benchgo-plugin 0.0.0-stage → 0.0.2

package/src/link-plugin.mjs

@@ -0,0 +1,21 @@
+import { mountLink } from '../lib/link.mjs';
+
+export const name = 'benchgo-link';
+export const inject = [
+  'commander',
+  'commanderLinkConfig',
+  'connection',
+  'workspaceRegistry',
+  'typertGateway',
+  'sessionController',
+  'webServer',
+  'clientModules',
+];
+
+export async function apply(ctx, config = {}) {
+  await mountLink(ctx, {
+    ...ctx.get('commanderLinkConfig'),
+    ...config,
+    webRoot: new URL('../lib/link-web/', import.meta.url),
+  });
+}

package/src/mcp.mjs

@@ -0,0 +1,21 @@
+import { createInterface } from 'node:readline';
+import { delegationSchema } from './delegation.mjs';
+// Spawned only by the native engine. Capabilities arrive through its private environment.
+const lines = createInterface({ input: process.stdin });
+for await (const line of lines) {
+  void (async () => {
+    let m;
+    try {
+      m = JSON.parse(line); if (m.id === undefined) return;
+      let result;
+      if (m.method === 'initialize') result = { protocolVersion: m.params.protocolVersion, capabilities: { tools: {} }, serverInfo: { name: 'BenchGo', version: '0.2.0' } };
+      else if (m.method === 'ping') result = {};
+      else if (m.method === 'tools/list') result = { tools: [{ name: 'commander_delegate', description: 'Delegate to another coding engine in this same project. Provide provider and text, optionally model. Human approval required. Returns child result; if pending, call again with operation=result and sessionId to read it. Do not resubmit.', inputSchema: delegationSchema }] };
+      else if (m.method === 'tools/call' && m.params.name === 'commander_delegate') {
+        const r = await fetch(process.env.COMMANDER_DELEGATE_URL, { method: 'POST', headers: { authorization: `Bearer ${process.env.COMMANDER_DELEGATE_TOKEN}`, 'content-type': 'application/json' }, body: JSON.stringify(m.params.arguments), signal: AbortSignal.timeout(240000) });
+        const value = await r.json(); result = { content: [{ type: 'text', text: JSON.stringify(value) }], isError: !r.ok };
+      } else throw new Error('Unsupported MCP method');
+      process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: m.id, result }) + '\n');
+    } catch (error) { if (m?.id !== undefined) process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: m.id, error: { code: -32603, message: error.message } }) + '\n'); }
+  })();
+}

