@ljwei-stak/dsh-model-router 0.18.2 → 0.20.0

package/.dsh-plugin/shared/cli-terminal-protocol.mjs

@@ -9,10 +9,12 @@
  * into that interactive process, exactly as in their own terminal, so a
  * session starts only after an explicit confirmation.
  */
-import { getOfficialTool } from './official-tool-registry.mjs'
+import { getOfficialTool, OFFICIAL_TOOLS } from './official-tool-registry.mjs'
 
-/** Registry CLIs that have an interactive terminal UI (ZCode is a desktop app). */
-export const TERMINAL_TOOL_IDS = Object.freeze(['codex', 'claude-code', 'kimi-code', 'minimax-code', 'mimo-code', 'grok-build', 'gemini'])
+/** Follow the tool registry, including the TUI bundled with ZCode desktop. */
+export const TERMINAL_TOOL_IDS = Object.freeze(OFFICIAL_TOOLS
+  .filter(tool => !tool.unsupported && (tool.probeExecutables?.length || tool.manager === 'signed-windows-installer'))
+  .map(tool => tool.id))
 export const TERMINAL_SHELL_ID = 'shell'
 export const TERMINAL_TARGETS = Object.freeze([TERMINAL_SHELL_ID, ...TERMINAL_TOOL_IDS])
 export const TERMINAL_MODES = Object.freeze(['interactive', 'login'])
@@ -46,8 +48,16 @@ export const TERMINAL_LOGIN_ARGS = Object.freeze({
   'mimo-code': Object.freeze(['auth', 'login']),
   'grok-build': Object.freeze(['login']),
   gemini: Object.freeze([]),
+  opencode: Object.freeze(['auth', 'login']),
+  stepcode: Object.freeze(['login']),
+  zcode: Object.freeze([]),
 })
 
+/** Tools without a separate login command authenticate from their TUI. */
+export function terminalCanLogin(target) {
+  return Boolean(TERMINAL_LOGIN_ARGS[target]?.length)
+}
+
 const SESSION_ID = /^term-[a-z0-9]{6,40}$/
 
 function plainObject(value, subject) {
@@ -82,7 +92,7 @@ export function terminalTargetLabel(target) {
 export function terminalCommandPreview(target, mode = 'interactive', platform = 'win32') {
   if (target === TERMINAL_SHELL_ID) return platform === 'win32' ? 'powershell.exe -NoLogo' : '$SHELL -l'
   const tool = getOfficialTool(target)
-  const executable = tool?.probeExecutables?.[0] ?? String(target)
+  const executable = target === 'zcode' ? 'ZCode 桌面版内置 TUI' : tool?.probeExecutables?.[0] ?? String(target)
   const args = mode === 'login' ? TERMINAL_LOGIN_ARGS[target] ?? [] : []
   return [executable, ...args].join(' ')
 }
@@ -92,7 +102,7 @@ export function parseTerminalStart(value) {
   if (!TERMINAL_TARGETS.includes(request.target)) throw new TypeError('target must be the shell or a fixed official CLI')
   const mode = request.mode === undefined ? 'interactive' : request.mode
   if (!TERMINAL_MODES.includes(mode)) throw new TypeError('mode must be interactive or login')
-  if (mode === 'login' && request.target === TERMINAL_SHELL_ID) throw new TypeError('the shell has no login mode')
+  if (mode === 'login' && !terminalCanLogin(request.target)) throw new TypeError('this target has no login mode')
   if (!isAbsoluteDirectoryText(request.cwd)) throw new TypeError('cwd must be an absolute directory path')
   if (request.confirmed !== true) throw new TypeError('starting a terminal requires the user\'s confirmation')
   return {

package/.dsh-plugin/shared/cli-terminal.mjs

@@ -13,11 +13,14 @@
  */
 import { spawn } from 'node:child_process'
 import { randomBytes } from 'node:crypto'
-import { stat } from 'node:fs/promises'
+import { readFile, readdir, realpath, stat } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { StringDecoder } from 'node:string_decoder'
-import { extname } from 'node:path'
-import { getOfficialTool } from './official-tool-registry.mjs'
+import { homedir } from 'node:os'
+import { extname, isAbsolute, join, relative, sep } from 'node:path'
+import { getOfficialTool, installMethodFor } from './official-tool-registry.mjs'
+import { resolveInstallPlan } from './tool-install-preferences.mjs'
+import { discoverZCodeBundle } from './zcode-bundle.mjs'
 import {
   TERMINAL_LIMITS,
   TERMINAL_LOGIN_ARGS,
@@ -84,6 +87,75 @@ export function pickWindowsExecutable(candidates) {
 
