@sanqianx/project-knowledge 5.0.24 → 5.0.26

package/_site/_test/parallel-workbench-integration-5025-env-check.js

@@ -0,0 +1,317 @@
+'use strict';
+// P-WB-CANONICAL-R2 offline env self-check — the free, offline validation that
+// the canonical suite's NEW wiring actually holds. No browser, no model, no
+// real profile read, no network: it only exercises the launcher's gates and
+// isolation in real child processes and re-validates the pure machine
+// definitions. Run via the integration-5025 runner (--run env) or --check.
+//
+//   1. GATES: a paid entry without PK_WB_ALLOW_PAID_TURNS=1 refuses, and an
+//      entry that reads the original profile without an EXPLICIT
+//      PK_WB_REAL_PROFILE_DIR refuses — both BEFORE any environment mutation.
+//   2. FULL BOOT in a real child: after boot, every whitelist path key points
+//      inside the per-run layout root, ambient module/credential vars are
+//      gone, and the carried-through captures (module root, installed product
+//      package) equal the parent's pre-isolation discovery.
+//   3. IDENTITY CARRY-THROUGH: the installed-product label computed by the
+//      canonical harness AFTER isolation matches the parent's real-environment
+//      expectation — the AppData install can no longer be mislabelled as a
+//      repository pin (the exact regression the R2 dispatch ordered fixed).
+//   4. RUNNER ENV: buildRunnerChildEnv drops everything except the documented
+//      whitelist — ambient Anthropic credentials and arbitrary developer vars
+//      never reach a probe child — and never invents a real profile path.
+//   5. PURE FRAGMENT: the machine-definition fragment carries no run
+//      conclusions (networkUsed/gitHistoryUsed/status/outcome/verdict/
+//      resolved as KEYS) and all 50 line anchors resolve against the current
+//      canonical sources.
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const launcher = require('./helpers/parallel-workbench-integration-5025-launcher');
+const fixture = require('./helpers/parallel-workbench-integration-5025-fixture');
+const sourceMap = require('./helpers/parallel-workbench-source-map');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const FRAGMENT = path.join(REPO_ROOT, 'qa-autopilot', 'artifacts', 'parallel-20261023', 'workbench-integration-5025', 'bindings.fragment.json');
+
+const results = [];
+function check(name, pass, detail) {
+  results.push({ name, pass: Boolean(pass), detail: String(detail) });
+  console.log(`${pass ? 'ok' : 'FAIL'} ${name} — ${detail}`);
+}
+
+// R3 offline poison sentinels — every value is newly invented; none is a real
+// credential, and the sentinel checks only ever print these names/values.
+// NODE_OPTIONS must stay startup-safe (--max-old-space-size is accepted by
+// node and harmless) so a poisoned child can actually boot far enough to
+// report; survival is caught by exact-value comparison either way.
+const POISON_ENV = {
+  OPENAI_API_KEY: 'sk-i5025-sentinel-openai',
+  MINIMAX_API_KEY: 'sk-i5025-sentinel-minimax',
+  GOOGLE_API_KEY: 'sk-i5025-sentinel-google',
+  AWS_ACCESS_KEY_ID: 'AKIAI5025SENTINEL',
+  CODEX_API_KEY: 'sk-i5025-sentinel-codex',
+  ANTHROPIC_API_KEY: 'sk-i5025-sentinel-anthropic',
+  NODE_OPTIONS: '--max-old-space-size=1233',
+  HTTPS_PROXY: 'http://127.0.0.1:59989',
+  HTTP_PROXY: 'http://127.0.0.1:59989',
+  ALL_PROXY: 'http://127.0.0.1:59989',
+  KB_KNOWLEDGE_ENGINE_URL: 'http://127.0.0.1:8787',
+  KB_VECTORHUB_URL: 'http://127.0.0.1:8790',
+};
+
+// --- child mode: run boot and report the post-isolation snapshot -------------
+// The parent launches this child with a POISONED copy of the real environment
+// (only invented sentinel values added). The snapshot never serializes real
+// machine values: pre-boot originals are compared IN the child and only key
+// names / booleans / isolated per-run values leave the process.
+if (process.argv[2] === '--child-boot') {
+  const preBoot = {};
+  for (const key of fixture.ISOLATION_PATH_KEYS) preBoot[key] = process.env[key] || null;
+  const boot = launcher.boot({ prefix: 'i5025-env-check', paid: false, needsRealProfile: false, requireChrome: false });
+  // Keys the lane itself mandates (the isolation map's KB_MODULES_AUTOSTART=0)
+  // are not ambient survivors — the dispatch requires the lane value to be kept.
