dsh-scnet 0.6.5 → 0.6.7

package/README.md

@@ -4,45 +4,19 @@
 
 DSH-SCNet (`dsh-scnet` on npm) is a community-maintained DSH bundle for operating Supercomputing Network (SCNet). It packages the source [`scnet-hpc`](https://github.com/lql341/scnet-hpc) Skill, profile-aware utilities, and bounded tools for SSH, Slurm, OpenAPI files, regional resources, and Notebook discovery.
 
-Current release: **0.6.5**
+Current release: **0.6.7**
 
-## What's new in 0.6.4
+<!-- scnet-release:start -->
+## 0.6.7 highlights
 
-- OpenAPI with AK/SK is preferred for structured cluster operations; SSH remains available for environment setup, compilation, and interactive diagnosis.
-- Ubuntu/Debian users can install `libsecret-tools` for secure local credential storage; it is optional when credentials are provided through environment variables.
+- Desktop hosts can inject a verified Python 3 interpreter through `DSH_SCNET_PYTHON` or
+  `SCNET_PYTHON`; local entrypoints no longer require the command name `python3`.
+- Shared shell helpers reject Python 2 and invalid configured interpreters before running
+  OpenAPI or local job-generation code.
+<!-- scnet-release:end -->
 
 > This is an independent community project. It is compatible with DeepSeek Harness but is not an official DeepSeek product and does not imply endorsement, partnership, or authorization by DeepSeek.
 
-## What's new in 0.6.3
-
-- Added read-only account and resource summaries plus bounded `scnet_job_wait`.
-- Submission queue preflight now fails closed and never silently selects a queue.
-- Download paths can default to the remote filename; ordinary and chunked uploads return the same
-  directory/filename result shape.
-
-## 0.6.2 highlights
-
-- Completed jobs now resolve through the fast filtered history-list endpoint rather than timing
-  out on the empty history-detail response.
-- Historical field aliases such as `workdir` are normalized for log-path discovery.
-- OpenAPI operations continue without persistent caching when the cache directory is read-only.
-
-## 0.6.1 highlights
-
-- Job details now fall back to the history endpoint when realtime records expire, with complete
-  normalized terminal states.
-- Added compact `scnet_job_list`, `scnet_limits`, and `scnet_file_transfer` tools.
-- File uploads now make the remote-directory contract explicit: the local filename is preserved
-  and must not be passed as the remote directory.
-
-## 0.6.0 highlights
-
-- Added first-class DSH tools for submitting jobs, inspecting job status, reading logs, and
-  cancelling jobs through the existing SSH/OpenAPI backends.
-- Added dry-run support and one-missing-decision-at-a-time validation for job lifecycle calls.
-- Job submission reports the authoritative work directory and log paths; OpenAPI log lookup can
-  derive `std.out` and `std.err` paths from `job_id` and `work_dir`.
-
 ## Requirements
 
 - Node.js 22.19 or later
@@ -130,16 +104,7 @@ The `skills/scnet-hpc/` directory is generated from the canonical `scnet-hpc` re
 
 Do not maintain the generated directory independently. The sync excludes the canonical installer and local probe cache because neither belongs in the npm runtime package.
 
-Release order is canonical-to-downstream: update `scnet-hpc/VERSION` first; its CI then
-synchronizes the skill and version into `dsh-scnet` and `codex-scnet-hpc`. Publish the matching
-`dsh-scnet` npm package only after that downstream change is reviewed.
-
-For a synchronized release, run the package validation on `main`, then trigger the repository's
-`Publish DSH-SCNet` workflow with the exact current version from `package.json`. The
-workflow verifies the package/Skill version match, runs validation, creates the tarball, publishes
-stable releases with the `latest` tag, and creates the matching Git tag. Do not bump only
-`package.json`: `skills/scnet-hpc/VERSION`, the package version, and both README release markers
-must stay aligned.
+Release order is canonical-to-downstream: update the canonical `VERSION` and release highlights once. CI synchronizes both distribution repositories. After each synchronized pull request passes validation, the workflow merges it automatically. The resulting `main` push validates and packs the bundle, publishes the npm package with the appropriate `latest` or `next` tag, and creates the matching Git tag and GitHub Release. Do not bump only `package.json`: the canonical `VERSION` remains the release source of truth.
 
