open-tui-orchestrator 0.9.6 → 0.9.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +50 -0
- package/README-zh.md +1 -1
- package/README.md +1 -1
- package/docs/adapt.md +1 -0
- package/docs/caller-driven.md +1 -1
- package/docs/public-readiness.md +13 -15
- package/docs/release-policy.md +7 -1
- package/package.json +1 -1
- package/release.json +11 -11
- package/scripts/core/adapt-lib.mjs +3 -1
- package/scripts/core/contracts.mjs +1 -1
- package/scripts/core/leases.mjs +21 -3
- package/scripts/core/runner.mjs +6 -1
- package/scripts/gate.mjs +10 -2
package/CHANGELOG.md
CHANGED
|
@@ -3,6 +3,56 @@
|
|
|
3
3
|
Notable changes, newest first. Every entry pairs a package version with a core version —
|
|
4
4
|
`open-tui-orchestrator --version` prints both (`open-tui-orchestrator <version> (core <core>)`).
|
|
5
5
|
|
|
6
|
+
## 0.9.9 — core 1.14.9
|
|
7
|
+
|
|
8
|
+
### Fixed
|
|
9
|
+
|
|
10
|
+
- **Resume adoption of a surviving unit no longer mis-reads one transient identity-snapshot miss as a dead launcher.** Measured 2026-09-16 with the L5 recovery drill re-run on the headless carrier: after the controller was killed, the guardian's resume engine read the live unit's identity with a *single* process snapshot; when that read missed (a known under-load form), the started-but-unproven task was cascaded into `needs-reconciliation` and the run finalized `success=false` about a second after resume — the drill's second kill hit a dead PID and the "stays unfinalized → guardian visibly exhausts → manual re-supply finalizes" scenario could not reproduce (it had passed on the window carrier, a timing accident of the same cause). On a resumed generation (>1) whose unit has no result file yet, the adoption read now uses the same bounded grace-retry as the spawn read (`identityWithGrace`, the default 10 s / 800 ms poll; if the identity still cannot be read the block falls back to recovery, and the engine stays alive through the grace so a re-kill still has a target): a live unit is adopted (`[resume] adopting live <block>; no duplicate window`) and the run keeps waiting on it. Fresh runs and the result-file-present path keep their single-read legacy semantics (the result is read from `rf` anyway, so identity is not required there), so existing fresh-run criteria are untouched. Acceptance: the drill's fail leg re-run goes rc=0 (`passed=true`, `stayedUnfinalized`/`manualResumeFinalized` both true, salvage rc=0) and the auto leg rc=0 — zero popups on both (WindowsTerminal count 0→0); `gate.mjs --all` PASS, regression 295/295.
|
|
11
|
+
|
|
12
|
+
## 0.9.8 — core 1.14.8
|
|
13
|
+
|
|
14
|
+
### Fixed
|
|
15
|
+
|
|
16
|
+
- **The regression and the gate no longer change with the shell's `ORCH_SPAWN_MODE`.** Measured
|
|
17
|
+
2026-09-16: on a machine whose user-level `ORCH_SPAWN_MODE=window` (kept on purpose so manual runs
|
|
18
|
+
show windows), `gate.mjs --all` went rc=1 and the suite went 289/294 — *and really popped visible
|
|
19
|
+
windows*. Four headless-default assertions (`caller-driven` / `orch-force` / `print-profile` /
|
|
20
|
+
`spawn-mode`) inherited the variable from the shell, `queue-backoff` silently ran on the window
|
|
21
|
+
carrier, and `release-package` flipped green/red with the shell's `ORCH_AGENT` (a published copy's
|
|
22
|
+
`--doctor` only diagnoses the missing SDK when a codex host is requested — `gate.mjs` forces
|
|
23
|
+
`ORCH_AGENT=codex`, a bare suite run inherits the shell). The user-level variable stays; the fix is
|
|
24
|
+
on the consumer side: `scripts/gate.mjs` pins every child to `headless` and reports the initiating
|
|
25
|
+
shell's value (`[gate] shell ORCH_SPAWN_MODE=…; children pinned to headless`), the unit-spawning
|
|
26
|
+
tests (`caller-driven`, `orch-force`, `print-profile`, `queue-backoff`), the `adapt --smoke` block
|
|
27
|
+
acceptance and `tools/orch-level-check.py` pin `headless` explicitly, the spawn-mode default
|
|
28
|
+
assertions strip the variable, the `--mode window` case passes the flag, and `release-package`
|
|
29
|
+
pins `ORCH_AGENT=codex`. Acceptance 2026-09-16: `gate.mjs --all` green with the variable set in the
|
|
30
|
+
shell and again without it, zero popups, logs filed
|
|
31
|
+
(`D:/temp/orch-L5-gate-fix-window-20260916.log`, `D:/temp/orch-L5-gate-fix-novar-20260916.log`).
|
|
32
|
+
New red-capable criterion: `test/gate.test.mjs` (the gate must report the shell value and stay
|
|
33
|
+
green; before the change the line does not exist ⇒ red). Regression 295/295.
|
|
34
|
+
|
|
35
|
+
## 0.9.7 — core 1.14.7
|
|
36
|
+
|
|
37
|
+
### Fixed
|
|
38
|
+
|
|
39
|
+
- **Process-identity failures are now diagnosable.** Measured 2026-09-15: a single
|
|
40
|
+
`Get-CimInstance Win32_Process` call took **79.8 s** on this machine (WMI/CIM degraded under
|
|
41
|
+
load) while the engine's snapshot budget is 15 s — every action entry then failed closed with a
|
|
42
|
+
bare `Cannot verify process identities`, which names neither the elapsed time nor the cause and
|
|
43
|
+
offers no way out. The line now carries the budget, the elapsed time, the cause and the knob:
|
|
44
|
+
|
|
45
|
+
```
|
|
46
|
+
before: [orchestrator] FATAL: Cannot verify process identities
|
|
47
|
+
after: [orchestrator] FATAL: Cannot verify process identities: the process snapshot did not
|
|
48
|
+
return within 15000 ms (elapsed 15210 ms; the machine may be under heavy load);
|
|
49
|
+
retry, or raise ORCH_PS_TIMEOUT_MS (budget 15000 ms, cap 120000)
|
|
50
|
+
```
|
|
51
|
+
|
|
52
|
+
`ORCH_PS_TIMEOUT_MS` raises the budget (default 15000 ms, capped at 120000 ms). New red-capable
|
|
53
|
+
tests: `test/snapshot-diagnostics.test.mjs` (a 1 ms budget must fail with the elapsed time and
|
|
54
|
+
the knob named; the env override and the cap are asserted).
|
|
55
|
+
|
|
6
56
|
## 0.9.6 — core 1.14.6
|
|
7
57
|
|
|
8
58
|
### Fixed
|
package/README-zh.md
CHANGED
|
@@ -176,6 +176,6 @@ node cli.mjs --agent claude --doctor
|
|
|
176
176
|
node cli.mjs --agent openclaw --doctor
|
|
177
177
|
~~~
|
|
178
178
|
|
|
179
|
-
当前通用核心为 1.14.