package/src/model-providers.mjs

@@ -0,0 +1,125 @@
+import { subscriptionHarnessTool } from './provider-access.mjs';
+
+const LIMIT = 4 * 1024 * 1024;
+const forbidden = new Set(['__proto__', 'constructor', 'prototype']);
+class ProviderError extends Error { constructor(message, status = 400) { super(message); this.status = status; } }
+function text(value, label, max = 512) { if (typeof value !== 'string' || !value.trim() || value.length > max || /[\u0000-\u001f]/u.test(value)) throw new ProviderError('Invalid ' + label); return value.trim(); }
+function endpoint(value) {
+  let url; try { url = new URL(text(value, 'provider URL', 2048)); } catch { throw new ProviderError('Invalid provider URL'); }
+  if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new ProviderError('Provider URL must be HTTP(S), without credentials, query or fragment');
+  return url.href.replace(/\/$/u, '');
+}
+function pathValue(value, path) { for (const part of path || []) { if (forbidden.has(part) || !value || !Object.hasOwn(value, part)) return undefined; value = value[part]; } return value; }
+function classification(model) {
+  const kinds = new Set(), metadata = [model.type, model.task, model.pipeline_tag, model.modality, model.modalities, model.capabilities, model.architecture, model.metadata].filter(value => value !== undefined);
+  const description = JSON.stringify(metadata).toLowerCase(), hasMetadata = /(?:^|[^a-z])(?:transcri|speech|audio|text|chat|completion|asr|tts|embedding|rerank|moderation|image|video|realtime)/u.test(JSON.stringify([model.task, model.pipeline_tag, model.modality, model.modalities, model.capabilities, model.architecture, model.metadata]).toLowerCase()) || /generation|embedding|rerank|moderation|image|audio|speech|asr|tts/u.test(String(model.type || '').toLowerCase());
+  if (/transcri|speech.to.text|audio.to.text|automatic.speech.recognition|"asr"/u.test(description)) kinds.add('asr');
+  if (/text.to.speech|speech.synth|"tts"|"speech"\s*:\s*true/u.test(description)) kinds.add('tts');
+  const architecture = model.architecture || model.modalities || {};
+  const inputs = architecture.input_modalities || architecture.input || [], outputs = architecture.output_modalities || architecture.output || [];
+  if (Array.isArray(inputs) && Array.isArray(outputs)) {
+    if (inputs.includes('audio') && outputs.includes('text') && !outputs.includes('audio')) kinds.add('asr');
+    if (inputs.includes('text') && outputs.includes('audio') && !outputs.includes('text')) kinds.add('tts');
+  }
+  let inferred = false;
+  if (!hasMetadata) {
+    const id = model.id.toLowerCase();
+    if (/whisper|transcri|(?:^|[-_/])asr(?:$|[-_/])|sensevoice|paraformer|funasr/u.test(id)) { kinds.add('asr'); inferred = true; }
+    if (/(?:^|[-_/])tts(?:$|[-_/])|text.to.speech|cosyvoice|kokoro|fish.speech|speech.synth/u.test(id)) { kinds.add('tts'); inferred = true; }
+  }
+  const explicitChat = /text.generation|chat|completion/u.test(description) || Array.isArray(outputs) && outputs.includes('text') && Array.isArray(inputs) && inputs.includes('text');
+  const nonChat = kinds.size > 0 || !explicitChat && /audio|speech|realtime|image|embedding|rerank|moderation|video/u.test(hasMetadata ? description : model.id.toLowerCase());
+  return { kinds: [...kinds], inferred, chat: !nonChat };
+}
+async function limitedJson(response, signal) {
+  if (Number(response.headers.get('content-length')) > LIMIT) { await response.body?.cancel(); throw new ProviderError('Model catalog exceeds 4 MiB', 502); }
+  if (!response.body) throw new ProviderError('Model service returned an empty response', 502);
+  const reader = response.body.getReader(), chunks = []; let size = 0;
+  const abort = () => { void reader.cancel().catch(() => {}); }; signal.addEventListener('abort', abort, { once: true });
+  try {
+    while (true) { signal.throwIfAborted(); const { value, done } = await reader.read(); signal.throwIfAborted(); if (done) break; size += value.byteLength; if (size > LIMIT) throw new ProviderError('Model catalog exceeds 4 MiB', 502); chunks.push(value); }
+    try { return JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { throw new ProviderError('Model service returned invalid JSON', 502); }
+  } finally { signal.removeEventListener('abort', abort); await reader.cancel().catch(() => {}); }
+}
+async function discover(config, signal) {
+  const timeout = AbortSignal.timeout(20000), requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout; let data;
+  try {
+    const response = await fetch(config.baseURL + '/models', { headers: { authorization: 'Bearer ' + config.apiKey, accept: 'application/json' }, signal: requestSignal, redirect: 'error' });
+    if (!response.ok) { await response.body?.cancel(); throw new ProviderError('Model service rejected the request (' + response.status + ')', 502); } data = await limitedJson(response, requestSignal);
+  } catch (error) { if (error instanceof ProviderError) throw error; throw new ProviderError(requestSignal.aborted ? 'Model request cancelled or timed out' : 'Unable to reach the model service', 502); }
+  const rows = Array.isArray(data?.data) ? data.data : Array.isArray(data?.models) ? data.models : null;
+  if (!rows || rows.length > 20000) throw new ProviderError('Model service returned an invalid catalog', 502);
+  const seen = new Set(), models = [];
+  for (const row of rows) { if (!row || typeof row.id !== 'string' || !row.id.trim() || row.id.length > 512 || /[\u0000-\u001f]/u.test(row.id) || row.id.includes(config.apiKey) || seen.has(row.id)) continue; seen.add(row.id); const info = classification(row), name = typeof row.name === 'string' && row.name.length <= 512 && !row.name.includes(config.apiKey) && !/[\u0000-\u001f]/u.test(row.name) ? row.name : row.id; models.push({ id: row.id, name, kinds: info.kinds, inferred: info.inferred }); }
+  return { models };
+}
+export function createModelProviders(ctx) {
