dsh-tap 0.20.0

package/scripts/verify-core-generic.mjs

@@ -0,0 +1,302 @@
+#!/usr/bin/env node
+/**
+ * Falsification test for the core/providers split (completion criterion 2):
+ * a SECOND OpenAI-compatible upstream is wired up using ONLY core/
+ * primitives plus a plain adapter object defined inline below. core/ is
+ * imported but never modified; providers/codebuddy is NOT imported at all.
+ *
+ * Two proof surfaces:
+ *
+ *   S. Static purity: every core/*.js file is scanned for CodeBuddy-specific
+ *      tokens (upstream hostnames, gateway error codes, vendor header names,
+ *      provider names) and for imports of providers/* — any hit means
+ *      provider specifics leaked into the shared layer.
+ *
+ *   R. Runtime generality: a mock OpenAI-compatible upstream + the inline
+ *      `mock-openai` adapter are driven through core's bridge, rotation
+ *      engine, and usage meter, asserting:
+ *        1. non-streaming inbound → aggregated chat.completion JSON
+ *        2. stream:true inbound → SSE passthrough
+ *        3. session-attribution header injection (generic feature)
+ *        4. multi-key rotation with 500 failover + cooldown skip
+ *        5. usage metering works with plain OpenAI usage (no `credit`
+ *           field → recorded as 0)
+ *        6. developer-role messages pass through UNCHANGED — the
+ *           developer→system rewrite is owned by the codebuddy adapter,
+ *           not by core (verify-bridge.mjs §9 locks the other half)
+ *        7. credential-file discipline: json-store writes land 0600, and
+ *           resolveEnvKey parses credentials lines without building a
+ *           RegExp from the settings-controlled name (no regex injection)
+ *
+ * Usage: node scripts/verify-core-generic.mjs   (no network, no credentials)
+ */
+
+import { createServer } from 'node:http'
+import { mkdtempSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { KeyRotator } from '../core/rotation.js'
+import { createUsageMeter } from '../core/usage-meter.js'
+import { createBridge } from '../core/bridge.js'
+import { resolveEnvKey } from '../core/json-store.js'
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)))
+
+let failures = 0
+function check(label, cond, detail = '') {
+  if (cond) {
+    console.log(`  ok   ${label}`)
+  } else {
+    failures++
+    console.log(`  FAIL ${label}${detail ? ` — ${detail}` : ''}`)
+  }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+
+async function freePort() {
+  const probe = createServer()
+  await new Promise((r) => probe.listen(0, '127.0.0.1', r))
+  const { port } = probe.address()
+  await new Promise((r) => probe.close(r))
+  return port
+}
+
+// ------------------------------------------------------- S. core static purity
+console.log('\n[S] core/ static purity')
+{
+  const coreDir = join(ROOT, 'core')
+  const files = readdirSync(coreDir).filter((f) => f.endsWith('.js'))
+  check('core/ has the expected four modules', files.length === 4, files.join(','))
+  // Upstream/vendor specifics that must never appear in core/.
+  const forbidden = /\bcodebuddy\b|copilot\.tencent|tencent|12403|14401|14407|11101|11102|11103|11128|11217|12153|10001|x-ide-|x-product-version|x-private-data|dsh-codebuddy-bridge/i
+  for (const f of files) {
+    const text = readFileSync(join(coreDir, f), 'utf8')
+    const hit = text.match(forbidden)
+    check(`core/${f} carries no provider-specific token`, !hit, hit?.[0])
+    check(`core/${f} never imports providers/*`,
+      !/from\s+['"][^'"]*providers\//.test(text) && !/import\s*\(\s*['"][^'"]*providers\//.test(text))
+  }
+}
+
+// --------------------------------------- R. second-upstream runtime generality
+
+// A minimal mock OpenAI-compatible upstream: speaks SSE, carries classic
+// OpenAI usage (no vendor `credit` field), tok_1 fails 500 on demand.
