@cnwenf/occ 2.1.269 → 2.1.271

package/README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@cnwenf/occ.svg)](https://www.npmjs.com/package/@cnwenf/occ)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Runtime: Bun](https://img.shields.io/badge/Runtime-Bun-%23000000.svg)](https://bun.sh/)
-[![Tracks: Claude Code 2.1.204](https://img.shields.io/badge/Tracks-Claude%20Code%202.1.204-blueviolet.svg)](https://docs.anthropic.com/en/docs/claude-code)
+[![Tracks: Claude Code 2.1.211](https://img.shields.io/badge/Tracks-Claude%20Code%202.1.211-blueviolet.svg)](https://docs.anthropic.com/en/docs/claude-code)
 
 [简体中文](./README.zh-CN.md) · **English**
 
@@ -13,7 +13,7 @@
 
 ## What is OCC
 
-**Open C Code (OCC)** is an open-source coding agent. Its capabilities are aligned with [Claude Code](https://docs.anthropic.com/en/docs/claude-code) (currently tracking `2.1.204`). The code is fully open, auditable, backdoor-free, and your data stays under your control.
+**Open C Code (OCC)** is an open-source coding agent. Its capabilities are aligned with [Claude Code](https://docs.anthropic.com/en/docs/claude-code) (currently tracking `2.1.211`). The code is fully open, auditable, backdoor-free, and your data stays under your control.
 
 If you worry that a closed-source CLI might hide backdoors, or that your code and credentials are uploaded to unauditable services, OCC is for you: all source is open and unobfuscated, the build is reproducible from source, and API credentials are sent only to endpoints you configure.
 
@@ -62,7 +62,7 @@ Requires a valid Anthropic API Key (or AWS Bedrock / Google Vertex / Azure Found
 | **Auditability** | Line-by-line reviewable | No |
 | **Telemetry** | Minimal (analytics stubbed) | Standard |
 | **Data sovereignty** | Credentials stay on your machine; requests only to endpoints you configure | Anthropic endpoints |
-| **Capability parity** | Tracks CC `2.1.204` | Reference implementation |
+| **Capability parity** | Tracks CC `2.1.211` | Reference implementation |
 | **Providers** | Anthropic Direct, Bedrock, Vertex, Azure | Anthropic, Bedrock, Vertex |
 | **Cost** | Free & open-source (MIT) | Subscription |
 | **Build** | Reproducible from source | N/A |
@@ -143,7 +143,7 @@ Requires [Bun](https://bun.sh/) >= 1.3.11 (use `bun upgrade` — older Bun cause
 
 ```bash
 bun install
-bun run dev          # run from source; version prints 2.1.204 when working
+bun run dev          # run from source; version prints 2.1.270 (dev polyfill; build overrides with pkg.version) when working
 bun run build        # output: dist/cli.js (~26 MB, single-file bundle)
 bun test             # test suite (Bun test runner)
 bun run lint         # Biome lint (formatter disabled to avoid large diffs)
@@ -157,7 +157,7 @@ For architecture, entry/bootstrap, tool system, UI layer, and module-status deta
 
 ## Status
 
-- Tracks Claude Code **`2.1.204`**.
+- Tracks Claude Code **`2.1.211`**.
 - Published to npm as [`@cnwenf/occ`](https://www.npmjs.com/package/@cnwenf/occ).
 - Many modules are intentionally stubbed or feature-flagged off — see "Disabled / stubbed" above.
 

package/README.zh-CN.md

@@ -8,7 +8,7 @@
 
 ## 这是什么
 
-**Open C Code（OCC）** 是一个开源的编码智能体。能力与 [Claude Code](https://docs.anthropic.com/en/docs/claude-code) 对齐（当前跟踪 `2.1.204`）。代码全开放、可审计、无暗门，数据由你掌控。
+**Open C Code（OCC）** 是一个开源的编码智能体。能力与 [Claude Code](https://docs.anthropic.com/en/docs/claude-code) 对齐（当前跟踪 `2.1.211`）。代码全开放、可审计、无暗门，数据由你掌控。
 
 如果你担心闭源 CLI 可能植入后门、担心代码与凭据被上传到不可审计的服务，OCC 就是为你准备的：全部源码开放、无混淆，构建产物可由源码复现，API 凭据只发往你自己配置的端点。
 
@@ -21,7 +21,7 @@
 
 ## 现状
 
-- 跟踪 Claude Code **`2.1.204`**。
+- 跟踪 Claude Code **`2.1.211`**。
 - 代码库有约 1300 个不阻塞的 `tsc` 类型错误（大量松散的 `unknown`/`never`/`{}` 类型），**不影响 Bun 运行时执行**。门槛是 Biome lint，不是 `tsc`。
 - 所有内部 feature flag（`feature(...)`）已被 polyfill 为 `false` —— 内部功能（COORDINATOR_MODE、KAIROS、PROACTIVE 等）全部关闭。
 - 已发布到 npm：[`@cnwenf/occ`](https://www.npmjs.com/package/@cnwenf/occ)。
@@ -80,7 +80,7 @@ Glob、Grep（默认启用）；TaskCreate/Get/Update/List（Todo v2）、EnterW
 