 const quoteWindows = path => `"${String(path).replace(/"/g, '')}"`
 
+function within(root, child) {
+  const part = relative(root, child)
+  return Boolean(part) && part !== '..' && !part.startsWith(`..${sep}`) && !isAbsolute(part)
+}
+
+/** Bind a configured npm/pnpm tool to its declared package entry, not a shared shim. */
+export async function findTerminalPackageEntry(tool, plan, { platform = process.platform } = {}) {
+  let roots = plan.packageModuleRoots
+  let boundary
+  if (!Array.isArray(roots)) {
+    if (!plan.installDir) return null
+    if (plan.manager === 'pnpm') {
+      const global = join(plan.installDir, '.pnpm', 'global')
+      boundary = await realpath(global).catch(() => null)
+      const versions = await readdir(global, { withFileTypes: true }).catch(() => [])
+      roots = versions.filter(item => item.isDirectory() && /^\d+$/.test(item.name))
+        .sort((left, right) => Number(left.name) - Number(right.name))
+        .map(item => join(global, item.name, 'node_modules'))
+    } else {
+      const modules = platform === 'win32' ? join(plan.installDir, 'node_modules') : join(plan.installDir, 'lib', 'node_modules')
+      boundary = await realpath(modules).catch(() => null)
+      roots = [modules]
+    }
+  } else {
+    boundary = await realpath(plan.globalDir || plan.installDir || roots[0]).catch(() => null)
+  }
+  if (!boundary) return null
+  const entries = []
+  for (const modules of roots) {
+    try {
+      const packageRoot = await realpath(join(modules, ...tool.package.split('/')))
+      if (!within(boundary, packageRoot)) continue
+      const manifest = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'))
+      if (manifest.name !== tool.package) continue
+      for (const executable of tool.probeExecutables) {
+        const raw = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin?.[executable]
+        const bin = typeof raw === 'string' ? raw.replace(/\\/g, '/').replace(/^\.\//, '') : ''
+        if (!bin || bin.split('/').some(part => !part || part === '..') || isAbsolute(bin)) continue
+        const entry = await realpath(join(packageRoot, ...bin.split('/')))
+        if (!within(packageRoot, entry) || !(await stat(entry)).isFile()) continue
+        entries.push({ entry, packageRoot, version: String(manifest.version ?? '') })
+      }
+    } catch { /* not the selected tool's usable package */ }
+  }
+  // pnpm normally has one active global tree. Prefer the highest numbered
+  // layout when multiple layouts survive an upgrade, following its directories.
+  return entries.at(-1) ?? null
+}
+
+async function terminalNode(workspace, minimum, acceptedVersion) {
+  const { findNodeExecutable } = await import('./official-tool-executor.mjs')
+  return findNodeExecutable(workspace, minimum, acceptedVersion)
+}
+
+function executableLaunch(file, args, display, { platform, env }) {
+  if (platform !== 'win32') return { file, args, verbatim: false, display }
+  const extension = extname(file).toLowerCase()
+  if (extension === '.cmd' || extension === '.bat') {
+    const comspec = env.ComSpec || env.COMSPEC || 'cmd.exe'
+    const tail = `/d /s /c "${[quoteWindows(file), ...args].join(' ')}"`
+    return { file: comspec, args: tail, verbatim: true, display }
+  }
+  if (extension === '.ps1') {
+    const root = env.SystemRoot || env.SYSTEMROOT || 'C:\\Windows'
+    return { file: `${root}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, args: ['-NoLogo', '-NoProfile', '-File', file, ...args], verbatim: false, display }
+  }
+  return { file, args, verbatim: false, display }
+}
+
 /**
  * Build the fixed launch for one target. `locate(executable)` returns the
  * candidate paths `where`/`which` printed. Returns
@@ -92,6 +164,9 @@ const quoteWindows = path => `"${String(path).replace(/"/g, '')}"`
  */
 export async function resolveTerminalLaunch(target, mode = 'interactive', {
   platform = process.platform, env = process.env, locate = defaultLocate,
+  preferences = {}, home = homedir(), cwd = process.cwd(),
+  packageEntry = findTerminalPackageEntry, fileExists = async path => (await stat(path).catch(() => null))?.isFile() === true,
+  discoverBundle = discoverZCodeBundle, findNode = terminalNode,
 } = {}) {
   if (target === TERMINAL_SHELL_ID) {
     if (platform === 'win32') {
