@nowcrew/daemon 0.6.88-beta.15 → 0.6.88-beta.16

package/README.md

@@ -3,6 +3,21 @@
 The daemon is NowWork's local execution adapter. It holds a machine credential, keeps one control-plane
 WebSocket open, and launches coding runtimes on that machine. Product policy remains on the server.
 
+## 已完成搬迁后的存储运行
+
+NAS / `NOWWORK_HOME` 搬迁和旧 daemon 布局标准化入口已退役。daemon 不再提供内部
+`storage-migration-worker` / `storage-migration-recover` 命令，不处理 `daemon:migrate`、
+`daemon:storage-doctor`、`daemon:storage-migrate` 或迁移确认消息，也不再声明
+`storage_migration_v1` / `storage_migration_status_v1` / `daemon_layout_migration_v1` 能力。
+
+现有 `installations.json` 即使仍有历史 `storageMigrationId`，也按当前 installation 解析
+Agent、仓库和报告目录；启动、hello 和身份绑定不再读取迁移 receipt、outbox 或备份。
+hello 继续报告布局、环境、Workspace、路径指纹与 ownership，但不再发送迁移 ID。
+每次连接仍须完成 Server 身份绑定后才能执行任务；Workspace 或 Machine 身份不匹配时拒绝执行。
+
+旧布局读取兼容、日常安装/升级、NAS 所有权校验、执行 journal 与 ACK/replay 继续保留。
+退役代码不会删除历史安装字段、迁移记录、receipt、备份或旧数据目录；这些数据的保留与清理另行处理。
+
 ## Run
 
 For a temporary foreground connection, run:

package/dist/daemon-update-eligibility.js

@@ -14,7 +14,7 @@ import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, man
 export async function managedDaemonCapabilities(eligibility) {
     try {
         return (await eligibility()).eligible
-            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1", "daemon_layout_migration_v1"]
+            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1"]
             : [];
     }
     catch {

package/dist/local-executor.js

@@ -1,3 +1,4 @@
+import { deepSeekHarnessLauncher } from "./runtimes/deepseek-harness.js";
 import { createInterface } from "node:readline";
 import { readFile, rm, writeFile } from "node:fs/promises";
 import { delimiter, join } from "node:path";
@@ -569,7 +570,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 });
             }
             const trainingRoots = input.trainingProjectContext?.projects.map((project) => project.root) ?? [];
-            const { codexSkillRoots, claudeAdditionalDirectories } = await projectSkillRuntimeDirectories({
+            const { codexSkillRoots, claudeAdditionalDirectories, harnessSkillRoots } = await projectSkillRuntimeDirectories({
                 runtime: runtime.name,
                 ...(runtimeRoot === undefined ? {} : { runtimeRoot }),
                 agentRoot: workspace.dir,
@@ -607,7 +608,8 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const workspaceRoots = [...legacyRoots, ...trainingRoots];
             const launchRequest = {
                 runtime: runtime.name,
-                bin: runtime.name === "deepseek-harness" ? "dsh-acp-demo" : runtime.name,
+                bin: runtime.name === "deepseek-harness" ? deepSeekHarnessLauncher(runtimeEnv).bin : runtime.name,
+                ...(runtime.name === "deepseek-harness" ? { harnessStateRoot: executionWorkspace.runDir, harnessSkillRoots: harnessSkillRoots ?? [] } : {}),
                 cwd: input.projectContext?.primary?.root ?? executionWorkspace.runDir,
                 ...(runtimeRoot !== undefined
                     || (input.projectSkills === undefined && input.abilityRelease === undefined)