 ```bash
 bun install
-bun run dev          # 从源码运行；版本号显示 2.1.204 即正常
+bun run dev          # 从源码运行；版本号显示 2.1.270（dev polyfill；build 用 pkg.version 覆盖）即正常
 bun run build        # 产物：dist/cli.js（~26MB，5300+ 模块，单文件 bundle）
 bun test             # 测试套件
 bun run lint         # Biome lint（禁用格式化以避免大 diff）

package/bin/occ.cjs

@@ -15,25 +15,47 @@
  *   `bun <package>/dist/cli.js <args…>`. If no Bun is available it prints
  *   a clear install instruction instead of a cryptic env error.
  *
- * BUN RESOLUTION ORDER
+ * WHY PROBE-RUN + LIBC DETECTION
+ *   `bun` is an OCC *optional* dependency. npm does NOT link an optional
+ *   dependency's `bin` into the global bin dir, so `bun` is NOT on PATH
+ *   after `npm i -g @cnwenf/occ` — the shim must rely on the bundled
+ *   `@oven/bun-*` platform binaries (and the `bun` meta-package's
+ *   postinstall-selected `bin/bun.exe`).
+ *
+ *   The `bun` meta-package ships platform binaries for BOTH glibc and musl
+ *   variants without an `os.libc` filter, so npm installs ALL of them on
+ *   every Linux host. A musl ELF's interpreter is `/lib/ld-musl-x86_64.so.1`,
+ *   which does NOT exist on a glibc host — spawning it fails with ENOENT.
+ *   Older versions of this shim picked the first `existsSync`-true candidate
+ *   in a fixed order (glibc, musl, …); when the glibc tarball's `bin/bun`
+ *   was absent (the `bun` postinstall moves it) the musl binary was picked
+ *   next, `existsSync`'d true, then ENOENT'd at spawn — `occ` died with
+ *   `failed to launch bun`.
+ *
+ *   The fix mirrors the official `@anthropic-ai/claude-code` cli-wrapper:
+ *   detect the host's libc (`process.report` glibcVersionRuntime), restrict
+ *   candidates to the MATCHING libc only, and PROBE-RUN each candidate
+ *   (`<bin> --version`) before committing — a present-but-unrunnable binary
+ *   is skipped, not fatal.
+ *
+ * BUN RESOLUTION ORDER (each existing candidate is probe-run; first success wins)
  *   1. `$BUN_PATH` env (power-user override)
- *   2. `bun` on PATH (the common case: `bun` is an OCC optionalDependency
- *      whose postinstall puts the real binary on PATH)
+ *   2. `bun` on PATH (explicit PATH walk — npm does not link it for optional deps)
  *   3. `~/.bun/bin/bun` (user installed Bun via bun.sh installer)
- *   4. The optional-dep platform binary directly, e.g.
- *      `@oven/bun-linux-x64/bin/bun`. This path works EVEN WHEN npm was
- *      run with `--ignore-scripts` (so `bun`'s postinstall never ran and
- *      `bun` is not on PATH), because the `@oven/bun-*` packages ship the
- *      real ELF/Mach-O/PE binary in the tarball — no postinstall needed.
- *   5. The `bun` meta-package's `bin/bun.exe` (real only if its
- *      postinstall ran; redundant with #2 but harmless).
+ *   4. The `bun` meta-package's `bin/bun.exe` — the meta postinstall already
+ *      detected the host and placed the correct (arch + libc) binary here.
+ *   5. The `@oven/bun-<platform>-<arch>[-musl][-baseline]` platform binary
+ *      matching the host's libc, non-baseline (AVX2) before baseline. This
+ *      path works EVEN WHEN npm was run with `--ignore-scripts` (so the
+ *      `bun` postinstall never ran and #4 is absent), because the `@oven-*`
+ *      tarballs ship the real ELF/Mach-O/PE binary — no postinstall needed.
  *
- *   If none resolve, print install instructions and exit 1.
+ *   If none probe-run successfully, print install instructions and exit 1.
  */
 'use strict'
 
 const { existsSync } = require('node:fs')
-const { spawn } = require('node:child_process')
+const { spawn, spawnSync } = require('node:child_process')
 const path = require('node:path')
 const os = require('node:os')
 