 The workflow uses npm Trusted Publishing through GitHub OIDC, so account 2FA/Passkey should remain
 enabled and no long-lived `NPM_TOKEN` is required. Configure `lql341/dsh-scnet` and

package/README_CN.md

@@ -4,40 +4,18 @@
 
 <p align="center">在 DeepSeek Harness 里操作超算互联网（SCNet）：配置 SSH、管理 Slurm 作业、查询 OpenAPI 区域和文件、检查 Notebook 资源与实例，并保留海光 DCU/DTK 诊断能力。</p>
 
-当前版本：**0.6.5**
+当前版本：**0.6.7**
 
-## 0.6.4 更新
+<!-- scnet-release:start -->
+## 0.6.7 更新
 
-- 结构化集群操作优先使用 OpenAPI AK/SK；环境配置、编译和交互式诊断仍可使用 SSH。
-- Ubuntu/Debian 可安装 `libsecret-tools` 安全保存本地凭据；通过环境变量提供 AK/SK 时无需安装。
+- Desktop 主机可通过 `DSH_SCNET_PYTHON` 或 `SCNET_PYTHON` 注入经过校验的 Python 3
+  解释器，本地入口不再强制要求命令名为 `python3`。
+- 共享 shell 辅助函数会在运行 OpenAPI 或本地作业生成前拒绝 Python 2 和无效解释器路径。
+<!-- scnet-release:end -->
 
 > 本项目是独立维护的社区项目，与 DeepSeek Harness 兼容，但不是 DeepSeek 官方产品，也不表示 DeepSeek 对本项目提供背书、合作或授权。
 
-## 0.6.3 更新
-
-- 新增只读账户摘要、资源摘要和有界等待作业工具 `scnet_job_wait`。
-- 提交前队列预检失败会停止提交，不再静默选择队列。
-- 下载时可省略本地路径自动使用远端文件名；普通上传和分片上传返回统一结果结构。
-
-## 0.6.2 更新
-
-- 已结束作业改用快速的历史列表过滤查询，不再卡在返回空数据的历史详情接口。
-- 兼容历史记录中的 `workdir` 等字段变体，可继续推导日志路径。
-- 缓存目录只读时自动降级为无持久缓存，OpenAPI 主功能不再被缓存故障阻断。
-
-## 0.6.1 更新
-
-- 作业实时记录过期时自动回退历史接口，并补全终态映射。
-- 新增紧凑的 `scnet_job_list`、`scnet_limits`、`scnet_file_transfer` 工具。
-- 明确 OpenAPI 上传参数是远端目录，文件名沿用本地文件名，不能把文件名当作远端目录传入。
-
-## 0.6.0 更新
-
-- 新增作业提交、状态查询、日志读取和取消作业的 DSH 工具，复用现有 SSH/OpenAPI backend。
-- 作业生命周期调用支持 `dry_run`，并按 CLI 顺序一次只提示一个缺失决策。
-- 提交结果返回权威的工作目录和日志路径；OpenAPI 日志查询支持由 `job_id` 和 `work_dir`
-  推导 `std.out`、`std.err` 路径。
-
 ## 这是什么
 
 一个 DeepSeek Harness bundle 插件，把 `scnet-hpc` 的 Agent Skill 和 bash 脚本包装成 DSH 可安装包。装好后 DSH 模型在涉及超算集群、Slurm 作业、海光 DCU/DTK 时会加载对应 skill，并可调用工具完成确定性操作。
@@ -141,15 +119,7 @@ git 源、本地目录安装以及验证步骤见[安装说明](./docs/installat
 只改 canonical，本仓库跑 sync 更新；不要把 `skills/scnet-hpc/` 当手工维护目录。
 `sync.sh` 会自动排除 `scripts/install.sh` 和 `clusters/.cache/`，避免把安装脚本或本机动态缓存打进发布包。
 