+  let nativeAuth;
+  const entries = () => ctx.llm.listConfigurableProviders();
+  const document = ns => ctx.settings.describe().find(row => row.ns === ns);
+  const profile = entry => pathValue(document(entry.settingsNs)?.value, entry.settingsPath) || {};
+  const credential = async (entry, value) => { const refs = value.apiKeyEnv ? [value.apiKeyEnv] : entry.nativeAuth?.env || []; for (const ref of refs) { const hit = await ctx.credentials.resolve(ref); if (hit?.value) return hit.value; } return ''; };
+  const address = (entry, value) => value.baseURL || entry.defaultBaseURL || '';
+  const access = async (entry, value) => {
+    const apiKey = await credential(entry, value);
+    const nativeOAuth = !value.apiKeyEnv && entry.declared !== true && entry.settingsNs === 'llm-pi-ai' && entry.nativeAuth?.oauth;
+    let oauthEnv = false;
+    if (nativeOAuth && apiKey) {
+      oauthEnv = /^sk-ant-oat/iu.test(apiKey);
+      for (const ref of entry.nativeAuth.env || []) if (/oauth/iu.test(ref) && (await ctx.credentials.resolve(ref))?.value === apiKey) oauthEnv = true;
+    }
+    if (apiKey && !oauthEnv) return { id: entry.provider, authMode: 'api', configured: true };
+    // A named API reference is authoritative, even if another route has OAuth.
+    if (value.apiKeyEnv || entry.declared === true || entry.settingsNs !== 'llm-pi-ai' || !entry.nativeAuth?.oauth) return { id: entry.provider, authMode: 'unconfigured', configured: false };
+    const record = /^[a-z][a-z0-9-]*$/u.test(entry.provider) ? await ctx.credentials.readRecord?.('llm-pi-ai/' + entry.provider) : undefined;
+    const tool = subscriptionHarnessTool(entry.provider);
+    const native = tool && nativeAuth ? await nativeAuth.status(tool) : undefined;
+    const nativeLogin = native?.status === 'subscription';
+    const granted = nativeLogin || oauthEnv || record?.kind === 'grant' && record.payload?.type === 'oauth' && typeof record.payload.access === 'string' && record.payload.access.length > 0;
+    if (!granted && entry.nativeAuth.env?.length) return { id: entry.provider, authMode: 'unconfigured', configured: false };
+    return { id: entry.provider, authMode: 'subscription', configured: granted, harnessTools: tool ? [tool] : [], authSource: nativeLogin ? 'native-cli-login' : oauthEnv ? 'official-oauth-env' : granted ? 'official-oauth-record' : 'official-oauth-provider', ...(native ? { nativeLoginStatus: native.status } : {}), routeReason: granted ? '订阅登录仅供对应工具使用；请在 Harness 工具中使用本机登录，订阅凭据不会转换为 API 密钥。' : '此供应商需要订阅登录；请先在对应 Harness 工具中完成登录。' };
+  };
+  const service = {
+    setNativeAuth(value) { nativeAuth = value; },
+    async list() {
+      // describe() projects every plugin schema/config; do it once per directory read.
+      const documents = new Map(ctx.settings.describe().map(row => [row.ns, row.value])), list = [];
+      for (const entry of entries()) {
+        const value = pathValue(documents.get(entry.settingsNs), entry.settingsPath) || {}, baseURL = address(entry, value), identity = await access(entry, value);
+        if (identity.authMode !== 'subscription' && (!baseURL || !identity.configured)) continue;
+        list.push({ ...identity, name: value.displayName || entry.displayName || entry.provider, ...(baseURL ? { baseURL: endpoint(baseURL) } : {}), ...(entry.declared === true ? { declared: true } : {}) });
+      }
+      return list.sort((a, b) => Number(/routergo/iu.test(b.id + b.name + b.baseURL)) - Number(/routergo/iu.test(a.id + a.name + a.baseURL)) || a.name.localeCompare(b.name));
+    },
+    async accessList() {
+      const documents = new Map(ctx.settings.describe().map(row => [row.ns, row.value]));
+      return Promise.all(entries().map(entry => access(entry, pathValue(documents.get(entry.settingsNs), entry.settingsPath) || {})));
+    },
+    async describeAccess(id) {
+      const entry = entries().find(row => row.provider === id); if (!entry) throw new ProviderError('Provider is not configured', 404);
+      return access(entry, profile(entry));
+    },
+    async resolve(id) {
+      const entry = entries().find(row => row.provider === id); if (!entry) throw new ProviderError('Provider is not configured', 404);
+      const value = profile(entry);
+      if ((await access(entry, value)).authMode === 'subscription') throw new ProviderError('订阅登录不能转换为 API 密钥，请在对应 Harness 工具中使用本机登录。', 409);
+      const baseURL = endpoint(address(entry, value)), apiKey = await credential(entry, value);
+      if (!apiKey) throw new ProviderError('Provider credential is not configured', 409); return { baseURL, apiKey };
+    },
+    async describeRoute(id) {
+      const entry = entries().find(row => row.provider === id);
+      if (!entry) throw new ProviderError('Provider is not configured', 404);
+      const value = profile(entry), config = await service.resolve(id);
+      return { ...config, protocol: value.api || value.protocol || entry.protocol || null, credentialRef: value.apiKeyEnv || entry.nativeAuth?.env?.join('|') || '' };
+    },
+    async models(id, signal) {
+      const originalEntry = entries().find(row => row.provider === id), originalRef = originalEntry ? profile(originalEntry).apiKeyEnv || originalEntry.nativeAuth?.env?.join('|') || '' : '';
+      const config = await service.resolve(id), { models } = await discover(config, signal);
+      const entry = entries().find(row => row.provider === id);
+      if (!entry) throw new ProviderError('Provider changed; refresh the model list again', 409);
+      const current = profile(entry), currentRef = current.apiKeyEnv || entry.nativeAuth?.env?.join('|') || '';
+      if (endpoint(address(entry, current)) !== config.baseURL || currentRef !== originalRef || await credential(entry, current) !== config.apiKey) throw new ProviderError('Provider changed; refresh the model list again', 409);
+      return models;
+    },
+  }; return service;
+}

