coding-tool-x 3.8.2 → 3.8.4

package/CHANGELOG.md

@@ -6,6 +6,9 @@
 
 ## [Unreleased]
 
+### Security
+- **依赖安全升级** - adm-zip 升至 0.6.0（GHSA-xcpc-8h2w-3j85）、js-yaml 升至 4.3.1（GHSA-h67p-54hq-rp68 / GHSA-52cp-r559-cp3m / GHSA-5p4m-2wfm-xmqj）、pm2 升至 7.0.3（GHSA-x5gf-qvw8-r2rm），overrides 同步更新 basic-ftp / qs / systeminformation / js-yaml；`npm audit` 报告归零
+
 ### Fixed
 - **Claude / Gemini 原生 wire 兼容** - OpenCode Claude / Gemini 代理、模型探测和测速统一使用 Anthropic Messages 与 Google Generative AI（含 Gemini CLI）原生请求格式、认证头与目标 URL；OMP managed provider 写入 `anthropic-messages` / `google-generative-ai` 标识，避免代理、adapter 与探测各自维护不一致的请求格式
 - **OMP Codex Responses 路径兼容** - managed gateway 将 OMP 原生 `openai-codex-responses` 的 `/codex/responses` 请求映射到 OpenAI-compatible 渠道的 `/v1/responses`，避免 Codex-only 服务返回 HTTP 404

package/docs/superpowers/plans/2026-08-13-omp-restart-recovery.md

@@ -0,0 +1,48 @@
+# OMP Restart Recovery Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Preserve OMP dynamic-provider state during process shutdown and allow `ctx start` to restore the gateway after `ctx stop`.
+
+**Architecture:** Add an explicit `preserveManagedMode` option to the OMP gateway lifecycle. Explicit OMP stop and foreground UI exit keep the current direct-channel handoff; the PM2 daemon process drains only the local gateway and leaves the persisted managed state for boot recovery. Increase PM2's graceful shutdown window.
+
+**Tech Stack:** Node.js, PM2, Vitest, CommonJS.
+
+---
+
+### Task 1: Add the failing OMP lifecycle regression test
+
+**Files:**
+- Modify: `tests/unit/services/omp-proxy-server.test.js`
+
+- [ ] Add a test asserting `stopOmpProxyServer({ preserveManagedMode: true })` stops the gateway without calling `activateStaticOmpChannel`, `disableManagedOmpProviders`, or `disableManagedOmpMode`.
+- [ ] Run the focused test and confirm it fails because the option is not implemented.
+
+### Task 2: Implement restart-safe OMP shutdown
+
+**Files:**
+- Modify: `src/server/omp-proxy-server.js`
+- Modify: `src/index.js`
+
+- [ ] Branch the stop operation on `preserveManagedMode` while retaining the existing default handoff path.
+- [ ] Pass `preserveManagedMode: true` from process-exit cleanup.
+- [ ] Run the focused OMP suite and confirm both explicit stop and preserved shutdown pass.
+
+### Task 3: Extend PM2 graceful shutdown time and regression coverage
+
+**Files:**
+- Modify: `src/commands/daemon.js`
+- Modify: `tests/unit/commands/daemon.test.js`
+
+- [ ] Set `kill_timeout: 5000` in the PM2 start options.
+- [ ] Add a focused assertion for the configured timeout.
+- [ ] Run daemon and OMP tests.
+
+### Task 4: Verify end-to-end behavior
+
+**Files:**
+- No source changes unless verification exposes a defect.
+
+- [ ] Run the focused Vitest suites.
+- [ ] Run a service status/start smoke check without claiming success beyond observed output.
+- [ ] Inspect the final diff and report any remaining runtime caveat.

