autowonder 0.2.138 → 0.2.139

package/README.md

@@ -6,16 +6,16 @@ AutoWonder 本地 agent runtime。安装后启动 daemon，持续轮询本地 as
 
 ```bash
 # Qoder CLI（模型使用 provider model ID；Context Window 使用固定档位）
-npx -y autowonder@0.2.138 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model qmodel_latest --reasoning-effort medium --context-window 260000
+npx -y autowonder@0.2.139 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model qmodel_latest --reasoning-effort medium --context-window 260000
 
 # Qoder CLI CN
-npx -y autowonder@0.2.138 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qodercn
+npx -y autowonder@0.2.139 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qodercn
 
 # Claude Code
-npx -y autowonder@0.2.138 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider claude
+npx -y autowonder@0.2.139 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider claude
 
 # Codex CLI
-npx -y autowonder@0.2.138 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider codex --model gpt-5.5 --reasoning-effort medium
+npx -y autowonder@0.2.139 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider codex --model gpt-5.5 --reasoning-effort medium
 ```
 
 `connect` 会安装当前 npm 包内置的 daemon，并使用页面生成的 WebSocket endpoint、Token 和执行器 ID 建立连接。选择 Qoder 时需要 Node.js 20+；runtime 会在缺少 `qodercli` 时自动通过 npm 安装，并在尚未登录时打开 Qoder 浏览器登录。Claude Code 和 Codex CLI 仍需提前安装并登录。runtime 会继承当前用户的 HOME、环境变量和 CLI 登录状态。
@@ -62,7 +62,7 @@ mv "$queue/.assignment.tmp" "$queue/assignment.json"
 也可以直接提交到本地 API：
 
 ```bash
-npx -y autowonder@0.2.138 dispatch ./assignment.json
+npx -y autowonder@0.2.139 dispatch ./assignment.json
 ```
 
 ## 上传工单附件
@@ -70,7 +70,7 @@ npx -y autowonder@0.2.138 dispatch ./assignment.json
 把本地需求/设计文档直接上传到工单，避免在会话里传递大文件：
 
 ```bash
-npx -y autowonder@0.2.138 workitem upload --server-url <autowonder-server-url> --workitem-id <id> --file <filepath-1> --file <filepath-2> --json
+npx -y autowonder@0.2.139 workitem upload --server-url <autowonder-server-url> --workitem-id <id> --file <filepath-1> --file <filepath-2> --json
 ```
 
 上传令牌通过 MCP 工具 `autowonder.workitem_cli_upload_token` 签发，经 `--token` 或 `AUTOWONDER_UPLOAD_TOKEN` 环境变量传入。`--file` 可重复指定多个文件；`--json` 输出机器可读结果。失败时按错误类型返回不同退出码（401→3、403→4、404→5、409→6、413→7、其他 4xx→8、网络/重定向→9）。
@@ -78,8 +78,8 @@ npx -y autowonder@0.2.138 workitem upload --server-url <autowonder-server-url> -
 ## 管理 daemon
 
 ```bash
-npx -y autowonder@0.2.138 status
-npx -y autowonder@0.2.138 stop
+npx -y autowonder@0.2.139 status
+npx -y autowonder@0.2.139 stop
 ```
 
 默认 API 是 `http://127.0.0.1:34989`，日志位于 `~/.autowonder/daemon.log`。npm 包不包含任何 agent、MCP 或服务端凭证。
@@ -87,7 +87,7 @@ npx -y autowonder@0.2.138 stop
 ## 调试
 
 ```bash
-npx -y autowonder@0.2.138 connect ... --debug
+npx -y autowonder@0.2.139 connect ... --debug
 ```
 
 `--debug` 会让 CLI 以 `AUTOWONDER_DEBUG=1` 启动 daemon，把完整的 daemon 与 agent 活动（runtime 事件流、provider 事件解码、重试退避与会话门等待、空闲时的阻塞点）同时输出到控制台和会话调试日志。调试日志不做脱敏，仅用于本机排障；不传 `--debug` 时该环境变量不会注入。

package/bin/qoder-bootstrap.js

@@ -25,6 +25,7 @@ const QODER_FAMILY_PROFILES = {
     defaultConfigRootName: ".qoder",
     managedBinName: "qodercli",
     windowsShimName: "qodercli.cmd",
+    windowsInstallDirNames: ["Qoder CLI", "QoderCLI"],
     unixCandidateRelPaths: [
       [".local", "bin", "qodercli"],
       [".qoder", "bin", "qodercli", "qodercli"],
@@ -41,6 +42,7 @@ const QODER_FAMILY_PROFILES = {
     defaultConfigRootName: ".qoder-cn",
     managedBinName: "qodercn",
     windowsShimName: "qodercn.cmd",
+    windowsInstallDirNames: ["Qoder CN CLI", "QoderCNCLI"],
     unixCandidateRelPaths: [[".local", "bin", "qodercn"]],
   },
 };
@@ -63,10 +65,127 @@ function isQoderFamilyProvider(provider) {
   return provider === "qoder" || provider === "qodercn";
 }
 