@@ -51,41 +73,105 @@ if (!existsSync(cliJs)) {
 }
 
 /**
- * The @oven/bun-<platform>-<arch> package(s) that match the current
- * process, ordered by preference (glibc before musl, non-baseline before
- * baseline). Each ships the real Bun binary at `bin/bun` (or `bin/bun.exe`
- * on Windows). List gleaned from the `bun` npm meta-package's
- * optionalDependencies (@oven 1.3.14).
+ * Detect a musl-libc Linux host the same way the official
+ * `@anthropic-ai/claude-code` cli-wrapper does: Node's runtime report sets
+ * `header.glibcVersionRuntime` only when running against glibc. Its absence
+ * (on Alpine/musl, or when the report is unavailable) means musl.
+ */
+function detectMusl() {
+  if (process.platform !== 'linux') return false
+  try {
+    const report =
+      typeof process.report?.getReport === 'function'
+        ? process.report.getReport()
+        : null
+    if (!report) return false
+    return report.header?.glibcVersionRuntime === undefined
+  } catch (_) {
+    return false
+  }
+}
+
+/**
+ * The @oven/bun-<platform>-<arch> packages that match the CURRENT process,
+ * restricted to the host's libc (glibc OR musl, never both) and ordered
+ * non-baseline (AVX2, faster) before baseline (compatible fallback). Each
+ * ships the real Bun binary at `bin/bun` (or `bin/bun.exe` on Windows).
+ * List gleaned from the `bun` npm meta-package's optionalDependencies
+ * (@oven 1.3.14).
+ *
+ * Restricting to one libc is the whole point: a glibc host must never
+ * consider a musl ELF (its `/lib/ld-musl-x86_64.so.1` interpreter is absent
+ * → ENOENT at spawn), and vice versa.
  */
 function platformPackages() {
   const p = process.platform
   const a = process.arch
+  const musl = detectMusl()
   if (p === 'darwin' && a === 'x64') return ['@oven/bun-darwin-x64']
   if (p === 'darwin' && a === 'arm64') return ['@oven/bun-darwin-aarch64']
-  if (p === 'linux' && a === 'x64')
-    return [
-      '@oven/bun-linux-x64',
-      '@oven/bun-linux-x64-musl',
-      '@oven/bun-linux-x64-baseline',
-      '@oven/bun-linux-x64-musl-baseline',
-    ]
-  if (p === 'linux' && a === 'arm64')
-    return ['@oven/bun-linux-aarch64', '@oven/bun-linux-aarch64-musl']
+  if (p === 'linux' && a === 'x64') {
+    if (musl)
+      return ['@oven/bun-linux-x64-musl', '@oven/bun-linux-x64-musl-baseline']
+    return ['@oven/bun-linux-x64', '@oven/bun-linux-x64-baseline']
+  }
+  if (p === 'linux' && a === 'arm64') {
+    if (musl) return ['@oven/bun-linux-aarch64-musl']
+    return ['@oven/bun-linux-aarch64']
+  }
   if (p === 'win32' && a === 'x64') return ['@oven/bun-windows-x64']
   if (p === 'win32' && a === 'arm64') return ['@oven/bun-windows-aarch64']
   return []
 }
 
-/** Resolve a path inside a dependency package, or null if not installed. */
-function resolveDepFile(spec) {
+/**
+ * Resolve a dependency PACKAGE DIRECTORY via its package.json (always
+ * resolvable — `package.json` is exempt from `exports` restrictions), then
+ * join the in-package relative path. This is the reliable way to locate a
+ * bundled binary: `require.resolve('pkg/bin/bun')` fails when the binary
+ * file is absent (postinstall hasn't created/moved it yet) or when the
+ * package restricts subpath access — both false negatives that broke the
+ * old shim. Returns null if the package or file is not present.
+ */
+function resolveDepFile(spec, relPath) {
   try {
-    return require.resolve(spec)
+    // Resolve the package DIRECTORY via its package.json (always resolvable
+    // — `package.json` is exempt from `exports` restrictions). Resolving the
+    // bare package name would fail for packages with no `main`/`exports`
+    // (e.g. the `bun` meta-package and the `@oven/bun-*` binaries).
+    const pkgJson = require.resolve(spec + '/package.json')
+    const file = path.join(path.dirname(pkgJson), relPath)
+    return existsSync(file) ? file : null
   } catch (_) {
     return null
   }
 }
 