@@ -104,9 +179,47 @@ export async function resolveTerminalLaunch(target, mode = 'interactive', {
   }
   if (!TERMINAL_TOOL_IDS.includes(target)) throw new Error('只能启动系统终端或固定注册表中的官方 CLI。')
   const tool = getOfficialTool(target)
+  if (target === 'zcode') {
+    if (platform !== 'win32') throw new Error('当前仅支持 Windows ZCode 桌面版内置 TUI。')
+    const bundle = await discoverBundle({ installDir: preferences.zcodeInstallDir, env })
+    if (!bundle) throw new Error('未找到通过智谱签名与组件核验的 ZCode 桌面版；请先配置 ZCode 独立安装目录并重新体检。')
+    const node = await findNode(cwd, [24, 14, 0], version => Number(String(version).split('.')[0]) === 24)
+    // The verified desktop's electron-node entry is usable independently of
+    // its GUI. It supplies its own runtime when external Node 24 is absent.
+    return { file: node || bundle.executable, args: [bundle.cliEntry], verbatim: false,
+      display: `ZCode TUI · ${bundle.cliEntry}`, ...(!node ? { env: { ELECTRON_RUN_AS_NODE: '1' } } : {}) }
+  }
   const executable = tool.probeExecutables[0]
   const args = mode === 'login' ? [...(TERMINAL_LOGIN_ARGS[target] ?? [])] : []
   const display = [executable, ...args].join(' ')
+  const selectedScript = installMethodFor(tool, preferences.methods?.[target])?.kind === 'script'
+  const selectedPreferences = selectedScript ? { ...preferences, allowScriptInstall: true } : preferences
+  const plan = resolveInstallPlan(tool, undefined, selectedPreferences, { platform, env, home })
+  const configured = Boolean(preferences.installDir || preferences.methods?.[target])
+  if (plan.kind === 'package-manager' && configured) {
+    const boundPlan = plan.installDir ? plan : await (await import('./official-tools-runtime.mjs')).resolvePackageJobPlan(tool, plan, selectedPreferences, { options: { platform, env, home } })
+    const found = await packageEntry(tool, boundPlan, { platform })
+    if (!found) throw new Error(`未在所选 ${boundPlan.manager} 安装目录中找到 ${tool.label} 的真实命令入口；请重新体检或修复。`)
+    const extension = extname(found.entry).toLowerCase()
+    if (['.js', '.mjs', '.cjs'].includes(extension) || (platform === 'win32' && !extension)) {
+      const node = await findNode(cwd)
+      if (!node) throw new Error(`未找到可核验的 Node.js 运行时，无法启动 ${tool.label}。`)
+      return { file: node, args: [found.entry, ...args], verbatim: false, display }
+    }
+    return executableLaunch(found.entry, args, display, { platform, env })
+  }
+  if (plan.kind === 'script' && plan.binDir) {
+    for (const name of tool.probeExecutables) {
+      const filenames = platform === 'win32' ? WINDOWS_PREFERENCE.map(extension => `${name}${extension}`) : [name]
+      for (const filename of filenames) {
+        const file = join(plan.binDir, filename)
+        if (await fileExists(file)) return executableLaunch(file, args, display, { platform, env })
+      }
+    }
+    // A saved method or directory is authoritative: an older PATH copy cannot
+    // satisfy a missing install in the user's selected tool directory.
+    if (configured || tool.manager === 'script-installer') throw new Error(`未在所选安装目录 ${plan.binDir} 中找到 ${tool.label}；请重新体检或安装。`)
+  }
   const candidates = await locate(executable, { platform, env })
   if (platform !== 'win32') {
     const file = candidates.map(item => String(item).trim()).find(item => item.startsWith('/'))
@@ -115,18 +228,7 @@ export async function resolveTerminalLaunch(target, mode = 'interactive', {
   }
   const file = pickWindowsExecutable(candidates)
   if (!file) throw new Error(`未在 PATH 中找到 ${executable}；请先在“官方工具 · 体检”中安装 ${tool.label}。`)
-  const extension = extname(file).toLowerCase()
-  if (extension === '.cmd' || extension === '.bat') {
-    // npm shims only run under cmd.exe. Every token is fixed by the registry.
-    const comspec = env.ComSpec || env.COMSPEC || 'cmd.exe'
-    const tail = `/d /s /c "${[quoteWindows(file), ...args].join(' ')}"`
-    return { file: comspec, args: tail, verbatim: true, display }
-  }
-  if (extension === '.ps1') {
-    const root = env.SystemRoot || env.SYSTEMROOT || 'C:\\Windows'
-    return { file: `${root}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, args: ['-NoLogo', '-NoProfile', '-File', file, ...args], verbatim: false, display }
-  }
-  return { file, args, verbatim: false, display }
+  return executableLaunch(file, args, display, { platform, env })
 }
 