+// Quotes one argument for cmd.exe. Paths containing spaces must stay a single
+// token when a .cmd shim is launched through ComSpec.
+function quoteWindowsArg(arg) {
+  if (arg && !/[\s"]/.test(arg)) return arg;
+  return `"${String(arg).replace(/"/g, '\\"')}"`;
+}
+
 function spawnQoderSync(executable, args, options = {}) {
   // npm exposes package binaries as .cmd shims on Windows. CreateProcess
-  // cannot execute those shims directly, so let ComSpec resolve them.
-  return spawnSync(executable, args, { ...options, shell: IS_WIN32 });
+  // cannot execute those shims directly, but shell:true would join the
+  // executable and its arguments with bare spaces and shred any path that
+  // contains a space (e.g. "...\Qoder CN CLI\..."). Launch ComSpec ourselves
+  // with an explicitly quoted command line instead; everything else runs as a
+  // plain argument array with no shell involved.
+  if (IS_WIN32 && /\.(cmd|bat)$/i.test(executable)) {
+    const comspec = process.env.ComSpec || "cmd.exe";
+    const command = [quoteWindowsArg(executable), ...args.map(quoteWindowsArg)].join(" ");
+    return spawnSync(comspec, ["/d", "/s", "/c", command], options);
+  }
+  return spawnSync(executable, args, { ...options, shell: false });
+}
+
+// Roots that hold user-level installers on Windows. Kept env-driven so the
+// probe logic stays testable off Windows.
+function windowsInstallRoots(env) {
+  const roots = [];
+  if (env.LOCALAPPDATA) roots.push(path.join(env.LOCALAPPDATA, "Programs"));
+  if (env.PROGRAMFILES) roots.push(env.PROGRAMFILES);
+  if (env["PROGRAMFILES(X86)"]) roots.push(env["PROGRAMFILES(X86)"]);
+  if (env.USERPROFILE) roots.push(env.USERPROFILE);
+  return roots;
+}
+
+// Matches a directory inside `parent` against the wanted names
+// case-insensitively, also accepting the space-free spelling, so casing or
+// spacing drift cannot hide an existing install.
+function matchInstallDir(parent, wantedNames, probed) {
+  let entries;
+  try { entries = fs.readdirSync(parent); } catch { return ""; }
+  const wanted = new Set(wantedNames.map((name) => name.toLowerCase()));
+  for (const entry of entries) {
+    const lower = entry.toLowerCase();
+    if (!wanted.has(lower) && !wanted.has(lower.replace(/\s+/g, ""))) continue;
+    const candidate = path.join(parent, entry);
+    probed.push(candidate);
+    try {
+      if (fs.statSync(candidate).isDirectory()) return candidate;
+    } catch {}
+  }
+  return "";
+}
+
+// Relative locations of the CLI executable inside an install directory.
+function windowsExeRelPaths(profile) {
+  const exe = profile.executable;
+  return [
+    `${exe}.exe`,
+    exe,
+    `${exe}.cmd`,
+    path.join("bin", `${exe}.exe`),
+    path.join("bin", exe),
+    path.join("bin", `${exe}.cmd`),
+  ];
+}
+
+// Probes the known install directories with the filesystem only; PATH entries
+// and install paths are always treated as whole strings, never split on
+// spaces. Returns the executable plus every location that was probed so a
+// miss can be explained to the operator.
+function findInInstallDirs(provider, env = process.env) {
+  const profile = QODER_FAMILY_PROFILES[provider];
+  const probed = [];
+  const roots = windowsInstallRoots(env);
+  roots.push(path.join(os.homedir(), profile.defaultConfigRootName));
+  for (const root of roots) {
+    const dir = matchInstallDir(root, profile.windowsInstallDirNames, probed);
+    if (!dir) {
+      for (const name of profile.windowsInstallDirNames) probed.push(path.join(root, name));
+      continue;
+    }
+    for (const rel of windowsExeRelPaths(profile)) {
+      const candidate = path.join(dir, rel);
+      probed.push(candidate);
+      try {
+        fs.accessSync(candidate, fs.constants.F_OK);
+        if (!fs.statSync(candidate).isDirectory()) return { found: candidate, probed };
+      } catch {}
+    }
+  }
+  return { found: "", probed };
+}
+
+// Everything a "not installed" report must show: the install candidates, the
+// managed shim and any PATH entry that mentions the CLI family.
+function qoderSearchSummary(provider) {
+  const profile = QODER_FAMILY_PROFILES[provider];
+  const paths = qoderPaths(profile);
+  const probed = [];
+  for (const root of windowsInstallRoots(process.env)) {
+    for (const name of profile.windowsInstallDirNames) probed.push(path.join(root, name));
+  }
+  probed.push(path.join(os.homedir(), profile.defaultConfigRootName));
+  probed.push(path.join(paths.managedDir, "node_modules", ".bin", profile.windowsShimName));
+  for (const rel of profile.unixCandidateRelPaths) probed.push(path.join(os.homedir(), ...rel));
+  const needle = "qoder";
+  const pathHints = (process.env.PATH || "").split(path.delimiter)
+    .filter((entry) => entry && entry.toLowerCase().includes(needle));
+  return { probed, pathHints };
+}
+
+function reportQoderNotFound(provider) {
+  const profile = QODER_FAMILY_PROFILES[provider];
+  const { probed, pathHints } = qoderSearchSummary(provider);
+  error(`${profile.displayName} was not found. Probed locations (PATH entries were scanned as whole strings):`);
+  probed.forEach((location) => error(`  - ${location}`));
+  if (pathHints.length) {
+    error("PATH entries mentioning qoder:");
+    pathHints.forEach((entry) => error(`  - ${entry}`));
+  } else {
+    error(`no PATH entry mentions "${profile.executable}".`);
+  }
 }
 
