@qoniai/qoni 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -8,6 +8,42 @@ compatible fixes.
 
 ## Unreleased
 
+### Breaking
+
+- Rename the public SDK constructor from its previous longer name to `Qoni`.
+  The previous constructor export has been removed.
+
+### Changed
+
+- The default Qoni host is now `https://dashboard.qoni.ai` (was
+  `https://anima.eazo.ai/dashboard`). Callers that never passed an explicit `host`
+  reach a different control plane after upgrading. Note that the new default has
+  no `/dashboard` path segment — pass `host` explicitly for private or local
+  deployments.
+- Service resolution no longer fetches the runtime-config document to answer a
+  Qoni base URL. It never read the result for that service, but it did require
+  the fetch to succeed, so an unavailable discovery endpoint failed every Qoni
+  call. Discovery is still fetched lazily for `genauth` / `gumem` / `webagent`,
+  which do read it.
+- Signed Qoni requests always stay on the configured control-plane host. Service
+  resolution no longer follows `eakBaseUrl` from the runtime config for the
+  Qoni service, because AK/SK signatures are scoped to that endpoint and a
+  cross-origin runtime URL can strip `Authorization` on redirect or disclose
+  credentials to an unintended origin.
+- `unstableRequest()` without a `token` now signs the call with AK/SK instead of
+  sending it unauthenticated. Caller-supplied `authorization`, `content-type`,
+  `date` and `x-authing-*` headers are dropped so they cannot corrupt the
+  signature.
+
+### Fixed
+
+- The previous default host was unreachable for SDK API calls. A client created
+  as `new Qoni({ accessKey, secretKey })` now reaches the live control plane.
+- Abandoning an event iterator no longer leaks its connection. Leaving
+  `for await (const event of run.events())` through a `break` now cancels the
+  response body before releasing the reader lock, returning the socket to the
+  connection pool.
+
 ### Added
 
 - `RunHandle.events()` and `wait()` accept `onWireEvent` and `onReconnect`
@@ -23,8 +59,8 @@ compatible fixes.
 ### Breaking
 
 - Rename the package from its previous product name to `@qoniai/qoni`.
-- Rename the primary constructor and all branded exports to `QoniAgentKit`,
-  `Qoni`, and the corresponding `Qoni*` types, constants, and error classes.
+- Rename the primary constructor and all branded exports to `Qoni` and the
+  corresponding `Qoni*` types, constants, and error classes.
 - Rename the product namespace to `client.qoni` and environment variables to
   `QONI_*`. The current server wire contract remains unchanged: SDK gateway
   routes stay under `/api/v3/eak/*`, delegation tokens retain
@@ -207,7 +243,7 @@ Initial public release of `@qoniai/qoni`.
 
 ### What ships
 
-- Server-side `QoniAgentKit` constructor for Qoni Agent delegation and product
+- Server-side `Qoni` constructor for Qoni Agent delegation and product
   runtime calls.
 - Runtime service discovery from the Qoni Console gateway through
   `GET /api/v3/eak/runtime-config`.
@@ -226,7 +262,7 @@ Initial public release of `@qoniai/qoni`.
 
 ### Compatibility
 
-- `Qoni` remains available as a short constructor alias.
+- `Qoni` is the public SDK constructor.
 - `delegateAgent` and `completeDelegateAgent` remain available as deprecated
   aliases for older integrations, but new integrations should use
   `delegateToken`.

package/README.md

@@ -19,7 +19,7 @@ Agents that perform real work need more than a backend API key. They need a user
 
 Qoni keeps that model small:
 