|
|
179
|
+
当前通用核心为 1.14.9，离线回归为 295/295 通过；覆盖无窗 headless 派发默认（`--mode window` 保留可见弹窗；launcher/身份/租约/恢复契约同构，隐藏载具不抢焦点）、单元载体分级（TUI 类 agent 走 ConPTY 伪终端载体——真实控制台、无窗口、不抢焦点，身份/租约/恢复契约与窗口模式同构；print 类维持无控制台载体）、执行看板（块与任务状态实时 `[board]` 行、run `events.jsonl`、只读 `--watch <runId>` 流式视图含 `--jsonl`、`--status` 活动 run 摘要）、任务不丢失、多块并行容量调度、依赖波次、同项目任务按资源键精细化拆分、全局容量租约（排队块等待指数退避+抖动；`ORCH_WAIT_BACKOFF_MS`/`ORCH_WAIT_BACKOFF_MAX_MS` 可调；协调器互斥等待亦可调可重试：`ORCH_MUTEX_WAIT_MS`/`ORCH_MUTEX_RETRIES`，锁票按龄回收 `ORCH_MUTEX_TICKET_TTL_MS`）、Windows Terminal 启动（同步拉起，弹窗可靠且不抢发起窗焦点）、失焦启动回归、进程身份、断点恢复、恢复账本加固（launcherFiles 工作区包容、验收契约哈希绑定、注册表锁老化回收）、守护进程驱动的控制器丢失自动恢复（test/guardian-live-result.json）与手动 --resume-run 收编存活窗口恢复（test/recovery-live-result.json）、发起方自动识别（环境标记优先、进程链兜底：kimi/codex/claude/pi/opencode/openclaw/hermes）、`orch` 强制编排入口、print-class 数据驱动画像适配管线（表面探测→画像→解析自检→活验守门→重封→自动提交，失败一律回滚；画像 agent 按 `modelDetection` 跟随发起窗 model/effort；hermes 画像已落地——hermes 发起即自动挡：识别其身份并以自身 CLI 执行（`--no-restore-cwd` 防旧会话 CWD 写偏））、调用方自助通道（调用方自带计划文件在覆盖/依赖/回退保证不变的前提下跑通且全程零模型调用、调用方自带单元命令让任意 CLI 走同一启动器/租约/恢复/验收契约、只读 `--tasks` 账本助手、单元命令的 resume 身份一致性、未知 agent 的两条出路诊断）、档位去向留痕（summary 记录 model/effort 与三态来源：explicit/宿主会话/host-default；机器可读入口 stdout 保持纯数据）、机器可调用失败契约（公开入口失败一律只回一行 `[orchestrator] FATAL: <原因>`、无 Node 栈帧（`ORCH_DEBUG=1` 才打）；未知 run 不甩 `ENOENT`、不挂起——`--verify-run`/`--resume-run` 立刻回 `Run not found: <id>`，`--watch` 先给有界宽限 `ORCH_WATCH_GRACE_MS`（默认 60s，覆盖 `--run-windows` 仍在规划、run 目录尚未建立的竞态）再拒，看板中途丢 `summary.json` 也立刻报错而不静默停摆）、维护锁、当前核心安全审计及修复（docs/security-audit-2026-09-09.md）、弱网配置、SDK 诊断、宿主 CLI 探测超时重试与逐候选拒绝诊断、OpenClaw 版本门诊断（tui 接口探针先行：未验证版本以探针实测结果 + 最后验证版本 fail-closed——版本常量只记「最后验证于」，不是准入门槛）、恢复账本校验覆盖盘符根工作区和干净发行副本。测试环境要求：离线套件假定发起 agent 的 CLI（默认 `codex`）可在 PATH 解析（Windows 下前置 codex vendor bin，即回归环境约定）；缺失时依赖 agent 解析的测试文件按设计快速失败（fail-closed），其中两个运行期依赖 CLI 的用例已标注 `{skip}`。真实模型额度、不同 Windows 用户安装、长时间断网恢复和每个未来 Agent 的现场兼容性也仍需单独验收。
|
|
180
180
|
|
|
181
181
|
未知宿主、无可执行 CLI 或显式路径无效时，命令会直接失败并给出原因；不会自动安装、猜测替代路径或换用其它 Agent。
|
package/README.md
CHANGED
|
@@ -176,6 +176,6 @@ node cli.mjs --agent claude --doctor
|
|
|
176
176
|
node cli.mjs --agent openclaw --doctor
|
|
177
177
|
```
|
|
178
178
|
|
|
179
|
-
The current generic core is 1.14.
|
|
179
|
+
The current generic core is 1.14.9, with 295/295 offline tests passing. Coverage includes headless spawn mode as the default (--mode window keeps the visible Windows Terminal popups; the launcher/identity/lease/recovery contract is shared, and the hidden carrier cannot steal focus; TUI-class agents run on a ConPTY pseudo-terminal carrier — a real console that stays fully invisible, while print-class CLIs keep the no-console carrier), a live run board (per-transition [board] stdout lines, run events.jsonl, read-only --watch <runId> streaming with --jsonl, and --status active-run rows), lossless task accounting, the memory-derived block-capacity ceiling, dependency waves, fine-grained same-project splitting by resource keys, global capacity leases with exponential + jittered wait backoff for queued blocks (ORCH_WAIT_BACKOFF_MS / ORCH_WAIT_BACKOFF_MAX_MS) and a tunable, retried coordinator-mutex wait (ORCH_MUTEX_WAIT_MS / ORCH_MUTEX_RETRIES) with age-based ticket reclamation (ORCH_MUTEX_TICKET_TTL_MS), Windows Terminal launch (synchronous and reliable, without stealing the initiating window's focus), unfocused-start regressions, process identity, checkpoint recovery, recovery-ledger hardening (launcher-files workspace containment, acceptance-contract hash binding, registry-lock stale reclaim), guardian-driven automatic resume after controller loss (test/guardian-live-result.json) plus manual --resume-run adoption of surviving windows (test/recovery-live-result.json), initiating-agent detection (env markers first, then the process chain: kimi/codex/claude/pi/opencode/openclaw/hermes), the `orch` force-execute entry, print-class data-driven profile adaptation (surface probe → profile → resolution self-check → live verification → reseal → auto-commit, rolled back on failure; profile `modelDetection` lets profiled agents follow the initiating window's model/effort; an adapter-less agent with a landed profile (hermes) is a first-class auto host — the initiating agent is detected and drives its own CLI as the executor with `--no-restore-cwd` guarding against stale-session CWD writes), the caller-driven channel (a caller-supplied plan file kept under the unchanged coverage/dependency/fallback guarantees with zero model calls in the run, caller-supplied unit commands driving any CLI in the same launcher/lease/recovery/acceptance contract, the read-only --tasks ledger helper, resume identity rules for unit commands, and the two-path diagnostic for unknown agents), model/effort traceability (summary records model/effort plus the source: explicit / host session / host-default; machine-readable stdout stays pure data), the machine-caller failure contract (every public entry fails closed with one `[orchestrator] FATAL: <reason>` line and no Node stack unless `ORCH_DEBUG=1`; an unknown run id never dumps `ENOENT` and never hangs — `--verify-run`/`--resume-run` refuse immediately with `Run not found: <id>`, and `--watch` honours a bounded `ORCH_WATCH_GRACE_MS` grace (default 60 s, covering the window in which `--run-windows` is still planning) before refusing, reporting a summary that disappears mid-watch instead of watching forever), the maintenance lock, a current-core security audit with fixes landed (docs/security-audit-2026-09-09.md), weak-network configuration, SDK diagnostics, host CLI probe timeout retry with per-candidate rejection diagnostics, OpenClaw version-gate diagnostics (the runtime tui interface probe runs first; unverified versions fail closed carrying the probe result and the last-verified version — the constant records "last verified", it is not an admission gate), recovery-ledger containment that covers drive-root workspaces, and clean package publication. Test-env requirement: the offline suite assumes the initiating agent CLI (default `codex`) is resolvable on PATH — on Windows prepend the codex vendor bin (the documented regression convention). Without it, agent-resolution-dependent test files fail fast by design (fail-closed); the two runtime-CLI-dependent cases are annotated `{skip}`. Real model quotas, installation under a different Windows user, prolonged offline recovery and field compatibility for future Agents also require separate acceptance.
|
|
180
180
|
|
|
181
181
|
An unknown host, missing CLI or invalid explicit path fails with a diagnostic. The tool does not install software, guess a replacement path or switch to another Agent.
|
package/docs/adapt.md
CHANGED
|
@@ -24,6 +24,7 @@ node scripts/adapt.mjs [--agent <id>] [--cli <path>] [--profiles-dir <dir>]
|
|
|
24
24
|
（`ADAPTOK-xxxxxxxx`）；未回、超时或非零退出即失败回滚。`--no-live` 关闭（不推荐）。
|
|
25
25
|
6. **块级真实验收（可选 `--smoke`）**：用画像 agent 走一遍真实的 `orch` 单块执行
|
|
26
26
|
（checkpoint 协议 + 验收契约 + 结果文件），把"能接上"验证到"跑得通"。
|
|
27
|
+
内部显式钉 `headless`（非交互自动化不弹窗，不受本机 `ORCH_SPAWN_MODE` 影响）。
|
|
27
28
|
⚠️ 会消耗该 agent 的真实额度，且要求它已登录/有模型配置。
|
|
28
29
|
7. **重封 + 自动提交（默认开）**：`release-integrity --seal` 后，仅提交画像文件与 `release.json`
|
|
29
30
|
（显式路径，绝不用 `git add -A`）。`--no-commit` 关闭。
|
package/docs/caller-driven.md
CHANGED
|
@@ -64,7 +64,7 @@ Hard rules (the existing core, unchanged):
|
|
|
64
64
|
- argv is built element-by-element (`shell:false`); the PowerShell launcher keeps quotes, Chinese and spaces intact.
