autowonder 0.3.8 → 0.3.10

package/README.md

@@ -6,10 +6,10 @@ AutoWonder 本地 agent runtime。安装后启动 daemon，持续轮询本地 as
 
 ```bash
 # Qoder CLI（模型使用 provider model ID；Context Window 使用固定档位）
-npx -y autowonder@0.3.8 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model qmodel_latest --reasoning-effort medium --context-window 260000
+npx -y autowonder@0.3.10 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qoder --model qmodel_latest --reasoning-effort medium --context-window 260000
 
 # Qoder CLI CN
-npx -y autowonder@0.3.8 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qodercn
+npx -y autowonder@0.3.10 connect --ws-url <wss-endpoint> --token <executor-token> --executor-id <executor-id> --provider qodercn
 ```
 
 `connect` 会安装当前 npm 包内置的 daemon，并使用页面生成的 WebSocket endpoint、Token 和执行器 ID 建立连接。客户端只支持通过 Qoder 系列 CLI 启动（`qoder` 对应 `qodercli`，`qodercn` 对应 `qodercn`），其他 `--provider` 取值会在启动 daemon 前直接报错拦截并提示 `Unsupported provider`。选择 Qoder CLI 或 Qoder CLI CN 时需要 Node.js 20+；runtime 会在缺少对应 CLI 时自动通过 npm 安装，并在尚未登录时打开浏览器登录。runtime 会继承当前用户的 HOME、环境变量和 CLI 登录状态。
@@ -35,6 +35,8 @@ Qoder 的 Context Window 只能使用 `1000000`、`400000` 或 `260000`，Reason
 
 daemon 会响应服务端的 `QODER_MODEL_CATALOG_REQUEST` 帧，用当前 provider 对应的本机 Qoder CLI 发现可用模型目录，只回传 `{id, name}`，让执行器页面展示这台机器真实可选的模型。该请求仅在 `executorId` 与 `provider` 都与本机一致时处理，发现超时 20 秒，并发请求合并为一次发现，`qoder` 与 `qodercn` 的发现互相隔离、不共享配置根。
 
+daemon 还在协议能力位里声明 `TASK_MODEL_SELECTION_V1`：服务端可在派单帧中附带任务级模型选择（`modelSelection`，含目标模型、条目计数与阈值、策略版本、原因码）。runtime 只对本次派单应用该模型（覆盖派单原有的 model 取值，不修改执行器保存的默认配置），并在开始执行时把 `dispatchId`、选中模型与原因写入 daemon 日志，便于回溯某个任务因何被升级到另一个模型。该能力对执行机用户无新增参数或环境变量。
+
 daemon 还会响应服务端的 `CONVERSATION_COMMANDS_PROBE` 帧，用独立会话抓取该会话工作目录下可用的斜杠命令，回传 `CONVERSATION_COMMANDS_RESULT` 帧，让会话面板在用户输入 `/` 时列出真实可用的命令。该探测与回合执行完全隔离：任何失败只产生 `FAILED` / `TIMEOUT` 帧，不影响进行中的会话；provider 后端不支持抓取时同样降级为 `FAILED` 帧。帧里的 `executorId` 与本机不一致或非正数时直接忽略，避免在别的执行器工作区里建目录或启动 CLI。daemon 侧给整个探测 25 秒硬上限，刻意长于 agent 侧的 20 秒预算，使 agent 自己的超时先触发并可被归类。
 
 给 `connect` 追加 `--token-aware-enable` 可开启 qoder / qodercn 的 token 用量采集：CLI 会以 sidecar 方式启动本地 HTTPS 转发代理（`bin/token-proxy.js`），从 Qoder API 的 SSE 响应流中提取 usage 数据并按 dispatch ID 归属上报。usage 解析失败只丢失计量数据；代理启动失败时仅告警并继续。启用后模型流量经过代理，连接失败由客户端处理重试，不保证自动直连。代理端口可用 `TOKEN_PROXY_PORT` 环境变量调整（默认 19876）；CA 证书位于 `~/.autowonder/token-tap/ca-cert.pem`。daemon 退出时 sidecar 一并停止。代理对 TCP 建连和两端 TLS 握手设置 15 秒期限，对无读写活动的连接设置 120 秒空闲期限；超时、报错或任一端关闭时释放两端连接。持续有数据的 SSE 流不受总时长限制，连续静默超过 120 秒的流会断开。
@@ -158,7 +160,7 @@ mv "$queue/.assignment.tmp" "$queue/assignment.json"
 也可以直接提交到本地 API：
 
 ```bash
-npx -y autowonder@0.3.8 dispatch ./assignment.json
+npx -y autowonder@0.3.10 dispatch ./assignment.json
 ```
 