+const behavior = new Map() // token → 'ok' | 'status:NNN'
+const arrivals = []
+const upstream = createServer((req, res) => {
+  let raw = ''
+  req.on('data', (c) => (raw += c))
+  req.on('end', () => {
+    let parsed = null
+    try { parsed = JSON.parse(raw) } catch { /* non-JSON */ }
+    const token = (req.headers.authorization ?? '').replace(/^Bearer /, '')
+    arrivals.push({ path: req.url, raw, parsed, token, sessionId: req.headers['session_id'] ?? null })
+    const b = behavior.get(token) ?? 'ok'
+    if (b.startsWith('status:')) {
+      res.writeHead(Number(b.slice(7)), { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ error: { message: `mock ${b}` } }))
+      return
+    }
+    res.writeHead(200, { 'Content-Type': 'text/event-stream' })
+    res.end([
+      'data: {"id":"mock","choices":[{"index":0,"delta":{"content":"hej "}}]}',
+      '',
+      'data: {"id":"mock","choices":[{"index":0,"delta":{"content":"da"}}],"usage":{"prompt_tokens":5,"completion_tokens":2,"total_tokens":7}}',
+      '',
+      'data: [DONE]',
+      '',
+    ].join('\n'))
+  })
+})
+
+/**
+ * The second upstream's adapter — everything core/ needs, nothing more.
+ * Written here, inline, against the hook contract documented in
+ * core/bridge.js: if core/ had hidden CodeBuddy coupling, this object could
+ * not drive it.
+ */
+const mockProvider = {
+  id: 'mock-openai',
+  logPrefix: '[mock-openai]',
+  bridgeHeaders: () => ({ 'User-Agent': 'mock-openai-cli/1.0' }),
+  // This upstream has no role restriction: passthrough. Proves the
+  // developer→system rewrite lives in the codebuddy adapter, not in core.
+  transformChatPayload: () => {},
+  extractUsage: (chunk) => chunk.usage ?? null,
+  extractStreamError: (chunk) => (chunk.error ? chunk : null),
+  bridgeResponseId: 'mock-openai-stream-bridge',
+  logHeaderNames: ['user-agent', 'content-type'],
+  sentinelAuth: 'Bearer mock-sentinel',
+  texts: { credentialUnavailable: 'mock-openai credential unavailable' },
+}
+
+async function main() {
+  const upstreamPort = await freePort()
+  await new Promise((r) => upstream.listen(upstreamPort, '127.0.0.1', r))
+  const baseURL = `http://127.0.0.1:${upstreamPort}`
+
+  const tmp = mkdtempSync(join(tmpdir(), 'core-generic-test-'))
+  const meter = createUsageMeter({ path: join(tmp, 'usage.json') })
+  // `let`: R4 swaps in a fresh rotator to pin the cursor deterministically.
+  let rotator = new KeyRotator()
+  const KEYS = [
+    { name: 'k1', key: 'tok_1' },
+    { name: 'k2', key: 'tok_2' },
+  ]
+  const withCredentials = (attempt) => {
+    const emptyError = new Error('mock credential unavailable')
+    emptyError.credentialUnavailable = true
+    return rotator.run(rotator.ordered(KEYS), attempt, { cooldownMs: 400, emptyError })
+  }
+
+  const runtime = { running: false, port: null, lastError: null }
+  const bridge = createBridge({
+    settings: () => ({
+      baseURL,
+      sessionHeadersEnabled: true,
+      sessionHeaderFormat: 'openai',
+      maxConcurrentPerSession: 4,
+    }),
+    provider: mockProvider,
+    withCredentials,
+    meter,
+    forensics: { logPath: () => undefined, dumpDir: () => undefined },
+    runtime,
+  })
+  const bridgePort = await freePort()
+  const stop = bridge.listen(bridgePort)
+  await sleep(200)
+
+  const chat = (body, headers = {}) =>
+    fetch(`http://127.0.0.1:${bridgePort}/v1/chat/completions`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...headers },
+      body: JSON.stringify(body),
+    })
+
+  console.log('\n[R1] non-streaming inbound → aggregated chat.completion JSON')
+  {
+    const res = await chat({ model: 'm1', stream: false, messages: [{ role: 'user', content: 'hi' }] })
+    const json = await res.json().catch(() => null)
+    check('status 200 + chat.completion shape', res.status === 200 && json?.object === 'chat.completion')
+    check('content aggregated', json?.choices?.[0]?.message?.content === 'hej da',
+      JSON.stringify(json?.choices?.[0]?.message))
+    check('response id comes from the adapter', json?.id === 'mock-openai-stream-bridge', json?.id)
+  }
+
+  console.log('\n[R2] stream:true inbound → SSE passthrough')
+  {
+    const res = await chat({ model: 'm1', stream: true, messages: [] })
+    const text = await res.text()
+    check('event-stream with [DONE]',
+      (res.headers.get('content-type') ?? '').includes('text/event-stream') && text.includes('[DONE]'))
+  }
+
+  console.log('\n[R3] session-attribution headers injected (generic feature)')
+  {
+    const before = arrivals.length
+    await (await chat({ model: 'm1', stream: true, messages: [] }, { 'X-Session-ID': 'sess-X' })).text()
+    check('session_id injected from X-Session-ID', arrivals[before]?.sessionId === 'sess-X',
+      arrivals[before]?.sessionId)
+  }
+
+  console.log('\n[R4] rotation: 500 failover + cooldown skip')
+  {
+    // Fresh rotator → cursor pinned at tok_1, so the first attempt order is
+    // deterministic regardless of how many requests ran above.
