autowonder 0.2.25 → 0.2.26

package/README.md

@@ -6,13 +6,13 @@ AutoWonder 本地 agent runtime。安装后启动 daemon，持续轮询本地 as
 
 ```bash
 # Qoder CLI
-npx -y autowonder@0.2.25 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model Qwen3.7-Max --reasoning-effort medium --context-window 131072
+npx -y autowonder@0.2.26 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model Qwen3.7-Max --reasoning-effort medium --context-window 131072
 
 # Claude Code
-npx -y autowonder@0.2.25 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider claude
+npx -y autowonder@0.2.26 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider claude
 
 # Codex CLI
-npx -y autowonder@0.2.25 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider codex --model gpt-5.5 --reasoning-effort medium
+npx -y autowonder@0.2.26 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider codex --model gpt-5.5 --reasoning-effort medium
 ```
 
 `connect` 会安装当前 npm 包内置的 daemon，并使用页面生成的 WebSocket endpoint、Token 和执行器 ID 建立连接。目标机器必须提前安装并登录对应的 Qoder CLI、Claude Code 或 Codex CLI；runtime 会继承当前用户的 HOME、环境变量和 CLI 登录状态。
@@ -29,13 +29,18 @@ AUTOWONDER_AUTO_UPDATE=false npx -y autowonder@latest connect ...
 
 # 调整检查周期或使用兼容的 npm registry
 AUTOWONDER_AUTO_UPDATE_INTERVAL=1h \
-AUTOWONDER_UPDATE_DOWNLOAD_TIMEOUT=10m \
 AUTOWONDER_NPM_REGISTRY=https://registry.npmjs.org \
 npx -y autowonder@latest connect ...
 ```
 
 候选版本缓存在 `~/.autowonder/updates/`；当前二进制和单个回滚副本位于 `~/.autowonder/bin/`。`GET /health` 会返回 `daemonVersion`、`updateState`、`updateTarget` 和 `updateError`。
 
+## 发布构建
+
+`npm run build` 和发布脚本只接受没有已跟踪或未跟踪改动的 Git worktree。脚本会把准确的 release commit 克隆到仓库外的 detached checkout，再从该目录构建四个平台的 daemon。
+
+每个产物都必须在 Go BuildInfo 中报告相同的完整 commit、`vcs.modified=false` 和目标平台；本机产物的 `--self-check` 还必须与 npm 包版本、短 commit 和平台一致。任一检查失败都会在替换 `vendor` 或执行 `npm publish` 前终止。
+
 ## 提交 assignment
 
 daemon 默认轮询 `~/autowonder_workspaces/assignments/*.json`。队列里放 assignment JSON，不放 package zip；JSON 的 `taskPackageRef.downloadUrl` 应指向可下载的 OSS、HTTP 或本地 package 地址。
@@ -50,14 +55,14 @@ mv "$queue/.assignment.tmp" "$queue/assignment.json"
 也可以直接提交到本地 API：
 
 ```bash
-npx -y autowonder@0.2.25 dispatch ./assignment.json
+npx -y autowonder@0.2.26 dispatch ./assignment.json
 ```
 
 ## 管理 daemon
 