+  const LANE_SET = { KB_MODULES_AUTOSTART: '0' };
+  const whitelist = {};
+  for (const key of fixture.ISOLATION_PATH_KEYS) whitelist[key] = process.env[key];
+  const harness = require('./helpers/parallel-workbench-integration-5025-runtime-harness');
+  const moduleRoot = boot.discovery.moduleRoot;
+  const identity = harness.moduleIdentity(moduleRoot);
+  const dirState = value => {
+    if (!value) return { present: false, exists: false, isDir: false, insideRoot: false };
+    let exists = false;
+    let isDir = false;
+    try { const stat = fs.statSync(value); exists = true; isDir = stat.isDirectory(); } catch { /* reported as absent */ }
+    return { present: true, exists, isDir, insideRoot: isInside(value, boot.layout.root) };
+  };
+  const psCache = process.env.PSModuleAnalysisCachePath || null;
+  const psParent = psCache ? path.dirname(psCache) : null;
+  const snapshot = {
+    layoutRoot: boot.layout.root,
+    whitelist,
+    redirectedOffenders: Object.keys(whitelist).filter(key => preBoot[key] && path.resolve(whitelist[key]) === path.resolve(preBoot[key])),
+    ambientPresent: [...fixture.AMBIENT_MODULE_URLS, ...fixture.AMBIENT_MODEL_ENV].filter(key => process.env[key] !== undefined && process.env[key] !== LANE_SET[key]),
+    overrides: {
+      moduleRoot: process.env.PK_WB_MODULE_ROOT || null,
+      installedProductModule: process.env.PK_WB_INSTALLED_PRODUCT_MODULE || null,
+      chrome: process.env.PK_WB_CHROME || null,
+      realProfileDir: process.env.PK_WB_REAL_PROFILE_DIR || null,
+    },
+    installedProductPackage: fixture.installedProductPackage(),
+    identityLabel: identity.label,
+    identityRoot: identity.root,
+    sentinelSurvivors: Object.keys(POISON_ENV).filter(key => process.env[key] !== undefined),
+    sentinelValueLeaks: Object.keys(POISON_ENV).filter(key => {
+      const poison = POISON_ENV[key];
+      return Object.values(process.env).some(value => value === poison);
+    }),
+    autostart: process.env.KB_MODULES_AUTOSTART || null,
+    kbEngineUrlPoisoned: process.env.KB_KNOWLEDGE_ENGINE_URL === POISON_ENV.KB_KNOWLEDGE_ENGINE_URL,
+    psModuleCache: {
+      insideRoot: psCache ? isInside(psCache, boot.layout.root) : false,
+      parentDir: psParent ? dirState(psParent) : null,
+    },
+    tempDirs: {
+      TEMP: dirState(process.env.TEMP),
+      TMP: dirState(process.env.TMP),
+      TMPDIR: dirState(process.env.TMPDIR),
+    },
+  };
+  fixture.removeTree(boot.layout.root);
+  console.log(`I5025_ENV_CHILD ${JSON.stringify(snapshot)}`);
+  process.exit(0);
+}
+
+function isInside(candidate, parent) {
+  const relative = path.relative(parent, candidate);
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function main() {
+  // --- 1. gates (in-process; they run before any mutation) -------------------
+  {
+    const savedPaid = process.env.PK_WB_ALLOW_PAID_TURNS;
+    const savedProfile = process.env.PK_WB_REAL_PROFILE_DIR;
+    delete process.env.PK_WB_ALLOW_PAID_TURNS;
+    delete process.env.PK_WB_REAL_PROFILE_DIR;
+    let paidRefused = false;
+    try { launcher.boot({ paid: true, needsRealProfile: true, requireChrome: false }); } catch (error) { paidRefused = error.code === 'PK_WB_BOOT_REFUSED'; }
+    let profileRefused = false;
+    process.env.PK_WB_ALLOW_PAID_TURNS = '1';
+    try { launcher.boot({ paid: true, needsRealProfile: true, requireChrome: false }); } catch (error) { profileRefused = error.code === 'PK_WB_BOOT_REFUSED'; }
+    check('gate-paid-flag', paidRefused, paidRefused ? 'paid entry without PK_WB_ALLOW_PAID_TURNS=1 refused before any env mutation' : 'the paid gate did not refuse');
+    check('gate-explicit-profile-path', profileRefused, profileRefused ? 'real-profile entry without an explicit PK_WB_REAL_PROFILE_DIR refused (no default real-profile discovery)' : 'the explicit-profile gate did not refuse');
+    if (savedPaid === undefined) delete process.env.PK_WB_ALLOW_PAID_TURNS; else process.env.PK_WB_ALLOW_PAID_TURNS = savedPaid;
+    if (savedProfile === undefined) delete process.env.PK_WB_REAL_PROFILE_DIR; else process.env.PK_WB_REAL_PROFILE_DIR = savedProfile;
+  }
+
+  // The parent's own real-environment discovery — the reference the child must
+  // reproduce through its carried-through captures.
+  const parentModuleRoot = fixture.resolveHostModuleRoot();
+  const parentInstalled = sourceMap.resolveInstalledProductPackage();
+  const expectedLabel = parentModuleRoot && parentModuleRoot === parentInstalled
+    ? 'currently-installed-package:installed-product'
+    : 'currently-installed-package:repository-pin';
+
+  // --- 2 + 3. full boot inside a real child launched with a POISONED copy of --
+  // the real environment (R3): the direct-entry path must scrub provider
+  // credentials / NODE_OPTIONS / proxy URLs / ambient module URLs BY
+  // WHITELIST REBUILD, keep the lane flags, and leave PS-module-cache + TEMP
+  // as real directories inside the isolation root.
