refactor(core): route remote exec through runtime port

docs/plans/core-decomposition-completed.md

@@ -21,8 +21,8 @@
 - `bitfun-events` 已承接 backend event DTO、agentic event DTO、framework-neutral Agentic frontend event projection 和 platform-neutral `EventEmitter` trait；Tauri/WebSocket transport 只负责 delivery。
 - `services-integrations` 已承接 remote-connect primitives、wire command routing / response assembly、LAN IP/URL 探测、ngrok 进程/tunnel lifecycle、mobile-web relay upload manifest / incremental upload / fallback upload、IM bot provider-neutral config / persistence / file auto-push / locale / menu / state / command parsing、Weixin provider client、workspace search concrete owner、remote SSH/SFTP/PTY owner、Remote SSH disabled runtime surface、Remote SSH workspace/session identity helper、remote workspace-search disabled surface、DeepResearch report IO / display-map sidecar、MiniApp host dispatch / storage / worker / import IO、announcement remote fetch/cache、browser CDP endpoint HTTP probing / page creation、WebFetch / WebSearch concrete HTTP provider、debug-log HTTP ingest posting、review-platform HTTP transport，以及 MCP server registry、connection pool、catalog cache、reconnect retry state、runtime-only config overlay、local command resolution helper 和 lifecycle status policy。
 - `tool-contracts` 已承接 provider-neutral tool DTO、manifest/catalog/admission/result presentation、Computer Use DTO/input parser/screenshot payload、confirmation facts、truncation recovery presentation、runtime restriction policy 和 provider-entry materialization；core 只保留 Computer Use 旧 public path re-export / compatibility shim 与产品执行入口。
-- `tool-execution` 已承接 local / remote IO helper、Bash shell helper、batching plan、retry policy、state counting、tool state event payload shaping / result redaction、cancellation-state/token-store policy、background exec output capture、ExecCommand provider-neutral 呈现 / 输入默认值 / 结果 shape / shell metadata / shell argv / remote shell probe / remote env snapshot 解析、cache 与 capture policy / lifecycle facts / control facts / completion shape、prompt-safe tool context facts / custom-data materialization、Computer Use loop detection / screenshot hash / verification / retry policy，以及 File tool 的 provider-neutral 结果展示、写入 mode/status/line-count 规则、Edit guardrail 分类和 Delete success 文本；core 只保留 ToolResult 包装、权限、checkpoint、runtime handles、process manager / host adapter 调用、read-state adapter、remote shell/FS 调用和旧工具入口。
-- `runtime-ports` / `terminal-core` 已承接本地 ExecCommand 会话执行端口和 concrete provider：`TerminalPort` 暴露本地命令执行、stdin 写入、会话控制和生命周期事件边界，`TerminalRuntimePort` 复用原 `ExecProcessManager` 行为，desktop/server/CLI 等产品入口通过 `CoreRuntimeServicesProvider` 构造 terminal provider 并显式注入 `ConversationCoordinator` / 执行上下文 / `ToolRuntimeHandles`；core 本地 `ExecCommand` / `WriteStdin` / `ExecControl` 只消费端口，不再直接调用全局本地进程 manager。远端 SSH ExecCommand 仍是单独 remote/product command adapter 待迁移项。
+- `tool-execution` 已承接 local / remote IO helper、Bash shell helper、batching plan、retry policy、state counting、tool state event payload shaping / result redaction、cancellation-state/token-store policy、background exec output capture、ExecCommand provider-neutral 呈现 / 输入默认值 / 结果 shape / shell metadata / shell argv / remote shell probe / remote env snapshot 解析、cache 与 capture policy / lifecycle facts / control facts / completion shape、prompt-safe tool context facts / custom-data materialization、Computer Use loop detection / screenshot hash / verification / retry policy，以及 File tool 的 provider-neutral 结果展示、写入 mode/status/line-count 规则、Edit guardrail 分类和 Delete success 文本；core 只保留 ToolResult 包装、权限、checkpoint、runtime handles、host adapter 调用、read-state adapter、remote FS 调用和旧工具入口。
+- `runtime-ports` / `terminal-core` / `services-integrations` 已承接 ExecCommand 会话执行端口和 concrete provider：`TerminalPort` 暴露本地命令执行、stdin 写入、会话控制和生命周期事件边界，`RemoteExecPort` 暴露远端 SSH 命令执行、bounded one-shot command、stdin、会话控制和生命周期事件边界；`TerminalRuntimePort` 复用原本地 `ExecProcessManager` 行为，`RemoteExecRuntimePort` 复用原 remote exec manager 与旧 SSH one-shot 行为，当前 desktop / CLI 产品入口和保留 server bootstrap 初始化路径通过 `CoreRuntimeServicesProvider` 构造 provider 并显式注入 `ConversationCoordinator` / 执行上下文 / `ToolRuntimeHandles`；core `ExecCommand` / `WriteStdin` / `ExecControl` 只消费端口，不再直接调用全局本地或远端进程 manager。
 - `agent-runtime` 已承接 scheduler/background delivery 纯决策、dialog lifecycle port contracts、runtime event queue/router、session management/cancellation port contracts、session/config/summary facts、persisted session state sidecar / processing-state sanitization、session state facts / event-label projection、session state manager / event emission owner、dialog-turn id / stats facts、side-question runtime-only tracking、thread-goal facts、context profile / model capability policy、prompt markup / prompt / prompt-cache facts 与持久化写入决策、remote file delivery prompt facts、turn skill/agent snapshot DTO/diff/render/store、file-read session state / prior-read guardrail / freshness 决策、session evidence ledger 与 compression-contract projection、dialog-turn cancellation token store、tool confirmation gate / wait channel state、user-question wait channel state、custom agent / mode / subagent schema、默认值、discovery/loading、markdown IO、validation、review 工具过滤、skill catalog/root specs、mode policy、selection/shadow/mode-info 规则、assistant payload rendering、post-call hook routing、DeepReview provider-neutral policy/queue/retry/diagnostics shaping 与 queue event payload shaping、DeepResearch citation renumber 与 report post-process gate，并建立不暴露 `bitfun-core` / `product-full` / concrete manager 的内部 SDK facade。SDK facade 已支持注入 fake runtime services、tool registry、harness registry、hook registry 和 agent registry。
 - `harness` 已建立 descriptor、route plan 和 legacy provider registry。
 - `product-domains` 已承接 MiniApp state/workflow planning、built-in seed orchestration / host adapter contract、compile / permission adaptation、import lifecycle、AI / Agent permission、rate-limit、model/message/session/workspace/turn-text bridge rules、AI / Agent 请求计划、stream / runtime event payload、worker restart / draft key / workspace input 规则、function-agent prompt/parser/response policy 和部分 Git snapshot/fallback 逻辑。

