autowonder 0.3.24 → 0.3.26

package/README.md

@@ -6,10 +6,10 @@ AutoWonder 本地 agent runtime。安装后启动 daemon，持续轮询本地 as
 
 ```bash
 # Qoder CLI（模型使用 provider model ID；Context Window 使用固定档位）
-npx -y autowonder@0.3.24 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model qmodel_latest --reasoning-effort medium --context-window 260000
+npx -y autowonder@0.3.26 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model qmodel_latest --reasoning-effort medium --context-window 260000
 
 # Qoder CLI CN
-npx -y autowonder@0.3.24 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qodercn
+npx -y autowonder@0.3.26 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qodercn
 ```
 
 `connect` 会安装当前 npm 包内置的 daemon，并使用页面生成的 WebSocket endpoint、Token 和执行器 ID 建立连接。客户端只支持通过 Qoder 系列 CLI 启动（`qoder` 对应 `qodercli`，`qodercn` 对应 `qodercn`），其他 `--provider` 取值会在启动 daemon 前直接报错拦截并提示 `Unsupported provider`。选择 Qoder CLI 或 Qoder CLI CN 时需要 Node.js 20+；runtime 会在缺少对应 CLI 时自动通过 npm 安装，并在尚未登录时打开浏览器登录。runtime 会继承当前用户的 HOME、环境变量和 CLI 登录状态。
@@ -27,9 +27,9 @@ runtime 启动时始终只拉取一次 Platform 环境变量快照，即使已
 
 出于安全考虑，命令行 token 可能出现在 shell 历史和操作系统进程列表中，建议优先使用环境变量或 Platform 绑定。
 
-`connect` 和 `start` 都要求 Qoder CLI / Qoder CLI CN 版本至少为 `1.1.65`。检测到旧版或无法解析的版本时，runtime 会对当前优先选中的用户 CLI 执行内置 `update`，原位升级到最新版并再次强校验；升级失败或升级后仍不满足最低版本时拒绝启动 daemon。所有 Qoder 系列子进程（普通任务、conversation、warm 会话、恢复回退、命令与模型探测）都会强制注入固定的 `QODER_INTEGRATION_ID`，调用方环境不能覆盖该流量归因标识。
+`connect` 和 `start` 都要求 Qoder CLI / Qoder CLI CN 版本至少为 `1.1.65`。检测到旧版、无法解析的版本，或共享安装被其他进程的安装锁占用时，runtime 不再原位升级共享 CLI，而是安装到独立的私有 generation（`~/.autowonder/qoder-generations/<provider>/gen-*`）：先校验候选二进制版本，再原子发布 `current.json` 指向已验证的 generation，启动时直接使用该 generation 的具体路径。候选安装或校验失败不会被选中，上一代保留为回退；旧 generation 不自动删除。显式指定的外部可执行文件（`AUTOWONDER_QODER_CLI` / `AUTOWONDER_QODERCN_CLI`）在校验通过后仍直接使用，runtime 不会原地修改它。daemon 退出与 re-exec 前会取消并等待进行中的 Qoder 安装/升级维护任务，避免遗留共享安装票据让同机其他执行器的版本预检持续失败。所有 Qoder 系列子进程（普通任务、conversation、warm 会话、恢复回退、命令与模型探测）都会强制注入固定的 `QODER_INTEGRATION_ID`，调用方环境不能覆盖该流量归因标识。
 
-`qodercn` 是国内版 Qoder CLI。runtime 会在缺少 `qodercn` 时自动把 `@qodercn-ai/qoderclicn` 安装到 `~/.autowonder/qoder-cn-cli`，并在尚未登录时打开浏览器登录。它使用自己的配置根（`QODERCN_CONFIG_DIR`，默认 `~/.qoder-cn`），与国际版 `qoder` 不共享可执行文件、凭证和会话。可用 `AUTOWONDER_QODERCN_CLI` 指定自定义可执行文件路径。
+`qodercn` 是国内版 Qoder CLI。runtime 会在缺少 `qodercn` 时自动把 `@qodercn-ai/qoderclicn` 安装到独立 generation `~/.autowonder/qoder-generations/qodercn/`（旧版本写入的 `~/.autowonder/qoder-cn-cli` 安装仍会被识别），并在尚未登录时打开浏览器登录。它使用自己的配置根（`QODERCN_CONFIG_DIR`，默认 `~/.qoder-cn`），与国际版 `qoder` 不共享可执行文件、凭证和会话。可用 `AUTOWONDER_QODERCN_CLI` 指定自定义可执行文件路径。
 
