@ljwei-stak/dsh-model-router 0.19.0 → 0.20.1

package/.dsh-plugin/shared/official-team-runtime.mjs

@@ -5,11 +5,13 @@
  * worktree for review. No package supplies an executable or shell fragment.
  */
 import { spawn } from 'node:child_process'
-import { appendFile, mkdir, realpath, stat } from 'node:fs/promises'
-import { randomUUID } from 'node:crypto'
+import { appendFile, lstat, mkdir, realpath, stat } from 'node:fs/promises'
+import { createHash, randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { runOfficialTool, officialToolExecutionCapabilities, officialToolReadiness } from './official-tool-executor.mjs'
 import { toolForProvider } from './official-tool-registry.mjs'
+import { redactDiagnostic, verifiedDiagnostic } from './task-executors.mjs'
 
 const MAX_GIT_OUTPUT = 64_000_000
 const GIT_TIMEOUT_MS = 120_000
@@ -26,6 +28,61 @@ async function canonicalDirectory(path) {
   return canonical
 }
 
+function pathIdentity(path) {
+  return process.platform === 'win32' ? resolve(path).toLowerCase() : resolve(path)
+}
+
+async function approvedSource(workspace, allowedRoot) {
+  const source = await canonicalDirectory(workspace)
+  const root = await canonicalDirectory(allowedRoot ?? source)
+  if (!within(root, source)) throw new Error('原工作区不在当前 Harness 会话批准的工作区范围内。')
+  return source
+}
+
+function sourceStorageKey(source) {
+  return createHash('sha256').update(pathIdentity(source)).digest('hex')
+}
+
+function requireDisjointStorage(source, storage) {
+  if (within(source, storage) || within(storage, source)) {
+    throw new Error('Host 独立工作区存储必须与原工作区互不包含。')
+  }
+}
+
+/** Reject junctions before creating deeper directories in Host-managed storage. */
+async function storageDirectory(parent, name) {
+  const target = join(parent, name)
+  try { await mkdir(target) }
+  catch (error) { if (error?.code !== 'EEXIST') throw error }
+  const entry = await lstat(target)
+  const canonical = await canonicalDirectory(target)
+  if (!entry.isDirectory() || entry.isSymbolicLink() || pathIdentity(canonical) !== pathIdentity(target)) {
+    throw new Error('Host 独立工作区存储不能经过符号链接或目录联接。')
+  }
+  return canonical
+}
+
+/**
+ * Windows ACL grants need WRITE_OWNER as well as ordinary file modification.
+ * Use the user's existing private temp storage rather than changing a source
+ * drive's ACL. Only the individual run receives the sandbox write capability;
+ * the SDK's separate random private temp remains disjoint from that run.
+ */
+async function windowsStorageParent(source, create = false) {
+  const temporary = await canonicalDirectory(tmpdir())
+  const rootPath = join(temporary, '.model-router-workspaces')
+  requireDisjointStorage(source, rootPath)
+  const root = create ? await storageDirectory(temporary, '.model-router-workspaces')
+    : await canonicalDirectory(rootPath)
+  if (pathIdentity(root) !== pathIdentity(rootPath)) throw new Error('Host 独立工作区存储路径校验失败。')
+  const key = sourceStorageKey(source)
+  const parentPath = join(root, key)
+  const parent = create ? await storageDirectory(root, key) : await canonicalDirectory(parentPath)
+  if (pathIdentity(parent) !== pathIdentity(parentPath)) throw new Error('Host 独立工作区存储路径校验失败。')
+  requireDisjointStorage(source, parent)
+  return parent
+}
+
 /** The session owner, never model arguments, selects the filesystem scope. */
 export async function sessionWorkspace(ctx, exec) {
   const session = exec?.agent?.session
@@ -97,6 +154,13 @@ async function cleanRepoRoot(workspace, signal) {
   return repo
 }
 
