autowonder 0.3.22 → 0.3.24

package/README.md

@@ -6,10 +6,10 @@ AutoWonder 本地 agent runtime。安装后启动 daemon，持续轮询本地 as
 
 ```bash
 # Qoder CLI（模型使用 provider model ID；Context Window 使用固定档位）
-npx -y autowonder@0.3.22 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model qmodel_latest --reasoning-effort medium --context-window 260000
+npx -y autowonder@0.3.24 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model qmodel_latest --reasoning-effort medium --context-window 260000
 
 # Qoder CLI CN
-npx -y autowonder@0.3.22 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qodercn
+npx -y autowonder@0.3.24 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qodercn
 ```
 
 `connect` 会安装当前 npm 包内置的 daemon，并使用页面生成的 WebSocket endpoint、Token 和执行器 ID 建立连接。客户端只支持通过 Qoder 系列 CLI 启动（`qoder` 对应 `qodercli`，`qodercn` 对应 `qodercn`），其他 `--provider` 取值会在启动 daemon 前直接报错拦截并提示 `Unsupported provider`。选择 Qoder CLI 或 Qoder CLI CN 时需要 Node.js 20+；runtime 会在缺少对应 CLI 时自动通过 npm 安装，并在尚未登录时打开浏览器登录。runtime 会继承当前用户的 HOME、环境变量和 CLI 登录状态。
@@ -119,6 +119,8 @@ npx -y autowonder@latest connect ...
 
 同版本空闲时用新参数 exec；切换到更高稳定版本要求二进制安装在 `~/.autowonder/bin/autowonder-daemon`，复用 npm tarball SHA-512、包版本、平台二进制和候选自检，再原子切换。失败保留原程序并在支持的故障路径回滚，不支持在线降级。源码构建仅支持保持当前版本的参数应用，Windows 不声明在线应用能力。旧客户端需要先本地安装一次支持版本。
 
+启动命令可携带可选的 `restartMode`，取值为 `WHEN_IDLE` 或 `FORCE`。未提供时仅在本机完全空闲时应用，繁忙时拒绝并回执失败；`WHEN_IDLE` 会立即关闭接单入口，等待运行中任务与会话结束后再重启，等待期间每 30 秒以 `EXECUTOR_RESTART_RESULT` 的 `WAITING_IDLE` 状态回执；`FORCE` 同样立即关闭接单入口，但不等运行中任务，仍要求结果 outbox 可读后立即重启。非法取值会在产生任何重启副作用前被拒绝。Linux/macOS 执行器在心跳中通过 `EXECUTOR_RESTART_POLICY_V1` 声明支持该策略。
+
 工作目录切换前必须没有运行/恢复任务，且原目录的结果 outbox 已全部确认；默认本地队列仍有待执行或已领取任务时也会拒绝切换。目标目录必须可写；历史任务文件保留在原目录，不自动迁移或删除。未指定目录和名称时在线应用沿用当前值，仅更新其他参数不会移动本地队列。
 
 候选版本缓存在 `~/.autowonder/updates/`；当前二进制和单个回滚副本位于 `~/.autowonder/bin/`。`GET /health` 会返回 `daemonVersion`、`updateState`、`updateTarget` 和 `updateError`。
@@ -127,7 +129,7 @@ daemon 建立连接时和每次心跳定时检查时发出的 `HEARTBEAT` 帧都
 
 同一批 `HEARTBEAT` 帧还带上 `model` 字段，取值为 daemon 当前生效的默认模型（`--model` 经 `AUTOWONDER_MODEL` 注入的 `cfg.DefaultModel`，即派单未指定模型时实际使用的取值）；该值为空时字段不出现在帧里。服务端据此在执行器列表展示每台执行机当前使用的底层模型，与上面的 `version` 上报同一条通路。对执行机用户同样无新增参数或环境变量。
 
-同一批 `HEARTBEAT` 帧还带上进程级固定的 `startedAt`（重连不重置）与继承自 re-exec 的 `restartRequestId`，并在能力位里声明 `EXECUTOR_RESTART_V1`（Windows 不声明）；接入自动更新的 daemon 额外声明 `EXECUTOR_UPDATE_RESTART_V1`。服务端可据此下发 `EXECUTOR_RESTART`（带 `executorId`、`requestId`、ISO UTC `issuedAt` 与布尔 `update`）。本机只接受 `executorId` 与自身一致、未过期且未处理过的请求，不接收任何远端 shell 命令、可执行路径或下载地址，并以 `EXECUTOR_RESTART_RESULT`（`UPDATING` / `RESTARTING` / `FAILED`）回执，真正是否成功以下一次心跳为准。重启走既有的接单闸门：有运行中任务或结果 outbox 未确认可读时不重启，re-exec 失败会重新开放接单；`update=true` 复用既有的 registry、完整性校验、候选 self-check、安装事务与回滚，仅标准安装的正式版支持远端拉取新版本，已是最新版的请求仍会重启，且该操作不应用平台上保存的启动配置改动。对执行机用户同样无新增参数或环境变量。
+同一批 `HEARTBEAT` 帧还带上进程级固定的 `startedAt`（重连不重置）与继承自 re-exec 的 `restartRequestId`，并在能力位里声明 `EXECUTOR_RESTART_V1` 与 `EXECUTOR_RESTART_POLICY_V1`（Windows 均不声明）；接入自动更新的 daemon 额外声明 `EXECUTOR_UPDATE_RESTART_V1`。服务端可据此下发 `EXECUTOR_RESTART`（带 `executorId`、`requestId`、ISO UTC `issuedAt` 与布尔 `update`）。本机只接受 `executorId` 与自身一致、未过期且未处理过的请求，不接收任何远端 shell 命令、可执行路径或下载地址，并以 `EXECUTOR_RESTART_RESULT`（`UPDATING` / `WAITING_IDLE` / `RESTARTING` / `FAILED`）回执，真正是否成功以下一次心跳为准。重启走既有的接单闸门：有运行中任务或结果 outbox 未确认可读时不重启，re-exec 失败会重新开放接单；`update=true` 复用既有的 registry、完整性校验、候选 self-check、安装事务与回滚，仅标准安装的正式版支持远端拉取新版本，已是最新版的请求仍会重启，且该操作不应用平台上保存的启动配置改动。对执行机用户同样无新增参数或环境变量。
 