 Qoder 的 Context Window 只能使用 `1000000`、`400000` 或 `260000`，Reasoning Effort 只能使用 `none`、`low`、`medium`、`high`、`xhigh` 或 `max`。`--model` 不再校验固定白名单：取值经 `AUTOWONDER_MODEL` 原样透传给 Qoder CLI，因此服务端上线新模型无需升级本客户端。建议直接复制 AutoWonder 执行器页面生成的命令，避免把模型展示名称误当成 provider model ID。
 
@@ -177,7 +177,7 @@ mv "$queue/.assignment.tmp" "$queue/assignment.json"
 也可以直接提交到本地 API：
 
 ```bash
-npx -y autowonder@0.3.24 dispatch ./assignment.json
+npx -y autowonder@0.3.26 dispatch ./assignment.json
 ```
 
 ## 上传工单附件
@@ -185,7 +185,7 @@ npx -y autowonder@0.3.24 dispatch ./assignment.json
 把本地需求/设计文档直接上传到工单，避免在会话里传递大文件：
 
 ```bash
-npx -y autowonder@0.3.24 workitem upload --server-url <autowonder-server-url> --workitem-id <id> --file <filepath-1> --file <filepath-2> --json
+npx -y autowonder@0.3.26 workitem upload --server-url <autowonder-server-url> --workitem-id <id> --file <filepath-1> --file <filepath-2> --json
 ```
 
 上传令牌通过 MCP 工具 `autowonder.workitem_cli_upload_token` 签发，经 `--token` 或 `AUTOWONDER_UPLOAD_TOKEN` 环境变量传入。`--file` 可重复指定多个文件；`--json` 输出机器可读结果。失败时按错误类型返回不同退出码（401→3、403→4、404→5、409→6、413→7、其他 4xx→8、网络/重定向→9）。
@@ -195,7 +195,7 @@ npx -y autowonder@0.3.24 workitem upload --server-url <autowonder-server-url> --
 把工单上已有的需求/设计文档下载到本地目录，再用本地文件工具阅读，避免把大文件或二进制附件搬进会话上下文：
 
 ```bash
-npx -y autowonder@0.3.24 workitem download --server-url <autowonder-server-url> --workitem-id <id> --file <name-or-id> --output-dir <dir> --json
+npx -y autowonder@0.3.26 workitem download --server-url <autowonder-server-url> --workitem-id <id> --file <name-or-id> --output-dir <dir> --json
 ```
 
 下载令牌通过 MCP 工具 `autowonder.workitem_cli_download_token` 签发（与上传令牌相互独立），经 `--token` 或 `AUTOWONDER_DOWNLOAD_TOKEN` 环境变量传入。`--file` 可重复指定文档名或 artifact id，省略则下载该工单的全部附件；`--output-dir` 默认为当前目录；`--json` 输出机器可读结果，含每个文件的 `id`、`name`、`path`、`size`。退出码约定与 `workitem upload` 相同（401→3、403→4、404→5、409→6、413→7、其他 4xx→8、网络/重定向→9）。
@@ -205,7 +205,7 @@ npx -y autowonder@0.3.24 workitem download --server-url <autowonder-server-url>
 把需求/设计文档上传到 7x24 定时任务，用法与工单附件一致（同一套上传令牌与预检规则）：
 
 ```bash
-npx -y autowonder@0.3.24 scheduled-task upload --server-url <autowonder-server-url> --scheduled-task-id <id> --file <filepath-1> --file <filepath-2> --json
+npx -y autowonder@0.3.26 scheduled-task upload --server-url <autowonder-server-url> --scheduled-task-id <id> --file <filepath-1> --file <filepath-2> --json
 ```
 
 上传令牌同样通过 `autowonder.workitem_cli_upload_token` 签发（令牌为用户级，对当前可修改的任意定时任务生效），经 `--token` 或 `AUTOWONDER_UPLOAD_TOKEN` 传入；退出码约定与 `workitem upload` 相同。
@@ -213,8 +213,8 @@ npx -y autowonder@0.3.24 scheduled-task upload --server-url <autowonder-server-u
 ## 管理 daemon
 
 ```bash
-npx -y autowonder@0.3.24 status
-npx -y autowonder@0.3.24 stop
+npx -y autowonder@0.3.26 status
+npx -y autowonder@0.3.26 stop
 ```
 