+  {
+    const child = spawnSync(process.execPath, [__filename, '--child-boot'], {
+      encoding: 'utf8', windowsHide: true, timeout: 120000,
+      env: { ...process.env, ...POISON_ENV },
+    });
+    const line = String(child.stdout || '').split(/\r?\n/).find(text => text.startsWith('I5025_ENV_CHILD '));
+    const snapshot = line ? JSON.parse(line.slice('I5025_ENV_CHILD '.length)) : null;
+    if (!snapshot) {
+      check('child-boot', false, `child did not report a snapshot (status=${child.status} stderr=${String(child.stderr || '').slice(0, 300)})`);
+    } else {
+      const pathKeys = Object.keys(snapshot.whitelist);
+      const allInside = pathKeys.every(key => isInside(path.resolve(snapshot.whitelist[key]), snapshot.layoutRoot));
+      check('child-boot-full-whitelist', allInside && pathKeys.length >= 13, `all ${pathKeys.length} whitelist path keys inside the per-run layout root (${allInside ? 'yes' : 'NO'})`);
+      check('child-boot-real-values-redirected', snapshot.redirectedOffenders.length === 0, snapshot.redirectedOffenders.length === 0 ? 'every whitelist path key that had a real-machine value is redirected off it by boot (compared in-child; no real values serialized)' : `keys that kept their real-machine value: ${snapshot.redirectedOffenders.join(',')}`);
+      check('child-boot-ambient-stripped', snapshot.ambientPresent.length === 0, snapshot.ambientPresent.length === 0 ? 'no ambient module/credential var survived boot' : `survivors: ${snapshot.ambientPresent.join(',')}`);
+      const carriedThrough = snapshot.overrides.moduleRoot === parentModuleRoot
+        && snapshot.overrides.installedProductModule === parentInstalled
+        && (!parentInstalled || snapshot.installedProductPackage === parentInstalled);
+      check('child-boot-captures-carried', carriedThrough, `moduleRoot and installed-product package equal the parent's pre-isolation discovery (${carriedThrough ? 'yes' : `child=${snapshot.overrides.installedProductModule} parent=${parentInstalled}`})`);
+      check('identity-label-survives-isolation', snapshot.identityLabel === expectedLabel, `post-isolation label "${snapshot.identityLabel}" === real-environment expectation "${expectedLabel}" (root=${snapshot.identityRoot})`);
+
+      // R3 poison sentinels — direct-entry boot path.
+      check('poison-env-scrubbed-direct-boot', snapshot.sentinelSurvivors.length === 0 && snapshot.sentinelValueLeaks.length === 0, snapshot.sentinelSurvivors.length === 0 && snapshot.sentinelValueLeaks.length === 0
+        ? 'OPENAI/MINIMAX/GOOGLE/AWS/CODEX/ANTHROPIC keys, NODE_OPTIONS, proxy URLs and ambient module URLs are all gone after a real boot (no sentinel value survives under any key)'
+        : `survivors: ${snapshot.sentinelSurvivors.join(',')} value-leaks: ${snapshot.sentinelValueLeaks.join(',')}`);
+      check('poison-lane-values-kept-direct-boot', snapshot.autostart === '0' && !snapshot.kbEngineUrlPoisoned, `KB_MODULES_AUTOSTART=0 kept and the ambient module-URL poison did not resurface (${snapshot.autostart === '0' && !snapshot.kbEngineUrlPoisoned ? 'yes' : `autostart=${snapshot.autostart} engineUrlPoisoned=${snapshot.kbEngineUrlPoisoned}`})`);
+      const psOk = snapshot.psModuleCache.insideRoot && snapshot.psModuleCache.parentDir && snapshot.psModuleCache.parentDir.exists && snapshot.psModuleCache.parentDir.isDir;
+      check('ps-module-cache-in-isolation-root', psOk, psOk ? 'PSModuleAnalysisCachePath points inside the isolation root and its parent directory really exists on disk' : `insideRoot=${snapshot.psModuleCache.insideRoot} parentDir=${JSON.stringify(snapshot.psModuleCache.parentDir)}`);
+      const tempEntries = Object.entries(snapshot.tempDirs);
+      const tempOk = tempEntries.every(([, state]) => state.exists && state.isDir && state.insideRoot);
+      check('temp-dirs-really-exist-in-isolation', tempOk, tempOk
+        ? `TEMP/TMP/TMPDIR all exist as real directories inside the isolation root (fs.statSync verified, not string checks): ${tempEntries.map(([name]) => name).join('/')}`
+        : `bad temp dir states: ${tempEntries.filter(([, state]) => !(state.exists && state.isDir && state.insideRoot)).map(([name]) => name).join(',')}`);
+    }
+  }
+
+  // --- 4. the runner child env builder ----------------------------------------
+  {
+    const fakeSource = {
+      PATH: 'C:\\windows\\system32', SystemRoot: 'C:\\windows', TEMP: 'C:\\Users\\dev\\AppData\\Local\\Temp',
+      ANTHROPIC_API_KEY: 'sk-should-never-pass', KB_KNOWLEDGE_ENGINE_URL: 'http://127.0.0.1:8787',
+      PK_WB_ALLOW_PAID_TURNS: '1', SOME_DEVELOPER_JUNK: 'junk',
+    };
+    const envPlain = launcher.buildRunnerChildEnv(fakeSource, { moduleRoot: 'C:\\mod', installedProductPackage: 'C:\\pkg', chrome: 'C:\\chrome.exe' });
+    const envAuthorized = launcher.buildRunnerChildEnv(fakeSource, { moduleRoot: 'C:\\mod', installedProductPackage: 'C:\\pkg', chrome: 'C:\\chrome.exe', realProfileDir: 'C:\\profiles' });
+    const ambientFree = !Object.keys(envPlain).some(key => launcher.RUNNER_ENV_PASSTHROUGH.includes(key) === false && key !== 'PK_WB_SAFE_LAUNCH' && !key.startsWith('PK_WB_'));
+    check('runner-env-whitelist-only', ambientFree && envPlain.SystemRoot === 'C:\\windows' && envPlain.PATH === fakeSource.PATH, `only documented keys survive (junk/credentials dropped: ${!('SOME_DEVELOPER_JUNK' in envPlain) && !('ANTHROPIC_API_KEY' in envPlain) && !('KB_KNOWLEDGE_ENGINE_URL' in envPlain)})`);
+    check('runner-env-captures-forwarded', envPlain.PK_WB_MODULE_ROOT === 'C:\\mod' && envPlain.PK_WB_INSTALLED_PRODUCT_MODULE === 'C:\\pkg' && envPlain.PK_WB_CHROME === 'C:\\chrome.exe' && envPlain.PK_WB_SAFE_LAUNCH === '1', 'runner captures forwarded as explicit overrides');
+    check('runner-env-profile-only-when-authorized', envPlain.PK_WB_REAL_PROFILE_DIR === undefined && envAuthorized.PK_WB_REAL_PROFILE_DIR === 'C:\\profiles', 'no real profile path unless the operator passed one explicitly');
+
+    // R3: the runner child env scrubs provider/NODE_OPTIONS/proxy/module-URL
+    // poison even in Windows case variants, while whitelisted system vars
+    // survive under ANY casing (Path/PATH, SystemRoot/SYSTEMROOT).