package/dist/machine-info.js

@@ -18,7 +18,7 @@ import { probeKimiAcp } from "./runtimes/kimi-acp-runner.js";
 import { probeHermesAcp } from "./runtimes/hermes.js";
 import { probeOpenCodeRun } from "./runtimes/opencode.js";
 import { RUNTIME_HEALTH_PROBE_CAPABILITY } from "./runtime-health.js";
-import { probeDeepSeekHarnessAcp } from "./runtimes/deepseek-harness.js";
+import { probeDeepSeekHarnessAcp, deepSeekHarnessLauncher } from "./runtimes/deepseek-harness.js";
 import { daemonHome } from "./computer-profile.js";
 import { daemonReleaseProvenance } from "./release-provenance.js";
 export { executableRuntimes } from "./runtime-capabilities.js";
@@ -90,7 +90,7 @@ const RUNTIME_BINS = [
     ["gemini", "gemini"],
     ["hermes", "hermes"],
     ["opencode", "opencode"],
-    ["deepseek-harness", "dsh-acp-demo"],
+    ["deepseek-harness", "dsh"],
     ["copilot", "copilot"],
     ["kimi", "kimi"],
     ["pi", "pi"],
@@ -107,7 +107,14 @@ async function isInstalled(bin) {
 }
 /** 并发探测所有候选 runtime,返回已安装的展示名列表。 */
 export async function detectRuntimes() {
-    const checks = await Promise.all(RUNTIME_BINS.map(async ([name, bin]) => ((await isInstalled(bin)) ? name : null)));
+    const checks = await Promise.all(RUNTIME_BINS.map(async ([name, bin]) => {
+        try {
+            return await isInstalled(name === "deepseek-harness" ? deepSeekHarnessLauncher().bin : bin) ? name : null;
+        }
+        catch {
+            return null;
+        }
+    }));
     return checks.filter((x) => x !== null);
 }
 async function supportsKimiAcp(signal) {
@@ -120,7 +127,12 @@ async function supportsOpenCodeRun(signal) {
     return probeOpenCodeRun(signal);
 }
 async function supportsDeepSeekHarnessAcp(signal) {
-    return probeDeepSeekHarnessAcp({ bin: "dsh-acp-demo", ...(signal ? { signal } : {}) });
+    try {
+        return await probeDeepSeekHarnessAcp({ bin: deepSeekHarnessLauncher().bin, ...(signal ? { signal } : {}) });
+    }
+    catch {
+        return false;
+    }
 }
 /** Runtime adapters that can satisfy the durable protocol-v1 process contract. */
 export async function detectExecutionRuntimes(installed = detectRuntimes(), kimiAcpProbe = supportsKimiAcp, hermesAcpProbe = supportsHermesAcp, openCodeProbe = supportsOpenCodeRun, deepSeekHarnessProbe = supportsDeepSeekHarnessAcp, signal) {