package/src/models.mjs

@@ -0,0 +1,37 @@
+import { LineProcess } from './line-process.mjs';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { ACP_TOOL_DEFAULTS } from './providers/acp.mjs';
+
+/** Discover models from the installed engine, never from the Harness provider catalog. */
+export async function discoverModels(provider, config = {}, cwd = process.cwd()) {
+  if (ACP_TOOL_DEFAULTS[provider]) {
+    // Never create empty native sessions just to open the model menu.
+    const model = config.managedProfile?.model;
+    return model ? [{ id: model, name: model }] : [];
+  }
+  if (provider === 'codex' || provider === 'pi') {
+    const pi = provider === 'pi';
+    const wire = new LineProcess(config.command ?? provider, [...(config.commandArgs ?? []), ...(pi ? ['--mode', 'rpc', '--no-session'] : ['app-server', '--listen', 'stdio://'])], { cwd, env: config.env, dialect: pi ? 'pi' : 'jsonrpc' });
+    try {
+      if (!pi) { await wire.request('initialize', { clientInfo: { name: 'commander_models', version: '0.2.0' } }); wire.notify('initialized'); }
+      const result = await wire.request(pi ? 'get_available_models' : 'model/list', pi ? {} : { limit: 100 });
+      return (pi ? result.models : result.data).map(m => ({ id: pi ? `${m.provider}/${m.id}` : m.model ?? m.id, name: m.displayName ?? m.name ?? m.model ?? m.id, ...(Number.isSafeInteger(m.contextWindow) && m.contextWindow > 0 ? { contextWindow: m.contextWindow } : {}) }));
+    } finally { await wire.close(); }
+  }
+  if (provider === 'claude') {
+    const sdk = await import('@anthropic-ai/claude-agent-sdk');
+    const controller = new AbortController();
+    const q = sdk.query({ prompt: (async function* () { await new Promise(resolve => controller.signal.addEventListener('abort', resolve, { once: true })); })(), options: { cwd, pathToClaudeCodeExecutable: config.command ?? 'claude', env: { ...process.env, ...config.env }, settingSources: ['user', 'project', 'local'] } });
+    let timer;
+    try {
+      const models = await Promise.race([q.supportedModels(), new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('Claude model discovery timed out')), 30000); })]);
+      return models.map(m => ({ id: m.value, name: m.displayName ?? m.value }));
+    } finally { clearTimeout(timer); controller.abort(); q.close(); }
+  }
+  if (provider === 'opencode') {
+    const { stdout } = await promisify(execFile)(config.command ?? 'opencode', [...(config.commandArgs ?? []), 'models'], { cwd, env: { ...process.env, ...config.env }, timeout: 30000, maxBuffer: 1024 * 1024 });
+    return stdout.split('\n').map(s => s.trim()).filter(s => /^[\w.-]+\/\S+$/.test(s)).map(id => ({ id, name: id }));
+  }
+  throw new Error(`Unknown provider: ${provider}`);
+}