 /** Locate an executable with where.exe / which (fixed registry names only). */
@@ -161,7 +263,10 @@ function spawnPtyProcess(pty, launch, { cwd, cols, rows, env }) {
 
 /** Pipe fallback: no TTY; the Host echoes input and maps Enter/Ctrl+C. */
 export function spawnPipeProcess(launch, { cwd, env, platform = process.platform, spawnImpl = spawn }) {
-  const child = spawnImpl(launch.file, launch.args, {
+  // node-pty accepts a Windows command-line string; node:child_process needs
+  // an array even with windowsVerbatimArguments. Keep the prepared tail intact.
+  const args = typeof launch.args === 'string' ? [launch.args] : launch.args
+  const child = spawnImpl(launch.file, args, {
     cwd, env, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true, shell: false,
     windowsVerbatimArguments: launch.verbatim === true,
   })
@@ -220,6 +325,8 @@ export function createTerminalManager({
   statPath = stat,
   prepare = async () => {},
   environment = () => terminalEnvironment(process.env),
+  preferences = () => ({}),
+  launchOptions = () => ({}),
   onSessionEnd = () => {},
   now = Date.now,
   platform = process.platform,
@@ -329,10 +436,11 @@ export function createTerminalManager({
       try { info = await statPath(request.cwd) } catch { info = null }
       if (!info?.isDirectory?.()) throw new Error(`工作目录不存在或不是目录：${request.cwd}`)
       await prepare()
-      const launch = await resolveLaunch(request.target, request.mode, { platform })
       const env = environment()
+      const launch = await resolveLaunch(request.target, request.mode, { ...launchOptions(), platform, env,
+        preferences: preferences(), cwd: request.cwd })
       const backend = backendInfo()
-      const options = { cwd: request.cwd, cols: request.cols, rows: request.rows, env, platform }
+      const options = { cwd: request.cwd, cols: request.cols, rows: request.rows, env: { ...env, ...launch.env }, platform }
       let proc
       try {
         proc = backend.backend === 'pty'

package/.dsh-plugin/shared/official-team-runtime.mjs

@@ -5,11 +5,13 @@
  * worktree for review. No package supplies an executable or shell fragment.
  */
 import { spawn } from 'node:child_process'
-import { appendFile, mkdir, realpath, stat } from 'node:fs/promises'
-import { randomUUID } from 'node:crypto'
+import { appendFile, lstat, mkdir, realpath, stat } from 'node:fs/promises'
+import { createHash, randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { runOfficialTool, officialToolExecutionCapabilities, officialToolReadiness } from './official-tool-executor.mjs'
 import { toolForProvider } from './official-tool-registry.mjs'
+import { redactDiagnostic, verifiedDiagnostic } from './task-executors.mjs'
 
 const MAX_GIT_OUTPUT = 64_000_000
 const GIT_TIMEOUT_MS = 120_000
@@ -26,6 +28,61 @@ async function canonicalDirectory(path) {
   return canonical
 }
 
+function pathIdentity(path) {
+  return process.platform === 'win32' ? resolve(path).toLowerCase() : resolve(path)
+}
+
+async function approvedSource(workspace, allowedRoot) {
+  const source = await canonicalDirectory(workspace)
+  const root = await canonicalDirectory(allowedRoot ?? source)
+  if (!within(root, source)) throw new Error('原工作区不在当前 Harness 会话批准的工作区范围内。')
+  return source
+}
+
+function sourceStorageKey(source) {
+  return createHash('sha256').update(pathIdentity(source)).digest('hex')
+}
+
+function requireDisjointStorage(source, storage) {
+  if (within(source, storage) || within(storage, source)) {
+    throw new Error('Host 独立工作区存储必须与原工作区互不包含。')
+  }
+}
+
+/** Reject junctions before creating deeper directories in Host-managed storage. */
+async function storageDirectory(parent, name) {
+  const target = join(parent, name)
+  try { await mkdir(target) }
+  catch (error) { if (error?.code !== 'EEXIST') throw error }
+  const entry = await lstat(target)
+  const canonical = await canonicalDirectory(target)
+  if (!entry.isDirectory() || entry.isSymbolicLink() || pathIdentity(canonical) !== pathIdentity(target)) {
+    throw new Error('Host 独立工作区存储不能经过符号链接或目录联接。')
+  }
+  return canonical
+}
+
+/**
+ * Windows ACL grants need WRITE_OWNER as well as ordinary file modification.
+ * Use the user's existing private temp storage rather than changing a source
+ * drive's ACL. Only the individual run receives the sandbox write capability;
+ * the SDK's separate random private temp remains disjoint from that run.
+ */
+async function windowsStorageParent(source, create = false) {
+  const temporary = await canonicalDirectory(tmpdir())
+  const rootPath = join(temporary, '.model-router-workspaces')
+  requireDisjointStorage(source, rootPath)
+  const root = create ? await storageDirectory(temporary, '.model-router-workspaces')
+    : await canonicalDirectory(rootPath)
+  if (pathIdentity(root) !== pathIdentity(rootPath)) throw new Error('Host 独立工作区存储路径校验失败。')
+  const key = sourceStorageKey(source)
+  const parentPath = join(root, key)
+  const parent = create ? await storageDirectory(root, key) : await canonicalDirectory(parentPath)
+  if (pathIdentity(parent) !== pathIdentity(parentPath)) throw new Error('Host 独立工作区存储路径校验失败。')
+  requireDisjointStorage(source, parent)
+  return parent
+}
+
 /** The session owner, never model arguments, selects the filesystem scope. */
 export async function sessionWorkspace(ctx, exec) {
   const session = exec?.agent?.session
@@ -97,6 +154,13 @@ async function cleanRepoRoot(workspace, signal) {
   return repo
 }
 