package/dist/main.js

@@ -7,7 +7,6 @@
  */
 import { parseArgs } from "node:util";
 import { homedir } from "node:os";
-import { join } from "node:path";
 import { loadConfig, ConfigError } from "./config.js";
 import { detectDaemonLang, formatDaemonText, translateDaemon } from "./i18n.js";
 import { cliVersion, daemonVersion } from "./machine-info.js";
@@ -25,19 +24,9 @@ import { assertManagedServiceStartup } from "./managed-service-startup.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { acquireDaemonInstallationLease, runWithDaemonInstallationLease, } from "./daemon-installation-lease.js";
 import { createStorageRuntimeOwnershipBinding, loadStorageRuntime } from "./storage-runtime.js";
-import { readStorageMigrationReceipt } from "./storage-migration-controller.js";
-import { storageMigrationStatusReplay } from "./storage-status-replay.js";
-import { runStorageWorkerCommand } from "./storage-worker-command.js";
-import { probeStorageMigrationRuntime } from "./storage-runtime-readiness.js";
-import { createStorageTargetConfirmationHandler } from "./storage-target-confirmation.js";
 import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 import { storageServiceEnvironment } from "./computer-service.js";
 async function main() {
-    const workerResult = await runStorageWorkerCommand(process.argv.slice(2));
-    if (workerResult !== null) {
-        process.exitCode = workerResult;
-        return;
-    }
     const computerResult = await runComputerCommand(process.argv.slice(2));
     if (computerResult !== null) {
         process.exitCode = computerResult;
@@ -74,7 +63,6 @@ async function main() {
     // 不把 machine token 放进 argv / plist / systemd unit / scheduled task。
     if (values["daemon-home"])
         process.env.CREW_DAEMON_HOME = values["daemon-home"];
-    let activeDaemonHome;
     const localHome = resolveDaemonLocalStateRoot({
         userHome: homedir(),
         platform: process.platform,
@@ -85,7 +73,6 @@ async function main() {
     });
     if (values.profile) {
         const home = daemonHome(process.env, values.profile);
-        activeDaemonHome = home;
         const profile = await loadProfile(values.profile, home);
         if (cmd === "serve") {
             await assertProfileAgentsRootUnique(profile, home, homedir());
@@ -148,68 +135,16 @@ async function main() {
         const installationLease = installation === null
             ? null
             : await acquireDaemonInstallationLease(installation.npmPrefix, { localHome });
-        const migrationRuntime = values.profile === undefined || activeDaemonHome === undefined || storageRuntime !== null
-            ? { ready: false, reason: "not_legacy_source" }
-            : await probeStorageMigrationRuntime({
-                profile: values.profile,
-                serverUrl: config.serverUrl,
-                currentDaemonHome: activeDaemonHome,
-                currentAgentsRoot: config.agentsRoot,
-                userHome: homedir(),
-                platform: process.platform,
-                ...(process.getuid === undefined ? {} : { uid: process.getuid() }),
-                environment: process.env,
-            });
-        const targetStorageBinding = storageRuntime === null
+        const storageBinding = storageRuntime === null
             ? null
             : createStorageRuntimeOwnershipBinding(storageRuntime);
-        const targetConfirmation = storageRuntime?.identity.storageMigrationId === undefined
-            ? null
-            : createStorageTargetConfirmationHandler({
-                backupsRoot: storageRuntime.local.backupsRoot,
-                identity: storageRuntime.identity,
-                profile: storageRuntime.installation.profile,
-                completionTimeoutMs: 180_000,
-            });
-        const storageMigration = storageRuntime !== null
-            ? {
-                ready: false,
-                statusOutboxPath: join(storageRuntime.local.stateRoot, "storage-status-outbox.json"),
-                identity: targetStorageBinding.identity,
-                bindServerIdentity: targetStorageBinding.bind,
-                ...(targetConfirmation === null ? {} : { confirm: targetConfirmation.handle }),
-                ...(storageRuntime.identity.storageMigrationId === undefined ? {} : {
-                    replayStatus: async (send) => {
-                        const migrationId = storageRuntime.identity.storageMigrationId;
-                        const receipt = await readStorageMigrationReceipt(storageRuntime.local.backupsRoot, migrationId);
-                        if (receipt === null)
-                            throw new Error(`storage migration receipt not found: ${migrationId}`);
-                        for (const frame of storageMigrationStatusReplay(receipt, {
-                            migrationId,
-                            environment: storageRuntime.identity.storageEnvironment,
-                            workspaceId: storageRuntime.identity.storageWorkspaceId,
-                            profile: storageRuntime.installation.profile,
-                        }))
-                            send(frame);
-                    },
-                }),
-            }
-            : migrationRuntime.ready
-                ? {
-                    ready: true,
-                    statusOutboxPath: migrationRuntime.runtime.statusOutboxPath,
-                    identity: migrationRuntime.runtime.identity,
-                    controller: migrationRuntime.runtime.controller,
-                    attach: migrationRuntime.runtime.attach,
-                    bindServerIdentity: migrationRuntime.runtime.bindServerIdentity,
-                    replayStatus: migrationRuntime.runtime.replayStatus,
-                }
-                : undefined;
         await runWithDaemonInstallationLease(installationLease, async () => {
             const service = serve(runtimeConfig, {
                 ...(values.profile === undefined ? {} : { profileName: values.profile }),
                 localHome,
-                ...(storageMigration === undefined ? {} : { storageMigration }),
+                ...(storageBinding === null ? {} : {
+                    storageRuntime: { identity: storageBinding.identity, bindServerIdentity: storageBinding.bind },
+                }),
             });
             await runServeLifecycle(service);
         });