 标准安装还支持服务端把整批执行机升级到指定的**已发布版本**（不再依赖各台机器安装时选定的版本），能力位为 `EXECUTOR_UPDATE_V1`。服务端下发 `EXECUTOR_UPGRADE`（带 `executorId`、`requestId`、ISO UTC `issuedAt` 与 `targetVersion`），本机只接受 `executorId` 与自身一致、`requestId` 非空且不超过 80 字符、`issuedAt` 在前后 1 分钟以内、且 `targetVersion` 为三段纯数字正式版的请求。升级按 `accepted` → `downloading` → `draining` → `applying` → `success` 逐阶段回执 `EXECUTOR_UPGRADE_RESULT`（含 `requestId`、`phase` 与该进程启动时的 `currentVersion`；新版本以下一个进程的首次心跳为准），失败则以 `failed` 帧带上错误原因——目标版本不受支持、请求过期、本机构建不支持远端升级等都会显式回执而不是静默丢弃。registry 按请求的版本号解析元数据并要求返回值与请求版本严格一致；请求版本低于当前版本时拒绝执行（服务端升级永不回滚整批执行机），已缓存但版本不符的候选不会被采用。`requestId` 会跨 re-exec 传递，服务端重放的同一请求不会触发第二次升级；同一 `requestId` 同时只允许一次尝试在飞，失败后可重试。升级复用既有的接单闸门、完整性校验、候选 self-check、安装事务与回滚。对执行机用户无新增参数或环境变量。
 
@@ -175,7 +177,7 @@ mv "$queue/.assignment.tmp" "$queue/assignment.json"
 也可以直接提交到本地 API：
 
 ```bash
-npx -y autowonder@0.3.22 dispatch ./assignment.json
+npx -y autowonder@0.3.24 dispatch ./assignment.json
 ```
 
 ## 上传工单附件
@@ -183,7 +185,7 @@ npx -y autowonder@0.3.22 dispatch ./assignment.json
 把本地需求/设计文档直接上传到工单，避免在会话里传递大文件：
 
 ```bash
-npx -y autowonder@0.3.22 workitem upload --server-url <autowonder-server-url> --workitem-id <id> --file <filepath-1> --file <filepath-2> --json
+npx -y autowonder@0.3.24 workitem upload --server-url <autowonder-server-url> --workitem-id <id> --file <filepath-1> --file <filepath-2> --json
 ```
 
 上传令牌通过 MCP 工具 `autowonder.workitem_cli_upload_token` 签发，经 `--token` 或 `AUTOWONDER_UPLOAD_TOKEN` 环境变量传入。`--file` 可重复指定多个文件；`--json` 输出机器可读结果。失败时按错误类型返回不同退出码（401→3、403→4、404→5、409→6、413→7、其他 4xx→8、网络/重定向→9）。
@@ -193,7 +195,7 @@ npx -y autowonder@0.3.22 workitem upload --server-url <autowonder-server-url> --
 把工单上已有的需求/设计文档下载到本地目录，再用本地文件工具阅读，避免把大文件或二进制附件搬进会话上下文：
 
 ```bash
-npx -y autowonder@0.3.22 workitem download --server-url <autowonder-server-url> --workitem-id <id> --file <name-or-id> --output-dir <dir> --json
+npx -y autowonder@0.3.24 workitem download --server-url <autowonder-server-url> --workitem-id <id> --file <name-or-id> --output-dir <dir> --json
 ```
 
