tokenmaw 0.3.0 → 0.4.1

package/dist/update-check.js

@@ -0,0 +1,332 @@
+/**
+ * update-check.ts — Update notification and self-update via npm.
+ *
+ * On startup the CLI queries `https://registry.npmjs.org/<pkg>/latest`, compares
+ * it against the running version, and (when newer) returns a notice that the
+ * CLI prints to stderr after command output. Results are cached for a day in
+ * the shared CODER_DATA_HOME cache dir so the registry is not hit on every run.
+ *
+ * In interactive sessions the CLI offers a y/N prompt; on confirmation it runs
+ * `npm install -g <pkg>@latest` for you. The install prefers the China mirror
+ * (registry.npmmirror.com) and falls back to the default registry when the
+ * mirror is unreachable or the install fails. Development installs (`npm link`)
+ * are never touched.
+ *
+ * Opt out of checks with MAW_NO_UPDATE_CHECK / CODER_NO_UPDATE_CHECK /
+ * NO_UPDATE_NOTIFIER, or implicitly in CI and non-TTY sessions. Opt out of
+ * self-updates with MAW_NO_SELF_UPDATE / CODER_NO_SELF_UPDATE.
+ */
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, resolve, sep } from 'node:path';
+import { createRequire } from 'node:module';
+import { createInterface } from 'node:readline';
+import { atomicReplaceFile } from './runtime/file-lock.js';
+const require = createRequire(import.meta.url);
+const pkg = require('../package.json');
+const PKG_NAME = pkg.name ?? 'tokenmaw';
+const REGISTRY_URL = 'https://registry.npmjs.org';
+const NPM_MIRROR_REGISTRY = 'https://registry.npmmirror.com';
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const REQUEST_TIMEOUT_MS = 3_000;
+const INSTALL_TIMEOUT_MS = 5 * 60 * 1000;
+const PROMPT_TIMEOUT_MS = 30_000;
+function cacheFilePath() {
+    const base = process.env.CODER_DATA_HOME?.trim() || resolve(homedir(), '.coder');
+    return resolve(base, 'cache', 'update-check.json');
+}
+function updateCheckDisabled() {
+    // Note: CI is intentionally NOT checked here. The library must stay testable
+    // under test runners that set CI=true; the CLI call site gates on isTTY,
+    // which already suppresses notices on non-interactive environments.
+    return ['MAW_NO_UPDATE_CHECK', 'CODER_NO_UPDATE_CHECK', 'NO_UPDATE_NOTIFIER']
+        .some((name) => {
+        const value = process.env[name];
+        return value !== undefined && value !== '0' && value.toLowerCase() !== 'false';
+    });
+}
+export function parseSemver(version) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(version.trim());
+    if (!match)
+        return null;
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2]),
+        patch: Number(match[3]),
+        prerelease: match[4] ? match[4].split('.') : [],
+    };
+}
+/** Semver ordering: negative when a < b, positive when a > b, 0 when equal. */
+export function compareSemver(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (!pa || !pb)
+        return 0;
+    for (const part of ['major', 'minor', 'patch']) {
+        if (pa[part] !== pb[part])
+            return pa[part] > pb[part] ? 1 : -1;
+    }
+    const [preA, preB] = [pa.prerelease, pb.prerelease];
+    if (preA.length === 0 && preB.length === 0)
+        return 0;
+    if (preA.length === 0)
+        return 1;
+    if (preB.length === 0)
+        return -1;
+    const len = Math.max(preA.length, preB.length);
+    for (let i = 0; i < len; i++) {
+        const x = preA[i];
+        const y = preB[i];
+        if (x === undefined)
+            return -1;
+        if (y === undefined)
+            return 1;
+        if (x === y)
+            continue;
+        const xNumeric = /^\d+$/.test(x);
+        const yNumeric = /^\d+$/.test(y);
+        if (xNumeric && yNumeric)
+            return Number(x) > Number(y) ? 1 : -1;
+        if (xNumeric)
+            return -1;
+        if (yNumeric)
+            return 1;
+        return x > y ? 1 : -1;
+    }
+    return 0;
+}
+export function formatUpdateNotice(result) {
+    return [
+        `Update available ${result.current} → ${result.latest}`,
+        `Run \`npm install -g ${result.packageName}@latest\` to update.`,
+        'Disable with MAW_NO_UPDATE_CHECK=1.',
+    ].join('\n');
+}
+/**
+ * True when the running CLI is a development install (`npm link` or a direct
+ * checkout). Overwriting those with a global install would silently orphan
+ * local code, so self-update refuses and the notice stays manual.
+ */
+export function isDevelopmentInstall() {
+    if (process.env.MAW_DEV_INSTALL === '1' || process.env.CODER_DEV_INSTALL === '1')
+        return true;
+    try {
+        return !require.resolve('../package.json').split(sep).includes('node_modules');
+    }
+    catch {
+        return false;
+    }
+}
+function selfUpdateDisabled() {
+    return ['MAW_NO_SELF_UPDATE', 'CODER_NO_SELF_UPDATE'].some((name) => {
+        const value = process.env[name];
+        return value !== undefined && value !== '0' && value.toLowerCase() !== 'false';
+    });
+}
+function spawnNpm(command, args, timeoutMs, spawnImpl) {
+    return new Promise((resolveSpawn) => {
+        // shell on win32 lets Node resolve npm.cmd; on POSIX the args are fixed
+        // constants so no shell interpretation is possible.
+        const child = spawnImpl(command, args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            shell: process.platform === 'win32',
+        });
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        const finishSpawn = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolveSpawn({ code, stdout, stderr });
+        };
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            finishSpawn(null);
+        }, timeoutMs);
+        child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+        child.stderr?.on('data', (chunk) => { stderr += String(chunk); });
+        child.on('error', () => finishSpawn(null));
+        child.on('close', (code) => finishSpawn(code));
+    });
+}
+function lastLine(text) {
+    const lines = text.trim().split('\n');
+    return lines[lines.length - 1] ?? '';
+}
+/**
+ * Probes a registry before installing from it so a blocked mirror degrades to
+ * the default registry quickly instead of letting npm hang on timeouts.
+ */
+async function registryReachable(packageName, registry, fetchImpl) {
+    try {
+        const response = await fetchImpl(`${registry}/${encodeURIComponent(packageName)}/latest`, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Installs the latest release globally via npm, preferring the China mirror
+ * (registry.npmmirror.com). Falls back to the default registry when the mirror
+ * is unreachable or its install fails. Never throws: failures are reported in