+    const poisonSource = {
+      Path: 'C:\\windows\\system32', SYSTEMROOT: 'C:\\Windows', TEMP: 'C:\\Users\\dev\\AppData\\Local\\Temp',
+      NODE_OPTIONS: POISON_ENV.NODE_OPTIONS, node_options: '--max-old-space-size=1234',
+      OPENAI_API_KEY: POISON_ENV.OPENAI_API_KEY, openai_api_key: 'sk-i5025-sentinel-openai-lower',
+      MINIMAX_API_KEY: POISON_ENV.MINIMAX_API_KEY, CODEX_API_KEY: POISON_ENV.CODEX_API_KEY,
+      HTTPS_PROXY: POISON_ENV.HTTPS_PROXY, KB_KNOWLEDGE_ENGINE_URL: POISON_ENV.KB_KNOWLEDGE_ENGINE_URL,
+    };
+    const envPoisoned = launcher.buildRunnerChildEnv(poisonSource, {});
+    const lowered = Object.keys(envPoisoned).map(key => key.toLowerCase());
+    const poisonNames = ['node_options', 'openai_api_key', 'minimax_api_key', 'codex_api_key', 'https_proxy', 'kb_knowledge_engine_url'];
+    check('runner-env-poison-scrubbed', !poisonNames.some(name => lowered.includes(name)), !poisonNames.some(name => lowered.includes(name))
+      ? 'provider credentials, NODE_OPTIONS (incl. case variants), proxy URLs and ambient module URLs never reach a runner child'
+      : `leaks: ${poisonNames.filter(name => lowered.includes(name)).join(',')}`);
+    check('runner-env-whitelist-case-insensitive', envPoisoned.Path === poisonSource.Path && envPoisoned.SYSTEMROOT === poisonSource.SYSTEMROOT, `whitelisted system vars survive under real Windows casing (Path=${envPoisoned.Path === poisonSource.Path}, SYSTEMROOT=${envPoisoned.SYSTEMROOT === poisonSource.SYSTEMROOT})`);
+  }
+
+  // --- 4b. fixture child base env: whitelist rebuild + lane values (R3) -------
+  // hostEnv feeds every host/census child; with the parent env poisoned it
+  // must still be built ONLY from the system whitelist, keep the complete
+  // isolation map (incl. PSModuleAnalysisCachePath + real TEMP dirs), and let
+  // the lane's explicit endpoint/fake markers win.
+  {
+    const saved = {};
+    for (const [key, value] of Object.entries(POISON_ENV)) { saved[key] = process.env[key]; process.env[key] = value; }
+    try {
+      const layout = fixture.createIsolationLayout('i5025-env-check-hostenv');
+      const laneExtras = { KB_KNOWLEDGE_ENGINE_URL: 'http://127.0.0.1:59990', PK_WB_PROFILE_SOURCE: 'real-readonly', PK_WB_FAKE_MARKER: 'i5025-fake' };
+      const hostChildEnv = fixture.hostEnv(layout, laneExtras);
+      const poisonValues = new Set(Object.values(POISON_ENV));
+      // A lane-specified key is expected to be present — with the LANE value,
+      // never the poison value (the leakedValues scan below proves that).