 下载令牌通过 MCP 工具 `autowonder.workitem_cli_download_token` 签发（与上传令牌相互独立），经 `--token` 或 `AUTOWONDER_DOWNLOAD_TOKEN` 环境变量传入。`--file` 可重复指定文档名或 artifact id，省略则下载该工单的全部附件；`--output-dir` 默认为当前目录；`--json` 输出机器可读结果，含每个文件的 `id`、`name`、`path`、`size`。退出码约定与 `workitem upload` 相同（401→3、403→4、404→5、409→6、413→7、其他 4xx→8、网络/重定向→9）。
@@ -203,7 +205,7 @@ npx -y autowonder@0.3.22 workitem download --server-url <autowonder-server-url>
 把需求/设计文档上传到 7x24 定时任务，用法与工单附件一致（同一套上传令牌与预检规则）：
 
 ```bash
-npx -y autowonder@0.3.22 scheduled-task upload --server-url <autowonder-server-url> --scheduled-task-id <id> --file <filepath-1> --file <filepath-2> --json
+npx -y autowonder@0.3.24 scheduled-task upload --server-url <autowonder-server-url> --scheduled-task-id <id> --file <filepath-1> --file <filepath-2> --json
 ```
 
 上传令牌同样通过 `autowonder.workitem_cli_upload_token` 签发（令牌为用户级，对当前可修改的任意定时任务生效），经 `--token` 或 `AUTOWONDER_UPLOAD_TOKEN` 传入；退出码约定与 `workitem upload` 相同。
@@ -211,8 +213,8 @@ npx -y autowonder@0.3.22 scheduled-task upload --server-url <autowonder-server-u
 ## 管理 daemon
 
 ```bash
-npx -y autowonder@0.3.22 status
-npx -y autowonder@0.3.22 stop
+npx -y autowonder@0.3.24 status
+npx -y autowonder@0.3.24 stop
 ```
 
 默认 API 是 `http://127.0.0.1:34989`，日志位于 `~/.autowonder/daemon.log`。npm 包不包含任何 agent、MCP 或服务端凭证。
@@ -235,7 +237,7 @@ daemon 内置独立于工作区 GC 的保留清扫：默认每小时运行一次
 ## 调试
 
 ```bash
-npx -y autowonder@0.3.22 connect ... --debug
+npx -y autowonder@0.3.24 connect ... --debug
 ```
 
 `--debug` 会让 CLI 以 `AUTOWONDER_DEBUG=1` 启动 daemon，把完整的 daemon 与 agent 活动（runtime 事件流、provider 事件解码、重试退避与会话门等待、空闲时的阻塞点）同时输出到控制台和会话调试日志。调试日志不做脱敏，仅用于本机排障；不传 `--debug` 时该环境变量不会注入。

package/bin/token-proxy.js

@@ -26,6 +26,7 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const zlib = require('zlib');
 
 // ─── Config ──────────────────────────────────────────────────────────────────
 
@@ -49,8 +50,10 @@ function intEnv(name, fallback) {
 }
 
 // Qoder/QoderCN LLM API hosts to sniff (others are tunneled without inspection).
-// Only LLM endpoints are listed — non-LLM APIs (openapi.*) are excluded to avoid
-// unnecessary MITM overhead on high-frequency config/auth calls.
+// The exact list documents the canonical API endpoints; the suffix list keeps
+// sniffing working when the vendor adds or moves endpoints to another subdomain
+// (e.g. *.qoder.xin), which would otherwise be blind-tunneled and silently drop
+// usage. Both only ever inspect traffic locally — nothing is uploaded.
 const SNIFF_HOSTS = new Set([
   // Qoder (international)
   'api3.qoder.sh', 'api2.qoder.sh', 'api.qoder.sh', 'openapi.qoder.sh',
@@ -58,6 +61,17 @@ const SNIFF_HOSTS = new Set([
   'gateway.qoder.com.cn', 'openapi.qoder.com.cn',
   'api3.qodercn.com', 'api2.qodercn.com', 'api.qodercn.com',
 ]);
+const SNIFF_HOST_SUFFIXES = ['.qoder.sh', '.qodercn.com', '.qoder.com.cn', '.qoder.xin'];
+
+// shouldSniffHost matches case-insensitively on the exact list first and then on
+// the owned-domain suffixes. A trailing root dot is ignored.
+function shouldSniffHost(hostname, exactHosts = SNIFF_HOSTS, suffixes = SNIFF_HOST_SUFFIXES) {
+  const host = String(hostname || '').trim().toLowerCase().replace(/\.$/, '');
+  if (!host) return false;
+  const exact = typeof exactHosts.has === 'function' ? exactHosts.has(host) : exactHosts.includes(host);
+  if (exact) return true;
+  return suffixes.some(suffix => host === suffix.slice(1) || host.endsWith(suffix));
+}
 
 // ─── Managed log rotation (proxy-diag.log) ───────────────────────────────────
 
@@ -148,10 +162,25 @@ function installDiagLog(logPath = DIAG_LOG_PATH) {
 
 // ─── CA Certificate (auto-generated, only for this proxy) ────────────────────
 
+// readCertPair rejects missing, zero-byte and unparsable pairs so a partial
+// file left by an interrupted signing run is regenerated instead of reused.
+function readCertPair(certPath, keyPath) {
+  try {
+    const cert = fs.readFileSync(certPath);
+    const key = fs.readFileSync(keyPath);
+    if (cert.length === 0 || key.length === 0) return null;
+    new crypto.X509Certificate(cert);
+    return { key, cert };
+  } catch (_) {
+    return null;
+  }
+}
+
 function ensureCA() {
   fs.mkdirSync(DATA_DIR, { recursive: true });
-  if (fs.existsSync(CA_KEY_PATH) && fs.existsSync(CA_CERT_PATH)) {
-    return { key: fs.readFileSync(CA_KEY_PATH), cert: fs.readFileSync(CA_CERT_PATH) };
+  const existing = readCertPair(CA_CERT_PATH, CA_KEY_PATH);
+  if (existing) {
+    return existing;
   }
 
   const { privateKey } = crypto.generateKeyPairSync('rsa', {
@@ -208,10 +237,16 @@ function getHostCert(hostname, ca) {
   const keyPath = path.join(DATA_DIR, `${hostname}-key.pem`);
 