docs/plans/core-decomposition-plan.md

@@ -87,8 +87,8 @@
 当前大型 PR 批次：
 
 - Platform Provider Closure 已继续收口具备服务层 owner 的 concrete provider：remote-connect LAN IP/URL 探测、ngrok 进程/tunnel lifecycle、mobile-web relay 上传、announcement remote fetch/cache、browser CDP endpoint HTTP probing / page creation、WebFetch / WebSearch concrete HTTP provider、debug-log HTTP ingest posting 和 review-platform HTTP transport。core 保留兼容 facade、配置读取、产品编排、provider DTO 映射和工具结果 envelope。
-- Terminal / ExecCommand 路径已迁出 provider-neutral 输入默认值、结果 shape、shell metadata、shell argv、PowerShell UTF-8 policy、remote shell probe、remote env snapshot 解析/cache/capture policy、remote non-TTY control wrapper 和 lifecycle status facts；本地 concrete execution 已通过 `TerminalPort` / `TerminalRuntimePort` 收口到 desktop/server/CLI 等产品入口显式注入的 terminal provider，并由执行上下文传递到工具 runtime handles。core 本地 `ExecCommand` / `WriteStdin` / `ExecControl` 不再直接调用全局本地进程 manager，只保留工具入口、权限/checkpoint 和结果 envelope。
-- 后续仍需迁移 remote ExecCommand/product 命令路径、Computer Use OS action、部分 Git/process/session host adapter、MCP auth URL helper 和 OpenCode/UI extension 的真实消费路径；这些路径必须在具备等价测试、host port 和交付形态矩阵后再迁移。
+- Terminal / ExecCommand 路径已迁出 provider-neutral 输入默认值、结果 shape、shell metadata、shell argv、PowerShell UTF-8 policy、remote shell probe、remote env snapshot 解析/cache/capture policy、remote non-TTY control wrapper 和 lifecycle status facts；本地 concrete execution 已通过 `TerminalPort` / `TerminalRuntimePort` 收口到当前 desktop / CLI 产品入口显式注入的 terminal provider，远端 SSH concrete execution 已通过 `RemoteExecPort` / `RemoteExecRuntimePort` 收口到 services-integrations remote owner，bounded shell probe 通过端口保留旧 SSH one-shot stdout/stderr/timeout 语义，并由执行上下文传递到工具 runtime handles。core `ExecCommand` / `WriteStdin` / `ExecControl` 不再直接调用全局本地或远端进程 manager，只保留工具入口、权限/checkpoint 和结果 envelope。
+- 后续仍需迁移 Computer Use OS action、部分 Git/process/session host adapter、MCP auth URL helper 和 OpenCode/UI extension 的真实消费路径；这些路径必须在具备等价测试、host port 和交付形态矩阵后再迁移。
 