+    rotator = new KeyRotator()
+    behavior.set('tok_1', 'status:500')
+    arrivals.length = 0
+    const r = await chat({ model: 'm1', stream: true, messages: [] })
+    await r.text()
+    check('caller still gets 200 after tok_1 500', r.status === 200)
+    check('tok_1 failed, tok_2 completed (failover inside one request)',
+      JSON.stringify(arrivals.map((a) => a.token)) === JSON.stringify(['tok_1', 'tok_2']),
+      JSON.stringify(arrivals.map((a) => a.token)))
+    arrivals.length = 0
+    const r2 = await chat({ model: 'm1', stream: true, messages: [] })
+    await r2.text()
+    check('cooling tok_1 skipped on the next request',
+      arrivals.length === 1 && arrivals[0].token === 'tok_2', JSON.stringify(arrivals.map((a) => a.token)))
+    behavior.delete('tok_1')
+  }
+
+  console.log('\n[R5] usage metering with plain OpenAI usage (no credit → 0)')
+  {
+    const v = meter.view()
+    // R1(1) + R2(1) + R3(1) + R4(2) = 5 billed chat requests
+    check('every chat request metered', v.totalRequests === 5, `got ${v.totalRequests}`)
+    check('credit recorded as 0 when the upstream has no credit field', v.totalCredit === 0)
+    check('tokens recorded', v.recent[0]?.prompt === 5 && v.recent[0]?.completion === 2,
+      JSON.stringify(v.recent[0]))
+  }
+
+  console.log('\n[R6] developer role passes through UNCHANGED (rewrite is adapter-owned)')
+  {
+    const before = arrivals.length
+    await (await chat({
+      model: 'm1',
+      stream: true,
+      messages: [{ role: 'developer', content: 'be nice' }, { role: 'user', content: 'ping' }],
+    })).text()
+    const forwarded = arrivals[before]?.parsed
+    check('developer role preserved verbatim for this upstream',
+      forwarded?.messages?.[0]?.role === 'developer',
+      JSON.stringify(forwarded?.messages?.map((m) => m.role)))
+  }
+
+  await stop()
+  meter.dispose()
+  await new Promise((r) => upstream.close(r))
+
+  console.log('\n[R7] json-store: 0600 credential files + injection-free key resolution')
+  {
+    // [11]+[13]: these files carry tokens/keys — the usage store is flushed
+    // through writeJson on dispose(), so the mode is observable here.
+    const st = statSync(join(tmp, 'usage.json'))
+    if (process.platform === 'win32') {
+      // win32 无 POSIX 权限位：writeFile 的 mode 选项不体现在 stat().mode
+      // （仅反映只读属性）。代码路径与 POSIX 一致（writeJson 传 0o600），
+      // 位断言只在 POSIX 平台有意义。
+      check('json-store file mode is 0600 (win32: POSIX 位不可观测，代码已传 0o600)', true,
+        'platform-skip')
+    } else {
+      check('json-store file mode is 0600', (st.mode & 0o777) === 0o600,
+        `mode ${(st.mode & 0o777).toString(8)}`)
+    }
+
+    // [17]: the credentials file is parsed line-wise, never with a RegExp
+    // built from envName (settings-controlled free text). Prefixed names so
+    // a like-named process env var can never shadow the file values.
