@whobot/cli 2.0.2 → 2.0.4

package/bin/install.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import {
   accessSync,
@@ -226,7 +226,38 @@ export async function runPostinstall(env) {
   }
 }
 
-export function whichCommand(name, env, ignoreRealpath = "") {
+// npxLauncherIgnore names the command entries of the npx copy at root, which
+// npx puts first on PATH. POSIX npm links them to run.mjs; Windows npm writes
+// cmd-shim files into the same node_modules/.bin, so a realpath alone cannot
+// recognize them. Outside an npx copy nothing is ignored.
+export function npxLauncherIgnore(root) {
+  if (!isNpxPath(root)) {
+    return {};
+  }
+  const ignore = { realpath: realpathSync(path.join(root, "bin", "run.mjs")) };
+  let modules = root;
+  while (path.basename(modules) !== "node_modules") {
+    const parent = path.dirname(modules);
+    if (parent === modules) {
+      return ignore;
+    }
+    modules = parent;
+  }
+  const binDir = path.join(modules, ".bin");
+  try {
+    ignore.binDir = realpathSync(binDir);
+  } catch {
+    // No .bin directory: no PATH entry can be inside it.
+    ignore.binDir = binDir;
+  }
+  return ignore;
+}
+
+function samePath(a, b) {
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+
+export function whichCommand(name, env, ignore = {}) {
   const pathEnv = env.PATH || env.Path || "";
   const exts = process.platform === "win32" ? [".cmd", ".exe", ".bat", ""] : [""];
   for (const dir of pathEnv.split(path.delimiter)) {
@@ -237,7 +268,8 @@ export function whichCommand(name, env, ignoreRealpath = "") {
       const candidate = path.join(dir, name + ext);
       try {
         accessSync(candidate, constants.X_OK);
-        if (ignoreRealpath && realpathSync(candidate) === ignoreRealpath) continue;
+        if (ignore.realpath && realpathSync(candidate) === ignore.realpath) continue;
+        if (ignore.binDir && samePath(realpathSync(dir), ignore.binDir)) continue;
         return candidate;
       } catch {
         // try next
@@ -625,7 +657,7 @@ async function repairAndVerifyNative(native, version, env) {
   }
 }
 
-export async function verifyInstalledCLI(tools, npmEnv, prefix, version, env, ignoreLauncher = "") {
+export async function verifyInstalledCLI(tools, npmEnv, prefix, version, env, ignoreLauncher = {}) {
   const registered = readGlobalPackageVersion(tools, npmEnv);
   if (registered !== version) {
     throw new InstallerError(`npm registered version ${registered} does not match ${version}`, "UPDATE_VERIFY_FAILED");
@@ -678,9 +710,14 @@ export async function runExplicitInstall(argv, env) {
   const staging = await fs.mkdtemp(path.join(os.tmpdir(), "whobot-install-preflight-"));
   const stagedNative = path.join(staging, path.basename(packageNativeBinary(prefix)));
   const updateArgs = ["update", "--yes", "--target-version", pkg.version];
+  const installId = randomUUID();
+  const reportAttrs = { installId, version: pkg.version, channel: bakedChannel(), previousVersion: registered };
+  let staged = false;
   let prepared;
   try {
     await ensureNativeBinary(env, { force: true, dest: stagedNative, version: pkg.version });
+    staged = true;
+    reportViaNative(stagedNative, "install_started", "ok", { attrs: reportAttrs }, env);
     verifyNpmEntryVersion(stagedNative, pkg.version, env);
     if (resetLocal) runResetLocal(stagedNative, env);
     runInstallPhase(stagedNative, ["update", "check-install", "--previous-binary", packageNativeBinary(prefix)], env, "binding", registered);
@@ -691,21 +728,47 @@ export async function runExplicitInstall(argv, env) {
       npmInstallGlobalFrom(tools, pkgRoot, npmEnv);
     }
     // Ignore this npx cache launcher only, not other stale host PATH entries.
-    const ignoreLauncher = isNpxPath(pkgRoot) ? realpathSync(path.join(pkgRoot, "bin", "run.mjs")) : "";
+    const ignoreLauncher = npxLauncherIgnore(pkgRoot);
     const installed = await verifyInstalledCLI(tools, npmEnv, prefix, pkg.version, env, ignoreLauncher);
     runInstallPhase(installed.native, updateArgs, env, "verify", registered);
     await prepared.discard();
+    reportViaNative(installed.native, "install_succeeded", "ok", { attrs: reportAttrs }, env);
     if (resetLocal) logStderr("本机登录已清理，请重新登录。");
     logStderr(`CLI 软件安装已完成；请更新 Skill 至对应渠道最新版，重载宿主或新建任务后重新预检。v2 后续更新请运行 ${COMMAND} update，并执行确认卡中的命令。`);
     return entry;
   } catch (err) {
     if (prepared) await prepared.restore();
+    // Before the program is staged there is nothing to report with.
+    if (staged) {
+      reportViaNative(stagedNative, "install_failed", "failed", { errorCode: failureCode(err) || "INSTALL_FAILED", attrs: reportAttrs }, env);
+    }
     throw err;
   } finally {
     await fs.rm(staging, { recursive: true, force: true });
   }
 }
 