package/dist/project-skills/execution-adapter.js

@@ -9,10 +9,11 @@ export function projectSkillExecutionProjection(bindings, generation) {
         });
 }
 /**
- * 投影门控与 ownership 判定的唯一谓词:只有绑定了 Project Skills 且运行时是 codex/claude 的执行
+ * 投影门控与 ownership 判定的唯一谓词:只有绑定了 Project Skills 且运行时支持受控目录的执行
  * 才会有投影目录,也才需要在停止无法证明时保留它。两处判定分开写过一次,结果 kimi + projectSkills
  * 会在取消路径上错抛 ownership 未确认。
  */
 export const projectSkillProjectionApplies = (spec) => spec.agent.projectSkills !== undefined
-    && (spec.runtime.name === "codex" || spec.runtime.name === "claude");
+    && (spec.runtime.name === "codex" || spec.runtime.name === "claude"
+        || spec.runtime.name === "deepseek-harness");
 export const projectSkillProjectionErrorCode = (error) => error instanceof ProjectProjectionError ? error.code : null;

package/dist/project-skills/runtime-launch.js

@@ -11,12 +11,26 @@ export function projectSkillRuntimeLaunchFacts(runtime, root) {
     if (runtime === "claude") {
         return Object.freeze({ claudeAdditionalDirectory: root.claudeAdditionalDirectory });
     }
+    if (runtime === "deepseek-harness") {
+        return Object.freeze({ harnessSkillRoot: root.codexSkillRoot });
+    }
     throw new ProjectProjectionError("skill_projection_failed");
 }
 /** Builds Runtime-native arrays while keeping v1 shared roots separate from v2 exact roots. */
 export async function projectSkillRuntimeDirectories(input) {
     const trainingProjectRoots = input.trainingProjectRoots ?? [];
     const facts = projectSkillRuntimeLaunchFacts(input.runtime, input.runtimeRoot);
+    if (input.runtime === "deepseek-harness") {
+        // Harness 的 local provider 接受直接包含 Skill 子目录的受控 root,不扫描项目/用户目录。
+        return Object.freeze({
+            codexSkillRoots: Object.freeze([]),
+            claudeAdditionalDirectories: Object.freeze([]),
+            harnessSkillRoots: Object.freeze([
+                ...(facts.harnessSkillRoot === undefined ? [] : [facts.harnessSkillRoot]),
+                ...(input.abilitySkillRoot === undefined ? [] : [input.abilitySkillRoot]),
+            ]),
+        });
+    }
     const codexSkillRoots = input.runtime === "codex"
         && (input.runtimeRoot !== undefined || input.projectContext !== undefined)
         ? Object.freeze([

package/dist/provider-env.js

@@ -10,7 +10,6 @@
  */
 import { join } from "node:path";
 import { DEEPSEEK_CODEX_KEY_ENV, deepSeekCodexHome, } from "./runtimes/codex-deepseek-config.js";
-import { DEEPSEEK_HARNESS_CONFIG_ENV } from "./runtimes/deepseek-harness.js";
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const RESERVED_ENV = new Set([
     "PATH",
@@ -96,9 +95,9 @@ export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverri
     }
     return env;
 }
-const deepSeekHarnessMachineOwnedKey = (key) => (key.startsWith("DEEPSEEK_")
-    || key === DEEPSEEK_HARNESS_CONFIG_ENV
-    || key.startsWith("DSH_"));
+const deepSeekHarnessMachineOwnedKey = (key) => (key.toUpperCase().startsWith("DEEPSEEK_")
+    || key.toUpperCase().startsWith("NOWCREW_DEEPSEEK_HARNESS_")
+    || key.toUpperCase().startsWith("DSH_"));
 /** Agent env remains available to tools, but cannot replace Harness process policy or credentials. */
 export function applyDeepSeekHarnessMachineEnv(base, machineEnv) {
     const env = { ...base };