   // Return cached cert from disk if still valid
-  if (fs.existsSync(certPath) && fs.existsSync(keyPath) && !isCertExpired(certPath)) {
-    const result = { key: fs.readFileSync(keyPath), cert: fs.readFileSync(certPath) };
-    hostCertCache.set(hostname, result);
-    return result;
+  const onDisk = readCertPair(certPath, keyPath);
+  if (onDisk && !isCertExpired(certPath)) {
+    hostCertCache.set(hostname, onDisk);
+    return onDisk;
+  }
+  if (!onDisk) {
+    // A zero-byte or truncated pair from an interrupted run must not shadow a
+    // fresh signing attempt.
+    try { fs.unlinkSync(certPath); } catch (_) {}
+    try { fs.unlinkSync(keyPath); } catch (_) {}
   }
 
   const { privateKey } = crypto.generateKeyPairSync('rsa', {
@@ -221,39 +256,65 @@ function getHostCert(hostname, ca) {
   });
 
   const { execFileSync } = require('child_process');
-  const csrPath = path.join(DATA_DIR, `${hostname}.csr`);
+  // Per-process temp names keep two proxies that share one data dir from
+  // overwriting each other's signing inputs.
+  const csrPath = path.join(DATA_DIR, `${hostname}.${process.pid}.csr`);
+  const extPath = path.join(DATA_DIR, `${hostname}.${process.pid}.ext`);
   fs.writeFileSync(keyPath, privateKey, { mode: 0o600 });
+  fs.writeFileSync(extPath, `[v3_ext]\nsubjectAltName=DNS:${hostname}\n`, { mode: 0o600 });
+
+  // A per-signing random serial removes the shared ca-cert.srl file that
+  // concurrent signings used to race on. The ext file is a real path because
+  // openssl cannot reopen /dev/stdin when stdin is a Node pipe.
+  const sign = extraArgs => execFileSync('openssl', [
+    'x509', '-req', '-in', csrPath, '-CA', CA_CERT_PATH, '-CAkey', CA_KEY_PATH,
+    '-set_serial', `0x${crypto.randomBytes(16).toString('hex')}`,
+    '-out', certPath, '-days', '365', ...extraArgs,
+  ], { stdio: 'pipe' });
 
   try {
     execFileSync('openssl', ['req', '-new', '-key', keyPath, '-out', csrPath, '-subj', `/CN=${hostname}`], { stdio: 'pipe' });
-    execFileSync('openssl', [
-      'x509', '-req', '-in', csrPath, '-CA', CA_CERT_PATH, '-CAkey', CA_KEY_PATH,
-      '-CAcreateserial', '-out', certPath, '-days', '365',
-      '-extfile', '/dev/stdin', '-extensions', 'v3_ext',
-    ], { input: `[v3_ext]\nsubjectAltName=DNS:${hostname}\n`, stdio: ['pipe', 'pipe', 'pipe'] });
+    sign(['-extfile', extPath, '-extensions', 'v3_ext']);
   } catch (_) {
     // Windows fallback: without SAN extension
     try {
       execFileSync('openssl', ['req', '-new', '-key', keyPath, '-out', csrPath, '-subj', `/CN=${hostname}`], { stdio: 'pipe' });
-      execFileSync('openssl', [
-        'x509', '-req', '-in', csrPath, '-CA', CA_CERT_PATH, '-CAkey', CA_KEY_PATH,
-        '-CAcreateserial', '-out', certPath, '-days', '365',
-      ], { stdio: 'pipe' });
+      sign([]);
     } catch (e2) {
-      // Cannot generate host cert — fall back to blind tunnel (no sniffing)
-      hostCertCache.set(hostname, null);
+      // Cannot generate host cert — report and fall back to a blind tunnel.
+      // The failure is not cached so a later connection can retry.
+      reportHostCertFailure(hostname, e2);
+      try { fs.unlinkSync(certPath); } catch (_) {}
+      try { fs.unlinkSync(csrPath); } catch (_) {}
+      try { fs.unlinkSync(extPath); } catch (_) {}
       return null;
     }
   }
 
-  const result = { key: fs.readFileSync(keyPath), cert: fs.readFileSync(certPath) };
+  const result = readCertPair(certPath, keyPath);
+  if (!result) {
+    reportHostCertFailure(hostname, new Error('signed certificate is unreadable'));
+    try { fs.unlinkSync(certPath); } catch (_) {}
+    try { fs.unlinkSync(csrPath); } catch (_) {}
+    try { fs.unlinkSync(extPath); } catch (_) {}
+    return null;
+  }
   hostCertCache.set(hostname, result);
   // Cleanup temp files
   try { fs.unlinkSync(csrPath); } catch (_) {}
-  try { fs.unlinkSync(path.join(DATA_DIR, 'ca-cert.srl')); } catch (_) {}
+  try { fs.unlinkSync(extPath); } catch (_) {}
   return result;
 }
 