+ * the result so callers can keep the session running.
+ */
+export async function selfUpdate(options = {}) {
+    const current = pkg.version ?? '0.0.0';
+    const target = options.version ?? 'latest';
+    const packageName = options.packageName ?? PKG_NAME;
+    const npmCommand = options.npmCommand ?? 'npm';
+    const spawnImpl = options.spawnImpl ?? spawn;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS;
+    const errors = [];
+    const fail = (message) => ({
+        ok: false, from: current, to: target, registry: '', errors: [...errors, message],
+    });
+    const devInstall = options.devInstall ?? isDevelopmentInstall();
+    if (devInstall) {
+        return fail('dev install detected (npm link); self-update skipped to avoid overwriting local code');
+    }
+    if (selfUpdateDisabled())
+        return fail('self-update disabled via MAW_NO_SELF_UPDATE');
+    const defaultRegistry = (options.registryUrl ?? REGISTRY_URL).replace(/\/$/, '');
+    const mirror = options.mirrorUrl === undefined ? NPM_MIRROR_REGISTRY : options.mirrorUrl;
+    const candidates = [mirror, defaultRegistry]
+        .filter((registry) => Boolean(registry))
+        .filter((registry, index, all) => all.indexOf(registry) === index);
+    for (const registry of candidates) {
+        if (!(await registryReachable(packageName, registry, fetchImpl))) {
+            errors.push(`${registry}: unreachable`);
+            continue;
+        }
+        const install = await spawnNpm(npmCommand, ['install', '-g', '--no-fund', '--no-audit', '--registry', registry, `${packageName}@${target}`], timeoutMs, spawnImpl);
+        if (install.code === 0) {
+            return { ok: true, from: current, to: target, registry, errors };
+        }
+        errors.push(`${registry}: npm exit ${install.code ?? 'killed'}${install.stderr.trim() ? ` — ${lastLine(install.stderr)}` : ''}`);
+    }
+    return { ok: false, from: current, to: target, registry: '', errors };
+}
+/**
+ * Asks `Update now? [y/N]` on the real stdin/stdout after the TUI has shut
+ * down. Defaults to no; only y/yes (any case) accepts. A 30s timeout or EOF
+ * also declines, and stdin that is already gone skips the prompt entirely.
+ */
+export async function promptForUpdate(input = process.stdin, output = process.stdout, allowSelfUpdateOverride) {
+    if (selfUpdateDisabled())
+        return false;
+    if (!(allowSelfUpdateOverride ?? !isDevelopmentInstall()))
+        return false;
+    if (!input.readable)
+        return false;
+    // A TTY gets terminal mode so typed input is echoed; pipes (tests, CI) fall
+    // back to plain line reading.
+    const terminal = Boolean(input.isTTY);
+    const rl = createInterface({ input, output, terminal });
+    const answer = await new Promise((resolvePrompt) => {
+        const timeout = setTimeout(() => {
+            output.write('\n');
+            rl.close();
+            resolvePrompt('');
+        }, PROMPT_TIMEOUT_MS);
+        rl.question('Update now? [y/N] ', (text) => {
+            clearTimeout(timeout);
+            resolvePrompt(text);
+        });
+        rl.on('close', () => {
+            clearTimeout(timeout);
+            resolvePrompt('');
+        });
+    });
+    rl.close();
+    return /^\s*(y|yes)\s*$/i.test(answer);
+}
+/**
+ * End-to-end interactive flow: ask, and on confirmation self-update. Returns
+ * a printable message, or null when nothing happened. Failures leave the
+ * current install untouched and working.
+ */
+export async function offerSelfUpdate(result, input = process.stdin, output = process.stdout, options = {}) {
+    if (!result.updateAvailable)
+        return null;
+    if (selfUpdateDisabled() || (options.devInstall ?? isDevelopmentInstall()))
+        return null;
+    const accepted = await promptForUpdate(input, output, options.devInstall === undefined ? undefined : !options.devInstall);
+    if (!accepted)
+        return null;
+    output.write(`Updating ${result.packageName} to ${result.latest} via npm (China mirror first)...\n`);
+    const outcome = await selfUpdate({ ...options, version: options.version ?? result.latest });
+    if (outcome.ok) {
+        return [
+            `Updated ${result.packageName} ${result.current} → ${result.latest} (from ${outcome.registry}).`,
+            'Restart with `maw` to use the new version.',
+        ].join('\n');
+    }
+    return [
+        `Update to ${result.latest} failed:`,
+        ...outcome.errors.map((error) => `  - ${error}`),
+        `Run \`npm install -g ${result.packageName}@latest\` manually.`,
+    ].join('\n');
+}
+async function fetchLatestVersion(registryUrl, fetchImpl) {
+    const url = `${registryUrl}/${encodeURIComponent(PKG_NAME)}/latest`;
+    const response = await fetchImpl(url, {
+        headers: { accept: 'application/json' },
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (!response.ok)
+        return null;
+    const manifest = (await response.json());
+    return typeof manifest.version === 'string' ? manifest.version : null;
+}
+/**
+ * Checks npm for a newer release at most once per day (cached in
+ * CODER_DATA_HOME). Returns null when disabled, offline, up to date, or on
+ * any error — update checks must never break the CLI.
+ */
+export async function checkForUpdate(options = {}) {
+    const current = pkg.version ?? '0.0.0';
+    if (updateCheckDisabled())
+        return null;
+    const path = options.cacheFile ?? cacheFilePath();
+    const registryUrl = (options.registryUrl ?? REGISTRY_URL).replace(/\/$/, '');
+    const fetchImpl = options.fetchImpl ?? fetch;
+    let cached = null;
+    try {
+        const parsed = JSON.parse(await readFile(path, 'utf8'));
+        if (typeof parsed.checkedAt === 'number' && typeof parsed.latest === 'string')
+            cached = parsed;
+    }
+    catch {
+        cached = null;
+    }
+    let latest = null;
+    if (!options.force && cached && Date.now() - cached.checkedAt < CHECK_INTERVAL_MS) {
+        latest = cached.latest;
+    }
+    else {
+        latest = await fetchLatestVersion(registryUrl, fetchImpl).catch(() => null);
+        if (latest) {
+            const entry = { checkedAt: Date.now(), latest };
+            await mkdir(dirname(path), { recursive: true });
+            await atomicReplaceFile(path, `${JSON.stringify(entry, null, 2)}\n`).catch(async () => {
+                await writeFile(path, `${JSON.stringify(entry, null, 2)}\n`).catch(() => undefined);
+            });
+        }
+    }
+    if (!latest)
+        return null;
+    return {
+        packageName: PKG_NAME,
+        current,
+        latest,
+        updateAvailable: compareSemver(latest, current) > 0,
+    };
+}

