@co0ontty/wand 4.83.1 → 4.84.0

package/dist/core-status-cli.d.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+export interface CoreStatus {
+    hasActiveTurns: boolean;
+    activeTurnCount: number;
+    activeTurnIds?: string[];
+}
+export declare function checkCoreStatus(configPath: string): Promise<void>;
+/** Zero means wait indefinitely. A timeout/error NEVER runs the stop command. */
+export declare function waitForCoreTurnsComplete(configPath: string, timeoutSeconds?: number, stopCommand?: string[], allowStopped?: boolean): Promise<number>;

package/dist/core-status-cli.js

@@ -0,0 +1,280 @@
+#!/usr/bin/env node
+/**
+ * Query the running web process, never the CLI process's in-memory tracker.
+ * Kept dependency-free so start.sh can run this source with Node's TS support
+ * before replacing an older global package (including --restart/--no-build).
+ */
+import { spawn } from "node:child_process";
+import { X509Certificate } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import net from "node:net";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+function parseStatus(value) {
+    const status = value;
+    if (!status || typeof status.hasActiveTurns !== "boolean"
+        || typeof status.activeTurnCount !== "number" || !Number.isSafeInteger(status.activeTurnCount)
+        || status.activeTurnCount < 0 || status.hasActiveTurns !== (status.activeTurnCount > 0)) {
+        throw new Error("Core 状态响应无效，不能确认重启安全。");
+    }
+    return status;
+}
+class CoreControl {
+    socket = null;
+    buffer = "";
+    nextId = 0;
+    pending = new Map();
+    disconnected = false;
+    configPath;
+    constructor(configPath) { this.configPath = configPath; }
+    async connect(timeoutMs = 5000) {
+        const socket = net.createConnection(path.join(path.dirname(this.configPath), "wand.sock"));
+        this.socket = socket;
+        socket.setEncoding("utf8");
+        socket.on("data", (chunk) => {
+            this.buffer += chunk;
+            if (this.buffer.length > 64 * 1024) {
+                socket.destroy(new Error("Core IPC 响应过大。"));
+                return;
+            }
+            let at;
+            while ((at = this.buffer.indexOf("\n")) >= 0) {
+                const line = this.buffer.slice(0, at);
+                this.buffer = this.buffer.slice(at + 1);
+                let response;
+                try {
+                    response = JSON.parse(line);
+                }
+                catch {
+                    socket.destroy(new Error("Core IPC 响应无效。"));
+                    return;
+                }
+                const pending = response && this.pending.get(response.id ?? "");
+                if (!pending)
+                    continue;
+                this.pending.delete(response.id);
+                if (response.ok === true)
+                    pending.resolve(response.data);
+                else
+                    pending.reject(new Error(response.error ?? "Core IPC 请求失败。"));
+            }
+        });
+        const fail = (error) => {
+            this.disconnected = true;
+            for (const pending of this.pending.values())
+                pending.reject(error);
+            this.pending.clear();
+        };
+        socket.on("error", fail);
+        socket.on("close", () => fail(new Error("Core 控制连接已断开，已取消重启。")));
+        await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => { socket.destroy(); reject(new Error("连接 Core 控制端超时。")); }, timeoutMs);
+            socket.once("connect", () => { clearTimeout(timer); resolve(); });
+            socket.once("error", (error) => { clearTimeout(timer); reject(error); });
+        });
+    }
+    request(cmd, timeoutMs = 5000) {
+        if (this.disconnected || !this.socket)
+            return Promise.reject(new Error("Core 控制连接不可用。"));
+        const id = String(++this.nextId);
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error("读取 Core 状态超时，已取消重启。"));
+            }, timeoutMs);
+            this.pending.set(id, {
+                resolve: (data) => { clearTimeout(timer); resolve(data); },
+                reject: (error) => { clearTimeout(timer); reject(error); },
+            });
+            this.socket.write(JSON.stringify({ id, cmd }) + "\n");
+        }).then(parseStatus);