package/src/native-auth.mjs

@@ -0,0 +1,32 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execute = promisify(execFile);
+/** Ask the existing CLI; never parse/copy account files or expose raw output. */
+export function createNativeAuth({ installer, executor = execute, env = process.env, cacheMs = 15000 } = {}) {
+  const cache = new Map(), pending = new Map();
+  const inspect = async tool => {
+    if (!['codex', 'claude'].includes(tool)) return { tool, status: 'unsupported' };
+    try {
+      const launch = await installer.resolveLaunch(tool);
+      if (!launch) return { tool, status: 'not-installed' };
+      const args = tool === 'codex' ? ['login', 'status'] : ['auth', 'status', '--json'];
+      const output = await executor(launch.command, [...launch.args, ...args], { env: { ...env, ...launch.env }, timeout: 5000, maxBuffer: 32768, windowsHide: true });
+      if (tool === 'codex') {
+        const text = String(output.stdout || '') + String(output.stderr || '');
+        return { tool, status: /logged in using chatgpt/iu.test(text) ? 'subscription' : /logged in using (?:an? )?api key/iu.test(text) ? 'api' : 'unknown' };
+      }
+      const value = JSON.parse(output.stdout);
+      const subscription = value.loggedIn === true && value.authMethod === 'claude.ai' && (!value.apiProvider || value.apiProvider === 'firstParty');
+      return { tool, status: subscription ? 'subscription' : value.loggedIn ? 'api' : 'logged-out' };
+    } catch (error) { return { tool, status: error.code === 1 ? 'logged-out' : 'unavailable' }; }
+  };
+  return {
+    async status(tool) {
+      const current = cache.get(tool);
+      if (current && Date.now() - current.time < cacheMs) return { ...current.value };
+      if (!pending.has(tool)) pending.set(tool, inspect(tool).then(value => { cache.set(tool, { time: Date.now(), value }); return value; }).finally(() => pending.delete(tool)));
+      return { ...await pending.get(tool) };
+    },
+  };
+}