package/docs/architecture-revision.md

@@ -263,7 +263,7 @@ TUI 不再模拟任务管理器，而采用现代桌面聊天应用布局：
 - [ ] main 的“相关工作复用还是新建 coordinator”由 LLM/spec 决定，Runtime 尚未提供语义相似度或去重兜底。
 - [ ] TUI 已现代化但仍是 Blessed 单体界面，尚未拆成可复用组件；暂不提供 Web 客户端。
 - [ ] 多用户、多进程服务化和远程 agent 执行尚未实现。
-- [ ] Agent 级 token/cost 统计和完整 trace 导出尚未实现。
+- [x] Agent 级 token/延迟统计已记录并在 TUI 状态栏展示；完整 trace 导出仍待后续补充。
 
 ## 10. 验收标准
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaw",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "type": "module",
   "files": [
     "dist",
@@ -11,7 +11,7 @@
   ],
   "scripts": {
     "clean": "node -e \"const fs=require('fs'),path=require('path'),p=path.resolve('dist');if(path.basename(p)!=='dist')throw new Error('unsafe clean target');fs.rmSync(p,{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
+    "build": "npm run clean && tsc -p tsconfig.json && node -e \"const fs=require('fs');const p='dist/cli.js';if(fs.existsSync(p))fs.chmodSync(p,0o755)\"",
     "start": "node dist/cli.js",
     "dev": "tsx src/cli.ts",
     "test": "node --import tsx/esm --test tests/*.test.ts tests/**/*.test.ts",
@@ -43,5 +43,11 @@
     "coder": "dist/cli.js",
     "coding-agent": "dist/cli.js"
   },
-  "description": "TUI-first, document-driven multi-agent coding runtime"
+  "description": "TUI-first, document-driven multi-agent coding runtime",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/elyar-adil/coder.git"
+  },
+  "homepage": "https://github.com/elyar-adil/coder#readme",
+  "bugs": "https://github.com/elyar-adil/coder/issues"
 }