+// reportHostCertFailure emits one bounded line per failed host so a blind
+// tunnel is visible in the proxy log; it never includes credentials.
+function reportHostCertFailure(hostname, err) {
+  const detail = String((err && err.message) || err || 'unknown error').split('\n')[0].slice(0, 200);
+  try {
+    console.error(`[token-proxy] host cert generation failed host=${hostname}: ${detail}`);
+  } catch (_) {}
+}
+
 // ─── Usage extraction from Qoder SSE ────────────────────────────────────────
 
 function extractUsageFromResponse(buffer) {
@@ -410,6 +471,335 @@ function extractDispatchInfo(req) {
   return { dispatchId: null, stepId: null };
 }
 
+// ─── HTTP/1.1 framing + content decoding ────────────────────────────────────
+
+// A single SSE data line can legitimately exceed the old 64KiB cap. Keeping a
+// much larger ceiling means a usage payload is never cut mid-line before the
+// newline arrives.
+const DEFAULT_MAX_LINE_BYTES = 8 * 1024 * 1024;
+
+// createBodyDecoder inflates a response body according to Content-Encoding.
+// Unknown encodings and decoder failures pass raw bytes through unchanged:
+// usage extraction is best-effort and must never affect the tunneled traffic.
+// onFlush runs once, after every decoded byte has been emitted.
+function createBodyDecoder(encoding, emit, onFlush = () => {}) {
+  const name = String(encoding || '').trim().toLowerCase();
+  let stream = null;
+  if (name === 'gzip' || name === 'x-gzip') stream = zlib.createGunzip();
+  else if (name === 'deflate') stream = zlib.createInflate();
+  else if (name === 'br') stream = zlib.createBrotliDecompress();
+  if (!stream) return { active: false, write: chunk => emit(chunk), end: onFlush, cancel() {} };
+
+  let broken = false;
+  let finished = false;
+  const finish = () => {
+    if (finished) return;
+    finished = true;
+    onFlush();
+  };
+  stream.on('data', chunk => { if (!broken) emit(chunk); });
+  stream.on('error', () => { broken = true; finish(); });
+  stream.on('end', finish);
+  return {
+    active: true,
+    write(chunk) {
+      if (broken) { emit(chunk); return; }
+      try { stream.write(chunk); } catch (_) { broken = true; emit(chunk); }
+    },
+    end() {
+      if (broken) { finish(); return; }
+      try { stream.end(); } catch (_) { broken = true; finish(); }
+    },
+    cancel() { broken = true; },
+  };
+}
+
+function findHeadEnd(buffer) {
+  const crlf = buffer.indexOf('\r\n\r\n');
+  if (crlf >= 0) return { index: crlf, next: crlf + 4 };
+  const lf = buffer.indexOf('\n\n');
+  if (lf >= 0) return { index: lf, next: lf + 2 };
+  return null;
+}
+
+// createResponseExtractor de-frames the upstream byte stream of one tunnel.
+// It follows HTTP/1.1 Content-Length / chunked framing so keep-alive responses
+// and chunk boundaries can never inject chunk metadata into a JSON line, and it
+// decodes Content-Encoding (gzip/deflate/br) before handing body bytes to
+// onData. onResponseEnd fires at every body boundary so a final line without a
+// trailing newline is still scanned.
+function createResponseExtractor({ onData = () => {}, onResponseEnd = () => {},
+  maxHeadBytes = 65536 } = {}) {
+  let pending = Buffer.alloc(0);
+  // head | fixed | chunk-size | chunk-data | chunk-crlf | trailers | until-close | raw
+  let mode = 'head';
+  let remaining = 0;
+  let encoding = null;
+  let decoder = null;
+  let responseCount = 0;
+  let sawRaw = false;
+
+  function switchToRaw() {
+    sawRaw = true;
+    mode = 'raw';
+    if (decoder) decoder.cancel();
+    decoder = null;
+    encoding = null;
+  }
+
+  function openDecoder() {
+    decoder = createBodyDecoder(encoding, onData, onResponseEnd);
+  }
+
+  function emitBody(chunk) {
+    if (!chunk.length) return;
+    if (decoder) decoder.write(chunk);
+    else onData(chunk);
+  }
+
+  function finishBody() {
+    const active = decoder;
+    decoder = null;
+    encoding = null;
+    mode = 'head';
+    if (!active) { onResponseEnd(); return; }
+    // Wait for inflate to drain so the final line is scanned before the
+    // response boundary is reported.
+    active.end();
+  }
+
+  function takeLine() {
+    const newline = pending.indexOf(0x0a);
+    if (newline < 0) return null;
+    let end = newline;
+    if (end > 0 && pending[end - 1] === 0x0d) end--;
+    const value = pending.subarray(0, end).toString('latin1');
+    pending = pending.subarray(newline + 1);
+    return value;
+  }
+
+  function parseHead(head) {
+    const lines = head.split(/\r?\n/);
+    const statusLine = lines.shift() || '';
+    const statusMatch = statusLine.match(/^HTTP\/\d(?:\.\d)?\s+(\d{3})/);
+    const status = statusMatch ? parseInt(statusMatch[1], 10) : 0;
+    const headers = {};
+    for (const line of lines) {
+      const colon = line.indexOf(':');
+      if (colon <= 0) continue;
+      const name = line.slice(0, colon).trim().toLowerCase();
+      const value = line.slice(colon + 1).trim();
+      headers[name] = headers[name] ? `${headers[name]},${value}` : value;
+    }
+    responseCount++;
+    if (status === 101) {
+      // Protocol switch: the remainder is an opaque frame stream.
+      switchToRaw();
+      return;
+    }
+    if (status < 200 || status === 204 || status === 304) {
+      mode = 'head';
+      return;
+    }
+    encoding = headers['content-encoding'] || null;
+    if (/\bchunked\b/i.test(headers['transfer-encoding'] || '')) {
+      mode = 'chunk-size';
+      openDecoder();
+      return;
+    }
+    const lengthHeader = headers['content-length'];
+    if (lengthHeader !== undefined) {
+      remaining = parseInt(lengthHeader, 10);
+      if (!Number.isFinite(remaining) || remaining < 0) {
+        mode = 'until-close';
+        openDecoder();