 ```bash
-npx -y autowonder@0.2.25 status
-npx -y autowonder@0.2.25 stop
+npx -y autowonder@0.2.26 status
+npx -y autowonder@0.2.26 stop
 ```
 
 默认 API 是 `http://127.0.0.1:34989`，日志位于 `~/.autowonder/daemon.log`。npm 包不包含任何 agent、MCP 或服务端凭证。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autowonder",
-  "version": "0.2.25",
+  "version": "0.2.26",
   "description": "AutoWonder local runtime — execute AI agent dispatch packages on your machine",
   "bin": {
     "autowonder": "bin/cli.js"

package/scripts/build-and-publish.sh

@@ -18,12 +18,22 @@ PKG_DIR="$(dirname "$SCRIPT_DIR")"
 VENDOR_DIR="$PKG_DIR/vendor"
 SOURCE_DIR="${AUTOWONDER_SOURCE_DIR:-}"
 SOURCE_REPO="${AUTOWONDER_SOURCE_REPO:-}"
-TEMP_SOURCE_DIR=""
+TEMP_SELECTED_SOURCE_DIR=""
+TEMP_BUILD_PARENT=""
+STAGING_VENDOR_DIR=""
 NPM_CONFIG_FILE=""
 
+source "$SCRIPT_DIR/release-build-lib.sh"
+
 cleanup() {
-  if [[ -n "$TEMP_SOURCE_DIR" ]]; then
-    rm -rf "$TEMP_SOURCE_DIR"
+  if [[ -n "$TEMP_SELECTED_SOURCE_DIR" ]]; then
+    rm -rf "$TEMP_SELECTED_SOURCE_DIR"
+  fi
+  if [[ -n "$TEMP_BUILD_PARENT" ]]; then
+    rm -rf "$TEMP_BUILD_PARENT"
+  fi
+  if [[ -n "$STAGING_VENDOR_DIR" ]]; then
+    rm -rf "$STAGING_VENDOR_DIR"
   fi
   if [[ -n "$NPM_CONFIG_FILE" ]]; then
     rm -f "$NPM_CONFIG_FILE"
@@ -50,19 +60,33 @@ else
     echo "Error: set AUTOWONDER_SOURCE_DIR or AUTOWONDER_SOURCE_REPO"
     exit 1
   fi
-  TEMP_SOURCE_DIR="$(mktemp -d)"
-  SOURCE_DIR="$TEMP_SOURCE_DIR"
+  TEMP_SELECTED_SOURCE_DIR="$(mktemp -d)"
+  SOURCE_DIR="$TEMP_SELECTED_SOURCE_DIR"
   echo "Cloning from $SOURCE_REPO..."
   git clone --depth 1 "$SOURCE_REPO" "$SOURCE_DIR"
 fi
 
 version="$(node -p "require('$PKG_DIR/package.json').version")"
-commit="$(git -C "$SOURCE_DIR" rev-parse --short=12 HEAD 2>/dev/null || printf unknown)"
+require_clean_release_source "$SOURCE_DIR"
+release_commit="$(git -C "$SOURCE_DIR" rev-parse HEAD)"
+commit="${release_commit:0:12}"
+
+TEMP_BUILD_PARENT="$(mktemp -d)"
+BUILD_SOURCE_DIR="$TEMP_BUILD_PARENT/source"
+prepare_clean_release_checkout "$SOURCE_DIR" "$release_commit" "$BUILD_SOURCE_DIR"
+
+source_version="$(node -p "require('$BUILD_SOURCE_DIR/npm/package.json').version")"
+if [[ "$source_version" != "$version" ]]; then
+  release_error "package version mismatch: source=$source_version package=$version"
+  exit 1
+fi
+
 ldflags="-s -w -X main.buildPackageName=autowonder -X main.buildVersion=$version -X main.buildCommit=$commit"
+echo "Release commit: $release_commit"
+echo "Go toolchain: $(go env GOVERSION)"
 
 # Build for all platforms
-rm -rf "$VENDOR_DIR"
-mkdir -p "$VENDOR_DIR"
+STAGING_VENDOR_DIR="$(mktemp -d "$PKG_DIR/.vendor-staging.XXXXXX")"
 
 platforms=("darwin-arm64" "darwin-amd64" "linux-amd64" "linux-arm64")
 goarch_map=("arm64" "amd64" "amd64" "arm64")
@@ -72,14 +96,28 @@ for i in "${!platforms[@]}"; do
   platform="${platforms[$i]}"
   goos="${goos_map[$i]}"
   goarch="${goarch_map[$i]}"
-  output="$VENDOR_DIR/autowonder-daemon-${goos}-${goarch}"
+  output="$STAGING_VENDOR_DIR/autowonder-daemon-${goos}-${goarch}"
 
   echo "Building $platform..."
-  (cd "$SOURCE_DIR" && CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" go build -o "$output" -ldflags="$ldflags" ./cmd/autowonder-daemon)
+  (cd "$BUILD_SOURCE_DIR" && CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" go build -trimpath -buildvcs=true -o "$output" -ldflags="$ldflags" ./cmd/autowonder-daemon)
   chmod +x "$output"
+  verify_go_binary_provenance "$output" "$release_commit" "$goos" "$goarch"
   echo "  -> $output ($(du -h "$output" | cut -f1))"
 done
 
+native_goos="$(go env GOOS)"
+native_goarch="$(go env GOARCH)"
+native_binary="$STAGING_VENDOR_DIR/autowonder-daemon-${native_goos}-${native_goarch}"
+if [[ ! -x "$native_binary" ]]; then
+  release_error "native platform is not included in release targets: ${native_goos}-${native_goarch}"
+  exit 1
+fi
+verify_daemon_self_check "$native_binary" "$version" "$commit" "$native_goos" "$native_goarch"
+
+rm -rf "$VENDOR_DIR"