+// reportViaNative records an install/update fact for analytics (ADR-0020)
+// through the native program's hidden reporter, which carries its compiled API
+// address, client id and AI host. Its outcome is ignored and it is bounded, so
+// it never fails or stalls an install or update.
+const REPORT_TIMEOUT_MS = 5000;
+export function reportViaNative(native, name, result, { errorCode = "", attrs = {} } = {}, env = process.env) {
+  const args = ["telemetry", "report", "--name", name, "--result", result];
+  if (errorCode) args.push("--error-code", errorCode);
+  for (const [key, value] of Object.entries(attrs)) {
+    if (value !== undefined && value !== null && value !== "") args.push("--attr", `${key}=${value}`);
+  }
+  const reportEnv = { ...env };
+  delete reportEnv.WHOBOT_UPDATE_PHASE;
+  spawnSync(native, args, { env: reportEnv, stdio: "ignore", timeout: REPORT_TIMEOUT_MS, windowsHide: true });
+}
+
+function failureCode(err) {
+  const code = err && typeof err.code === "string" ? err.code : "";
+  return /^[A-Z][A-Z0-9_]{0,63}$/.test(code) ? code : "";
+}
+
 function runInstallPhase(native, args, env, phase, previous, wantVersion = pkg.version) {
   const result = spawnSync(native, args, {
     encoding: "utf8",
@@ -856,10 +919,12 @@ export async function runWhobot(argv, env) {
   }
   await recoverNativeBackup(nativeBinaryPath(pkgRoot));
   if (isUpdateApply(argv)) {
+    const updateAttrs = { updateId: randomUUID(), fromVersion: pkg.version };
+    let started = false;
     try {
       rejectExternalChannel(env);
       parseChannelAndForward(argv);
-      confirmedTargetVersion(argv);
+      updateAttrs.toVersion = confirmedTargetVersion(argv);
       let currentNative = nativeBinaryPath(pkgRoot);
       let preflightDir;
       let pre;
@@ -902,7 +967,10 @@ export async function runWhobot(argv, env) {
       if (!preflight.ok || preflight.data?.installedVersion !== pkg.version || preflight.next?.action !== "done") {
         throw new InstallerError("更新前检查没有确认可以替换程序", "UPDATE_VERIFY_FAILED");
       }
+      reportViaNative(nativeBinaryPath(pkgRoot), "update_started", "ok", { attrs: updateAttrs }, env);
+      started = true;
       const updated = await runExplicitUpdate(argv, env);
+      reportViaNative(updated.native, "update_succeeded", "replaced", { attrs: { ...updateAttrs, fromVersion: updated.previous, toVersion: updated.installedVersion } }, env);
       spawnNative(
         updated.native,
         updated.forwarded,
@@ -916,6 +984,9 @@ export async function runWhobot(argv, env) {
       );
     } catch (err) {
       const code = err?.code === "CHANNEL_INVALID" ? "CHANNEL_INVALID" : "UPDATE_VERIFY_FAILED";
+      if (started) {
+        reportViaNative(nativeBinaryPath(pkgRoot), "update_failed", "failed", { errorCode: failureCode(err) || code, attrs: updateAttrs }, env);
+      }
       const message = err && err.message ? err.message : String(err);
       writeJSONFailure(code, message);
       process.stderr.write(`${message}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whobot/cli",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Whobot CLI: npm-managed JS launcher that runs the in-package Go binary.",
   "type": "module",
   "bin": {