package/src/picker-catalog.mjs

@@ -0,0 +1,82 @@
+import { subscriptionTool } from './provider-access.mjs';
+
+/** Credential-free catalog shared by the official picker and native adapters. */
+const PREFIX = 'dsh-route-v1:';
+const cleanId = value => typeof value === 'string' && value.length > 0 && value.length <= 512 && !/[\u0000-\u001f]/u.test(value);
+export function encodeRouteModelId(providerId, nativeModelId) {
+  if (!cleanId(providerId) || !cleanId(nativeModelId)) throw new Error('Invalid provider/model route');
+  return PREFIX + Buffer.from(JSON.stringify([providerId, nativeModelId]), 'utf8').toString('base64url');
+}
+export function decodeRouteModelId(value) {
+  if (typeof value !== 'string' || !value.startsWith(PREFIX)) return null;
+  if (value.length > 8192) throw new Error('Invalid provider/model route');
+  try {
+    const pair = JSON.parse(Buffer.from(value.slice(PREFIX.length), 'base64url').toString('utf8'));
+    if (!Array.isArray(pair) || pair.length !== 2 || !pair.every(cleanId) || encodeRouteModelId(...pair) !== value) throw Error();
+    return { providerId: pair[0], model: pair[1] };
+  } catch { throw new Error('Invalid provider/model route'); }
+}
+const positive = value => Number.isSafeInteger(value) && value > 0;
+function safeReasoning(value) {
+  if (!Array.isArray(value?.efforts)) return undefined;
+  const efforts = value.efforts.filter(item => cleanId(item?.id)).map(item => ({ id: item.id, name: cleanId(item.name) ? item.name : item.id, ...(cleanId(item.description) ? { description: item.description } : {}) }));
+  return efforts.length ? { efforts, ...(efforts.some(item => item.id === value.defaultEffort) ? { defaultEffort: value.defaultEffort } : {}) } : undefined;
+}
+export function createPickerCatalog({ commander, installer, profiles, providers, routeService, llm, cacheMs = 5000 } = {}) {
+  let installCache, installAt = 0, installationJob, catalogJob;
+  const installations = async () => {
+    if (installCache && Date.now() - installAt < cacheMs) return installCache;
+    if (!installationJob) installationJob = Promise.resolve(installer?.list?.() ?? []).then(rows => { installCache = rows; installAt = Date.now(); return rows; }).finally(() => { installationJob = undefined; });
+    return installationJob;
+  };
+  const capability = tool => { const value = (routeService ?? commander?.routeService)?.supports?.(tool); return tool === 'deepseek' ? { supported: true } : value === true ? { supported: true } : value && typeof value === 'object' ? value : { supported: false }; };
+  const supports = tool => capability(tool).supported === true;
+  const providerModels = async providerId => {
+    const rows = llm?.listModels ? await llm.listModels(providerId) : await providers.models(providerId);
+    return Promise.all(rows.filter(row => cleanId(row?.id) && !row.kinds?.length && (!row.inputModalities || row.inputModalities.includes('text'))).map(async row => {
+      let resolved = row;
+      if (llm?.resolveModelInfo) { try { resolved = { ...row, ...await llm.resolveModelInfo(providerId, row.id) }; } catch { /* Configured directory metadata remains usable. */ } }
+      const contextWindow = resolved.context?.contextWindow ?? resolved.contextWindow, reasoning = safeReasoning(resolved.reasoning);
+      return { id: row.id, name: cleanId(row.name) ? row.name : row.id, ...(positive(contextWindow) ? { context: { contextWindow } } : {}), ...(reasoning ? { reasoning } : {}) };
+    }));
+  };
+  const build = async () => {
+    const [installed, state, configured] = await Promise.all([installations(), profiles?.list?.({ includeNative: false }) ?? {}, providers?.list?.() ?? []]);
+    const tools = [{ id: 'deepseek', name: 'DeepSeek', installed: true, chatSupported: true, routeSupported: true }, ...installed.map(tool => ({ id: tool.id, name: tool.name || tool.id, installed: tool.installed === true, chatSupported: tool.chatSupported === true, routeSupported: tool.chatSupported === true && supports(tool.id), ...(!tool.chatSupported ? { routeReason: '此工具暂未接入对话' } : !supports(tool.id) ? { routeReason: capability(tool.id).reason || '此工具暂未支持独立供应商路由，现有本机配置保持不变' } : {}) }))];
+    const allowed = new Set(tools.filter(tool => tool.installed && tool.chatSupported && tool.routeSupported).map(tool => tool.id));
+    // Match the official provider editor: legacy providers start eligible for
+    // all tools. An explicitly saved empty binding remains an intentional opt-out.
+    const providerRows = configured.filter(provider => cleanId(provider.id) && !provider.id.startsWith('commander-')).map(provider => {
+      const binding = Object.hasOwn(state.bindings ?? {}, provider.id) ? state.bindings[provider.id] : [...allowed];
+      const subscribed = provider.authMode === 'subscription', onlyTool = subscriptionTool(provider);
+      const eligibility = subscribed ? onlyTool ? [onlyTool] : [] : Array.isArray(binding) ? binding : [];
+      return { id: provider.id, name: cleanId(provider.name) ? provider.name : provider.id, ...(provider.declared === true ? { declared: true } : {}), ...(subscribed ? { authMode: 'subscription', harnessTools: onlyTool ? [onlyTool] : [], configured: provider.configured === true, nativeRequired: true, routeReason: provider.routeReason || '请在对应 Harness 工具中使用本机订阅登录。' } : {}), tools: [...new Set(eligibility)].map(tool => tool === 'harness' ? 'deepseek' : tool).filter(tool => allowed.has(tool)) };
+    });
+    const routes = [];
+    await Promise.all(providerRows.map(async provider => {
+      if (!provider.tools.length || provider.authMode === 'subscription' && (!provider.configured || !llm?.listModels)) return;
+      let rows; try { rows = await providerModels(provider.id); } catch { return; }
+      // API adapter effort IDs (including custom wire mappings) are not native
+      // CLI capabilities. Native effort stays in the tool's saved quick settings.
+      for (const tool of provider.tools) for (const model of rows) routes.push({ tool, providerId: provider.id, providerName: provider.name, modelId: tool === 'deepseek' ? model.id : encodeRouteModelId(provider.id, model.id), nativeModelId: model.id, name: model.name, ...(provider.authMode === 'subscription' ? { authMode: 'subscription' } : {}), ...(model.context ? { context: model.context } : {}), ...(tool === 'deepseek' && model.reasoning ? { reasoning: model.reasoning } : {}) });
+    }));
+    routes.sort((a, b) => a.tool.localeCompare(b.tool) || a.providerId.localeCompare(b.providerId) || a.nativeModelId.localeCompare(b.nativeModelId));
+    return { tools, providers: providerRows, routes };
+  };
+  // The official catalog asks every native adapter concurrently. Share only
+  // in-flight work; the next read still sees current bindings and credentials.
+  const list = () => {
+    if (!catalogJob) {
+      const job = build().finally(() => { if (catalogJob === job) catalogJob = undefined; });
+      catalogJob = job;
+    }
+    return catalogJob.then(value => structuredClone(value));
+  };
+  return {
+    list, decodeModelId: decodeRouteModelId, invalidate() { installCache = undefined; catalogJob = undefined; },
+    async models(tool) {
+      const catalog = await list();
+      return catalog.routes.filter(row => row.tool === tool).map(row => ({ provider: 'commander-' + tool, id: row.modelId, name: row.name, inputModalities: ['text'], providerId: row.providerId, providerName: row.providerName, nativeModelId: row.nativeModelId, ...(row.context ? { context: structuredClone(row.context) } : {}), ...(row.reasoning ? { reasoning: structuredClone(row.reasoning) } : {}) }));
+    },
+  };
+}