package/dist/runtimes/deepseek-harness-profile.js

@@ -0,0 +1,92 @@
+/** 短命执行配置:不读取全局 Harness home,不新增 daemon 状态。 */
+import { mkdtemp, mkdir, writeFile, access } from "node:fs/promises";
+import { join, isAbsolute } from "node:path";
+import { stringify } from "yaml";
+export const harnessPermissionMode = (permission) => permission === "sandboxed"
+    ? "read-only"
+    : permission === "workspace_write"
+        ? "workspace-write"
+        : "danger-full-access";
+// A variable's returned value is interpolated once: literal {{...}} in NowWork
+// instructions must not become unknown Harness template variables.
+const instructionsPlugin = `export const name = 'nowwork-instructions';
+export const inject = ['systemPrompt'];
+export function apply(ctx, config) {
+  ctx.systemPrompt.variable('nowwork_instructions', () => config.text);
+  ctx.systemPrompt.section({name: 'nowwork-instructions', order: 100000, text: '{{nowwork_instructions}}'});
+}
+`;
+export async function prepareHarnessProfile(input) {
+    if (![input.stateRoot, input.cwd, ...input.skillRoots].every(isAbsolute)) {
+        throw new Error("DeepSeek Harness execution paths must be absolute");
+    }
+    if (input.patchPath !== undefined) {
+        if (!isAbsolute(input.patchPath))
+            throw new Error("DeepSeek Harness patch must be absolute");
+        await access(input.patchPath);
+    }
+    await mkdir(input.stateRoot, { recursive: true, mode: 0o700 });
+    const home = await mkdtemp(join(input.stateRoot, ".deepseek-harness-"));
+    const pluginPath = join(home, "nowwork-instructions.mjs");
+    const policyPath = join(home, "nowwork-policy.yml");
+    const mode = harnessPermissionMode(input.effectivePermission);
+    await writeFile(pluginPath, instructionsPlugin, { mode: 0o600 });
+    await writeFile(policyPath, stringify([
+        {
+            id: "sandbox-policy",
+            disabled: false,
+            config: { mode, workspaceRoot: input.cwd },
+        },
+        { id: "approval", disabled: false, config: { policy: "never" } },
+        {
+            id: "permission",
+            disabled: false,
+            config: {
+                defaultPreset: "nowwork",
+                presets: { nowwork: { sandbox: mode, approval: "never" } },
+            },
+        },
+        {
+            id: "skill-filesystem",
+            disabled: false,
+            config: {
+                includeDefaultRoots: false,
+                customSkillDirs: [...input.skillRoots],
+                watch: false,
+            },
+        },
+        {
+            id: "session-persistence-jsonl",
+            disabled: false,
+            config: { root: join(home, "sessions") },
+        },
+        {
+            insert: [
+                {
+                    id: "nowwork-instructions",
+                    name: pluginPath,
+                    config: { text: input.systemPrompt },
+                },
+            ],
+        },
+    ]), { mode: 0o600 });
+    const env = Object.fromEntries(Object.entries(input.env).filter(([key]) => !key.toUpperCase().startsWith("DSH_")));
+    return {
+        home,
+        policyPath,
+        args: [
+            "--profile",
+            "acp",
+            ...(input.patchPath ? ["--patch", input.patchPath] : []),
+            "--patch",
+            policyPath,
+        ],
+        env: {
+            ...env,
+            DSH_HOME: home,
+            DSH_AGENTS_HOME: join(home, "agents-home"),
+            DSH_PERMISSION_MODE: mode,
+            DSH_TELEMETRY_DISABLED: "1",
+        },
+    };
+}

