMax 官方 Windows 脚本的 `<# ... #>` 是 PowerShell 帮助注释。0.18.
 
 | 工具 | npm / pnpm | curl（Linux / macOS） | irm（Windows） | 统一目录支持 |
 | --- | --- | --- | --- | --- |
-| Kimi Code | ✓ | bash | PowerShell | 支持；脚本命令在目录的 bin 子目录 |
+| Kimi Code | ✓ | bash | PowerShell | 脚本使用根目录/kimi-code/bin |
 | Claude Code | ✓ | bash | PowerShell | 包管理器支持；脚本固定在 ~/.local/bin |
 | Codex | ✓ | sh | PowerShell | 支持；Windows 脚本使用统一目录/codex/bin，避免把共享目录变成目录联接 |
-| MiniMax Code | ✓ | bash | PowerShell | 支持 |
+| MiniMax Code | ✓ | bash | PowerShell | 脚本使用根目录/minimax-code |
 | MiMo Code | ✓ | bash | PowerShell | 包管理器与 Windows 脚本支持；Unix 脚本固定 ~/.mimocode/bin |
-| Grok Build | ✓ | bash | PowerShell | 支持 |
+| Grok Build | ✓ | bash | PowerShell | 脚本使用根目录/grok-build |
 | Gemini CLI | ✓ | — | — | 支持 |
 | OpenCode | ✓ | bash | — | 包管理器支持；脚本固定 ~/.opencode/bin |
-| Step Code | — | bash | PowerShell | 支持 |
+| Step Code | — | bash | PowerShell | 脚本使用根目录/stepcode |
 | ZCode | — | — | — | 官方 Windows 桌面安装窗口中选择 |
 
 “—”表示当前厂商未提供相应渠道。每个工具的安装方式下拉框保留所有声明方式，并说明本机不适用的原因。MiniMax 官方脚本只接受官方 npm 源或 npmmirror；其他 npm 镜像请选 npm/pnpm 方式。
 
-脚本安装成功只表示命令和版本已确认。Kimi、MiMo、Grok 的独立原生脚本安装目前没有插件需要的 npm 文件摘要证明，自动任务会显示执行入口未就绪并回退到 API；npm/pnpm 安装保留可核验的执行路径。Windows Codex 脚本使用目录联接，插件不提供通用文件删除卸载；请按官方方式移除原生安装。
+安装成功只表示所选目录的命令入口和版本已确认，不代表工具支持受限执行。Gemini 使用核验后的 npm/pnpm 包入口无界面执行；OpenCode、Step 当前可安装和在终端中使用，尚不支持受限任务。缺少这类能力不再报安装失败。Kimi、MiMo、Grok 的独立原生脚本安装目前没有插件需要的 npm 文件摘要证明，自动任务会显示执行入口未就绪并回退到 API；npm/pnpm 安装保留可核验的执行路径。Windows Codex 脚本使用目录联接，插件不提供通用文件删除卸载；请按官方方式移除原生安装。
 
 ### 安装方式的会话与 Agent 等价物
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ljwei-stak/dsh-model-router",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "type": "module",
   "description": "Model Router for official DeepSeek Harness Desktop: cost-aware task routing, dependent work packages and official vendor CLI discovery, installation and execution. GAL is available separately as @ljwei-stak/dsh-galgame.",
   "repository": {
@@ -103,7 +103,7 @@
     "experiment:routing-summary": "node scripts/summarize-routing-search.mjs",
     "experiment:routing-adaptive": "node scripts/adaptive-routing-study.mjs",
     "audit:livebench": "node scripts/livebench-aggregate-audit.mjs",
-    "test": "node --test tests/adaptive-*.test.mjs tests/dynamic-data.test.mjs tests/router.test.mjs tests/routing-optimizer.test.mjs tests/routing-evaluation.test.mjs tests/routing-paired-statistics.test.mjs tests/routing-selftest-tools.test.mjs tests/livebench-aggregate-audit.test.mjs tests/livebench-prior-study.test.mjs tests/routing-search-experiment.test.mjs tests/routing-regression-study.test.mjs tests/routing-search-summary.test.mjs tests/harness-*.test.mjs tests/official-tools.test.mjs tests/official-team-runtime.test.mjs tests/model-profiles.test.mjs tests/model-profile-editor.test.mjs tests/tool-install-state.test.mjs tests/tool-install-sdk-ui.test.mjs tests/vendor-adapters.test.mjs tests/desktop-compat.test.mjs tests/plugin-split.test.mjs tests/install-settings-host.test.mjs tests/task-executors.test.mjs tests/tool-install-preferences.test.mjs tests/roadmap.test.mjs tests/insights-state.test.mjs tests/billing-team-ledger.test.mjs tests/subscription-billing.test.mjs tests/subscription-host.test.mjs tests/test-pass-regressions.test.mjs tests/roadmap-gaps.test.mjs tests/cordis-inject.test.mjs tests/cli-terminal.test.mjs tests/cli-terminal-gateway.test.mjs tests/latest-versions.test.mjs tests/vendor-installer-validation.test.mjs tests/install-entry-selection.test.mjs",
+    "test": "node --test tests/adaptive-*.test.mjs tests/dynamic-data.test.mjs tests/router.test.mjs tests/routing-optimizer.test.mjs tests/routing-evaluation.test.mjs tests/routing-paired-statistics.test.mjs tests/routing-selftest-tools.test.mjs tests/livebench-aggregate-audit.test.mjs tests/livebench-prior-study.test.mjs tests/routing-search-experiment.test.mjs tests/routing-regression-study.test.mjs tests/routing-search-summary.test.mjs tests/harness-*.test.mjs tests/official-tools.test.mjs tests/official-team-runtime.test.mjs tests/model-profiles.test.mjs tests/model-profile-editor.test.mjs tests/tool-install-state.test.mjs tests/tool-install-sdk-ui.test.mjs tests/vendor-adapters.test.mjs tests/desktop-compat.test.mjs tests/plugin-split.test.mjs tests/install-settings-host.test.mjs tests/task-executors.test.mjs tests/tool-install-preferences.test.mjs tests/roadmap.test.mjs tests/insights-state.test.mjs tests/billing-team-ledger.test.mjs tests/subscription-billing.test.mjs tests/subscription-host.test.mjs tests/test-pass-regressions.test.mjs tests/roadmap-gaps.test.mjs tests/cordis-inject.test.mjs tests/cli-terminal.test.mjs tests/cli-terminal-gateway.test.mjs tests/latest-versions.test.mjs tests/vendor-installer-validation.test.mjs tests/install-entry-selection.test.mjs tests/script-directory-safety.test.mjs",
     "prepack": "node scripts/prepack.mjs",
     "pack:local": "npm pack --pack-destination dist"
   },