+/** Preview-only validation; never creates a worktree or changes ignore rules. */
+export async function preflightOfficialWorkspace(workspace, mode = 'read-only', signal) {
+  const source = await canonicalDirectory(workspace)
+  if (mode === 'workspace-write') await cleanRepoRoot(source, signal)
+  return source
+}
+
 /** Keep nested worktrees out of ordinary git status without changing tracked files. */
 async function excludeNestedWorktrees(workspace, signal) {
   const ignored = await git(['check-ignore', '-q', '--', '.model-router-workspaces/'], { cwd: workspace, signal })
@@ -114,25 +178,31 @@ async function excludeNestedWorktrees(workspace, signal) {
   if (!confirmed.ok) throw gitError('确认独立工作区忽略规则', confirmed)
 }
 
-/** Keep generated worktrees beside the project so they use the same drive. */
+/** Source authorization is independent from the Host's isolated output storage. */
 async function isolatedWorktree(workspace, signal, allowedRoot) {
+  workspace = await approvedSource(workspace, allowedRoot)
   await cleanRepoRoot(workspace, signal)
   const base = await git(['rev-parse', 'HEAD'], { cwd: workspace, signal })
   if (!base.ok || !/^[0-9a-f]{40,64}$/i.test(base.output.toString('utf8').trim())) {
     throw gitError('记录原仓库基线', base)
   }
   const baseCommit = base.output.toString('utf8').trim()
-  const policyRoot = await canonicalDirectory(allowedRoot ?? workspace)
-  const sibling = join(dirname(workspace), '.model-router-workspaces', basename(workspace))
-  const parent = within(policyRoot, sibling) ? sibling : join(workspace, '.model-router-workspaces')
-  if (parent === join(workspace, '.model-router-workspaces')) await excludeNestedWorktrees(workspace, signal)
-  await mkdir(parent, { recursive: true })
-  const isolatedRoot = await canonicalDirectory(parent)
+  let isolatedRoot
+  if (process.platform === 'win32') isolatedRoot = await windowsStorageParent(workspace, true)
+  else {
+    const policyRoot = await canonicalDirectory(allowedRoot ?? workspace)
+    const sibling = join(dirname(workspace), '.model-router-workspaces', basename(workspace))
+    const parent = within(policyRoot, sibling) ? sibling : join(workspace, '.model-router-workspaces')
+    if (parent === join(workspace, '.model-router-workspaces')) await excludeNestedWorktrees(workspace, signal)
+    await mkdir(parent, { recursive: true })
+    isolatedRoot = await canonicalDirectory(parent)
+  }
   const target = join(isolatedRoot, `run-${randomUUID()}`)
   const added = await git(['worktree', 'add', '--detach', target, 'HEAD'], { cwd: workspace, signal })
   if (!added.ok) throw gitError('创建独立 Git 工作区', added)
   const runPath = await canonicalDirectory(target)
-  if (!within(isolatedRoot, runPath) || runPath === isolatedRoot) throw new Error('独立工作区路径校验失败')
+  if (pathIdentity(dirname(runPath)) !== pathIdentity(isolatedRoot)
+    || pathIdentity(runPath) !== pathIdentity(target)) throw new Error('独立工作区路径校验失败')
   return { workspace: runPath, isolatedRoot, baseCommit, source: workspace }
 }
 
@@ -198,13 +268,11 @@ function checkedTeamCliModels(cliModels, assigned) {
 
 function teamCliModel(item, cliModels) {
   // Harness directory IDs and vendor CLI aliases are independent namespaces.
-  // Only the two CLIs with a verified direct model argument contract receive
-  // a planned ID. All other vendors use their configured default until the
-  // user supplies a verified CLI mapping through that vendor's own settings.
+  // Every vendor uses its own configured default unless a package or tool
+  // explicitly binds the model name accepted by that CLI.
   if (cliModels[item.id]) return cliModels[item.id]
   if (cliModels[item.toolId]) return cliModels[item.toolId]
-  return item.toolId === 'claude-code' || item.toolId === 'codex'
-    ? item.recommendedModel : null
+  return null
 }
 
 function reportedCliModel(toolId, value) {
@@ -241,8 +309,8 @@ function packagePrompt(task, item, completed) {
 }
 