package/dist/runtimes/deepseek-harness-runner.js

@@ -0,0 +1,224 @@
+/** 新版 Harness 的短命 ACP 桥:产品状态与重试仍属于 server。 */
+import { once } from "node:events";
+import { Readable, Writable } from "node:stream";
+import { parseArgs } from "node:util";
+import { pathToFileURL } from "node:url";
+import { isAbsolute } from "node:path";
+import spawn from "cross-spawn";
+import { z } from "zod";
+import { client, methods, ndJsonStream, PROTOCOL_VERSION, } from "@agentclientprotocol/sdk";
+import { prepareHarnessProfile } from "./deepseek-harness-profile.js";
+import { mapAcpUpdate } from "./kimi-acp-runner.js";
+import { prepareThreadDelivery } from "../thread-input-delivery.js";
+const absolutePath = z.string().refine(isAbsolute, "must be an absolute path");
+export const HarnessInputSchema = z
+    .object({
+    systemPrompt: z.string(),
+    wakePrompt: z.string().min(1),
+    stateRoot: absolutePath,
+    skillRoots: z.array(absolutePath).default([]),
+    effectivePermission: z.enum([
+        "sandboxed",
+        "workspace_write",
+        "full_access",
+    ]),
+})
+    .strict();
+const emit = async (event) => {
+    if (!process.stdout.write(`${JSON.stringify(event)}\n`))
+        await once(process.stdout, "drain");
+};
+async function settleWithin(promise, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(undefined), ms);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+export async function runHarness(input, bin, patchPath) {
+    const delivery = await prepareThreadDelivery({
+        env: process.env,
+        resumed: false,
+        sessionId: "cold-harness",
+        wakePrompt: input.wakePrompt,
+    });
+    const profile = await prepareHarnessProfile({
+        ...input,
+        cwd: process.cwd(),
+        env: process.env,
+        ...(patchPath ? { patchPath } : {}),
+    });
+    const child = spawn(bin, profile.args, {
+        cwd: profile.home,
+        env: profile.env,
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    // Boot away from the repository: the CLI must not load a project's .env into
+    // trusted process credentials. ACP session/new carries the real workspace.
+    let spawnError;
+    const closed = new Promise((resolve) => {
+        child.once("error", (error) => {
+            spawnError = error;
+            resolve();
+        });
+        child.once("close", () => resolve());
+    });
+    if (!child.stdin || !child.stdout || !child.stderr)
+        throw new Error("DeepSeek Harness stdio unavailable");
+    // Provider diagnostics may include secrets or prompts; do not stream raw stderr.
+    child.stderr.resume();
+    let context;
+    let sessionId;
+    let cancelled = false;
+    let stage = "initialize";
+    let exitCode = 1;
+    let stopping;
+    const stop = () => (stopping ??= (async () => {
+        child.stdin?.end();
+        if (await settleWithin(closed.then(() => true), 2000))
+            return;
+        child.kill("SIGTERM");
+        if (await settleWithin(closed.then(() => true), 1000))
+            return;
+        child.kill("SIGKILL");
+        if (!(await settleWithin(closed.then(() => true), 2000)))
+            throw new Error("DeepSeek Harness process stop unconfirmed");
+    })());
+    const cancel = () => {
+        cancelled = true;
+        void (async () => {
+            if (context && sessionId)
+                await settleWithin(context
+                    .notify(methods.agent.session.cancel, { sessionId })
+                    .catch(() => undefined), 1000);
+            await stop();
+        })().catch(() => {
+            /* finally reports stop failure; supervisor owns process tree */
+        });
+    };
+    process.once("SIGTERM", cancel);
+    process.once("SIGINT", cancel);
+    const app = client({ name: "nowwork-harness" })
+        .onRequest(methods.client.session.requestPermission, () => ({
+        outcome: { outcome: "cancelled" },
+    }))
+        .onNotification(methods.client.session.update, async ({ params }) => {
+        if (params.sessionId !== sessionId)
+            return;
+        for (const event of mapAcpUpdate("deepseek-harness", params.update))
+            await emit(event);
+    });
+    try {