package/src/plugin.mjs

@@ -0,0 +1,138 @@
+import { Commander } from './runtime.mjs';
+import { askNativeQuestion } from './questions.mjs';
+import { mountWeb, mountUnavailableWeb } from './web.mjs';
+import { mountHarnessCommands } from './harness-commands.mjs';
+import { mountHarnessAdapter } from './harness-adapter.mjs';
+import { apply as applyVoice } from '../voice/src/plugin.mjs';
+import { createModelProviders } from './model-providers.mjs';
+import { mountUsage } from './usage.mjs';
+import { mountTooling } from './tooling.mjs';
+import { mountUpdates } from './updates.mjs';
+
+export const name = 'commander';
+export const inject = ['tools'];
+
+const string = description => ({ type: 'string', description });
+const output = { schema: { type: 'object', additionalProperties: true }, render: (_args, value) => [{ type: 'text', text: JSON.stringify(value) }] };
+
+export async function apply(ctx, config = {}) {
+  let commander;
+  try { commander = await new Commander(config).open(); }
+  catch (error) {
+    ctx.logger?.error?.(`BenchGo startup failed: ${error.message}`);
+    ctx.inject(['connection'], child => mountUnavailableWeb(child, error));
+    return;
+  }
+  ctx.effect(() => () => commander.close());
+  ctx.provide('commander', commander);
+  ctx.provide('commanderLinkConfig', config.link ?? {});
+  ctx.inject(['connection', 'settings', 'credentials', 'llm'], async child => {
+    const providers = createModelProviders(child);
+    await mountTooling(child, commander, providers);
+    await applyVoice(child, { ...config.voice, providers });
+  });
+  ctx.inject(['connection'], async child => { await mountUsage(child, commander, config.usage ?? {}); await mountUpdates(child, commander); });
+  ctx.inject(['connection', 'workspaceRegistry'], async child => { await mountWeb(child, commander, config); });
+  const owners = new Map();
+  ctx.inject(['commands'], child => mountHarnessCommands(child, commander, { bindOwner: (id, agent) => owners.set(id, agent) }));
+  ctx.inject(['llm', 'agents', 'workspaceRegistry'], child => { mountHarnessAdapter(child, commander, { bindOwner: (id, agent) => owners.set(id, agent) }); });
+  const ownerId = exec => {
+    const id = exec.agent?.session?.id;
+    if (!id) throw new Error('BenchGo tools require a Harness Agent session');
+    return String(id);
+  };
+  const owned = (id, exec) => {
+    const session = commander.snapshot(id);
+    if (session.ownerSessionId !== ownerId(exec)) throw new Error('BenchGo session belongs to a different Harness session');
+    owners.set(id, exec.agent);
+    return session;
+  };
+
+  // A native permission is always routed to the real human approval seam.
+  // There is deliberately no commander_approve model tool.
+  const pendingApprovals = new Set();
+  const controllers = new Map();
+  const listener = event => {
+    if (event.type === 'approval.resolved') { controllers.get(event.data.id)?.abort(); return; }
+    if (event.type !== 'approval.requested') return;
+    // Direct browser sessions own their approval UI; never auto-deny them for lacking a Harness Agent.
+    if (commander.snapshot(event.sessionId).ownerSessionId?.startsWith('commander-web:')) return;
+    const task = (async () => {
+      const controller = new AbortController(); controllers.set(event.data.id, controller);
+      try {
+        const owner = commander.snapshot(event.sessionId).ownerSessionId;
+        const agent = owners.get(event.sessionId) ?? ctx.get('agents')?.get(owner);
+        const approval = ctx.get('approval');
+        let allow = false;
+        if (agent && approval && event.data.kind === 'permission') {
+          const result = await approval.request({
+            agent, toolName: `commander:${event.data.method}`, signal: controller.signal,
+            reason: `Native ${commander.snapshot(event.sessionId).provider} request:\n${JSON.stringify(event.data.details)}`,
+          });
+          allow = result === 'allowed-once';
+        }
+        let answer = { allow };
+        const questions = ctx.get('userQuestions');
+        if (agent && questions && event.data.kind === 'question') {
+          answer = await askNativeQuestion(commander.snapshot(event.sessionId).provider, event.data, request => questions.ask({ ...request, agent, signal: controller.signal }));
+        }
+        commander.approve(event.sessionId, event.data.id, answer);
+      } catch {
+        // The native timeout/interrupt may already have resolved this request.
+        try { commander.approve(event.sessionId, event.data.id, { allow: false }); } catch {}
+      } finally { controllers.delete(event.data.id); }
+    })();
+    pendingApprovals.add(task); task.finally(() => pendingApprovals.delete(task));
+  };
+  commander.on('event', listener);
+  ctx.effect(() => async () => {
+    commander.off('event', listener);
+    for (const controller of controllers.values()) controller.abort();
+    await Promise.allSettled(pendingApprovals);
+  });
+
+  const register = (name, description, properties, required, execute) => ctx.tools.register({
+    name, description,
+    parameters: { type: 'object', properties, required, additionalProperties: false },
+    output,
+    async execute(args, exec) { exec.signal.throwIfAborted(); return execute(args, exec); },
+  });
+  register('commander_providers', 'List native coding-agent providers and protocol capabilities. Does not prove installation or login.', {}, [], async () => ({ providers: commander.catalog() }));
+  register('commander_doctor', 'Check native coding-agent executables and versions. Does not inspect credentials or prove login.', {}, [], async () => ({ providers: await commander.doctor() }));
+  register('commander_sessions', 'List external sessions owned by this Harness conversation.', {}, [], async (_args, exec) => ({ sessions: commander.list().filter(s => s.ownerSessionId === ownerId(exec)) }));
+  register('commander_create', 'Create or import a persistent native coding-agent session. Starting an external coding engine requires user approval. Use commander_send for tasks.', {
+    provider: { type: 'string', enum: ['codex', 'claude', 'pi', 'opencode', 'gemini', 'hermes', 'grok', 'mcode'] },
+    cwd: string('Absolute working directory'), model: string('Optional native model ID'), providerId: string('Optional configured DSH supplier ID; requires model and creates an isolated session, never changes the local CLI profile'),
+    nativeId: string('Existing native thread/session handle to resume, only after its original writer is stopped'),
+    parentId: string('Optional BenchGo parent session for delegation'),
+  }, ['provider', 'cwd'], async (args, exec) => {
+    const ownerSessionId = ownerId(exec);
+    if (args.parentId) owned(args.parentId, exec);
+    const approval = ctx.get('approval');
+    if (!approval) throw new Error('A human approval service is required to start external agents');
+    const grant = await approval.request({ agent: exec.agent, toolName: 'commander_create', callId: exec.callId, signal: exec.signal, reason: `Start ${args.provider} in ${args.cwd}. It uses its native credentials and tool policy; native permissions will be forwarded separately.` });
+    if (grant !== 'allowed-once') throw new Error('External agent launch was not approved');
+    exec.signal.throwIfAborted();
+    const { providerId, ...createArgs } = args;
+    if (providerId && !args.model) throw new Error('An explicit model is required for a managed supplier route');
+    const session = await commander.create({ ...createArgs, ...(providerId ? { route: { providerId, model: args.model } } : {}), ownerSessionId });
+    owners.set(session.id, exec.agent);
+    return session;
+  });
+  register('commander_connect', 'Reconnect a previously owned native session using its saved handle. Never recreates a missing handle.', { id: string('BenchGo session ID') }, ['id'], async ({ id }, exec) => { owned(id, exec); return commander.connect(id); });
+  register('commander_send', 'Submit another prompt to an idle native session. Returns an enqueue receipt; inspect events/wait for completion. Reuse requestId when retrying; never resubmit an uncertain receipt blindly.', {
+    id: string('BenchGo session ID'), text: string('Task or follow-up text'), requestId: string('Stable unique idempotency key for this input'),
+  }, ['id', 'text', 'requestId'], async ({ id, text, requestId }, exec) => { owned(id, exec); return commander.submit(id, text, { requestId }); });
+  register('commander_events', 'Read streamed text, native tool activity and completion events after a cursor. If truncated is true, older BenchGo events have been pruned; inspect native history.', {
+    id: string('BenchGo session ID'), after: { type: 'integer', minimum: 0 },
+  }, ['id'], async ({ id, after }, exec) => { owned(id, exec); return commander.events(id, after); });
+  register('commander_wait', 'Wait at most 60 seconds for a native session to become idle or fail. Task continues if this wait is cancelled or times out.', {
+    id: string('BenchGo session ID'), timeout: { type: 'integer', minimum: 0, maximum: 60000 },
+  }, ['id'], async ({ id, timeout }, exec) => { owned(id, exec); return commander.wait(id, { timeout, signal: exec.signal }); });
+  register('commander_interrupt', 'Interrupt an active native turn. Does not roll back completed tool side effects.', { id: string('BenchGo session ID') }, ['id'], async ({ id }, exec) => { owned(id, exec); await commander.interrupt(id); return commander.snapshot(id); });
+  register('commander_steer', 'Steer an active native turn only if the provider supports it.', { id: string('BenchGo session ID'), text: string('Steering text') }, ['id', 'text'], async ({ id, text }, exec) => { owned(id, exec); await commander.steer(id, text); return commander.snapshot(id); });
+  register('commander_close', 'Release a native session process while retaining its history and handle.', { id: string('BenchGo session ID') }, ['id'], async ({ id }, exec) => { owned(id, exec); return commander.disconnect(id); });
+  register('commander_history', 'Read the owned session native conversation history. Requires an active connection and provider support.', { id: string('BenchGo session ID') }, ['id'], async ({ id }, exec) => { owned(id, exec); return { history: await commander.history(id) }; });
+  register('commander_discover', 'Discover native session handles in the owned session working directory, when the provider supports it. Stop other writers before importing.', { id: string('BenchGo session ID') }, ['id'], async ({ id }, exec) => { owned(id, exec); return { sessions: await commander.discover(id) }; });
+  register('commander_archive', 'Archive an owned external session and release its process, or unarchive it without automatically running tasks.', { id: string('BenchGo session ID'), archived: { type: 'boolean' } }, ['id'], async ({ id, archived = true }, exec) => { owned(id, exec); return commander.archive(id, archived); });
+}