-- One SDK entry: `new QoniAgentKit({ accessKey, secretKey })`.
+- One SDK entry: `new Qoni({ accessKey, secretKey })`.
 - One discovery path: `host` can override the Qoni Console/SDK gateway for private or local deployments, and the SDK reads downstream runtime URLs from `/api/v3/eak/runtime-config`.
 - One delegation entry: call `delegateToken`; silent mode returns `data.token`, while interactive mode returns an authorization URL and later completes on your server.
 - One management path: call `genauth.users.*`, and the SDK exchanges AK/SK for a GenAuth management token before calling GenAuth v3 users APIs.
@@ -59,8 +59,8 @@ The package ships both ESM and CommonJS builds with TypeScript types, so either
 import style works:
 
 ```ts
-import { QoniAgentKit } from "@qoniai/qoni";        // ESM / TypeScript
-const { QoniAgentKit } = require("@qoniai/qoni");    // CommonJS
+import { Qoni } from "@qoniai/qoni";        // ESM / TypeScript
+const { Qoni } = require("@qoniai/qoni");    // CommonJS
 ```
 
 ## AI Skill
@@ -87,9 +87,9 @@ Start with a server-side SDK instance. AK/SK stays on your trusted server for bo
 
 ```ts
 import fs from "node:fs";
-import { QoniAgentKit } from "@qoniai/qoni";
+import { Qoni } from "@qoniai/qoni";
 
-const qoni = new QoniAgentKit({
+const qoni = new Qoni({
   accessKey: process.env.QONI_ACCESS_KEY!,
   secretKey: process.env.QONI_SECRET_KEY!,
 });
@@ -472,7 +472,7 @@ const sameMonitor = await qoni.track.attach(monitor.id, { token });
 ### GenAuth User Context and Management
 
 ```ts
-const client = new QoniAgentKit({
+const client = new Qoni({
   accessKey: process.env.QONI_ACCESS_KEY!,
   secretKey: process.env.QONI_SECRET_KEY!,
 });
@@ -499,7 +499,7 @@ const created = await client.genauth.users.create({
 ### Client
 
 ```ts
-const qoni = new QoniAgentKit({
+const qoni = new Qoni({
   accessKey: process.env.QONI_ACCESS_KEY!,
   secretKey: process.env.QONI_SECRET_KEY!,
   timeoutMs: 30_000,
@@ -524,12 +524,6 @@ const qoni = new QoniAgentKit({
 > `wait()` timeout does not stop the run; it keeps executing server-side and
 > you can `attach()` to it again.
 
-`Qoni` is also exported as a short alias:
-
-```ts
-import { Qoni, QoniAgentKit } from "@qoniai/qoni";
-```
-
 ### Namespaces
 
 | Namespace | Methods |

package/README.zh-CN.md

@@ -14,7 +14,7 @@ AK/SK 必须只保存在可信服务端，不能下发到浏览器、移动端
 
 Qoni 把 Agent 授权模型收敛成几个稳定边界：
 
-- 一个 SDK 入口：`new QoniAgentKit({ accessKey, secretKey })`。
+- 一个 SDK 入口：`new Qoni({ accessKey, secretKey })`。
 - 一条发现路径：`host` 可在私有化或本地部署中覆盖 Qoni Console/SDK 网关，SDK 通过 `/api/v3/eak/runtime-config` 获取 GenAuth、GUMem、WebAgent 等运行时地址。
 - 一个授权入口：调用 `delegateToken`；silent 模式直接返回 `data.token`，interactive 模式返回授权 URL，之后由业务服务端完成兑换。
 - 一条管理面路径：调用 `genauth.users.*`，SDK 会先用 AK/SK 换取 GenAuth management token，再调用 GenAuth v3 users API。
@@ -52,8 +52,8 @@ yarn add @qoniai/qoni
 包同时发布 ESM 和 CommonJS 两套构建（都带 TypeScript 类型），两种引入方式都可用：
 
 ```ts
-import { QoniAgentKit } from "@qoniai/qoni";        // ESM / TypeScript
-const { QoniAgentKit } = require("@qoniai/qoni");    // CommonJS
+import { Qoni } from "@qoniai/qoni";        // ESM / TypeScript
+const { Qoni } = require("@qoniai/qoni");    // CommonJS
 ```
 
 ## AI Skill
@@ -80,9 +80,9 @@ npm 包中包含 `skills/` 目录，但推荐仍使用上面的 GitHub 仓库安
 
 ```ts
 import fs from "node:fs";
-import { QoniAgentKit } from "@qoniai/qoni";
+import { Qoni } from "@qoniai/qoni";
 