-发布顺序也是从 canonical 向下游流转：先在 `scnet-hpc` 修改并发布 `VERSION`，其 CI
-再把 Skill 内容和版本同步到 `dsh-scnet` 与 `codex-scnet-hpc`。下游变更审核通过后，
-才能发布对应版本的 `dsh-scnet` npm 包。
-
-下游同步合并到 `main` 后，先运行本地校验，再手动触发仓库的 `Publish DSH-SCNet` workflow，
-输入 `package.json` 中的当前版本。workflow 会校验 package 与 Skill
-版本一致，执行验证、生成 tarball、以稳定版 `latest` 标签发布，并创建对应 Git tag。
-不要只修改 `package.json`；`skills/scnet-hpc/VERSION`、package 版本和两份 README 的版本
-标记必须保持一致。
+发布只需在 canonical 仓库更新一次 `VERSION` 与版本亮点，CI 会同步两个分发仓库。下游同步 PR 校验通过后自动合并；合并产生的 `main` push 会校验并打包 bundle，以对应的 `latest` 或 `next` 标签发布 npm package，并创建匹配的 Git tag 与 GitHub Release。不要只修改 `package.json`；canonical `VERSION` 仍是唯一版本来源。
 
 该 workflow 使用 GitHub OIDC 的 npm Trusted Publishing，因此应保留账号的 2FA/Passkey，
 不需要长期保存 `NPM_TOKEN`。首次使用 OIDC 发布前，请在 npm package 设置中把

package/connector/contract.mjs

@@ -0,0 +1,96 @@
+const OPERATION_DEFINITIONS = {
+  login: { scope: 'openid', mutatesRemote: false, supportsDryRun: false },
+  status: { scope: 'scnet.read', mutatesRemote: false, supportsDryRun: false },
+  refresh: { scope: 'openid', mutatesRemote: false, supportsDryRun: false },
+  logout: { scope: 'openid', mutatesRemote: true, supportsDryRun: false },
+  linkAccount: { scope: 'account.link', mutatesRemote: true, supportsDryRun: true },
+  unlinkAccount: { scope: 'account.link', mutatesRemote: true, supportsDryRun: true },
+  listRegions: { scope: 'scnet.read', mutatesRemote: false, supportsDryRun: false },
+  listSchedulers: { scope: 'scnet.read', mutatesRemote: false, supportsDryRun: false },
+  listQueues: { scope: 'scnet.read', mutatesRemote: false, supportsDryRun: false },
+  submitJob: { scope: 'jobs.submit', mutatesRemote: true, supportsDryRun: true },
+  getJob: { scope: 'jobs.read', mutatesRemote: false, supportsDryRun: false },
+  cancelJob: { scope: 'jobs.cancel', mutatesRemote: true, supportsDryRun: true },
+  listFiles: { scope: 'files.read', mutatesRemote: false, supportsDryRun: false },
+  transferFile: { scope: 'files.write', mutatesRemote: true, supportsDryRun: true },
+}
+
+export const SCNET_CONNECTOR_CONTRACT_VERSION = '0.1.0'
+export const CONNECTOR_OPERATION_DEFINITIONS = Object.freeze(
+  Object.fromEntries(
+    Object.entries(OPERATION_DEFINITIONS).map(([name, definition]) => [name, Object.freeze({ ...definition })]),
+  ),
+)
+export const CONNECTOR_CAPABILITY_STATES = Object.freeze([
+  'supported',
+  'unsupported',
+  'requires-remote-host',
+])
+
+function nonEmptyString(value, label) {
+  const normalized = String(value ?? '').trim()
+  if (!normalized) throw new TypeError(`${label} must be a non-empty string`)
+  return normalized
+}
+
+function normalizeState(value, operation) {
+  const state = nonEmptyString(value, `capability ${operation}`)
+  if (!CONNECTOR_CAPABILITY_STATES.includes(state)) {
+    throw new TypeError(
+      `capability ${operation} must be one of ${CONNECTOR_CAPABILITY_STATES.join(', ')}`,
+    )
+  }
+  return state
+}
+
+export function createCapabilityMatrix(entries = {}) {
+  if (entries === null || typeof entries !== 'object' || Array.isArray(entries)) {
+    throw new TypeError('capabilities must be an object')
+  }
+  return Object.freeze(
+    Object.fromEntries(
+      Object.keys(OPERATION_DEFINITIONS).map((operation) => [
+        operation,
+        normalizeState(entries[operation] ?? 'unsupported', operation),
+      ]),
+    ),
+  )
+}
+
+export function createConnectorDescriptor({
+  id = 'scnet',
+  version = SCNET_CONNECTOR_CONTRACT_VERSION,
+  issuer,
+  capabilities = {},
+} = {}) {
+  const descriptor = {
+    contractVersion: SCNET_CONNECTOR_CONTRACT_VERSION,
+    id: nonEmptyString(id, 'connector id'),
+    version: nonEmptyString(version, 'connector version'),
+    issuer: nonEmptyString(issuer, 'issuer'),
+    capabilities: createCapabilityMatrix(capabilities),
+  }
+  return Object.freeze(descriptor)
+}
+
+export function getOperationDefinition(operation) {
+  const name = nonEmptyString(operation, 'operation')
+  const definition = CONNECTOR_OPERATION_DEFINITIONS[name]
+  if (!definition) throw new RangeError(`unsupported connector operation: ${name}`)
+  return definition
+}
+
+export function assertCapability(descriptor, operation, { allowRemoteHost = false } = {}) {
+  if (!descriptor || typeof descriptor !== 'object') {
+    throw new TypeError('connector descriptor is required')
+  }
+  const definition = getOperationDefinition(operation)
+  const state = descriptor.capabilities?.[operation]
+  if (state === 'supported' || (state === 'requires-remote-host' && allowRemoteHost)) {
+    return definition
+  }
+  if (state === 'requires-remote-host') {
+    throw new Error(`${operation} requires a remote host`)
+  }
+  throw new Error(`${operation} is not supported by connector ${descriptor.id || 'unknown'}`)
+}