 function findQoderExecutable(provider) {
@@ -85,6 +204,8 @@ function findQoderExecutable(provider) {
   const onPath = findOnPath(profile.executable);
   if (onPath) return onPath;
   if (IS_WIN32) {
+    const { found } = findInInstallDirs(provider);
+    if (found) return found;
     const shim = path.join(paths.managedDir, "node_modules", ".bin", profile.windowsShimName);
     try { fs.accessSync(shim, fs.constants.F_OK); return shim; } catch {}
     return "";
@@ -137,6 +258,10 @@ function qoderBinaryVersion(executable) {
     stdio: ["ignore", "pipe", "pipe"],
     timeout: 20000,
   });
+  // "missing" means the file itself is absent; "unknown" means the file is
+  // there but produced no version, so the two failure classes never collapse
+  // into one misleading answer.
+  if (result.error && result.error.code === "ENOENT") return "missing";
   // stdout wins so a warning on stderr cannot masquerade as the version and
   // make the identity comparison see a change that did not happen.
   const firstLine = (stream) => (stream || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean);
@@ -385,6 +510,9 @@ function reportQoderDiagnostics(profile, info) {
   const { executable, version, configRoot, rootSource, verdict, identityChanged, previous } = info;
   error(`--- ${profile.displayName} bootstrap diagnostics ---`);
   error(`executable      : ${executable}`);
+  if (/\s/.test(executable)) {
+    error("note            : the executable path contains spaces; it is launched as an argument array / quoted command line");
+  }
   error(`version         : ${version}`);
   error(`config root     : ${configRoot} (${rootSource})`);
   error(`verdict         : ${verdict.state} - ${verdict.reason || "no further detail"}`);
@@ -456,6 +584,7 @@ async function ensureQoderReady(provider, options = {}) {
   // reinstall the package that just landed.
   let refreshed = false;
   if (!executable) {
+    reportQoderNotFound(provider);
     executable = installQoderCLI(provider);
     refreshed = true;
   }
@@ -564,13 +693,17 @@ async function ensureQoderReady(provider, options = {}) {
 module.exports = {
   QODER_FAMILY_PROFILES,
   ensureQoderReady,
+  findInInstallDirs,
   findQoderExecutable,
   inspectQoderHealth,
   isQoderFamilyProvider,
   qoderBinaryVersion,
   qoderPaths,
+  qoderSearchSummary,
+  quoteWindowsArg,
   readQoderState,
   reportQoderDiagnostics,
+  reportQoderNotFound,
   selectQoderConfigRoot,
   spawnQoderSync,
   waitForQoderLogin,

package/bin/shared.js

@@ -1,6 +1,5 @@
 "use strict";
 
-const { spawnSync } = require("child_process");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
@@ -25,11 +24,24 @@ function resolveUserPath(value) {
   return path.resolve(value);
 }
 
+// Scans PATH entry by entry with the filesystem instead of shelling out to
+// where/which: each entry stays a single string, so directories containing
+// spaces can never be split or misquoted by a shell.
 function findOnPath(name) {
-  const finder = process.platform === "win32" ? "where" : "which";
-  const found = spawnSync(finder, [name], { encoding: "utf8", timeout: 3000 });
-  if (found.status !== 0) return "";
-  return (found.stdout || "").split(/\r?\n/).map((value) => value.trim()).find(Boolean) || "";
+  const isWin32 = process.platform === "win32";
+  const suffixes = isWin32 ? ["", ".exe", ".cmd", ".bat", ".com"] : [""];
+  const entries = (process.env.PATH || process.env.Path || "").split(path.delimiter);
+  for (const entry of entries) {
+    if (!entry) continue;
+    for (const suffix of suffixes) {
+      const candidate = path.join(entry, name + suffix);
+      try {
+        fs.accessSync(candidate, isWin32 ? fs.constants.F_OK : fs.constants.X_OK);
+        if (!fs.statSync(candidate).isDirectory()) return candidate;
+      } catch {}
+    }
+  }
+  return "";
 }
 
 module.exports = { ensureDir, error, findOnPath, log, resolveUserPath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autowonder",
-  "version": "0.2.138",
+  "version": "0.2.139",
   "description": "AutoWonder local runtime — execute AI agent dispatch packages on your machine",
   "bin": {
     "autowonder": "bin/cli.js"