+/** Preview-only validation; never creates a worktree or changes ignore rules. */
+export async function preflightOfficialWorkspace(workspace, mode = 'read-only', signal) {
+  const source = await canonicalDirectory(workspace)
+  if (mode === 'workspace-write') await cleanRepoRoot(source, signal)
+  return source
+}
+
 /** Keep nested worktrees out of ordinary git status without changing tracked files. */
 async function excludeNestedWorktrees(workspace, signal) {
   const ignored = await git(['check-ignore', '-q', '--', '.model-router-workspaces/'], { cwd: workspace, signal })
@@ -114,25 +178,31 @@ async function excludeNestedWorktrees(workspace, signal) {
   if (!confirmed.ok) throw gitError('确认独立工作区忽略规则', confirmed)
 }
 
-/** Keep generated worktrees beside the project so they use the same drive. */
+/** Source authorization is independent from the Host's isolated output storage. */
 async function isolatedWorktree(workspace, signal, allowedRoot) {
+  workspace = await approvedSource(workspace, allowedRoot)
   await cleanRepoRoot(workspace, signal)
   const base = await git(['rev-parse', 'HEAD'], { cwd: workspace, signal })
   if (!base.ok || !/^[0-9a-f]{40,64}$/i.test(base.output.toString('utf8').trim())) {
     throw gitError('记录原仓库基线', base)
   }
   const baseCommit = base.output.toString('utf8').trim()
-  const policyRoot = await canonicalDirectory(allowedRoot ?? workspace)
-  const sibling = join(dirname(workspace), '.model-router-workspaces', basename(workspace))
-  const parent = within(policyRoot, sibling) ? sibling : join(workspace, '.model-router-workspaces')
-  if (parent === join(workspace, '.model-router-workspaces')) await excludeNestedWorktrees(workspace, signal)
-  await mkdir(parent, { recursive: true })
-  const isolatedRoot = await canonicalDirectory(parent)
+  let isolatedRoot
+  if (process.platform === 'win32') isolatedRoot = await windowsStorageParent(workspace, true)
+  else {
+    const policyRoot = await canonicalDirectory(allowedRoot ?? workspace)
+    const sibling = join(dirname(workspace), '.model-router-workspaces', basename(workspace))
+    const parent = within(policyRoot, sibling) ? sibling : join(workspace, '.model-router-workspaces')
+    if (parent === join(workspace, '.model-router-workspaces')) await excludeNestedWorktrees(workspace, signal)
+    await mkdir(parent, { recursive: true })
+    isolatedRoot = await canonicalDirectory(parent)
+  }
   const target = join(isolatedRoot, `run-${randomUUID()}`)
   const added = await git(['worktree', 'add', '--detach', target, 'HEAD'], { cwd: workspace, signal })
   if (!added.ok) throw gitError('创建独立 Git 工作区', added)
   const runPath = await canonicalDirectory(target)
-  if (!within(isolatedRoot, runPath) || runPath === isolatedRoot) throw new Error('独立工作区路径校验失败')
+  if (pathIdentity(dirname(runPath)) !== pathIdentity(isolatedRoot)
+    || pathIdentity(runPath) !== pathIdentity(target)) throw new Error('独立工作区路径校验失败')
   return { workspace: runPath, isolatedRoot, baseCommit, source: workspace }
 }
 
@@ -198,13 +268,11 @@ function checkedTeamCliModels(cliModels, assigned) {
 
 function teamCliModel(item, cliModels) {
   // Harness directory IDs and vendor CLI aliases are independent namespaces.
-  // Only the two CLIs with a verified direct model argument contract receive
-  // a planned ID. All other vendors use their configured default until the
-  // user supplies a verified CLI mapping through that vendor's own settings.
+  // Every vendor uses its own configured default unless a package or tool
+  // explicitly binds the model name accepted by that CLI.
   if (cliModels[item.id]) return cliModels[item.id]
   if (cliModels[item.toolId]) return cliModels[item.toolId]
-  return item.toolId === 'claude-code' || item.toolId === 'codex'
-    ? item.recommendedModel : null
+  return null
 }
 
 function reportedCliModel(toolId, value) {
@@ -241,8 +309,8 @@ function packagePrompt(task, item, completed) {
 }
 
 /** Preflight every assignment before any model request or workspace write. */
-export function executableTeamPackages(plan, installedIds = [], mode = 'read-only') {
-  const capabilities = new Map(officialToolExecutionCapabilities().map(item => [item.id, item]))
+export function executableTeamPackages(plan, installedIds = [], mode = 'read-only', executionEnvironment = 'harness') {
+  const capabilities = new Map(officialToolExecutionCapabilities({ executionEnvironment }).map(item => [item.id, item]))
   const packages = Array.isArray(plan?.team?.workPackages) ? plan.team.workPackages : []
   const blocking = []
   const assigned = packages.map(item => {
@@ -266,6 +334,34 @@ async function removeWorktree(source, target) {
   try { await git(['worktree', 'remove', '--force', target], { cwd: source }) } catch { /* left for manual cleanup */ }
 }
 