-/** Ordered candidate Bun binaries. Bare 'bun' (PATH) validated by findOnPath. */
+/**
+ * Walk PATH for an executable named `name` (with Windows PATHEXT extensions
+ * on win32). Returns the absolute path if found, else null.
+ */
+function findOnPath(name) {
+  const pathVar = process.env.PATH || process.env.Path
+  if (!pathVar) return null
+  const sep = isWin ? ';' : ':'
+  const exts = isWin
+    ? (process.env.PATHEXT ? process.env.PATHEXT.split(';') : ['.exe', '.cmd', '.bat', ''])
+    : ['']
+  for (const dir of pathVar.split(sep)) {
+    if (!dir) continue
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext)
+      if (existsSync(candidate)) return candidate
+    }
+  }
+  return null
+}
+
+/**
+ * Ordered candidate Bun binaries. Each entry is an absolute path. Existence
+ * is checked at build time; runnability is probe-verified later in selectBun().
+ */
 function bunCandidates() {
   const cands = []
 
@@ -94,111 +180,121 @@ function bunCandidates() {
     cands.push(process.env.BUN_PATH)
   }
 
-  // 2. `bun` on PATH — verified by findBun via an explicit PATH walk. If not
-  //    present, fall through to #3/#4/#5 instead of returning a phantom
-  //    candidate that would ENOENT at spawn and skip the better fallbacks.
-  cands.push('bun')
+  // 2. `bun` on PATH — verified via an explicit PATH walk (npm does not
+  //    link an optional dependency's bin globally, so this only matches when
+  //    the user installed Bun separately).
+  const pathBun = findOnPath(bunExeName)
+  if (pathBun) cands.push(pathBun)
 
   // 3. ~/.bun/bin/bun (bun.sh installer default location).
   const homeBun = path.join(os.homedir(), '.bun', 'bin', bunExeName)
   if (existsSync(homeBun)) cands.push(homeBun)
 
-  // 4. Optional-dep platform binary (robust under --ignore-scripts).
+  // 4. `bun` meta-package bin — postinstall-selected for this host. The
+  //    meta package always names it `bin/bun.exe` regardless of platform.
+  const metaBin = resolveDepFile('bun', path.posix.join('bin', 'bun.exe'))
+  if (metaBin) cands.push(metaBin)
+
+  // 5. Optional-dep platform binary (robust under --ignore-scripts); one
+  //    libc only, non-baseline before baseline.
   for (const pkg of platformPackages()) {
-    const resolved = resolveDepFile(path.posix.join(pkg, 'bin', bunExeName))
-    if (resolved && existsSync(resolved)) cands.push(resolved)
+    const resolved = resolveDepFile(pkg, path.posix.join('bin', bunExeName))
+    if (resolved) cands.push(resolved)
   }
 
-  // 5. `bun` meta-package bin (real only if its postinstall ran).
-  const metaBin = resolveDepFile('bun/bin/bun.exe')
-  if (metaBin && existsSync(metaBin)) cands.push(metaBin)
-
   return cands
 }
 
 /**
- * Walk PATH for an executable named `name` (with Windows PATHEXT extensions
- * on win32). Returns the absolute path if found, else null. This is what
- * `bun:bundle`'s bare-candidate check needs — without it, returning 'bun'
- * unconditionally makes the shim skip #3/#4/#5 fallbacks when bun isn't on
- * PATH (the exact scenario the shim exists to handle).
+ * Probe-run a candidate Bun binary: `spawnSync(<bin>, ['--version'])` with a
+ * short timeout. Returns true only if the binary actually launched AND
+ * exited 0 — i.e. it is executable on THIS host. This is the signal that
+ * `existsSync` cannot give: a present musl ELF on a glibc host `existsSync`'s
+ * true but ENOENTs at spawn (missing `/lib/ld-musl-x86_64.so.1`); a
+ * non-baseline binary needing a newer glibc ditto. Probing lets the shim
+ * fall through to the next candidate instead of dying.
  */
-function findOnPath(name) {
-  const pathVar = process.env.PATH || process.env.Path
-  if (!pathVar) return null
-  const sep = isWin ? ';' : ':'
-  const exts = isWin
-    ? (process.env.PATHEXT ? process.env.PATHEXT.split(';') : ['.exe', '.cmd', '.bat', ''])
-    : ['']
-  for (const dir of pathVar.split(sep)) {
-    if (!dir) continue
-    for (const ext of exts) {
-      const candidate = path.join(dir, name + ext)
-      if (existsSync(candidate)) return candidate
-    }
+function probeRuns(bin) {
+  try {
+    const r = spawnSync(bin, ['--version'], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 5000,
+      windowsHide: true,
+      shell: false,
+    })
+    if (r.error) return false
+    return r.status === 0
+  } catch (_) {
+    return false
   }
-  return null
 }
 