+        return;
+      }
+      if (remaining === 0) {
+        encoding = null;
+        mode = 'head';
+        return;
+      }
+      mode = 'fixed';
+      openDecoder();
+      return;
+    }
+    mode = 'until-close';
+    openDecoder();
+  }
+
+  function process() {
+    for (;;) {
+      if (mode === 'head') {
+        if (!pending.length) return;
+        if (pending.length < 5) return;
+        if (pending.subarray(0, 5).toString('latin1') !== 'HTTP/') {
+          // Not an HTTP stream (unexpected framing): scan the bytes as text.
+          switchToRaw();
+          continue;
+        }
+        const headEnd = findHeadEnd(pending);
+        if (!headEnd) {
+          if (pending.length > maxHeadBytes) { switchToRaw(); continue; }
+          return;
+        }
+        const head = pending.subarray(0, headEnd.index).toString('latin1');
+        pending = pending.subarray(headEnd.next);
+        parseHead(head);
+        continue;
+      }
+
+      if (mode === 'fixed') {
+        if (!pending.length) return;
+        const take = Math.min(remaining, pending.length);
+        const chunk = pending.subarray(0, take);
+        pending = pending.subarray(take);
+        remaining -= take;
+        emitBody(chunk);
+        if (remaining === 0) finishBody();
+        continue;
+      }
+
+      if (mode === 'chunk-size') {
+        const line = takeLine();
+        if (line === null) return;
+        const size = parseInt(line.split(';')[0].trim(), 16);
+        if (!Number.isFinite(size) || size < 0) { switchToRaw(); continue; }
+        remaining = size;
+        mode = size === 0 ? 'trailers' : 'chunk-data';
+        continue;
+      }
+
+      if (mode === 'chunk-data') {
+        if (!pending.length) return;
+        const take = Math.min(remaining, pending.length);
+        const chunk = pending.subarray(0, take);
+        pending = pending.subarray(take);
+        remaining -= take;
+        emitBody(chunk);
+        if (remaining === 0) mode = 'chunk-crlf';
+        continue;
+      }
+
+      if (mode === 'chunk-crlf') {
+        if (pending.length < 2) {
+          if (pending.length === 1 && pending[0] !== 0x0d && pending[0] !== 0x0a) { switchToRaw(); continue; }
+          return;
+        }
+        if (pending[0] === 0x0d && pending[1] === 0x0a) pending = pending.subarray(2);
+        else if (pending[0] === 0x0a) pending = pending.subarray(1);
+        else { switchToRaw(); continue; }
+        mode = 'chunk-size';
+        continue;
+      }
+
+      if (mode === 'trailers') {
+        const line = takeLine();
+        if (line === null) return;
+        if (line.trim() === '') finishBody();
+        continue;
+      }
+
+      // until-close and raw forward everything that is left.
+      if (!pending.length) return;
+      const chunk = pending;
+      pending = Buffer.alloc(0);
+      if (mode === 'until-close') emitBody(chunk);
+      else onData(chunk);
+      return;
+    }
+  }
+
+  return {
+    get mode() { return mode; },
+    get encoding() { return encoding; },
+    get responseCount() { return responseCount; },
+    get sawRaw() { return sawRaw; },
+    push(chunk) {
+      if (!chunk || !chunk.length) return;
+      pending = pending.length ? Buffer.concat([pending, chunk]) : Buffer.from(chunk);
+      process();
+    },
+    flush() {
+      if (mode === 'until-close' || mode === 'raw') {
+        if (pending.length) {
+          const rest = pending;
+          pending = Buffer.alloc(0);
+          if (mode === 'until-close') emitBody(rest);
+          else onData(rest);
+        }
+        finishBody();
+        return;
+      }
+      // A truncated framed body may still carry a scannable tail.
+      const partial = pending.length > 0 || mode !== 'head';
+      if (pending.length) {
+        const rest = pending;
+        pending = Buffer.alloc(0);
+        if (mode === 'head') onData(rest);
+        else emitBody(rest);
+      }
+      if (decoder) {
+        finishBody();
+        return;
+      }
+      if (partial) onResponseEnd();
+    },
+  };
+}
+
+// createLineScanner splits a byte stream into lines without assuming that a
+// chunk boundary aligns with a line boundary. Oversized lines keep their tail
+// (the usage object sits at the end of an SSE line), so a single huge line can
+// never push the rest of the stream out of the scan window.
+function createLineScanner(onLine, { maxLineBytes = DEFAULT_MAX_LINE_BYTES } = {}) {
+  let parts = [];
+  let held = 0;
+
+  function emit(line) {
+    if (!line.length) return;
+    if (line[line.length - 1] === 0x0d) line = line.subarray(0, line.length - 1);
+    if (!line.length) return;
+    onLine(line.toString('utf8'));
+  }
+
+  return {
+    push(chunk) {
+      let start = 0;
+      while (start < chunk.length) {
+        const newline = chunk.indexOf(0x0a, start);
+        if (newline < 0) {
+          const rest = chunk.subarray(start);
+          parts.push(rest);
+          held += rest.length;
+          if (held > maxLineBytes) {
+            const all = Buffer.concat(parts);
+            parts = [all.subarray(all.length - maxLineBytes)];
+            held = maxLineBytes;
+          }
+          return;
+        }
+        if (parts.length) {
+          parts.push(chunk.subarray(start, newline));
+          emit(Buffer.concat(parts));
+          parts = [];
+          held = 0;
+        } else {
+          emit(chunk.subarray(start, newline));
+        }
+        start = newline + 1;
+      }
+    },
+    flush() {
+      if (!parts.length) return;
+      const line = Buffer.concat(parts);
+      parts = [];
+      held = 0;
+      emit(line);
+    },
+  };
+}
+
 // ─── Forward Proxy (CONNECT method) ─────────────────────────────────────────
 