+function executionDiagnostic(value) {
+  let detail = String(value ?? '')
+  for (const key of ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN',
+    'OPENAI_API_KEY', 'CODEX_API_KEY', 'KIMI_API_KEY', 'MOONSHOT_API_KEY', 'MINIMAX_API_KEY',
+    'MIMO_API_KEY', 'XAI_API_KEY', 'ZAI_API_KEY', 'GEMINI_API_KEY', 'GOOGLE_API_KEY']) {
+    const secret = process.env[key]
+    if (typeof secret === 'string' && secret) detail = detail.split(secret).join('[redacted]')
+  }
+  return redactDiagnostic(detail, '', 2_000)
+}
+
+function executionException(error, signal) {
+  const detail = executionDiagnostic(error?.message ?? error)
+  const cancelled = signal?.aborted === true || error?.name === 'AbortError'
+  return { status: cancelled ? 'cancelled' : 'failed', exitCode: null, finalText: '',
+    error: `${cancelled ? '官方 CLI 执行已取消' : '官方 CLI 执行器异常'}${detail ? `：${detail}` : '。'}`,
+    detail }
+}
+
+/** The ledger accepts this bounded, scrubbed field instead of raw CLI streams. */
+function withFailureDiagnostic(result) {
+  if (result.status === 'succeeded') return result
+  const diagnostic = executionDiagnostic(result.diagnostic ?? verifiedDiagnostic(result))
+  return { ...result, ...(result.error ? { error: executionDiagnostic(result.error) } : {}),
+    ...(result.reason ? { reason: executionDiagnostic(result.reason) } : {}),
+    ...(diagnostic ? { diagnostic } : {}) }
+}
+
 /**
  * Copy the changes of an earlier, never integrated worktree into a fresh one.
  * Refuses when the original checkout moved since that run (the patch would be
@@ -279,11 +375,25 @@ async function seedWorktree(isolated, seedFrom, signal) {
   let prior
   try { prior = await canonicalDirectory(seedFrom.workspace) }
   catch { throw new Error('原运行的独立工作区已不存在，无法套用之前的改动；请重新执行整个团队任务。') }
-  // Only a worktree of this repository that the plugin created (run-<uuid>) is accepted.
-  const listed = await git(['worktree', 'list', '--porcelain'], { cwd: isolated.source, signal })
-  const worktrees = listed.ok ? listed.output.toString('utf8').split(/\r?\n/).filter(line => line.startsWith('worktree ')).map(line => line.slice(9)) : []
+  // A basename is not ownership evidence: require this repository's membership
+  // and an exact canonical parent derived from this source, including old runs.
+  const listed = await git(['worktree', 'list', '--porcelain', '-z'], { cwd: isolated.source, signal })
+  const worktrees = listed.ok ? listed.output.toString('utf8').split('\0').filter(line => line.startsWith('worktree ')).map(line => line.slice(9)) : []
   const known = await Promise.all(worktrees.map(path => canonicalDirectory(path).catch(() => null)))
-  if (!known.includes(prior) || !/^run-[0-9a-f-]{36}$/i.test(basename(prior)) || basename(dirname(dirname(prior))) !== '.model-router-workspaces' && basename(dirname(prior)) !== '.model-router-workspaces') {
+  const expectedParents = [join(isolated.source, '.model-router-workspaces'),
+    join(dirname(isolated.source), '.model-router-workspaces', basename(isolated.source))]
+  if (process.platform === 'win32') {
+    try { expectedParents.push(await windowsStorageParent(isolated.source)) } catch { /* a removed/redirected Host parent is not trusted */ }
+  }
+  const parents = await Promise.all(expectedParents.map(async path => {
+    try {
+      const canonical = await canonicalDirectory(path)
+      return pathIdentity(canonical) === pathIdentity(path) ? canonical : null
+    } catch { return null }
+  }))
+  if (!known.some(path => path && pathIdentity(path) === pathIdentity(prior))
+    || !/^run-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(basename(prior))
+    || !parents.some(path => path && pathIdentity(path) === pathIdentity(dirname(prior)))) {
     throw new Error('原独立工作区不是本仓库由插件创建的 Git 工作树，拒绝读取。')
   }
   const staged = await git(['add', '-A'], { cwd: prior, signal })
@@ -301,7 +411,9 @@ async function seedWorktree(isolated, seedFrom, signal) {
 }
 