package/connector/index.mjs

@@ -0,0 +1,21 @@
+export {
+  CONNECTOR_CAPABILITY_STATES,
+  CONNECTOR_OPERATION_DEFINITIONS,
+  SCNET_CONNECTOR_CONTRACT_VERSION,
+  assertCapability,
+  createCapabilityMatrix,
+  createConnectorDescriptor,
+  getOperationDefinition,
+} from './contract.mjs'
+
+export {
+  MemoryCredentialStore,
+  TokenLifecycle,
+  createAuthorizationRequest,
+  createCodeVerifier,
+  createPkceChallenge,
+  createRefreshTokenRequest,
+  createTokenExchangeRequest,
+  normalizeTokenResponse,
+  validateAuthorizationCallback,
+} from './oauth2.mjs'

package/connector/oauth2.mjs

@@ -0,0 +1,263 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
+
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '[::1]', 'localhost'])
+
+function requiredString(value, label) {
+  const normalized = String(value ?? '').trim()
+  if (!normalized) throw new TypeError(`${label} must be a non-empty string`)
+  return normalized
+}
+
+function parseUrl(value, label) {
+  let parsed
+  try {
+    parsed = new URL(requiredString(value, label))
+  } catch {
+    throw new TypeError(`${label} must be a valid URL`)
+  }
+  return parsed
+}
+
+function assertHttpsEndpoint(value, label) {
+  const parsed = parseUrl(value, label)
+  if (parsed.protocol !== 'https:') {
+    throw new TypeError(`${label} must use https`)
+  }
+  return parsed
+}
+
+function assertRedirectUri(value) {
+  const parsed = parseUrl(value, 'redirectUri')
+  const isLoopback = parsed.protocol === 'http:' && LOOPBACK_HOSTS.has(parsed.hostname)
+  if (parsed.protocol !== 'https:' && !isLoopback) {
+    throw new TypeError('redirectUri must use https or a loopback http address')
+  }
+  return parsed
+}
+
+function base64url(value) {
+  return Buffer.from(value).toString('base64url')
+}
+
+export function createCodeVerifier() {
+  return base64url(randomBytes(32))
+}
+
+export function createPkceChallenge(codeVerifier) {
+  const verifier = requiredString(codeVerifier, 'codeVerifier')
+  return base64url(createHash('sha256').update(verifier).digest())
+}
+
+export function createAuthorizationRequest({
+  authorizationEndpoint,
+  clientId,
+  redirectUri,
+  issuer,
+  scope = [],
+  state = randomUUID(),
+  nonce = randomUUID(),
+  codeVerifier = createCodeVerifier(),
+} = {}) {
+  const endpoint = assertHttpsEndpoint(authorizationEndpoint, 'authorizationEndpoint')
+  const redirect = assertRedirectUri(redirectUri)
+  const client = requiredString(clientId, 'clientId')
+  const normalizedIssuer = issuer === undefined ? undefined : assertHttpsEndpoint(issuer, 'issuer').origin
+  const scopes = Array.isArray(scope) ? scope : String(scope).split(/\s+/)
+  const normalizedScopes = [...new Set(scopes.map((item) => String(item).trim()).filter(Boolean))]
+  if (normalizedScopes.length === 0) throw new TypeError('scope must contain at least one value')
+
+  const params = new URLSearchParams({
+    client_id: client,
+    redirect_uri: redirect.href,
+    response_type: 'code',
+    scope: normalizedScopes.join(' '),
+    code_challenge: createPkceChallenge(codeVerifier),
+    code_challenge_method: 'S256',
+    state: requiredString(state, 'state'),
+    nonce: requiredString(nonce, 'nonce'),