 默认 API 是 `http://127.0.0.1:34989`，日志位于 `~/.autowonder/daemon.log`。npm 包不包含任何 agent、MCP 或服务端凭证。
@@ -237,7 +237,7 @@ daemon 内置独立于工作区 GC 的保留清扫：默认每小时运行一次
 ## 调试
 
 ```bash
-npx -y autowonder@0.3.24 connect ... --debug
+npx -y autowonder@0.3.26 connect ... --debug
 ```
 
 `--debug` 会让 CLI 以 `AUTOWONDER_DEBUG=1` 启动 daemon，把完整的 daemon 与 agent 活动（runtime 事件流、provider 事件解码、重试退避与会话门等待、空闲时的阻塞点）同时输出到控制台和会话调试日志。调试日志不做脱敏，仅用于本机排障；不传 `--debug` 时该环境变量不会注入。

package/bin/qoder-bootstrap.js

@@ -5,6 +5,7 @@ const crypto = require("crypto");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
+const generations = require("./qoder-generations");
 
 const { ensureDir, error, findOnPath, log, resolveUserPath } = require("./shared");
 
@@ -260,6 +261,8 @@ function findQoderExecutable(provider) {
       error(`${profile.envVar} points at ${resolved}, which is not executable; falling back to PATH.`);
     }
   }
+  const managed = generations.current(generationOptions(profile));
+  if (managed) return managed;
   const onPath = findOnPath(profile.executable);
   if (onPath) return onPath;
   if (IS_WIN32) {
@@ -284,22 +287,38 @@ function managedQoderExecutable(profile) {
   return path.join(qoderPaths(profile).managedDir, "node_modules", ".bin", binName);
 }
 
+function generationOptions(profile) {
+  const provider = profile === QODER_FAMILY_PROFILES.qodercn ? "qodercn" : "qoder";
+  return {
+    root: path.join(os.homedir(), ".autowonder", "qoder-generations", provider),
+    executable: IS_WIN32 ? profile.windowsShimName : profile.managedBinName,
+    verify: (bin) => qoderVersionMeetsMinimum(probeQoderVersionUntil(profile, bin,
+      (probe) => qoderVersionMeetsMinimum(probe.version)).version),
+  };
+}
+
 function installQoderCLI(provider, options = {}) {
   const profile = QODER_FAMILY_PROFILES[provider];
-  if (options.lockHeld) return installQoderCLIUnlocked(provider);
-  const result = withQoderUpdateLock(managedQoderExecutable(profile), () => {
-    if (options.skipIfPresent) {
-      const existing = findQoderExecutable(provider);
-      if (existing) return existing;
-    }
-    return installQoderCLIUnlocked(provider);
-  });
-  return result || "";
+  if (options.skipIfPresent) {
+    const current = generations.current(generationOptions(profile));
+    if (current) return current;
+  }
+  return installQoderCLIUnlocked(provider);
 }
 
 function installQoderCLIUnlocked(provider) {
   const profile = QODER_FAMILY_PROFILES[provider];
-  const managedDir = qoderPaths(profile).managedDir;
+  try {
+    return generations.install({ ...generationOptions(profile),
+      install: (prefix) => installQoderPackage(profile, prefix),
+    });
+  } catch (err) {
+    error(`${profile.displayName} requires version 1.1.65 or newer: ${err.message}`);
+    return "";
+  }
+}
+
+function installQoderPackage(profile, managedDir) {
   log(`${profile.displayName} is not installed. Installing ${profile.npmPackage}...`);
   const args = [
     "install", "--prefix", managedDir, profile.npmPackage, "--no-audit", "--no-fund",
@@ -332,9 +351,7 @@ function installQoderCLIUnlocked(provider) {
     error(`Failed to install ${profile.displayName} into ${managedDir}: ${detail}`);
     return "";
   }
-  const executable = findQoderExecutable(provider);
-  if (!executable) error(`${profile.displayName} was installed but ${profile.executable} is not available on PATH.`);
-  return executable;
+  return true;
 }
 
 const MACHINE_ID_REL_PATH = path.join(".auth", "machine_id");
@@ -619,10 +636,10 @@ function validateQoderLockTickets(tickets) {
   }
 }
 