 /** Sequential execution preserves DAG dependencies and avoids edit conflicts. */
-export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode = 'read-only', installedIds = [], cliModels, signal, sandbox, runtime, previous = [], onlyIds = null, seedFrom = null }) {
+export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode = 'read-only', executionEnvironment = 'harness', installedIds = [], cliModels, signal, sandbox, runtime, previous = [], onlyIds = null, seedFrom = null }) {
+  if (!['harness', 'cli-native'].includes(executionEnvironment)
+    || (executionEnvironment === 'cli-native' && mode !== 'workspace-write')) throw new TypeError('invalid team CLI execution environment')
   // A retry runs only `onlyIds`; earlier results feed dependency context. An
   // editable retry needs `seedFrom` (the earlier, never integrated worktree and
   // its base commit): a fresh worktree gets that worktree's changes first, so
@@ -310,22 +422,23 @@ export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode
   if (retry && mode !== 'read-only' && !(seedFrom && typeof seedFrom.workspace === 'string' && typeof seedFrom.baseCommit === 'string')) {
     throw new TypeError('an editable team retry needs the earlier isolated worktree (seedFrom)')
   }
-  const selected = executableTeamPackages(plan, installedIds, mode)
+  const selected = executableTeamPackages(plan, installedIds, mode, executionEnvironment)
   const assigned = retry ? selected.assigned.filter(item => onlyIds.includes(item.id)) : selected.assigned
   const blocking = retry ? selected.blocking.filter(item => onlyIds.includes(item.id)) : selected.blocking
   if (assigned.length === 0) return { status: 'blocked', blocking: [{ reason: '计划没有工作包。' }], results: [] }
   if (blocking.length > 0) return { status: 'blocked', blocking, results: [] }
   if (mode !== 'read-only' && mode !== 'workspace-write') throw new TypeError('team mode must be read-only or workspace-write')
   const configuredCliModels = checkedTeamCliModels(cliModels, assigned)
-  const source = await canonicalDirectory(workspace)
-  if (typeof sandbox?.confine !== 'function') return { status: 'blocked', blocking: [{ reason: '官方 Harness 进程沙箱不可用。' }], results: [] }
+  const source = await approvedSource(workspace, allowedRoot)
+  if (executionEnvironment === 'harness' && typeof sandbox?.confine !== 'function') return { status: 'blocked', blocking: [{ reason: '官方 Harness 进程沙箱不可用。' }], results: [] }
   // The Host passes no runtime override. Tests can inject inert CLI adapters to
   // exercise assignment, stopping, and Git integration without provider accounts.
   const readinessCheck = runtime?.readiness ?? officialToolReadiness
   const runTool = runtime?.runTool ?? runOfficialTool
-  const readiness = await Promise.all([...new Set(assigned.map(item => item.toolId))].map(id => readinessCheck(id, source)))
-  const unready = readiness.filter(item => !item.ready)
-  if (unready.length > 0) return { status: 'blocked', blocking: unready.map(item => ({ toolId: item.id, reason: item.reason })), results: [] }
+  const readiness = await Promise.all([...new Set(assigned.map(item => item.toolId))].map(id => readinessCheck(id, source, { executionEnvironment })))
+  const unready = readiness.filter(item => !item.ready || !(item.readyModes ?? item.modes ?? [mode]).includes(mode))
+  if (unready.length > 0) return { status: 'blocked', blocking: unready.map(item => ({ toolId: item.id,
+    reason: item.reason ?? `官方 CLI 尚未就绪，或不支持 ${mode} 模式。` })), results: [] }
   const isolated = mode === 'workspace-write' ? await isolatedWorktree(source, signal, allowedRoot) : null
   const runWorkspace = isolated?.workspace ?? source
   let seeded = null
@@ -339,18 +452,28 @@ export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode
   const completed = []
   const context = retry ? (Array.isArray(previous) ? previous : []).filter(item => item?.id && typeof item.finalText === 'string') : []
   for (const item of assigned) {
-    if (signal?.aborted) return { status: 'cancelled', workspace: runWorkspace, results: completed }
+    if (signal?.aborted) return { status: 'cancelled', workspace: runWorkspace, results: completed,
+      ...(isolated ? { baseCommit: isolated.baseCommit } : {}), ...(seeded ? { seeded } : {}) }
     const cliModel = teamCliModel(item, configuredCliModels)
-    const result = await runTool({
-      toolId: item.toolId,
-      modelId: cliModel,
-      task: packagePrompt(task, item, [...context, ...completed]),
-      workspace: runWorkspace,
-      mode,
-      isolatedRoot: isolated?.isolatedRoot,
-      sandbox,
-      signal,
-    })
+    let result
+    try {
+      result = await runTool({
+        toolId: item.toolId,
+        modelId: cliModel,
+        task: packagePrompt(task, item, [...context, ...completed]),
+        workspace: runWorkspace,
+        mode,
+        isolatedRoot: isolated?.isolatedRoot,
+        sandbox,
+        signal,
+        executionEnvironment,
+      })
+      if (!result || typeof result.status !== 'string') throw new TypeError('官方 CLI 执行器没有返回有效状态。')
+    } catch (error) {
+      // Keep earlier paid results and the isolated worktree available for the
+      // ledger and retry even when a later adapter rejects before returning.
+      result = executionException(error, signal)
+    }
     const reportedModel = reportedCliModel(item.toolId, result.reportedModel)
     const modelMismatch = result.status === 'succeeded' && cliModel && reportedModel
       && cliModel !== reportedModel
@@ -358,19 +481,26 @@ export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode
     completed.push({ id: item.id, name: item.name,
       ...(item.objective ? { objective: item.objective } : {}), provider: item.recommendedProvider,
       recommendedModel: item.recommendedModel, toolId: item.toolId,
-      requestedCliModel: result.requestedModel ?? null,
+      requestedCliModel: Object.hasOwn(result, 'requestedModel') ? result.requestedModel : cliModel,
       actualModel: reportedModel,
+      ...(result.reportedModel !== undefined ? { reportedModel: result.reportedModel } : {}),
+      ...(result.usageIncomplete === true ? { usageIncomplete: true } : {}),
+      ...(typeof result.source === 'string' ? { source: result.source } : {}),
+      ...(typeof result.sandboxEnforcement === 'string' ? { sandboxEnforcement: result.sandboxEnforcement } : {}),
+      executionEnvironment,
       modelNotice: modelMismatch
         ? `官方 CLI 回报模型 ${reportedModel}，与本包指定的 ${cliModel} 不一致；后续工作包已停止。`
         : result.modelNotice ?? (!cliModel
         ? 'Harness 推荐模型 ID 未经此厂商 CLI 验证；本包使用厂商 CLI 已配置的默认模型。'
         : reportedModel ? null : '该 CLI 未返回可核验的实际模型 ID；请以厂商运行记录核对。'),
       status: packageStatus, finalText: result.finalText ?? '',
+      exitCode: result.exitCode ?? null,
       ...(result.usage ? { usage: result.usage } : {}),
       ...(Number.isFinite(result.reportedCostUsd) ? { reportedCostUsd: result.reportedCostUsd } : {}),
-      error: modelMismatch ? '官方 CLI 实际模型与指定模型不一致。' : result.error ?? result.reason ?? null,
-      outputTail: result.status === 'succeeded' ? null : result.stderrTail ?? result.stdoutTail ?? null })
-    if (packageStatus !== 'succeeded') return { status: 'incomplete', workspace: runWorkspace, results: completed,
+      error: modelMismatch ? '官方 CLI 实际模型与指定模型不一致。'
+        : (result.error || result.reason) ? executionDiagnostic(result.error || result.reason) : null,
+      outputTail: result.status === 'succeeded' ? null : executionDiagnostic(verifiedDiagnostic(result)) || null })
+    if (packageStatus !== 'succeeded') return { status: packageStatus === 'cancelled' ? 'cancelled' : 'incomplete', workspace: runWorkspace, results: completed,
       ...(isolated ? { baseCommit: isolated.baseCommit } : {}), ...(seeded ? { seeded } : {}) }
   }
   if (!isolated) return { status: 'cli-completed', workspace: runWorkspace, results: completed,
@@ -390,14 +520,24 @@ export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode
 }
 