+      const laneKeys = new Set(Object.keys(laneExtras));
+      const poisonedKeys = Object.keys(POISON_ENV).filter(key => !laneKeys.has(key) && hostChildEnv[key] !== undefined);
+      const leakedValues = Object.values(hostChildEnv).filter(value => poisonValues.has(value)).length;
+      check('fixture-hostenv-whitelist-rebuild', poisonedKeys.length === 0 && leakedValues === 0, poisonedKeys.length === 0 && leakedValues === 0
+        ? 'hostEnv is rebuilt from the system whitelist only — no poison key, no poison value under any key'
+        : `keys: ${poisonedKeys.join(',')} values: ${leakedValues}`);
+      const psParentDir = path.dirname(hostChildEnv.PSModuleAnalysisCachePath);
+      const laneKept = hostChildEnv.KB_KNOWLEDGE_ENGINE_URL === laneExtras.KB_KNOWLEDGE_ENGINE_URL
+        && hostChildEnv.PK_WB_PROFILE_SOURCE === 'real-readonly'
+        && hostChildEnv.PK_WB_FAKE_MARKER === 'i5025-fake'
+        && hostChildEnv.KB_MODULES_AUTOSTART === '0'
+        && isInside(path.resolve(hostChildEnv.PSModuleAnalysisCachePath), layout.root)
+        && fs.statSync(psParentDir).isDirectory()
+        && fs.statSync(hostChildEnv.TEMP).isDirectory()
+        && isInside(path.resolve(hostChildEnv.TEMP), layout.root);
+      check('fixture-hostenv-lane-values-kept', laneKept, laneKept
+        ? 'lane-specified module URL + fake/probe markers kept, KB_MODULES_AUTOSTART=0 kept, PS cache + TEMP are real dirs inside the isolation root'
+        : `engineUrl=${hostChildEnv.KB_KNOWLEDGE_ENGINE_URL} autostart=${hostChildEnv.KB_MODULES_AUTOSTART}`);
+      fixture.removeTree(layout.root);
+    } finally {
+      for (const [key, value] of Object.entries(saved)) {
+        if (value === undefined) delete process.env[key]; else process.env[key] = value;
+      }
+    }
+  }
+
+  // --- 5. the pure fragment ----------------------------------------------------
+  {
+    if (!fs.existsSync(FRAGMENT)) {
+      check('fragment-absent-outside-git', true, `${path.relative(REPO_ROOT, FRAGMENT)} is not present — qa-autopilot/artifacts is gitignored delivery-time evidence; the durable tracked binding store is qa-autopilot/config/product-case-assertions.json, so the two fragment legs below only run where the delivered artifact exists`);
+    }
+    let fragment = null;
+    try { fragment = JSON.parse(fs.readFileSync(FRAGMENT, 'utf8')); } catch (error) {
+      if (fs.existsSync(FRAGMENT)) check('fragment-load', false, `cannot read ${path.relative(REPO_ROOT, FRAGMENT)}: ${error.message}`);
+    }
+    if (fragment) {
+      const forbidden = new Set(['networkUsed', 'gitHistoryUsed', 'status', 'outcome', 'verdict', 'resolved', 'pass', 'fail']);
+      const offenders = [];
+      (function walk(node, trail) {
+        if (!node || typeof node !== 'object') return;
+        for (const [key, value] of Object.entries(node)) {
+          if (forbidden.has(key.toLowerCase()) && !trail.endsWith('.note')) offenders.push(`${trail}.${key}`);
+          walk(value, `${trail}.${key}`);
+        }
+      })(fragment, '');
+      check('fragment-no-run-conclusions', offenders.length === 0, offenders.length === 0 ? 'machine definition carries no run-conclusion keys' : `offenders: ${offenders.join(', ')}`);
+
+      let bindings = [];
+      for (const caseEntry of Object.values(fragment.cases || {})) {
+        for (const expected of caseEntry.expected || []) bindings = bindings.concat(expected.bindings || []);
+      }
+      let anchorOk = 0;
+      const drift = [];
+      for (const binding of bindings) {
+        const file = path.join(REPO_ROOT, binding.file);
+        let lines;
+        try { lines = fs.readFileSync(file, 'utf8').split(/\r?\n/); } catch { drift.push(`${binding.id}: file missing`); continue; }
+        const at = lines[binding.line - 1] || '';
+        // exact match first; a source line with escaped quotes still matches
+        // after backslash-normalisation
+        const hit = at.includes(binding.anchor)
+          || at.replace(/\\/g, '').includes(binding.anchor.replace(/\\/g, ''));
+        if (hit) anchorOk += 1; else drift.push(`${binding.id} @ ${binding.file}:${binding.line}`);
+      }
+      check('fragment-50-anchors', bindings.length === 50 && anchorOk === 50, `${anchorOk}/${bindings.length} line anchors resolve against the current canonical sources${drift.length ? `; drift: ${drift.slice(0, 5).join(' | ')}` : ''}`);
+    }
+  }
+
+  const pass = results.every(entry => entry.pass);
+  console.log(pass ? 'PASS parallel-workbench-integration-5025-env-check' : 'FAIL parallel-workbench-integration-5025-env-check');
+  process.exitCode = pass ? 0 : 1;
+}
+
+main();

package/_site/_test/parallel-workbench-integration-5025-model-probe.js

@@ -0,0 +1,342 @@
+'use strict';
+// P-WB-QA-INTEGRATION-5025 canonical copy of the accepted WB-003 entry
+// (_site/_test/parallel-workbench-runtime-minimax-probe.js, frozen untracked).
+// P-WB-CANONICAL-R2 wiring: the entry goes through the canonical launcher boot
+// (paid gate + explicit real-profile authorization → read-only discovery with
+// the real environment → FULL driver isolation incl. APPDATA/LOCALAPPDATA/
+// CODEX_HOME → carried-through captures); the host child now receives the
+// canonical fixture's complete whitelist (the pre-R5 tracked fixture's env
+// lacked those keys), with the authorized real profile directory passed
+// explicitly for the in-memory read-only key facade. Case logic, expecteds and
+// the two-level model evidence are unchanged. Real paid model probe (exactly
+// ONE paid turn, real network to the provider) — run only explicitly via the
+// integration-5025 runner with PK_WB_ALLOW_PAID_TURNS=1 and an explicit
+// PK_WB_REAL_PROFILE_DIR.