+    }
+    assertConnected() {
+        if (this.disconnected)
+            throw new Error("Core 控制连接已断开，已取消重启。");
+    }
+    close() { this.socket?.destroy(); }
+}
+/** Compatibility with the first core-enabled server, which has no core IPC commands. */
+async function readLegacyStatus(configPath, timeoutMs = 5000) {
+    const config = JSON.parse(readFileSync(configPath, "utf8"));
+    if (!Number.isInteger(config.port) || config.port < 1 || config.port > 65535) {
+        throw new Error("配置端口无效，不能读取运行中 Core 状态。");
+    }
+    // Trust the configured local certificate, not arbitrary self-signed peers.
+    // Pinning also works with a user certificate whose SAN is not 127.0.0.1.
+    const ca = config.https ? readFileSync(config.tls?.certPath ?? path.join(path.dirname(configPath), "server.crt")) : undefined;
+    const fingerprint = ca ? new X509Certificate(ca).fingerprint256 : undefined;
+    const request = config.https ? httpsRequest : httpRequest;
+    const result = await new Promise((resolve, reject) => {
+        const req = request({ hostname: config.host === "::1" ? "::1" : "127.0.0.1",
+            port: config.port, path: "/api/core-status", method: "GET",
+            ...(ca ? { ca, allowPartialTrustChain: true,
+                checkServerIdentity: (_hostname, cert) => cert.fingerprint256 === fingerprint ? undefined : new Error("Core 服务证书与本机配置不一致。") } : {}) }, (res) => {
+            let body = "";
+            res.setEncoding("utf8");
+            res.on("data", (chunk) => {
+                body += chunk;
+                if (body.length > 64 * 1024)
+                    req.destroy(new Error("Core 状态响应过大。"));
+            });
+            res.on("error", reject);
+            res.on("end", () => {
+                if (res.statusCode !== 200) {
+                    reject(new Error(`读取运行中 Core 状态失败 (HTTP ${res.statusCode})。`));
+                    return;
+                }
+                try {
+                    resolve(JSON.parse(body));
+                }
+                catch {
+                    reject(new Error("Core 状态不是 JSON，已取消重启。"));
+                }
+            });
+        });
+        const timer = setTimeout(() => req.destroy(new Error("读取运行中 Core 状态超时。")), timeoutMs);
+        req.on("close", () => clearTimeout(timer));
+        req.on("error", reject);
+        req.end();
+    });
+    return parseStatus(result);
+}
+async function openControl(configPath, deadline = Infinity) {
+    const control = new CoreControl(configPath);
+    const budget = () => {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            throw new Error("等待 Core 回合超时，服务未停止，已取消重启。");
+        return Math.min(5000, remaining);
+    };
+    try {
+        await control.connect(budget());
+        await control.request("core-status", budget());
+        return control;
+    }
+    catch (error) {
+        control.close();
+        // Older protocols and missing/stale sockets can use the real loopback probe.
+        // Permission errors and malformed responses must fail closed.
+        if (error instanceof Error && /^unknown cmd: core-status$/.test(error.message))
+            return null;
+        if (["ENOENT", "ECONNREFUSED"].includes(error?.code ?? ""))
+            return null;
+        throw error;
+    }
+}
+export async function checkCoreStatus(configPath) {
+    const control = await openControl(configPath);
+    try {
+        const status = control ? await control.request("core-status") : await readLegacyStatus(configPath);
+        console.log(JSON.stringify({ status: status.hasActiveTurns ? "busy" : "idle", ...status }));
+        process.exitCode = status.hasActiveTurns ? 1 : 0;
+    }
+    finally {
+        control?.close();
+    }
+}
+/** Zero means wait indefinitely. A timeout/error NEVER runs the stop command. */
+export async function waitForCoreTurnsComplete(configPath, timeoutSeconds = 0, stopCommand, allowStopped = false) {
+    if (!Number.isFinite(timeoutSeconds) || timeoutSeconds < 0)
+        throw new Error("--timeout 必须是非负秒数（0 表示一直等待）。");
+    if (stopCommand && !stopCommand.length)
+        throw new Error("缺少等待完成后要执行的停止命令。");
+    const deadline = timeoutSeconds > 0 ? Date.now() + timeoutSeconds * 1000 : Infinity;