 /** One editable CLI task also uses the same isolated workspace and merge gate. */
-export async function runOfficialTask({ toolId, task, workspace, allowedRoot, modelId, mode = 'read-only', signal, sandbox }) {
-  const source = await canonicalDirectory(workspace)
+export async function runOfficialTask({ toolId, task, workspace, allowedRoot, modelId, mode = 'read-only', signal, sandbox, runtime }) {
+  const source = await approvedSource(workspace, allowedRoot)
   if (typeof sandbox?.confine !== 'function') return { toolId, status: 'unsupported', reason: '官方 Harness 进程沙箱不可用。' }
-  const readiness = await officialToolReadiness(toolId, source)
-  if (!readiness.ready) return { toolId, status: 'unsupported', reason: readiness.reason }
+  // The Host supplies no runtime override; offline tests use inert adapters.
+  const readiness = await (runtime?.readiness ?? officialToolReadiness)(toolId, source)
+  const readyModes = readiness.readyModes ?? readiness.modes ?? []
+  if (!readiness.ready || !readyModes.includes(mode)) return { toolId, status: 'unsupported',
+    reason: readiness.reason ?? readiness.modeReasons?.[mode] ?? `官方 CLI 尚未就绪，或不支持 ${mode} 模式。` }
   const isolated = mode === 'workspace-write' ? await isolatedWorktree(source, signal, allowedRoot) : null
-  const result = await runOfficialTool({ toolId, task, modelId, workspace: isolated?.workspace ?? source,
-    mode, isolatedRoot: isolated?.isolatedRoot, signal, sandbox })
+  let result
+  try {
+    result = await (runtime?.runTool ?? runOfficialTool)({ toolId, task, modelId, workspace: isolated?.workspace ?? source,
+      mode, isolatedRoot: isolated?.isolatedRoot, signal, sandbox })
+    if (!result || typeof result.status !== 'string') throw new TypeError('官方 CLI 执行器没有返回有效状态。')
+  } catch (error) {
+    result = executionException(error, signal)
+  }
+  result = withFailureDiagnostic(result)
   if (!isolated || result.status !== 'succeeded') return { ...result, ...(isolated ? { isolatedWorkspace: isolated.workspace, baseCommit: isolated.baseCommit } : {}) }
   try {
     const integration = await integrateWorktree(source, isolated.workspace, isolated.baseCommit, signal)