-function findBun() {
+function selectBun() {
   const tried = []
   for (const c of bunCandidates()) {
     if (!c) continue
     tried.push(c)
-    // Bare 'bun' is only usable if it's actually on PATH. Verify now so the
-    // #3/#4/#5 fallbacks get a chance when it isn't — otherwise we'd return
-    // a phantom 'bun' that ENOENTs at spawn, defeating the shim's purpose.
-    if (c === 'bun') {
-      if (findOnPath(bunExeName)) return { bin: c, viaShell: isWin, tried }
-      continue
-    }
-    if (existsSync(c)) return { bin: c, viaShell: false, tried }
+    if (probeRuns(c)) return { bin: c, viaShell: false, tried }
   }
   return { bin: null, viaShell: false, tried }
 }
 
-const { bin: bunBin, viaShell, tried } = findBun()
-
-if (!bunBin) {
-  console.error('')
-  console.error('occ: Bun runtime not found.')
-  console.error('')
-  console.error('OCC requires Bun (>= 1.3.11) to run. Install it with one of:')
-  console.error('  npm i -g bun')
-  console.error('  curl -fsSL https://bun.sh/install | bash')
-  console.error('Then run `occ` again.')
-  console.error('')
-  console.error('Tried: ' + tried.join(', '))
-  process.exit(1)
-}
-
-const child = spawn(bunBin, [cliJs, ...process.argv.slice(2)], {
-  stdio: 'inherit',
-  env: process.env,
-  shell: viaShell,
-  windowsHide: false,
-})
+/**
+ * Locate a working Bun binary and spawn `bun dist/cli.js <args…>`, inheriting
+ * stdio so the child REPL/pipe owns the terminal. Exits the process with the
+ * child's code/signal, or 1 on a launch error / no-binary-found.
+ *
+ * Hoisted into a function (and only invoked when this file is the entry point)
+ * so the pure helpers above can be unit-tested via `require('./bin/occ.cjs')`
+ * without the shim auto-spawning a child on import.
+ */
+function launch() {
+  const { bin: bunBin, viaShell, tried } = selectBun()
 
-child.on('error', (err) => {
-  if (err && err.code === 'ENOENT' && bunBin === 'bun') {
+  if (!bunBin) {
+    console.error('')
+    console.error('occ: Bun runtime not found.')
     console.error('')
-    console.error('occ: `bun` is on PATH but not executable. Reinstall Bun:')
+    console.error('OCC requires Bun (>= 1.3.11) to run. Install it with one of:')
     console.error('  npm i -g bun')
     console.error('  curl -fsSL https://bun.sh/install | bash')
+    console.error('Then run `occ` again.')
+    console.error('')
+    console.error('Tried: ' + (tried.length ? tried.join(', ') : '(no bundled bun found)'))
     process.exit(1)
   }
-  console.error('occ: failed to launch bun:', err ? err.message : 'unknown error')
-  process.exit(1)
-})
-
-child.on('exit', (code, signal) => {
-  if (signal) {
-    try {
-      process.kill(process.pid, signal)
-    } catch (_) {
-      process.exit(1)
+
+  const child = spawn(bunBin, [cliJs, ...process.argv.slice(2)], {
+    stdio: 'inherit',
+    env: process.env,
+    shell: viaShell,
+    windowsHide: false,
+  })
+
+  child.on('error', (err) => {
+    console.error('occ: failed to launch bun:', err ? err.message : 'unknown error')
+    console.error('  binary: ' + bunBin)
+    process.exit(1)
+  })
+
+  child.on('exit', (code, signal) => {
+    if (signal) {
+      try {
+        process.kill(process.pid, signal)
+      } catch (_) {
+        process.exit(1)
+      }
+      return
     }
-    return
-  }
-  process.exit(code ?? 0)
-})
+    process.exit(code ?? 0)
+  })
+}
+
+// Pure helpers exported for unit tests (see test/launcher.test.ts). When this
+// file is the entry point (`occ` invoked on the CLI), run the launcher; when
+// it is merely required, do nothing — no spawn side effect on import.
+module.exports = { detectMusl, platformPackages, resolveDepFile, findOnPath, bunCandidates, probeRuns, selectBun }
+
+if (require.main === module) {
+  launch()
+}