+    const budget = () => {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            throw new Error("等待 Core 回合超时，服务未停止，已取消重启。");
+        return Math.min(5000, remaining);
+    };
+    const control = await openControl(configPath, deadline);
+    try {
+        const readStatus = async (budget = 5000) => {
+            if (control)
+                return control.request("core-status", budget);
+            try {
+                return await readLegacyStatus(configPath, budget);
+            }
+            catch (error) {
+                // Only the service manager's confirmed stopped state plus no live PID
+                // AND a refused local listener may treat an absent service as idle.
+                if (!allowStopped || error?.code !== "ECONNREFUSED")
+                    throw error;
+                try {
+                    const info = JSON.parse(readFileSync(path.join(path.dirname(configPath), "wand.pid"), "utf8"));
+                    if (!Number.isInteger(info.pid) || info.pid <= 0)
+                        throw new Error("Core pidfile 无效。");
+                    try {
+                        process.kill(info.pid, 0);
+                        throw new Error("Core 主进程仍在运行，不能跳过检查。");
+                    }
+                    catch (pidError) {
+                        if (pidError?.code !== "ESRCH")
+                            throw pidError;
+                    }
+                }
+                catch (pidError) {
+                    if (pidError?.code !== "ENOENT")
+                        throw pidError;
+                }
+                return { hasActiveTurns: false, activeTurnCount: 0 };
+            }
+        };
+        let status = control && stopCommand ? await control.request("core-drain", budget()) : await readStatus(budget());
+        if (!control && stopCommand)
+            console.error("[wand] 旧服务尚不支持重启排空；正在读取真实服务状态。首次升级等待期间请勿启动新任务。");
+        let lastCount = -1;
+        while (status.hasActiveTurns) {
+            if (status.activeTurnCount !== lastCount) {
+                console.log(`[wand] ${status.activeTurnCount} 个原生 Core 回合仍在运行，等待完成后再停止服务…`);
+                lastCount = status.activeTurnCount;
+            }
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                throw new Error("等待 Core 回合超时，服务未停止，已取消重启。");
+            await new Promise((resolve) => setTimeout(resolve, Math.min(1000, remaining)));
+            status = await readStatus(budget());
+        }
+        // The draining connection stays open until the stop command finishes.
+        // New Pi inputs are persisted in the queue, not started in the check/stop gap.
+        control?.assertConnected();
+        console.log("[wand] 原生 Core 回合已全部完成，可以停止服务。");
+        if (!stopCommand)
+            return 0;
+        return await new Promise((resolve, reject) => {
+            const child = spawn(stopCommand[0], stopCommand.slice(1), { stdio: "inherit" });
+            child.once("error", reject);
+            // A dedicated code distinguishes action failure from a broken/missing
+            // guard executable (which may itself exit 1 before our catch can run).
+            child.once("exit", (code, signal) => resolve(code === 0 && !signal ? 0 : 3));
+        });
+    }
+    finally {
+        control?.close();
+    }
+}
+// start.sh uses the current source rather than the possibly broken installed CLI.
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+    const args = process.argv.slice(2);
+    const separator = args.indexOf("--");
+    const options = separator < 0 ? args : args.slice(0, separator);
+    const flag = (name) => {
+        const index = options.indexOf(name);
+        return index < 0 ? undefined : options[index + 1];
+    };
+    const config = flag("-c") ?? flag("--config");
+    try {
+        if (!config)
+            throw new Error("缺少 -c 配置路径。");
+        if (options.includes("--status"))
+            await checkCoreStatus(path.resolve(config));
+        else
+            process.exitCode = await waitForCoreTurnsComplete(path.resolve(config), Number(flag("--timeout") ?? 0), separator < 0 ? undefined : args.slice(separator + 1), options.includes("--allow-stopped"));
+    }
+    catch (error) {
+        console.error(`[wand] ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 2;
+    }
+}