package/src/projects.mjs

@@ -0,0 +1,96 @@
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { lstat, mkdir, mkdtemp, readdir, realpath, rename, rm, stat } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+
+export function githubRepository(value) {
+  if (typeof value !== 'string' || value.length > 500 || !/^https:\/\/github\.com\/[A-Za-z0-9-]+\/[A-Za-z0-9_.-]+\/?$/.test(value)) throw new Error('Use an HTTPS GitHub repository URL: https://github.com/owner/repo');
+  const [owner, raw] = value.slice('https://github.com/'.length).split('/');
+  const name = raw.replace(/\.git$/, '');
+  if (!name || name === '.' || name === '..' || name.startsWith('.')) throw new Error('Invalid GitHub repository name');
+  return { owner, name, url: `https://github.com/${owner}/${name}.git` };
+}
+
+export function profileDirectory(ctx) {
+  const pathService = ctx.get?.('path');
+  if (typeof pathService?.baseDir === 'string' && isAbsolute(pathService.baseDir)) return pathService.baseDir;
+  // Official app-boot sets baseUrl to the active configuration/profile folder.
+  const base = ctx.baseUrl ?? ctx.get?.('baseUrl');
+  if (typeof base === 'string' && base.startsWith('file:')) return fileURLToPath(base);
+  throw new Error('The active Harness profile directory is unavailable');
+}
+
+async function cloneGit(url, destination, { timeout = 5 * 60_000 } = {}) {
+  await new Promise((resolve, reject) => {
+    const child = spawn('git', ['-c', 'credential.interactive=false', 'clone', '--', url, destination], {
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, stdio: ['ignore', 'ignore', 'pipe'], detached: process.platform !== 'win32', windowsHide: true,
+    });
+    let tail = '', timedOut = false;
+    child.stderr.on('data', chunk => { tail = (tail + chunk.toString()).slice(-3000); });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try { if (process.platform === 'win32') child.kill('SIGKILL'); else if (child.pid) process.kill(-child.pid, 'SIGKILL'); } catch (error) { if (error.code !== 'ESRCH') reject(error); }
+    }, timeout);
+    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('close', code => {
+      clearTimeout(timer);
+      if (timedOut) reject(new Error('Git clone timed out; try again'));
+      else if (code !== 0) reject(new Error(`Git clone failed: ${tail.trim() || `exit ${code}`}`));
+      else resolve();
+    });
+  });
+}
+
+export function projectActions(ctx, { runClone = cloneGit } = {}) {
+  let cloning = false;
+  return {
+    async browse({ path = homedir(), name = '' } = {}) {
+      if (typeof path !== 'string' || !isAbsolute(path) || path.length > 4096) throw new Error('Directory path must be absolute');
+      if (typeof name !== 'string' || name.length > 200) throw new Error('Invalid directory name filter');
+      const current = await realpath(path);
+      if (!(await stat(current)).isDirectory()) throw new Error('Path is not a directory');
+      const dirents = await readdir(current, { withFileTypes: true });
+      const entries = [];
+      for (const entry of dirents) {
+        if (entry.name.startsWith('.') || !entry.name.toLowerCase().includes(name.toLowerCase())) continue;
+        const child = join(current, entry.name);
+        if (entry.isDirectory()) entries.push({ name: entry.name, path: child });
+        else if (entry.isSymbolicLink()) {
+          try { if ((await stat(child)).isDirectory()) entries.push({ name: entry.name, path: child }); } catch {}
+        }
+      }
+      entries.sort((a, b) => a.name.localeCompare(b.name));
+      return { path: current, parent: dirname(current) === current ? null : dirname(current), home: homedir(), entries };
+    },
+    async clone({ url } = {}) {
+      const repo = githubRepository(url);
+      if (cloning) throw new Error('Another repository is being cloned; wait for it to finish');
+      cloning = true;
+      let staging, destination, reserved = false;
+      try {
+        const root = join(profileDirectory(ctx), 'workspaces');
+        await mkdir(root, { recursive: true });
+        destination = join(root, repo.name);
+        // Exclusive reservation forbids overwriting any pre-existing path,
+        // including symlinks and concurrent clones from another process.
+        try { await lstat(destination); throw new Error('Repository destination already exists'); }
+        catch (error) { if (error.code !== 'ENOENT') throw error; }
+        try { await mkdir(destination); reserved = true; }
+        catch (error) { if (error.code === 'EEXIST') throw new Error('Repository destination already exists'); throw error; }
+        staging = await mkdtemp(join(root, '.clone-'));
+        const checkout = join(staging, 'repository');
+        await runClone(repo.url, checkout);
+        await rename(checkout, destination);
+        const p = await ctx.workspaceRegistry.create(await realpath(destination));
+        return { project: { id: p.id, path: p.path, title: p.title } };
+      } catch (error) {
+        if (reserved) await rm(destination, { recursive: true, force: true });
+        throw error;
+      } finally {
+        if (staging) await rm(staging, { recursive: true, force: true });
+        cloning = false;
+      }
+    },
+  };
+}

package/src/provider-access.mjs

@@ -0,0 +1,11 @@
+/** Authentication evidence is supplied by the official provider credential seam. */
+const subscriptionTools = new Map([['openai-codex', 'codex'], ['anthropic', 'claude'], ['google-gemini-cli', 'gemini']]);
+export const subscriptionHarnessTool = id => subscriptionTools.get(id);
+export function subscriptionTool(provider) {
+  return provider?.authMode === 'subscription' && Array.isArray(provider.harnessTools) && provider.harnessTools.length === 1 ? provider.harnessTools[0] : undefined;
+}
+export function assertProviderToolAccess(provider, tool) {
+  if (!provider || provider.authMode !== 'subscription') return;
+  const requested = tool === 'deepseek' ? 'harness' : tool;
+  if (!provider.harnessTools?.includes(requested)) throw Object.assign(new Error('此订阅登录仅允许使用对应的 Harness 工具，不能转用于其他工具。'), { status: 409, code: 'SUBSCRIPTION_TOOL_MISMATCH' });
+}