+  })
+  return Object.freeze({
+    url: `${endpoint.href}${endpoint.search ? '&' : '?'}${params}`,
+    authorizationEndpoint: endpoint.href,
+    clientId: client,
+    redirectUri: redirect.href,
+    issuer: normalizedIssuer,
+    scope: Object.freeze(normalizedScopes),
+    state,
+    nonce,
+    codeVerifier,
+  })
+}
+
+function assertExactRedirect(callbackUrl, redirectUri) {
+  const actual = parseUrl(callbackUrl, 'callbackUrl')
+  const expected = assertRedirectUri(redirectUri)
+  if (actual.origin !== expected.origin || actual.pathname !== expected.pathname) {
+    throw new Error('OAuth callback redirect URI does not match the request')
+  }
+  if (actual.port !== expected.port || actual.hash !== expected.hash) {
+    throw new Error('OAuth callback redirect URI does not match the request')
+  }
+  for (const [key, value] of expected.searchParams) {
+    if (actual.searchParams.get(key) !== value) {
+      throw new Error('OAuth callback redirect URI does not match the request')
+    }
+  }
+  return actual
+}
+
+export function validateAuthorizationCallback(callbackUrl, request) {
+  const callback = assertExactRedirect(callbackUrl, request.redirectUri)
+  const returnedState = callback.searchParams.get('state')
+  if (returnedState !== request.state) throw new Error('OAuth state mismatch')
+
+  const error = callback.searchParams.get('error')
+  if (error) {
+    const description = callback.searchParams.get('error_description')
+    throw new Error(`OAuth authorization failed: ${error}${description ? ` (${description})` : ''}`)
+  }
+
+  const code = callback.searchParams.get('code')
+  if (!code) throw new Error('OAuth callback did not contain an authorization code')
+  if (request.issuer !== undefined) {
+    const returnedIssuer = callback.searchParams.get('iss')
+    if (returnedIssuer !== request.issuer) throw new Error('OAuth issuer mismatch')
+  }
+  return Object.freeze({
+    code,
+    state: returnedState,
+    issuer: callback.searchParams.get('iss') || undefined,
+  })
+}
+
+export function createTokenExchangeRequest({
+  tokenEndpoint,
+  clientId,
+  code,
+  redirectUri,
+  codeVerifier,
+}) {
+  const endpoint = assertHttpsEndpoint(tokenEndpoint, 'tokenEndpoint')
+  const redirect = assertRedirectUri(redirectUri)
+  const params = new URLSearchParams({
+    grant_type: 'authorization_code',
+    client_id: requiredString(clientId, 'clientId'),
+    code: requiredString(code, 'code'),
+    redirect_uri: redirect.href,
+    code_verifier: requiredString(codeVerifier, 'codeVerifier'),
+  })
+  return Object.freeze({
+    method: 'POST',
+    url: endpoint.href,
+    headers: Object.freeze({ 'content-type': 'application/x-www-form-urlencoded' }),
+    body: params.toString(),
+  })
+}
+
+export function createRefreshTokenRequest({ tokenEndpoint, clientId, refreshToken, scope } = {}) {
+  const endpoint = assertHttpsEndpoint(tokenEndpoint, 'tokenEndpoint')
+  const params = new URLSearchParams({
+    grant_type: 'refresh_token',
+    client_id: requiredString(clientId, 'clientId'),
+    refresh_token: requiredString(refreshToken, 'refreshToken'),
+  })
+  if (scope !== undefined) params.set('scope', requiredString(scope, 'scope'))