 保护：
 

scripts/core-boundaries/rules/source/forbidden-rules.mjs

@@ -1570,6 +1570,21 @@ export const forbiddenContentRules = [
         message:
           'core local ExecCommand adapter must not call the global local process manager; use injected TerminalPort',
       },
+      {
+        regex: /\bget_global_remote_exec_process_manager\b/,
+        message:
+          'core remote ExecCommand adapter must not call the global remote process manager; use injected RemoteExecPort',
+      },
+      {
+        regex: /\bSSHConnectionManager\b/,
+        message:
+          'core remote ExecCommand adapter must not depend on concrete SSH managers; use injected RemoteExecPort',
+      },
+      {
+        regex: /\bSSHCommandOptions\b/,
+        message:
+          'core remote ExecCommand adapter must not depend on concrete SSH command options; use injected RemoteExecPort',
+      },
       {
         regex: /\bLocalExecCommandRequest\b/,
         message:
@@ -1620,6 +1635,16 @@ export const forbiddenContentRules = [
         message:
           'core local WriteStdin adapter must not call the global local process manager; use injected TerminalPort',
       },
+      {
+        regex: /\bget_global_remote_exec_process_manager\b/,
+        message:
+          'core remote WriteStdin adapter must not call the global remote process manager; use injected RemoteExecPort',
+      },
+      {
+        regex: /\bRemoteExecError\b/,
+        message:
+          'core remote WriteStdin adapter must not match concrete remote exec errors; use PortErrorKind',
+      },
       {
         regex: /\bLocalWriteStdinRequest\b/,
         message:
@@ -1655,6 +1680,16 @@ export const forbiddenContentRules = [
         message:
           'core local ExecControl adapter must not call the global local process manager; use injected TerminalPort',
       },
+      {
+        regex: /\bget_global_remote_exec_process_manager\b/,
+        message:
+          'core remote ExecControl adapter must not call the global remote process manager; use injected RemoteExecPort',
+      },
+      {
+        regex: /\bRemoteExecError\b/,
+        message:
+          'core remote ExecControl adapter must not match concrete remote exec errors; use PortErrorKind',
+      },
       {
         regex: /\bLocalExecControlRequest\b/,
         message:
@@ -1680,6 +1715,11 @@ export const forbiddenContentRules = [
         message:
           'core local ExecCommand input adapter must not call the global local process manager; use injected TerminalPort',
       },
+      {
+        regex: /\bget_global_remote_exec_process_manager\b/,
+        message:
+          'core remote ExecCommand input adapter must not call the global remote process manager; use injected RemoteExecPort',
+      },
       {
         regex: /\bLocalSendStdinRequest\b/,
         message:
@@ -1745,6 +1785,16 @@ export const forbiddenContentRules = [
         message:
           'core exec_command env snapshot adapter must not own snapshot cache ttl; use tool-runtime exec_command',
       },
+      {
+        regex: /\bget_global_remote_exec_process_manager\b/,
+        message:
+          'core exec_command env snapshot adapter must not call the global remote process manager; use injected RemoteExecPort',
+      },
+      {
+        regex: /\bSSHConnectionManager\b/,
+        message:
+          'core exec_command env snapshot adapter must not depend on concrete SSH managers; use injected RemoteExecPort',
+      },
     ],
   },
   {

scripts/core-boundaries/self-test.mjs

@@ -989,6 +989,9 @@ export function runManifestParserSelfTest({
     'command\\s+-v\\s+bash',
       'REMOTE_SHELL_PROBE_TIMEOUT_MS',
       'get_global_exec_process_manager',
+      'get_global_remote_exec_process_manager',
+      'SSHConnectionManager',
+      'SSHCommandOptions',
       'LocalExecCommandRequest',
       'CoreRuntimeServicesProvider::terminal_port',
       'TerminalRuntimePort',
@@ -1007,6 +1010,8 @@ export function runManifestParserSelfTest({
     '"status"\\s*:\\s*"session_not_found"',
       'No input was sent',
       'get_global_exec_process_manager',
+      'get_global_remote_exec_process_manager',
+      'RemoteExecError',
       'LocalWriteStdinRequest',
       'CoreRuntimeServicesProvider::terminal_port',
       'TerminalRuntimePort',
@@ -1026,6 +1031,8 @@ export function runManifestParserSelfTest({
   }
     for (const contract of [
       'get_global_exec_process_manager',
+      'get_global_remote_exec_process_manager',
+      'RemoteExecError',
       'LocalExecControlRequest',
       'CoreRuntimeServicesProvider::terminal_port',
       'TerminalRuntimePort',
@@ -1039,6 +1046,7 @@ export function runManifestParserSelfTest({
   );
     for (const contract of [
       'get_global_exec_process_manager',
+      'get_global_remote_exec_process_manager',
       'LocalSendStdinRequest',
       'CoreRuntimeServicesProvider::terminal_port',
       'TerminalRuntimePort',
@@ -1060,6 +1068,8 @@ export function runManifestParserSelfTest({
     'ENV_SNAPSHOT_TIMEOUT_MS',
     'ENV_SNAPSHOT_MAX_OUTPUT_CHARS',
     'ENV_SNAPSHOT_TTL',
+    'get_global_remote_exec_process_manager',
+    'SSHConnectionManager',
   ]) {
     if (!coreExecCommandEnvSnapshotRuleText.includes(contract)) {
       throw new Error(`core exec_command env_snapshot boundary rule must forbid ${contract}`);