 /** Preflight every assignment before any model request or workspace write. */
-export function executableTeamPackages(plan, installedIds = [], mode = 'read-only') {
-  const capabilities = new Map(officialToolExecutionCapabilities().map(item => [item.id, item]))
+export function executableTeamPackages(plan, installedIds = [], mode = 'read-only', executionEnvironment = 'harness') {
+  const capabilities = new Map(officialToolExecutionCapabilities({ executionEnvironment }).map(item => [item.id, item]))
   const packages = Array.isArray(plan?.team?.workPackages) ? plan.team.workPackages : []
   const blocking = []
   const assigned = packages.map(item => {
@@ -266,6 +334,34 @@ async function removeWorktree(source, target) {
   try { await git(['worktree', 'remove', '--force', target], { cwd: source }) } catch { /* left for manual cleanup */ }
 }
 
+function executionDiagnostic(value) {
+  let detail = String(value ?? '')
+  for (const key of ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN',
+    'OPENAI_API_KEY', 'CODEX_API_KEY', 'KIMI_API_KEY', 'MOONSHOT_API_KEY', 'MINIMAX_API_KEY',
+    'MIMO_API_KEY', 'XAI_API_KEY', 'ZAI_API_KEY', 'GEMINI_API_KEY', 'GOOGLE_API_KEY']) {
+    const secret = process.env[key]
+    if (typeof secret === 'string' && secret) detail = detail.split(secret).join('[redacted]')
+  }
+  return redactDiagnostic(detail, '', 2_000)
+}
+
+function executionException(error, signal) {
+  const detail = executionDiagnostic(error?.message ?? error)
+  const cancelled = signal?.aborted === true || error?.name === 'AbortError'
+  return { status: cancelled ? 'cancelled' : 'failed', exitCode: null, finalText: '',
+    error: `${cancelled ? '官方 CLI 执行已取消' : '官方 CLI 执行器异常'}${detail ? `：${detail}` : '。'}`,
+    detail }
+}
+
+/** The ledger accepts this bounded, scrubbed field instead of raw CLI streams. */
+function withFailureDiagnostic(result) {
+  if (result.status === 'succeeded') return result
+  const diagnostic = executionDiagnostic(result.diagnostic ?? verifiedDiagnostic(result))
+  return { ...result, ...(result.error ? { error: executionDiagnostic(result.error) } : {}),
+    ...(result.reason ? { reason: executionDiagnostic(result.reason) } : {}),
+    ...(diagnostic ? { diagnostic } : {}) }
+}
+
 /**
  * Copy the changes of an earlier, never integrated worktree into a fresh one.
  * Refuses when the original checkout moved since that run (the patch would be
@@ -279,11 +375,25 @@ async function seedWorktree(isolated, seedFrom, signal) {
   let prior
   try { prior = await canonicalDirectory(seedFrom.workspace) }
   catch { throw new Error('原运行的独立工作区已不存在，无法套用之前的改动；请重新执行整个团队任务。') }
-  // Only a worktree of this repository that the plugin created (run-<uuid>) is accepted.
-  const listed = await git(['worktree', 'list', '--porcelain'], { cwd: isolated.source, signal })
-  const worktrees = listed.ok ? listed.output.toString('utf8').split(/\r?\n/).filter(line => line.startsWith('worktree ')).map(line => line.slice(9)) : []
+  // A basename is not ownership evidence: require this repository's membership
+  // and an exact canonical parent derived from this source, including old runs.
+  const listed = await git(['worktree', 'list', '--porcelain', '-z'], { cwd: isolated.source, signal })
+  const worktrees = listed.ok ? listed.output.toString('utf8').split('\0').filter(line => line.startsWith('worktree ')).map(line => line.slice(9)) : []
   const known = await Promise.all(worktrees.map(path => canonicalDirectory(path).catch(() => null)))
-  if (!known.includes(prior) || !/^run-[0-9a-f-]{36}$/i.test(basename(prior)) || basename(dirname(dirname(prior))) !== '.model-router-workspaces' && basename(dirname(prior)) !== '.model-router-workspaces') {
+  const expectedParents = [join(isolated.source, '.model-router-workspaces'),
+    join(dirname(isolated.source), '.model-router-workspaces', basename(isolated.source))]
+  if (process.platform === 'win32') {
+    try { expectedParents.push(await windowsStorageParent(isolated.source)) } catch { /* a removed/redirected Host parent is not trusted */ }
+  }
+  const parents = await Promise.all(expectedParents.map(async path => {
+    try {
+      const canonical = await canonicalDirectory(path)
+      return pathIdentity(canonical) === pathIdentity(path) ? canonical : null
+    } catch { return null }
+  }))
+  if (!known.some(path => path && pathIdentity(path) === pathIdentity(prior))
+    || !/^run-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(basename(prior))
+    || !parents.some(path => path && pathIdentity(path) === pathIdentity(dirname(prior)))) {
     throw new Error('原独立工作区不是本仓库由插件创建的 Git 工作树，拒绝读取。')
   }
   const staged = await git(['add', '-A'], { cwd: prior, signal })
@@ -301,7 +411,9 @@ async function seedWorktree(isolated, seedFrom, signal) {
 }
 