-const qoni = new QoniAgentKit({
+const qoni = new Qoni({
   accessKey: process.env.QONI_ACCESS_KEY!,
   secretKey: process.env.QONI_SECRET_KEY!,
 });
@@ -442,7 +442,7 @@ const sameMonitor = await qoni.track.attach(monitor.id, { token });
 ### GenAuth 用户上下文与用户管理
 
 ```ts
-const client = new QoniAgentKit({
+const client = new Qoni({
   accessKey: process.env.QONI_ACCESS_KEY!,
   secretKey: process.env.QONI_SECRET_KEY!,
 });
@@ -469,7 +469,7 @@ const created = await client.genauth.users.create({
 ### Client
 
 ```ts
-const qoni = new QoniAgentKit({
+const qoni = new Qoni({
   accessKey: process.env.QONI_ACCESS_KEY!,
   secretKey: process.env.QONI_SECRET_KEY!,
   timeoutMs: 30_000,
@@ -486,12 +486,6 @@ const qoni = new QoniAgentKit({
 
 > **`timeoutMs` 不会限制长任务。** 它只作用于单次一次性 HTTP 请求（委托、`status()`、单个 POST）。事件流（`events()` / `wait()`）**不受它约束**——流的响应头一到，这个单次计时器就被清掉了,所以一个跑一小时的 Deep Research 在默认 30s 客户端超时下也能正常流式。要限制等待时长用 `wait({ timeoutMs })`；不传则 `wait()` 一直等到终态。`wait()` 超时**不会停止 run**——它在服务端继续跑，可以再 `attach()` 回去。
 
-兼容导出：
-
-```ts
-import { Qoni, QoniAgentKit } from "@qoniai/qoni";
-```
-
 ### 命名空间
 
 | 命名空间 | 方法 |

package/dist/index.cjs

@@ -25,8 +25,7 @@ __export(index_exports, {
   InteractionStatuses: () => InteractionStatuses,
   InteractionTypes: () => InteractionTypes,
   MonitorHandle: () => MonitorHandle,
-  Qoni: () => QoniAgentKit,
-  QoniAgentKit: () => QoniAgentKit,
+  Qoni: () => Qoni,
   QoniAuthError: () => QoniAuthError,
   QoniDelegationRequiredError: () => QoniDelegationRequiredError,
   QoniError: () => QoniError,
@@ -1958,8 +1957,8 @@ function renameKeys5(value, mapping) {
 }
 
 // src/client.ts
-var DEFAULT_QONI_HOST = "https://anima.eazo.ai/dashboard";
-var QoniAgentKit = class {
+var DEFAULT_QONI_HOST = "https://dashboard.qoni.ai";
+var Qoni = class {
   constructor(options) {
     this.options = options;
     const accessKey = options.accessKey ?? options.accessKeyId;
@@ -2317,7 +2316,11 @@ var QoniAgentKit = class {
       const finalEvent = parseSSEEvent(buffer);
       if (finalEvent) yield finalEvent;
     } finally {
-      reader.releaseLock();
+      await reader.cancel().catch(() => void 0);
+      try {
+        reader.releaseLock();
+      } catch {
+      }
     }
   }
   async fetchWithTimeout(input, init, signal, opts) {
@@ -2351,8 +2354,8 @@ var QoniAgentKit = class {
   async baseUrlFor(service) {
     const explicit = this.explicitBaseUrlFor(service);
     if (explicit) return explicit;
-    const runtime = await this.runtimeConfig();
     if (service === "qoni") return this.host;
+    const runtime = await this.runtimeConfig();
     const hostOrigin = originBaseUrl(this.host);
     if (service === "genauth") return runtime.genauthBaseUrl ?? hostOrigin;
     if (service === "gumem") return runtime.gumemBaseUrl ?? hostOrigin;
@@ -2894,7 +2897,6 @@ function errorName(error) {
   InteractionTypes,
   MonitorHandle,
   Qoni,
-  QoniAgentKit,
   QoniAuthError,
   QoniDelegationRequiredError,
   QoniError,