+// P-WB-RUNTIME-03 / WB-003 — real MiniMax positive acceptance probe.
+//
+// The MiniMax subscription quota is refreshed (a real tool-input-delta was
+// observed on the first RET line at 2026-10-23T07:38:15Z), so the positive
+// acceptance that was BLOCKED on the old 429/2067 evidence is executed for
+// real now — with the ORIGINAL minimax profile, read-only in memory.
+//
+// Model evidence is the same two-level scheme the r2 supplement established:
+//   * sdkReportedModel  — the system/init model string the SDK reports for the
+//     session (what the CLI resolved locally);
+//   * vendorReturnedModel — message.model of the REAL assistant messages in
+//     the CLI transcript written under the ISOLATED CLAUDE_CONFIG_DIR,
+//     correlated to the same claudeSessionId and to the unique token echoed
+//     in that same transcript. This is the vendor-returned field.
+//
+// Everything else is unchanged from the frozen lane rules: the REAL installed
+// module hosted standalone (no knowledge engine), the original profile store
+// behind a read-only facade (every write method refuses), the credential only
+// in memory, isolated HOME/CLAUDE_CONFIG_DIR/data/temp/ports, live ports
+// refused, ambient credentials stripped, and a byte-level SHA256 comparison of
+// the real profile directory before/after (digests never leave the process).
+//
+// Exactly ONE paid request. No quota endpoint, no retry loop, no PAYG.
+//
+// Exit codes: 0 = MiniMax positive acceptance positively proven;
+//             3 = honestly BLOCKED (e.g. the vendor rejected the call);
+//             1 = script error.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const launcher = require('./helpers/parallel-workbench-integration-5025-launcher');
+const fixture = require('./helpers/parallel-workbench-integration-5025-fixture');
+const sourceMap = require('./helpers/parallel-workbench-source-map');
+
+const PROFILE_ID = String(process.env.PK_WB_MODEL_PROFILE || 'minimax');
+const REQUESTED_MODEL = String(process.env.PK_WB_MODEL_ID || 'MiniMax-M3.1-Flash');
+const TURN_TIMEOUT_MS = Number(process.env.PK_WB_TURN_TIMEOUT_MS || 420000);
+
+const results = [];
+function record(caseId, status, detail) {
+  results.push({ caseId, status, detail });
+  console.log(`CASE ${caseId} ${status} ${JSON.stringify(detail)}`);
+}
+
+async function getJson(url, options) {
+  const response = await fetch(url, { ...options, signal: AbortSignal.timeout(30000) });
+  const body = await response.json().catch(() => null);
+  return { status: response.status, ok: response.ok, body };
+}
+
+async function consumeEvents(url, onEvent, until, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error(`event stream timed out after ${timeoutMs}ms`)), timeoutMs);
+  let done = null;
+  const finished = new Promise(resolve => { done = resolve; });
+  (async () => {
+    try {
+      const response = await fetch(url, { signal: controller.signal });
+      if (!response.ok) throw new Error(`event stream HTTP ${response.status}`);
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      let buffer = '';
+      for (;;) {
+        const { value, done: streamDone } = await reader.read();
+        if (streamDone) break;
+        buffer += decoder.decode(value, { stream: true });
+        let index;
+        while ((index = buffer.indexOf('\n')) >= 0) {
+          const line = buffer.slice(0, index).replace(/\r$/, '');
+          buffer = buffer.slice(index + 1);
+          if (!line.startsWith('data:')) continue;
+          const payload = line.slice(5).trim();
+          if (!payload) continue;
+          let event;
+          try { event = JSON.parse(payload); } catch { continue; }
+          try { onEvent(event); } catch { /* listener errors never kill the stream */ }
+          if (until(event)) { controller.abort(); return; }
+        }
+      }
+    } catch { /* aborted or ended */ }
+    finally { done && done(); }
+  })();
+  await finished;
+  clearTimeout(timer);
+}
+
+function walkFiles(root, visit) {
+  let names;
+  try { names = fs.readdirSync(root, { withFileTypes: true }); } catch { return; }
+  for (const entry of names) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) walkFiles(full, visit);
+    else if (entry.isFile()) visit(full);
+  }
+}
+
+// The vendor-returned model of THIS session, read from the CLI transcript of
+// the isolated host. Only file names, model strings and booleans leave here.
+function scanTranscriptForVendorModel(roots, claudeSessionId, token) {
+  const matchedFiles = [];
+  const assistantModels = new Set();
+  let sessionCorrelated = false;
+  let tokenEchoed = false;
+  for (const root of roots) {
+    walkFiles(root, file => {
+      if (!file.endsWith('.jsonl')) return;
+      let text;
+      try { text = fs.readFileSync(file, 'utf8'); } catch { return; }
+      if (claudeSessionId && !text.includes(claudeSessionId)) return;
+      matchedFiles.push(path.basename(file));
+      for (const line of text.split(/\r?\n/)) {
+        let entry;
+        try { entry = JSON.parse(line); } catch { continue; }
+        if (entry.type !== 'assistant' || !entry.message) continue;
+        const belongs = entry.sessionId === claudeSessionId
+          || (entry.sessionId == null && claudeSessionId != null && text.includes(claudeSessionId));
+        if (!belongs) continue;
+        sessionCorrelated = true;
+        if (typeof entry.message.model === 'string' && entry.message.model) assistantModels.add(entry.message.model);
+        const content = Array.isArray(entry.message.content) ? entry.message.content : [];
+        for (const block of content) {
+          if (block && block.type === 'text' && typeof block.text === 'string' && block.text.includes(token)) tokenEchoed = true;
+        }
+      }
+    });
+  }
+  return {
+    transcriptFilesMatched: matchedFiles,
+    sessionCorrelated,
+    assistantModelValues: [...assistantModels],
+    tokenEchoedInTranscript: tokenEchoed,
+  };
+}
+
+const sameModel = (a, b) => String(a).replace(/\s+/g, '').toLowerCase() === String(b).replace(/\s+/g, '').toLowerCase();
+
+(async () => {
+  // The single safe entry discipline: paid gate + explicit real-profile
+  // authorization, read-only discovery with the real environment, then FULL
+  // driver isolation (incl. APPDATA/LOCALAPPDATA/CODEX_HOME) with the
+  // captures carried through — before anything else happens.