 // Bound connection setup separately from idle time: a peer can trickle bytes
@@ -458,7 +848,8 @@ function guardConnection(sockets, { readyEvents, connectTimeoutMs = 15000,
 }
 
 function createProxyServer({ ca = ensureCA(), hostCertificate = getHostCert,
-  connectTimeoutMs = 15000, idleTimeoutMs = 120000, sniffHosts = SNIFF_HOSTS } = {}) {
+  connectTimeoutMs = 15000, idleTimeoutMs = 120000, sniffHosts = SNIFF_HOSTS,
+  sniffSuffixes = SNIFF_HOST_SUFFIXES } = {}) {
   const dbg = DEBUG ? (...args) => console.log(...args) : () => {};
 
   const server = http.createServer((req, res) => {
@@ -473,7 +864,7 @@ function createProxyServer({ ca = ensureCA(), hostCertificate = getHostCert,
     const ts = () => new Date().toISOString().slice(11, 23);
     const [hostname, portStr] = req.url.split(':');
     const remotePort = parseInt(portStr) || 443;
-    const shouldSniff = sniffHosts.has(hostname);
+    const shouldSniff = shouldSniffHost(hostname, sniffHosts, sniffSuffixes);
     const { dispatchId, stepId } = extractDispatchInfo(req);
 
     dbg(`[${ts()}] CONNECT #${seq} ${hostname}:${remotePort} sniff=${shouldSniff} dispatch=${dispatchId || 'none'} step=${stepId || 'none'}`);
@@ -512,8 +903,11 @@ function createProxyServer({ ca = ensureCA(), hostCertificate = getHostCert,
     let tlsClientReady = false;
     tlsClient.on('secure', () => { tlsClientReady = true; dbg(`[${ts()}] #${seq} TLS-client handshake OK`); });
 
-    // Connect to real upstream
-    const tlsUpstream = tls.connect({ host: hostname, port: remotePort, servername: hostname });
+    // Connect to real upstream. SNI is only defined for host names, and Node
+    // rejects an IP-literal servername, so IP targets are connected without it.
+    const upstreamOptions = { host: hostname, port: remotePort };
+    if (!net.isIP(hostname)) upstreamOptions.servername = hostname;
+    const tlsUpstream = tls.connect(upstreamOptions);
 
     let tlsUpstreamReady = false;
     tlsUpstream.on('secureConnect', () => { tlsUpstreamReady = true; dbg(`[${ts()}] #${seq} TLS-upstream handshake OK → ${hostname}`); });
@@ -540,27 +934,31 @@ function createProxyServer({ ca = ensureCA(), hostCertificate = getHostCert,
       return text.includes('prompt_tokens') || text.includes('input_tokens');
     }
 
