feat(minimax): add native plugin setup and verification

.github/workflows/desktop.yml

@@ -204,6 +204,8 @@ jobs:
       - name: Verify native Keychain across processes
         run: cargo run --locked --manifest-path src-tauri/Cargo.toml --example credential_probe
       - name: Build unsigned macOS app and DMG
+        id: macos_build
+        shell: bash
         run: |
           mkdir -p .artifacts
           set -euo pipefail
@@ -221,15 +223,32 @@ jobs:
             echo "::warning::DMG creation found a busy resource; retrying after $((attempt * 5)) seconds (attempt $attempt of 3)."
             sleep "$((attempt * 5))"
           done
-      - name: Upload failed macOS build diagnostics
-        if: failure()
+      - name: Collect macOS packaging diagnostics
+        if: ${{ always() && steps.macos_build.outcome == 'failure' }}
+        timeout-minutes: 2
+        shell: bash
+        run: |
+          mkdir -p .artifacts
+          {
+            sw_vers || true
+            uname -m || true
+            df -h . "$RUNNER_TEMP" || true
+            hdiutil info || true
+            diskutil list || true
+          } > .artifacts/macos-packaging-diagnostics.log 2>&1
+      - name: Upload macOS packaging diagnostics
+        if: ${{ always() && steps.macos_build.outcome != 'skipped' }}
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
-          name: desktop-macos-${{ matrix.runner }}-build-diagnostics
+          name: desktop-macos-${{ matrix.runner }}-packaging-diagnostics
+          include-hidden-files: true
           path: |
             desktop/.artifacts/macos-build*.log
+            desktop/.artifacts/macos-packaging-diagnostics.log
             desktop/src-tauri/target/release/bundle/dmg/bundle_dmg.sh
+            desktop/src-tauri/target/release/bundle/share/create-dmg/support/
           if-no-files-found: warn
+          retention-days: 7
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: desktop-macos-${{ matrix.runner }}-internal-unsigned

.github/workflows/master.yml

@@ -769,6 +769,7 @@ jobs:
           tests/builtin/runtime/test_external_skills.py
           tests/test_cli.py::test_remote_enroll_can_install_automatic_service_in_one_command
           tests/test_openclaw_cli.py::test_build_openclaw_plugin_runs_pnpm_install_non_interactively
+          tests/test_cli_minimax.py
           tests/test_opencode_cli.py
           tests/test_service.py
           tests/test_service_bootstrap.py

desktop/VALIDATION.md

@@ -118,7 +118,7 @@ The historical Server c535d816 protocol qualification below records the specific
 
 ## Compatibility scope
 
-[compatibility.json](src-tauri/src/connections/compatibility.json) preserves each recorded Server source, normalized OpenAPI contract digest, qualification-wheel digest and operation set. The `sqlite-atomic-112db11e-v1` record matches the bundled API contract and qualifies its eleven recorded SQLite protocol operations against the exact Server source and wheel below. Historical records retain their exact identities and evidence. Ordinary builds require explicitly selecting the record whose tested Server source and wheel match the deployment, then checking the connection before business operations become available. Records with a different contract digest are disabled in the selector, and saved unavailable selections remain visible until explicitly replaced. Selecting a profile does not extend its recorded operation set or qualify a different Server source. CI builds have their own artifact identities and do not change product qualification.
+[compatibility.json](src-tauri/src/connections/compatibility.json) preserves each recorded Server source, normalized OpenAPI contract digest, qualification-wheel digest and operation set. The `sqlite-atomic-112db11e-v1` record matches the bundled API contract and qualifies its eleven recorded SQLite protocol operations against the exact Server source and wheel below. Historical records retain their exact identities and evidence, including `sqlite-atomic-bae5d714-v1`, `sqlite-source-artifact-87b6fae2-v1` and the preceding `sqlite-artifact-merge-87d01f68-v1` record. The `sqlite-atomic-dd62723d-v1` and `sqlite-atomic-4ffdf4e9-v1` records retain their migration-framework and release-preparation source qualifications with their original contract digest. Other historical records, including the separate `sqlite-atomic-1da99747-linux-v1` qualification, also retain their exact identities and evidence. Ordinary builds require explicitly selecting the record whose tested Server source and wheel match the deployment, then checking the connection before business operations become available. Records with a different contract digest are disabled in the selector, and saved unavailable selections remain visible until explicitly replaced. Selecting a profile does not extend its recorded operation set or qualify a different Server source. CI builds have their own artifact identities and do not change product qualification.
 
 The real Server harness covers SQLite with anonymous loopback, static Bearer, HTTPS with explicit CA/base path, and injected-provider/enforced access. It exercises save/search/exact reads, identity changes, binding revocation, ambiguous writes without replay and Scope pagination. Installed UI checks cover repeated launches preserving the existing editor, late committed-save responses preserving a new Scope draft, explicit connection/Scope selection, clipboard copies, connection isolation, draft cancellation, byte limits and independent Server survival after Desktop exit.
 