+  const boot = launcher.boot({ prefix: 'parallel-wb-rt-minimax', paid: true, needsRealProfile: true, requireChrome: false });
+  const moduleRoot = boot.discovery.moduleRoot;
+  const identity = sourceMap.packageIdentity(moduleRoot);
+  // The installed-product root resolves from the pre-isolation capture — an
+  // isolated APPDATA can no longer mislabel an AppData install as a pin.
+  const moduleRootLabel = moduleRoot === fixture.installedProductPackage()
+    ? 'currently-installed-package:installed-product'
+    : 'currently-installed-package:repository-pin';
+
+  const realProfilesBefore = launcher.digestDirectory(boot.discovery.realProfileDir);
+  const layout = boot.layout;
+  const port = await fixture.freePort();
+  const base = `http://127.0.0.1:${port}`;
+  const child = fixture.spawnNode([path.join(__dirname, 'helpers', 'parallel-workbench-host.js')], fixture.hostEnv(layout, {
+    PK_WB_MODULE_ROOT: moduleRoot,
+    PK_WB_HOST_PORT: String(port),
+    PK_WB_HOST_DATA_DIR: layout.dataDir,
+    PK_WB_HOST_WORKSPACE: layout.workspace,
+    PK_WB_HOST_MODE: 'standalone',
+    PK_WB_PROFILE_SOURCE: 'real-readonly',
+    PK_WB_REAL_PROFILE_DIR: boot.discovery.realProfileDir,
+  }));
+
+  const token = `WBRT-MINIMAX-${crypto.randomBytes(5).toString('hex')}`;
+  const question = [
+    '这是一次真实 MiniMax 订阅模型正向抽测（Workbench WB-003 / P-WB-RUNTIME-03）。',
+    `请只回复一行，原样包含以下随机标记，不要添加任何其他内容：${token}`,
+  ].join('\n');
+
+  let outcome = null;
+  try {
+    await fixture.waitForHttp(`${base}/api/claude-workbench/v1/health`, 30000);
+
+    const profiles = await getJson(`${base}/api/claude-workbench/v1/profiles`);
+    const listed = Array.isArray(profiles.body && profiles.body.profiles) ? profiles.body.profiles : [];
+    const target = listed.find(profile => profile.id === PROFILE_ID) || null;
+    record('WB-003.m1-profile-injected-readonly', target ? 'PASS' : 'BLOCKED', {
+      profileId: PROFILE_ID,
+      profileName: target && target.name,
+      baseUrl: target && target.baseUrl,
+      defaultModel: target && target.models && target.models.default,
+      credentialConfigured: target ? target.credentialConfigured === true : null,
+      storeWritesPossible: false,
+      credentialMaterialLogged: false,
+    });
+    assert.ok(target, `the ${PROFILE_ID} profile was not visible through the read-only facade`);
+
+    const session = await getJson(`${base}/api/claude-workbench/v1/sessions`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        context: { contextId: 'wbrt-minimax-probe', workspaceRef: 'wb-fixture' },
+        aiProfileId: PROFILE_ID,
+        model: REQUESTED_MODEL,
+      }),
+    });
+    const created = session.body && session.body.session;
+    record('WB-003.m2-session-with-subscription-profile', session.status === 201 && created ? 'PASS' : 'BLOCKED', {
+      httpStatus: session.status,
+      sessionId: created && created.sessionId,
+      model: created && created.model,
+      authSource: created && created.authSource,
+    });
+    assert.equal(session.status, 201);
+    const sessionId = created.sessionId;
+    assert.equal(created.authSource, 'profile-injected');
+
+    const events = [];
+    let settle = null;
+    const settled = new Promise(resolve => { settle = resolve; });
+    const isTerminal = event => event.type === 'claude/result';
+    const streamUrl = `${base}/api/claude-workbench/v1/sessions/${encodeURIComponent(sessionId)}/events`;
+    const consume = consumeEvents(streamUrl, event => {
+      if (['claude/init', 'claude/result', 'claude/error', 'claude/aborted'].includes(event.type)) events.push(event);
+    }, isTerminal, TURN_TIMEOUT_MS + 60000).catch(() => {});
+
+    const send = await getJson(`${base}/api/claude-workbench/v1/sessions/${encodeURIComponent(sessionId)}/input`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ text: question }),
+    });
+    record('WB-003.m3-unique-question-accepted', send.status === 202 ? 'PASS' : 'BLOCKED', { httpStatus: send.status, uniqueToken: token });
+    assert.equal(send.status, 202);
+
+    const deadline = Date.now() + TURN_TIMEOUT_MS;
+    while (Date.now() < deadline && !events.some(isTerminal)) {
+      await new Promise(resolve => setTimeout(resolve, 250));
+    }
+    settle && settle();
+    await Promise.race([consume, new Promise(resolve => setTimeout(resolve, 5000))]);
+
+    const init = events.find(event => event.type === 'claude/init') || null;
+    const result = events.find(event => event.type === 'claude/result') || null;