|
|
65
65
|
- No probe, no version assertion: the caller vouches for the command.
|
|
66
66
|
- Completion uses the same contract as every host: the unit writes its checkpoints, prints `__ORCH_DONE__ <token>` as its last line, and the parent re-checks the real results with its own acceptance file. Output text is never parsed for success.
|
|
67
|
-
- `unitProfile` is stored in the run ledger; `--resume-run`
|
|
67
|
+
- `unitProfile` is stored in the run ledger. The **guardian** resume passes it from the ledger automatically; a **manual** `--resume-run` must re-supply the same unit command (`--unit-cmd`/`--unit-cmd-file`) — omitting it is refused with `re-supply the identical --unit-cmd/--unit-cmd-file to resume`, and supplying a different one is refused as well (measured 2026-09-15 in the L5 recovery drill).
|
|
68
68
|
|
|
69
69
|
## 3. Run
|
|
70
70
|
|
package/docs/public-readiness.md
CHANGED
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
| 项 | 证据 |
|
|
8
8
|
| --- | --- |
|
|
9
9
|
| MIT 许可 + 作者署名 | `LICENSE` |
|
|
10
|
-
| 离线回归全绿 |
|
|
10
|
+
| 离线回归全绿 | 295/295（本轮补 2 条：`scripts/gate.mjs` 自身可红判据；Windows-only 入口拒绝判据——判据本身已用「去守卫 + 重封副本」验证能红；2026-09-15 再补 3 条：封印树「链接拒绝」判据——红例用「摘掉链接检查 + 类型白名单」实测能红；身份枚举失败话术必须带预算/耗时/出路——红例＝把话术改回裸串即红；2026-09-16 再补 1 条：gate 必须报告本壳 `ORCH_SPAWN_MODE` 且子进程钉 headless——红例＝改动前无报告行即红，且本壳设 `window` 时旧版四条断言真红） |
|
|
11
11
|
| 发行封印 + 副本流程 | `release.json`（43 核心 + 65 运行时）、`repair.mjs`、`docs/release-policy.md` |
|
|
12
12
|
| 机器可调用失败契约 | 一行 `[orchestrator] FATAL: …`、退出码 0/1/2、未知 run 不挂起（1.13.0 起） |
|
|
13
13
|
| 机判门禁（在仓里，任何人可跑） | `node scripts/gate.mjs --all`：L1 套件 / L2a doctor / L2b 反例能红 / L3 未知 run / L4 版本·封印·文档·套件总数对账 + 锁票巡检 |
|
|
@@ -24,9 +24,8 @@
|
|
|
24
24
|
**结论（2026-09-14，core 1.14.4 / 0.9.4）：清单只剩两件事，且都不可逆、都必须用户亲手点——一、发 npm 包（需要 `npm login`/token）；二、仓转公开。其余全部就绪。**
|
|
25
25
|
|
|
26
26
|
1. ~~公开前的个人路径清理~~ **完成 2026-09-14**：18 个 tracked 文件、77 处用户名归一化为 `<user>`；根因一并修掉（证据采集器、画像适配器、hermes 画像 provenance）。验证：`git grep -c yecha` 只剩公开的 GitHub 句柄 `yechang1450`。
|
|
27
|
-
2.
|
|
28
|
-
|
|
29
|
-
3. ~~CI~~ **完成 2026-09-14 / 实测 2026-09-15**：`.github/workflows/ci.yml`（`windows-latest` + Node 24 + 装 codex + `--install-deps` 自检 + `node scripts/gate.mjs --all`）。**实测结论**：在私有仓手动派发该工作流 → 作业零步骤、3 秒失败，GitHub 注解为「recent account payments have failed or your spending limit needs to be increased」——**私有仓的 Actions 作业起不来（与代码无关，是账户计费问题）**；而 GitHub 计费文档明确：**公开仓的标准 hosted runner 免费**。所以正确姿势是**转公开后再武装**（改文件头 2 行 `on:`），提前武装只会收获红叉。
|
|
27
|
+
2. ~~**npm 发布**~~ **已发布 2026-09-15**：`open-tui-orchestrator@0.9.6` 已在 registry 上（93 文件 / 310.5 kB、shasum `4b16de76…`、`dist.tarball` 可取）。账号＝个人账号 unscoped（`npm whoami` = `yechang1450`；正名未被占）。**端到端烟测**：① 干净前缀（`D:/temp/orch-coldinstall`）`npm install open-tui-orchestrator` 345ms → `--version` = `0.9.6 (core 1.14.6)` → `--install-deps` = `{"ok":true,"action":"installed"}` → `--doctor` = `hostError=null / carrierAvailable=true`；② `npx --yes open-tui-orchestrator@latest --version` 同结论（任何 agent 从 PATH 即装的路径成立）。
|
|
28
|
+
3. ~~CI~~ **弃用（用户令 2026-09-15）**：GitHub Actions 一律不用——私有仓被账户计费拦死（2026-09-15 实测：作业零步骤、3 秒失败），转公开也不再启用。**判定全部走本机等价门禁**：`node scripts/gate.mjs --all`（一条命令五判据 + 反例能红）＋ 定时巡逻（83 的 schtasks 法，需要时并入）。`.github/workflows/ci.yml` 仅作历史记录保留、不带任何触发。
|
|
30
29
|
4. ~~公开文档面~~ **完成 2026-09-14**：`CHANGELOG.md`、`.github/ISSUE_TEMPLATE/bug_report.yml`、`SECURITY.md`（私密漏洞报告渠道 + 披露政策）、`CONTRIBUTING.md`（屋规：判据必须能红、封印纪律、数字对账）。
|
|
31
30
|
5. ~~信任与安全声明~~ **完成 2026-09-14**：`docs/trust-and-safety.md`（隐藏 agent 以你的凭据运行、Codex 的 `--dangerously-bypass-approvals-and-sandbox`、`--unit-cmd` 属调用方自授权、写哪些文件、无遥测无后台服务、如何卸载），README/README-zh 首屏与 INSTALL 均给出一行摘要 + 链接。
|
|
32
31
|
6. ~~平台声明~~ **完成 2026-09-14**：README/README-zh 首屏与 INSTALL「Requirements」均明写 **Windows-only**，其它平台直接给诊断。
|
|
@@ -34,30 +33,29 @@
|
|
|
34
33
|
**注意（2026-09-15 环境事实）**：本机 codex 账号额度耗尽（Sep 19 恢复）——模型驱动的真跑今天做不了；编排器在该条件下退化正确（inline 明说、无假成功），调用方自助通道（零模型调用）的真机双块验收已于 2026-09-15 通过。
|
|
35
34
|
8. ~~验收证据去本地化~~ **完成 2026-09-14**。
|
|
36
35
|
|
|
37
|
-
###
|
|
36
|
+
### 公开前一毫米（done 一件、剩一件可选）
|
|
38
37
|
```powershell
|
|
39
|
-
#
|
|
40
|
-
|
|
38
|
+
# 一、发布 ✅ 2026-09-15 已完成（open-tui-orchestrator@0.9.6 已在 registry；冷装三步 + npx 实跑通过）
|
|
39
|
+
# 产物基线：93 文件 / 310.5 kB、shasum 4b16de76…
|
|
41
40
|
|
|
42
|
-
#
|
|
41
|
+
# 二、转公开（可选：CI 理由已作废，只剩「让外人能看到/克隆源码」一条）
|
|
43
42
|
gh repo edit yechang1450/open-tui-orchestrator --visibility public --accept-visibility-change-consequences
|
|
44
|
-
#
|
|
45
|
-
# 私有仓的 Actions 作业被账户计费拦截（2026-09-15 实测），公开仓的标准 runner 免费。
|
|
43
|
+
# 注意：转公开后**不**武装 CI（CI 已弃用，用户令 2026-09-15）；判定走本机等价门禁 `node scripts/gate.mjs --all`。
|
|
46
44
|
```
|
|
47
45
|
|
|
48
46
|
## 三、需要你决策
|
|
49
47
|
|
|
50
|
-
|
|
48
|
+
**当前只剩一个决定（npm 发布账号那条已随发布定案）：**
|
|
51
49
|
|
|
52
|
-
- **仓库是否转公开**（private → public）：不可逆；历史里只有作者信息（已清理机器用户名，只剩公开的 GitHub 句柄）。