package/dist/core-turn-tracker.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Tracks active Core engine turns to prevent service restart during execution.
+ */
+export declare class CoreTurnTracker {
+    private static activeTurns;
+    static startTurn(sessionId: string): symbol;
+    static endTurn(token: symbol): void;
+    static hasActiveTurns(): boolean;
+    static getActiveTurnCount(): number;
+    static getActiveTurnIds(): string[];
+    static waitForAllTurnsComplete(timeoutMs?: number): Promise<void>;
+}

package/dist/core-turn-tracker.js

@@ -0,0 +1,36 @@
+/**
+ * Tracks active Core engine turns to prevent service restart during execution.
+ */
+export class CoreTurnTracker {
+    // Each execution owns its token: a late cancelled turn cannot untrack its
+    // replacement in the same session.
+    static activeTurns = new Map();
+    static startTurn(sessionId) {
+        const token = Symbol(sessionId);
+        this.activeTurns.set(token, sessionId);
+        return token;
+    }
+    static endTurn(token) {
+        this.activeTurns.delete(token);
+    }
+    static hasActiveTurns() {
+        return this.activeTurns.size > 0;
+    }
+    static getActiveTurnCount() {
+        return this.activeTurns.size;
+    }
+    static getActiveTurnIds() {
+        return [...new Set(this.activeTurns.values())];
+    }
+    static async waitForAllTurnsComplete(timeoutMs = 0) {
+        const startTime = Date.now();
+        while (this.hasActiveTurns()) {
+            if (timeoutMs > 0 && Date.now() - startTime >= timeoutMs) {
+                throw new Error(`Timeout waiting for Core turns to complete. ` +
+                    `${this.activeTurns.size} turns still active: ${this.getActiveTurnIds().join(", ")}`);
+            }
+            // Wait 1 second before checking again
+            await new Promise(resolve => setTimeout(resolve, 1000));
+        }
+    }
+}

package/dist/decision-runner.d.ts

@@ -1,8 +1,14 @@
+import type { DecisionResult } from "./decision-types.js";
 import type { WandStorage } from "./storage.js";
 import type { StructuredRunnerAdapter } from "./structured-runner.js";
 export interface DecisionRuntimeAccess {
     url: string;
     caPath?: string;
+    /**
+     * 进程内调用入口（core 会话用）：同一个 server 进程直接调决策服务，
+     * 不经过 env token / HTTP 回环。CLI runner 仍然走 `url` + 环境变量。
+     */
+    evaluate?: (value: unknown, caller: string, signal?: AbortSignal) => Promise<DecisionResult>;
 }
 export declare const DECISION_ENV_KEYS: readonly ["WAND_DECISION_URL", "WAND_DECISION_TOKEN", "WAND_DECISION_CA", "WAND_DECISION_NODE", "WAND_DECISION_CLI"];
 /** Adds only a revocable inference capability. Never edits base prompts, DTOs, or tool permissions. */

package/dist/decision-runner.js

@@ -8,8 +8,10 @@ export function withDecisionAccess(runner, storage, runtime) {
             for (const key of DECISION_ENV_KEYS)
                 delete env[key];
             const access = runtime();
-            if (!access)
+            // Pi 会话可以逐次关闭本轮决策能力：关掉就不注入凭据，也不加运行时提示。
+            if (!access || (context.session.provider === "pi" && context.session.piSettings?.localDecision === false)) {
                 return runner.start({ ...context, env }, observer);
+            }
             const token = storage.issueDecisionAccess(context.session.id);
             const cleanup = () => { try {
                 storage.revokeDecisionAccess(token);

package/dist/decision-tool.d.ts

@@ -8,6 +8,8 @@ interface DecisionToolLike {
         kind?: string;
     };
 }
+/** core 会话里决策是进程内工具（`src/core-runner.ts`）；CLI 会话是命令行调用。 */
+export declare const DECISION_TOOL_NAME = "decision_evaluate";
 export declare function isDecisionToolCall(block: DecisionToolLike): boolean;
 /**
  * 卡头副标题：结论优先（窄屏先被省略的是被判定内容，不是答案），再题数、再要点的有界拼接；