 /** Sequential execution preserves DAG dependencies and avoids edit conflicts. */
-export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode = 'read-only', installedIds = [], cliModels, signal, sandbox, runtime, previous = [], onlyIds = null, seedFrom = null }) {
+export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode = 'read-only', executionEnvironment = 'harness', installedIds = [], cliModels, signal, sandbox, runtime, previous = [], onlyIds = null, seedFrom = null }) {
+  if (!['harness', 'cli-native'].includes(executionEnvironment)
+    || (executionEnvironment === 'cli-native' && mode !== 'workspace-write')) throw new TypeError('invalid team CLI execution environment')
   // A retry runs only `onlyIds`; earlier results feed dependency context. An
   // editable retry needs `seedFrom` (the earlier, never integrated worktree and
   // its base commit): a fresh worktree gets that worktree's changes first, so
@@ -310,22 +422,23 @@ export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode
   if (retry && mode !== 'read-only' && !(seedFrom && typeof seedFrom.workspace === 'string' && typeof seedFrom.baseCommit === 'string')) {
     throw new TypeError('an editable team retry needs the earlier isolated worktree (seedFrom)')
   }
-  const selected = executableTeamPackages(plan, installedIds, mode)
+  const selected = executableTeamPackages(plan, installedIds, mode, executionEnvironment)
   const assigned = retry ? selected.assigned.filter(item => onlyIds.includes(item.id)) : selected.assigned
   const blocking = retry ? selected.blocking.filter(item => onlyIds.includes(item.id)) : selected.blocking
   if (assigned.length === 0) return { status: 'blocked', blocking: [{ reason: '计划没有工作包。' }], results: [] }
   if (blocking.length > 0) return { status: 'blocked', blocking, results: [] }
   if (mode !== 'read-only' && mode !== 'workspace-write') throw new TypeError('team mode must be read-only or workspace-write')
   const configuredCliModels = checkedTeamCliModels(cliModels, assigned)
-  const source = await canonicalDirectory(workspace)
-  if (typeof sandbox?.confine !== 'function') return { status: 'blocked', blocking: [{ reason: '官方 Harness 进程沙箱不可用。' }], results: [] }
+  const source = await approvedSource(workspace, allowedRoot)
+  if (executionEnvironment === 'harness' && typeof sandbox?.confine !== 'function') return { status: 'blocked', blocking: [{ reason: '官方 Harness 进程沙箱不可用。' }], results: [] }
   // The Host passes no runtime override. Tests can inject inert CLI adapters to
   // exercise assignment, stopping, and Git integration without provider accounts.
   const readinessCheck = runtime?.readiness ?? officialToolReadiness
   const runTool = runtime?.runTool ?? runOfficialTool
-  const readiness = await Promise.all([...new Set(assigned.map(item => item.toolId))].map(id => readinessCheck(id, source)))
-  const unready = readiness.filter(item => !item.ready)
-  if (unready.length > 0) return { status: 'blocked', blocking: unready.map(item => ({ toolId: item.id, reason: item.reason })), results: [] }
+  const readiness = await Promise.all([...new Set(assigned.map(item => item.toolId))].map(id => readinessCheck(id, source, { executionEnvironment })))
+  const unready = readiness.filter(item => !item.ready || !(item.readyModes ?? item.modes ?? [mode]).includes(mode))
+  if (unready.length > 0) return { status: 'blocked', blocking: unready.map(item => ({ toolId: item.id,
+    reason: item.reason ?? `官方 CLI 尚未就绪，或不支持 ${mode} 模式。` })), results: [] }
   const isolated = mode === 'workspace-write' ? await isolatedWorktree(source, signal, allowedRoot) : null
   const runWorkspace = isolated?.workspace ?? source
   let seeded = null
@@ -339,18 +452,28 @@ export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode
   const completed = []
   const context = retry ? (Array.isArray(previous) ? previous : []).filter(item => item?.id && typeof item.finalText === 'string') : []
   for (const item of assigned) {