|
|
53
|
-
-
|
|
50
|
+
- **仓库是否转公开**（private → public）：不可逆；历史里只有作者信息（已清理机器用户名，只剩公开的 GitHub 句柄）。CI 理由已作废（CI 弃用），现在只剩「让外人看到/克隆源码」一个动机——愿意再点。
|
|
51
|
+
- ~~**npm 发布账号**~~ **已定 2026-09-15：个人账号 unscoped**（`open-tui-orchestrator@0.9.6` 已发布；正名未被占，无需 scope 退路）。
|
|
54
52
|
|
|
55
|
-
已由我按「最省事且不烧钱」定完、不需要你操心的：平台路线（Windows-only 明说，不投跨平台）、CI
|
|
53
|
+
已由我按「最省事且不烧钱」定完、不需要你操心的：平台路线（Windows-only 明说，不投跨平台）、CI（**弃用**——判定走本机等价门禁 `node scripts/gate.mjs --all`，用户令 2026-09-15）、信任声明与安全渠道（`docs/trust-and-safety.md` + `SECURITY.md`）。
|
|
56
54
|
|
|
57
55
|
## 四、推进记录
|
|
58
56
|
|
|
59
57
|
1. ~~个人路径清理 + `CHANGELOG.md` / issue 模板~~ ✅ 2026-09-14
|
|
60
58
|
2. ~~`npm publish --dry-run` 预演 + 打包瘦身（`files`）~~ ✅ 2026-09-14（89 文件 / 292 kB）
|
|
61
|
-
3. ~~CI 骨架 + 门禁入仓~~ ✅ 2026-09-14（`scripts/gate.mjs` + `.github/workflows/ci.yml
|
|
59
|
+
3. ~~CI 骨架 + 门禁入仓~~ ✅ 2026-09-14（`scripts/gate.mjs` + `.github/workflows/ci.yml`，有意不武装）→ **2026-09-15 用户令：GitHub CI 弃用，判定走本机等价门禁**
|
|
62
60
|
4. ~~信任/安全声明定稿 + `SECURITY.md` + `CONTRIBUTING.md`~~ ✅ 2026-09-14
|
|
63
61
|
5. 干净环境首次验收（第 7 项）——**你的部分**，过了即可对外说「可以用」
|
package/docs/release-policy.md
CHANGED
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
4. 用 `node repair.mjs --target <新的绝对父目录>` 生成发行副本。目标目录必须不存在；复制完成后会再次验证封印和必需文件，任何失败都会清理本次 staging 目录。
|
|
11
11
|
5. 从目标副本运行 `node repair.mjs`、`node cli.mjs --version`、`node cli.mjs --agent codex --doctor` 和只读状态检查。本仓库是独立私有 CLI、不含插件管理器：安装、升级和回滚以发行副本的目录级替换落实（外部验收证据见文末）。
|
|
12
12
|
|
|
13
|
-
当前源码封印记录通用核心 1.14.
|
|
13
|
+
当前源码封印记录通用核心 1.14.9、43 个核心文件和 65 个运行时文件。最新离线回归为 295/295 通过；当前已覆盖任务不丢失、多块并行容量调度、依赖波次、单块/纯串行计划不触发普通开窗、同项目任务按资源键精细化拆分并行（资源不明则整组串行兜底）、全局容量租约（排队等待指数退避+抖动：首等 600ms、×1.7、封顶 5s、抖动 ±20%；`ORCH_WAIT_BACKOFF_MS`/`ORCH_WAIT_BACKOFF_MAX_MS` 可调）、无窗 headless 派发默认（`--mode window` 保留可见弹窗；launcher/身份/租约/恢复契约同构，隐藏载具不抢焦点；2026-09-10 在 pi/claude/opencode/kimi 四宿主实跑通过：双块收据齐、零弹窗）、单元载体分级（TUI 类 agent 的 ConPTY 伪终端载体：真实控制台、无窗口、不抢焦点，身份/租约/恢复契约与窗口模式同构；print 类维持无控制台载体；2026-09-12 在 codex（pty）与 pi（stdio）双载体实跑通过）、执行看板（块与任务状态实时 `[board]` 行、run `events.jsonl` 事件流、只读 `--watch <runId>` 流式视图、`--status` 活动 run 摘要）、Windows Terminal 启动（同步拉起，弹窗可靠且不抢发起窗焦点）、进程身份、断点身份、损坏账本拒绝、账本 launcherFiles 工作区包容校验、验收契约创建时哈希锚定（resume/verify 篡改即拒）、注册表锁老化回收、轮询截止时间、SDK 缺失诊断、CLI 只读 `--version` 版本痕迹（不改状态、不解析 agent CLI）、强制编排入口 `orch`（跳过全部 inline 回退——单块/纯串行/只读定性/自改都会派发单元，维护锁仍是唯一门）、调用方自助通道（`--plan-file` 自带计划文件走既有覆盖/依赖/回退硬校验且全程零模型调用，`--unit-cmd`/`--unit-cmd-file` 自带单元命令绕过宿主识别与探测、任意 CLI 走同一启动器/租约/恢复/验收契约，只读 `--tasks` 账本助手，单元命令的 resume 身份一致性，未知 agent 的两条出路诊断）、print-class 数据驱动画像适配管线（`node scripts/adapt.mjs` 与 `ORCH_AUTO_ADAPT=1` 自动模式：表面探测→画像→解析自检→活验守门→重封→自动提交，失败一律回滚；2026-09-11 aider 0.86.2 实弹完成表面/画像/自检并在未登录时正确 fail-closed；画像自动发现 model/effort 探测规格（`modelDetection`，只读 env/配置文件精确键名），发起窗 model/effort 对画像 agent 同样跟随；hermes 画像正式落地：`--agent hermes` 解析为 profile 宿主、hermes 发起即自动挡——适配探活实测 12.5s 取回令牌）、档位去向留痕（summary 的 model/effort 与三态来源 explicit/宿主会话/host-default；机器可读入口 stdout 保持纯数据）、机器可调用失败契约（公开入口失败只回一行 `[orchestrator] FATAL: <原因>`、无栈帧（`ORCH_DEBUG=1` 才打）；未知 run 不甩 `ENOENT` 也不挂起：`--verify-run`/`--resume-run` 立刻 fail-closed，`--watch` 有界宽限 `ORCH_WATCH_GRACE_MS`（默认 60s）后 fail-closed，看板中途丢 `summary.json` 立刻报错）、宿主 CLI 探测超时重试与逐候选拒绝诊断（scripts/core/host-probe.mjs）、OpenClaw 版本门诊断（接口探针先行：版本常量只记「最后验证于」——未验证版本必须以 `tui` 接口探针实测结果 + node-pty 状态 + 最后验证版本 fail-closed；2026-09-14 本机 2026.9.3 实测：探针 OK、node-pty present；扩版仍需逐版 config/transcript/TUI 验收 + 用户侧 gateway 凭据）、恢复账本 launcherFiles 包容校验覆盖盘符根工作区、发起方自动识别（环境标记优先、进程链就近命中：kimi/codex/claude/pi/opencode/openclaw/hermes）、kimi、claude 与 opencode 适配器的启动器回环、控制器异常死亡后的守护进程自动接管恢复（test/guardian-live-result.json）与手动 --resume-run 收编存活窗口恢复（test/recovery-live-result.json）、维护锁（自身维护期间动作入口只回固定话术并放行，docs/maintenance-lock.md）和干净发布副本。2026-09-09 已完成当前核心安全复扫（双路 LLM 源码审计，docs/security-audit-2026-09-09.md）：无 Critical/High，4 个 Medium 与 1 个 Low 已修复并纳入回归，其余 Low 登记为已知问题；该报告、对应修复提交与本次封印共同构成当前核心的新安全基线，替换 2026-09-05 绑定旧哈希的历史基线。长期环境验收仍单独列为发行门槛。覆盖率摘要保存在 `coverage/coverage-summary.json`，它是验证产物，不会随发行副本发布。
|
|
14
14
|
|
|
15
15
|
Codex、pi 和固定版本 OpenClaw 适配器各自负责宿主参数、会话输出、完成判定和关闭流程。Windows Terminal 是默认可见承载；PowerShell 只作为生命周期脚本和进程枚举辅助，不承担宿主适配。没有经过对应适配器验证的 CLI 会直接失败，不自动安装或回退到其它 Agent。
|
|
16
16
|
|
|
@@ -18,6 +18,12 @@ Codex、pi 和固定版本 OpenClaw 适配器各自负责宿主参数、会话
|
|
|
18
18
|
|
|
19
19
|
2026-09-12 完成 caller-driven 通道（core 1.9.0：`--plan-file` 自带计划 + `--unit-cmd`/`--unit-cmd-file` 自带单元命令 + 只读 `--tasks`）的真机验收，全部走真实 CLI（Kimi Code 0.42.0 / deepseek-flash，headless，无适配器参与）：双块并行实跑 2/2 verified、success=true；同通道 `--resume-run` 对已终结运行零重开（每块 attempts 保持 1）、产物哈希不变；控制器被中途杀死后守护进程自动接管（generation=2，无证据的块按"不重放未证明副作用"重开一次）并最终 success=true；反例（真实 CLI 拒绝未知旗标 exit 1）fail-closed 零假成功。证据 test/acceptance-2026-09-12-caller-driven.json。
|
|
20
20
|
|
|
21
|
+