+        const stream = ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
+        const result = await app.connectWith(stream, async (ctx) => {
+            context = ctx;
+            const initialized = await ctx.request(methods.agent.initialize, {
+                protocolVersion: PROTOCOL_VERSION,
+                clientCapabilities: {},
+                clientInfo: { name: "nowwork", version: "1" },
+            });
+            if (initialized.protocolVersion !== PROTOCOL_VERSION)
+                throw new Error("Incompatible ACP protocol");
+            if (cancelled)
+                throw new Error("cancelled");
+            stage = "session_new";
+            const session = await ctx.request(methods.agent.session.new, {
+                cwd: process.cwd(),
+                mcpServers: [],
+            });
+            sessionId = session.sessionId;
+            if (!sessionId || cancelled)
+                throw new Error("Harness session unavailable");
+            await emit({ type: "thread.started", thread_id: sessionId });
+            stage = "prompt";
+            const response = await ctx.request(methods.agent.session.prompt, {
+                sessionId,
+                prompt: [{ type: "text", text: delivery.prompt }],
+            });
+            if (initialized.agentCapabilities?.sessionCapabilities?.close != null) {
+                stage = "session_close";
+                const close = await settleWithin(ctx
+                    .request(methods.agent.session.close, { sessionId })
+                    .then(() => true), 5000);
+                if (!close)
+                    throw new Error("Harness session close timed out");
+            }
+            return response;
+        });
+        const usage = result.usage;
+        if (!cancelled)
+            await emit({
+                type: "turn.completed",
+                stop_reason: result.stopReason,
+                ...(usage
+                    ? {
+                        usage: {
+                            input_tokens: usage.inputTokens,
+                            output_tokens: usage.outputTokens,
+                            cache_read_input_tokens: usage.cachedReadTokens ?? 0,
+                            cache_creation_input_tokens: usage.cachedWriteTokens ?? 0,
+                        },
+                    }
+                    : {}),
+            });
+        exitCode =
+            result.stopReason === "end_turn"
+                ? 0
+                : result.stopReason === "cancelled"
+                    ? 130
+                    : 1;
+    }
+    catch {
+        if (!cancelled)
+            process.stderr.write(spawnError
+                ? "DeepSeek Harness launch failed; verify the installed dsh executable.\n"
+                : `DeepSeek Harness ACP execution failed at ${stage}; verify the pinned version, machine credentials and profile patch.\n`);
+    }
+    finally {
+        try {
+            await stop();
+        }
+        finally {
+            process.off("SIGTERM", cancel);
+            process.off("SIGINT", cancel);
+        }
+    }
+    if (cancelled)
+        return 130;
+    return child.exitCode !== 0 ? 1 : exitCode;
+}
+async function main() {
+    const { values } = parseArgs({
+        options: { bin: { type: "string" }, patch: { type: "string" } },
+    });
+    if (!values.bin)
+        throw new Error("DeepSeek Harness --bin is required");
+    process.stdin.setEncoding("utf8");
+    let text = "";
+    for await (const chunk of process.stdin) {
+        text += String(chunk);
+        if (Buffer.byteLength(text) > 16 * 1024 * 1024)
+            throw new Error("Harness input exceeds 16 MiB");
+    }
+    const input = HarnessInputSchema.parse(JSON.parse(text));
+    return runHarness(input, values.bin, values.patch);
+}
+if (process.argv[1] &&
+    import.meta.url === pathToFileURL(process.argv[1]).href) {
+    main()
+        .then((code) => {
+        process.exitCode = code;
+    })
+        .catch(() => {
+        process.stderr.write("DeepSeek Harness configuration or cleanup failed; check execution paths and machine patch.\n");
+        process.exitCode = 1;
+    });
+}