@@ -803,6 +803,34 @@ Repository hooks passed except the existing Windows Python type errors in unchan
 see ignored `.artifacts/desktop-shell/current-contract-prek.log`.
 仓库全量钩子仍有未修改代码的既存 Windows Python 类型错误，其余钩子通过。
 
+#### Server 1da99747 Linux protocol qualification
+
+`sqlite-atomic-1da99747-linux-v1` records a separate qualification wheel for the same Server
+contract as `sqlite-atomic-1da99747-v1`. It identifies Server sources at
+`1da997476651c2850ff7141e2b7cd512d0152a90` and normalized OpenAPI digest
+`5878999ce9e239d6642e4da858074b281ed465629432c578b3584eec47cbce6c`.
+The qualification wheel is `powercontext-1.4.1.dev139+g1da997476-py3-none-any.whl`,
+SHA-256 `92c71e27f406df8663b6cac894ecef9fe8aff17454a5a0dda736b09624c305d9`.
+All 540 packaged runtime files match the recorded Server commit byte for byte; the OpenAPI
+contract, project configuration and lock also match. The sorted runtime source-manifest digest
+is `da5b32b18298795299135c585c618d8238683eb596b2121f4904f61da23c3786`
+(one `wheel/path sha256` entry per line, with a final newline).
+
+The existing real-Server harness passed against this isolated wheel and SQLite in all four modes:
+anonymous loopback, static Bearer, HTTPS with an explicit CA and base path, and an injected
+provider with enforced access. The ten recorded operations cover Scope selection and pagination,
+Atomic Memory save/search/exact revision reads, identity changes, same-identity revocation,
+committed writes with lost responses without replay, and independent Server survival after the
+client exits.
+
+Qualification ran on Linux x86_64 with Python 3.12.3 and Rust 1.95.0. The standalone Rust client
+compiled the unmodified product connection, transport, credential and error modules, plus
+`server_probe.rs`, from Desktop merge commit `5bab8fc3720087e537a1a5cd1da613fd044780b7`.
+Every client dependency version and checksum matches the product Cargo lock. The Tauri GUI shell
+was excluded. This establishes Server protocol compatibility for the recorded sources and wheel;
+it does not qualify Linux Desktop support, native macOS/Windows packaging, credential stores,
+or installed UI workflows. Historical records retain their original identities and evidence.
+
 #### Server c535d816 protocol qualification
 
 `sqlite-atomic-c535d816-v1` records Server sources at
@@ -1017,7 +1045,6 @@ Headless Edge 155.0.4283.62 with synthetic IPC checked all five pages in 24 comb
 
 无头 Edge 155.0.4283.62 使用合成 IPC 检查中英文、三种主题及上述四组 CSS 视口，共 24 种组合，五个页面没有横向溢出。在桌面宽度下，有无观察入口时“设置与诊断”的坐标一致；小窗口中它仍位于主导航下方。400×300 配合设备缩放因子 2 仅检查 800×600 在 200% 下的等效布局，不代表安装版 WebView 缩放。真实 Server、安装包、原生 IME、屏幕阅读器和 macOS 仍需实际验收。
 
-
 ## Shared feedback and global context (#2102)
 
 On 2026-10-22, Windows x64 local checks used Node 24.14.1, pnpm 11.13.1 and Rust 1.95.0. Focused feedback/context tests and all 50 frontend tests passed, together with typecheck, lint (including generated contracts and icons in check mode) and production build. Coverage includes pending/failed/disconnected initialization, local-state recovery without readiness probes, same-name Scope IDs, latest matching connection facts, identity/health/compatibility separation, prerequisite recovery, Scope pagination recovery, failed exact-read retries retaining the original revision, preserved drafts, local diagnostics, keyboard menus and modal focus. Existing save, unknown-write and late-response protections remain covered.

desktop/src-tauri/src/connections/compatibility.json

@@ -171,6 +171,25 @@
     ],
     "evidence": "desktop/VALIDATION.md#server-1da99747-protocol-qualification"
   },
+  {
+    "id": "sqlite-atomic-1da99747-linux-v1",
+    "serverCommit": "1da997476651c2850ff7141e2b7cd512d0152a90",
+    "contractSha256": "5878999ce9e239d6642e4da858074b281ed465629432c578b3584eec47cbce6c",
+    "artifactSha256": "92c71e27f406df8663b6cac894ecef9fe8aff17454a5a0dda736b09624c305d9",
+    "operations": [
+      "get_access_principal",
+      "get_artifact_revision",
+      "get_capabilities",
+      "get_default_scope",
+      "get_liveness",
+      "get_readiness",
+      "get_scope",
+      "list_scopes",
+      "remember_memory",
+      "search_memory"
+    ],
+    "evidence": "desktop/VALIDATION.md#server-1da99747-linux-protocol-qualification"
+  },
   {
     "id": "sqlite-atomic-8f10c560-v1",
     "serverCommit": "8f10c560776b32b717c3511fad9da349982a5748",

docs/en/docs/integrations/capabilities.md

@@ -48,3 +48,4 @@ candidate_review permits listing and reading candidates only; it never grants de
 | bub | Evaluation harness | Master only | — | — | — | memory_read<br>memory_write<br>source_capture<br>context_injection<br>flush_or_checkpoint |
 | dify | Framework adapter | Experimental | — | — | — | memory_read<br>memory_write<br>source_capture<br>context_injection<br>handoff<br>experience_read_or_generate<br>skill_read_or_generate<br>candidate_review |
 | kimi-code | Agent host | Experimental | minimal, recommended, full | unsupported | — | memory_read<br>memory_write<br>source_capture<br>context_injection<br>persistent_scope_binding<br>work_contract<br>handoff<br>acknowledge<br>task_outcome<br>experience_read_or_generate<br>skill_read_or_generate<br>candidate_review<br>external_skill |
+| minimax | Agent host | Experimental | — | unsupported | — | acknowledge<br>artifact_publication<br>candidate_review<br>experience_read_or_generate<br>external_skill<br>handoff<br>memory_read<br>memory_write<br>persistent_scope_binding<br>scope_organization<br>skill_read_or_generate<br>source_capture<br>task_outcome<br>work_contract |

docs/en/docs/integrations/meta.json

@@ -12,6 +12,7 @@
     "dsh",
     "kimi-code",
     "hermes",
+    "minimax",
     "openclaw",
     "opencode",
     "pi",