-    // lineBuffer accumulates complete lines; incomplete trailing data stays for next chunk
-    let lineRemainder = '';
-
-    function processLines(lines) {
-      // Extract ALL usage records from a batch of complete lines (not just the last one)
-      for (const line of lines.split('\n')) {
-        const trimmed = line.trim();
-        if (!trimmed) continue;
-        if (!hasUsageSignal(trimmed)) continue;
-        const buf = Buffer.from(trimmed, 'utf8');
-        const usage = extractUsageFromResponse(buf);
-        if (usage) {
-          usageCount++;
-          if (dispatchId) usage.dispatch_id = dispatchId;
-            if (stepId) usage.step_id = stepId;
-          appendUsage(usage);
-          console.log(`[${ts()}] #${seq} ✓ USAGE CAPTURED (#${usageCount}) credits=${usage.credits} model=${usage.model} in=${usage.input_tokens} out=${usage.output_tokens}`);
-        }
-      }
+    let lineCount = 0;
+
+    function processLine(line) {
+      const trimmed = line.trim();
+      if (!trimmed) return;
+      lineCount++;
+      if (!hasUsageSignal(trimmed)) return;
+      const usage = extractUsageFromResponse(Buffer.from(trimmed, 'utf8'));
+      if (!usage) return;
+      usageCount++;
+      if (dispatchId) usage.dispatch_id = dispatchId;
+      if (stepId) usage.step_id = stepId;
+      appendUsage(usage);
+      console.log(`[${ts()}] #${seq} ✓ USAGE CAPTURED (#${usageCount}) credits=${usage.credits} model=${usage.model} in=${usage.input_tokens} out=${usage.output_tokens}`);
     }
 
+    // The extractor removes HTTP framing and content-encoding before the
+    // scanner splits lines, so a compressed, chunked or keep-alive response
+    // still yields intact JSON lines.
+    const scanner = createLineScanner(processLine);
+    const extractor = createResponseExtractor({
+      onData: chunk => scanner.push(chunk),
+      onResponseEnd: () => scanner.flush(),
+    });
+
     tlsUpstream.on('data', (chunk) => {
       totalBytes += chunk.length;
       if (rawFd !== null) {
@@ -573,15 +971,7 @@ function createProxyServer({ ca = ensureCA(), hostCertificate = getHostCert,
         }
       }
       try {
-        const text = lineRemainder + chunk.toString('utf8');
-        const lastNL = text.lastIndexOf('\n');
-        if (lastNL === -1) {
-          lineRemainder = text.length > 65536 ? text.slice(-65536) : text;
-          return;
-        }
-        const complete = text.slice(0, lastNL);
-        lineRemainder = text.slice(lastNL + 1);
-        processLines(complete);
+        extractor.push(chunk);
       } catch (_) {}
     });
 
@@ -590,12 +980,14 @@ function createProxyServer({ ca = ensureCA(), hostCertificate = getHostCert,
     tlsClient.pipe(tlsUpstream);
 
     const cleanup = () => {
-      // Final extraction from any remaining data (lineRemainder may hold last line without trailing \n)
+      // Drain framing state, then scan any trailing data that lacked a newline.
+      try {
+        extractor.flush();
+      } catch (_) {}
       try {
-        if (lineRemainder) processLines(lineRemainder);
+        scanner.flush();
       } catch (_) {}
-      lineRemainder = '';
-      dbg(`[${ts()}] #${seq} CLOSED ${hostname} bytes=${totalBytes} usages=${usageCount} tlsClient=${tlsClientReady} tlsUpstream=${tlsUpstreamReady}`);
+      dbg(`[${ts()}] #${seq} CLOSED ${hostname} bytes=${totalBytes} usages=${usageCount} lines=${lineCount} responses=${extractor.responseCount} mode=${extractor.mode} raw=${extractor.sawRaw} encoding=${extractor.encoding || 'identity'} tlsClient=${tlsClientReady} tlsUpstream=${tlsUpstreamReady}`);
       if (rawFd !== null) { try { fs.closeSync(rawFd); } catch (_) {} rawFd = null; }
     };
 
@@ -626,6 +1018,7 @@ function startProxy(port) {
     console.log(`[token-proxy] CA cert: ${CA_CERT_PATH}`);
     console.log(`[token-proxy] Usage log: ${USAGE_LOG_PATH}`);
     console.log(`[token-proxy] Sniffing hosts: ${[...SNIFF_HOSTS].join(', ')}`);
+    console.log(`[token-proxy] Sniffing suffixes: ${SNIFF_HOST_SUFFIXES.join(', ')}`);
     if (diagWriter) console.log(`[token-proxy] Diag log: ${diagWriter.filePath}`);
   });
 
@@ -730,4 +1123,7 @@ if (require.main === module) {
 }
 
 module.exports = { extractUsageFromResponse, extractDispatchInfo, buildUsageRecord,
-  guardConnection, createProxyServer, createRotatingWriter, rawLogFileName, rawSliceFor, installDiagLog };
+  guardConnection, createProxyServer, createRotatingWriter, rawLogFileName, rawSliceFor, installDiagLog,
+  shouldSniffHost, createBodyDecoder, createResponseExtractor, createLineScanner,
+  ensureCA, getHostCert,
+  SNIFF_HOSTS, SNIFF_HOST_SUFFIXES, DEFAULT_MAX_LINE_BYTES };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autowonder",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "description": "AutoWonder local runtime — execute AI agent dispatch packages on your machine",
   "bin": {
     "autowonder": "bin/cli.js"