+  return Object.freeze({
+    method: 'POST',
+    url: endpoint.href,
+    headers: Object.freeze({ 'content-type': 'application/x-www-form-urlencoded' }),
+    body: params.toString(),
+  })
+}
+
+export function normalizeTokenResponse(response, now = Date.now()) {
+  if (!response || typeof response !== 'object') throw new TypeError('token response must be an object')
+  const accessToken = requiredString(response.access_token, 'access_token')
+  const refreshToken = response.refresh_token === undefined ? undefined : requiredString(response.refresh_token, 'refresh_token')
+  const tokenType = String(response.token_type || 'Bearer')
+  const expiresIn = Number(response.expires_in)
+  if (!Number.isFinite(expiresIn) || expiresIn <= 0) throw new TypeError('expires_in must be a positive number')
+  return Object.freeze({
+    accessToken,
+    refreshToken,
+    tokenType,
+    scope: response.scope ? String(response.scope) : undefined,
+    expiresAt: now + expiresIn * 1000,
+  })
+}
+
+export class MemoryCredentialStore {
+  #values = new Map()
+
+  async get(key) {
+    return this.#values.get(requiredString(key, 'credential key'))
+  }
+
+  async set(key, value) {
+    const normalizedKey = requiredString(key, 'credential key')
+    if (value === undefined) throw new TypeError('credential value must not be undefined')
+    this.#values.set(normalizedKey, structuredClone(value))
+  }
+
+  async delete(key) {
+    this.#values.delete(requiredString(key, 'credential key'))
+  }
+
+  async clear() {
+    this.#values.clear()
+  }
+}
+
+export class TokenLifecycle {
+  #store
+  #key
+  #now
+  #refreshPromise
+
+  constructor({ store = new MemoryCredentialStore(), key = 'scnet.tokens', now = () => Date.now() } = {}) {
+    this.#store = store
+    this.#key = requiredString(key, 'token key')
+    this.#now = now
+  }
+
+  async save(tokenResponse) {
+    const token = normalizeTokenResponse(tokenResponse, this.#now())
+    await this.#store.set(this.#key, token)
+    return this.status()
+  }
+
+  async status() {
+    const token = await this.#store.get(this.#key)
+    if (!token) return { authenticated: false, expiresAt: undefined }
+    return {
+      authenticated: true,
+      expiresAt: token.expiresAt,
+      hasRefreshToken: Boolean(token.refreshToken),
+      scope: token.scope,
+    }
+  }
+
+  async accessToken({ refresh } = {}) {
+    const token = await this.#store.get(this.#key)
+    if (!token) throw new Error('SCNet authentication required')
+    if (token.expiresAt > this.#now() + 30000) return token.accessToken
+    if (typeof refresh !== 'function' || !token.refreshToken) {
+      throw new Error('SCNet access token expired; re-authentication required')
+    }
+    if (!this.#refreshPromise) {
+      this.#refreshPromise = Promise.resolve()
+        .then(() => refresh(token.refreshToken))
+        .then((response) => this.save(response))
+        .finally(() => {
+          this.#refreshPromise = undefined
+        })
+    }
+    await this.#refreshPromise
+    const refreshed = await this.#store.get(this.#key)
+    return refreshed.accessToken
+  }
+
+  async clear() {
+    await this.#store.delete(this.#key)
+  }
+}