+    const credPath = join(tmp, 'creds.yaml')
+    writeFileSync(credPath, [
+      '# dsh flat credentials file',
+      'VCG_PLAIN: sk-plain-value',
+      'VCG_QUOTED: "sk-quoted-value"',
+      'VCG_OTHER: not-mine',
+      '',
+    ].join('\n'))
+    check('plain name resolves its file value', resolveEnvKey('VCG_PLAIN', credPath) === 'sk-plain-value',
+      String(resolveEnvKey('VCG_PLAIN', credPath)))
+    check('double-quoted value is dequoted', resolveEnvKey('VCG_QUOTED', credPath) === 'sk-quoted-value')
+    check('regex metachar name resolves null (no injection)',
+      resolveEnvKey('.*)|(', credPath) === null)
+    check('metachar name does NOT leak another line\'s value',
+      resolveEnvKey('.*)|(', credPath) !== 'not-mine')
+    check('absent name resolves null', resolveEnvKey('VCG_ABSENT', credPath) === null)
+  }
+
+  console.log(failures === 0
+    ? '\ncore/ generality proven: second OpenAI-compatible upstream wired with zero core/ changes'
+    : `\n${failures} check(s) FAILED`)
+  process.exit(failures === 0 ? 0 : 1)
+}
+
+main().catch((err) => {
+  console.error(`verify-core-generic crashed: ${err.stack ?? err.message}`)
+  process.exit(1)
+})

package/scripts/verify-desktop-acceptance.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+/**
+ * verify-desktop-acceptance.mjs — desktop 适配 goal 的「可执行验收」。
+ *
+ * 把 docs/goals/desktop-adaptation.md 的验收标准 §1–§5 逐条变成机器可判的断言。
+ * 这是 goal 的 executable spec：规约即验收，验收即断言。
+ *
+ * 三条分层（对应 goal 验收标准的可机器化程度）：
+ *   A. 离线结构性不变量 —— 任何环境可跑，CI 硬闸门。
+ *      §4a index.js 无 desktop 特化分支（静态守卫）
+ *      §4b 宿主差异收口在 host-config.js / lib/client.js 候选兜底（静态守卫）
+ *      §6  goal 文档存在且含可执行验收锚点
+ *   B. 桌面环境断言 —— 本机有 ~/.dsh/profiles/desktop 时跑；没有则 SKIP（不假装覆盖）。
+ *      §1a desktop patch 的 llm-pi-ai.providers 键枚举可解析（接入后必含 codebuddy）
+ *      §1b 手写块并存校验（volces 等不被接管/破坏）
+ *   C. 活桌面实例断言 —— 需要运行中的 desktop 实例，本脚本标记 SKIP。
+ *      §1c ?probe=host-config 全绿、§2 三通道端到端、§3 UI 壳回归
+ *      → 这些由 dsh-ui-test / 端到端探针承担，此处诚实标注，不伪造。
+ *
+ * 跑法：node scripts/verify-desktop-acceptance.mjs [--structural]
+ *   默认（本机/接入验证）：A + B 全跑，B 组结果断言 FAIL 即「适配未达成」信号。
+ *   --structural（CI 硬闸门）：只锁 A 组结构性不变量——它们必须恒真、与适配进度无关；
+ *     B 组结果断言（§1c codebuddy 已接入）在适配完成前必然 FAIL，不该进 CI 恒闸门。
+ */
+import { readFileSync, existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const structuralOnly = process.argv.includes('--structural')
+const root = join(dirname(fileURLToPath(import.meta.url)), '..')