package/dist/decision-tool.js

@@ -1,3 +1,5 @@
+/** core 会话里决策是进程内工具（`src/core-runner.ts`）；CLI 会话是命令行调用。 */
+export const DECISION_TOOL_NAME = "decision_evaluate";
 /** Small shell lexer: quoted examples are one argument, not executable commands; heredoc bodies are data. */
 function commandWords(source) {
     const commands = [];
@@ -83,6 +85,9 @@ export function isDecisionToolCall(block) {
     if (block.type && block.type !== "tool_use")
         return false;
     const operation = (block.name ?? "").toLowerCase().split(/__|[/.]/).at(-1) ?? "";
+    // core（进程内 harness）把决策暴露成真工具，不是命令行调用。
+    if (operation === DECISION_TOOL_NAME)
+        return true;
     if (!["bash", "exec", "exec_command", "command_execution", "shell_command", "terminal", "run_command", "run_shell_command"].includes(operation))
         return false;
     const input = block.input ?? {};
@@ -205,6 +210,22 @@ function decisionCommands(input) {
 }
 /** 请求侧要点：被判定内容摘要 + 题数 + 模式。请求体读不出时整块省略。 */
 function requestDigest(input) {
+    if (!input)
+        return null;
+    // core 进程内工具：questions 直接是字段（JSON 字符串），state 也在同一层。
+    if (typeof input.questions === "string") {
+        try {
+            const parsed = JSON.parse(input.questions);
+            const digest = bodyDigest({ state: input.state, questions: parsed });
+            if (digest)
+                return digest;
+        }
+        catch {
+            // questions 坏了不影响从 state 给出被判定内容摘要。
+        }
+        const stateOnly = statePreview(input.state);
+        return Object.keys(stateOnly).length ? stateOnly : null;
+    }
     for (const source of decisionCommands(input)) {
         for (const candidate of jsonCandidates(source)) {
             let value;
@@ -214,32 +235,38 @@ function requestDigest(input) {
             catch {
                 continue;
             }
-            if (!isRecord(value) || !isRecord(value.questions))
-                continue;
-            const questions = Object.entries(value.questions);
-            if (!questions.length)
-                continue;
-            const types = [];
-            let recognized = 0;
-            for (const [, raw] of questions) {
-                if (!isRecord(raw))
-                    continue;
-                if (raw.type === "choice" || raw.type === "score" || raw.type === "noul") {
-                    types.push(raw.type);
-                    recognized++;
-                }
-            }
-            if (!recognized)
-                continue;
-            return {
-                mode: modeOf(types),
-                questions: questions.length,
-                ...statePreview(value.state),
-            };
+            const digest = bodyDigest(value);
+            if (digest)
+                return digest;
         }
     }
     return null;
 }
+/** 决策请求体 → 摘要要点；读不出题目就返回 null（宁可没有摘要也不猜）。 */
+function bodyDigest(value) {
+    if (!isRecord(value) || !isRecord(value.questions))
+        return null;
+    const questions = Object.entries(value.questions);
+    if (!questions.length)
+        return null;
+    const types = [];
+    let recognized = 0;
+    for (const [, raw] of questions) {
+        if (!isRecord(raw))
+            continue;
+        if (raw.type === "choice" || raw.type === "score" || raw.type === "noul") {
+            types.push(raw.type);
+            recognized++;
+        }
+    }
+    if (!recognized)
+        return null;
+    return {
+        mode: modeOf(types),
+        questions: questions.length,
+        ...statePreview(value.state),
+    };
+}
 function statePreview(state) {
     if (typeof state === "string") {
         const preview = collapse(state, PREVIEW_MAX);