 ## 上传工单附件
@@ -166,7 +168,7 @@ npx -y autowonder@0.3.8 dispatch ./assignment.json
 把本地需求/设计文档直接上传到工单，避免在会话里传递大文件：
 
 ```bash
-npx -y autowonder@0.3.8 workitem upload --server-url <autowonder-server-url> --workitem-id <id> --file <filepath-1> --file <filepath-2> --json
+npx -y autowonder@0.3.10 workitem upload --server-url <autowonder-server-url> --workitem-id <id> --file <filepath-1> --file <filepath-2> --json
 ```
 
 上传令牌通过 MCP 工具 `autowonder.workitem_cli_upload_token` 签发，经 `--token` 或 `AUTOWONDER_UPLOAD_TOKEN` 环境变量传入。`--file` 可重复指定多个文件；`--json` 输出机器可读结果。失败时按错误类型返回不同退出码（401→3、403→4、404→5、409→6、413→7、其他 4xx→8、网络/重定向→9）。
@@ -176,7 +178,7 @@ npx -y autowonder@0.3.8 workitem upload --server-url <autowonder-server-url> --w
 把工单上已有的需求/设计文档下载到本地目录，再用本地文件工具阅读，避免把大文件或二进制附件搬进会话上下文：
 
 ```bash
-npx -y autowonder@0.3.8 workitem download --server-url <autowonder-server-url> --workitem-id <id> --file <name-or-id> --output-dir <dir> --json
+npx -y autowonder@0.3.10 workitem download --server-url <autowonder-server-url> --workitem-id <id> --file <name-or-id> --output-dir <dir> --json
 ```
 
 下载令牌通过 MCP 工具 `autowonder.workitem_cli_download_token` 签发（与上传令牌相互独立），经 `--token` 或 `AUTOWONDER_DOWNLOAD_TOKEN` 环境变量传入。`--file` 可重复指定文档名或 artifact id，省略则下载该工单的全部附件；`--output-dir` 默认为当前目录；`--json` 输出机器可读结果，含每个文件的 `id`、`name`、`path`、`size`。退出码约定与 `workitem upload` 相同（401→3、403→4、404→5、409→6、413→7、其他 4xx→8、网络/重定向→9）。
@@ -186,7 +188,7 @@ npx -y autowonder@0.3.8 workitem download --server-url <autowonder-server-url> -
 把需求/设计文档上传到 7x24 定时任务，用法与工单附件一致（同一套上传令牌与预检规则）：
 
 ```bash
-npx -y autowonder@0.3.8 scheduled-task upload --server-url <autowonder-server-url> --scheduled-task-id <id> --file <filepath-1> --file <filepath-2> --json
+npx -y autowonder@0.3.10 scheduled-task upload --server-url <autowonder-server-url> --scheduled-task-id <id> --file <filepath-1> --file <filepath-2> --json
 ```
 
 上传令牌同样通过 `autowonder.workitem_cli_upload_token` 签发（令牌为用户级，对当前可修改的任意定时任务生效），经 `--token` 或 `AUTOWONDER_UPLOAD_TOKEN` 传入；退出码约定与 `workitem upload` 相同。
@@ -194,8 +196,8 @@ npx -y autowonder@0.3.8 scheduled-task upload --server-url <autowonder-server-ur
 ## 管理 daemon
 
 ```bash
-npx -y autowonder@0.3.8 status
-npx -y autowonder@0.3.8 stop
+npx -y autowonder@0.3.10 status
+npx -y autowonder@0.3.10 stop
 ```
 
 默认 API 是 `http://127.0.0.1:34989`，日志位于 `~/.autowonder/daemon.log`。npm 包不包含任何 agent、MCP 或服务端凭证。
@@ -203,7 +205,7 @@ npx -y autowonder@0.3.8 stop
 ## 调试
 
 ```bash
-npx -y autowonder@0.3.8 connect ... --debug
+npx -y autowonder@0.3.10 connect ... --debug
 ```
 