2026-09-16 完成 L5 恢复演练收尾与接管采纳加固（core 1.14.9 / 0.9.9）：① 演练件（`tools/l5-recovery-drill.mjs`，随仓不发 npm）两处修正——fail 腿的手动收口（salvage，两处）此前未重交 `--unit-cmd-file`，带调用方单元命令的 run 只会得到 `FATAL: re-supply the identical --unit-cmd/--unit-cmd-file`（工具面恒红，非能力面）；现两处均重交同一份 unit 并把 salvage 输出与 rc 收入 report；两条腿显式钉 `headless`（不继承本壳、零弹窗——实测 WindowsTerminal 计数 0→0），需要可见窗的手动调试用 `ORCH_DRILL_WINDOW=1`。② **复跑逮出并修一条核心缺陷**：headless 下控制器被杀、守护进程重启接管后，接管引擎对「存活单元」的采纳读只有单次进程快照——快照瞬时缺失/超时（高负载下的已知形态）即把在飞单元误判为未采纳，直接判 `needs-reconciliation` 并收口（实测 run 建后约 1 秒即 `finalized success=false`，二次杀来不及；该场景在窗口载具下曾通过——疑似同因的时序侥幸，记录在案）；修法＝**接管（generation>1）且未出结果**的单元采纳读改用与 spawn 读同一套宽限重试（`identityWithGrace` 默认 10s／800ms 轮询；仍无则按未采纳走 recovery——宽限期内引擎保持存活，也让「再杀接管引擎」有靶）；fresh 首轮与已有结果文件的路径保持单读旧语义、与既有判据零扰动。③ 验收：两腿复跑全绿（auto `passed=true` rc=0；fail `passed=true` rc=0、`stayedUnfinalized`/`manualResumeFinalized` 全真、二次杀命中、salvage rc=0），零弹窗；`gate --all` PASS、离线回归 295/295。证据 `D:/temp/orch-l5-drill-fix2-auto-*.log`、`D:/temp/orch-l5-drill-fix2-fail-*.log`、`D:/temp/orch-l5/report-auto.json`、`D:/temp/orch-l5/report-fail.json`。
|
|
22
|
+
|
|
23
|
+
2026-09-16 L6 交付面读数（0.9.9，发布前报房轮）＋一处回潮修复：① **冷装三步（tarball 路径）**——`npm pack` = 93 文件 / 315,116 B（sha256 `f227b534…`）→ 干净前缀统一装包 → `--version` = `0.9.9 (core 1.14.9)` → `--install-deps` = `installed`（幂等复跑 `already-present`）→ `--agent codex --doctor` = `hostError=null` / `carrierAvailable=true`；装好的副本自验封印 43+65。② **发布件真机执行验收（零模型双块，装在干净前缀的副本上跑）**——调用方自助通道（`--plan-file` + `--unit-cmd-file` + `--acceptance-file`）双块并行：看板 `0/2 → 2/2 verified → finalized success=true`；产物 `alpha.txt=ALPHA_OK` / `beta.txt=BETA_OK`，sha256 与 0.9.5 轮**逐字节一致**（`5b59da96…`/`d76be855…`）；`spawnMode=headless`、WindowsTerminal 计数 0→0。③ **交付面扫描＝逮出并修一处回潮**：L10 巡逻件（`tools/orch-patrol.py` / `tools/orch-patrol-install.ps1`）把机器用户名写死 6 处（推翻 09-14「tracked 文件只剩公开句柄」的清面声样）⇒ 修成 `~`/`$HOME`/`%USERPROFILE%` 归一（ast/PSParser 双 0 错、`.ps1` 保持 ASCII/LF/BOM-less、巡逻拍绿）；同轮把安装器的任务注册改走 `schtasks /Create`（PS 原生 `Register-ScheduledTask` 本机未提权必拒 0x80070005——复装实跑成、任务触发实跑 tick 57/58、`last_rc=0`）。④ **跨线冷装腿**（game 现包 `334e112731ad…`，非作者复现）：sha/六件/双路径 rc=0/心跳 mode=play/真实用户目录 218 文件零改动——回执已交房。证据 `test/acceptance-2026-09-16-l6-delivery-face.json`、`D:/temp/orch-coldinstall-099/`、`D:/temp/game-coldinstall-orch/logs/batch20-run.log`。未闭：npm 上架（本机实读未登录 ENEEDAUTH；registry 仅 0.9.6）——候用户 `npm login` 一步。
|
|
24
|
+
|
|
25
|
+
2026-09-16 完成判据抗壳化：离线回归与门禁不再随本壳 `ORCH_SPAWN_MODE` 变色（core 1.14.8 / 0.9.8）。① 真机现象：本机用户级 `ORCH_SPAWN_MODE=window`（为手动跑 agent 见窗而设）下 gate `--all` rc=1——四条默认断言（`caller-driven`/`orch-force`/`print-profile`/`spawn-mode`）被子进程继承的窗口变量顶掉，套件真弹可见窗；`queue-backoff` 静默走了窗口载具；`release-package` 随本壳 `ORCH_AGENT` 绿/红翻面（发布副本的 `--doctor` 只在请求 codex 宿主时才诊断 SDK 缺失，gate 强制 `ORCH_AGENT=codex`、裸跑继承本壳）。② 裁与修：用户级变量保留（手动手感不动）；消费者一律显式——`scripts/gate.mjs` 给子进程钉 `headless` 并打印本壳取值，套件里会派单元的用例（`caller-driven`/`orch-force`/`print-profile`/`queue-backoff`/`adapt --smoke`）显式钉 `headless`，默认断言显式去掉变量，`--mode window` 用例显式传参，`release-package` 显式钉 `ORCH_AGENT=codex`；`tools/orch-level-check.py` 同样钉 `headless` 并打印本壳取值。③ 新判据（红例＝改动前无报告行即红）：`test/gate.test.mjs`「gate 必须报告本壳 `ORCH_SPAWN_MODE` 且仍绿」。④ 验收：带变量与不带变量两环境各跑一次 `gate --all` 同绿、全程零弹窗，日志 `D:/temp/orch-L5-gate-fix-window-20260916.log` / `D:/temp/orch-L5-gate-fix-novar-20260916.log`；离线回归 295/295。
|
|
26
|
+
|
|
21
27
|
2026-09-15 完成公开化准备第五步：模型侧失败**不再被吞**（core 1.14.6 / 0.9.6）。① 真机发现：本机 codex 账号额度耗尽时，分解阶段只报 `no JSON in classify output: (no valid JSON) -> fallback to single serial block (autosafe detect)`——**读起来像解析 bug，真正原因（额度用尽 / 未登录 / 弱网）被丢掉**：`runThreadPrompt` 返回的 `errored`/`warnings` 从未被检查，代码只去解析空的 `final`。② 修：分解循环在 `final` 为空且存在模型侧故障信息时，抛 `classify model call failed: <原因>`（一行、有界 300 字），失败告警行照旧附带 `-> fallback …` 的兜底说明。③ **前后对照（同一命令、同一账号状态，0.9.5 副本 vs 修复后源码树）**：前 `… no JSON in classify output: (no valid JSON) …`；后 `… classify model call failed: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Sep 19th, 2026 4:10 PM. …`——操作者第一次就能看懂并知道何时恢复。④ 同轮记录（**诚实边界**）：额度耗尽下的两次真实模型跑（81/84 双块）均 `success=false`、两任务 `failed`，**无假成功**；但每任务的失败原因是通用的 `No durable task checkpoint` / `Safe recovery attempt budget exhausted`，CLI 原文留在 `runs/<id>/attempts/`，把单元级原因提到摘要属后续项，本轮不冒充已做。离线回归 291/291；门禁 L1–L4 全 PASS。证据 test/acceptance-2026-09-15-windows-guard-live-run.json。
|
|
22
28
|
|
|
23
29
|
2026-09-15 完成公开化准备第四步：Windows-only 承诺落成判据 + 发布件真机双块验收（core 1.14.5 / 0.9.5）。① **抓到一处「说法无判据」**：README/INSTALL 承诺「其它平台会直接给诊断而不是半可用的安装」，实测（`node --import` 伪造平台）无守卫时 `--doctor` 在"Linux"下**健康返回 exit 0**（还报 `terminal: "wt"`）、`--run-windows` 照常发起分类调用——承诺是假的。② **修法**：`scripts/platform-guard.mjs` 在**三个入口**（`cli.mjs`——npm bin 入口、`orch.mjs`、`scripts/orchestrate-sdk.mjs`）于解析宿主/调模型/落状态**之前**强制，一行 `[orchestrator] FATAL: Windows-only: …` + exit 1；仅保留 `--version`/`--help`/`--install-deps`（平台中立且正是排障所需）。③ **判据与红例**：`test/windows-only.test.mjs` 两条（拒绝必须干净且不得像健康报告；三个中立入口必须照常工作），**红例真做**——副本去掉守卫 + 重封副本 → 假平台下健康 exit 0 ⇒ 判据必红。④ **发布件真机验收**：在 0.9.4 副本上走调用方自助通道（`--plan-file` + `--unit-cmd-file` + `--acceptance-file`，**零模型调用**）双块并行：看板 `0/2 → 1/2 → 2/2 verified → finalized success=true`，产物 `alpha.txt=ALPHA_OK`/`beta.txt=BETA_OK` 落地并记 sha256 证据，两任务 `verified` 且检查点 `completed`，全程 ~60 秒。⑤ **环境事实（记录在案）**：本机 codex 账号额度耗尽（Sep 19 恢复），故「模型驱动的双块实跑」今日无法进行；编排器在该条件下**退化正确**（连续两次分类失败 → `mode:inline` 明说由发起对话执行，无假成功）。离线回归 291/291；门禁 L1–L4 全 PASS；封印 43 核心 + 65 运行时。证据 test/acceptance-2026-09-15-windows-guard-live-run.json。