package/dist/env-utils.d.ts

@@ -1,15 +1,19 @@
-/** 子进程 env：显式传入 env 优先，否则按 inheritEnv 生成白名单环境。 */
+/** 子进程 env：显式传入 env 优先，否则按 inheritEnv 生成环境。 */
 export declare function resolveChildEnv(options: {
     env?: NodeJS.ProcessEnv;
     inheritEnv?: boolean;
 }): NodeJS.ProcessEnv;
+export declare function setLoginShellEnv(env: NodeJS.ProcessEnv | undefined): void;
+export declare function getLoginShellEnv(): NodeJS.ProcessEnv | undefined;
+/** 读取系统默认环境里的单个变量：进程 env 优先，其次登录 shell。 */
+export declare function systemEnvValue(name: string): string | undefined;
 /** 是否以 root 身份运行（uid 或 euid 为 0）。供 PTY runner 与 structured runner 共用。 */
 export declare function isRunningAsRoot(): boolean;
 /**
  * 根据 inheritEnv 配置组装子进程的环境变量。
  *
- * - inheritEnv=true（默认）：继承父进程全部 env，再合并 extras 覆盖。
- * - inheritEnv=false：仅保留 MINIMAL_ENV_KEYS 中存在的字段，再合并 extras 覆盖。
+ * - inheritEnv=true（默认）：复用系统默认环境（登录 shell + 当前进程 env），再合并 extras 覆盖。
+ * - inheritEnv=false：在同一底座上只保留 MINIMAL_ENV_KEYS 中存在的字段，再合并 extras 覆盖。
  *
  * extras 中的 undefined 字段会被剔除（spawn 不允许 env 值为 undefined）。
  */

package/dist/env-utils.js

@@ -19,10 +19,34 @@ const MINIMAL_ENV_KEYS = [
     "TEMP",
     "PWD",
 ];
-/** 子进程 env：显式传入 env 优先，否则按 inheritEnv 生成白名单环境。 */
+/** 子进程 env：显式传入 env 优先，否则按 inheritEnv 生成环境。 */
 export function resolveChildEnv(options) {
     return options.env ?? buildChildEnv(options.inheritEnv !== false);
 }
+/**
+ * 用户默认登录 shell 的完整环境（由 src/path-repair.ts 的 `-lic` 探测捕获）。
+ * 服务被 launchd / systemd 拉起时进程 env 是安装那一刻的快照，shell rc 里导出的
+ * 变量（工具链、代理、模型相关的配置）都不在其中；这里把它按系统默认环境补回来。
+ */
+let loginShellEnv;
+export function setLoginShellEnv(env) {
+    loginShellEnv = env && Object.keys(env).length > 0 ? env : undefined;
+}
+export function getLoginShellEnv() {
+    return loginShellEnv;
+}
+/**
+ * 子进程环境的底座：系统默认登录 shell 环境 + 当前进程环境。
+ * 两者冲突时进程环境优先（本轮显式启动值最大），shell 环境只填补进程里缺失的变量；
+ * PATH 的顺序由 deepRepairRuntimePath() 单独按登录 shell 重排回 process.env。
+ */
+function systemEnv() {
+    return loginShellEnv ? { ...loginShellEnv, ...process.env } : { ...process.env };
+}
+/** 读取系统默认环境里的单个变量：进程 env 优先，其次登录 shell。 */
+export function systemEnvValue(name) {
+    return process.env[name] ?? loginShellEnv?.[name];
+}
 /** 是否以 root 身份运行（uid 或 euid 为 0）。供 PTY runner 与 structured runner 共用。 */
 export function isRunningAsRoot() {
     return process.getuid?.() === 0 || process.geteuid?.() === 0;
@@ -30,19 +54,20 @@ export function isRunningAsRoot() {
 /**
  * 根据 inheritEnv 配置组装子进程的环境变量。
  *
- * - inheritEnv=true（默认）：继承父进程全部 env，再合并 extras 覆盖。
- * - inheritEnv=false：仅保留 MINIMAL_ENV_KEYS 中存在的字段，再合并 extras 覆盖。
+ * - inheritEnv=true（默认）：复用系统默认环境（登录 shell + 当前进程 env），再合并 extras 覆盖。
+ * - inheritEnv=false：在同一底座上只保留 MINIMAL_ENV_KEYS 中存在的字段，再合并 extras 覆盖。
  *
  * extras 中的 undefined 字段会被剔除（spawn 不允许 env 值为 undefined）。
  */
 export function buildChildEnv(inheritEnv, extras = {}) {
+    const source = systemEnv();
     const base = {};
     if (inheritEnv) {
-        Object.assign(base, process.env);
+        Object.assign(base, source);
     }
     else {
         for (const key of MINIMAL_ENV_KEYS) {
-            const v = process.env[key];
+            const v = source[key];
             if (typeof v === "string")
                 base[key] = v;
         }