-    if (signal?.aborted) return { status: 'cancelled', workspace: runWorkspace, results: completed }
+    if (signal?.aborted) return { status: 'cancelled', workspace: runWorkspace, results: completed,
+      ...(isolated ? { baseCommit: isolated.baseCommit } : {}), ...(seeded ? { seeded } : {}) }
     const cliModel = teamCliModel(item, configuredCliModels)
-    const result = await runTool({
-      toolId: item.toolId,
-      modelId: cliModel,
-      task: packagePrompt(task, item, [...context, ...completed]),
-      workspace: runWorkspace,
-      mode,
-      isolatedRoot: isolated?.isolatedRoot,
-      sandbox,
-      signal,
-    })
+    let result
+    try {
+      result = await runTool({
+        toolId: item.toolId,
+        modelId: cliModel,
+        task: packagePrompt(task, item, [...context, ...completed]),
+        workspace: runWorkspace,
+        mode,
+        isolatedRoot: isolated?.isolatedRoot,
+        sandbox,
+        signal,
+        executionEnvironment,
+      })
+      if (!result || typeof result.status !== 'string') throw new TypeError('官方 CLI 执行器没有返回有效状态。')
+    } catch (error) {
+      // Keep earlier paid results and the isolated worktree available for the
+      // ledger and retry even when a later adapter rejects before returning.
+      result = executionException(error, signal)
+    }
     const reportedModel = reportedCliModel(item.toolId, result.reportedModel)
     const modelMismatch = result.status === 'succeeded' && cliModel && reportedModel
       && cliModel !== reportedModel
@@ -358,19 +481,26 @@ export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode
     completed.push({ id: item.id, name: item.name,
       ...(item.objective ? { objective: item.objective } : {}), provider: item.recommendedProvider,
       recommendedModel: item.recommendedModel, toolId: item.toolId,
-      requestedCliModel: result.requestedModel ?? null,
+      requestedCliModel: Object.hasOwn(result, 'requestedModel') ? result.requestedModel : cliModel,
       actualModel: reportedModel,
+      ...(result.reportedModel !== undefined ? { reportedModel: result.reportedModel } : {}),
+      ...(result.usageIncomplete === true ? { usageIncomplete: true } : {}),
+      ...(typeof result.source === 'string' ? { source: result.source } : {}),
+      ...(typeof result.sandboxEnforcement === 'string' ? { sandboxEnforcement: result.sandboxEnforcement } : {}),
+      executionEnvironment,
       modelNotice: modelMismatch
         ? `官方 CLI 回报模型 ${reportedModel}，与本包指定的 ${cliModel} 不一致；后续工作包已停止。`
         : result.modelNotice ?? (!cliModel
         ? 'Harness 推荐模型 ID 未经此厂商 CLI 验证；本包使用厂商 CLI 已配置的默认模型。'
         : reportedModel ? null : '该 CLI 未返回可核验的实际模型 ID；请以厂商运行记录核对。'),
       status: packageStatus, finalText: result.finalText ?? '',
+      exitCode: result.exitCode ?? null,
       ...(result.usage ? { usage: result.usage } : {}),
       ...(Number.isFinite(result.reportedCostUsd) ? { reportedCostUsd: result.reportedCostUsd } : {}),
-      error: modelMismatch ? '官方 CLI 实际模型与指定模型不一致。' : result.error ?? result.reason ?? null,
-      outputTail: result.status === 'succeeded' ? null : result.stderrTail ?? result.stdoutTail ?? null })
-    if (packageStatus !== 'succeeded') return { status: 'incomplete', workspace: runWorkspace, results: completed,
+      error: modelMismatch ? '官方 CLI 实际模型与指定模型不一致。'
+        : (result.error || result.reason) ? executionDiagnostic(result.error || result.reason) : null,
+      outputTail: result.status === 'succeeded' ? null : executionDiagnostic(verifiedDiagnostic(result)) || null })
+    if (packageStatus !== 'succeeded') return { status: packageStatus === 'cancelled' ? 'cancelled' : 'incomplete', workspace: runWorkspace, results: completed,
       ...(isolated ? { baseCommit: isolated.baseCommit } : {}), ...(seeded ? { seeded } : {}) }
   }
   if (!isolated) return { status: 'cli-completed', workspace: runWorkspace, results: completed,
@@ -390,14 +520,24 @@ export async function runOfficialTeam({ plan, task, workspace, allowedRoot, mode
 }
 