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "open-tui-orchestrator",
|
|
3
|
-
"version": "0.9.
|
|
3
|
+
"version": "0.9.9",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "Split a multi-part agent request into a verified TODO ledger, then run the parallel blocks in hidden or visible TUI windows of the agent CLI you already use (Windows).",
|
|
6
6
|
"type": "module",
|
package/release.json
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema": 2,
|
|
3
|
-
"coreVersion": "1.14.
|
|
3
|
+
"coreVersion": "1.14.9",
|
|
4
4
|
"files": {
|
|
5
|
-
"adapt-lib.mjs": "
|
|
5
|
+
"adapt-lib.mjs": "4902e049b9b63c1d8eab285720a490b2925bb1611aacc060aa5db3289107d61d",
|
|
6
6
|
"agent-auth-prompt.txt": "18fa9c01972cd99a2fe2b1b74a440b34921a051ba6c0d54daf2f5bf1096457b0",
|
|
7
7
|
"agent-profiles/hermes.json": "0283956550eec69f7a47811db3e5125c5c1e003c6a7310a28185a615aeae34a2",
|
|
8
8
|
"agent.mjs": "e75eb20ebe560072f67d9e7803467eba4114fb23716b04f82147aebb17a12555",
|
|
9
9
|
"checkpoint.mjs": "246de59db9a7aac48b12eea1554ff281eaf9dd897e620ecf73d954f39b3cf94a",
|
|
10
10
|
"claude-host.mjs": "8ab7661e2b56eab07709b2a16c7f6e04dab8708edfbe672300254109c2323aaa",
|
|
11
11
|
"claude-runtime.mjs": "06e7aba4a5c62a2bf0f12e09089db778c265a0aa21b31a53dbac7245586abe20",
|
|
12
|
-
"contracts.mjs": "
|
|
12
|
+
"contracts.mjs": "09327d6dd8790a0f3bb2cf8f410976c39eb17a93029690a3b79ecc0fc739e863",
|
|
13
13
|
"host-cli.mjs": "67b538db32c8aa6a7c2527b2b0fe81d2fbe8b440ab062071c6e6ecff0309b949",
|
|
14
14
|
"host-model.mjs": "497c5ac6a9a47cd8e42594f680c04d831f7bf1229ab1c2a8f192cacf9fe88547",
|
|
15
15
|
"host-probe.mjs": "90d0831ca2775e54183145638880277f8c45fbf457a8b948d65966b6f96c378f",
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
"kimi-host.mjs": "17efd7cac6210f7f5e1d43e3a9144589edca45057009aaaa19962f7853c36ddf",
|
|
19
19
|
"kimi-runtime.mjs": "6358d32bb5fb9a4b055dad8d9b80401b3d8bb342c76ad1319eec0e0a7f4f4265",
|
|
20
20
|
"lease-lock.ps1": "75ecd1b7780e5df8489d44732320a681f6bc476acc38121fb096952180b0cdcb",
|
|
21
|
-
"leases.mjs": "
|
|
21
|
+
"leases.mjs": "22bd2bd9fb617302d9bfa9e619fe808b4f06c7264b6dc8d77b939d1ea7dfc212",
|
|
22
22
|
"maintenance-lock.mjs": "4fa35bd978a78e89861d65e4a22355d6a76552b7d19ea466503c059a0af8fb58",
|
|
23
23
|
"native-argv.mjs": "3b5a762eddf8a9042293ee12e9c441cafa566e14974563a04ee168a6d68834c0",
|
|
24
24
|
"network-policy.mjs": "e15fcef46f74ac07705ae87379ac6ce0b937b2f82d5ba13e94d12c5eff756f46",
|
|
@@ -40,7 +40,7 @@
|
|
|
40
40
|
"recovery.mjs": "45e7eb9f23585fc3f51c2d6aeebb9607097640544ff43871c667df7f63fb06a4",
|
|
41
41
|
"run-board.mjs": "ee98dac04d2babe68ff3c0a88f40547a380188ed8de7135cf54c9a0f469ae9e3",
|
|
42
42
|
"run-guardian.mjs": "e1b2b17663c0a9a8a408e8a25484b87adcf7144f4d08f81c03d736a704feda6b",
|
|
43
|
-
"runner.mjs": "
|
|
43
|
+
"runner.mjs": "c80cb3de9deaa397a5394b002a228872cde9aeef945eb261c69150d14e12fa99",
|
|
44
44
|
"runtime-context.mjs": "39ee58751764034504a6e3c5a6cb53ded725abee5a5ccd7675ade7d690bdb58b",
|
|
45
45
|
"unit-carrier.mjs": "462b4512910a458815a1d5f7c1bce2e0e43e53e0511f5be3e13f118c879aeb48",
|
|
46
46
|
"unit-command.mjs": "93791c8e1d5ce7ccd87a9eb2a78438961faa723cb445535cadfef1254f1168ff",
|
|
@@ -48,19 +48,19 @@
|
|
|
48
48
|
},
|
|
49
49
|
"runtimeFiles": {
|
|
50
50
|
"cli.mjs": "8b6817604286769142d0620ed8da96d433596e84362cee66594e099c88f1a1c4",
|
|
51
|
-
"package.json": "
|
|
51
|
+
"package.json": "33754d3d3ab241c82163c5712d2b1b4bc2f6665a822052e41e1fa87a5eb225ae",
|
|
52
52
|
"repair.mjs": "5a456b42560bfa21fd1e66ccdff7416f88e82fe711db5c04279717e73275a076",
|
|
53
53
|
"scripts/adapt.mjs": "20209c74212d334ea5aa1dfe35816a1b7a4b7f0415eb27c5a1975925dbbd10c5",
|
|
54
54
|
"scripts/agent-auth-prompt.txt": "18fa9c01972cd99a2fe2b1b74a440b34921a051ba6c0d54daf2f5bf1096457b0",
|
|
55
55
|
"scripts/agent.mjs": "e75eb20ebe560072f67d9e7803467eba4114fb23716b04f82147aebb17a12555",
|
|
56
|
-
"scripts/core/adapt-lib.mjs": "
|
|
56
|
+
"scripts/core/adapt-lib.mjs": "4902e049b9b63c1d8eab285720a490b2925bb1611aacc060aa5db3289107d61d",
|
|
57
57
|
"scripts/core/agent-auth-prompt.txt": "18fa9c01972cd99a2fe2b1b74a440b34921a051ba6c0d54daf2f5bf1096457b0",
|
|
58
58
|
"scripts/core/agent-profiles/hermes.json": "0283956550eec69f7a47811db3e5125c5c1e003c6a7310a28185a615aeae34a2",
|
|
59
59
|
"scripts/core/agent.mjs": "e75eb20ebe560072f67d9e7803467eba4114fb23716b04f82147aebb17a12555",
|
|
60