-function withQoderUpdateLock(executable, fn) {
+function withQoderUpdateLock(executable, fn, timeoutMs = 15 * 60 * 1000) {
   const lockPaths = qoderUpdateLockPaths(executable);
   fs.mkdirSync(path.dirname(lockPaths[0]), { recursive: true, mode: 0o700 });
-  const deadline = Date.now() + 15 * 60 * 1000;
+  const deadline = Date.now() + timeoutMs;
   const owner = { pid: process.pid, token: crypto.randomBytes(16).toString("hex") };
   const acquired = [];
   let failure = null;
@@ -676,48 +693,39 @@ function withQoderUpdateLock(executable, fn) {
 }
 
 function ensureMinimumQoderVersion(profile, provider, executable) {
-  const result = withQoderUpdateLock(executable, () => ensureMinimumQoderVersionLocked(profile, provider, executable));
-  return result || { ok: false, version: "unknown", executable };
-}
-
-function ensureMinimumQoderVersionLocked(profile, provider, executable) {
-  let probe = probeQoderBinaryVersion(executable);
-  if (isTransientQoderVersionProbe(probe)) {
-    // An up-to-date CLI answers nothing far more often than it is really too
-    // old, so confirm the failure before paying for a download.
-    log(`${profile.displayName} did not report a version on the first probe (${describeQoderVersionProbe(probe)}); re-probing before updating...`);
-    probe = probeQoderVersionUntil(profile, executable, (candidate) => candidate.outcome === "ok", probe);
-  }
-  if (qoderVersionMeetsMinimum(probe.version)) return { ok: true, version: probe.version };
-
-  log(`${profile.displayName} ${probe.version} is older than required version 1.1.65 (or could not be parsed). Updating the current installation to latest...`);
-  const update = spawnQoderSync(executable, ["update"], { stdio: "inherit", timeout: 5 * 60 * 1000, treeTimeout: true });
-  if (update.status !== 0) {
-    const managedDir = qoderPaths(profile).managedDir;
-    if (executable.startsWith(`${managedDir}${path.sep}`)) {
-      const reinstalled = installQoderCLI(provider, { lockHeld: true });
-      if (reinstalled) {
-        executable = reinstalled;
-        probe = probeQoderVersionUntil(profile, executable, (candidate) => qoderVersionMeetsMinimum(candidate.version));
-        if (qoderVersionMeetsMinimum(probe.version)) return { ok: true, version: probe.version, executable };
-      }
+  const opts = generationOptions(profile);
+  let probe;
+  const inspect = () => {
+    probe = probeQoderBinaryVersion(executable);
+    if (isTransientQoderVersionProbe(probe)) {
+      log(`${profile.displayName} did not report a version; re-probing before selecting another installation...`);
+      probe = probeQoderVersionUntil(profile, executable, (candidate) => candidate.outcome === "ok", probe);
     }
-    const detail = update.error?.message || (update.signal ? `signal ${update.signal}` : `exit status ${update.status}`);
-    error(`${profile.displayName} requires version 1.1.65 or newer, but updating ${executable} failed: ${detail}`);
-    reportQoderVersionProbe(probe);
-    return { ok: false, version: probe.version, executable };
-  }
-
-  // The update reported success; give the installation the bounded schedule to
-  // start answering with the version it just installed.
-  probe = probeQoderVersionUntil(profile, executable, (candidate) => qoderVersionMeetsMinimum(candidate.version));
-  if (!qoderVersionMeetsMinimum(probe.version)) {
-    error(`${profile.displayName} requires version 1.1.65 or newer, but ${executable} reports ${probe.version} after updating to latest.`);
+    return qoderVersionMeetsMinimum(probe.version) ? { ok: true, version: probe.version, executable } : null;
+  };
+  // Known private generations have no in-place writer in this protocol.
+  // External installations still coordinate with legacy writers. Never delete
+  // their tickets: a blocked installation can only be replaced by a new prefix.
+  let verified;
+  try {
+    verified = generations.contains(opts, executable) ? inspect()
+      : withQoderUpdateLock(executable, inspect, 2000);
+  } catch (err) {
+    log(`Shared Qoder installation is unavailable (${err.message}); selecting a separate generation.`);
+  }
+  if (verified) return verified;
+  let selected = generations.current(opts);
+  if (!selected && probe && probe.outcome !== "ok"
+      && !executable.startsWith(`${qoderPaths(profile).managedDir}${path.sep}`)
+      && !generations.contains(opts, executable)) {
+    error(`${profile.displayName} requires version 1.1.65 or newer; version probe failed without evidence of an old version.`);
     reportQoderVersionProbe(probe);
     return { ok: false, version: probe.version, executable };
   }
-  log(`${profile.displayName} updated in place to ${probe.version}.`);
-  return { ok: true, version: probe.version, executable };
+  if (!selected) selected = installQoderCLI(provider);
+  if (!selected) return { ok: false, version: probe?.version || "unknown", executable };
+  const finalProbe = probeQoderVersionUntil(profile, selected, (p) => qoderVersionMeetsMinimum(p.version));
+  return { ok: qoderVersionMeetsMinimum(finalProbe.version), version: finalProbe.version, executable: selected };
 }
 