 `--debug` 会让 CLI 以 `AUTOWONDER_DEBUG=1` 启动 daemon，把完整的 daemon 与 agent 活动（runtime 事件流、provider 事件解码、重试退避与会话门等待、空闲时的阻塞点）同时输出到控制台和会话调试日志。调试日志不做脱敏，仅用于本机排障；不传 `--debug` 时该环境变量不会注入。

package/bin/cli.js

@@ -1051,10 +1051,14 @@ function parseFlags(args, knownFlags) {
 
 function ensureWindowsUTF8() {
   if (process.platform !== "win32") return;
-  const result = spawnSync("chcp", [], { shell: true, encoding: "utf8", timeout: 2000 });
+  // chcp is a .com console tool and CreateProcess resolves no PATHEXT, so it is
+  // addressed by full path. shell:true would join the code page into a cmd.exe
+  // command line instead, which is what emits Node's DEP0190 warning.
+  const chcp = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "chcp.com");
+  const result = spawnSync(chcp, [], { encoding: "utf8", timeout: 2000 });
   const currentCP = (result.stdout || "").match(/:\s*(\d+)/)?.[1];
   if (currentCP !== "65001") {
-    spawnSync("chcp", ["65001"], { shell: true, stdio: "ignore" });
+    spawnSync(chcp, ["65001"], { stdio: "ignore" });
   }
   process.env.PYTHONIOENCODING = process.env.PYTHONIOENCODING || "utf-8";
   process.env.PYTHONUTF8 = process.env.PYTHONUTF8 || "1";

package/bin/qoder-bootstrap.js

@@ -340,23 +340,136 @@ function installQoderCLIUnlocked(provider) {
 const MACHINE_ID_REL_PATH = path.join(".auth", "machine_id");
 const CREDENTIAL_REL_PATH = path.join(".auth", "user");
 