package/index.mjs

@@ -12,6 +12,11 @@ const SKILL_DIR = join(__dirname, 'skills', 'scnet-hpc')
 const SCRIPTS_DIR = join(SKILL_DIR, 'scripts')
 const CLUSTERS_DIR = join(SKILL_DIR, 'clusters')
 
+export function resolvePythonCandidates(env = process.env) {
+  const configured = String(env.DSH_SCNET_PYTHON ?? env.SCNET_PYTHON ?? '').trim()
+  return configured ? [configured] : ['python3', 'python']
+}
+
 function runBash(script, args, timeoutMs = 120000, cwd = SKILL_DIR) {
   return new Promise((resolve) => {
     execFile(
@@ -32,21 +37,35 @@ function runBash(script, args, timeoutMs = 120000, cwd = SKILL_DIR) {
 }
 
 function runScnet(args, timeoutMs = 120000) {
+  const candidates = resolvePythonCandidates()
+  const scriptArgs = [join(SCRIPTS_DIR, 'scnet.py'), '--json', ...args]
+
   return new Promise((resolve) => {
-    execFile(
-      'python3',
-      [join(SCRIPTS_DIR, 'scnet.py'), '--json', ...args],
-      { cwd: SKILL_DIR, timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 },
-      (error, stdout, stderr) => {
-        const code = error ? (typeof error.code === 'number' ? error.code : 1) : 0
-        resolve({
-          ok: code === 0,
-          code,
-          stdout: String(stdout || ''),
-          stderr: String(stderr || ''),
-        })
-      },
-    )
+    const attempt = (index) => {
+      const executable = candidates[index]
+      execFile(
+        executable,
+        scriptArgs,
+        { cwd: SKILL_DIR, timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 },
+        (error, stdout, stderr) => {
+          if (error?.code === 'ENOENT' && index + 1 < candidates.length) {
+            attempt(index + 1)
+            return
+          }
+          const code = error ? (typeof error.code === 'number' ? error.code : 1) : 0
+          resolve({
+            ok: code === 0,
+            code,
+            executable,
+            stdout: String(stdout || ''),
+            stderr: error?.code === 'ENOENT'
+              ? `无法启动 Python 解释器 ${executable}；请设置 DSH_SCNET_PYTHON 或 SCNET_PYTHON 指向 Python 3。`
+              : String(stderr || ''),
+          })
+        },
+      )
+    }
+    attempt(0)
   })
 }
 
@@ -1173,5 +1192,6 @@ export const __testables = {
   parseWalltimeSeconds,
   pickBackend,
   queueCandidates,
+  resolvePythonCandidates,
   translateScnetError,
 }

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "dsh-scnet",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Community DeepSeek Harness bundle for SCNet SSH and OpenAPI jobs, files, Notebook resources, Slurm diagnostics, and Hygon DCU/DTK guidance.",
   "type": "module",
   "main": "./index.mjs",
   "exports": {
     ".": "./index.mjs",
+    "./connector": "./connector/index.mjs",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
@@ -26,8 +27,11 @@
   },
   "files": [
     "index.mjs",
+    "connector",
     "cordis.patch.yml",
     "skills",
+    "!skills/**/__pycache__",
+    "!skills/**/*.pyc",
     "docs",
     "README_CN.md",
     "README.md",

package/skills/scnet-hpc/VERSION

@@ -1 +1 @@
-0.6.5
+0.6.7

package/skills/scnet-hpc/references/environment.md

@@ -50,6 +50,20 @@ ssh <集群> 'module avail 2>&1'
 
 ## Python 环境
 
+### 本地脚本解释器
+
+Linux Desktop 可将随包 Python 的绝对路径注入本地脚本：
+
+```bash
+export DSH_SCNET_PYTHON=/path/to/bundled/python
+# 通用环境也可使用：
+export SCNET_PYTHON=/path/to/python3
+```
+
+`DSH_SCNET_PYTHON` 优先于 `SCNET_PYTHON`。脚本会验证解释器确实是 Python 3；
+未注入时才按 `python3`、`python` 顺序探测。该设置只影响本机的 OpenAPI CLI 和作业
+脚本生成，不会把本机解释器路径传到远端计算节点。
+
 超算通常没有系统级的 torch，用 venv 或 conda env。profile 的 `DEFAULT_VENV`
 记录默认环境路径（相对家目录）。
 

package/skills/scnet-hpc/scripts/_common.sh

@@ -12,6 +12,37 @@ CLUSTER_DIR="$REPO_ROOT/clusters"
 die() { printf '错误: %s\n' "$1" >&2; exit 1; }
 info() { printf '  %s\n' "$1"; }
 