src/apps/cli/src/agent/agentic_system.rs

@@ -13,6 +13,9 @@ pub async fn init_agentic_system() -> Result<AgenticSystem> {
     system
         .coordinator
         .set_terminal_port(CoreRuntimeServicesProvider::terminal_port());
+    system
+        .coordinator
+        .set_remote_exec_port(CoreRuntimeServicesProvider::remote_exec_port());
     Ok(system)
 }
 

src/apps/desktop/src/api/agentic_api.rs

@@ -1534,6 +1534,11 @@ pub async fn control_background_command(
     } else {
         coordinator.inner().terminal_port()
     };
+    let remote_exec_port = if remote {
+        coordinator.inner().remote_exec_port()
+    } else {
+        None
+    };
 
     control_exec_command_session(
         ExecCommandControlRequest {
@@ -1544,6 +1549,7 @@ pub async fn control_background_command(
             yield_time_ms: Some(250),
         },
         terminal_port.as_ref(),
+        remote_exec_port.as_ref(),
     )
     .await
     .map(|response| {
@@ -1606,6 +1612,11 @@ pub async fn send_background_command_input(
     } else {
         coordinator.inner().terminal_port()
     };
+    let remote_exec_port = if remote {
+        coordinator.inner().remote_exec_port()
+    } else {
+        None
+    };
     send_exec_command_input(
         ExecCommandInputRequest {
             session_id,
@@ -1614,6 +1625,7 @@ pub async fn send_background_command_input(
             remote,
         },
         terminal_port.as_ref(),
+        remote_exec_port.as_ref(),
     )
     .await
     .map_err(|e| {

src/apps/desktop/src/api/tool_api.rs

@@ -12,6 +12,7 @@ use bitfun_core::agentic::{
     workspace::{local_workspace_services, remote_workspace_services},
     WorkspaceBinding,
 };
+use bitfun_core::product_runtime::CoreRuntimeServicesProvider;
 use bitfun_core::service::remote_ssh::workspace_state::{
     get_remote_workspace_manager, lookup_remote_connection, workspace_session_identity,
 };
@@ -172,7 +173,16 @@ async fn build_tool_context(workspace_path: Option<&str>) -> ToolUseContext {
         None => None,
     };
 
-    ToolUseContext::for_tool_listing(workspace, workspace_services)
+    let remote_exec_port = workspace
+        .as_ref()
+        .is_some_and(WorkspaceBinding::is_remote)
+        .then(CoreRuntimeServicesProvider::remote_exec_port);
+
+    ToolUseContext::for_tool_listing_with_remote_exec_port(
+        workspace,
+        workspace_services,
+        remote_exec_port,
+    )
 }
 
 fn to_dynamic_mcp_tool_info(

src/apps/desktop/src/lib.rs

@@ -1387,6 +1387,9 @@ async fn init_agentic_system() -> anyhow::Result<(
     coordinator.set_terminal_port(
         bitfun_core::product_runtime::CoreRuntimeServicesProvider::terminal_port(),
     );
+    coordinator.set_remote_exec_port(
+        bitfun_core::product_runtime::CoreRuntimeServicesProvider::remote_exec_port(),
+    );
 
     coordination::ConversationCoordinator::set_global(coordinator.clone());
 

src/apps/server/src/bootstrap.rs

@@ -104,6 +104,9 @@ pub async fn initialize(workspace: Option<String>) -> anyhow::Result<Arc<ServerA
     coordinator.set_terminal_port(
         bitfun_core::product_runtime::CoreRuntimeServicesProvider::terminal_port(),
     );
+    coordinator.set_remote_exec_port(
+        bitfun_core::product_runtime::CoreRuntimeServicesProvider::remote_exec_port(),
+    );
 
     coordination::ConversationCoordinator::set_global(coordinator.clone());