 /** One editable CLI task also uses the same isolated workspace and merge gate. */
-export async function runOfficialTask({ toolId, task, workspace, allowedRoot, modelId, mode = 'read-only', signal, sandbox }) {
-  const source = await canonicalDirectory(workspace)
+export async function runOfficialTask({ toolId, task, workspace, allowedRoot, modelId, mode = 'read-only', signal, sandbox, runtime }) {
+  const source = await approvedSource(workspace, allowedRoot)
   if (typeof sandbox?.confine !== 'function') return { toolId, status: 'unsupported', reason: '官方 Harness 进程沙箱不可用。' }
-  const readiness = await officialToolReadiness(toolId, source)
-  if (!readiness.ready) return { toolId, status: 'unsupported', reason: readiness.reason }
+  // The Host supplies no runtime override; offline tests use inert adapters.
+  const readiness = await (runtime?.readiness ?? officialToolReadiness)(toolId, source)
+  const readyModes = readiness.readyModes ?? readiness.modes ?? []
+  if (!readiness.ready || !readyModes.includes(mode)) return { toolId, status: 'unsupported',
+    reason: readiness.reason ?? readiness.modeReasons?.[mode] ?? `官方 CLI 尚未就绪，或不支持 ${mode} 模式。` }
   const isolated = mode === 'workspace-write' ? await isolatedWorktree(source, signal, allowedRoot) : null
-  const result = await runOfficialTool({ toolId, task, modelId, workspace: isolated?.workspace ?? source,
-    mode, isolatedRoot: isolated?.isolatedRoot, signal, sandbox })
+  let result
+  try {
+    result = await (runtime?.runTool ?? runOfficialTool)({ toolId, task, modelId, workspace: isolated?.workspace ?? source,
+      mode, isolatedRoot: isolated?.isolatedRoot, signal, sandbox })
+    if (!result || typeof result.status !== 'string') throw new TypeError('官方 CLI 执行器没有返回有效状态。')
+  } catch (error) {
+    result = executionException(error, signal)
+  }
+  result = withFailureDiagnostic(result)
   if (!isolated || result.status !== 'succeeded') return { ...result, ...(isolated ? { isolatedWorkspace: isolated.workspace, baseCommit: isolated.baseCommit } : {}) }
   try {
     const integration = await integrateWorktree(source, isolated.workspace, isolated.baseCommit, signal)