+mv "$STAGING_VENDOR_DIR" "$VENDOR_DIR"
+STAGING_VENDOR_DIR=""
+
 echo ""
 echo "Binaries ready in $VENDOR_DIR:"
 ls -lh "$VENDOR_DIR/"

package/scripts/release-build-lib.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+
+release_error() {
+  printf 'Error: %s\n' "$*" >&2
+  return 1
+}
+
+require_clean_release_source() {
+  local source_dir="$1"
+  local status
+
+  if ! git -C "$source_dir" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    release_error "release source is not a Git worktree: $source_dir"
+    return 1
+  fi
+  if ! status="$(git -C "$source_dir" status --porcelain --untracked-files=all)"; then
+    release_error "cannot inspect release source: $source_dir"
+    return 1
+  fi
+  if [[ -n "$status" ]]; then
+    release_error "release source is dirty: $source_dir"
+    return 1
+  fi
+}
+
+prepare_clean_release_checkout() {
+  local source_dir="$1"
+  local expected_commit="$2"
+  local destination="$3"
+  local actual_commit
+
+  if ! git clone --quiet --no-local --no-checkout "$source_dir" "$destination"; then
+    release_error "cannot clone release source: $source_dir"
+    return 1
+  fi
+  if ! git -C "$destination" checkout --quiet --detach "$expected_commit"; then
+    release_error "cannot check out release commit: $expected_commit"
+    return 1
+  fi
+  actual_commit="$(git -C "$destination" rev-parse HEAD)" || return 1
+  if [[ "$actual_commit" != "$expected_commit" ]]; then
+    release_error "clean checkout commit mismatch: got $actual_commit, want $expected_commit"
+    return 1
+  fi
+  require_clean_release_source "$destination"
+}
+
+go_build_value() {
+  local binary="$1"
+  local key="$2"
+
+  go version -m "$binary" |
+    awk -v key="$key" '$1 == "build" && index($2, key "=") == 1 { sub("^" key "=", "", $2); print $2; exit }'
+}
+
+verify_go_binary_provenance() {
+  local binary="$1"
+  local expected_commit="$2"
+  local expected_goos="$3"
+  local expected_goarch="$4"
+  local vcs revision modified goos goarch
+
+  vcs="$(go_build_value "$binary" vcs)"
+  revision="$(go_build_value "$binary" vcs.revision)"
+  modified="$(go_build_value "$binary" vcs.modified)"
+  goos="$(go_build_value "$binary" GOOS)"
+  goarch="$(go_build_value "$binary" GOARCH)"
+
+  if [[ "$vcs" != "git" ]]; then
+    release_error "missing Git VCS metadata: $binary"
+    return 1
+  fi
+  if [[ "$revision" != "$expected_commit" ]]; then
+    release_error "VCS revision mismatch: got $revision, want $expected_commit: $binary"
+    return 1
+  fi
+  if [[ "$modified" != "false" ]]; then
+    release_error "binary reports vcs.modified=$modified: $binary"
+    return 1
+  fi
+  if [[ "$goos" != "$expected_goos" ]]; then
+    release_error "GOOS mismatch: got $goos, want $expected_goos: $binary"
+    return 1
+  fi
+  if [[ "$goarch" != "$expected_goarch" ]]; then
+    release_error "GOARCH mismatch: got $goarch, want $expected_goarch: $binary"
+    return 1
+  fi
+}
+
+verify_daemon_self_check() {
+  local binary="$1"
+  local expected_version="$2"
+  local expected_commit="$3"
+  local expected_goos="$4"
+  local expected_goarch="$5"
+  local identity
+
+  if ! identity="$("$binary" --self-check --expected-version "$expected_version")"; then
+    release_error "daemon self-check failed: $binary"
+    return 1
+  fi
+
+  if ! printf '%s' "$identity" | node -e '
+    const fs = require("node:fs");
+    const actual = JSON.parse(fs.readFileSync(0, "utf8"));
+    const expected = {
+      package: "autowonder",
+      version: process.argv[1],
+      commit: process.argv[2],
+      goos: process.argv[3],
+      goarch: process.argv[4],
+    };
+    for (const [key, value] of Object.entries(expected)) {
+      if (actual[key] !== value) {
+        throw new Error(`${key} mismatch: got ${actual[key]}, want ${value}`);
+      }
+    }
+  ' "$expected_version" "$expected_commit" "$expected_goos" "$expected_goarch"; then
+    release_error "daemon self-check identity mismatch: $binary"
+    return 1
+  fi
+}