-function qoderBinaryVersion(executable, options = {}) {
-  if ((path.isAbsolute(executable) || executable.includes(path.sep)) && !fs.existsSync(executable)) return "missing";
+// Both tree runners report a timeout as exit code 124, so a bound probe stays
+// distinguishable from a CLI that really failed to start.
+const QODER_PROBE_TIMEOUT_STATUS = 124;
+const QODER_PROBE_OUTPUT_LIMIT = 1000;
+
+function classifyQoderVersionProbe(result) {
+  if (result.error) {
+    if (result.error.code === "ENOENT") return "missing";
+    if (result.error.code === "ETIMEDOUT") return "timeout";
+    return "spawn_failed";
+  }
+  if (result.signal) return "failed";
+  if (result.status === null || result.status === undefined) return "timeout";
+  if (result.status === QODER_PROBE_TIMEOUT_STATUS) return "timeout";
+  if (result.status !== 0) return "failed";
+  return "unparseable";
+}
+
+// The probe keeps the raw evidence of the invocation so a permanent failure can
+// be told apart from a transient one, and so the operator sees exit code,
+// signal, spawn error and output instead of a single opaque "unknown".
+function probeQoderBinaryVersion(executable, options = {}) {
+  const absent = (path.isAbsolute(executable) || executable.includes(path.sep)) && !fs.existsSync(executable);
+  const probe = {
+    executable,
+    version: absent ? "missing" : "unknown",
+    outcome: absent ? "missing" : "failed",
+    status: null,
+    signal: null,
+    spawnError: "",
+    stdout: "",
+    stderr: "",
+  };
+  if (absent) return probe;
   const result = spawnQoderSync(executable, ["--version"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: options.timeout || 20000,
     treeTimeout: true,
   });
+  probe.status = result.status === undefined ? null : result.status;
+  probe.signal = result.signal || null;
+  probe.spawnError = result.error
+    ? `${result.error.code ? `${result.error.code}: ` : ""}${result.error.message}`
+    : "";
+  probe.stdout = result.stdout || "";
+  probe.stderr = result.stderr || "";
+  probe.outcome = classifyQoderVersionProbe(result);
   // "missing" means the file itself is absent; "unknown" means the file is
   // there but produced no version, so the two failure classes never collapse
   // into one misleading answer.
-  if (result.error && result.error.code === "ENOENT") return "missing";
-  if (result.status !== 0) return "unknown";
-  // Accept only an unambiguous Qoder version line. Runtime warnings and update
-  // banners often contain unrelated/newer semvers and must never satisfy the
-  // minimum gate for an old executable.
-  return qoderVersionLine(`${result.stdout || ""}\n${result.stderr || ""}`) || "unknown";
+  if (probe.outcome === "missing") probe.version = "missing";
+  // Accept only an unambiguous Qoder version line, and only from a probe that
+  // exited zero. Runtime warnings and update banners often contain
+  // unrelated/newer semvers and must never satisfy the minimum gate for an old
+  // executable.
+  if (probe.outcome === "unparseable") {
+    const line = qoderVersionLine(`${probe.stdout}\n${probe.stderr}`);
+    if (line) {
+      probe.version = line;
+      probe.outcome = "ok";
+    }
+  }
+  return probe;
+}
+
+function qoderBinaryVersion(executable, options = {}) {
+  return probeQoderBinaryVersion(executable, options).version;
+}
+
+// "missing" is a definitive filesystem answer. Every other non-ok outcome can
+// be a one-off glitch (first run, a short-lived file lock, a slow antivirus),
+// which is exactly the field failure this retry exists for.
+function isTransientQoderVersionProbe(probe) {
+  return probe.outcome !== "ok" && probe.outcome !== "missing";
+}
+
+// A single probe must not be trusted on its own: a CLI that is already up to
+// date can answer nothing while its installation settles, and a just-updated
+// CLI can need a moment before it reports the version it just installed.
+// Re-probe on this bounded schedule instead of acting on one transient answer.
+const QODER_VERSION_RETRY_DELAYS_MS = [300, 1000, 2000];
+
+function qoderVersionRetryDelays() {
+  if (process.env.NODE_ENV === "test" && process.env.AUTOWONDER_TEST_QODER_VERSION_RETRY_DELAY_MS) {
+    const override = Number.parseInt(process.env.AUTOWONDER_TEST_QODER_VERSION_RETRY_DELAY_MS, 10);
+    if (Number.isFinite(override) && override >= 0) return QODER_VERSION_RETRY_DELAYS_MS.map(() => override);
+  }
+  return QODER_VERSION_RETRY_DELAYS_MS;
+}
+
+// The bootstrap runs before any event-loop work, so the wait blocks exactly
+// like the update lock's own queue does.
+function sleepMs(milliseconds) {
+  if (milliseconds > 0) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+
+function describeQoderVersionProbe(probe) {
+  const status = probe.status === null ? "none" : probe.status;
+  return `version ${probe.version}, outcome ${probe.outcome}, exit code ${status}, signal ${probe.signal || "none"}, spawn error ${probe.spawnError || "none"}`;
+}
+
+// A chatty or hostile CLI must not be able to flood the operator's log.
+function boundedQoderProbeOutput(text) {
+  const value = String(text || "").replace(/\s+/g, " ").trim();
+  if (!value) return "<empty>";
+  if (value.length <= QODER_PROBE_OUTPUT_LIMIT) return value;
+  return `${value.slice(0, QODER_PROBE_OUTPUT_LIMIT)}... (${value.length} characters total)`;
+}
+
+function reportQoderVersionProbe(probe) {
+  error(`probe outcome   : ${probe.outcome}`);
+  error(`probe exit code : ${probe.status === null ? "none" : probe.status}`);
+  error(`probe signal    : ${probe.signal || "none"}`);
+  error(`probe spawn err : ${probe.spawnError || "none"}`);
+  error(`probe stdout    : ${boundedQoderProbeOutput(probe.stdout)}`);
+  error(`probe stderr    : ${boundedQoderProbeOutput(probe.stderr)}`);
+}
+
+// Re-probes until `accept` is satisfied or the bounded schedule is spent,
+// reusing `initialProbe` when the caller has already probed once.
+function probeQoderVersionUntil(profile, executable, accept, initialProbe) {
+  let probe = initialProbe || probeQoderBinaryVersion(executable);
+  const delays = qoderVersionRetryDelays();
+  for (let step = 0; step < delays.length && !accept(probe); step += 1) {
+    log(`${profile.displayName} version probe did not settle (${describeQoderVersionProbe(probe)}); re-probing in ${delays[step]}ms...`);
+    sleepMs(delays[step]);
+    probe = probeQoderBinaryVersion(executable);
+  }
+  return probe;
 }
 