package/dist/git-quick-commit.d.ts

@@ -19,6 +19,7 @@ interface QuickCommitOptions extends CommitInputOptions, QuickCommitAiOptions {
     submodule?: boolean;
 }
 export interface QuickCommitAiOptions {
+    modelGroups?: import("./model-groups.js").ModelGroup[];
     provider?: SessionProvider;
     model?: string | null;
     thinkingEffort?: SessionSnapshot["thinkingEffort"];
@@ -27,6 +28,10 @@ export interface QuickCommitAiOptions {
     opsPersona?: string;
     /** CLI 降级链（按顺序）；未设置时只用 provider/model 这一次调用。 */
     cliCandidates?: import("./types.js").AiCliCandidate[];
+    /** 系统应用必须经员工渠道；没有可用 CLI 候选时直接失败，不退回默认 provider。 */
+    employeeChannelOnly?: boolean;
+    /** 整条候选链的时间上限；默认 CLI_CHAIN_BUDGET_MS。第一条消息里的调用要短得多。 */
+    budgetMs?: number;
 }
 export declare class QuickCommitError extends Error {
     readonly code: QuickCommitErrorCode;

package/dist/git-quick-commit.js

@@ -775,13 +775,19 @@ function singleCandidate(opts) {
  * 仅用于一次性文本生成；执行工具的任务不能使用这条无条件重试路径。
  */
 async function callCliCandidates(request, cwd, language, opts, parseOutput) {
-    const chain = opts.cliCandidates?.length ? opts.cliCandidates : [singleCandidate(opts)];
+    const { resolveModelGroupModels } = await import("./model-groups.js");
+    const chain = (opts.cliCandidates?.length ? opts.cliCandidates : [singleCandidate(opts)])
+        .flatMap((candidate) => resolveModelGroupModels(opts.modelGroups, candidate.provider, candidate.model, { preferDefault: !candidate.model || candidate.model === "default" })
+        .map((model) => ({ ...candidate, model: model || undefined })));
+    if (opts.employeeChannelOnly && !opts.cliCandidates?.length) {
+        throw new QuickCommitError("系统员工没有可用的 CLI 候选，已跳过 SDK 候选。", "AI_FALLBACK_FAILED");
+    }
+    const deadline = Date.now() + Math.max(1, opts.budgetMs ?? CLI_CHAIN_BUDGET_MS);
     if (chain.length === 1) {
-        return parseOutput(await callCliAiText(request, cwd, language, candidateOptions(opts, chain[0])));
+        return parseOutput(await callCliAiText(request, cwd, language, { ...candidateOptions(opts, chain[0]), deadline }));
     }
     const installed = chain.filter((candidate) => providerCliInstalled(candidate.provider));
     const attempts = installed.length ? installed : chain;
-    const deadline = Date.now() + CLI_CHAIN_BUDGET_MS;
     const errors = [];
     for (const candidate of attempts) {
         if (Date.now() >= deadline) {

package/dist/git-utils.js

@@ -1,4 +1,5 @@
 import { execFile, execFileSync, } from "node:child_process";
+import { buildChildEnv } from "./env-utils.js";
 const DEFAULT_GIT_TIMEOUT_MS = 30_000;
 const DEFAULT_GIT_MAX_BUFFER = 10 * 1024 * 1024;
 function positiveInteger(value, fallback) {
@@ -8,7 +9,7 @@ function positiveInteger(value, fallback) {
 }
 function gitEnvironment(opts) {
     return {
-        ...process.env,
+        ...buildChildEnv(true),
         ...(opts.env ?? {}),
         GIT_TERMINAL_PROMPT: "0",
         GIT_ASKPASS: "true",