60
|
"scripts/core/checkpoint.mjs": "246de59db9a7aac48b12eea1554ff281eaf9dd897e620ecf73d954f39b3cf94a",
|
|
61
61
|
"scripts/core/claude-host.mjs": "8ab7661e2b56eab07709b2a16c7f6e04dab8708edfbe672300254109c2323aaa",
|
|
62
62
|
"scripts/core/claude-runtime.mjs": "06e7aba4a5c62a2bf0f12e09089db778c265a0aa21b31a53dbac7245586abe20",
|
|
63
|
-
"scripts/core/contracts.mjs": "
|
|
63
|
+
"scripts/core/contracts.mjs": "09327d6dd8790a0f3bb2cf8f410976c39eb17a93029690a3b79ecc0fc739e863",
|
|
64
64
|
"scripts/core/host-cli.mjs": "67b538db32c8aa6a7c2527b2b0fe81d2fbe8b440ab062071c6e6ecff0309b949",
|
|
65
65
|
"scripts/core/host-model.mjs": "497c5ac6a9a47cd8e42594f680c04d831f7bf1229ab1c2a8f192cacf9fe88547",
|
|
66
66
|
"scripts/core/host-probe.mjs": "90d0831ca2775e54183145638880277f8c45fbf457a8b948d65966b6f96c378f",
|
|
@@ -69,7 +69,7 @@
|
|
|
69
69
|
"scripts/core/kimi-host.mjs": "17efd7cac6210f7f5e1d43e3a9144589edca45057009aaaa19962f7853c36ddf",
|
|
70
70
|
"scripts/core/kimi-runtime.mjs": "6358d32bb5fb9a4b055dad8d9b80401b3d8bb342c76ad1319eec0e0a7f4f4265",
|
|
71
71
|
"scripts/core/lease-lock.ps1": "75ecd1b7780e5df8489d44732320a681f6bc476acc38121fb096952180b0cdcb",
|
|
72
|
-
"scripts/core/leases.mjs": "
|
|
72
|
+
"scripts/core/leases.mjs": "22bd2bd9fb617302d9bfa9e619fe808b4f06c7264b6dc8d77b939d1ea7dfc212",
|
|
73
73
|
"scripts/core/maintenance-lock.mjs": "4fa35bd978a78e89861d65e4a22355d6a76552b7d19ea466503c059a0af8fb58",
|
|
74
74
|
"scripts/core/native-argv.mjs": "3b5a762eddf8a9042293ee12e9c441cafa566e14974563a04ee168a6d68834c0",
|
|
75
75
|
"scripts/core/network-policy.mjs": "e15fcef46f74ac07705ae87379ac6ce0b937b2f82d5ba13e94d12c5eff756f46",
|
|
@@ -91,12 +91,12 @@
|
|
|
91
91
|
"scripts/core/recovery.mjs": "45e7eb9f23585fc3f51c2d6aeebb9607097640544ff43871c667df7f63fb06a4",
|
|
92
92
|
"scripts/core/run-board.mjs": "ee98dac04d2babe68ff3c0a88f40547a380188ed8de7135cf54c9a0f469ae9e3",
|
|
93
93
|
"scripts/core/run-guardian.mjs": "e1b2b17663c0a9a8a408e8a25484b87adcf7144f4d08f81c03d736a704feda6b",
|
|
94
|
-
"scripts/core/runner.mjs": "
|
|
94
|
+
"scripts/core/runner.mjs": "c80cb3de9deaa397a5394b002a228872cde9aeef945eb261c69150d14e12fa99",
|
|
95
95
|
"scripts/core/runtime-context.mjs": "39ee58751764034504a6e3c5a6cb53ded725abee5a5ccd7675ade7d690bdb58b",
|
|
96
96
|
"scripts/core/unit-carrier.mjs": "462b4512910a458815a1d5f7c1bce2e0e43e53e0511f5be3e13f118c879aeb48",
|
|
97
97
|
"scripts/core/unit-command.mjs": "93791c8e1d5ce7ccd87a9eb2a78438961faa723cb445535cadfef1254f1168ff",
|
|
98
98
|
"scripts/core/unit-runtime.mjs": "21a7a287e59c068c6d277281d4fb092852cfe21f4bb2df62d6695106f4f20665",
|
|
99
|
-
"scripts/gate.mjs": "
|
|
99
|
+
"scripts/gate.mjs": "e77ea14e6c2946f79bceb403fb3b26bf7834e3dd75901d5cdd9d7a1fbbb01116",
|
|
100
100
|
"scripts/host-cli.mjs": "994448626766f53883a29d17a5af547dcb67f6d2b9e7e5b6b6ff60f28582978c",
|
|
101
101
|
"scripts/install-deps.mjs": "49873cecfb7af52148e2d7d06e225e6fa1501fb852ef199f016914bcf8a810de",
|
|
102
102
|
"scripts/maintenance-lock.mjs": "888d99a00ed90eb7b8650ef8ab56abcfd43b992e448c66a158acf876446f79a3",
|
|
@@ -172,6 +172,8 @@ export async function adaptAgent({ id, cli, env = process.env, live = true, comm
|
|
|
172
172
|
...env, ORCH_AGENT: id, ORCH_CLI: located.source || located.bin, ORCH_AGENT_PROFILES_DIR: profilesDir(env),
|
|
173
173
|
ORCH_ACCEPTANCE_FILE: path.join(ws, 'acceptance.json'), ORCH_MAINTENANCE_LOCK: path.join(ws, 'no-lock.json'),
|
|
174
174
|
ORCH_MAX_POLL_MS: '300000', WORKSPACE_DIR: ws, ORCH_STATE_DIR: path.join(ws, 'temp', 'orchestrator'),
|
|
175
|
+
// 块级验收是非交互自动化：显式钉 headless，绝不继承本壳 ORCH_SPAWN_MODE（不弹窗、判据不随壳变色）。
|
|
176
|
+
ORCH_SPAWN_MODE: 'headless',
|
|
175
177
|
};
|
|
176
178
|
delete smokeEnv.NODE_TEST_CONTEXT;
|
|
177
179
|
const t0 = Date.now();
|
|
@@ -186,7 +188,7 @@ export async function adaptAgent({ id, cli, env = process.env, live = true, comm
|
|
|
186
188
|
}
|
|
187
189
|
|
|
188
190
|
if (suite) {
|
|
189
|
-
const s = run(process.execPath, ['--test', 'test/print-profile.test.mjs'], { cwd: REPO, env: { ...env, ORCH_AGENT: 'codex', ORCH_MAINTENANCE_LOCK: path.join(REPO, 'temp', 'adapt-suite-lock-none.json') }, timeout: 300000 });
|
|
191
|
+
const s = run(process.execPath, ['--test', 'test/print-profile.test.mjs'], { cwd: REPO, env: { ...env, ORCH_AGENT: 'codex', ORCH_MAINTENANCE_LOCK: path.join(REPO, 'temp', 'adapt-suite-lock-none.json'), ORCH_SPAWN_MODE: 'headless' }, timeout: 300000 });
|
|
190
192
|
report.suite = { exit: s.status };
|
|
191
193
|
if (s.status !== 0) { report.reason = 'print-profile suite failed'; rollback(); return report; }
|
|
192
194
|
}
|
|
@@ -3,7 +3,7 @@ import fs from 'node:fs';
|
|
|
3
3
|
import crypto from 'node:crypto';
|
|
4
4
|
import {spawnSync} from 'node:child_process';
|
|
5
5
|
|
|
6
|
-
export const CORE_VERSION = '1.14.