 function qoderVersionLine(output) {
@@ -568,10 +681,16 @@ function ensureMinimumQoderVersion(profile, provider, executable) {
 }
 
 function ensureMinimumQoderVersionLocked(profile, provider, executable) {
-  let version = qoderBinaryVersion(executable);
-  if (qoderVersionMeetsMinimum(version)) return { ok: true, version };
+  let probe = probeQoderBinaryVersion(executable);
+  if (isTransientQoderVersionProbe(probe)) {
+    // An up-to-date CLI answers nothing far more often than it is really too
+    // old, so confirm the failure before paying for a download.
+    log(`${profile.displayName} did not report a version on the first probe (${describeQoderVersionProbe(probe)}); re-probing before updating...`);
+    probe = probeQoderVersionUntil(profile, executable, (candidate) => candidate.outcome === "ok", probe);
+  }
+  if (qoderVersionMeetsMinimum(probe.version)) return { ok: true, version: probe.version };
 
-  log(`${profile.displayName} ${version} is older than required version 1.1.50 (or could not be parsed). Updating the current installation to latest...`);
+  log(`${profile.displayName} ${probe.version} is older than required version 1.1.50 (or could not be parsed). Updating the current installation to latest...`);
   const update = spawnQoderSync(executable, ["update"], { stdio: "inherit", timeout: 5 * 60 * 1000, treeTimeout: true });
   if (update.status !== 0) {
     const managedDir = qoderPaths(profile).managedDir;
@@ -579,22 +698,26 @@ function ensureMinimumQoderVersionLocked(profile, provider, executable) {
       const reinstalled = installQoderCLI(provider, { lockHeld: true });
       if (reinstalled) {
         executable = reinstalled;
-        version = qoderBinaryVersion(executable);
-        if (qoderVersionMeetsMinimum(version)) return { ok: true, version, executable };
+        probe = probeQoderVersionUntil(profile, executable, (candidate) => qoderVersionMeetsMinimum(candidate.version));
+        if (qoderVersionMeetsMinimum(probe.version)) return { ok: true, version: probe.version, executable };
       }
     }
     const detail = update.error?.message || (update.signal ? `signal ${update.signal}` : `exit status ${update.status}`);
     error(`${profile.displayName} requires version 1.1.50 or newer, but updating ${executable} failed: ${detail}`);
-    return { ok: false, version, executable };
+    reportQoderVersionProbe(probe);
+    return { ok: false, version: probe.version, executable };
   }
 
-  version = qoderBinaryVersion(executable);
-  if (!qoderVersionMeetsMinimum(version)) {
-    error(`${profile.displayName} requires version 1.1.50 or newer, but ${executable} reports ${version} after updating to latest.`);
-    return { ok: false, version, executable };
+  // The update reported success; give the installation the bounded schedule to
+  // start answering with the version it just installed.
+  probe = probeQoderVersionUntil(profile, executable, (candidate) => qoderVersionMeetsMinimum(candidate.version));
+  if (!qoderVersionMeetsMinimum(probe.version)) {
+    error(`${profile.displayName} requires version 1.1.50 or newer, but ${executable} reports ${probe.version} after updating to latest.`);
+    reportQoderVersionProbe(probe);
+    return { ok: false, version: probe.version, executable };
   }
-  log(`${profile.displayName} updated in place to ${version}.`);
-  return { ok: true, version, executable };
+  log(`${profile.displayName} updated in place to ${probe.version}.`);
+  return { ok: true, version: probe.version, executable };
 }
 
 // A missing or unreadable record means "no history", never a bootstrap failure.
@@ -1088,6 +1211,8 @@ async function ensureQoderReady(provider, options = {}) {
 
 module.exports = {
   QODER_FAMILY_PROFILES,
+  QODER_VERSION_RETRY_DELAYS_MS,
+  classifyQoderVersionProbe,
   ensureMinimumQoderVersion,
   ensureQoderReady,
   findInInstallDirs,
@@ -1096,6 +1221,7 @@ module.exports = {
   inspectQoderHealth,
   installQoderCLIUnlocked,
   isQoderFamilyProvider,
+  probeQoderBinaryVersion,
   qoderBinaryVersion,
   qoderChildEnv,
   qoderUpdateLockPaths,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autowonder",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "AutoWonder local runtime — execute AI agent dispatch packages on your machine",
   "bin": {
     "autowonder": "bin/cli.js"