+    const error = events.find(event => event.type === 'claude/error') || null;
+    const sdkReportedModel = init ? init.model : null;
+    const claudeSessionId = init ? init.claudeSessionId : null;
+    const answer = result ? String(result.result || '') : '';
+    const tokenEchoed = answer.includes(token);
+    const isError = result ? result.isError === true : true;
+
+    const transcript = scanTranscriptForVendorModel([layout.claudeConfigDir, path.join(layout.home, '.claude')], claudeSessionId, token);
+    const vendorModels = transcript.assistantModelValues;
+    const vendorModelProven = transcript.sessionCorrelated
+      && vendorModels.length > 0
+      && transcript.tokenEchoedInTranscript
+      && vendorModels.every(model => sameModel(model, REQUESTED_MODEL));
+
+    record('WB-003.m4-vendor-returned-model', vendorModelProven ? 'PASS' : 'BLOCKED', {
+      requestedModel: REQUESTED_MODEL,
+      sdkReportedModel,
+      assistantModelValues: vendorModels,
+      vendorModelMatchesRequest: vendorModels.length > 0 ? vendorModels.every(model => sameModel(model, REQUESTED_MODEL)) : null,
+      sessionCorrelated: transcript.sessionCorrelated,
+      tokenEchoedInTranscript: transcript.tokenEchoedInTranscript,
+      transcriptFilesMatched: transcript.transcriptFilesMatched,
+      detail: 'message.model of the real assistant messages in the CLI transcript under the ISOLATED CLAUDE_CONFIG_DIR, correlated by claudeSessionId and the unique token echo',
+    });
+
+    record('WB-003.m5-response-correlated', !isError && tokenEchoed ? 'PASS' : 'BLOCKED', {
+      isError,
+      uniqueToken: token,
+      tokenEchoedInAnswer: tokenEchoed,
+      claudeSessionId,
+      workbenchSessionId: sessionId,
+      answerPreview: answer.slice(0, 200),
+      errorEvent: error,
+    });
+
+    outcome = {
+      requestedModel: REQUESTED_MODEL,
+      sdkReportedModel,
+      vendorReturnedModels: vendorModels,
+      vendorModelProven,
+      claudeSessionId,
+      workbenchSessionId: sessionId,
+      isError,
+      tokenEchoed,
+      answerPreview: answer.slice(0, 200),
+      usage: result && result.usage ? { inputTokens: result.usage.input_tokens, outputTokens: result.usage.output_tokens } : null,
+    };
+  } finally {
+    child.child.kill();
+    await child.exited;
+  }
+
+  const digestComparison = launcher.compareDigests(realProfilesBefore, launcher.digestDirectory(boot.discovery.realProfileDir));
+  record('WB-003.m6-real-profiles-byte-identical', digestComparison.byteIdentical ? 'PASS' : 'FAIL', {
+    profileDir: boot.discovery.realProfileDir,
+    comparison: 'byte-level SHA256, computed in memory; digests never printed, logged or persisted',
+    fileCount: digestComparison.count,
+    changedFiles: digestComparison.changedFiles,
+    addedFiles: digestComparison.addedFiles,
+    removedFiles: digestComparison.removedFiles,
+  });
+
+  const essential = ['WB-003.m1-profile-injected-readonly', 'WB-003.m2-session-with-subscription-profile', 'WB-003.m3-unique-question-accepted', 'WB-003.m4-vendor-returned-model', 'WB-003.m5-response-correlated', 'WB-003.m6-real-profiles-byte-identical'];
+  const proven = essential.every(id => (results.find(entry => entry.caseId === id) || {}).status === 'PASS');
+
+  const summary = {
+    lane: 'test-workbench-runtime',
+    file: 'parallel-workbench-runtime-minimax-probe.js',
+    case: 'WB-003',
+    title: '真实模型抽测（MiniMax 正向验收）',
+    module: { label: moduleRootLabel, root: moduleRoot, name: identity.name, version: identity.version },
+    host: { mode: 'standalone', engineUrlConfigured: false, dataDir: layout.dataDir, workspace: layout.workspace },
+    profile: { id: PROFILE_ID, source: 'original-subscription-store read-only, credential in memory only', credentialWrittenAnywhere: false },
+    turn: outcome,
+    cases: results,
+    verdict: proven ? 'PASS (MiniMax positive acceptance proven: vendor-returned model + unique fact + session correlation)' : 'BLOCKED',
+    paidTurnsSent: 1,
+    quotaEndpointQueried: false,
+    networkUsed: true,
+  };
+
+  const target = process.env.PARALLEL_WORKBENCH_RUNTIME_EVIDENCE;
+  if (target) {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, JSON.stringify(summary, null, 2), 'utf8');
+  }
+  fixture.removeTree(layout.root);
+  console.log(`parallel-workbench-runtime-minimax-probe verdict=${summary.verdict}`);
+  process.exitCode = proven ? 0 : 3;
+})().catch(error => {
+  console.error(error);
+  process.exitCode = 1;
+});