|
|
6
|
+
export const CORE_VERSION = '1.14.9';
|
|
7
7
|
export const SUCCESS = new Set(['verified']);
|
|
8
8
|
export const TERMINAL = new Set(['verified','failed','blocked','cancelled','awaiting-verification','preflight-failed','popup-failed','timeout','needs-reconciliation']);
|
|
9
9
|
|
package/scripts/core/leases.mjs
CHANGED
|
@@ -8,12 +8,30 @@ import {keysOverlap,powershellExe} from './contracts.mjs';
|
|
|
8
8
|
// 锚定 SystemRoot 的 powershell.exe：裸名会先按进程 cwd（任意工作区）解析，防二进制投毒。
|
|
9
9
|
const PS_EXE=powershellExe();
|
|
10
10
|
|
|
11
|
-
export function
|
|
11
|
+
export function processSnapshotTimeoutMs(override) {
|
|
12
|
+
// 身份枚举的预算（2026-09-15）：慢机上 PowerShell/WMI 可能几十秒不返回。默认 15000 ms，
|
|
13
|
+
// 可用 ORCH_PS_TIMEOUT_MS 调（上限 120000 ms）。失败话术必须带耗时与原因——裸话术
|
|
14
|
+
// 「Cannot verify process identities」既不说耗时也不说原因，慢机上无法排障。
|
|
15
|
+
const raw=Number.isFinite(override)?override:Number(process.env.ORCH_PS_TIMEOUT_MS);
|
|
16
|
+
const value=Number.isFinite(raw)&&raw>0?raw:15000;
|
|
17
|
+
return Math.max(1,Math.min(120000,Math.ceil(value)));
|
|
18
|
+
}
|
|
19
|
+
export function processSnapshot(timeoutMs) {
|
|
12
20
|
if(process.platform!=='win32')throw new Error('Visible TUI runtime currently requires Windows');
|
|
21
|
+
const budget=processSnapshotTimeoutMs(timeoutMs);
|
|
22
|
+
const started=Date.now();
|
|
13
23
|
const result=spawnSync(PS_EXE,['-NoProfile','-Command',
|
|
14
24
|
'$ErrorActionPreference="Stop"; Get-CimInstance Win32_Process | Select-Object ProcessId,Name,CommandLine,@{n="Started";e={$_.CreationDate.ToUniversalTime().ToString("o")}} | ConvertTo-Json -Compress'],
|
|
15
|
-
{encoding:'utf8',windowsHide:true,timeout:
|
|
16
|
-
|
|
25
|
+
{encoding:'utf8',windowsHide:true,timeout:budget});
|
|
26
|
+
const elapsed=Date.now()-started;
|
|
27
|
+
if(result.status!==0){
|
|
28
|
+
const timedOut=(result.error&&result.error.code==='ETIMEDOUT')||(result.status===null);
|
|
29
|
+
const stderr=String(result.stderr||'').trim().split('\n').filter(Boolean).slice(-1)[0]||'';
|
|
30
|
+
const detail=timedOut
|
|
31
|
+
?`the process snapshot did not return within ${budget} ms (elapsed ${elapsed} ms; the machine may be under heavy load)`
|
|
32
|
+
:`powershell exited with status ${result.status} after ${elapsed} ms`;
|
|
33
|
+
throw new Error(`Cannot verify process identities: ${detail}${stderr?'; '+stderr.slice(0,200):''}; retry, or raise ORCH_PS_TIMEOUT_MS (budget ${budget} ms, cap 120000)`);
|
|
34
|
+
}
|
|
17
35
|
return new Map(JSON.parse(result.stdout).map(p=>[p.ProcessId,p]));
|
|
18
36
|
}
|
|
19
37
|
export function sameProcess(expected,actual) {
|
package/scripts/core/runner.mjs
CHANGED
|
@@ -186,7 +186,12 @@ export async function runWindows(request,hooks,options={}) {
|
|
|
186
186
|
const limit=Math.max(1,Math.min(3,Number(options.maxAttempts||2)));
|
|
187
187
|
while(Date.now()<deadline) {
|
|
188
188
|
let e=sum.results[r.key],la=e.launcherFiles,identity;spawnConfirmed=false;
|
|
189
|
-
|
|
189
|
+
// 采纳读加固（2026-09-16 L5 复跑实逮）：**接管（generation>1）且单元还没出结果**时，全量快照会
|
|
190
|
+
// 瞬时缺失/超时（见 identityWithGrace 注释），单次读失手会把「还活着的单元」误判为未采纳 ⇒ 走
|
|
191
|
+
// recovery 误收口（实测 headless 接管引擎 ~3s 内把在飞单元判 needs-reconciliation）；此时改用与
|
|
192
|
+
// spawn 读同一套宽限重试（identityWithGrace 默认 10s／800ms；仍无则按未采纳走 recovery，且宽限
|
|
193
|
+
// 期间引擎存活⇒二次杀有靶）。首轮（fresh）与已有结果文件的路径保持单读旧语义（fresh 判据零扰动）。
|
|
194
|
+
if(la)try{identity=(Number(sum.generation)>1&&!fs.existsSync(la.rf))?await identityWithGrace(hooks,la):launcherIdentity(hooks.readPid(la.pidf),la.pidf);}catch{identity=undefined;}
|
|
190
195
|
const adopted=identity&&(!e.launcher||sameProcess(e.launcher,identity));
|
|
191
196
|
let active;
|
|
192
197
|
if(adopted) {
|
package/scripts/gate.mjs
CHANGED
|
@@ -13,7 +13,10 @@
|
|
|
13
13
|
* - every criterion prints command / expectation / actual;
|
|
14
14
|
* - a value that cannot be read counts as failure ("unknown is failure");
|
|
15
15
|
* - exit 0 only if every requested criterion passed; any failure exits 1;
|
|
16
|
-
* - L2b keeps the criteria themselves honest: it proves a red case still goes red
|
|
16
|
+
* - L2b keeps the criteria themselves honest: it proves a red case still goes red;
|
|
17
|
+
* - the shell's user-level `ORCH_SPAWN_MODE` (kept for manual runs) is reported, never
|
|
18
|
+
* inherited: children are pinned to headless, so criteria cannot change with the shell
|
|
19
|
+
* and nothing pops up (2026-09-16 ruling: 判据随壳变色不可接受).
|
|
17
20
|
*
|
|
18
21
|
* Environment: the suite follows the documented convention (`ORCH_AGENT` defaults to
|
|
19
22
|
* `codex` here; the codex CLI must be resolvable — see README "Test-env requirement").
|
|
@@ -29,6 +32,9 @@ const AGENT = String(process.env.ORCH_GATE_AGENT || 'codex').trim();
|
|
|
29
32
|
const args = new Set(process.argv.slice(2));
|
|
30
33
|
const wants = (flag) => args.has(flag) || args.has('--all') || args.size === 0;
|
|
31
34
|
const results = [];
|
|
35
|
+
// 判据不得随壳变色：本壳的用户级 ORCH_SPAWN_MODE 只报告、不继承；子进程一律显式钉 headless。
|
|
36
|
+
const SHELL_SPAWN_MODE = String(process.env.ORCH_SPAWN_MODE || '').trim() || '(unset)';
|
|
37
|
+
console.log(` [gate] shell ORCH_SPAWN_MODE=${SHELL_SPAWN_MODE}; children pinned to headless (zero popups)`);
|
|
32
38
|
|
|
33
39
|
function check(id, title, ok, lines) {
|
|
34
40
|
results.push({id, ok});
|
|
@@ -38,7 +44,9 @@ function check(id, title, ok, lines) {
|
|
|
38
44
|
}
|
|
39
45
|
|
|
40
46
|
function node(argsArr, opts = {}) {
|
|
41
|
-
|
|
47
|
+
// 非交互自动化一律显式 headless：gate 的子进程绝不继承本壳 ORCH_SPAWN_MODE（零弹窗）。
|
|
48
|
+
const env = {...(opts.env || process.env), ORCH_SPAWN_MODE: 'headless'};
|
|
49
|
+
const r = spawnSync(process.execPath, argsArr, {cwd: REPO, encoding: 'utf8', windowsHide: true, timeout: opts.timeout || 900000, env});
|
|
42
50
|
return {status: r.status, out: (r.stdout || '') + (r.stderr || '')};
|
|
43
51
|
}
|
|
44
52
|
|