+# Resolve the local Python 3 interpreter without assuming that every desktop
+# distribution exposes the command as `python3`. Desktop hosts may inject an
+# absolute path through DSH_SCNET_PYTHON; SCNET_PYTHON is the portable alias.
+resolve_python() {
+    local configured="${DSH_SCNET_PYTHON:-${SCNET_PYTHON:-}}"
+    local candidate resolved
+
+    if [ -n "$configured" ]; then
+        if [ -x "$configured" ]; then
+            resolved="$configured"
+        else
+            resolved="$(command -v "$configured" 2>/dev/null || true)"
+        fi
+        [ -n "$resolved" ] || return 1
+        "$resolved" -c 'import sys; raise SystemExit(0 if sys.version_info.major == 3 else 1)' \
+            >/dev/null 2>&1 || return 1
+        printf '%s\n' "$resolved"
+        return 0
+    fi
+
+    for candidate in python3 python; do
+        resolved="$(command -v "$candidate" 2>/dev/null || true)"
+        [ -n "$resolved" ] || continue
+        "$resolved" -c 'import sys; raise SystemExit(0 if sys.version_info.major == 3 else 1)' \
+            >/dev/null 2>&1 || continue
+        printf '%s\n' "$resolved"
+        return 0
+    done
+    return 1
+}
+
 list_clusters() {
     find "$CLUSTER_DIR" -maxdepth 1 -name '*.conf' ! -name '_*' -exec basename {} .conf \; 2>/dev/null | sort
 }

package/skills/scnet-hpc/scripts/new-job.sh

@@ -132,6 +132,7 @@ fi
 
 OUT="${NAME}.slurm"
 [ -e "$OUT" ] && die "$OUT 已存在"
+PYTHON_BIN="$(resolve_python)" || die "本机需要 Python 3；请设置 DSH_SCNET_PYTHON 或 SCNET_PYTHON"
 
 cat > "$OUT" <<EOF
 #!/bin/bash -l

package/skills/scnet-hpc/scripts/setup.sh

@@ -370,8 +370,8 @@ if [ -z "$ACTION" ]; then
 fi
 
 if [ "$ACTION" = status ] || [ "$ACTION" = reset ]; then
-    if command -v python3 >/dev/null 2>&1; then
-        exec python3 "$SCRIPT_DIR/scnet.py" setup "$ACTION"
+    if PYTHON_BIN="$(resolve_python)"; then
+        exec "$PYTHON_BIN" "$SCRIPT_DIR/scnet.py" setup "$ACTION"
     fi
     [ "$ACTION" = status ] || die "reset 需要 Python 3 以执行安全的分范围重置"
     config_root="${XDG_CONFIG_HOME:-$HOME/.config}/scnet-hpc"
@@ -450,16 +450,16 @@ if [ "$BACKEND" = ssh ] || [ "$BACKEND" = both ]; then
 fi
 
 if [ "$BACKEND" = openapi ] || [ "$BACKEND" = both ]; then
-    if command -v python3 >/dev/null 2>&1; then
+    if PYTHON_BIN="$(resolve_python)"; then
         printf '%s\n' \
             "OpenAPI 使用一组平台 AK/SK 自动发现全部授权区域。" >&2
         openapi_args=(setup "$ACTION" --mode openapi)
         [ "$SKIP_CONNECT" = yes ] && openapi_args+=(--skip-connect)
-        python3 "$SCRIPT_DIR/scnet.py" "${openapi_args[@]}"
+        "$PYTHON_BIN" "$SCRIPT_DIR/scnet.py" "${openapi_args[@]}"
     else
         printf '%s\n' \
             "OpenAPI backend 需要 Python 3；SSH 配置不受影响。" \
-            "安装 Python 3 后运行：python3 scripts/scnet.py setup --mode openapi" >&2
+            "请设置 DSH_SCNET_PYTHON 或 SCNET_PYTHON 指向 Python 3，或安装 python3。" >&2
     fi
 fi