+
+let pass = 0
+let fail = 0
+let skip = 0
+const ok = (desc, cond, extra = '') => {
+  if (cond) { pass++; console.log(`  ok   ${desc}`) }
+  else { fail++; console.log(`  FAIL ${desc}${extra ? ' — ' + extra : ''}`) }
+}
+const skipped = (desc, why) => { skip++; console.log(`  SKIP ${desc} — ${why}`) }
+const section = (t) => console.log(`\n[${t}]`)
+
+// ============================================================
+// A 组：离线结构性不变量（任何环境可跑）
+// ============================================================
+section('A. 离线结构性不变量')
+
+// §4a index.js 无 desktop 特化分支
+{
+  const src = readFileSync(join(root, 'index.js'), 'utf8')
+  // desktop 特化 = 出现 desktop 字样的条件分支；注释/字符串里提及不计。
+  const branch = src.split('\n').filter((l) =>
+    /\b(if|else if|case|&&|\|\||\?)\b.*desktop/i.test(l) && !/^\s*(\/\/|\*)/.test(l))
+  ok('§4a index.js 无 desktop 特化分支', branch.length === 0,
+    branch.length ? `命中 ${branch.length} 行：${branch[0].trim().slice(0, 80)}` : '')
+  // 分流收口加固（goal bridge-port-host-split G3）：端口偏移常量与信号函数在
+  // index.js 各唯一一处定义——「分流规则只在一处」机器可判，防分流逻辑散点复刻。
+  const offsetDefs = src.split('\n').filter((l) => /^\s*const\s+HOST_BRIDGE_PORT_OFFSET\s*=/.test(l))
+  const signalDefs = src.split('\n').filter((l) => /^\s*function\s+currentProfileDirName\s*\(/.test(l))
+  ok('§4a+ 分流收口：HOST_BRIDGE_PORT_OFFSET 常量唯一定义', offsetDefs.length === 1,
+    `定义处=${offsetDefs.length}`)
+  ok('§4a+ 分流收口：currentProfileDirName 信号函数唯一定义', signalDefs.length === 1,
+    `定义处=${signalDefs.length}`)
+}
+
+// §4b 宿主差异收口：desktop 相关选路只允许出现在 host-config.js / lib/client.js
+{
+  const files = ['index.js', 'host-config.js', 'lib/client.js']
+  const offenders = []
+  for (const f of files) {
+    const src = readFileSync(join(root, f), 'utf8')
+    const hits = src.split('\n').filter((l) => /desktop/i.test(l))
+    if (f !== 'host-config.js' && f !== 'lib/client.js' && hits.length) {
+      offenders.push(`${f}(${hits.length})`)
+    }
+  }
+  ok('§4b 宿主差异收口 host-config/client（index.js 零 desktop 引用）', offenders.length === 0,
+    offenders.join(' '))
+}
+
+// §6 goal 文档存在且含可执行验收锚点
+{
+  const goalPath = join(root, 'docs/goals/desktop-adaptation.md')
+  ok('§6a goal 文档存在', existsSync(goalPath))
+  if (existsSync(goalPath)) {
+    const txt = readFileSync(goalPath, 'utf8')
+    ok('§6b goal 文档引用本可执行验收', /verify-desktop-acceptance/.test(txt),
+      'goal 应写明本脚本为验收锚点')
+    ok('§6c goal 文档含验收标准节', /## 验收标准/.test(txt))
+  } else {
+    skipped('§6b/§6c goal 内容', 'goal 文档不存在')
+  }
+}
+
+// ============================================================
+// B 组：桌面环境断言（有 desktop profile 才跑）
+// ============================================================
+section('B. 桌面环境断言')
+
+const dshHome = join(homedir(), '.dsh')
+const desktopPatch = join(dshHome, 'profiles', 'desktop', 'cordis.patch.yml')
+
+// 从 desktop patch 文本抠某 provider 镜像块的 baseURL 端口（整块镜像纪律：
+// baseURL 跟随镜像写回时的有效端口）。
+function mirrorBlockPort(text, providerId) {
+  const m = text.match(new RegExp(`${providerId}:[\\s\\S]*?baseURL:\\s*http://127\\.0\\.0\\.1:(\\d+)`))
+  return m ? Number(m[1]) : null
+}
+
+if (structuralOnly) {
+  skipped('B 组全部', '--structural 模式：CI 只锁 A 组恒真不变量；B 组结果断言随适配进度变化，留给本机默认跑')
+} else if (!existsSync(desktopPatch)) {
+  skipped('B 组全部', `无 desktop profile（${desktopPatch} 不存在）——无桌面环境属预期`)