 // A missing or unreadable record means "no history", never a bootstrap failure.
@@ -1130,7 +1138,7 @@ async function ensureQoderReady(provider, options = {}) {
     return false;
   }
 
-  const managedCopy = executable.startsWith(`${paths.managedDir}${path.sep}`);
+  const managedCopy = generations.contains(generationOptions(profile), executable) || executable.startsWith(`${paths.managedDir}${path.sep}`);
 
   // B — a managed copy that cannot run at all gets refreshed once.
   if (verdict.state === "cli_unusable" && managedCopy && !refreshed) {

package/bin/qoder-generations.js

@@ -0,0 +1,79 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+// Schema and directory layout are shared with pkg/agent/qoder_install.go.
+const GENERATION = /^gen-[a-zA-Z0-9_-]+$/;
+
+function readPointer(root) {
+  try {
+    const pointer = JSON.parse(fs.readFileSync(path.join(root, "current.json"), "utf8"));
+    return pointer.schema === 1 ? pointer : {};
+  } catch { return {}; }
+}
+
+function executablePath(root, generation, executable) {
+  if (typeof generation !== "string" || !GENERATION.test(generation)) return "";
+  try {
+    const dir = path.join(root, generation);
+    const stat = fs.lstatSync(dir);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) return "";
+    const bin = path.join(dir, "node_modules", ".bin", executable);
+    const relative = path.relative(fs.realpathSync(dir), fs.realpathSync(bin));
+    if (path.isAbsolute(relative) || relative === ".." || relative.startsWith(`..${path.sep}`)) return "";
+    return bin;
+  } catch { return ""; }
+}
+
+function current({ root, executable, verify }) {
+  const pointer = readPointer(root);
+  for (const generation of [pointer.generation, pointer.previous]) {
+    const bin = executablePath(root, generation, executable);
+    if (bin && verify(bin)) return bin;
+  }
+  return "";
+}
+
+function contains({ root, executable }, bin) {
+  const parts = path.relative(root, bin).split(path.sep);
+  return parts.length === 4 && executablePath(root, parts[0], executable) === bin;
+}
+
+function install({ root, executable, install: runInstall, verify }) {
+  fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+  const prefix = fs.mkdtempSync(path.join(root, "gen-"));
+  // Failure leaves an unselected directory. Never race a surviving npm helper
+  // by deleting its prefix; the next install owns a different directory.
+  if (!runInstall(prefix, executable)) {
+    throw new Error("private Qoder installation failed; previous generation retained");
+  }
+  const generation = path.basename(prefix);
+  const bin = executablePath(root, generation, executable);
+  if (!bin || !verify(bin)) {
+    throw new Error("private Qoder generation failed version verification; previous generation retained");
+  }
+  const previous = readPointer(root).generation;
+  const pointer = { schema: 1, generation };
+  if (typeof previous === "string" && GENERATION.test(previous)) pointer.previous = previous;
+  const tmp = path.join(root, `.current-${generation}`);
+  const fd = fs.openSync(tmp, "wx", 0o600);
+  try {
+    fs.writeFileSync(fd, JSON.stringify(pointer));
+    fs.fsyncSync(fd);
+  } finally { fs.closeSync(fd); }
+  try {
+    fs.renameSync(tmp, path.join(root, "current.json"));
+  } finally {
+    try { fs.unlinkSync(tmp); } catch {}
+  }
+  // Windows rename has platform-specific durability; the executable is always
+  // verified again on read, so a lost pointer after power loss triggers retry.
+  if (process.platform !== "win32") {
+    const directory = fs.openSync(root, "r");
+    try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); }
+  }
+  return bin;
+}
+
+module.exports = { current, install, contains, executablePath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autowonder",
-  "version": "0.3.24",
+  "version": "0.3.26",
   "description": "AutoWonder local runtime — execute AI agent dispatch packages on your machine",
   "bin": {
     "autowonder": "bin/cli.js"