package/docs/superpowers/specs/2026-08-13-omp-restart-recovery-design.md

@@ -0,0 +1,22 @@
+# OMP Restart Recovery Design
+
+## Goal
+
+Keep OMP managed-provider state across a full `ctx stop`/`ctx start` cycle so the local dynamic gateway is automatically recoverable without changing the explicit `ctx omp stop` behavior.
+
+## Design
+
+The OMP gateway stop operation gains an opt-in `preserveManagedMode` flag. The default remains the existing explicit-stop behavior: drain, hand off to one direct channel, remove managed providers, and delete the managed-mode marker. The PM2 daemon process uses `preserveManagedMode: true` during process exit: drain and stop the local gateway, but leave the managed marker and `ctx-*` provider configuration intact. Foreground `ctx ui` shutdown keeps the existing explicit handoff behavior. On the next daemon boot, the existing marker-based auto-restore starts the gateway and re-syncs providers.
+
+PM2 receives a five-second `kill_timeout` so the daemon shutdown has enough time to complete while active streaming requests are being drained.
+
+## Invariants
+
+- `ctx omp stop` still restores one direct OMP channel.
+- `ctx stop` does not delete the OMP managed-mode marker.
+- The persisted gateway secret remains unchanged across restart.
+- Failed explicit handoff still leaves managed mode active and resumes log observation.
+
+## Verification
+
+Unit tests cover preserved shutdown state, existing explicit-stop handoff, and the PM2 kill timeout. The focused OMP and daemon suites plus a live service status/start smoke check verify the behavior.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-tool-x",
-  "version": "3.8.2",
+  "version": "3.8.4",
   "description": "Vibe Coding 增强工作助手 - 智能会话管理、动态渠道切换、全局搜索、实时监控",
   "main": "src/index.js",
   "bin": {
@@ -58,28 +58,29 @@
   ],
   "dependencies": {
     "@iarna/toml": "^2.2.5",
-    "adm-zip": "^0.5.16",
+    "adm-zip": "^0.6.0",
     "ajv": "^8.17.1",
     "chalk": "^4.1.2",
     "express": "^4.21.2",
     "http-proxy": "^1.18.1",
     "https-proxy-agent": "^7.0.6",
     "inquirer": "^8.2.7",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^4.3.1",
     "open": "^8.4.2",
     "ora": "^5.4.1",
-    "pm2": "^6.0.14",
+    "pm2": "^7.0.3",
     "rxjs": "^7.8.2",
     "semver": "^7.6.0",
     "toml": "^3.0.0",
     "ws": "^8.18.3"
   },
   "overrides": {
-    "basic-ftp": "^5.2.0",
+    "basic-ftp": "^6.2.0",
+    "js-yaml": "^4.3.1",
     "lodash": "^4.17.23",
     "lodash-es": "^4.17.23",
-    "qs": "^6.15.0",
-    "systeminformation": "^5.31.4"
+    "qs": "^6.15.3",
+    "systeminformation": "^5.33.1"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.1.0",

package/src/commands/daemon.js

@@ -410,6 +410,7 @@ function buildStartOptions(port, enableHost, enableHttps) {
     args: pmArgs,
     interpreter: 'node',
     autorestart: true,
+    kill_timeout: 5000,
     max_memory_restart: '500M',
     env: {
       NODE_ENV: 'production',
@@ -617,18 +618,8 @@ async function handleStop() {
  */
 async function handleRestart() {
   try {
-    await connectPM2();
-
-    const existing = await getCCToolProcess();
-    if (!existing) {
-      console.log(chalk.yellow('\n[WARN]  服务未在运行，请使用 ') + chalk.cyan('ctx start') + chalk.yellow(' 启动\n'));
-      disconnectPM2();
-      return;
-    }
-
-    await restartPM2Process(PM2_APP_NAME);
-    console.log(chalk.green('\n[OK] Coding-Tool 服务已重启\n'));
-    await finalizePM2Session({ persist: true });
+    await handleStop();
+    await handleStart();
   } catch (error) {
     console.error(chalk.red('重启失败:'), error.message);
     disconnectPM2();

package/src/index.js

@@ -135,7 +135,8 @@ async function stopOwnedOmpGatewayBeforeExit() {
       stopOmpProxyServer
     } = require('./server/omp-proxy-server');
     if (getOmpProxyStatus().running) {
-      await stopOmpProxyServer({ forceAfterMs: 1500 });
+      const preserveManagedMode = process.argv.includes('--daemon');
+      await stopOmpProxyServer({ forceAfterMs: 1500, preserveManagedMode });
     }
   } catch (error) {
     console.error(chalk.yellow(`[WARN]  OMP 动态网关退出清理失败: ${error.message}`));
@@ -741,3 +742,9 @@ async function main() {
 main().catch((error) => {
   void shutdownProcess(1, error);
 });
+
+module.exports = {
+  _test: {
+    stopOwnedOmpGatewayBeforeExit
+  }
+};

package/src/server/omp-proxy-server.js

@@ -107,6 +107,7 @@ function startOmpProxyServer(options = {}) {
 
 async function stopOmpProxyServerUnlocked(options = {}) {
   const clearStartTime = options.clearStartTime !== false;
+  const preserveManagedMode = options.preserveManagedMode === true;
   const stoppedPort = currentPort;
   if (!gateway.status().listening && !isManagedOmpModeEnabled()) {
     return {
@@ -126,18 +127,20 @@ async function stopOmpProxyServerUnlocked(options = {}) {
   gateway.beginDraining();
   stopOmpSessionLogObserver();
   try {
-    if (activeChannel) {
-      const handoff = activateStaticOmpChannel(activeChannel.id);
-      lastSyncResult = handoff?.sync || lastSyncResult;
-    } else {
-      lastSyncResult = disableManagedOmpProviders();
+    if (!preserveManagedMode) {
+      if (activeChannel) {
+        const handoff = activateStaticOmpChannel(activeChannel.id);
+        lastSyncResult = handoff?.sync || lastSyncResult;
+      } else {
+        lastSyncResult = disableManagedOmpProviders();
+      }
+      disableManagedOmpMode();
     }
   } catch (error) {
     startOmpSessionLogObserver();
     gateway.cancelDraining();
     throw error;
   }
-  disableManagedOmpMode();
   await gateway.stop({ forceAfterMs: options.forceAfterMs });
   currentPort = null;
   lastRoutingResult = { routes: [], unsupportedChannels: [] };