+} else {
+  // 枚举 llm-pi-ai.providers 键（与 workflow 闸门同款逻辑，缩进层级已实测）
+  const lines = readFileSync(desktopPatch, 'utf8').split(/\r?\n/)
+  const start = lines.findIndex((l) => l.indexOf('- id: llm-pi-ai') === 0)
+  ok('§1a desktop patch 存在 llm-pi-ai 条目', start >= 0)
+
+  if (start >= 0) {
+    let end = lines.length
+    for (let i = start + 1; i < lines.length; i++) {
+      if (lines[i].indexOf('- id: ') === 0) { end = i; break }
+    }
+    const block = lines.slice(start, end)
+    let provIdx = -1, baseIndent = 0
+    for (let i = 0; i < block.length; i++) {
+      const t = block[i].trimEnd()
+      if (t.endsWith('providers:')) { provIdx = i; baseIndent = block[i].length - block[i].trimStart().length; break }
+    }
+    const keyIndent = baseIndent + 2
+    const keys = []
+    if (provIdx >= 0) {
+      for (let i = provIdx + 1; i < block.length; i++) {
+        const l = block[i]
+        if (l.trim() === '' || l.trim().startsWith('#')) continue
+        const indent = l.length - l.trimStart().length
+        if (indent <= baseIndent) break
+        if (indent !== keyIndent) continue
+        const m = l.trim().match(/^([A-Za-z0-9_-]+):\s*$/)
+        if (m) keys.push(m[1])
+      }
+    }
+    ok('§1b providers 键可枚举（结构未破坏）', keys.length > 0, `枚举到 ${JSON.stringify(keys)}`)
+    // 接入判据：适配落地后 codebuddy 必须出现；手写块 volces 必须仍在（并存不接管）
+    ok('§1c 接入判据：codebuddy 已进入 desktop providers', keys.includes('codebuddy'),
+      `当前=${JSON.stringify(keys)}（适配未完成时此项 FAIL 即「未达成」信号）`)
+    ok('§1d 手写块并存：volces 未被接管/删除', keys.includes('volces'),
+      `当前=${JSON.stringify(keys)}`)
+    // 分流端口断言（goal bridge-port-host-split G4）：desktop patch 的 qoder/trae
+    // 镜像块 baseURL 端口应跟随分流值 3913/3912。两条件分开报：通道镜像块存在
+    // 与否（未启用/未同步时路由不存在属预期，SKIP）与端口值本身。
+    const patchText = readFileSync(desktopPatch, 'utf8')
+    const qoderPort = mirrorBlockPort(patchText, 'qoder')
+    const traePort = mirrorBlockPort(patchText, 'trae')
+    if (keys.includes('qoder')) {
+      ok('§4c desktop qoder 镜像 baseURL 端口 = 3913（分流）', qoderPort === 3913,
+        `当前=${qoderPort}`)
+    } else {
+      skipped('§4c qoder 镜像端口', 'providers.qoder 块不存在（通道未启用/目录未同步——路由存在性管理属预期）')
+    }
+    if (keys.includes('trae')) {
+      ok('§4d desktop trae 镜像 baseURL 端口 = 3912（分流）', traePort === 3912,
+        `当前=${traePort}`)
+    } else {
+      skipped('§4d trae 镜像端口', 'providers.trae 块不存在（通道未启用/目录未同步——路由存在性管理属预期）')
+    }
+  }
+}
+
+// ============================================================
+// C 组：活桌面实例断言（诚实标注，不伪造）
+// ============================================================
+section('C. 活桌面实例断言（诚实标注）')
+skipped('§2 三通道端到端（CodeBuddy 桥聊天出正文）', '需运行中的 desktop 实例——由端到端探针承担，不在离线脚本伪造')
+skipped('§3 UI 壳设置卡回归', '需按 desktop UI 壳形态适配 dsh-ui-test 驱动后另跑（先加载 .agents/skills/dsh-ui-regression/）')
+skipped('§1e ?probe=host-config 活实例全绿', '需运行中的 desktop 实例——workflow G4 阶段承担')
+skipped('§4e 分流端口活体验收（listen 3912/3913 探活 + 双实例 probe 各归各 + web 侧 documentPath 落盘）',
+  '需运行中的 web/desktop 双实例——由活体探针承担（证据落 docs/probes/），不在离线脚本伪造')
+
+// ============================================================
+console.log(`\n${pass} ok / ${fail} FAIL / ${skip} SKIP`)
+console.log('（B 组 SKIP = 无桌面环境属预期；C 组恒 SKIP，活实例断言由探针/GUI 套件承担）')
+process.exit(fail > 0 ? 1 : 0)